@polymorphism-tech/morph-spec 8.37.1 → 8.40.0

package/src/lib/generators/settings-generator.js

@@ -1,209 +1,208 @@
-/**
- * Settings Generator
- *
- * Generates .claude/settings.local.json for projects based on detected
- * stack, MCPs, and morph-spec configuration. Uses _morph_managed marker
- * to track managed entries for safe reset.
- */
-
-import { join } from 'path';
-import { existsSync } from 'fs';
-import { readFile, writeFile, mkdir } from 'fs/promises';
-
-const MORPH_MANAGED_KEY = '_morph_managed';
-
-/**
- * Generate and merge settings for a project
- * @param {string} targetPath - Project root directory
- * @param {Object} detectedConfig - Output from detectClaudeConfig()
- * @param {Object} morphConfig - morph-spec config (from .morph/config/config.json)
- * @returns {Promise<Object>} Generated settings summary
- */
-export async function generateSettings(targetPath, detectedConfig, morphConfig = {}) {
-  const claudeDir = join(targetPath, '.claude');
-  const settingsPath = join(claudeDir, 'settings.local.json');
-
-  // Read existing settings
-  const existing = await readSettingsSafe(settingsPath);
-
-  // Build stack-based permissions
-  const stack = morphConfig?.project?.architecture || 'unknown';
-  const permissions = buildPermissions(stack, detectedConfig);
-
-  // Build generated settings
-  const generated = {};
-
-  if (permissions.length > 0) {
-    generated.permissions = permissions;
-  }
-
-  // Track what we manage
-  const managed = {
-    permissions_added: permissions,
-    mcps_detected: detectedConfig.mcpServers.map(s => s.name),
-    plugins_detected: detectedConfig.plugins.map(p => p.name),
-    generated_at: new Date().toISOString()
-  };
-
-  // Merge without overwriting user config
-  const merged = mergeSettings(existing, generated);
-  merged[MORPH_MANAGED_KEY] = managed;
-
-  // Ensure directory exists
-  if (!existsSync(claudeDir)) {
-    await mkdir(claudeDir, { recursive: true });
-  }
-
-  await writeFile(settingsPath, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
-
-  return {
-    settingsPath,
-    permissionsAdded: permissions.length,
-    managed
-  };
-}
-
-/**
- * Build permission rules based on detected stack
- * @param {string} stack - Detected project stack
- * @param {Object} detectedConfig - Detected Claude config
- * @returns {Array<string>} Permission patterns
- */
-export function buildPermissions(stack, detectedConfig = {}) {
-  const permissions = [];
-
-  // Stack-based permissions
-  const stackPermissions = {
-    nodejs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    typescript: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)', 'Bash(tsc:*)'],
-    nextjs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    react: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    vue: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
-    dotnet: ['Bash(dotnet:*)', 'Bash(nuget:*)'],
-    python: ['Bash(python:*)', 'Bash(pip:*)', 'Bash(pytest:*)'],
-    go: ['Bash(go:*)']
-  };
-
-  if (stackPermissions[stack]) {
-    permissions.push(...stackPermissions[stack]);
-  }
-
-  // morph-spec CLI always needs node/npx
-  if (!permissions.includes('Bash(npx:*)')) {
-    permissions.push('Bash(npx:*)');
-  }
-
-  return permissions;
-}
-
-/**
- * Deep merge settings without overwriting user entries
- * @param {Object} existing - Current settings.local.json
- * @param {Object} generated - Generated settings to merge
- * @returns {Object} Merged settings
- */
-export function mergeSettings(existing, generated) {
-  const result = { ...existing };
-
-  for (const [key, value] of Object.entries(generated)) {
-    if (key === MORPH_MANAGED_KEY) continue;
-
-    if (Array.isArray(value) && Array.isArray(result[key])) {
-      // Merge arrays without duplicates
-      const set = new Set(result[key]);
-      for (const item of value) {
-        set.add(item);
-      }
-      result[key] = [...set];
-    } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
-      // Recursively merge objects
-      result[key] = mergeSettings(result[key] || {}, value);
-    } else if (!(key in result)) {
-      // Only add new keys, never overwrite existing
-      result[key] = value;
-    }
-  }
-
-  return result;
-}
-
-/**
- * Remove only morph-spec managed entries from settings
- * @param {string} settingsPath - Path to settings.local.json
- * @returns {Promise<Object>} Summary of what was removed
- */
-export async function resetMorphSettings(settingsPath) {
-  if (!existsSync(settingsPath)) {
-    return { removed: false, reason: 'file not found' };
-  }
-
-  const settings = await readSettingsSafe(settingsPath);
-  const managed = settings[MORPH_MANAGED_KEY];
-
-  if (!managed) {
-    return { removed: false, reason: 'no _morph_managed section found' };
-  }
-
-  // Remove managed permissions
-  if (managed.permissions_added && Array.isArray(settings.permissions)) {
-    settings.permissions = settings.permissions.filter(
-      p => !managed.permissions_added.includes(p)
-    );
-    if (settings.permissions.length === 0) {
-      delete settings.permissions;
-    }
-  }
-
-  // Remove the managed marker itself
-  delete settings[MORPH_MANAGED_KEY];
-
-  // Write back
-  await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
-
-  return {
-    removed: true,
-    permissionsRemoved: managed.permissions_added || [],
-    previouslyGenerated: managed.generated_at
-  };
-}
-
-/**
- * Save integrations.json with detected config
- * @param {string} targetPath - Project root directory
- * @param {Object} detectedConfig - Output from detectClaudeConfig()
- */
-export async function saveIntegrations(targetPath, detectedConfig) {
-  const integrationsPath = join(targetPath, '.morph', 'config', 'integrations.json');
-  const integrationsDir = join(targetPath, '.morph', 'config');
-
-  if (!existsSync(integrationsDir)) {
-    await mkdir(integrationsDir, { recursive: true });
-  }
-
-  const integrations = {
-    version: '1.0.0',
-    detectedAt: new Date().toISOString(),
-    plugins: detectedConfig.plugins,
-    mcpServers: detectedConfig.mcpServers,
-    superpowers: detectedConfig.superpowers,
-    customSkills: detectedConfig.customSkills.length,
-    customCommands: detectedConfig.customCommands.length,
-    hooks: detectedConfig.hooks.length
-  };
-
-  await writeFile(integrationsPath, JSON.stringify(integrations, null, 2) + '\n', 'utf-8');
-  return integrationsPath;
-}
-
-// ============================================================================
-// Helpers
-// ============================================================================
-
-async function readSettingsSafe(settingsPath) {
-  try {
-    if (!existsSync(settingsPath)) return {};
-    return JSON.parse(await readFile(settingsPath, 'utf-8'));
-  } catch {
-    return {};
-  }
-}
+/**
+ * Settings Generator
+ *
+ * Generates .claude/settings.local.json for projects based on detected
+ * stack, MCPs, and morph-spec configuration. Uses _morph_managed marker
+ * to track managed entries for safe reset.
+ */
+
+import { join } from 'path';
+import { existsSync } from 'fs';
+import { readFile, writeFile, mkdir } from 'fs/promises';
+
+const MORPH_MANAGED_KEY = '_morph_managed';
+
+/**
+ * Generate and merge settings for a project
+ * @param {string} targetPath - Project root directory
+ * @param {Object} detectedConfig - Output from detectClaudeConfig()
+ * @param {Object} morphConfig - morph-spec config (from .morph/config/config.json)
+ * @returns {Promise<Object>} Generated settings summary
+ */
+export async function generateSettings(targetPath, detectedConfig, morphConfig = {}) {
+  const claudeDir = join(targetPath, '.claude');
+  const settingsPath = join(claudeDir, 'settings.local.json');
+
+  // Read existing settings
+  const existing = await readSettingsSafe(settingsPath);
+
+  // Build stack-based permissions
+  const stack = morphConfig?.project?.architecture || 'unknown';
+  const permissions = buildPermissions(stack, detectedConfig);
+
+  // Build generated settings
+  const generated = {};
+
+  if (permissions.length > 0) {
+    generated.permissions = permissions;
+  }
+
+  // Track what we manage
+  const managed = {
+    permissions_added: permissions,
+    mcps_detected: detectedConfig.mcpServers.map(s => s.name),
+    plugins_detected: detectedConfig.plugins.map(p => p.name),
+    generated_at: new Date().toISOString()
+  };
+
+  // Merge without overwriting user config
+  const merged = mergeSettings(existing, generated);
+  merged[MORPH_MANAGED_KEY] = managed;
+
+  // Ensure directory exists
+  if (!existsSync(claudeDir)) {
+    await mkdir(claudeDir, { recursive: true });
+  }
+
+  await writeFile(settingsPath, JSON.stringify(merged, null, 2) + '\n', 'utf-8');
+
+  return {
+    settingsPath,
+    permissionsAdded: permissions.length,
+    managed
+  };
+}
+
+/**
+ * Build permission rules based on detected stack
+ * @param {string} stack - Detected project stack
+ * @param {Object} detectedConfig - Detected Claude config
+ * @returns {Array<string>} Permission patterns
+ */
+export function buildPermissions(stack, detectedConfig = {}) {
+  const permissions = [];
+
+  // Stack-based permissions
+  const stackPermissions = {
+    nodejs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    typescript: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)', 'Bash(tsc:*)'],
+    nextjs: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    react: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    vue: ['Bash(node:*)', 'Bash(npm:*)', 'Bash(npx:*)'],
+    dotnet: ['Bash(dotnet:*)', 'Bash(nuget:*)'],
+    python: ['Bash(python:*)', 'Bash(pip:*)', 'Bash(pytest:*)'],
+    go: ['Bash(go:*)']
+  };
+
+  if (stackPermissions[stack]) {
+    permissions.push(...stackPermissions[stack]);
+  }
+
+  // morph-spec CLI always needs node/npx
+  if (!permissions.includes('Bash(npx:*)')) {
+    permissions.push('Bash(npx:*)');
+  }
+
+  return permissions;
+}
+
+/**
+ * Deep merge settings without overwriting user entries
+ * @param {Object} existing - Current settings.local.json
+ * @param {Object} generated - Generated settings to merge
+ * @returns {Object} Merged settings
+ */
+export function mergeSettings(existing, generated) {
+  const result = { ...existing };
+
+  for (const [key, value] of Object.entries(generated)) {
+    if (key === MORPH_MANAGED_KEY) continue;
+
+    if (Array.isArray(value) && Array.isArray(result[key])) {
+      // Merge arrays without duplicates
+      const set = new Set(result[key]);
+      for (const item of value) {
+        set.add(item);
+      }
+      result[key] = [...set];
+    } else if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+      // Recursively merge objects
+      result[key] = mergeSettings(result[key] || {}, value);
+    } else if (!(key in result)) {
+      // Only add new keys, never overwrite existing
+      result[key] = value;
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Remove only morph-spec managed entries from settings
+ * @param {string} settingsPath - Path to settings.local.json
+ * @returns {Promise<Object>} Summary of what was removed
+ */
+export async function resetMorphSettings(settingsPath) {
+  if (!existsSync(settingsPath)) {
+    return { removed: false, reason: 'file not found' };
+  }
+
+  const settings = await readSettingsSafe(settingsPath);
+  const managed = settings[MORPH_MANAGED_KEY];
+
+  if (!managed) {
+    return { removed: false, reason: 'no _morph_managed section found' };
+  }
+
+  // Remove managed permissions
+  if (managed.permissions_added && Array.isArray(settings.permissions)) {
+    settings.permissions = settings.permissions.filter(
+      p => !managed.permissions_added.includes(p)
+    );
+    if (settings.permissions.length === 0) {
+      delete settings.permissions;
+    }
+  }
+
+  // Remove the managed marker itself
+  delete settings[MORPH_MANAGED_KEY];
+
+  // Write back
+  await writeFile(settingsPath, JSON.stringify(settings, null, 2) + '\n', 'utf-8');
+
+  return {
+    removed: true,
+    permissionsRemoved: managed.permissions_added || [],
+    previouslyGenerated: managed.generated_at
+  };
+}
+
+/**
+ * Save integrations.json with detected config
+ * @param {string} targetPath - Project root directory
+ * @param {Object} detectedConfig - Output from detectClaudeConfig()
+ */
+export async function saveIntegrations(targetPath, detectedConfig) {
+  const integrationsPath = join(targetPath, '.morph', 'config', 'integrations.json');
+  const integrationsDir = join(targetPath, '.morph', 'config');
+
+  if (!existsSync(integrationsDir)) {
+    await mkdir(integrationsDir, { recursive: true });
+  }
+
+  const integrations = {
+    version: '1.0.0',
+    detectedAt: new Date().toISOString(),
+    plugins: detectedConfig.plugins,
+    mcpServers: detectedConfig.mcpServers,
+    customSkills: detectedConfig.customSkills.length,
+    customCommands: detectedConfig.customCommands.length,
+    hooks: detectedConfig.hooks.length
+  };
+
+  await writeFile(integrationsPath, JSON.stringify(integrations, null, 2) + '\n', 'utf-8');
+  return integrationsPath;
+}
+
+// ============================================================================
+// Helpers
+// ============================================================================
+
+async function readSettingsSafe(settingsPath) {
+  try {
+    if (!existsSync(settingsPath)) return {};
+    return JSON.parse(await readFile(settingsPath, 'utf-8'));
+  } catch {
+    return {};
+  }
+}

package/src/lib/git/default-branch.js

@@ -260,3 +260,55 @@ export function changedPathsAgainst(baseRef, cwd = process.cwd()) {
 
   return [...new Set([...tracked, ...listUntrackedFiles(cwd)])].sort();
 }
+
+/**
+ * The lines this working tree ADDED against `baseRef`, per file: the new-side
+ * line numbers of `git diff -U0`, plus every brand-new untracked file whole
+ * (the same probe as {@link changedPathsAgainst}).
+ *
+ * Measured from the merge-base, not the tip: a default branch that moved on
+ * after the feature branched must not lend its edits to the feature. `-M`
+ * keeps a moved file from reading as added. `--relative` gives paths relative
+ * to `cwd` and drops what lies outside it, the same base as the untracked
+ * listing: a project in a subfolder of the repo reads its own files.
+ *
+ * @param {string|null} baseRef - typically `detectDefaultBranch(cwd)`
+ * @param {string} [cwd]
+ * @returns {Map<string, number[]|null>|null} path → added line numbers, or
+ *   `null` for a whole untracked file. `null` (not an empty map) when it cannot
+ *   tell: falsy or unresolvable ref, not a repo, diff failed.
+ */
+export function addedLinesAgainst(baseRef, cwd = process.cwd()) {
+  if (!baseRef) return null;
+  const git = (args) => execFileSync('git', args, { cwd, stdio: 'pipe', maxBuffer: 256 * 1024 * 1024 }).toString();
+
+  let diff;
+  try {
+    let base = baseRef;
+    try { base = git(['merge-base', 'HEAD', baseRef]).trim() || baseRef; } catch { /* diff against the ref itself */ }
+    diff = git(['-c', 'core.quotepath=off', 'diff', '-U0', '--no-color', '--no-ext-diff', '-M', '--relative',
+      '--src-prefix=a/', '--dst-prefix=b/', base]);
+  } catch {
+    return null;
+  }
+
+  const added = new Map();
+  let current = null;
+  for (const line of diff.split('\n')) {
+    if (line.startsWith('+++ ')) {
+      const target = line.slice(4).trim().replace(/^"|"$/g, '');
+      current = target.startsWith('b/') ? target.slice(2) : null;
+      continue;
+    }
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+    if (!hunk || !current) continue;
+    const start = Number(hunk[1]);
+    const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
+    if (count === 0) continue;
+    const lines = added.get(current) ?? [];
+    for (let n = start; n < start + count; n++) lines.push(n);
+    added.set(current, lines);
+  }
+  for (const path of listUntrackedFiles(cwd)) added.set(path, null);
+  return added;
+}

package/src/lib/git/tree-fingerprint.js

@@ -0,0 +1,58 @@
+/**
+ * A hash of what a verify run reads: the commit, the uncommitted changes and
+ * the untracked files, plus the project's `config.json` (it names the test
+ * commands). Everything else under `.morph/` stays out — verify itself writes
+ * feature.json and the logs on every run, and counting that would make two
+ * runs over the same code look different.
+ */
+
+import { execFileSync } from 'child_process';
+import { createHash } from 'crypto';
+import { existsSync, readFileSync, statSync } from 'fs';
+import { join } from 'path';
+
+/** Pathspec for "the project minus its `.morph/` bookkeeping". */
+export const OUTSIDE_MORPH = ['--', '.', ':(exclude).morph'];
+const MAX_OUTPUT = 64 * 1024 * 1024;
+
+/** git output as a Buffer; stderr dropped, throws on a non-zero exit. */
+export function git(projectPath, args, input) {
+  return execFileSync('git', args, {
+    cwd: projectPath, stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'ignore'], maxBuffer: MAX_OUTPUT, input,
+  });
+}
+
+/**
+ * @param {string} projectPath
+ * @returns {string|null} sha256 hex, or null outside a git repo / on any git error
+ */
+export function treeFingerprint(projectPath) {
+  try {
+    const hash = createHash('sha256');
+    let head = null;
+    try { head = git(projectPath, ['rev-parse', 'HEAD']).toString().trim(); } catch { /* no commit yet */ }
+    hash.update(`head\0${head ?? 'no-commit'}\0`);
+    // Before the first commit there is no HEAD to diff against: every file is
+    // untracked, and the listing below covers them.
+    if (head) hash.update(git(projectPath, ['diff', 'HEAD', '--binary', ...OUTSIDE_MORPH]));
+    hash.update('\0untracked\0');
+    const untracked = git(projectPath, ['ls-files', '--others', '--exclude-standard', '-z', ...OUTSIDE_MORPH])
+      .toString().split('\0').filter(Boolean).sort();
+    for (const rel of untracked) {
+      // Size and mtime stand in for content: hashing every untracked file of
+      // a large tree would cost more than the run the warning tries to save.
+      let stamp = 'gone';
+      try {
+        const st = statSync(join(projectPath, rel));
+        stamp = `${st.size}\0${st.mtimeMs}`;
+      } catch { /* deleted since the listing */ }
+      hash.update(`${rel}\0${stamp}\0`);
+    }
+    const config = join(projectPath, '.morph', 'config', 'config.json');
+    hash.update('\0config\0');
+    if (existsSync(config)) hash.update(readFileSync(config));
+    return hash.digest('hex');
+  } catch {
+    return null;
+  }
+}