@soulbatical/tetra-dev-toolkit 1.8.5 → 1.8.7

package/bin/tetra-check-rls.js

@@ -34,17 +34,18 @@ import chalk from 'chalk'
 
 // Load tetra-core dynamically (it's a peer/workspace dep)
 async function loadTetraCore() {
-  try {
-    return await import('@soulbatical/tetra-core')
-  } catch {
-    // Fallback: try relative path in monorepo
-    try {
-      return await import('../../core/dist/index.js')
-    } catch {
-      console.error(chalk.red('ERROR: @soulbatical/tetra-core not found. Install it first.'))
-      process.exit(1)
-    }
+  // Try multiple paths: direct import, monorepo sibling, backend workspace
+  const attempts = [
+    () => import('@soulbatical/tetra-core'),
+    () => import('../../core/dist/index.js'),
+    () => import(join(process.cwd(), 'backend', 'node_modules', '@soulbatical', 'tetra-core', 'dist', 'index.js')),
+    () => import(join(process.cwd(), 'node_modules', '@soulbatical', 'tetra-core', 'dist', 'index.js')),
+  ]
+  for (const attempt of attempts) {
+    try { return await attempt() } catch { /* next */ }
   }
+  console.error(chalk.red('ERROR: @soulbatical/tetra-core not found. Install it first.'))
+  process.exit(1)
 }
 
 function findSupabaseConfig() {

package/bin/tetra-setup.js

@@ -153,7 +153,7 @@ echo "✅ Pre-commit checks passed"
     console.log('   ⏭️  .husky/pre-commit already exists (use --force to overwrite)')
   }
 
-  // Create or extend pre-push hook with hygiene check
+  // Create or extend pre-push hook with hygiene check + RLS security gate
   const prePushPath = join(huskyDir, 'pre-push')
   const hygieneBlock = `
 # Tetra hygiene check — blocks push if repo contains clutter
@@ -167,23 +167,72 @@ if [ $? -ne 0 ]; then
   exit 1
 fi
 echo "✅ Repo hygiene passed"
+`
+
+  // RLS security gate — auto-detects Doppler project from doppler.yaml
+  const rlsBlock = `
+# Tetra RLS Security Gate — blocks push if DB has security violations
+# Auto-detects Doppler project from doppler.yaml
+DOPPLER_PROJECT=""
+for dopfile in doppler.yaml backend/doppler.yaml; do
+  if [ -f "$dopfile" ]; then
+    DOPPLER_PROJECT=$(grep 'project:' "$dopfile" | head -1 | sed 's/.*project: *//')
+    break
+  fi
+done
+
+if [ -n "$DOPPLER_PROJECT" ]; then
+  echo ""
+  echo "🔐 Running RLS security gate..."
+  doppler run --project "$DOPPLER_PROJECT" --config dev_backend -- npx tetra-check-rls --errors-only 2>/dev/null
+  RLS_EXIT=$?
+  if [ $RLS_EXIT -ne 0 ]; then
+    echo ""
+    echo "════════════════════════════════════════════════════════════"
+    echo "❌ PUSH BLOCKED — RLS SECURITY VIOLATION"
+    echo "════════════════════════════════════════════════════════════"
+    echo ""
+    echo "Fix all errors before pushing."
+    echo "Run for details: doppler run --project $DOPPLER_PROJECT --config dev_backend -- npx tetra-check-rls"
+    echo ""
+    exit 1
+  fi
+  echo "✅ RLS security gate passed"
+else
+  echo "⚠️  No doppler.yaml found — skipping RLS check (add doppler.yaml to enable)"
+fi
 `
 
   if (!existsSync(prePushPath)) {
-    // No pre-push hook yet — create one
-    const prePushContent = `#!/bin/sh\n${hygieneBlock}\n`
+    // No pre-push hook yet — create one with both checks
+    const prePushContent = `#!/bin/sh\n${hygieneBlock}\n${rlsBlock}\n`
     writeFileSync(prePushPath, prePushContent)
     execSync(`chmod +x ${prePushPath}`)
-    console.log('   ✅ Created .husky/pre-push with hygiene check')
+    console.log('   ✅ Created .husky/pre-push with hygiene + RLS security gate')
   } else {
-    // Pre-push hook exists — add hygiene check if not already there
-    const existing = readFileSync(prePushPath, 'utf-8')
+    // Pre-push hook exists — add missing checks
+    let existing = readFileSync(prePushPath, 'utf-8')
+    let changed = false
+
     if (!existing.includes('tetra-audit hygiene')) {
-      writeFileSync(prePushPath, existing.trimEnd() + '\n' + hygieneBlock)
+      existing = existing.trimEnd() + '\n' + hygieneBlock
+      changed = true
       console.log('   ✅ Added hygiene check to existing .husky/pre-push')
     } else {
       console.log('   ⏭️  .husky/pre-push already has hygiene check')
     }
+
+    if (!existing.includes('tetra-check-rls')) {
+      existing = existing.trimEnd() + '\n' + rlsBlock
+      changed = true
+      console.log('   ✅ Added RLS security gate to existing .husky/pre-push')
+    } else {
+      console.log('   ⏭️  .husky/pre-push already has RLS security gate')
+    }
+
+    if (changed) {
+      writeFileSync(prePushPath, existing)
+    }
   }
 
   // Add prepare script to package.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.8.5",
+  "version": "1.8.7",
   "publishConfig": {
     "access": "restricted"
   },