@quonfig/cli 0.0.68 → 0.0.70

package/dist/verify/standalone.js

@@ -99,26 +99,32 @@ async function runGitHook() {
  * exists to catch (verified live on staging: a `configs/bad charset key.json`
  * push was accepted unvalidated). A listed-but-unreadable file is now a hard
  * failure (fail closed), not a silent skip.
+ *
+ * qfg-hbuy.4: enumerates RECURSIVELY (`-r`) and with NO name filtering. The
+ * old non-recursive listing plus `endsWith('.json') && !includes('/.')` filter
+ * meant dotfiles, nested paths (configs/sub/x.json), and case-variant
+ * extensions (FOO.JSON) never reached validation at all — ghost files that
+ * push fine but no loader reads. The hook must see EVERYTHING under the
+ * validated dirs; validateFileMap is the layer that decides what is an error.
  */
 export function readFilesFromCommit(commitOid, cwd) {
     const files = new Map();
     const dirs = ['configs', 'feature-flags', 'segments', 'log-levels', 'schemas', 'schemas-protected'];
     for (const dir of dirs) {
-        // List files in this directory at the given commit. A directory that
-        // doesn't exist yields an empty listing (exit 0); a bad/unreadable OID
-        // throws — fail closed, the hook rejects the push.
-        const listing = execFileSync('git', ['ls-tree', '-z', '--name-only', commitOid, `${dir}/`], {
+        // List every leaf entry under this directory at the given commit. A
+        // directory that doesn't exist yields an empty listing (exit 0); a
+        // bad/unreadable OID throws — fail closed, the hook rejects the push.
+        const listing = execFileSync('git', ['ls-tree', '-z', '-r', '--name-only', commitOid, `${dir}/`], {
             cwd,
             encoding: 'utf8',
             stdio: ['pipe', 'pipe', 'pipe'],
         });
         const filenames = listing.split('\0').filter(Boolean);
         for (const filePath of filenames) {
-            if (!filePath.endsWith('.json') || filePath.includes('/.'))
-                continue;
-            // Fail closed: if a listed file can't be read, the push must not be
-            // accepted with that file unvalidated — let the error propagate to the
-            // hook's per-ref handler, which rejects the push.
+            // Fail closed: if a listed entry can't be read (bad object, submodule
+            // gitlink, ...), the push must not be accepted with that entry
+            // unvalidated — let the error propagate to the hook's per-ref handler,
+            // which rejects the push.
             const content = execFileSync('git', ['show', `${commitOid}:${filePath}`], {
                 cwd,
                 encoding: 'utf8',

package/dist/verify/validate.js

@@ -160,6 +160,86 @@ const DIR_TO_TYPE = {
 const CONFIG_DIRS = new Set(Object.keys(DIR_TO_TYPE));
 const SCHEMA_DIRS = new Set(['schemas', 'schemas-protected']);
 const KNOWN_DIRS = new Set([...CONFIG_DIRS, ...SCHEMA_DIRS]);
+// ── Ghost-file prevention (qfg-hbuy.4) ──────────────────────────────────
+// Within the validated content dirs (KNOWN_DIRS), every entry must be a
+// top-level, non-dot, lowercase-`.json` file. Anything else used to be
+// silently SKIPPED by the enumeration filters — a "ghost" file that pushes
+// fine but is invisible to the hook and to every loader, and a mixed-case
+// FOO.JSON can collide with foo.json on a case-insensitive customer clone
+// (the exact clonability failure Policy A exists to prevent). A skipped
+// entry is a bypass; an error is a rejected push. Paths OUTSIDE the
+// validated dirs (quonfig.json, README.md, .qf/, ...) are not this rule's
+// business and stay untouched.
+function ghostEntryIssue(dir, relPath, name, nested) {
+    if (nested) {
+        return {
+            file: relPath,
+            message: `Subdirectories are not allowed inside "${dir}/" — nested files are never loaded (ghost file)`,
+            severity: 'error',
+            suggestion: `Move config files to the top level: "${dir}/<key>.json"`,
+        };
+    }
+    if (name.startsWith('.')) {
+        return {
+            file: relPath,
+            message: `Dotfile "${name}" is not allowed inside "${dir}/" — hidden files are never loaded (ghost file)`,
+            severity: 'error',
+            suggestion: `Remove the file or rename it without the leading dot`,
+        };
+    }
+    if (!name.endsWith('.json')) {
+        if (name.toLowerCase().endsWith('.json')) {
+            return {
+                file: relPath,
+                message: `File extension must be lowercase ".json" (found "${name}") — a case-variant extension is never loaded and can collide with another file on a case-insensitive filesystem`,
+                severity: 'error',
+                suggestion: `Rename to "${name.slice(0, -5)}.json"`,
+            };
+        }
+        return {
+            file: relPath,
+            message: `Only ".json" files are allowed inside "${dir}/" (found "${name}")`,
+            severity: 'error',
+            suggestion: `Remove the file or rename it to "<key>.json"`,
+        };
+    }
+    return null;
+}
+/**
+ * Disk-walk variant of the ghost rule (validateWorkspace). Returns the list
+ * of names that should proceed to content validation, pushing an issue for
+ * every ghost entry.
+ *
+ * Dotfiles are the one place the disk rule is softer than the committed-tree
+ * rule: `qfg push` never sends dotfiles (collectFiles skips them), so a local
+ * `configs/.DS_Store` is inert OS junk — erroring on it would break every
+ * macOS user. A `.json`-looking dotfile is almost certainly a mistake, so it
+ * gets a WARNING; other dotfiles are skipped silently.
+ */
+function listValidatedDirEntries(dirPath, dir, issues) {
+    const names = [];
+    for (const entry of fs.readdirSync(dirPath, { withFileTypes: true })) {
+        const relPath = `${dir}/${entry.name}`;
+        if (entry.name.startsWith('.')) {
+            if (entry.name.toLowerCase().endsWith('.json')) {
+                issues.push({
+                    file: relPath,
+                    message: `Dotfile "${entry.name}" in "${dir}/" is ignored — it is never validated, pushed, or loaded`,
+                    severity: 'warning',
+                    suggestion: `Remove the file or rename it without the leading dot`,
+                });
+            }
+            continue;
+        }
+        const ghost = ghostEntryIssue(dir, relPath, entry.name, entry.isDirectory());
+        if (ghost) {
+            issues.push(ghost);
+            continue;
+        }
+        names.push(entry.name);
+    }
+    return names;
+}
 // Operators that reference segments
 const SEGMENT_OPERATORS = new Set(['IN_SEG', 'NOT_IN_SEG']);
 // Operators that require a propertyName
@@ -318,12 +398,13 @@ export function validateWorkspace(workspaceDir) {
             suggestion: `Create quonfig.json with format: {"environments": ["production", "staging"]}`,
         });
     }
-    // First pass: parse all files and collect keys
+    // First pass: parse all files and collect keys. Ghost entries (dotfiles,
+    // subdirectories, non-lowercase-.json names) are reported here (qfg-hbuy.4).
     for (const dir of KNOWN_DIRS) {
         const dirPath = path.join(workspaceDir, dir);
         if (!fs.existsSync(dirPath))
             continue;
-        const files = fs.readdirSync(dirPath).filter((f) => f.endsWith('.json') && !f.startsWith('.'));
+        const files = listValidatedDirEntries(dirPath, dir, issues);
         for (const file of files) {
             const filePath = path.join(dirPath, file);
             const relPath = `${dir}/${file}`;
@@ -482,7 +563,8 @@ export function validateWorkspace(workspaceDir) {
             allConfigs.push({ key: config.key, type: config.type, dir, file: relPath });
         }
     }
-    // Second pass: referential integrity
+    // Second pass: referential integrity. Keep the plain skip-filter here —
+    // ghost entries were already reported (once) by the first pass.
     for (const dir of KNOWN_DIRS) {
         const dirPath = path.join(workspaceDir, dir);
         if (!fs.existsSync(dirPath))
@@ -629,8 +711,15 @@ export function validateFileMap(files) {
         const file = parts.at(-1);
         if (!KNOWN_DIRS.has(dir))
             continue;
-        if (!file || !file.endsWith('.json') || file.startsWith('.'))
+        if (!file)
+            continue;
+        // qfg-hbuy.4: a dotfile, nested path, or non-lowercase-.json entry inside
+        // a validated dir is a hard error (rejected push), not a silent skip.
+        const ghost = ghostEntryIssue(dir, relPath, file, parts.length > 2);
+        if (ghost) {
+            issues.push(ghost);
             continue;
+        }
         filesChecked++;
         let parsed;
         try {
@@ -980,6 +1069,24 @@ function validateRules(rules, file, context, expectedValueType, issues, variants
                     }
                 }
             }
+            // Weight predicate (qfg-wis6.10): stored weights must be either an
+            // even split (all weights equal and > 0) or percentages summing to
+            // MAX_WEIGHT. Anything else was written by a broken client: evaluators
+            // normalize by total, so it silently serves different percentages
+            // than any display of the raw weights suggests.
+            if (wv.weightedValues.length > 0) {
+                const weights = wv.weightedValues.map((entry) => entry.weight);
+                const total = weights.reduce((a, b) => a + b, 0);
+                const evenSplit = weights[0] > 0 && weights.every((w) => w === weights[0]);
+                if (!evenSplit && total !== MAX_WEIGHT) {
+                    issues.push({
+                        file,
+                        message: `${ruleCtx}: weighted values must either be an even split (all weights equal and > 0) or sum to ${MAX_WEIGHT}; got [${weights.join(', ')}] summing to ${total}`,
+                        severity: 'error',
+                        suggestion: `Use equal weights for an even split, or make the weights sum to ${MAX_WEIGHT} (1000 units per percent).`,
+                    });
+                }
+            }
         }
         // Check criteria
         for (let j = 0; j < rule.criteria.length; j++) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const _default: "0.0.68";
+declare const _default: "0.0.70";
 export default _default;

package/dist/version.js

@@ -1,2 +1,2 @@
 // AUTO-GENERATED from package.json by scripts/generate-version.mjs — do not edit.
-export default '0.0.68';
+export default '0.0.70';

package/oclif.manifest.json

@@ -4136,5 +4136,5 @@
       ]
     }
   },
-  "version": "0.0.68"
+  "version": "0.0.70"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "packageManager": "yarn@4.11.0+sha512.4e54aeace9141df2f0177c266b05ec50dc044638157dae128c471ba65994ac802122d7ab35bcd9e81641228b7dcf24867d28e750e0bcae8a05277d600008ad54",
   "name": "@quonfig/cli",
-  "version": "0.0.68",
+  "version": "0.0.70",
   "bugs": {
     "url": "https://github.com/quonfig/cli/issues"
   },