@specship/specship-win32-arm64 0.11.8 → 0.12.0

package/lib/dist/bin/specship.js

@@ -115,11 +115,79 @@ async function loadServerPackage() {
  * The JSONL ingest watcher now ships inside `@specship/specship-server`
  * itself — `createServer({ ingest: true })` starts it. No separate package.
  */
+/**
+ * Claude Code's slug encoding (every non-alphanumeric char → '-') is lossy,
+ * so decoding by mapping '-' back to '/' mangles any path containing
+ * hyphens/dots/underscores. Recover real paths from `~/.claude.json` (its
+ * `projects` object is keyed by real absolute paths), then from a `"cwd"`
+ * value in the slug's newest transcript, before falling back to the lossy
+ * decode. Mirrors `packages/server/src/ingest/project-paths.ts`
+ * (REQ-SLUGRES-004) — the server package depends on this one, so the CLI
+ * can't import it.
+ */
+function buildClaudeSlugIndex() {
+    const bySlug = new Map();
+    try {
+        const raw = fs.readFileSync(path.join(os.homedir(), '.claude.json'), 'utf8');
+        const parsed = JSON.parse(raw);
+        for (const realPath of Object.keys(parsed.projects ?? {})) {
+            bySlug.set(realPath.replace(/[^A-Za-z0-9]/g, '-'), realPath);
+        }
+    }
+    catch { /* missing or malformed — sniff/fallback below still work */ }
+    return bySlug;
+}
+function sniffClaudeSlugCwd(claudeRoot, slug) {
+    const dir = path.join(claudeRoot, slug);
+    let newest = null;
+    try {
+        for (const f of fs.readdirSync(dir, { withFileTypes: true })) {
+            if (!f.isFile() || !f.name.toLowerCase().endsWith('.jsonl'))
+                continue;
+            const st = fs.statSync(path.join(dir, f.name));
+            if (!newest || st.mtimeMs > newest.mtimeMs)
+                newest = { file: f.name, mtimeMs: st.mtimeMs };
+        }
+    }
+    catch {
+        return null;
+    }
+    if (!newest)
+        return null;
+    try {
+        const fd = fs.openSync(path.join(dir, newest.file), 'r');
+        let chunk;
+        try {
+            const buf = Buffer.alloc(64 * 1024);
+            const read = fs.readSync(fd, buf, 0, buf.length, 0);
+            chunk = buf.toString('utf8', 0, read);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        const m = /"cwd"\s*:\s*"((?:[^"\\]|\\.)*)"/.exec(chunk);
+        if (!m)
+            return null;
+        let cwd = JSON.parse(`"${m[1]}"`);
+        // Accept the cwd or an ancestor of it — sessions may record a subdir.
+        for (;;) {
+            if (cwd.replace(/[^A-Za-z0-9]/g, '-') === slug)
+                return cwd;
+            const parent = path.dirname(cwd);
+            if (parent === cwd)
+                return null;
+            cwd = parent;
+        }
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Auto-pick a default project for `specship serve --ui` when the user
  * didn't pass `-p` and the cwd isn't initialized either. Walks
  * `~/.claude/projects/*` (Claude Code's per-project transcript dirs),
- * decodes each slug back to a real path, and returns the most-recently-
+ * resolves each slug back to a real path, and returns the most-recently-
  * touched one that's still on disk AND has been `specship init`'d.
  *
  * Returns null when nothing qualifies — the server boots projectless and
@@ -134,13 +202,15 @@ async function pickRecentInitializedProject() {
     catch {
         return null;
     }
+    const slugIndex = buildClaudeSlugIndex();
     const candidates = [];
     for (const ent of entries) {
         if (!ent.isDirectory())
             continue;
         const slug = ent.name;
-        // Same encoding the server's decodeProjectSlug uses: '-' → '/'.
-        const decoded = slug.startsWith('-') ? '/' + slug.slice(1).replace(/-/g, '/') : slug;
+        const decoded = slugIndex.get(slug) ??
+            sniffClaudeSlugCwd(claudeRoot, slug) ??
+            (slug.startsWith('-') ? '/' + slug.slice(1).replace(/-/g, '/') : slug);
         try {
             const st = fs.statSync(decoded);
             if (!st.isDirectory())
@@ -172,54 +242,6 @@ async function pickRecentInitializedProject() {
     candidates.sort((a, b) => b.lastTouched - a.lastTouched);
     return candidates[0]?.decoded ?? null;
 }
-/**
- * Locate the built Angular UI for `specship serve --ui`. Mirrors the
- * lookup order in `packages/server/src/cli.ts:locateWebDir` so both entry
- * points behave identically. Returns null when nothing is found — the
- * server then runs API-only.
- */
-function locateWebDir(explicit) {
-    const envDir = process.env.SPECSHIP_WEB_DIR ?? process.env.SPECSHIP_WEB_DIR;
-    const candidates = [];
-    if (explicit)
-        candidates.push(path.resolve(explicit));
-    if (envDir)
-        candidates.push(path.resolve(envDir));
-    // 1. Bundled mode — `dist/web/` next to this CLI. This is what every
-    //    `npm i -g @specship/specship` install hits.
-    candidates.push(path.resolve(__dirname, '..', 'web'));
-    // 2. Legacy / forward-compat: the old `@specship/specship-server`
-    //    used to ship the SPA at <pkg>/public/web.
-    try {
-        const pkgJson = require.resolve('@specship/specship-server/package.json');
-        candidates.push(path.resolve(path.dirname(pkgJson), 'public', 'web'));
-    }
-    catch { /* not installed as separate package — fall through */ }
-    // 3. Dev monorepo layouts (running from a checkout).
-    candidates.push(path.resolve(__dirname, '..', '..', 'packages', 'server', 'public', 'web'));
-    candidates.push(path.resolve(__dirname, '..', '..', '..', 'packages', 'server', 'public', 'web'));
-    candidates.push(path.resolve(__dirname, '..', '..', 'packages', 'web-ng', 'dist', 'web-ng', 'browser'));
-    candidates.push(path.resolve(__dirname, '..', '..', '..', 'packages', 'web-ng', 'dist', 'web-ng', 'browser'));
-    // 4. Walk up from cwd in case the bin is run inside a checkout.
-    let cur = process.cwd();
-    for (let depth = 0; depth < 6; depth++) {
-        candidates.push(path.join(cur, 'dist', 'web'));
-        candidates.push(path.join(cur, 'packages', 'server', 'public', 'web'));
-        candidates.push(path.join(cur, 'packages', 'web-ng', 'dist', 'web-ng', 'browser'));
-        const parent = path.dirname(cur);
-        if (parent === cur)
-            break;
-        cur = parent;
-    }
-    for (const c of candidates) {
-        try {
-            if (fs.existsSync(path.join(c, 'index.html')))
-                return c;
-        }
-        catch { /* ignore */ }
-    }
-    return null;
-}
 // Dynamic import helper — tsc compiles import() to require() in CJS mode,
 // which fails for ESM-only packages. This bypasses the transformation.
 // eslint-disable-next-line @typescript-eslint/no-implied-eval
@@ -769,9 +791,28 @@ function main() {
     program
         .command('sync [path]')
         .description('Sync changes since last index')
-        .option('-q, --quiet', 'Suppress output (for git hooks)')
+        .option('-q, --quiet', 'Suppress output (for git hooks); drift-transition notices still print')
+        .option('--drift-summary', 'After syncing, print a one-line drifted-link summary when the queue is non-empty (for the SessionStart hook)')
         .action(async (pathArg, options) => {
         const projectPath = resolveProjectPath(pathArg);
+        // One line per link that TRANSITIONED into drifted this sync
+        // (REQ-DRIFT-PUSH-001). Deliberately printed even under --quiet — the
+        // auto-sync hook runs with --quiet, and these notices are its payload.
+        const pushDriftNotices = (result) => {
+            for (const t of result.driftedTransitions ?? []) {
+                console.log(`⚠ spec drift: ${t.specId} ${t.fromState}→drifted (${t.symbol} ${t.axis === 'spec' ? 'spec changed' : 'changed'}) — ` +
+                    `re-assert with specship_link_assert, or run /specship:check fix ${t.specId}`);
+            }
+        };
+        // One-line drift-queue summary, only when non-empty (REQ-DRIFT-PUSH-002).
+        const pushDriftSummary = (cg) => {
+            if (!options.driftSummary)
+                return;
+            const drifted = cg.getSpecQueries().getLinksByState(['drifted']).length;
+            if (drifted > 0) {
+                console.log(`⚠ ${drifted} spec link(s) drifted — review with /specship:check drifted`);
+            }
+        };
         try {
             if (!(0, directory_1.isInitialized)(projectPath)) {
                 if (!options.quiet) {
@@ -782,7 +823,9 @@ function main() {
             const { default: SpecShip } = await loadSpecShip();
             const cg = await SpecShip.open(projectPath);
             if (options.quiet) {
-                await cg.sync();
+                const result = await cg.sync();
+                pushDriftNotices(result);
+                pushDriftSummary(cg);
                 cg.destroy();
                 return;
             }
@@ -809,6 +852,8 @@ function main() {
                     details.push(`Removed: ${result.filesRemoved}`);
                 clack.log.info(`${details.join(', ')} ${(0, glyphs_1.getGlyphs)().dash} ${formatNumber(result.nodesUpdated)} nodes in ${formatDuration(result.durationMs)}`);
             }
+            pushDriftNotices(result);
+            pushDriftSummary(cg);
             clack.outro('Done');
             cg.destroy();
         }
@@ -1450,11 +1495,18 @@ function main() {
      * GATING check fails. Which checks gate vs advise is configured in
      * specship.config.json `enforce.gate`; with no config every check is advisory
      * and the command exits 0 (opt-in — never breaks an existing repo).
+     *
+     * The graduation ramp (REQ-ENFORCE-004): `--strict` gates every check for
+     * one run; `--enable-gate <checks...>` persists gating into the config and
+     * then runs; an advisory run with would-be-gating findings ends by printing
+     * the exact `--enable-gate` command that turns the gate on.
      */
     program
         .command('check [path]')
         .description('Run the enforcement gate (drift + fitness + maintainability + behaviour); exits non-zero on a gating failure')
         .option('-j, --json', 'Output as JSON')
+        .option('--strict', 'Treat every check as gating for this run only (nothing read from or written to config)')
+        .option('--enable-gate <checks...>', 'Persist gating for the named checks into specship.config.json, then run the gate')
         .action(async (pathArg, options) => {
         const projectPath = resolveProjectPath(pathArg);
         try {
@@ -1462,9 +1514,25 @@ function main() {
                 error(`SpecShip not initialized in ${projectPath}`);
                 process.exit(1);
             }
+            const enforce = await Promise.resolve().then(() => __importStar(require('../enforce/enforce')));
+            // --enable-gate writes the opt-in config, then falls through to a
+            // normal run so the user immediately sees the gate with teeth
+            // (REQ-ENFORCE-004.A1).
+            if (options.enableGate?.length) {
+                const invalid = options.enableGate.filter((c) => !enforce.ALL_CHECKS.includes(c));
+                if (invalid.length) {
+                    error(`Unknown check(s): ${invalid.join(', ')}. Valid: ${enforce.ALL_CHECKS.join(', ')}`);
+                    process.exit(1);
+                }
+                const enabled = enforce.enableGateChecks(projectPath, options.enableGate);
+                if (enabled.length) {
+                    success(`Gating enabled for ${enabled.join(', ')} — written to specship.config.json.`);
+                }
+            }
             const { default: SpecShip } = await loadSpecShip();
             const cg = await SpecShip.open(projectPath);
-            const r = cg.getEnforce();
+            // --strict gates everything for this run only (REQ-ENFORCE-004.A2).
+            const r = options.strict ? cg.getEnforce(enforce.strictEnforceConfig()) : cg.getEnforce();
             if (options.json) {
                 console.log(JSON.stringify(r, null, 2));
                 cg.destroy();
@@ -1486,6 +1554,16 @@ function main() {
                 success(r.gatedFailures.length === 0 && r.checks.some((c) => c.gating)
                     ? 'All gating checks pass.'
                     : 'Pass (no gating checks failed).');
+                // The advisory sell (REQ-ENFORCE-004.A1): findings that would fail
+                // a gated run end the report with the exact opt-in command.
+                const wouldGate = r.checks.filter((c) => !c.gating && !c.passed).map((c) => c.check);
+                if (wouldGate.length) {
+                    const total = r.checks
+                        .filter((c) => wouldGate.includes(c.check))
+                        .reduce((n, c) => n + c.findings.length, 0);
+                    console.log(chalk.dim(`\n  ${total} advisory finding(s) would fail a gated run.` +
+                        `\n  Enable: specship check --enable-gate ${wouldGate.join(' ')}\n`));
+                }
                 cg.destroy();
                 return;
             }
@@ -1555,10 +1633,10 @@ function main() {
                 // node_modules/@specship/specship-server, OR (dev) the
                 // sibling packages/server/dist directory.
                 const { createServer } = await loadServerPackage();
-                // Locate the built Angular UI so the same port serves the SPA at /.
-                // `--no-web` opts out (Commander sets web=false then). Otherwise we
-                // try the explicit --web-dir, then auto-detect.
-                const webDir = options.web === false ? null : locateWebDir(options.webDir ?? null);
+                // The dashboard is the lean server-rendered UI (DASH-LEAN-DOC), served
+                // in-process by the server itself — no separate SPA build. `--no-web`
+                // still opts out to run API-only.
+                const serveUi = options.web !== false;
                 // The JSONL ingest watcher now starts in-process inside createServer
                 // when `ingest: true`. The server owns its lifecycle; CLI just toggles.
                 const handle = await createServer({
@@ -1566,7 +1644,8 @@ function main() {
                     host,
                     port,
                     ingest: options.ingest !== false,
-                    webDir,
+                    webDir: null,
+                    ssr: serveUi,
                     verbose: false,
                 });
                 console.error(chalk.bold('\nSpecShip Desktop server\n'));
@@ -1575,15 +1654,11 @@ function main() {
                     console.error(chalk.dim(`  project: ${root}`));
                 }
                 else {
-                    console.error(chalk.yellow((0, glyphs_1.getGlyphs)().warn) + ' no primary project — pick one in the desktop UI');
+                    console.error(chalk.yellow((0, glyphs_1.getGlyphs)().warn) + ' no primary project — pick one in the dashboard');
                     console.error(chalk.dim('  analytics endpoints will return 409 until one is selected'));
                 }
-                if (webDir) {
-                    console.error(chalk.green((0, glyphs_1.getGlyphs)().ok) + ` SPA:      ${handle.url}/  (from ${webDir})`);
-                }
-                else if (options.web !== false) {
-                    console.error(chalk.yellow((0, glyphs_1.getGlyphs)().warn) + ' UI not found — running API-only.');
-                    console.error(chalk.dim('  Build it first: cd packages/server && npm run build:all'));
+                if (serveUi) {
+                    console.error(chalk.green((0, glyphs_1.getGlyphs)().ok) + ` Dashboard: ${handle.url}/  (server-rendered)`);
                 }
                 if (options.ingest !== false) {
                     console.error(chalk.dim('  Claude Code transcript ingest watcher active'));