@scheduler-systems/gal-run 0.0.377 → 0.0.378

package/dist/index.cjs

@@ -3970,7 +3970,7 @@ var cliVersion, defaultApiUrl, BUILD_CONSTANTS, constants_default;
 var init_constants = __esm({
   "src/constants.ts"() {
     "use strict";
-    cliVersion = true ? "0.0.377" : "0.0.0-dev";
+    cliVersion = true ? "0.0.378" : "0.0.0-dev";
     defaultApiUrl = true ? "https://api.gal.run" : "http://localhost:3000";
     BUILD_CONSTANTS = Object.freeze([cliVersion, defaultApiUrl]);
     constants_default = BUILD_CONSTANTS;
@@ -4880,7 +4880,7 @@ function detectEnvironment() {
     return "dev";
   }
   try {
-    const version2 = true ? "0.0.377" : void 0;
+    const version2 = true ? "0.0.378" : void 0;
     if (version2 && version2.includes("-local")) {
       return "dev";
     }
@@ -5249,7 +5249,7 @@ function getId() {
 }
 function getCliVersion() {
   try {
-    return true ? "0.0.377" : "0.0.0-dev";
+    return true ? "0.0.378" : "0.0.0-dev";
   } catch {
     return "0.0.0-dev";
   }
@@ -54040,6 +54040,84 @@ function generateGenericHook(platform5, patterns) {
     }
   };
 }
+function generateSdlcPrePushHook(apiUrl, orgName) {
+  return `#!/bin/sh
+# GAL SDLC Phase-Gate Pre-Push Hook
+# Installed by: gal enforce install --sdlc
+# Blocks pushes when the SDLC phase gate for the branch is not met.
+# Fail-open: if the API is unreachable the push is allowed.
+# To skip: git push --no-verify
+
+BRANCH=$(git rev-parse --abbrev-ref HEAD)
+
+# Skip check for main/master \u2014 phase gates apply to feature branches
+case "$BRANCH" in
+  main|master) exit 0 ;;
+esac
+
+API_URL="${apiUrl}"
+ORG_NAME="${orgName}"
+
+RESPONSE=$(curl -sf -w "\\n%{http_code}" \\
+  "\${API_URL}/organizations/\${ORG_NAME}/enforcement/sdlc/gate?branch=\${BRANCH}" \\
+  2>/dev/null) || {
+  # API unreachable \u2014 fail open
+  exit 0
+}
+
+HTTP_CODE=$(echo "$RESPONSE" | tail -n1)
+BODY=$(echo "$RESPONSE" | sed '$ d')
+
+if [ "$HTTP_CODE" != "200" ]; then
+  # Non-200 \u2014 fail open
+  exit 0
+fi
+
+ALLOWED=$(echo "$BODY" | grep -o '"allowed"\\s*:\\s*\\(true\\|false\\)' | grep -o '\\(true\\|false\\)')
+
+if [ "$ALLOWED" = "false" ]; then
+  MESSAGE=$(echo "$BODY" | grep -o '"message"\\s*:\\s*"[^"]*"' | head -1 | sed 's/"message"\\s*:\\s*"//;s/"$//')
+  echo ""
+  echo "\\033[31m[GAL] SDLC phase gate blocked this push.\\033[0m"
+  echo "\\033[33m  Branch: $BRANCH\\033[0m"
+  if [ -n "$MESSAGE" ]; then
+    echo "\\033[33m  Reason: $MESSAGE\\033[0m"
+  fi
+  echo "\\033[33m  Complete the required SDLC phase before pushing.\\033[0m"
+  echo ""
+  exit 1
+fi
+
+exit 0
+`;
+}
+function generateSdlcAgentHook(apiUrl) {
+  const hook = {
+    type: "pre_tool_call",
+    description: "GAL SDLC phase-gate enforcement \u2014 blocks tool calls when the required SDLC phase is not met.",
+    api_url: apiUrl,
+    matchers: [
+      {
+        tool_name: "Bash",
+        command_pattern: "git\\s+push",
+        action: "check_sdlc_gate"
+      },
+      {
+        tool_name: "Edit",
+        file_pattern: "^\\.github/workflows/.*\\.yml$",
+        action: "check_sdlc_gate"
+      }
+    ],
+    check_sdlc_gate: {
+      method: "GET",
+      url: `${apiUrl}/enforcement/sdlc/gate`,
+      query_params: { branch: "{{current_branch}}" },
+      block_when: { allowed: false },
+      fail_open: true
+    }
+  };
+  return JSON.stringify(hook, null, 2);
+}
 var init_hook_generator = __esm({
   "src/enforcement/hook-generator.ts"() {
     "use strict";
@@ -56667,7 +56745,7 @@ function getEnforcementHookPaths(basePath, platform5) {
 }
 function createEnforceCommand() {
   const enforce = new Command("enforce").description("Install and manage organization security policies locally");
-  enforce.command("install").description("Install organization-approved safety hooks from GAL").option("-o, --org <orgName>", "Organization name").option("-p, --platform <platform>", "Specific platform (claude, cursor, gemini, codex, windsurf)").option("--all", "Install hooks for all detected platforms").option("--path <path>", "Base path (default: current directory)").option("--force", "Overwrite existing hooks").option("--dry-run", "Show what would be installed without making changes").action(async (options) => {
+  enforce.command("install").description("Install organization-approved safety hooks from GAL").option("-o, --org <orgName>", "Organization name").option("-p, --platform <platform>", "Specific platform (claude, cursor, gemini, codex, windsurf)").option("--all", "Install hooks for all detected platforms").option("--path <path>", "Base path (default: current directory)").option("--force", "Overwrite existing hooks").option("--dry-run", "Show what would be installed without making changes").option("--sdlc", "Install SDLC phase-gate hooks (git pre-push + Claude Code agent hook)").action(async (options) => {
     const spinner = ora();
     try {
       const config2 = ConfigManager.load();
@@ -56737,6 +56815,29 @@ Installing hooks for: ${platforms.join(", ")}`));
         const msg = err instanceof Error ? err.message : String(err);
         spinner.warn(`Git pre-commit hook: ${msg}`);
       }
+      if (options.sdlc) {
+        const sdlcApiUrl = config2.apiUrl || defaultApiUrl7;
+        spinner.start("Installing SDLC git pre-push hook...");
+        try {
+          if (!options.dryRun) {
+            await installSdlcPrePushHook(basePath, sdlcApiUrl, orgName, options.force);
+          }
+          spinner.succeed(`Installed SDLC git pre-push hook \u2192 ${source_default.dim(".git/hooks/pre-push")}`);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          spinner.warn(`SDLC git pre-push hook: ${msg}`);
+        }
+        spinner.start("Installing SDLC Claude Code agent hook...");
+        try {
+          if (!options.dryRun) {
+            await installSdlcAgentHook(basePath, sdlcApiUrl, options.force);
+          }
+          spinner.succeed(`Installed SDLC agent hook \u2192 ${source_default.dim(".claude/hooks/sdlc-phase-gate.json")}`);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          spinner.warn(`SDLC agent hook: ${msg}`);
+        }
+      }
       console.log(source_default.green("\nEnforcement hooks installed successfully!"));
       console.log(source_default.dim("AI agents will now enforce your organization's security policies."));
       console.log(source_default.dim("Git commits will be validated against approved policy via pre-commit hook."));
@@ -57673,7 +57774,46 @@ async function removeGitPrecommitHook(basePath) {
   }
   await (0, import_promises4.writeFile)(hookPath, filtered.join("\n"), "utf-8");
 }
-var import_promises4, import_node_fs2, import_node_path3, import_node_crypto, defaultApiUrl7, PLATFORM_DIRS3, SCAN_PLATFORM_DIRS, ENFORCEMENT_HOOK_SUPPORT, GAL_PRECOMMIT_MARKER, GAL_PRECOMMIT_CONTENT;
+async function installSdlcPrePushHook(basePath, apiUrl, orgName, force) {
+  const gitDir = (0, import_node_path3.join)(basePath, ".git");
+  if (!(0, import_node_fs2.existsSync)(gitDir)) {
+    throw new Error("Not a git repository");
+  }
+  const hooksDir = (0, import_node_path3.join)(gitDir, "hooks");
+  const hookPath = (0, import_node_path3.join)(hooksDir, "pre-push");
+  if ((0, import_node_fs2.existsSync)(hookPath)) {
+    const existing = await (0, import_promises4.readFile)(hookPath, "utf-8");
+    if (existing.includes(GAL_SDLC_PREPUSH_MARKER)) {
+      if (!force) {
+        throw new Error("SDLC pre-push hook already installed. Use --force to overwrite.");
+      }
+    }
+  }
+  await (0, import_promises4.mkdir)(hooksDir, { recursive: true });
+  const hookContent = generateSdlcPrePushHook(apiUrl, orgName);
+  if ((0, import_node_fs2.existsSync)(hookPath)) {
+    const existing = await (0, import_promises4.readFile)(hookPath, "utf-8");
+    if (!existing.includes(GAL_SDLC_PREPUSH_MARKER)) {
+      const appended = existing.trimEnd() + "\n\n" + hookContent.replace("#!/bin/sh\n", "");
+      await (0, import_promises4.writeFile)(hookPath, appended, "utf-8");
+      await (0, import_promises4.chmod)(hookPath, 493);
+      return;
+    }
+  }
+  await (0, import_promises4.writeFile)(hookPath, hookContent, "utf-8");
+  await (0, import_promises4.chmod)(hookPath, 493);
+}
+async function installSdlcAgentHook(basePath, apiUrl, force) {
+  const claudeHooksDir = (0, import_node_path3.join)(basePath, ".claude", "hooks");
+  const hookPath = (0, import_node_path3.join)(claudeHooksDir, "sdlc-phase-gate.json");
+  if ((0, import_node_fs2.existsSync)(hookPath) && !force) {
+    throw new Error("SDLC agent hook already installed. Use --force to overwrite.");
+  }
+  await (0, import_promises4.mkdir)(claudeHooksDir, { recursive: true });
+  const hookContent = generateSdlcAgentHook(apiUrl);
+  await (0, import_promises4.writeFile)(hookPath, hookContent, "utf-8");
+}
+var import_promises4, import_node_fs2, import_node_path3, import_node_crypto, defaultApiUrl7, PLATFORM_DIRS3, SCAN_PLATFORM_DIRS, ENFORCEMENT_HOOK_SUPPORT, GAL_PRECOMMIT_MARKER, GAL_PRECOMMIT_CONTENT, GAL_SDLC_PREPUSH_MARKER;
 var init_enforce = __esm({
   "src/commands/enforce.ts"() {
     "use strict";
@@ -57685,6 +57825,7 @@ var init_enforce = __esm({
     import_node_path3 = require("node:path");
     import_node_crypto = require("node:crypto");
     init_enforcement();
+    init_hook_generator();
     init_config_manager();
     init_constants();
     init_CoreServiceProvider();
@@ -57742,6 +57883,7 @@ fi
 
 exit $EXIT_CODE
 `;
+    GAL_SDLC_PREPUSH_MARKER = "# GAL SDLC Phase-Gate Pre-Push Hook";
   }
 });
 
@@ -70762,7 +70904,7 @@ var init_index = __esm({
 });
 
 // src/bootstrap.ts
-var cliVersion10 = true ? "0.0.377" : "0.0.0-dev";
+var cliVersion10 = true ? "0.0.378" : "0.0.0-dev";
 var args = process.argv.slice(2);
 var requestedGlobalHelp = args.length === 1 && (args[0] === "--help" || args[0] === "-h");
 var requestedVersion = args.length === 1 && (args[0] === "--version" || args[0] === "-V");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scheduler-systems/gal-run",
-  "version": "0.0.377",
+  "version": "0.0.378",
   "description": "GAL CLI - Command-line tool for managing AI agent configurations across your organization",
   "license": "Elastic-2.0",
   "private": false,