@profoundry-us/highball 0.4.1 → 0.6.0

package/lib/stamp.js

@@ -0,0 +1,73 @@
+// Working-tree fingerprint behind `run --fast --if-changed`.
+//
+// Agents in auto mode edit through Bash — sed, heredocs, scripts — so a
+// fast hook matched only on the edit tools never fires for them. Matching
+// Bash too means firing after every command, and most commands are reads.
+// The fingerprint makes those free: HEAD plus every dirty path with its
+// size and mtime, hashed. A further edit to an already-dirty file moves
+// its mtime, so the stamp tracks edits rather than just the set of dirty
+// paths. Stamps live outside the repo, like the journal.
+import { createHash } from "node:crypto";
+import { execSync } from "node:child_process";
+import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export function stampDir() {
+  return join(homedir(), ".highball", "stamps");
+}
+
+// One stamp per CHECKOUT, not per project: git worktrees and parallel
+// clones share a project name but not a working tree, and a run in one
+// must never let the other skip a run it needs.
+export function stampPath(project, cwd, dir = stampDir()) {
+  const checkout = createHash("sha256").update(cwd).digest("hex").slice(0, 12);
+  return join(dir, `${project}-${checkout}`);
+}
+
+// null outside a git repo: with no way to tell whether anything changed,
+// --if-changed must never skip.
+export function treeFingerprint(cwd = process.cwd()) {
+  const sh = (command) => {
+    try {
+      return execSync(command, { cwd, encoding: "utf8", stdio: [ "ignore", "pipe", "ignore" ] }).trim();
+    } catch {
+      return "";
+    }
+  };
+  const head = sh("git rev-parse HEAD");
+  if (!head) return null;
+
+  const hash = createHash("sha256").update(head).update("\0");
+  const status = sh("git status --porcelain=v1 -z --untracked-files=all");
+  for (const entry of status.split("\0").filter(Boolean)) {
+    hash.update(entry).update("\0");
+    try {
+      const stat = statSync(join(cwd, entry.slice(3)));
+      hash.update(`${stat.size}:${stat.mtimeMs}`);
+    } catch {
+      hash.update("gone");
+    }
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+
+export function readStamp(project, cwd, dir = stampDir()) {
+  try {
+    return readFileSync(stampPath(project, cwd, dir), "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+
+// Best-effort, like the journal: a stamp that fails to write costs one
+// extra fast run, never a failed one.
+export function writeStamp(project, cwd, fingerprint, dir = stampDir()) {
+  try {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    writeFileSync(stampPath(project, cwd, dir), `${fingerprint}\n`);
+  } catch {
+    // ignore
+  }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@profoundry-us/highball",
-  "version": "0.4.1",
-  "description": "Highball runner — local CI for AI coding agents: runs a repo's .highball/checks.yml rules, blocks the agent on failure, and reports runs to a Highball dashboard.",
+  "version": "0.6.0",
+  "description": "Highball runner — local CI for AI coding agents: runs a repo's .highball/checks.yml rules, blocks the agent on failure, and optionally reports runs to PostHog.",
   "keywords": [
     "ai",
     "claude-code",
@@ -12,11 +12,11 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/profoundry-us/highball-runner.git"
+    "url": "git+https://github.com/profoundry-us/highball.git"
   },
-  "homepage": "https://github.com/profoundry-us/highball-runner#readme",
+  "homepage": "https://github.com/profoundry-us/highball#readme",
   "bugs": {
-    "url": "https://github.com/profoundry-us/highball-runner/issues"
+    "url": "https://github.com/profoundry-us/highball/issues"
   },
   "type": "module",
   "bin": {

package/lib/login.js

@@ -1,68 +0,0 @@
-// `highball login` — stores a project token in the machine-local
-// credentials file (~/.highball/credentials.json, host → project →
-// token). The token is read from stdin with --token-stdin (recommended:
-// no shell history, no process listing) or prompted interactively.
-// Tokens never touch the repo tree and are never echoed back.
-import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-import { createInterface } from "node:readline/promises";
-import { CREDENTIALS_PATH, loadConfig, readCredentials } from "./config.js";
-
-export async function login(args) {
-  const options = parse(args);
-
-  // The local checks.yml, when present, already knows the url + project —
-  // don't make the user repeat what the repo declares.
-  let config = null;
-  try {
-    config = loadConfig();
-  } catch {
-    // Not in a configured repo; url/project must come from flags/prompts.
-  }
-
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const url =
-      options.url ||
-      config?.reporting?.url ||
-      (await rl.question("Highball URL (e.g. https://highball.example.com): "));
-    const project =
-      options.project || config?.project || (await rl.question("Project slug: "));
-    const token = options.tokenStdin
-      ? (await readAllStdin()).trim()
-      : (await rl.question("Project token (input is visible — prefer --token-stdin): ")).trim();
-
-    if (!url || !project || !token) {
-      console.error("highball: url, project, and token are all required.");
-      return 1;
-    }
-
-    const credentials = readCredentials();
-    (credentials[url] ??= {})[project] = token;
-
-    mkdirSync(dirname(CREDENTIALS_PATH), { recursive: true, mode: 0o700 });
-    writeFileSync(CREDENTIALS_PATH, JSON.stringify(credentials, null, 2) + "\n");
-    chmodSync(CREDENTIALS_PATH, 0o600);
-
-    console.log(`stored token for ${project} @ ${url} in ${CREDENTIALS_PATH}`);
-    return 0;
-  } finally {
-    rl.close();
-  }
-}
-
-function parse(args) {
-  const options = { tokenStdin: false };
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--url") options.url = args[++i];
-    else if (args[i] === "--project") options.project = args[++i];
-    else if (args[i] === "--token-stdin") options.tokenStdin = true;
-  }
-  return options;
-}
-
-async function readAllStdin() {
-  let text = "";
-  for await (const chunk of process.stdin) text += chunk;
-  return text;
-}

package/lib/report.js

@@ -1,75 +0,0 @@
-// The witness half: best-effort reporting to the Highball app — open
-// run, per-check results, finalize. Payloads mirror the Ruby
-// proto-runner exactly so the ingestion API sees one dialect. Failures
-// here warn and return; they NEVER fail the checks.
-import { execSync } from "node:child_process";
-import { hostname } from "node:os";
-
-// Returns the server's run id on success, null when reporting was
-// skipped or failed — the caller journals it either way.
-export async function report({ url, token, rules, results, hook, fastOnly, startedAt, branch, commitSha }) {
-  try {
-    const base = new URL(url);
-    const request = async (method, path, body) => {
-      const response = await fetch(new URL(path, base), {
-        method,
-        headers: {
-          Authorization: `Bearer ${token}`,
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body),
-        signal: AbortSignal.timeout(15_000)
-      });
-      if (response.status >= 300) {
-        throw new Error(`${path} -> ${response.status}: ${await response.text()}`);
-      }
-      return response.json();
-    };
-
-    const opened = await request("POST", "/api/v1/runs", {
-      agent: hook.session_id ? "claude-code" : "manual",
-      session_key:
-        hook.session_id || process.env.HIGHBALL_SESSION_KEY || `manual-${hostname()}`,
-      trigger: fastOnly ? "edit" : "stop",
-      branch,
-      commit_sha: commitSha,
-      rules_snapshot: rules,
-      started_at: startedAt.toISOString()
-    });
-    const runId = opened.run_id;
-
-    for (const result of results) {
-      await request("POST", `/api/v1/runs/${runId}/results`, {
-        check_key: result.rule.id,
-        name: result.rule.name,
-        status: result.todo ? "todo" : result.passed ? "passed" : "failed",
-        duration_ms: result.durationMs,
-        // Full logs stay local; the tail is enough to read a failure on
-        // the dashboard without shipping megabytes per keystroke.
-        log_tail: result.passed ? null : result.output.slice(-4000),
-        summary: result.todo
-          ? "planned — not implemented yet"
-          : result.passed
-            ? null
-            : result.output.split("\n")[0]?.trim().slice(0, 120)
-      });
-    }
-
-    await request("PATCH", `/api/v1/runs/${runId}`, {
-      status: results.every((result) => result.passed) ? "passed" : "failed"
-    });
-    console.log(`reported to ${base.host} (run ${runId})`);
-    return runId;
-  } catch (error) {
-    console.error(`highball reporting skipped: ${error.message}`);
-    return null;
-  }
-}
-
-export function git(command) {
-  try {
-    return execSync(`${command} 2>/dev/null`, { encoding: "utf8" }).trim();
-  } catch {
-    return "";
-  }
-}