@ulysses-ai/create-workspace 0.22.0-beta.0 → 0.23.1-beta.0

package/template/_claude/scripts/maintenance-audit.mjs

@@ -25,7 +25,11 @@
 //                         of the git common dir), while the worktree's own
 //                         branch is only named in an info line and its dirty
 //                         tracked tree is skipped as info: in-flight work, not
-//                         drift (gh:183)
+//                         drift (gh:183). The launcher's
+//                         .claude/skills/workspace-update/ modification an
+//                         --upgrade leaves when its content equals the staged
+//                         payload's is the expected bootstrap, reported as
+//                         info, never a dirty-tree warning (gh:190)
 //   5. auto-files       — workspace-context catalogs current (the same
 //                         semantics as build-workspace-context.mjs --check)
 //   6. budget           — always-loaded context within
@@ -82,6 +86,7 @@ import {
   readIgnorePrefixes,
   isIgnored,
 } from './build-workspace-context.mjs';
+import { hashBytes } from './template-baseline.mjs';
 import { refreshIfStale } from '../lib/freshness.mjs';
 import { parseSessionContent } from '../lib/session-frontmatter.mjs';
 
@@ -157,7 +162,10 @@ export async function runAudit({
   // array — a structural delimiter, never a byte that could appear in the
   // values (NUL separators made git treat this file as binary).
   const seenFindings = new Set();
-  const add = (section, severity, file, message) => {
+  // opts.noFromUpdate: expected-absent findings (a machine-local import
+  // missing inside a task worktree) stay ambient info even when their file
+  // is on the --changed list — the update did not cause them (gh:190).
+  const add = (section, severity, file, message, opts = {}) => {
     const key = JSON.stringify([section, severity, file, message]);
     if (seenFindings.has(key)) return;
     seenFindings.add(key);
@@ -166,7 +174,7 @@ export async function runAudit({
       severity,
       file,
       message,
-      ...(changedSet.has(file) ? { fromUpdate: true } : {}),
+      ...(changedSet.has(file) && !opts.noFromUpdate ? { fromUpdate: true } : {}),
     });
   };
 
@@ -323,7 +331,10 @@ export async function runAudit({
       const posix = toPosix(spec);
       const base = posix.split('/').pop();
       if (base.startsWith('local-only-')) {
-        add('cross-reference', 'info', 'CLAUDE.md', `@${posix} is absent — machine-local, expected on other machines`);
+        // Machine-local files never materialize inside a task worktree (the
+        // update flow audits from one), so this is ambient, never something
+        // the update caused (gh:190).
+        add('cross-reference', 'info', 'CLAUDE.md', `@${posix} is absent — machine-local, expected on other machines`, { noFromUpdate: true });
       } else if (posix === 'CODEBASE.md') {
         add('cross-reference', 'info', 'CLAUDE.md', '@CODEBASE.md is absent — optional stub, /workspace-init generates it on request');
       } else if (isAutoFileRel(posix, wcDir)) {
@@ -379,6 +390,9 @@ export async function runAudit({
       return relToWC.split('/').includes('archive');
     };
 
+    // Resolved lifecycles are closed out, not defects — however many there
+    // are, they surface as ONE info line, not one per file (gh:190).
+    const resolvedFiles = [];
     for (let i = 0; i < files.length; i++) {
       const rel = rels[i];
       if (ignored.has(rel) || isHistorical(rel)) continue;
@@ -435,12 +449,17 @@ export async function runAudit({
         }
       }
       if (f.lifecycle === 'resolved') {
-        add('frontmatter', 'info', rel, 'lifecycle resolved — confirm /complete-work has processed it');
+        resolvedFiles.push(rel);
       }
       if ('confidence' in f && !['high', 'medium', 'low'].includes(f.confidence)) {
         add('frontmatter', 'warning', rel, `confidence '${f.confidence}' is not one of high, medium, low`);
       }
     }
+    if (resolvedFiles.length > 0) {
+      const names = resolvedFiles.slice(0, 3).map((rel) => rel.split('/').pop());
+      add('frontmatter', 'info', wcDir,
+        `${resolvedFiles.length} lifecycle resolved file(s) — confirm /complete-work has processed them (${names.join(', ')}${resolvedFiles.length > 3 ? ', …' : ''})`);
+    }
   })();
 
   // ---------- 4. git state ----------
@@ -463,11 +482,31 @@ export async function runAudit({
         add('git', 'warning', '.',
           `launcher is on branch '${gitInfo.launcherBranch}' — it stays on its default branch ('${gitInfo.defaultBranch}')`);
       }
+      // --upgrade replaces the launcher's workspace-update skill before the
+      // payload is applied, and the merged PR delivers the same content back:
+      // a modification that equals the staged payload's copy is the expected
+      // bootstrap, not drift — info, and out of the dirty warning (gh:190).
+      const porcelainPath = (line) => line.slice(line.indexOf(' ') + 1).split(' -> ')[0];
       const launcherDirty = gitInfo.launcherPorcelain.filter((l) => !l.startsWith('??'));
-      if (launcherDirty.length > 0) {
-        const paths = launcherDirty.slice(0, 5).map((l) => l.slice(l.indexOf(' ') + 1).replace(/ -> /, ' → '));
+      const bootstrap = launcherDirty.filter((l) => {
+        const p = porcelainPath(l);
+        if (!p.startsWith('.claude/skills/workspace-update/')) return false;
+        try {
+          return hashBytes(readFileSync(join(gitInfo.launcherRoot, p)))
+            === hashBytes(readFileSync(join(gitInfo.launcherRoot, '.workspace-update', p)));
+        } catch {
+          return false; // no staged payload copy to compare against
+        }
+      });
+      if (bootstrap.length > 0) {
+        add('git', 'info', '.',
+          "launcher's .claude/skills/workspace-update/ replaced by --upgrade (matches the staged payload) — expected until the update merges");
+      }
+      const drift = launcherDirty.filter((l) => !bootstrap.includes(l));
+      if (drift.length > 0) {
+        const paths = drift.slice(0, 5).map((l) => l.slice(l.indexOf(' ') + 1).replace(/ -> /, ' → '));
         add('git', 'warning', '.',
-          `launcher has ${launcherDirty.length} tracked file(s) with uncommitted changes: ${paths.join(', ')}${launcherDirty.length > 5 ? ', …' : ''}`);
+          `launcher has ${drift.length} tracked file(s) with uncommitted changes: ${paths.join(', ')}${drift.length > 5 ? ', …' : ''}`);
       }
       add('git', 'info', '.',
         'uncommitted-changes check skipped — the worktree is expected to carry in-flight changes');

package/template/_claude/scripts/merge-mode.mjs

@@ -26,14 +26,97 @@ function readWorkspace(rootDir) {
   }
 }
 
-// Same remote shapes the forge adapters resolve a repo from. A URL that
-// does not match is not forge-hosted, and the forge path supports
-// forge-hosted repos only — a local/bare remote has no PR concept to aim at.
-const FORGE_REMOTE_RE = /github\.com[:/]([^/]+)\/([^/.]+?)(?:\.git)?$/;
+// Same remote shapes the forge adapters resolve a repo from: scp-style SSH
+// (`git@github.com:owner/name.git`, `git@gitlab.com:group/sub/name.git`),
+// scheme URLs (`ssh://git@host/...`, `https://host/...`, optional port), with
+// or without a trailing `.git`. A URL that does not match is not
+// forge-hosted, and the forge path supports forge-hosted repos only — a
+// local/bare remote has no PR concept to aim at.
+//
+// GitLab repos may sit in nested groups (`group/sub/project` at any depth),
+// so the parser returns the full `slug` plus `host` and `forge` type; GitHub
+// remains exactly two segments (owner/name). `hosts` names additional
+// self-managed GitLab hosts (workspace.forge.host) — gitlab.com is always
+// recognised, and a URL on any other host parses as nothing.
+function parseForgeRemote(url, { hosts = [] } = {}) {
+  const parsed = parseRemoteUrl(url);
+  if (!parsed) return null;
+  const { host, path: segments } = parsed;
+  if (segments.length < 2) return null;
+  if (host === 'github.com') {
+    if (segments.length !== 2) return null;
+    return { owner: segments[0], name: segments[1], slug: segments.join('/'), host, forge: 'github' };
+  }
+  const gitlabHosts = new Set(['gitlab.com', ...hosts.map((h) => String(h).toLowerCase())]);
+  if (gitlabHosts.has(host)) {
+    return {
+      owner: segments.slice(0, -1).join('/'),
+      name: segments[segments.length - 1],
+      slug: segments.join('/'),
+      host,
+      forge: 'gitlab',
+    };
+  }
+  return null;
+}
+
+// Split any remote URL into host + path segments, or null when it is not a
+// forge-shaped remote at all (local path, file:// URL, …).
+const DEFAULT_PORTS = { https: 443, http: 80, ssh: 22, git: 9418 };
+const SCHEME_URL_RE = /^(?<scheme>https?|ssh|git):\/\/(?:[^@/]+@)?(?<host>[^:/]+)(?::(?<port>\d+))?\/(?<path>.+)$/;
 
-function parseForgeRemote(url) {
-  const m = String(url).trim().match(FORGE_REMOTE_RE);
-  return m ? { owner: m[1], name: m[2] } : null;
+function parseRemoteUrl(url) {
+  const s = String(url).trim().replace(/\/+$/, '');
+  // scp-style: user@host:path — the colon separator, no scheme.
+  const scp = s.match(/^[^@/]+@([^:/]+):(.+)$/);
+  if (scp) return { host: scp[1].toLowerCase(), path: splitRemotePath(scp[2]) };
+  // scheme://[user@]host[:port]/path — an explicit non-default port stays
+  // part of the host so a configured self-managed host can carry it
+  // (gitlab.example.com:8443); a default port drops, so github.com:443
+  // still reads as github.com.
+  const m = s.match(SCHEME_URL_RE);
+  if (m) {
+    const { scheme, host, port, path } = m.groups;
+    const hostWithPort = port && Number(port) !== DEFAULT_PORTS[scheme] ? `${host}:${port}` : host;
+    return { host: hostWithPort.toLowerCase(), path: splitRemotePath(path) };
+  }
+  return null;
+}
+
+function splitRemotePath(p) {
+  return p.replace(/\.git$/, '').split('/').filter(Boolean);
+}
+
+// Self-managed GitLab hosts configured for this workspace — the value of
+// workspace.forge.host, when set, is a GitLab host however the forge `type`
+// reads (a mixed workspace may leave type unset entirely).
+function forgeHosts(ws) {
+  return [ws?.workspace?.forge?.host].filter(Boolean);
+}
+
+// The per-repo forge config: the workspace block (host, any shared
+// settings) with the repo's own identity layered on. The origin's host and
+// slug win over any workspace-level `type` — a workspace may mix GitHub
+// and GitLab repos, and each repo's origin names where its PRs live, so
+// one global type cannot speak for both. `parsed` is parseForgeRemote's
+// result; a null (unparseable origin) yields the workspace block as-is.
+function perRepoForge(ws, parsed) {
+  if (!parsed) return { ...(ws?.workspace?.forge ?? {}) };
+  return { ...(ws?.workspace?.forge ?? {}), type: parsed.forge, host: parsed.host, repo: parsed.slug };
+}
+
+// Everything a caller outside task-pr needs to build one repo's forge:
+// read the repo's origin, parse it, and hand back a config createForge can
+// take. The adapter type comes from the repo's own host, so a GitLab repo
+// gets the gitlab adapter even when workspace.forge names no type (or a
+// different one) — this is the helper the /release skill uses, so its
+// forge always matches the repo being released.
+function forgeConfigForRepo(rootDir, repo, ws, deps = {}) {
+  const gitFn = deps.gitFn ?? spawnSync;
+  const res = gitFn('git', ['-C', repoDirFor(rootDir, repo), 'remote', 'get-url', 'origin'], { encoding: 'utf8' });
+  const origin = res.error || res.status !== 0 ? null : String(res.stdout || '').trim();
+  const parsed = origin ? parseForgeRemote(origin, { hosts: forgeHosts(ws) }) : null;
+  return perRepoForge(ws, parsed);
 }
 
 /**
@@ -43,9 +126,10 @@ function parseForgeRemote(url) {
  * right call for a clone whose origin is a third-party upstream nobody
  * here may push to) or when the repo has no origin remote at all;
  * "forge" — pushed and PR'd — when its origin parses as a forge-hosted
- * owner/name. An origin that is neither (say a local bare mirror with no
- * override) resolves to null: the caller stops with the override spelled
- * out rather than pushing somewhere that cannot host a PR.
+ * repo (github.com, gitlab.com, or the configured self-managed host). An
+ * origin that is neither (say a local bare mirror with no override)
+ * resolves to null: the caller stops with the override spelled out rather
+ * than pushing somewhere that cannot host a PR.
  */
 function mergeModeFor(root, repo, deps = {}) {
   const gitFn = deps.gitFn ?? spawnSync;
@@ -55,7 +139,7 @@ function mergeModeFor(root, repo, deps = {}) {
   if (override === 'local') return 'local';
   const res = gitFn('git', ['-C', repoDirFor(rootDir, repo), 'remote', 'get-url', 'origin'], { encoding: 'utf8' });
   if (res.error || res.status !== 0) return 'local'; // no origin — nowhere to push
-  return parseForgeRemote(String(res.stdout || '').trim()) ? 'forge' : null;
+  return parseForgeRemote(String(res.stdout || '').trim(), { hosts: forgeHosts(ws) }) ? 'forge' : null;
 }
 
-export { WORKSPACE_REPO, repoDirFor, readWorkspace, parseForgeRemote, mergeModeFor };
+export { WORKSPACE_REPO, repoDirFor, readWorkspace, parseForgeRemote, forgeHosts, perRepoForge, forgeConfigForRepo, mergeModeFor };