@polymorphism-tech/morph-spec 8.34.2 → 8.35.1

package/src/lib/generators/settings-generator.js

@@ -1,209 +1,209 @@
-/**
- * Settings Generator
- *
- * Generates .claude/settings.local.json for projects based on detected
- * stack, MCPs, and morph-spec configuration. Uses _morph_managed marker
- * to track managed entries for safe reset.
- */
-
-import { join } from 'path';
-import { existsSync } from 'fs';
-import { readFile, writeFile, mkdir } from 'fs/promises';
-
-const MORPH_MANAGED_KEY = '_morph_managed';
-
-/**
- * Generate and merge settings for a project
- * @param {string} targetPath - Project root directory
- * @param {Object} detectedConfig - Output from detectClaudeConfig()
- * @param {Object} morphConfig - morph-spec config (from .morph/config/config.json)
- * @returns {Promise<Object>} Generated settings summary
- */
-export async function generateSettings(targetPath, detectedConfig, morphConfig = {}) {
-  const claudeDir = join(targetPath, '.claude');
-  const settingsPath = join(claudeDir, 'settings.local.json');
-
-  // Read existing settings
-  const existing = await readSettingsSafe(settingsPath);
-
-  // Build stack-based permissions
-  const stack = morphConfig?.project?.architecture || 'unknown';
-  const permissions = buildPermissions(stack, detectedConfig);
-
-  // Build generated settings
-  const generated = {};
-
-  if (permissions.length > 0) {
-    generated.permissions = permissions;
-  }
-
-  // Track what we manage
-  const managed = {
-    permissions_added: permissions,
-    mcps_detected: detectedConfig.mcpServers.map(s => s.name),
-    plugins_detected: detectedConfig.plugins.map(p => p.name),
-    generated_at: new Date().toISOString()
-  };
-
-  // Merge without overwriting user config
-  const merged = mergeSettings(existing, generated);
-  merged[MORPH_MANAGED_KEY] = managed;
-
-  // Ensure directory exists
-  if (!existsSync(claudeDir)) {
-    await mkdir(claudeDir, { recursive: true });
-  }
-
-  await writeFile(settingsPath, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
-
-  return {
-    settingsPath,
-    permissionsAdded: permissions.length,
-    managed
-  };
-}
-
-/**
- * Build permission rules based on detected stack
- * @param {string} stack - Detected project stack
- * @param {Object} detectedConfig - Detected Claude config
- * @returns {Array<string>} Permission patterns
- */
-export function buildPermissions(stack, detectedConfig = {}) {
-  const permissions = [];
-
-  // Stack-based permissions
-  const stackPermissions = {
-    nodejs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    typescript: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)', 'Bash(tsc:*)'],
-    nextjs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    react: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    vue: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    dotnet: ['Bash(dotnet:*)', 'Bash(nuget:*)'],
-    python: ['Bash(python:*)', 'Bash(pip:*)', 'Bash(pytest:*)'],
-    go: ['Bash(go:*)']
-  };
-
-  if (stackPermissions[stack]) {
-    permissions.push(...stackPermissions[stack]);
-  }
-
-  // morph-spec CLI always needs node/npx
-  if (!permissions.includes('Bash(npx:*)')) {
-    permissions.push('Bash(npx:*)');
-  }
-
-  return permissions;
-}
-
-/**
- * Deep merge settings without overwriting user entries
- * @param {Object} existing - Current settings.local.json
- * @param {Object} generated - Generated settings to merge
- * @returns {Object} Merged settings
- */
-export function mergeSettings(existing, generated) {
-  const result = { ...existing };
-
-  for (const [key, value] of Object.entries(generated)) {
-    if (key === MORPH_MANAGED_KEY) continue;
-
-    if (Array.isArray(value) && Array.isArray(result[key])) {
-      // Merge arrays without duplicates
-      const set = new Set(result[key]);
-      for (const item of value) {
-        set.add(item);
-      }
-      result[key] = [...set];
-    } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
-      // Recursively merge objects
-      result[key] = mergeSettings(result[key] || {}, value);
-    } else if (!(key in result)) {
-      // Only add new keys, never overwrite existing
-      result[key] = value;
-    }
-  }
-
-  return result;
-}
-
-/**
- * Remove only morph-spec managed entries from settings
- * @param {string} settingsPath - Path to settings.local.json
- * @returns {Promise<Object>} Summary of what was removed
- */
-export async function resetMorphSettings(settingsPath) {
-  if (!existsSync(settingsPath)) {
-    return { removed: false, reason: 'file not found' };
-  }
-
-  const settings = await readSettingsSafe(settingsPath);
-  const managed = settings[MORPH_MANAGED_KEY];
-
-  if (!managed) {
-    return { removed: false, reason: 'no _morph_managed section found' };
-  }
-
-  // Remove managed permissions
-  if (managed.permissions_added && Array.isArray(settings.permissions)) {
-    settings.permissions = settings.permissions.filter(
-      p => !managed.permissions_added.includes(p)
-    );
-    if (settings.permissions.length === 0) {
-      delete settings.permissions;
-    }
-  }
-
-  // Remove the managed marker itself
-  delete settings[MORPH_MANAGED_KEY];
-
-  // Write back
-  await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
-
-  return {
-    removed: true,
-    permissionsRemoved: managed.permissions_added || [],
-    previouslyGenerated: managed.generated_at
-  };
-}
-
-/**
- * Save integrations.json with detected config
- * @param {string} targetPath - Project root directory
- * @param {Object} detectedConfig - Output from detectClaudeConfig()
- */
-export async function saveIntegrations(targetPath, detectedConfig) {
-  const integrationsPath = join(targetPath, '.morph', 'config', 'integrations.json');
-  const integrationsDir = join(targetPath, '.morph', 'config');
-
-  if (!existsSync(integrationsDir)) {
-    await mkdir(integrationsDir, { recursive: true });
-  }
-
-  const integrations = {
-    version: '1.0.0',
-    detectedAt: new Date().toISOString(),
-    plugins: detectedConfig.plugins,
-    mcpServers: detectedConfig.mcpServers,
-    superpowers: detectedConfig.superpowers,
-    customSkills: detectedConfig.customSkills.length,
-    customCommands: detectedConfig.customCommands.length,
-    hooks: detectedConfig.hooks.length
-  };
-
-  await writeFile(integrationsPath, JSON.stringify(integrations, null, 2) + '\n', 'utf-8');
-  return integrationsPath;
-}
-
-// ============================================================================
-// Helpers
-// ============================================================================
-
-async function readSettingsSafe(settingsPath) {
-  try {
-    if (!existsSync(settingsPath)) return {};
-    return JSON.parse(await readFile(settingsPath, 'utf-8'));
-  } catch {
-    return {};
-  }
-}
+/**
+ * Settings Generator
+ *
+ * Generates .claude/settings.local.json for projects based on detected
+ * stack, MCPs, and morph-spec configuration. Uses _morph_managed marker
+ * to track managed entries for safe reset.
+ */
+
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { readFile, writeFile, mkdir } from 'fs/promises';
+
+const MORPH_MANAGED_KEY = '_morph_managed';
+
+/**
+ * Generate and merge settings for a project
+ * @param {string} targetPath - Project root directory
+ * @param {Object} detectedConfig - Output from detectClaudeConfig()
+ * @param {Object} morphConfig - morph-spec config (from .morph/config/config.json)
+ * @returns {Promise<Object>} Generated settings summary
+ */
+export async function generateSettings(targetPath, detectedConfig, morphConfig = {}) {
+  const claudeDir = join(targetPath, '.claude');
+  const settingsPath = join(claudeDir, 'settings.local.json');
+
+  // Read existing settings
+  const existing = await readSettingsSafe(settingsPath);
+
+  // Build stack-based permissions
+  const stack = morphConfig?.project?.architecture || 'unknown';
+  const permissions = buildPermissions(stack, detectedConfig);
+
+  // Build generated settings
+  const generated = {};
+
+  if (permissions.length > 0) {
+    generated.permissions = permissions;
+  }
+
+  // Track what we manage
+  const managed = {
+    permissions_added: permissions,
+    mcps_detected: detectedConfig.mcpServers.map(s => s.name),
+    plugins_detected: detectedConfig.plugins.map(p => p.name),
+    generated_at: new Date().toISOString()
+  };
+
+  // Merge without overwriting user config
+  const merged = mergeSettings(existing, generated);
+  merged[MORPH_MANAGED_KEY] = managed;
+
+  // Ensure directory exists
+  if (!existsSync(claudeDir)) {
+    await mkdir(claudeDir, { recursive: true });
+  }
+
+  await writeFile(settingsPath, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
+
+  return {
+    settingsPath,
+    permissionsAdded: permissions.length,
+    managed
+  };
+}
+
+/**
+ * Build permission rules based on detected stack
+ * @param {string} stack - Detected project stack
+ * @param {Object} detectedConfig - Detected Claude config
+ * @returns {Array<string>} Permission patterns
+ */
+export function buildPermissions(stack, detectedConfig = {}) {
+  const permissions = [];
+
+  // Stack-based permissions
+  const stackPermissions = {
+    nodejs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    typescript: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)', 'Bash(tsc:*)'],
+    nextjs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    react: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    vue: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    dotnet: ['Bash(dotnet:*)', 'Bash(nuget:*)'],
+    python: ['Bash(python:*)', 'Bash(pip:*)', 'Bash(pytest:*)'],
+    go: ['Bash(go:*)']
+  };
+
+  if (stackPermissions[stack]) {
+    permissions.push(...stackPermissions[stack]);
+  }
+
+  // morph-spec CLI always needs node/npx
+  if (!permissions.includes('Bash(npx:*)')) {
+    permissions.push('Bash(npx:*)');
+  }
+
+  return permissions;
+}
+
+/**
+ * Deep merge settings without overwriting user entries
+ * @param {Object} existing - Current settings.local.json
+ * @param {Object} generated - Generated settings to merge
+ * @returns {Object} Merged settings
+ */
+export function mergeSettings(existing, generated) {
+  const result = { ...existing };
+
+  for (const [key, value] of Object.entries(generated)) {
+    if (key === MORPH_MANAGED_KEY) continue;
+
+    if (Array.isArray(value) && Array.isArray(result[key])) {
+      // Merge arrays without duplicates
+      const set = new Set(result[key]);
+      for (const item of value) {
+        set.add(item);
+      }
+      result[key] = [...set];
+    } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      // Recursively merge objects
+      result[key] = mergeSettings(result[key] || {}, value);
+    } else if (!(key in result)) {
+      // Only add new keys, never overwrite existing
+      result[key] = value;
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Remove only morph-spec managed entries from settings
+ * @param {string} settingsPath - Path to settings.local.json
+ * @returns {Promise<Object>} Summary of what was removed
+ */
+export async function resetMorphSettings(settingsPath) {
+  if (!existsSync(settingsPath)) {
+    return { removed: false, reason: 'file not found' };
+  }
+
+  const settings = await readSettingsSafe(settingsPath);
+  const managed = settings[MORPH_MANAGED_KEY];
+
+  if (!managed) {
+    return { removed: false, reason: 'no _morph_managed section found' };
+  }
+
+  // Remove managed permissions
+  if (managed.permissions_added && Array.isArray(settings.permissions)) {
+    settings.permissions = settings.permissions.filter(
+      p => !managed.permissions_added.includes(p)
+    );
+    if (settings.permissions.length === 0) {
+      delete settings.permissions;
+    }
+  }
+
+  // Remove the managed marker itself
+  delete settings[MORPH_MANAGED_KEY];
+
+  // Write back
+  await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
+
+  return {
+    removed: true,
+    permissionsRemoved: managed.permissions_added || [],
+    previouslyGenerated: managed.generated_at
+  };
+}
+
+/**
+ * Save integrations.json with detected config
+ * @param {string} targetPath - Project root directory
+ * @param {Object} detectedConfig - Output from detectClaudeConfig()
+ */
+export async function saveIntegrations(targetPath, detectedConfig) {
+  const integrationsPath = join(targetPath, '.morph', 'config', 'integrations.json');
+  const integrationsDir = join(targetPath, '.morph', 'config');
+
+  if (!existsSync(integrationsDir)) {
+    await mkdir(integrationsDir, { recursive: true });
+  }
+
+  const integrations = {
+    version: '1.0.0',
+    detectedAt: new Date().toISOString(),
+    plugins: detectedConfig.plugins,
+    mcpServers: detectedConfig.mcpServers,
+    superpowers: detectedConfig.superpowers,
+    customSkills: detectedConfig.customSkills.length,
+    customCommands: detectedConfig.customCommands.length,
+    hooks: detectedConfig.hooks.length
+  };
+
+  await writeFile(integrationsPath, JSON.stringify(integrations, null, 2) + '\n', 'utf-8');
+  return integrationsPath;
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+async function readSettingsSafe(settingsPath) {
+  try {
+    if (!existsSync(settingsPath)) return {};
+    return JSON.parse(await readFile(settingsPath, 'utf-8'));
+  } catch {
+    return {};
+  }
+}

package/src/lib/git/default-branch.js

@@ -126,12 +126,52 @@ function parseShortstat(text) {
  * @returns {number}
  */
 function countUntrackedFiles(cwd) {
+  return listUntrackedFiles(cwd).length;
+}
+
+/**
+ * Split git's stdout into clean, forward-slashed, non-empty path lines.
+ *
+ * One helper for both probes because the two disagreeing about what a "line" is
+ * — a stray `\r` on Windows, a trailing empty line — would make the count and
+ * the listing describe different sets from the same output.
+ *
+ * @param {string} text
+ * @returns {string[]}
+ */
+function splitLines(text) {
+  return String(text)
+    .split('\n')
+    .map((line) => line.trim().replace(/\\/g, '/'))
+    .filter(Boolean);
+}
+
+/**
+ * The brand-new UNTRACKED files, by NAME — the listing behind
+ * {@link countUntrackedFiles}, and the second half of {@link changedPathsAgainst}.
+ *
+ * The two callers need the same fact at different resolutions, and this is the
+ * ONLY place the probe is spelled: `git diff` never shows a file that was never
+ * `git add`-ed, regardless of ref or working-tree mode, so anything that answers
+ * "what changed" has to ask twice. A second copy of this command is exactly how
+ * the invisible-new-file bug would come back on one caller and not the other.
+ *
+ * `--exclude-standard` honours gitignore the way `git status` does, so build
+ * output never inflates either answer.
+ *
+ * Fail-open to `[]`: this probe is secondary to the diff and must never take the
+ * whole result down.
+ *
+ * @param {string} cwd
+ * @returns {string[]}
+ */
+function listUntrackedFiles(cwd) {
   try {
-    const out = execFileSync('git', ['ls-files', '--others', '--exclude-standard'], { cwd, stdio: 'pipe' })
-      .toString();
-    return out.split('\n').filter((l) => l.trim()).length;
+    return splitLines(
+      execFileSync('git', ['ls-files', '--others', '--exclude-standard'], { cwd, stdio: 'pipe' }).toString()
+    );
   } catch {
-    return 0;
+    return [];
   }
 }
 
@@ -172,3 +212,51 @@ export function getDiffStat(baseRef, cwd = process.cwd()) {
     return null;
   }
 }
+
+/**
+ * Every path this working tree CHANGED against `baseRef` — tracked edits plus
+ * brand-new untracked files.
+ *
+ * WHY IT LIVES BESIDE getDiffStat, AND REUSES ITS UNTRACKED PROBE
+ *
+ * The two answer the same question at different resolutions ("how much changed"
+ * versus "what changed"), and both depend on the SAME fragile fact: `git diff`
+ * is tracked-edits-only, so a brand-new file is invisible to it no matter which
+ * ref is named. `getDiffStat`'s docblock has documented that for a while; a
+ * second copy of the probe here is precisely how the "new file is invisible"
+ * bug comes back on one of the two call sites and not the other. So
+ * `countUntrackedFiles`'s command is not retyped — the listing is.
+ *
+ * `git diff --name-only <baseRef>` against the WORKING TREE, deliberately not
+ * `baseRef...HEAD`: a gate-check in the middle of implement must see work that
+ * is not committed yet. Someone who has only staged the prompt change has still
+ * changed the prompt.
+ *
+ * FAIL-OPEN, and the caller must know what that means. `[]` comes back both for
+ * "nothing changed" and for "the ref did not resolve", exactly like
+ * `getDiffStat` returning null. The distinction that MATTERS to the caller is a
+ * different one — "the project declares no watched path" versus "it declares
+ * some and none were touched" — and that one is answered by the caller's own
+ * `declared` flag, never by the emptiness of this array.
+ *
+ * @param {string|null} baseRef - typically `detectDefaultBranch(cwd)`
+ * @param {string} [cwd]
+ * @returns {string[]} Repo-relative paths with forward slashes, deduplicated,
+ *   sorted. Empty when `baseRef` is falsy, cwd is not a repo, or the diff fails.
+ */
+export function changedPathsAgainst(baseRef, cwd = process.cwd()) {
+  if (!baseRef) return [];
+
+  let tracked;
+  try {
+    tracked = splitLines(
+      execFileSync('git', ['diff', '--name-only', baseRef], { cwd, stdio: 'pipe' }).toString()
+    );
+  } catch {
+    // A baseRef that does not resolve is not a reason to claim "nothing
+    // changed" loudly — the caller's policy is written to be inert on `[]`.
+    return [];
+  }
+
+  return [...new Set([...tracked, ...listUntrackedFiles(cwd)])].sort();
+}

package/src/lib/git/pr-files.js

@@ -0,0 +1,56 @@
+/**
+ * pr-files.js — o diff de um PR carregou uma feature morph-spec?
+ *
+ * `morph/{f}` é a convenção de nome das branches que o framework cria, não
+ * prova de que a branch carregou uma feature: nada impede um PR só de docs
+ * numa `morph/x`. O `doctor` lia o nome como prova e acusava
+ * `pr-merged-not-landed` para sempre sobre PRs que nunca tiveram archive para
+ * pousar (medido no MORPH_GHLBrain: #5, um único `docs/*.md`, e #23, a onda 2
+ * de outra feature — nenhum caminho `.morph/` no diff de nenhum dos dois).
+ *
+ * A pergunta é feita ao diff, e só para o candidato: o `doctor` chama isto
+ * depois de já saber que o PR mergeou e que `archive/{f}` falta aqui, então o
+ * custo (~650 ms por `gh pr view`) não recai sobre quem não tem pendência. O
+ * índice (`pr-index.js`) segue sem o campo de propósito: pedir `mergeCommit` no
+ * `pr list` custou ~400 ms a mais em CADA chamada, paga pelos quatro leitores.
+ *
+ * Três respostas, nunca duas: `true` (o diff tocou `.morph/{features,archive}/{f}/`),
+ * `false` (o diff foi lido inteiro e não tocou) e `null` (DESCONHECIDO — sem
+ * `gh`, falha, JSON ilegível, ou o diff bateu no teto de arquivos do `gh` sem
+ * achar). Só `false` autoriza calar um aviso.
+ */
+
+import { execFileSync } from 'child_process';
+import { resolveGh } from './gh.js';
+
+/** Quantos arquivos o `gh pr view --json files` devolve, no máximo. */
+export const GH_FILES_CAP = 100;
+
+/**
+ * @param {string} root - de onde o `gh` roda (resolve o repositório pelo origin)
+ * @param {number} number - número do PR
+ * @param {string} feature - o `{f}` de `morph/{f}`
+ * @param {{ timeout?: number }} [opts]
+ * @returns {boolean|null} null = DESCONHECIDO, nunca "não carregou"
+ */
+export function prCarriesFeature(root, number, feature, opts = {}) {
+  const timeout = opts.timeout ?? 8000;
+  try {
+    const { bin, prefix } = resolveGh();
+    const out = execFileSync(
+      bin,
+      [...prefix, 'pr', 'view', String(number), '--json', 'files'],
+      { cwd: root, stdio: 'pipe', timeout },
+    ).toString();
+    const files = JSON.parse(out)?.files;
+    if (!Array.isArray(files)) return null;
+    // A barra final é a fronteira do slug: `vitrine` não pode casar `vitrine-lead/`.
+    const owned = [`.morph/features/${feature}/`, `.morph/archive/${feature}/`];
+    if (files.some((f) => typeof f?.path === 'string' && owned.some((p) => f.path.startsWith(p)))) return true;
+    // Diff truncado sem o caminho não prova ausência — o archive pode estar além do teto.
+    if (files.length >= GH_FILES_CAP) return null;
+    return false;
+  } catch {
+    return null;
+  }
+}