@timekast/factory 2.3.1 → 2.5.0

package/dist/lib/kit-settings-history.json

@@ -0,0 +1,13 @@
+{
+    "473a92392f7357596cf877cf4703a49ee03786141313e0959734c8c537561006": "0c2922a8fce7c8073d3740392caaedbdd1b502efd0da07b988fca271dd32bc93",
+    "ac139661924928e1080053b6032409c6b105f5c929355ce95ff5a91ee03cd100": "f24cc44dd20bb99edf5511e1202948fe3fe35ee063e283790eaabdf07eac6cee",
+    "9784f61835263225d26c4f2d5646e9540597667173510e4865c64439aff26950": "b582d978287acf77175fdc0048d23771da7b8c6f04d519eb98253d6b726d624a",
+    "04664118924eb3a936fff0c37818befe0b950e8cc5fc8ced04917d4575b1dae8": "69fc8443158543232b07c6e0177a4630b25287f7b298811192ec5ecc65586fa9",
+    "a2fd91e21cf3110ad7c59b54b209ae2228e9797e16ef346e040af01dd640f1ef": "d1f75b3591fc12ac29c670183376cd1a1c79f30149be0aa28c5e412a6879227b",
+    "0b834d5e7f2e14d2d617b665bd768b89876d2bd8e3f17244a03194c02d03c528": "7ad35befedc2260fb75df0d6bd4c42720c478e02f97f1d43e23769fd7516da78",
+    "2ab69db4fcab8cd10637b41004503caaedf30855af7779bc19cc85ea39f9b62a": "49cb2ac5d07b69fa9d35c7ab97acd23a311c0fe76cbacd74e137e7dce5300ef2",
+    "8ab33214c9204aebfb655a9f8b44fdf14e3d6e553b6142014f54b441400b82af": "2cc1afb006290a1ddf88b43b9fdc9f12354f1c22c5983c52a9d47c796a0c44ff",
+    "6248c3c08b75455d5e0af8fd38089ac48a501ed851d4982b1fb2bbbade76f8ed": "bc50ff7698b6e7f9573649015295a58b3667d3eed72e8369f1178b3f2d553b53",
+    "62f90996cf30610266fc95b8be85ac6e79b2156d03083415dc7c063b9efe4205": "d48522be6e87f07ae60c8cd26bda469014d0fe15632f3ff8a0a50562a58d44d9",
+    "5a11e07728b61229a0cbcc5f9b31daf8c71e8c701f5daf4b026328226481d167": "92ad1c42bd0f3f4e93ba9a3ff358d084083ad87acc8719dfc7211edd76c30348"
+}

package/dist/lib/lockfile.js

@@ -32,7 +32,7 @@ import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 import { CLIError } from './cli-error.js';
-import { CLAUDE_MD_FILE, LOCKFILE_FILE, MANIFEST_FILE, TIMEKAST_DIR, } from './constants.js';
+import { CLAUDE_MD_FILE, KIT_DEPS_FILE, LOCKFILE_FILE, MANIFEST_FILE, TIMEKAST_DIR, } from './constants.js';
 /**
  * Write the initial lockfile in `destDir/.timekast/lockfile.json` (used by
  * `new` / `add`). On the initial install the lockfile carries the tarball's
@@ -54,9 +54,11 @@ export function writeInitialLockfile(destDir, manifestRaw) {
     const stamped = { ...manifest, factoryVersion: manifest.version };
     // If the tarball already unpacked manifest.json into .timekast/, drop it: the
     // stamped lockfile is the SSOT and we do not keep a duplicate manifest around.
-    const unpackedManifest = path.join(timekastDir, MANIFEST_FILE);
-    if (existsSync(unpackedManifest)) {
-        rmSync(unpackedManifest, { force: true });
+    // Same for the dependency list (Factory#78): it is read from the staged tarball, never kept.
+    for (const unpacked of [MANIFEST_FILE, KIT_DEPS_FILE]) {
+        const abs = path.join(timekastDir, unpacked);
+        if (existsSync(abs))
+            rmSync(abs, { force: true });
     }
     writeLockfile(destDir, stamped);
 }
@@ -124,7 +126,10 @@ export function parseLockfile(raw, source = 'lockfile') {
         if (typeof e.path !== 'string' || typeof e.hash !== 'string') {
             throw new CLIError(`El ${source} tiene una entrada sin \`path\`/\`hash\` en files[${i}].`);
         }
-        return { path: e.path, hash: e.hash };
+        const keys = Array.isArray(e.keys) && e.keys.every((k) => typeof k === 'string')
+            ? { keys: e.keys }
+            : {};
+        return { path: e.path, hash: e.hash, ...keys };
     });
     return {
         version: obj.version,

package/dist/lib/prune-git.js

@@ -0,0 +1,81 @@
+/**
+ * Git plumbing for `factory prune`: list what the repo tracks, and commit a set of
+ * untrack + add operations WITHOUT going through the shared index.
+ *
+ * Why a private index and not the kit's usual commit-by-pathspec (`GIT.md §3.6.1`): a
+ * pathspec commit takes the listed paths' content from the WORKING TREE, so a path removed
+ * with `git rm --cached` (still on disk, now ignored) is put right back — the commit records
+ * no deletion and the methodology stays published. Staging the removal in the real index
+ * instead would leave it there for any other commit to swallow. A throwaway index seeded from
+ * HEAD gives both properties: the commit holds exactly these operations, and nothing another
+ * session staged can ride along.
+ */
+import { existsSync, rmSync } from 'node:fs';
+import path from 'node:path';
+import { execa } from 'execa';
+import { CLIError } from './cli-error.js';
+/** Every path the index tracks (POSIX, repo-relative). */
+export async function trackedFiles(rootDir) {
+    const res = await execa('git', ['ls-files', '-z'], { cwd: rootDir, reject: false });
+    if (res.exitCode !== 0) {
+        throw new CLIError(`No se pudo listar los archivos del repo (\`git ls-files\`): ${res.stderr}`);
+    }
+    return res.stdout.split('\0').filter(Boolean);
+}
+/**
+ * Commit `remove` + `add` on top of HEAD through a private index, then bring the real index
+ * of those paths in line with the new HEAD. Hooks run as for any commit. Nothing to commit →
+ * `{ committed: false }`, no empty commit.
+ */
+export async function commitWithPrivateIndex(rootDir, input) {
+    const gitDirRes = await execa('git', ['rev-parse', '--absolute-git-dir'], {
+        cwd: rootDir,
+        reject: false,
+    });
+    if (gitDirRes.exitCode !== 0) {
+        throw new CLIError('Esto no es un repo git.');
+    }
+    const indexFile = path.join(gitDirRes.stdout.trim(), `tk-prune-index-${process.pid}`);
+    const env = { ...process.env, GIT_INDEX_FILE: indexFile };
+    const run = (args) => execa('git', args, { cwd: rootDir, env, reject: false });
+    try {
+        const head = await execa('git', ['rev-parse', '--verify', '-q', 'HEAD'], {
+            cwd: rootDir,
+            reject: false,
+        });
+        const seeded = await run(head.exitCode === 0 ? ['read-tree', 'HEAD'] : ['read-tree', '--empty']);
+        if (seeded.exitCode !== 0)
+            throw new CLIError(`\`git read-tree\` falló: ${seeded.stderr}`);
+        if (input.remove.length > 0) {
+            const rm = await run(['rm', '--cached', '-q', '--ignore-unmatch', '--', ...input.remove]);
+            if (rm.exitCode !== 0)
+                throw new CLIError(`\`git rm --cached\` falló: ${rm.stderr}`);
+        }
+        if (input.add.length > 0) {
+            const add = await run(['add', '-f', '--', ...input.add]);
+            if (add.exitCode !== 0)
+                throw new CLIError(`\`git add\` falló: ${add.stderr}`);
+        }
+        const diff = await run(['diff', '--cached', '--quiet']);
+        if (diff.exitCode === 0)
+            return { committed: false };
+        const commit = await run(['commit', '-q', '-m', input.message]);
+        if (commit.exitCode !== 0) {
+            throw new CLIError(`El commit falló (¿un hook lo rechazó o falta identidad git?):\n${commit.stderr || commit.stdout}`);
+        }
+        const sha = await execa('git', ['rev-parse', '--short', 'HEAD'], { cwd: rootDir });
+        // The real index still holds the pre-commit state of these paths: reset them to the new
+        // HEAD so `git status` shows the removals as done, not as staged re-additions.
+        await execa('git', ['reset', '-q', '--', ...input.remove, ...input.add], {
+            cwd: rootDir,
+            reject: false,
+        });
+        return { committed: true, sha: sha.stdout.trim() };
+    }
+    finally {
+        for (const f of [indexFile, `${indexFile}.lock`]) {
+            if (existsSync(f))
+                rmSync(f, { force: true });
+        }
+    }
+}

package/dist/lib/prune-pr-check.js

@@ -0,0 +1,119 @@
+/**
+ * The hard refusal `/integrate` runs on a collaborator's pull request BEFORE checking it out
+ * (`factory prune check-pr`). A member runs the PR's code on their own machine — a risk the
+ * org accepted for product code, and only for product code — so any change to what runs
+ * around the product (hooks, CI, scripts, tooling config, the methodology, the prune switch)
+ * is refused by path, mechanically, never by the agent's judgement. A PR refused here goes
+ * back to the collaborator, or a member redoes it.
+ *
+ * SSOT of the list: `REJECTED_PATHS` below. `tk-integrate/methodology/rejected-paths.md`
+ * explains it and points here.
+ */
+import { CLIError } from './cli-error.js';
+export const REJECTED_PATHS = [
+    { pattern: '.claude/', why: 'el cerebro del kit (reglas, hooks del agente, políticas)' },
+    { pattern: 'CLAUDE.md', why: 'instrucciones del agente' },
+    { pattern: '.husky/', why: 'hooks de git: corren en la máquina de quien commitea' },
+    { pattern: '.github/', why: 'CI y configuración de GitHub' },
+    { pattern: 'scripts/', why: 'scripts que corren los hooks y `pnpm verify`' },
+    { pattern: '.gitignore', why: 'decide qué de la metodología entra al repo' },
+    { pattern: '.timekast/', why: 'el interruptor del repo compartido y el estado del kit' },
+    {
+        pattern: '**/*.config.*',
+        why: 'configuración de herramientas (next, vitest, eslint, playwright…)',
+    },
+    { pattern: 'vitest.setup*', why: 'código que corre antes de cada test' },
+    { pattern: '.npmrc', why: 'configuración de pnpm (registro, scripts)' },
+    { pattern: '.pnpmfile.cjs', why: 'código que pnpm ejecuta al instalar' },
+    { pattern: 'pnpm-workspace.yaml', why: 'configuración de pnpm' },
+];
+/** The `package.json` fields a PR may not change (scripts run on the member's machine). */
+export const REJECTED_PACKAGE_FIELDS = ['scripts', 'pnpm'];
+function segmentRx(pattern) {
+    return new RegExp(`^${pattern
+        .split('*')
+        .map((p) => p.replace(/[.+?^${}()|[\]\\]/g, '\\$&'))
+        .join('[^/]*')}$`);
+}
+/** Does `relPath` fall under `pattern`? A leading `**` + `/` matches the basename at any depth. */
+export function pathRejected(pattern, relPath) {
+    if (pattern.startsWith('**/')) {
+        const base = relPath.split('/').pop() ?? relPath;
+        return segmentRx(pattern.slice(3)).test(base);
+    }
+    if (pattern.endsWith('/'))
+        return relPath.startsWith(pattern);
+    return segmentRx(pattern).test(relPath);
+}
+/** Read the PR's files from GitHub (no checkout) and apply the refusal. */
+export async function checkPr(repo, pr, deps) {
+    const filesRes = await deps.gh([
+        'api',
+        '--paginate',
+        `repos/${repo}/pulls/${pr}/files?per_page=100`,
+        '--jq',
+        '.[] | [.filename, (.previous_filename // "")] | @tsv',
+    ]);
+    if (filesRes.exitCode !== 0) {
+        throw new CLIError(`No pude leer los archivos del PR #${pr} de \`${repo}\`: ${filesRes.stderr}`);
+    }
+    const files = [
+        ...new Set(filesRes.stdout
+            .split('\n')
+            .flatMap((line) => line.split('\t'))
+            .map((p) => p.trim())
+            .filter(Boolean)),
+    ].sort();
+    const rejected = [];
+    for (const p of files) {
+        const hit = REJECTED_PATHS.find((r) => pathRejected(r.pattern, p));
+        if (hit)
+            rejected.push({ path: p, why: hit.why });
+    }
+    const packageFields = [];
+    if (files.includes('package.json')) {
+        const meta = await deps.gh([
+            'pr',
+            'view',
+            String(pr),
+            '--repo',
+            repo,
+            '--json',
+            'baseRefOid,headRefOid',
+            '--jq',
+            '[.baseRefOid, .headRefOid] | @tsv',
+        ]);
+        if (meta.exitCode !== 0)
+            throw new CLIError(`No pude leer el PR #${pr}: ${meta.stderr}`);
+        const [base, head] = meta.stdout.trim().split('\t');
+        const read = async (ref) => {
+            const r = await deps.gh([
+                'api',
+                `repos/${repo}/contents/package.json?ref=${ref}`,
+                '-H',
+                'Accept: application/vnd.github.raw',
+            ]);
+            if (r.exitCode !== 0)
+                return null;
+            try {
+                return JSON.parse(r.stdout);
+            }
+            catch {
+                return null;
+            }
+        };
+        const [before, after] = [await read(base), await read(head)];
+        if (!before || !after) {
+            // Unreadable or invalid JSON on either side: the comparison cannot clear it.
+            packageFields.push('(no se pudo comparar package.json)');
+        }
+        else {
+            for (const field of REJECTED_PACKAGE_FIELDS) {
+                if (JSON.stringify(before[field] ?? null) !== JSON.stringify(after[field] ?? null)) {
+                    packageFields.push(field);
+                }
+            }
+        }
+    }
+    return { rejected, packageFields, files };
+}