@pieai/pro-gov 0.5.1 → 0.5.2

package/dist/cli.js

@@ -2903,7 +2903,7 @@ function validatePortfolioManifest(value) {
       continue;
     }
     validateEndpoint(target, "targets", issues, technologyCatalog);
-    validateAllowedFields(target, "target", ["id", "path", "profile", "assetBundles", "projectType", "capabilities", "boundary", "technologyExceptions"], issues);
+    validateAllowedFields(target, "target", ["id", "path", "profile", "assetBundles", "projectType", "capabilities", "boundary", "technologyExceptions", "environmentPolicy"], issues);
     if (typeof target.id === "string") {
       if (seenTargetIds.has(target.id)) {
         issues.push({
@@ -2962,7 +2962,7 @@ function validateEndpoint(value, field, issues, technologyCatalog) {
   validateAllowedFields(
     value,
     field,
-    field === "targets" ? ["id", "path", "profile", "assetBundles", "projectType", "capabilities", "boundary", "technologyExceptions"] : ["id", "path", "projectType", "capabilities", "boundary", "technologyExceptions"],
+    field === "targets" ? ["id", "path", "profile", "assetBundles", "projectType", "capabilities", "boundary", "technologyExceptions", "environmentPolicy"] : ["id", "path", "projectType", "capabilities", "boundary", "technologyExceptions", "environmentPolicy"],
     issues
   );
   if (typeof value.id !== "string" || value.id.length === 0) {
@@ -3080,6 +3080,14 @@ function isRepositoryRelativePath(value) {
   const segments = value.replaceAll("\\", "/").split("/");
   return !segments.includes("..");
 }
+function isExactRepositoryRelativePath(value) {
+  if (value.length === 0) return false;
+  if (isAbsolute3(value)) return false;
+  if (/^[A-Za-z]:[\\/]/.test(value) || value.startsWith("\\\\") || value.startsWith("//")) return false;
+  if (value.includes("\\")) return false;
+  const segments = value.split("/");
+  return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
 function validateRepositoryGovernance(value, field, catalog, issues) {
   const id = typeof value.id === "string" ? value.id : void 0;
   if (value.projectType !== void 0 && (typeof value.projectType !== "string" || !catalog.projectTypes.has(value.projectType))) {
@@ -3113,6 +3121,53 @@ function validateRepositoryGovernance(value, field, catalog, issues) {
       if (typeof exception.reason !== "string" || exception.reason.length === 0) issues.push({ type: "invalid-field", id, field: `${field}.technologyExceptions.reason`, message: "Technology exception reason must be non-empty." });
     }
   }
+  validateEnvironmentPolicy(value.environmentPolicy, field, id, issues);
+}
+function validateEnvironmentPolicy(value, field, id, issues) {
+  if (value === void 0) return;
+  if (!isRecord(value)) {
+    issues.push({ type: "invalid-field", id, field: `${field}.environmentPolicy`, message: "Repository environmentPolicy must be an object." });
+    return;
+  }
+  validateAllowedFields(value, "environmentPolicy", ["localOnly"], issues);
+  if (value.localOnly === void 0) return;
+  if (!Array.isArray(value.localOnly)) {
+    issues.push({ type: "invalid-field", id, field: `${field}.environmentPolicy.localOnly`, message: "environmentPolicy.localOnly must be an array." });
+    return;
+  }
+  const seenPaths = /* @__PURE__ */ new Set();
+  for (const entry of value.localOnly) {
+    if (!isRecord(entry)) {
+      issues.push({ type: "invalid-field", id, field: `${field}.environmentPolicy.localOnly`, message: "environmentPolicy.localOnly entry must be an object." });
+      continue;
+    }
+    validateAllowedFields(entry, "environmentPolicy.localOnly", ["path", "reason"], issues);
+    if (typeof entry.path !== "string" || !isExactRepositoryRelativePath(entry.path)) {
+      issues.push({
+        type: "invalid-field",
+        id,
+        field: `${field}.environmentPolicy.localOnly.path`,
+        message: `environmentPolicy.localOnly path must be an exact repository-relative path without absolute, backslash, empty, '.', or '..' segments: ${String(entry.path)}`
+      });
+    } else if (seenPaths.has(entry.path)) {
+      issues.push({
+        type: "invalid-field",
+        id,
+        field: `${field}.environmentPolicy.localOnly.path`,
+        message: `Duplicate environmentPolicy.localOnly path: ${entry.path}`
+      });
+    } else {
+      seenPaths.add(entry.path);
+    }
+    if (typeof entry.reason !== "string" || entry.reason.trim().length === 0) {
+      issues.push({
+        type: "invalid-field",
+        id,
+        field: `${field}.environmentPolicy.localOnly.reason`,
+        message: "environmentPolicy.localOnly reason must be a non-empty string."
+      });
+    }
+  }
 }
 function validateHostTooling(value, issues) {
   if (value === void 0) return;
@@ -3600,7 +3655,7 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
     claudeCode: jsonObjectKeys(join20(root, ".claude/settings.json"), "mcpServers"),
     codex: tomlMcpNames(join20(root, ".codex/config.toml"))
   };
-  const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository);
+  const secrets = inspectRepositorySecrets(root, endpoint.id, secretsRoot, git.isRepository, endpoint.environmentPolicy);
   const projectModel = inspectProjectModel(root, endpoint, technologyGovernance);
   const recommendations = [];
   if (!git.isRepository) recommendations.push("\u8BE5\u8DEF\u5F84\u4E0D\u662F Git \u4ED3\u5E93\uFF1B\u786E\u8BA4\u6E05\u5355\u8DEF\u5F84\u662F\u5426\u6B63\u786E\u3002");
@@ -3622,9 +3677,10 @@ function inspectRepository(endpoint, role, secretsRoot, expectedPackageVersion,
   if (skills.claudeCompatibility === "dangling-symlink") recommendations.push("`.claude/skills` \u662F\u65AD\u5F00\u7684\u94FE\u63A5\u3002");
   if (hasWorkflowReminderHooks(hooks)) recommendations.push("\u53D1\u73B0 Stop/SubagentStop hook\uFF1B\u786E\u8BA4\u5B83\u662F\u5426\u4ECD\u6709\u9879\u76EE\u4E13\u5C5E\u7528\u9014\uFF0C\u5E76\u79FB\u9664\u9000\u4F11\u7684 PGS \u5DE5\u4F5C\u6D41\u63D0\u9192\u3002");
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
+  const envNeedsCentralReview = liveEnv.filter((file) => !file.localOnly);
   if (liveEnv.some((file) => file.tracked)) recommendations.push("\u53D1\u73B0\u88AB Git \u8DDF\u8E2A\u7684\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\uFF1B\u5E94\u7ACB\u5373\u786E\u8BA4\u5176\u4E2D\u662F\u5426\u5305\u542B\u51ED\u636E\u5E76\u8FC1\u51FA\u4ED3\u5E93\u3002");
-  if (liveEnv.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
-  else if (liveEnv.some((file) => !file.centralized)) recommendations.push("\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002");
+  if (envNeedsCentralReview.length > 0 && secrets.centralDirectory === "absent") recommendations.push("\u4ED3\u5E93\u6709\u672C\u5730\u73AF\u5883\u6587\u4EF6\uFF0C\u4F46\u4E2D\u592E `.secrets` \u4E2D\u6CA1\u6709\u5BF9\u5E94\u76EE\u5F55\uFF1B\u786E\u8BA4\u662F\u5426\u9700\u8981\u7EB3\u5165\u5206\u5C42\u7BA1\u7406\u3002");
+  else if (envNeedsCentralReview.some((file) => !file.centralized)) recommendations.push("\u53D1\u73B0\u771F\u5B9E\u73AF\u5883\u6587\u4EF6\u5C1A\u672A\u8FDE\u63A5\u5230\u672C\u9879\u76EE\u7684\u4E2D\u592E `.secrets` \u76EE\u5F55\uFF1B\u533A\u5206\u53EF\u4E22\u5F03\u751F\u6210\u7269\u4E0E\u672C\u5730\u4E3B\u6765\u6E90\uFF0C\u9700\u4FDD\u7559\u7684\u6765\u6E90\u5E94\u96C6\u4E2D\u540E\u518D\u63A5\u56DE\u9879\u76EE\u3002");
   if (hasUnsafeCentralSecretPermissions(secrets)) recommendations.push("\u4E2D\u592E\u5BC6\u94A5\u76EE\u5F55\u6216\u6587\u4EF6\u6743\u9650\u8FC7\u5BBD\uFF1B\u76EE\u5F55\u5E94\u4E3A 0700\uFF0C\u914D\u7F6E\u6587\u4EF6\u5E94\u4E3A 0600\u3002");
   if (!docs.packages.aligned) recommendations.push(`PGS \u5305\u7248\u672C\u672A\u4E0E\u6267\u884C\u5F15\u64CE ${docs.packages.expected ?? "\u672A\u77E5\u7248\u672C"} \u5BF9\u9F50\uFF1B\u53D1\u5E03\u4E0A\u6E38\u540E\u518D\u540C\u6B65\u76EE\u6807\u4ED3\u5E93\u3002`);
   if (role === "target" && !docs.manifest) recommendations.push("\u7F3A\u5C11 docs/governance/MANIFEST.yml\uFF1B\u6587\u6863\u6E05\u5355\u65E0\u6CD5\u8BC1\u660E\u5DF2\u540C\u6B65\u3002");
@@ -3655,7 +3711,7 @@ function deriveStatus(entries, git, hooks, skills, secrets, projectModel, techno
   const missingBaseline = projectModel.baseline.some((technology) => !technology.detected && !hasBaselineException(projectModel, technology.id));
   const missingSelected = projectModel.optionalCapabilities.some((technology) => technology.selected && !technology.detected);
   const liveEnv = secrets.repositoryEnvFiles.filter((file) => !file.template && !file.fixture);
-  const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized);
+  const secretMaterializationNeedsReview = liveEnv.some((file) => !file.centralized && !file.localOnly);
   if (entries.agents !== "pgs-router" || entries.claude !== "agents-symlink" || hasWorkflowReminderHooks(hooks) || skills.claudeCompatibility === "duplicate-directory" || skills.claudeCompatibility === "dangling-symlink" || git.branches.length > 1 || git.worktrees.length > 1 || git.dirtyPaths.length > 0 || (git.ahead ?? 0) > 0 || secretMaterializationNeedsReview || technologyGovernanceConfigured && !projectModel.projectType || missingBaseline || missingSelected) return "attention";
   return "healthy";
 }
@@ -3816,17 +3872,25 @@ function inspectClaudeSkillRoot(root) {
   }
   return stat.isDirectory() ? "duplicate-directory" : "other";
 }
-function inspectRepositorySecrets(root, id, secretsRoot, isRepository) {
+function inspectRepositorySecrets(root, id, secretsRoot, isRepository, environmentPolicy) {
   const centralPath = join20(secretsRoot, id);
   const centralRealPath = safeRealpath(centralPath);
-  const envFiles = collectEnvironmentFiles(root).map((path) => ({
-    path,
-    tracked: isRepository ? gitTracks(root, path) : false,
-    template: isEnvironmentTemplate(path),
-    fixture: isEnvironmentFixture(path),
-    symlink: lstatSync6(join20(root, path)).isSymbolicLink(),
-    centralized: pointsInside(join20(root, path), centralRealPath)
-  }));
+  const localOnlyReasons = new Map(
+    (environmentPolicy?.localOnly ?? []).map((entry) => [entry.path, entry.reason])
+  );
+  const envFiles = collectEnvironmentFiles(root).map((path) => {
+    const localOnlyReason = localOnlyReasons.get(path);
+    return {
+      path,
+      tracked: isRepository ? gitTracks(root, path) : false,
+      template: isEnvironmentTemplate(path),
+      fixture: isEnvironmentFixture(path),
+      symlink: lstatSync6(join20(root, path)).isSymbolicLink(),
+      centralized: pointsInside(join20(root, path), centralRealPath),
+      localOnly: localOnlyReason !== void 0,
+      ...localOnlyReason !== void 0 ? { localOnlyReason } : {}
+    };
+  });
   return {
     centralDirectory: existsSync21(centralPath) ? "present" : "absent",
     centralMode: existsSync21(centralPath) ? modeString(statSync4(centralPath).mode) : void 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pieai/pro-gov",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Project-level distribution kit for Project Governance System.",
   "keywords": [
     "ai-agents",
@@ -35,7 +35,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@pieai/doc-gov": "^0.5.1"
+    "@pieai/doc-gov": "^0.5.2"
   },
   "devDependencies": {
     "@pieai/swimmer-ui-kit": "1.0.1",