@rtorcato/repo-tooling 3.36.0 → 3.37.0

package/AGENTS.md

@@ -26,7 +26,7 @@ Every command supports `--json` and a non-interactive mode. Combine with `--yes`
 | `fix --dry-run` | ✅ | ✅ | Print what each fixer would write without writing. Combine with `--json`. |
 | `list --json` | ✅ | ✅ | Enumerate the library's surface area. Each entry has `{ name, description, exports, fixTarget }`. |
 | `copy <name>` | ✅ | text only | Copy a single preset (`biome`, `tsconfig`) into the current directory. |
-| `loop guard --root <path>` | ✅ | ✅ | Guard an `ai-issue-loop` tick: repair a wrongly-bare main checkout, gate the `node_modules` rebuild (`--removed`). Exit `0` continue, `1` repair failed, `2` root is not a repairable checkout — both non-zero halt the tick. |
+| `loop guard --root <path>` | ✅ | ✅ | Guard an `ai-issue-loop` tick: repair a wrongly-bare main checkout, gate the `node_modules` rebuild (`--removed`), and assert `gh` authenticates as the declared `rules.aiLoop.agentUser`. Exit `0` continue, `1` repair failed, `2` root is not a repairable checkout or the agent identity is wrong — both non-zero halt the tick. |
 
 ## Recommended workflows
 

package/README.md

@@ -67,9 +67,10 @@ Tailwind v4, exclude your stylesheet in `biome.json`:
 ```jsonc
 {
   "extends": ["@rtorcato/repo-tooling/biome"],
-  // `includes` replaces the preset's list rather than extending it — restate
-  // the exclusions you still want alongside the CSS one.
-  "files": { "includes": ["**", "!**/node_modules", "!**/dist", "!**/*.css"] }
+  // List only the extra negations — Biome merges them into the preset's
+  // `includes`. Do NOT repeat the leading `"**"`: that is a lint error,
+  // `lint/suspicious/noBiomeFirstException`.
+  "files": { "includes": ["!**/*.css"] }
 }
 ```
 
@@ -91,7 +92,7 @@ See the [Getting Started guide](https://rtorcato.github.io/repo-tooling/guides/g
 | `copy <config>` | Copy a single config file into the current project. | `npx @rtorcato/repo-tooling copy biome` |
 | `doctor` | Diagnose an existing project for missing or drifted tooling. | `npx @rtorcato/repo-tooling doctor` |
 | `fix [target]` | Apply scaffolders for what `doctor` flagged (`--yes`, `--dry-run`, `--diff`). | `npx @rtorcato/repo-tooling fix` |
-| `loop guard` | Repair a main checkout that has gone `core.bare = true`, and gate the `node_modules` rebuild after a worktree removal. Exits `1` if the repair failed and `2` if the root is not a repairable checkout — see `--help`. | `npx @rtorcato/repo-tooling loop guard --root .` |
+| `loop guard` | Repair a main checkout that has gone `core.bare = true`, gate the `node_modules` rebuild after a worktree removal, and halt when `gh` is not authenticated as the `rules.aiLoop.agentUser` the repo declares. Exits `1` if the repair failed and `2` if the root is not a repairable checkout or the identity is wrong — see `--help`. | `npx @rtorcato/repo-tooling loop guard --root .` |
 
 Prefer to run the audit in CI? `doctor` also ships as a GitHub Action:
 

package/dist/cli/commands/loop-guard.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import chalk from 'chalk';
 import fs from 'fs-extra';
 import { realGitExec } from '../../base/git-identity.js';
+import { realGhExec } from '../../base/github-settings.js';
 /**
  * The invariant table from the skill, verified on git 2.55.0:
  *
@@ -34,6 +35,45 @@ export function classifyRoot(insideWorkTree, gitEntry) {
         return 'linked-worktree';
     return 'genuinely-bare';
 }
+const LOCKFILE = '.repo-tooling.json';
+/**
+ * `rules.aiLoop.agentUser`, with the flat pre-v4 fallback — the same pair the
+ * skill's `jq` reads. Read raw rather than through `readLockfile`, whose parser
+ * requires a `record.config`: a hand-written rules-only lockfile is exactly the
+ * file this has to see.
+ */
+export async function configuredAgentUser(root) {
+    const raw = await fs.readJson(path.join(root, LOCKFILE)).catch(() => null);
+    const user = raw?.rules?.aiLoop?.agentUser ?? raw?.aiLoop?.agentUser;
+    return typeof user === 'string' && user.trim() !== '' ? user.trim() : undefined;
+}
+/**
+ * Declared intent that is not met is a misconfiguration, not a degraded mode —
+ * so this halts, unlike the assignability check in `base/agent-user.ts`, which
+ * warns and carries on. That check can never catch this: `agentUser` is
+ * assignable regardless of who is calling.
+ */
+export async function checkAgentIdentity(configured, gh) {
+    if (!configured) {
+        return {
+            verdict: 'not-configured',
+            message: `no aiLoop.agentUser in ${LOCKFILE} — identity check skipped`,
+        };
+    }
+    const r = await gh(['api', 'user', '--jq', '.login']);
+    const effective = r.ok ? r.stdout.trim() : '';
+    // GitHub logins are case-insensitive, so a case difference is one account.
+    if (effective !== '' && effective.toLowerCase() === configured.toLowerCase()) {
+        return {
+            verdict: 'match',
+            message: `gh is authenticated as ${effective} — the configured agent account`,
+        };
+    }
+    return {
+        verdict: 'mismatch',
+        message: `⚠ agentUser is ${configured} but gh authenticates as ${effective || '(gh could not say — unauthenticated or missing)'} — the tick would commit, push and review as the wrong account`,
+    };
+}
 /**
  * `--frozen-lockfile` forbids re-resolution, so neither `pnpm-lock.yaml` nor a
  * `pnpm-workspace.yaml` carve-out moves as a side effect of a cleanup.
@@ -99,6 +139,7 @@ export async function runLoopGuard(options = {}) {
         ? path.resolve(options.worktreeRoot)
         : defaultWorktreeRoot(root);
     const git = options.git ?? ((args) => realGitExec(args, root));
+    const gh = options.gh ?? ((args, stdin) => realGhExec(args, stdin, root));
     const install = options.install ?? realInstall;
     const messages = [];
     const state = classifyRoot(await git(['rev-parse', '--is-inside-work-tree']), await gitEntryKind(root));
@@ -127,6 +168,11 @@ export async function runLoopGuard(options = {}) {
     else {
         messages.push('main checkout is a work tree');
     }
+    const { verdict: identity, message: identityMessage } = await checkAgentIdentity(await configuredAgentUser(root), gh);
+    messages.push(identityMessage);
+    // A failed repair (1) is the more specific verdict, so it keeps the code.
+    if (identity === 'mismatch' && exitCode === 0)
+        exitCode = 2;
     const live = await findLive([worktreeRoot, path.join(root, '.claude', 'worktrees')]);
     const rebuild = await decideRebuild({ root, removed: options.removed === true, exitCode, live });
     let outcome = rebuild;
@@ -146,7 +192,7 @@ export async function runLoopGuard(options = {}) {
             messages.push('node_modules rebuilt');
         }
     }
-    return { root, worktreeRoot, state, bare, rebuild: outcome, live, exitCode, messages };
+    return { root, worktreeRoot, state, bare, identity, rebuild: outcome, live, exitCode, messages };
 }
 /**
  * The three load-bearing conditions, kept separate from the run so a test can

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.36.0",
+	"version": "3.37.0",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [

package/skills/ai-issue-loop/SKILL.md

@@ -232,6 +232,23 @@ AGENT_USER="${AI_LOOP_AGENT:-$(jq -r '.rules.aiLoop.agentUser // .aiLoop.agentUs
   AGENT_USER=""; }; }
 ```
 
+**Then prove `gh` is *authenticating as* that account — this one halts the
+tick.** Assignability passes no matter who is calling, so on a machine where the
+agent identity was never configured both checks above are green while `gh` is
+the owner: worktrees, commits, PRs and reviews all land under the owner's
+account, and the split only shows up in `git log` afterwards (#601).
+
+```bash
+# Exit 0 continue, non-zero halt — also covers the bare-checkout repair. The
+# identity check is skipped entirely when no agentUser is declared.
+npx @rtorcato/repo-tooling loop guard --root "$ROOT" || exit 1
+```
+
+Configured intent that is not met is a misconfiguration, not a degraded mode —
+which is why this halts where the assignability check merely warns. Fix it by
+pointing `gh` at the agent account on this machine, or by removing
+`rules.aiLoop.agentUser`.
+
 **It lives in the repo, not a shell profile.** The agent account is a
 collaborator on *this* repo, so a machine-wide env var is both the wrong
 granularity and invisible — forgotten on a new laptop, with the only symptom