@polymorphism-tech/morph-spec 8.47.0 → 9.1.0

package/src/commands/state/delete.js

@@ -6,33 +6,10 @@ import { isValidFeatureName, cwdIsInsideWorktree, teardownWorktree, resolvePrima
 import { resolveFeatureTree } from '../../lib/worktree/feature-truth.js';
 import { tearDownFeatureStack } from '../../lib/e2e/stack-teardown.js';
 
-/**
- * `morph-spec delete <feature>` — remove a feature. Hard by default (folder is
- * gone), soft via `--archive` (moved to .morph/archive with status
- * "abandoned"). The complement of `archive`: archive = completed work you keep;
- * delete = dead scaffolds and abandoned drafts you clear out.
- *
- * The critical guarantee — mirrored from `archive` — is that the deletion also
- * drops the feature from the thin root index (.morph/state.json). Without that,
- * the next `loadState` resurrects the folder from the stale index entry
- * (turning a delete into a zombie). We edit the index directly rather than
- * calling saveState, which would re-materialize .morph/features/{name}.
- *
- * Refuses when any gate is approved (real work, not a dead shell), unless
- * `--force`.
- *
- * SECURITY: `featureName` is an unsanitized CLI argument that flows straight
- * into `rmSync(..., { recursive: true })` — the same class of bug the worktree
- * teardown guards against, but here the danger is path TRAVERSAL rather than a
- * followed symlink. `join(cwd, '.morph', 'features', '../../.claude')`
- * resolves to `cwd/.claude`, so an unvalidated name can point the hard-delete
- * at the shared `.claude/` install (or anything else relative to cwd). Gated
- * by `isValidFeatureName` (same kebab-slug rule `create` stamps at birth) PLUS
- * a resolved-path containment assert — validated by path, not by the
- * convention that a real feature name never contains `..`.
- */
-
-/** Refuse a delete/archive whose resolved target escapes `.morph/features/{scope}/{name}`. */
+// `featureName` flows into a recursive rmSync and `../../.claude` would resolve to the shared
+// install: the name is validated AND the resolved path must stay contained. Dropping the root
+// index entry matters too, or the next loadState resurrects the folder.
+
 function assertContained(scopeDir, name, target) {
   const scopeAbs = resolve(scopeDir) + sep;
   const targetAbs = resolve(target);
@@ -57,7 +34,6 @@ function approvedGates(feature) {
     .map(([name]) => name);
 }
 
-/** Drop the feature from the thin, derivable root index (like archive does). */
 function dropFromIndex(cwd, featureName) {
   const rootPath = join(cwd, '.morph', 'state.json');
   if (!existsSync(rootPath)) return;
@@ -76,11 +52,7 @@ export async function deleteCommand(featureName, options = {}) {
   try {
     const cwd = options.cwd || process.cwd();
 
-    // Gate 0: valid kebab name — refuses BEFORE any path is built from it, so a
-    // traversal attempt (`../../.claude`) never reaches existsSync/rmSync. Same
-    // gate `create` stamps at birth and `finish` re-checks; unlike those two,
-    // delete/archive take a FRESH argument every invocation, so this cannot rely
-    // on "every real feature folder is already a valid slug".
+    // Validated BEFORE any path is built: delete takes a fresh argument on every invocation.
     if (!isValidFeatureName(featureName)) {
       console.error(chalk.red(`\n❌ Invalid feature name: "${featureName}"`));
       console.error(chalk.gray('Use kebab-case: lowercase letters, digits and hyphens (e.g. "user-onboarding")\n'));
@@ -97,14 +69,12 @@ export async function deleteCommand(featureName, options = {}) {
       process.exit(1);
     }
 
-    // Read the authoritative feature.json directly (not loadState — a read that
-    // mutates state has no place inside a delete).
+    // Not loadState: a read that mutates state has no place inside a delete.
     let feature = {};
     if (existsSync(fjPath)) {
       try { feature = JSON.parse(readFileSync(fjPath, 'utf8')); } catch { feature = {}; }
     }
 
-    // Precondition: no approved gate (real work) unless --force.
     const approved = approvedGates(feature);
     if (approved.length && !options.force) {
       console.error(chalk.red(`\n❌ "${featureName}" has approved gate(s): ${approved.join(', ')}.`));
@@ -113,14 +83,8 @@ export async function deleteCommand(featureName, options = {}) {
       process.exit(1);
     }
 
-    // A live worktree elsewhere owns this feature's REAL state — deleting the
-    // root's registration here would orphan the worktree + branch silently
-    // (no `no-feature` audit hit either: featureCommittedOnBranch stays true).
-    // Distinct consent from --force on purpose: --force answers "approved gate
-    // present, delete anyway" (a STATE risk); a live worktree is a FILESYSTEM
-    // risk (orphan directory, junctions into the primary root) — the same
-    // reasoning that keeps `worktree remove`'s PROVE-or-DECLINE separate from
-    // gate policy.
+    // A live worktree owns the real state; deleting the root registration would orphan it. A distinct
+    // consent from --force on purpose: --force answers a state risk, this one is a filesystem risk.
     const owner = resolveFeatureTree(featureName, cwd);
     const liveElsewhere = (owner.source === 'registry' || owner.source === 'pointer') && owner.tree;
     if (liveElsewhere) {
@@ -141,14 +105,9 @@ export async function deleteCommand(featureName, options = {}) {
         process.exit(1);
       }
 
-      // PROVE-or-DECLINE first — only delete the feature's own copy if the
-      // worktree actually came down. A refusal here must leave EVERYTHING
-      // untouched, same contract as `worktree remove`.
+      // PROVE-or-DECLINE: a refusal here must leave everything untouched.
       const root = resolvePrimaryRoot(cwd);
-      // The feature's verification stack (containers, ports, volumes, stamp)
-      // comes down BEFORE its worktree: the compose file and the bind mount
-      // live there, and a deleted feature has nothing to keep a volume for.
-      // Fail-open by contract — a stubborn container never blocks the delete.
+      // The stack comes down BEFORE the worktree, where its compose file and bind mount live. Fail-open.
       try {
         tearDownFeatureStack(featureName, { root, worktreePath: owner.tree, volumes: true });
       } catch { /* fail-open */ }
@@ -166,15 +125,11 @@ export async function deleteCommand(featureName, options = {}) {
         console.error(chalk.gray(`   ${teardown.declineReason || 'motivo desconhecido'}\n`));
         process.exit(1);
       }
-      // Fall through: the feature's own .morph/features/{featureName} copy in
-      // `cwd` (the primary root, by construction of `liveElsewhere`) is deleted
-      // by the normal flow below, exactly as if there had never been a worktree.
     }
 
     const useGit = isGitRepo(cwd) && options.git !== false;
 
     if (options.archive) {
-      // Soft delete: move to .morph/archive with status "abandoned".
       const archiveDir = join(cwd, '.morph', 'archive');
       const archivePath = join(archiveDir, featureName);
       if (existsSync(archivePath)) {
@@ -209,7 +164,6 @@ export async function deleteCommand(featureName, options = {}) {
       process.exit(0);
     }
 
-    // Hard delete: remove the folder (git-aware), then drop from index.
     let staged = false;
     if (useGit) {
       try {
@@ -218,13 +172,7 @@ export async function deleteCommand(featureName, options = {}) {
       } catch {
         // Untracked (never committed) — nothing for git rm to act on.
       }
-      // `git rm` only ever removes TRACKED files — a scaffolded phase folder
-      // with no artifact in it (0-proposal/ with nothing written yet) has no
-      // tracked blob and survives as an empty directory on disk. This bit
-      // real after --with-worktree: teardownWorktree's own registration-clear
-      // commits the root's feature.json on its way through, so `git rm`
-      // SUCCEEDS on that one file while the sibling empty folders it never
-      // tracked are left behind. Unconditional sweep closes both paths at once.
+      // `git rm` only removes tracked files: scaffolded empty phase folders survive it.
       if (existsSync(featuresPath)) rmSync(featuresPath, { recursive: true, force: true });
       try { execSync(`git add -A "${featuresPath}"`, { cwd, stdio: 'pipe' }); staged = true; } catch { /* not fatal */ }
     } else {