@polymorphism-tech/morph-spec 8.29.0 → 8.32.0

package/src/lib/generators/settings-generator.js

@@ -1,209 +1,209 @@
-/**
- * Settings Generator
- *
- * Generates .claude/settings.local.json for projects based on detected
- * stack, MCPs, and morph-spec configuration. Uses _morph_managed marker
- * to track managed entries for safe reset.
- */
-
-import { join } from 'path';
-import { existsSync } from 'fs';
-import { readFile, writeFile, mkdir } from 'fs/promises';
-
-const MORPH_MANAGED_KEY = '_morph_managed';
-
-/**
- * Generate and merge settings for a project
- * @param {string} targetPath - Project root directory
- * @param {Object} detectedConfig - Output from detectClaudeConfig()
- * @param {Object} morphConfig - morph-spec config (from .morph/config/config.json)
- * @returns {Promise<Object>} Generated settings summary
- */
-export async function generateSettings(targetPath, detectedConfig, morphConfig = {}) {
-  const claudeDir = join(targetPath, '.claude');
-  const settingsPath = join(claudeDir, 'settings.local.json');
-
-  // Read existing settings
-  const existing = await readSettingsSafe(settingsPath);
-
-  // Build stack-based permissions
-  const stack = morphConfig?.project?.architecture || 'unknown';
-  const permissions = buildPermissions(stack, detectedConfig);
-
-  // Build generated settings
-  const generated = {};
-
-  if (permissions.length > 0) {
-    generated.permissions = permissions;
-  }
-
-  // Track what we manage
-  const managed = {
-    permissions_added: permissions,
-    mcps_detected: detectedConfig.mcpServers.map(s => s.name),
-    plugins_detected: detectedConfig.plugins.map(p => p.name),
-    generated_at: new Date().toISOString()
-  };
-
-  // Merge without overwriting user config
-  const merged = mergeSettings(existing, generated);
-  merged[MORPH_MANAGED_KEY] = managed;
-
-  // Ensure directory exists
-  if (!existsSync(claudeDir)) {
-    await mkdir(claudeDir, { recursive: true });
-  }
-
-  await writeFile(settingsPath, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
-
-  return {
-    settingsPath,
-    permissionsAdded: permissions.length,
-    managed
-  };
-}
-
-/**
- * Build permission rules based on detected stack
- * @param {string} stack - Detected project stack
- * @param {Object} detectedConfig - Detected Claude config
- * @returns {Array<string>} Permission patterns
- */
-export function buildPermissions(stack, detectedConfig = {}) {
-  const permissions = [];
-
-  // Stack-based permissions
-  const stackPermissions = {
-    nodejs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    typescript: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)', 'Bash(tsc:*)'],
-    nextjs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    react: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    vue: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    dotnet: ['Bash(dotnet:*)', 'Bash(nuget:*)'],
-    python: ['Bash(python:*)', 'Bash(pip:*)', 'Bash(pytest:*)'],
-    go: ['Bash(go:*)']
-  };
-
-  if (stackPermissions[stack]) {
-    permissions.push(...stackPermissions[stack]);
-  }
-
-  // morph-spec CLI always needs node/npx
-  if (!permissions.includes('Bash(npx:*)')) {
-    permissions.push('Bash(npx:*)');
-  }
-
-  return permissions;
-}
-
-/**
- * Deep merge settings without overwriting user entries
- * @param {Object} existing - Current settings.local.json
- * @param {Object} generated - Generated settings to merge
- * @returns {Object} Merged settings
- */
-export function mergeSettings(existing, generated) {
-  const result = { ...existing };
-
-  for (const [key, value] of Object.entries(generated)) {
-    if (key === MORPH_MANAGED_KEY) continue;
-
-    if (Array.isArray(value) && Array.isArray(result[key])) {
-      // Merge arrays without duplicates
-      const set = new Set(result[key]);
-      for (const item of value) {
-        set.add(item);
-      }
-      result[key] = [...set];
-    } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
-      // Recursively merge objects
-      result[key] = mergeSettings(result[key] || {}, value);
-    } else if (!(key in result)) {
-      // Only add new keys, never overwrite existing
-      result[key] = value;
-    }
-  }
-
-  return result;
-}
-
-/**
- * Remove only morph-spec managed entries from settings
- * @param {string} settingsPath - Path to settings.local.json
- * @returns {Promise<Object>} Summary of what was removed
- */
-export async function resetMorphSettings(settingsPath) {
-  if (!existsSync(settingsPath)) {
-    return { removed: false, reason: 'file not found' };
-  }
-
-  const settings = await readSettingsSafe(settingsPath);
-  const managed = settings[MORPH_MANAGED_KEY];
-
-  if (!managed) {
-    return { removed: false, reason: 'no _morph_managed section found' };
-  }
-
-  // Remove managed permissions
-  if (managed.permissions_added && Array.isArray(settings.permissions)) {
-    settings.permissions = settings.permissions.filter(
-      p => !managed.permissions_added.includes(p)
-    );
-    if (settings.permissions.length === 0) {
-      delete settings.permissions;
-    }
-  }
-
-  // Remove the managed marker itself
-  delete settings[MORPH_MANAGED_KEY];
-
-  // Write back
-  await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
-
-  return {
-    removed: true,
-    permissionsRemoved: managed.permissions_added || [],
-    previouslyGenerated: managed.generated_at
-  };
-}
-
-/**
- * Save integrations.json with detected config
- * @param {string} targetPath - Project root directory
- * @param {Object} detectedConfig - Output from detectClaudeConfig()
- */
-export async function saveIntegrations(targetPath, detectedConfig) {
-  const integrationsPath = join(targetPath, '.morph', 'config', 'integrations.json');
-  const integrationsDir = join(targetPath, '.morph', 'config');
-
-  if (!existsSync(integrationsDir)) {
-    await mkdir(integrationsDir, { recursive: true });
-  }
-
-  const integrations = {
-    version: '1.0.0',
-    detectedAt: new Date().toISOString(),
-    plugins: detectedConfig.plugins,
-    mcpServers: detectedConfig.mcpServers,
-    superpowers: detectedConfig.superpowers,
-    customSkills: detectedConfig.customSkills.length,
-    customCommands: detectedConfig.customCommands.length,
-    hooks: detectedConfig.hooks.length
-  };
-
-  await writeFile(integrationsPath, JSON.stringify(integrations, null, 2) + '\n', 'utf-8');
-  return integrationsPath;
-}
-
-// ============================================================================
-// Helpers
-// ============================================================================
-
-async function readSettingsSafe(settingsPath) {
-  try {
-    if (!existsSync(settingsPath)) return {};
-    return JSON.parse(await readFile(settingsPath, 'utf-8'));
-  } catch {
-    return {};
-  }
-}
+/**
+ * Settings Generator
+ *
+ * Generates .claude/settings.local.json for projects based on detected
+ * stack, MCPs, and morph-spec configuration. Uses _morph_managed marker
+ * to track managed entries for safe reset.
+ */
+
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { readFile, writeFile, mkdir } from 'fs/promises';
+
+const MORPH_MANAGED_KEY = '_morph_managed';
+
+/**
+ * Generate and merge settings for a project
+ * @param {string} targetPath - Project root directory
+ * @param {Object} detectedConfig - Output from detectClaudeConfig()
+ * @param {Object} morphConfig - morph-spec config (from .morph/config/config.json)
+ * @returns {Promise<Object>} Generated settings summary
+ */
+export async function generateSettings(targetPath, detectedConfig, morphConfig = {}) {
+  const claudeDir = join(targetPath, '.claude');
+  const settingsPath = join(claudeDir, 'settings.local.json');
+
+  // Read existing settings
+  const existing = await readSettingsSafe(settingsPath);
+
+  // Build stack-based permissions
+  const stack = morphConfig?.project?.architecture || 'unknown';
+  const permissions = buildPermissions(stack, detectedConfig);
+
+  // Build generated settings
+  const generated = {};
+
+  if (permissions.length > 0) {
+    generated.permissions = permissions;
+  }
+
+  // Track what we manage
+  const managed = {
+    permissions_added: permissions,
+    mcps_detected: detectedConfig.mcpServers.map(s => s.name),
+    plugins_detected: detectedConfig.plugins.map(p => p.name),
+    generated_at: new Date().toISOString()
+  };
+
+  // Merge without overwriting user config
+  const merged = mergeSettings(existing, generated);
+  merged[MORPH_MANAGED_KEY] = managed;
+
+  // Ensure directory exists
+  if (!existsSync(claudeDir)) {
+    await mkdir(claudeDir, { recursive: true });
+  }
+
+  await writeFile(settingsPath, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
+
+  return {
+    settingsPath,
+    permissionsAdded: permissions.length,
+    managed
+  };
+}
+
+/**
+ * Build permission rules based on detected stack
+ * @param {string} stack - Detected project stack
+ * @param {Object} detectedConfig - Detected Claude config
+ * @returns {Array<string>} Permission patterns
+ */
+export function buildPermissions(stack, detectedConfig = {}) {
+  const permissions = [];
+
+  // Stack-based permissions
+  const stackPermissions = {
+    nodejs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    typescript: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)', 'Bash(tsc:*)'],
+    nextjs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    react: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    vue: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    dotnet: ['Bash(dotnet:*)', 'Bash(nuget:*)'],
+    python: ['Bash(python:*)', 'Bash(pip:*)', 'Bash(pytest:*)'],
+    go: ['Bash(go:*)']
+  };
+
+  if (stackPermissions[stack]) {
+    permissions.push(...stackPermissions[stack]);
+  }
+
+  // morph-spec CLI always needs node/npx
+  if (!permissions.includes('Bash(npx:*)')) {
+    permissions.push('Bash(npx:*)');
+  }
+
+  return permissions;
+}
+
+/**
+ * Deep merge settings without overwriting user entries
+ * @param {Object} existing - Current settings.local.json
+ * @param {Object} generated - Generated settings to merge
+ * @returns {Object} Merged settings
+ */
+export function mergeSettings(existing, generated) {
+  const result = { ...existing };
+
+  for (const [key, value] of Object.entries(generated)) {
+    if (key === MORPH_MANAGED_KEY) continue;
+
+    if (Array.isArray(value) && Array.isArray(result[key])) {
+      // Merge arrays without duplicates
+      const set = new Set(result[key]);
+      for (const item of value) {
+        set.add(item);
+      }
+      result[key] = [...set];
+    } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      // Recursively merge objects
+      result[key] = mergeSettings(result[key] || {}, value);
+    } else if (!(key in result)) {
+      // Only add new keys, never overwrite existing
+      result[key] = value;
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Remove only morph-spec managed entries from settings
+ * @param {string} settingsPath - Path to settings.local.json
+ * @returns {Promise<Object>} Summary of what was removed
+ */
+export async function resetMorphSettings(settingsPath) {
+  if (!existsSync(settingsPath)) {
+    return { removed: false, reason: 'file not found' };
+  }
+
+  const settings = await readSettingsSafe(settingsPath);
+  const managed = settings[MORPH_MANAGED_KEY];
+
+  if (!managed) {
+    return { removed: false, reason: 'no _morph_managed section found' };
+  }
+
+  // Remove managed permissions
+  if (managed.permissions_added && Array.isArray(settings.permissions)) {
+    settings.permissions = settings.permissions.filter(
+      p => !managed.permissions_added.includes(p)
+    );
+    if (settings.permissions.length === 0) {
+      delete settings.permissions;
+    }
+  }
+
+  // Remove the managed marker itself
+  delete settings[MORPH_MANAGED_KEY];
+
+  // Write back
+  await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
+
+  return {
+    removed: true,
+    permissionsRemoved: managed.permissions_added || [],
+    previouslyGenerated: managed.generated_at
+  };
+}
+
+/**
+ * Save integrations.json with detected config
+ * @param {string} targetPath - Project root directory
+ * @param {Object} detectedConfig - Output from detectClaudeConfig()
+ */
+export async function saveIntegrations(targetPath, detectedConfig) {
+  const integrationsPath = join(targetPath, '.morph', 'config', 'integrations.json');
+  const integrationsDir = join(targetPath, '.morph', 'config');
+
+  if (!existsSync(integrationsDir)) {
+    await mkdir(integrationsDir, { recursive: true });
+  }
+
+  const integrations = {
+    version: '1.0.0',
+    detectedAt: new Date().toISOString(),
+    plugins: detectedConfig.plugins,
+    mcpServers: detectedConfig.mcpServers,
+    superpowers: detectedConfig.superpowers,
+    customSkills: detectedConfig.customSkills.length,
+    customCommands: detectedConfig.customCommands.length,
+    hooks: detectedConfig.hooks.length
+  };
+
+  await writeFile(integrationsPath, JSON.stringify(integrations, null, 2) + '\n', 'utf-8');
+  return integrationsPath;
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+async function readSettingsSafe(settingsPath) {
+  try {
+    if (!existsSync(settingsPath)) return {};
+    return JSON.parse(await readFile(settingsPath, 'utf-8'));
+  } catch {
+    return {};
+  }
+}

package/src/lib/git/branch-classifier.js

@@ -0,0 +1,177 @@
+/**
+ * branch-classifier.js — answer "is this branch's work already in the default
+ * branch?" for a repository that squash-merges.
+ *
+ * WHY THIS EXISTS: a squash-merge puts the WORK in `origin/master` while
+ * leaving none of the branch's own commits reachable from it. So
+ * `git branch --merged origin/master` does not list the branch, and
+ * `git branch -d` refuses it as unmerged. The only remaining command is
+ * `git branch -D`, which is byte-identical to the command that discards real,
+ * never-integrated work — the tool gives the user no way to tell the two apart,
+ * and after enough of these the habit becomes "just -D it", which is how work
+ * gets lost.
+ *
+ * Every branch lands in exactly one class, and only the two MERGED ones are
+ * ever deletable:
+ *
+ *   merged-ancestral — git itself proves it: the branch tip is an ancestor of
+ *                      the default. A plain merge, or a fast-forward.
+ *   merged-squash    — git cannot see it, but the evidence is positive: either
+ *                      GitHub reports the PR as MERGED, or the branch's tree is
+ *                      IDENTICAL to the default's (every change it carries is
+ *                      already there under a different commit).
+ *   open             — a PR is OPEN for it. Never deleted: the PR is the whole
+ *                      reason the branch must survive.
+ *   in-worktree      — checked out by a live worktree. Never deleted.
+ *   unmerged         — none of the above could be PROVEN. This is the fail-safe
+ *                      default and covers "no `gh`", "no origin", and "genuinely
+ *                      unintegrated work" alike, because from here they are the
+ *                      same thing: not proven integrated.
+ *
+ * Nothing here mutates. `pruneBranches` in commands/project/branch.js does the
+ * deleting, and it deletes ONLY what this file classified as merged.
+ */
+
+import { execFileSync } from 'child_process';
+
+function git(args, cwd) {
+  return execFileSync('git', args, { cwd, stdio: 'pipe' }).toString();
+}
+
+/**
+ * Local branches with their tips. Excludes nothing — the caller decides.
+ *
+ * @returns {Array<{ name: string, sha: string, current: boolean, worktreePath: string|null }>}
+ */
+export function listLocalBranches(cwd) {
+  try {
+    const out = git(['for-each-ref', '--format=%(refname:short)%09%(objectname)%09%(HEAD)%09%(worktreepath)', 'refs/heads/'], cwd);
+    return out.split('\n').filter(Boolean).map((line) => {
+      const [name, sha, head, worktreePath] = line.split('\t');
+      return { name, sha, current: head === '*', worktreePath: worktreePath || null };
+    });
+  } catch {
+    return [];
+  }
+}
+
+/** Is `ancestor` reachable from `descendant`? False on any git error. */
+function isAncestor(ancestor, descendant, cwd) {
+  try {
+    git(['merge-base', '--is-ancestor', ancestor, descendant], cwd);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Does the branch introduce NOTHING the base does not already have?
+ *
+ * `git diff --quiet <base> <branch>` compares the two TREES: an empty diff
+ * means every file the branch touched already reads exactly as the branch left
+ * it in the base. That is precisely the state a squash-merge produces, and it
+ * is a positive proof rather than an inference from history shape.
+ *
+ * Deliberately NOT `base...branch` (the three-dot form diffs against the merge
+ * base, which for a squash-merged branch still shows the branch's own changes).
+ *
+ * Fail-CLOSED: any git error reads as "introduces something", never as merged.
+ */
+function treeIsIdentical(base, branch, cwd) {
+  try {
+    execFileSync('git', ['diff', '--quiet', base, branch], { cwd, stdio: 'pipe' });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * How many commits the branch carries that the base does not. Used only for
+ * REPORTING — the classification never turns on it, because a squash-merged
+ * branch legitimately has commits ahead while carrying no unintegrated work.
+ *
+ * @returns {number|null} null when it cannot be computed
+ */
+export function commitsAhead(base, branch, cwd) {
+  try {
+    const out = git(['rev-list', '--count', `${base}..${branch}`], cwd).trim();
+    const n = Number(out);
+    return Number.isFinite(n) ? n : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the ref to compare against: `origin/<default>` when the remote-tracking
+ * ref exists (the authority on what has actually landed), else the local branch.
+ *
+ * @returns {string|null} null when neither resolves — the caller must then
+ *   classify everything as `unmerged`, because there is no baseline to prove
+ *   integration against.
+ */
+export function resolveBaseRef(defaultBranch, cwd) {
+  if (!defaultBranch) return null;
+  for (const ref of [`refs/remotes/origin/${defaultBranch}`, `refs/heads/${defaultBranch}`]) {
+    try {
+      git(['show-ref', '--verify', '--quiet', ref], cwd);
+      return ref.replace(/^refs\/(remotes|heads)\//, '');
+    } catch { /* try the next */ }
+  }
+  return null;
+}
+
+/**
+ * Classify one branch. Pure decision logic over already-gathered facts, so the
+ * table above is testable without a GitHub account.
+ *
+ * ORDER IS THE POLICY, and the two protective classes come FIRST: a branch that
+ * is checked out, or that carries an OPEN PR, is never deleted even if its tree
+ * happens to match the base — a PR being open means a human still has business
+ * with it.
+ *
+ * @param {object} b - from listLocalBranches
+ * @param {{ baseRef: string|null, cwd: string, pr: {number:number,state:string}|null|undefined }} ctx
+ * @returns {{ name: string, kind: string, reason: string, pr: number|null, ahead: number|null, deletable: boolean }}
+ */
+export function classifyBranch(b, { baseRef, cwd, pr }) {
+  const prNum = pr?.number ?? null;
+  const mk = (kind, reason, deletable) => ({
+    name: b.name, kind, reason, pr: prNum, ahead: baseRef ? commitsAhead(baseRef, b.name, cwd) : null, deletable,
+  });
+
+  if (b.current || b.worktreePath) {
+    return mk('in-worktree', b.current ? 'é a branch atual (HEAD)' : `está em uso pelo worktree ${b.worktreePath}`, false);
+  }
+  if (pr?.state === 'OPEN') {
+    return mk('open', `PR #${prNum} está OPEN — a branch é o que o PR aponta`, false);
+  }
+  if (!baseRef) {
+    return mk('unmerged', 'não há branch default resolvível (origin/HEAD, main ou master) para comparar', false);
+  }
+  if (isAncestor(b.name, baseRef, cwd)) {
+    return mk('merged-ancestral', `já é ancestral de ${baseRef}`, true);
+  }
+  if (pr?.state === 'MERGED') {
+    return mk('merged-squash', `PR #${prNum} está MERGED (squash-merge: os commits não entram em ${baseRef}, o trabalho sim)`, true);
+  }
+  if (treeIsIdentical(baseRef, b.name, cwd)) {
+    return mk('merged-squash', `a árvore é idêntica à de ${baseRef} — tudo que a branch muda já está lá`, true);
+  }
+  return mk('unmerged', `carrega mudanças que não estão em ${baseRef} e nenhum PR MERGED comprova o contrário`, false);
+}
+
+/**
+ * Classify every local branch except the default itself.
+ *
+ * @param {{ cwd: string, defaultBranch: string|null, prIndex: Map|null }} ctx
+ * @returns {Array} one entry per branch, in `for-each-ref` order
+ */
+export function classifyBranches({ cwd, defaultBranch, prIndex }) {
+  const baseRef = resolveBaseRef(defaultBranch, cwd);
+  return listLocalBranches(cwd)
+    .filter((b) => b.name !== defaultBranch)
+    .map((b) => classifyBranch(b, { baseRef, cwd, pr: prIndex?.get(b.name) ?? null }));
+}

package/src/lib/git/gh.js

@@ -0,0 +1,30 @@
+/**
+ * gh.js — como o `gh` é invocado, num lugar só.
+ *
+ * Extraído de `finish.js`, onde nasceu, porque o `pr-index.js` chamava `'gh'`
+ * cru: o caminho de SUCESSO do índice era intestável, já que não havia por
+ * onde injetar um stub. Duas formas de chamar o mesmo binário também são duas
+ * formas de discordar sobre qual binário é.
+ */
+
+/**
+ * Resolve a invocação do `gh`. Por padrão, o `gh` do PATH. Sobrescrevível via
+ * MORPH_GH_BIN: uma string simples nomeia outro binário (um wrapper corporativo,
+ * `hub`, …); um array JSON é um prefixo de argv COMPLETO — por exemplo
+ * `["/path/to/node","/path/to/gh-shim.js"]` — que é como os testes injetam um
+ * stub cross-platform que o execFileSync consegue spawnar (Node ≥20 recusa
+ * rodar shims `.cmd`/`.bat` sem `shell:true`, e `shell:true` reabriria o buraco
+ * de injeção de argumento que estes caminhos evitam).
+ *
+ * @returns {{ bin: string, prefix: string[] }}
+ */
+export function resolveGh() {
+  const raw = process.env.MORPH_GH_BIN;
+  if (raw && raw.trim().startsWith('[')) {
+    try {
+      const arr = JSON.parse(raw);
+      if (Array.isArray(arr) && arr.length) return { bin: String(arr[0]), prefix: arr.slice(1).map(String) };
+    } catch { /* não é JSON — trata como nome de binário abaixo */ }
+  }
+  return { bin: raw && raw.trim() ? raw.trim() : 'gh', prefix: [] };
+}