@webpieces/pr-gate 0.4.613 → 0.4.614

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/pr-gate",
-  "version": "0.4.613",
+  "version": "0.4.614",
   "description": "Gated PR system: 3-point squash-merge, merge validation gate, and red/yellow/green PR dashboard. Standalone scripts, no Nx dependency required.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -15,7 +15,7 @@
     "directory": "packages/tooling/pr-gate"
   },
   "dependencies": {
-    "@webpieces/rules-config": "0.4.613",
+    "@webpieces/rules-config": "0.4.614",
     "@inversifyjs/binding-decorators": "1.1.5",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"

package/src/scripts/workflow/build-gate-log.js

@@ -11,6 +11,11 @@ const inversify_1 = require("inversify");
 // file runs for a user who has not created that OPTIONAL file — see `HomeConfigService`
 // (`@webpieces/rules-config`), which returns all-defaults silently when it is absent.
 //
+// That file has a second, REQUIRED key once it exists — `experimental.whole-repo-build-guard` — so the
+// smallest document enabling THIS feature is:
+//     { "experimental": { "whole-repo-build-guard": false, "buildGateLogCapture": true } }
+// `HomeConfigService` owns that rule and prints the same edit when the key is missing.
+//
 // ─── Why ───────────────────────────────────────────────────────────────────────────────────────────────
 // The build gate already builds everything. When it fails, the pre-existing message says "run THIS exact
 // command to reproduce", and an AI agent obeys it — so the repo is built a SECOND time purely to see the

package/src/scripts/workflow/build-gate-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-gate-log.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/build-gate-log.ts"],"names":[],"mappings":";;;;AAAA,iDAA0C;AAC1C,+CAAyB;AACzB,mDAA6B;AAC7B,0DAAuD;AACvD,yCAA2D;AAE3D,2GAA2G;AAC3G,wFAAwF;AACxF,sFAAsF;AACtF,EAAE;AACF,0GAA0G;AAC1G,yGAAyG;AACzG,yGAAyG;AACzG,4FAA4F;AAC5F,EAAE;AACF,0GAA0G;AAC1G,0GAA0G;AAC1G,yGAAyG;AACzG,gGAAgG;AAChG,EAAE;AACF,0GAA0G;AAC1G,sGAAsG;AACtG,yGAAyG;AACzG,0GAA0G;AAC1G,gGAAgG;AAChG,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC;;;GAGG;AACU,QAAA,YAAY,GAAG,QAAQ,CAAC;AACxB,QAAA,YAAY,GAAG,QAAQ,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACrB,4FAA4F;IAC5F,OAAO,CAAC,QAAgB,EAAE,KAAa;QACnC,MAAM,IAAI,GAAG,2BAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,2GAA2G;IAC3G,cAAc,CAAC,QAAgB,EAAE,KAAa;QAC1C,MAAM,IAAI,GAAG,2BAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,0GAA0G;IAC1G,WAAW,CAAC,QAAgB,EAAE,KAAa;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,cAAc,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;IACrH,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,QAAgB,EAAE,YAAoB,EAAE,OAAe;QACvD,MAAM,UAAU,GAAG,GAAG,OAAO,GAAG,aAAa,EAAE,CAAC;QAChD,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,EACjE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;QACvC,iGAAiG;QACjG,4FAA4F;QAC5F,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,YAAoB,EAAE,OAAe;QAChD,OAAO,qCAAqC;YACxC,OAAO,YAAY,MAAM,OAAO,MAAM;YACtC,2FAA2F;YAC3F,6EAA6E,CAAC;IACtF,CAAC;IAED;;;;;;;;OAQG;IACK,IAAI,CAAC,YAAoB,EAAE,OAAe,EAAE,UAAkB;QAClE,OAAO,SAAS,YAAY,kBAAkB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAChH,CAAC;IAED,yGAAyG;IACjG,UAAU,CAAC,UAAkB;QACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,KAAa;QACvB,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IACjD,CAAC;IAED,wGAAwG;IAChG,IAAI,CAAC,KAAa;QACtB,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,qGAAqG;IACrG,8DAA8D;IACtD,GAAG,CAAC,QAAgB,EAAE,IAAc;QACxC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;CACJ,CAAA;AA1FY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,YAAY,CA0FxB","sourcesContent":["import { spawnSync } from 'child_process';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { dotWebpieces } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\n// EXPERIMENTAL (opt-in via `~/.webpieces/config.json` → experimental.buildGateLogCapture). Nothing in this\n// file runs for a user who has not created that OPTIONAL file — see `HomeConfigService`\n// (`@webpieces/rules-config`), which returns all-defaults silently when it is absent.\n//\n// ─── Why ───────────────────────────────────────────────────────────────────────────────────────────────\n// The build gate already builds everything. When it fails, the pre-existing message says \"run THIS exact\n// command to reproduce\", and an AI agent obeys it — so the repo is built a SECOND time purely to see the\n// errors that scrolled past the first time. This captures the first build's output instead.\n//\n// ─── Why a shell `tee` and not spawnSync's pipes ───────────────────────────────────────────────────────\n// spawnSync BUFFERS a piped stream and hands it over only after the child exits, so the human would watch\n// a silent terminal for the length of a full build. The output has to be split at the OS level, which is\n// what `tee` is. The gate keeps `stdio: 'inherit'`, so the terminal is byte-identical to today.\n//\n// ─── Why an exit-status side file and not `pipefail` ───────────────────────────────────────────────────\n// In a pipeline the shell reports the LAST command's status, i.e. tee's, which is 0 whether the build\n// passed or failed. `set -o pipefail` and `${PIPESTATUS[0]}` are bash/zsh, and spawnSync's `shell: true`\n// gives `/bin/sh` — dash on Debian. Writing `$?` to a side file inside the group is plain POSIX and works\n// under every one of them. The redirect keeps it out of the pipe, so it never lands in the log.\nconst STATUS_SUFFIX = '.status';\n\n/**\n * Which stage's gate is being captured. The value is part of the log FILENAME, so review and finish never\n * write the same file even at the same commit on the same branch.\n */\nexport const REVIEW_STAGE = 'review';\nexport const FINISH_STAGE = 'finish';\n\n/**\n * Captures the build gate's full output to `.webpieces/logs/`, and renders the small pointer the AI is\n * handed instead of a rebuild instruction.\n *\n * ─── Why the filename cannot collide ───────────────────────────────────────────────────────────────────\n * The path is `dotWebpieces.logsFile(repoRoot, 'build-gate-<stage>-<branch>-<shortSha>.log')`, and each\n * component rules out one class of concurrent writer:\n *   • the DIRECTORY is `dotWebpieces.local()`-scoped — `<primary>/.webpieces/worktrees/<git worktree\n *     name>/logs/` in a linked worktree. Every worktree therefore has its own log directory already, which\n *     is what makes \"N agents in N worktrees\" safe by construction rather than by naming.\n *   • `<stage>` separates review from finish, the two gates that CAN run against one commit.\n *   • `<branch>` — a branch can be checked out in at most one worktree (git enforces it), so within one\n *     log directory the branch is effectively constant; it is in the name so a human reading the directory\n *     can tell whose log is whose, and so switching branches never appends to a stale file.\n *   • `<shortSha>` — a re-run at a NEW commit gets a new file, so the log a failure message points at is\n *     always the build for the code that failed. A re-run at the SAME commit deliberately TRUNCATES: it is\n *     the same build of the same tree, and the fresh one is the one worth reading.\n * The residual case is two agents running the same stage, at the same commit, in the SAME worktree,\n * simultaneously. That is already unsupported — both would be driving one git index and one merge state —\n * and it is the only case this scheme does not separate.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class BuildGateLog {\n    /** Absolute path of the log for `stage` at the current HEAD, creating the log directory. */\n    pathFor(repoRoot: string, stage: string): string {\n        const file = dotWebpieces.logsFile(repoRoot, this.fileNameFor(repoRoot, stage));\n        fs.mkdirSync(path.dirname(file), { recursive: true });\n        return file;\n    }\n\n    /** The same path WITHOUT creating anything, and '' when no such log exists. Used by finish's skip path. */\n    existingLogFor(repoRoot: string, stage: string): string {\n        const file = dotWebpieces.logsFile(repoRoot, this.fileNameFor(repoRoot, stage));\n        return fs.existsSync(file) ? file : '';\n    }\n\n    /** `build-gate-<stage>-<branch>-<shortSha>.log` — see the class docstring for why this cannot collide. */\n    fileNameFor(repoRoot: string, stage: string): string {\n        const branch = this.slug(this.git(repoRoot, ['rev-parse', '--abbrev-ref', 'HEAD']));\n        const sha = this.slug(this.git(repoRoot, ['rev-parse', '--short', 'HEAD']));\n        return `build-gate-${this.slug(stage)}-${branch === '' ? 'nobranch' : branch}-${sha === '' ? 'nosha' : sha}.log`;\n    }\n\n    /**\n     * Run `buildCommand` with its combined stdout+stderr streaming to the terminal AND appended in full to\n     * `logPath`. Returns the BUILD's exit code (not tee's). Nothing is truncated.\n     */\n    run(repoRoot: string, buildCommand: string, logPath: string): number {\n        const statusFile = `${logPath}${STATUS_SUFFIX}`;\n        fs.rmSync(statusFile, { force: true });\n        const result = spawnSync(this.wrap(buildCommand, logPath, statusFile),\n            { stdio: 'inherit', cwd: repoRoot, shell: true });\n        const fromFile = this.readStatus(statusFile);\n        fs.rmSync(statusFile, { force: true });\n        if (fromFile !== null) return fromFile;\n        // The side file never appeared ⇒ the shell died before the echo. The PIPELINE's status is tee's,\n        // which is 0, and reporting 0 there would call a dead build green — so fail CLOSED instead.\n        return result.status !== null && result.status !== 0 ? result.status : 1;\n    }\n\n    /**\n     * The ENTIRE message the AI gets on a captured failure. Deliberately tiny: the whole point is that the\n     * agent reads ONE file rather than carrying a build transcript in its context.\n     *\n     * The last sentence is not filler. If the log holds no visible failure then something upstream is wrong\n     * (a runner that died without printing, a truncated pipe), and the worst possible response is an agent\n     * guessing or rebuilding — so it is told to surface the contradiction to the human and stop.\n     */\n    failureMessage(buildCommand: string, logPath: string): string {\n        return `\\n❌ The CI build failed. We ran\\n\\n` +\n            `    ${buildCommand} > ${logPath}\\n\\n` +\n            `and it failed, so read that file for the failures. Do NOT re-run the build to see them.\\n` +\n            `If you do not see failures in that log, report that to the user and stop.\\n`;\n    }\n\n    /**\n     * `{ ( <build> ) ; echo $? > <status> ; } 2>&1 | tee <log>` — written across LINES so a build command\n     * ending in a `#` comment cannot swallow what follows it.\n     *\n     * The inner `( … )` is load-bearing, not decoration. The left side of a pipeline is already a subshell,\n     * so a build command containing a plain `exit 7` (or any script that calls `exit`) would terminate that\n     * subshell OUTRIGHT — `echo $?` never runs, the side file never appears, and the only status left is\n     * tee's 0. The nested subshell absorbs the `exit`, so `$?` is the build's code every time.\n     */\n    private wrap(buildCommand: string, logPath: string, statusFile: string): string {\n        return `{\\n(\\n${buildCommand}\\n)\\necho $? > ${this.quote(statusFile)}\\n} 2>&1 | tee ${this.quote(logPath)}`;\n    }\n\n    // The build's own exit code, or null when the side file never appeared (the shell died before the echo).\n    private readStatus(statusFile: string): number | null {\n        if (!fs.existsSync(statusFile)) return null;\n        const parsed = Number.parseInt(fs.readFileSync(statusFile, 'utf8').trim(), 10);\n        return Number.isNaN(parsed) ? null : parsed;\n    }\n\n    // POSIX single-quoting: everything is literal inside '…', and a literal ' is spelled '\\''.\n    private quote(value: string): string {\n        return `'${value.split(\"'\").join(`'\\\\''`)}'`;\n    }\n\n    // Anything that is not a filename-safe character becomes '-', so `dean/feat` cannot create directories.\n    private slug(value: string): string {\n        return value.replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');\n    }\n\n    // One local git read. Fails SOFT to '' — a missing branch/sha degrades the FILENAME, and degrading a\n    // filename may never be the reason a build gate does not run.\n    private git(repoRoot: string, args: string[]): string {\n        const result = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8' });\n        if (result.status !== 0) return '';\n        return (result.stdout ?? '').trim();\n    }\n}\n"]}
+{"version":3,"file":"build-gate-log.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/build-gate-log.ts"],"names":[],"mappings":";;;;AAAA,iDAA0C;AAC1C,+CAAyB;AACzB,mDAA6B;AAC7B,0DAAuD;AACvD,yCAA2D;AAE3D,2GAA2G;AAC3G,wFAAwF;AACxF,sFAAsF;AACtF,EAAE;AACF,uGAAuG;AACvG,8CAA8C;AAC9C,2FAA2F;AAC3F,uFAAuF;AACvF,EAAE;AACF,0GAA0G;AAC1G,yGAAyG;AACzG,yGAAyG;AACzG,4FAA4F;AAC5F,EAAE;AACF,0GAA0G;AAC1G,0GAA0G;AAC1G,yGAAyG;AACzG,gGAAgG;AAChG,EAAE;AACF,0GAA0G;AAC1G,sGAAsG;AACtG,yGAAyG;AACzG,0GAA0G;AAC1G,gGAAgG;AAChG,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC;;;GAGG;AACU,QAAA,YAAY,GAAG,QAAQ,CAAC;AACxB,QAAA,YAAY,GAAG,QAAQ,CAAC;AAErC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACrB,4FAA4F;IAC5F,OAAO,CAAC,QAAgB,EAAE,KAAa;QACnC,MAAM,IAAI,GAAG,2BAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,2GAA2G;IAC3G,cAAc,CAAC,QAAgB,EAAE,KAAa;QAC1C,MAAM,IAAI,GAAG,2BAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAChF,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,CAAC;IAED,0GAA0G;IAC1G,WAAW,CAAC,QAAgB,EAAE,KAAa;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5E,OAAO,cAAc,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;IACrH,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,QAAgB,EAAE,YAAoB,EAAE,OAAe;QACvD,MAAM,UAAU,GAAG,GAAG,OAAO,GAAG,aAAa,EAAE,CAAC;QAChD,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,EACjE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC7C,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC;QACvC,iGAAiG;QACjG,4FAA4F;QAC5F,OAAO,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,YAAoB,EAAE,OAAe;QAChD,OAAO,qCAAqC;YACxC,OAAO,YAAY,MAAM,OAAO,MAAM;YACtC,2FAA2F;YAC3F,6EAA6E,CAAC;IACtF,CAAC;IAED;;;;;;;;OAQG;IACK,IAAI,CAAC,YAAoB,EAAE,OAAe,EAAE,UAAkB;QAClE,OAAO,SAAS,YAAY,kBAAkB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,kBAAkB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IAChH,CAAC;IAED,yGAAyG;IACjG,UAAU,CAAC,UAAkB;QACjC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAChD,CAAC;IAED,2FAA2F;IACnF,KAAK,CAAC,KAAa;QACvB,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;IACjD,CAAC;IAED,wGAAwG;IAChG,IAAI,CAAC,KAAa;QACtB,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,qGAAqG;IACrG,8DAA8D;IACtD,GAAG,CAAC,QAAgB,EAAE,IAAc;QACxC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,CAAC;CACJ,CAAA;AA1FY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;GAC5B,YAAY,CA0FxB","sourcesContent":["import { spawnSync } from 'child_process';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { dotWebpieces } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\n\n// EXPERIMENTAL (opt-in via `~/.webpieces/config.json` → experimental.buildGateLogCapture). Nothing in this\n// file runs for a user who has not created that OPTIONAL file — see `HomeConfigService`\n// (`@webpieces/rules-config`), which returns all-defaults silently when it is absent.\n//\n// That file has a second, REQUIRED key once it exists — `experimental.whole-repo-build-guard` — so the\n// smallest document enabling THIS feature is:\n//     { \"experimental\": { \"whole-repo-build-guard\": false, \"buildGateLogCapture\": true } }\n// `HomeConfigService` owns that rule and prints the same edit when the key is missing.\n//\n// ─── Why ───────────────────────────────────────────────────────────────────────────────────────────────\n// The build gate already builds everything. When it fails, the pre-existing message says \"run THIS exact\n// command to reproduce\", and an AI agent obeys it — so the repo is built a SECOND time purely to see the\n// errors that scrolled past the first time. This captures the first build's output instead.\n//\n// ─── Why a shell `tee` and not spawnSync's pipes ───────────────────────────────────────────────────────\n// spawnSync BUFFERS a piped stream and hands it over only after the child exits, so the human would watch\n// a silent terminal for the length of a full build. The output has to be split at the OS level, which is\n// what `tee` is. The gate keeps `stdio: 'inherit'`, so the terminal is byte-identical to today.\n//\n// ─── Why an exit-status side file and not `pipefail` ───────────────────────────────────────────────────\n// In a pipeline the shell reports the LAST command's status, i.e. tee's, which is 0 whether the build\n// passed or failed. `set -o pipefail` and `${PIPESTATUS[0]}` are bash/zsh, and spawnSync's `shell: true`\n// gives `/bin/sh` — dash on Debian. Writing `$?` to a side file inside the group is plain POSIX and works\n// under every one of them. The redirect keeps it out of the pipe, so it never lands in the log.\nconst STATUS_SUFFIX = '.status';\n\n/**\n * Which stage's gate is being captured. The value is part of the log FILENAME, so review and finish never\n * write the same file even at the same commit on the same branch.\n */\nexport const REVIEW_STAGE = 'review';\nexport const FINISH_STAGE = 'finish';\n\n/**\n * Captures the build gate's full output to `.webpieces/logs/`, and renders the small pointer the AI is\n * handed instead of a rebuild instruction.\n *\n * ─── Why the filename cannot collide ───────────────────────────────────────────────────────────────────\n * The path is `dotWebpieces.logsFile(repoRoot, 'build-gate-<stage>-<branch>-<shortSha>.log')`, and each\n * component rules out one class of concurrent writer:\n *   • the DIRECTORY is `dotWebpieces.local()`-scoped — `<primary>/.webpieces/worktrees/<git worktree\n *     name>/logs/` in a linked worktree. Every worktree therefore has its own log directory already, which\n *     is what makes \"N agents in N worktrees\" safe by construction rather than by naming.\n *   • `<stage>` separates review from finish, the two gates that CAN run against one commit.\n *   • `<branch>` — a branch can be checked out in at most one worktree (git enforces it), so within one\n *     log directory the branch is effectively constant; it is in the name so a human reading the directory\n *     can tell whose log is whose, and so switching branches never appends to a stale file.\n *   • `<shortSha>` — a re-run at a NEW commit gets a new file, so the log a failure message points at is\n *     always the build for the code that failed. A re-run at the SAME commit deliberately TRUNCATES: it is\n *     the same build of the same tree, and the fresh one is the one worth reading.\n * The residual case is two agents running the same stage, at the same commit, in the SAME worktree,\n * simultaneously. That is already unsupported — both would be driving one git index and one merge state —\n * and it is the only case this scheme does not separate.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class BuildGateLog {\n    /** Absolute path of the log for `stage` at the current HEAD, creating the log directory. */\n    pathFor(repoRoot: string, stage: string): string {\n        const file = dotWebpieces.logsFile(repoRoot, this.fileNameFor(repoRoot, stage));\n        fs.mkdirSync(path.dirname(file), { recursive: true });\n        return file;\n    }\n\n    /** The same path WITHOUT creating anything, and '' when no such log exists. Used by finish's skip path. */\n    existingLogFor(repoRoot: string, stage: string): string {\n        const file = dotWebpieces.logsFile(repoRoot, this.fileNameFor(repoRoot, stage));\n        return fs.existsSync(file) ? file : '';\n    }\n\n    /** `build-gate-<stage>-<branch>-<shortSha>.log` — see the class docstring for why this cannot collide. */\n    fileNameFor(repoRoot: string, stage: string): string {\n        const branch = this.slug(this.git(repoRoot, ['rev-parse', '--abbrev-ref', 'HEAD']));\n        const sha = this.slug(this.git(repoRoot, ['rev-parse', '--short', 'HEAD']));\n        return `build-gate-${this.slug(stage)}-${branch === '' ? 'nobranch' : branch}-${sha === '' ? 'nosha' : sha}.log`;\n    }\n\n    /**\n     * Run `buildCommand` with its combined stdout+stderr streaming to the terminal AND appended in full to\n     * `logPath`. Returns the BUILD's exit code (not tee's). Nothing is truncated.\n     */\n    run(repoRoot: string, buildCommand: string, logPath: string): number {\n        const statusFile = `${logPath}${STATUS_SUFFIX}`;\n        fs.rmSync(statusFile, { force: true });\n        const result = spawnSync(this.wrap(buildCommand, logPath, statusFile),\n            { stdio: 'inherit', cwd: repoRoot, shell: true });\n        const fromFile = this.readStatus(statusFile);\n        fs.rmSync(statusFile, { force: true });\n        if (fromFile !== null) return fromFile;\n        // The side file never appeared ⇒ the shell died before the echo. The PIPELINE's status is tee's,\n        // which is 0, and reporting 0 there would call a dead build green — so fail CLOSED instead.\n        return result.status !== null && result.status !== 0 ? result.status : 1;\n    }\n\n    /**\n     * The ENTIRE message the AI gets on a captured failure. Deliberately tiny: the whole point is that the\n     * agent reads ONE file rather than carrying a build transcript in its context.\n     *\n     * The last sentence is not filler. If the log holds no visible failure then something upstream is wrong\n     * (a runner that died without printing, a truncated pipe), and the worst possible response is an agent\n     * guessing or rebuilding — so it is told to surface the contradiction to the human and stop.\n     */\n    failureMessage(buildCommand: string, logPath: string): string {\n        return `\\n❌ The CI build failed. We ran\\n\\n` +\n            `    ${buildCommand} > ${logPath}\\n\\n` +\n            `and it failed, so read that file for the failures. Do NOT re-run the build to see them.\\n` +\n            `If you do not see failures in that log, report that to the user and stop.\\n`;\n    }\n\n    /**\n     * `{ ( <build> ) ; echo $? > <status> ; } 2>&1 | tee <log>` — written across LINES so a build command\n     * ending in a `#` comment cannot swallow what follows it.\n     *\n     * The inner `( … )` is load-bearing, not decoration. The left side of a pipeline is already a subshell,\n     * so a build command containing a plain `exit 7` (or any script that calls `exit`) would terminate that\n     * subshell OUTRIGHT — `echo $?` never runs, the side file never appears, and the only status left is\n     * tee's 0. The nested subshell absorbs the `exit`, so `$?` is the build's code every time.\n     */\n    private wrap(buildCommand: string, logPath: string, statusFile: string): string {\n        return `{\\n(\\n${buildCommand}\\n)\\necho $? > ${this.quote(statusFile)}\\n} 2>&1 | tee ${this.quote(logPath)}`;\n    }\n\n    // The build's own exit code, or null when the side file never appeared (the shell died before the echo).\n    private readStatus(statusFile: string): number | null {\n        if (!fs.existsSync(statusFile)) return null;\n        const parsed = Number.parseInt(fs.readFileSync(statusFile, 'utf8').trim(), 10);\n        return Number.isNaN(parsed) ? null : parsed;\n    }\n\n    // POSIX single-quoting: everything is literal inside '…', and a literal ' is spelled '\\''.\n    private quote(value: string): string {\n        return `'${value.split(\"'\").join(`'\\\\''`)}'`;\n    }\n\n    // Anything that is not a filename-safe character becomes '-', so `dean/feat` cannot create directories.\n    private slug(value: string): string {\n        return value.replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');\n    }\n\n    // One local git read. Fails SOFT to '' — a missing branch/sha degrades the FILENAME, and degrading a\n    // filename may never be the reason a build gate does not run.\n    private git(repoRoot: string, args: string[]): string {\n        const result = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8' });\n        if (result.status !== 0) return '';\n        return (result.stdout ?? '').trim();\n    }\n}\n"]}

package/src/scripts/workflow/repo-config-testkit.d.ts

@@ -13,6 +13,10 @@
  *     source"): a rule added in this working tree cannot get a config entry until its release ships,
  *     while the LOCAL validator a spec runs already demands one. Without this, adding any rule turns
  *     these specs red for exactly one release — a failure that says nothing about the code under test.
+ *  3. Every RETIRED rule entry is dropped — the same one-release lag pointing the other way. When a rule
+ *     is retired in this working tree, the repo's config must KEEP its entry until the release carrying
+ *     the retirement ships (deleting it early would fail the published validator and block every Bash
+ *     call), while the LOCAL validator already REJECTS it. Same trade as (2), same fix.
  *
  * A testkit, not product code: nothing in a published bin imports it (same role as ai-hook-rules'
  * `shim-testkit.ts`).
@@ -20,6 +24,7 @@
 export declare class RepoConfigFixture {
     /** The repo's config as a mutable object, checklists dropped and missing rules seeded. */
     load(): Record<string, unknown>;
+    private dropRetiredRules;
     /** Write `config` (usually a `load()` result a spec has edited) as the config of `dir`. */
     writeTo(dir: string, config: Record<string, unknown>): void;
     private seedMissingRules;

package/src/scripts/workflow/repo-config-testkit.js

@@ -20,6 +20,10 @@ const rules_config_1 = require("@webpieces/rules-config");
  *     source"): a rule added in this working tree cannot get a config entry until its release ships,
  *     while the LOCAL validator a spec runs already demands one. Without this, adding any rule turns
  *     these specs red for exactly one release — a failure that says nothing about the code under test.
+ *  3. Every RETIRED rule entry is dropped — the same one-release lag pointing the other way. When a rule
+ *     is retired in this working tree, the repo's config must KEEP its entry until the release carrying
+ *     the retirement ships (deleting it early would fail the published validator and block every Bash
+ *     call), while the LOCAL validator already REJECTS it. Same trade as (2), same fix.
  *
  * A testkit, not product code: nothing in a published bin imports it (same role as ai-hook-rules'
  * `shim-testkit.ts`).
@@ -35,9 +39,24 @@ class RepoConfigFixture {
         const commands = config['commands'];
         delete commands['pr-gate']['checklists'];
         delete commands['pr-gate']['checklistsWhy'];
+        this.dropRetiredRules(config);
         this.seedMissingRules(config);
         return config;
     }
+    // Drop every rule/guard name this build knows to be RETIRED, from whichever section holds it.
+    // webpieces-disable no-any-unknown -- see load()
+    dropRetiredRules(config) {
+        for (const section of ['rules', 'hookGuards']) {
+            // webpieces-disable no-any-unknown -- narrowing one rule section
+            const entries = config[section];
+            if (entries === undefined)
+                continue;
+            for (const name of Object.keys(entries)) {
+                if ((0, rules_config_1.retiredRuleFor)(name) !== null)
+                    delete entries[name];
+            }
+        }
+    }
     /** Write `config` (usually a `load()` result a spec has edited) as the config of `dir`. */
     // webpieces-disable no-any-unknown -- see load()
     writeTo(dir, config) {

package/src/scripts/workflow/repo-config-testkit.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo-config-testkit.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/repo-config-testkit.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,0DAAyF;AAEzF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,iBAAiB;IAC1B,0FAA0F;IAC1F,mGAAmG;IACnG,IAAI;QACA,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QACjG,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAA4B,CAAC;QACtF,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAA4C,CAAC;QAC/E,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,2FAA2F;IAC3F,iDAAiD;IACjD,OAAO,CAAC,GAAW,EAAE,MAA+B;QAChD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,iDAAiD;IACzC,gBAAgB,CAAC,MAA+B;QACpD,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAA4B,CAAC;QACzD,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAA4B,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,IAAA,2BAAY,GAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;CACJ;AAhCD,8CAgCC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { allRuleNames, sectionForRule, seedEntryForRule } from '@webpieces/rules-config';\n\n/**\n * THIS repo's own `webpieces.config.json`, prepared for use inside a temp clone.\n *\n * Specs that exercise a command end-to-end need a config the REAL validator accepts, and using the\n * repo's own file (rather than a hand-rolled minimal one) is what keeps them honest — a stub drifts out\n * from under the validator on the next config change. Two adjustments are needed to make that file\n * usable outside this checkout, and both are the same for every such spec, so they live here once:\n *\n *  1. `checklists` is dropped. Its `doc` paths are validated REPO-RELATIVE and point at\n *     `.claude/review/*.md`, which exist here and not in a temp clone.\n *  2. Every locally-known rule with no entry is SEEDED. The repo's config is validated by the PUBLISHED\n *     validator and therefore lags local source by one release (CLAUDE.md, \"Published vs local\n *     source\"): a rule added in this working tree cannot get a config entry until its release ships,\n *     while the LOCAL validator a spec runs already demands one. Without this, adding any rule turns\n *     these specs red for exactly one release — a failure that says nothing about the code under test.\n *\n * A testkit, not product code: nothing in a published bin imports it (same role as ai-hook-rules'\n * `shim-testkit.ts`).\n */\nexport class RepoConfigFixture {\n    /** The repo's config as a mutable object, checklists dropped and missing rules seeded. */\n    // webpieces-disable no-any-unknown -- the repo's own config document, opaque until a spec edits it\n    load(): Record<string, unknown> {\n        const source = path.join(__dirname, '..', '..', '..', '..', '..', '..', 'webpieces.config.json');\n        // webpieces-disable no-any-unknown -- parsed JSON, narrowed by the accessors below\n        const config = JSON.parse(fs.readFileSync(source, 'utf8')) as Record<string, unknown>;\n        // webpieces-disable no-any-unknown -- narrowing one nested section\n        const commands = config['commands'] as Record<string, Record<string, unknown>>;\n        delete commands['pr-gate']['checklists'];\n        delete commands['pr-gate']['checklistsWhy'];\n        this.seedMissingRules(config);\n        return config;\n    }\n\n    /** Write `config` (usually a `load()` result a spec has edited) as the config of `dir`. */\n    // webpieces-disable no-any-unknown -- see load()\n    writeTo(dir: string, config: Record<string, unknown>): void {\n        fs.writeFileSync(path.join(dir, 'webpieces.config.json'), JSON.stringify(config, null, 4) + '\\n');\n    }\n\n    // webpieces-disable no-any-unknown -- see load()\n    private seedMissingRules(config: Record<string, unknown>): void {\n        // webpieces-disable no-any-unknown -- narrowing the two rule sections\n        const rules = config['rules'] as Record<string, unknown>;\n        // webpieces-disable no-any-unknown -- narrowing the two rule sections\n        const guards = config['hookGuards'] as Record<string, unknown>;\n        for (const name of allRuleNames()) {\n            const section = sectionForRule(name) === 'hookGuards' ? guards : rules;\n            if (!(name in section)) section[name] = seedEntryForRule(name);\n        }\n    }\n}\n"]}
+{"version":3,"file":"repo-config-testkit.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/repo-config-testkit.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,0DAAyG;AAEzG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAa,iBAAiB;IAC1B,0FAA0F;IAC1F,mGAAmG;IACnG,IAAI;QACA,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QACjG,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAA4B,CAAC;QACtF,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAA4C,CAAC;QAC/E,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,8FAA8F;IAC9F,iDAAiD;IACzC,gBAAgB,CAAC,MAA+B;QACpD,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5C,iEAAiE;YACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAwC,CAAC;YACvE,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,IAAI,IAAA,6BAAc,EAAC,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,CAAC;QACL,CAAC;IACL,CAAC;IAED,2FAA2F;IAC3F,iDAAiD;IACjD,OAAO,CAAC,GAAW,EAAE,MAA+B;QAChD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,iDAAiD;IACzC,gBAAgB,CAAC,MAA+B;QACpD,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAA4B,CAAC;QACzD,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAA4B,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,IAAA,2BAAY,GAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;CACJ;AA9CD,8CA8CC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { allRuleNames, retiredRuleFor, sectionForRule, seedEntryForRule } from '@webpieces/rules-config';\n\n/**\n * THIS repo's own `webpieces.config.json`, prepared for use inside a temp clone.\n *\n * Specs that exercise a command end-to-end need a config the REAL validator accepts, and using the\n * repo's own file (rather than a hand-rolled minimal one) is what keeps them honest — a stub drifts out\n * from under the validator on the next config change. Two adjustments are needed to make that file\n * usable outside this checkout, and both are the same for every such spec, so they live here once:\n *\n *  1. `checklists` is dropped. Its `doc` paths are validated REPO-RELATIVE and point at\n *     `.claude/review/*.md`, which exist here and not in a temp clone.\n *  2. Every locally-known rule with no entry is SEEDED. The repo's config is validated by the PUBLISHED\n *     validator and therefore lags local source by one release (CLAUDE.md, \"Published vs local\n *     source\"): a rule added in this working tree cannot get a config entry until its release ships,\n *     while the LOCAL validator a spec runs already demands one. Without this, adding any rule turns\n *     these specs red for exactly one release — a failure that says nothing about the code under test.\n *  3. Every RETIRED rule entry is dropped — the same one-release lag pointing the other way. When a rule\n *     is retired in this working tree, the repo's config must KEEP its entry until the release carrying\n *     the retirement ships (deleting it early would fail the published validator and block every Bash\n *     call), while the LOCAL validator already REJECTS it. Same trade as (2), same fix.\n *\n * A testkit, not product code: nothing in a published bin imports it (same role as ai-hook-rules'\n * `shim-testkit.ts`).\n */\nexport class RepoConfigFixture {\n    /** The repo's config as a mutable object, checklists dropped and missing rules seeded. */\n    // webpieces-disable no-any-unknown -- the repo's own config document, opaque until a spec edits it\n    load(): Record<string, unknown> {\n        const source = path.join(__dirname, '..', '..', '..', '..', '..', '..', 'webpieces.config.json');\n        // webpieces-disable no-any-unknown -- parsed JSON, narrowed by the accessors below\n        const config = JSON.parse(fs.readFileSync(source, 'utf8')) as Record<string, unknown>;\n        // webpieces-disable no-any-unknown -- narrowing one nested section\n        const commands = config['commands'] as Record<string, Record<string, unknown>>;\n        delete commands['pr-gate']['checklists'];\n        delete commands['pr-gate']['checklistsWhy'];\n        this.dropRetiredRules(config);\n        this.seedMissingRules(config);\n        return config;\n    }\n\n    // Drop every rule/guard name this build knows to be RETIRED, from whichever section holds it.\n    // webpieces-disable no-any-unknown -- see load()\n    private dropRetiredRules(config: Record<string, unknown>): void {\n        for (const section of ['rules', 'hookGuards']) {\n            // webpieces-disable no-any-unknown -- narrowing one rule section\n            const entries = config[section] as Record<string, unknown> | undefined;\n            if (entries === undefined) continue;\n            for (const name of Object.keys(entries)) {\n                if (retiredRuleFor(name) !== null) delete entries[name];\n            }\n        }\n    }\n\n    /** Write `config` (usually a `load()` result a spec has edited) as the config of `dir`. */\n    // webpieces-disable no-any-unknown -- see load()\n    writeTo(dir: string, config: Record<string, unknown>): void {\n        fs.writeFileSync(path.join(dir, 'webpieces.config.json'), JSON.stringify(config, null, 4) + '\\n');\n    }\n\n    // webpieces-disable no-any-unknown -- see load()\n    private seedMissingRules(config: Record<string, unknown>): void {\n        // webpieces-disable no-any-unknown -- narrowing the two rule sections\n        const rules = config['rules'] as Record<string, unknown>;\n        // webpieces-disable no-any-unknown -- narrowing the two rule sections\n        const guards = config['hookGuards'] as Record<string, unknown>;\n        for (const name of allRuleNames()) {\n            const section = sectionForRule(name) === 'hookGuards' ? guards : rules;\n            if (!(name in section)) section[name] = seedEntryForRule(name);\n        }\n    }\n}\n"]}