@webpieces/pr-gate 0.4.725 → 0.4.727

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/pr-gate",
-  "version": "0.4.725",
+  "version": "0.4.727",
   "description": "Gated PR system: 3-point squash-merge, merge validation gate, and red/yellow/green PR dashboard. Standalone scripts, no Nx dependency required.",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -16,8 +16,8 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/ai-hook-rules": "0.4.725",
-    "@webpieces/rules-config": "0.4.725",
+    "@webpieces/ai-hook-rules": "0.4.727",
+    "@webpieces/rules-config": "0.4.727",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"
   },

package/src/scripts/commands/sync-main-command.d.ts

@@ -52,7 +52,8 @@ export declare class SyncMainCommand {
     run(): Promise<void>;
     /**
      * A linked worktree has no main to check out — `git checkout main` FATALS there with "main is already
-     * checked out at <primary clone>", which is a footgun CLAUDE.md currently has to warn about in prose.
+     * checked out at <primary clone>", which is a footgun `.claude/rules/finishing-a-feature.md`
+     * currently has to warn about in prose.
      * So the command does the half that IS meaningful here (worktrees accumulate corpses too, if a
      * long-lived one keeps merging main in) and says plainly where the other half lives.
      */

package/src/scripts/commands/sync-main-command.js

@@ -82,7 +82,8 @@ let SyncMainCommand = class SyncMainCommand {
     }
     /**
      * A linked worktree has no main to check out — `git checkout main` FATALS there with "main is already
-     * checked out at <primary clone>", which is a footgun CLAUDE.md currently has to warn about in prose.
+     * checked out at <primary clone>", which is a footgun `.claude/rules/finishing-a-feature.md`
+     * currently has to warn about in prose.
      * So the command does the half that IS meaningful here (worktrees accumulate corpses too, if a
      * long-lived one keeps merging main in) and says plainly where the other half lives.
      */

package/src/scripts/commands/sync-main-command.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-main-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/sync-main-command.ts"],"names":[],"mappings":";;;;AAAA,yCAA2D;AAC3D,0DAIiC;AAEjC,uDAAmD;AACnD,uDAK2B;AAC3B,mDAA6D;AAC7D,2DAAsE;AAEtE,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAEH;IACA;IACA;IACA;IACA;IALrB,YACqB,cAA8B,EAC9B,cAA8B,EAC9B,gBAAkC,EAClC,eAAgC,EAChC,YAA0B;QAJ1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,iBAAY,GAAZ,YAAY,CAAc;IAC5C,CAAC;IAEJ,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,kCAAkC,GAAG,IAAI,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzC,kGAAkG;QAClG,gGAAgG;QAChG,+FAA+F;QAC/F,sFAAsF;QACtF,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAC5C,IAAI,iCAAe,CAAC,sCAAoB,EAAE,KAAK,EAAE,EAAE,CAAC,EACpD,IAAI,iCAAe,CAAC,uCAAqB,EAAE,KAAK,EAAE,EAAE,CAAC,EACrD,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,SAAS,CAAC,QAAgB;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,4FAA4F;cAC1F,0DAA0D;cAC1D,4FAA4F;cAC5F,8FAA8F;cAC9F,wCAAwC,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACrC,MAAM,IAAI,GAAG,2BAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,SAAyB,EAAE,OAAqB;QACpE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;YAAE,OAAO;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,OAAqB;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,QAAgB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;CACJ,CAAA;AAzFY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QACd,gCAAc;QACZ,+BAAgB;QACjB,mCAAe;QAClB,4BAAY;GANtC,eAAe,CAyF3B","sourcesContent":["import { injectable, bindingScopeValues } from 'inversify';\nimport {\n    OrphanDirSweeper,\n    RepoRootFinder,\n    dotWebpieces,\n} from '@webpieces/rules-config';\n\nimport { CleanupCommand } from './cleanup-command';\nimport {\n    CleanupOptions,\n    DeleteSelection,\n    FLAG_DELETE_BRANCHES,\n    FLAG_DELETE_WORKTREES,\n} from './cleanup-options';\nimport { MainCheckout, StashedFiles } from './main-checkout';\nimport { WorkingTreeGate, UntrackedFiles } from './working-tree-gate';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * `wp-sync-main` — go to main, get main, and take out the trash. ONE command, because the three\n * are one intention and splitting them is what let the third never happen.\n *\n * ─── ITS RELATIONSHIP TO `git checkout main && git pull origin main` (READ BEFORE \"DELETING\" THAT) ────\n * That pair was already the enforced spelling: bare `git checkout main` is blocked precisely so the pull\n * rides along. This command is the same pairing with cleanup and the sweep welded on, and the WORKFLOW\n * messages now prescribe this instead — two spellings where one sweeps and one does not is shim shape\n * #1, an agent types whichever is accepted and the corpses accumulate forever.\n *\n * The raw pair is NOT deleted, and the reason is a constraint that outranks the shim rule: it is a\n * TERMINAL ENTRY ON THE L0 ALLOWLIST (`CHECKOUT_MAIN_PULL_CMD` in ai-hook-rules\n * `src/bin/l0-allowlist.ts`, consumed as an L0 cure in `src/core/l0-matrix.ts`) — one of\n * the few commands still permitted while an L0 block denies every other tool call. In exactly that\n * state, `node_modules` is the thing that is untrustworthy, so a `pnpm wp-*` bin is the one kind of cure\n * that cannot be relied on to run. The same reasoning covers the L0 shim's own fix option in\n * `templates/ai-hook.sh` (rendered from `src/bin/shim-drift-fix.ts`).\n *\n * So the end state is TWO LAYERS, not a deletion, and it is now in place:\n *   • L0 recovery (l0-allowlist, shim-drift-fix, l0-matrix) → keeps the raw pair. It is not a shim\n *     there; it is the only thing that works when the package manager's output is what is in doubt.\n *   • the WORKFLOW layer (stale-main-bash-guard's preferred cure, merged-branch-message/-bash-guard,\n *     TreeRecovery's cleanupSteps and updateMainSteps, the L2 rows/doc, CLAUDE.md's \"Finishing a\n *     Feature\") → prescribes `pnpm wp-sync-main`, and no longer prints the pair.\n *\n * The pair remains ALLOWED as a Bash command in both layers — this changed what the guards TEACH, not\n * what they permit. Blocking it would have deleted the L0 escape along with the shim.\n *\n * ─── WHY GOING TO MAIN IS THE RIGHT MOMENT TO SWEEP ───────────────────────────────────────────────────\n * The corpses appear when git moves the working tree onto a base where the tracked files under some\n * directory are gone. Landing a PR and returning to main is when every developer does that, on every\n * clone, roughly once per merged PR — so a sweep bolted here converges the whole team's machines with no\n * new trigger, no git hook to distribute, and no background daemon. It is also the quietest moment in the\n * day to move directories: nothing is building, no dev server is watching files.\n *\n * ─── WHY THE ORDER IS FIXED AND NOT PARALLEL ──────────────────────────────────────────────────────────\n * Cleanup runs BEFORE the sweep and not beside it. `wp-cleanup` removes dead worktrees, which changes\n * what is on disk, and a scan racing that would be reading a tree mid-demolition. The scan is one\n * ignore-walk and costs about a second; there is no wall-clock worth buying with that race.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class SyncMainCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly cleanupCommand: CleanupCommand,\n        private readonly orphanDirSweeper: OrphanDirSweeper,\n        private readonly workingTreeGate: WorkingTreeGate,\n        private readonly mainCheckout: MainCheckout,\n    ) {}\n\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        process.stdout.write(`${SEP}🧹 Checkout main, pull, clean\\n${SEP}\\n`);\n        if (this.isLinkedWorktree(repoRoot)) {\n            await this.sweepOnly(repoRoot);\n            return;\n        }\n        const untracked = this.workingTreeGate.assertNoTrackedChanges(repoRoot);\n        const stashed = this.mainCheckout.goToMain(repoRoot, untracked);\n        this.reportUntracked(untracked, stashed);\n        // No flags: this is the \"go to main and take out the trash\" path, so cleanup behaves exactly as a\n        // bare `pnpm wp-cleanup` does here — reap what is provably dead and every zero-commit husk, ask\n        // (or report) about the rest. Spelled out rather than defaulted so that if CleanupOptions ever\n        // grows a field, this call site is a compile error instead of a silent old behaviour.\n        await this.cleanupCommand.run(new CleanupOptions(\n            new DeleteSelection(FLAG_DELETE_BRANCHES, false, ''),\n            new DeleteSelection(FLAG_DELETE_WORKTREES, false, ''),\n            false, false, false));\n        this.sweep(repoRoot);\n        this.reportStashed(stashed);\n    }\n\n    /**\n     * A linked worktree has no main to check out — `git checkout main` FATALS there with \"main is already\n     * checked out at <primary clone>\", which is a footgun CLAUDE.md currently has to warn about in prose.\n     * So the command does the half that IS meaningful here (worktrees accumulate corpses too, if a\n     * long-lived one keeps merging main in) and says plainly where the other half lives.\n     */\n    private async sweepOnly(repoRoot: string): Promise<void> {\n        process.stdout.write(\n            'This is a linked WORKTREE. main is checked out in the primary clone, so there is nothing\\n'\n            + 'here to check out or pull — sweeping this tree only.\\n\\n'\n            + 'Most worktrees never need this: `wp-cleanup` removes the whole directory once its branch\\n'\n            + 'lands, which takes any orphan directories inside it along. Run this command again from the\\n'\n            + 'primary clone to go to main there.\\n\\n');\n        this.sweep(repoRoot);\n        return Promise.resolve();\n    }\n\n    private isLinkedWorktree(repoRoot: string): boolean {\n        const dirs = dotWebpieces.gitDirs(repoRoot);\n        return dirs !== null && dirs.isLinkedWorktree;\n    }\n\n    /**\n     * Say which untracked files were let through, AFTER the move — so nobody has to wonder whether the\n     * files still sitting in their tree came along for the ride. Printed rather than refused on: see\n     * `WorkingTreeGate` for why an untracked file is not the hazard a tracked one is.\n     *\n     * Silent when the checkout had to stash: those files are NOT sitting in the tree any more, and\n     * \"nothing about them changed\" would be a lie. `reportStashed` speaks for that case instead.\n     */\n    private reportUntracked(untracked: UntrackedFiles, stashed: StashedFiles): void {\n        if (!stashed.isEmpty()) return;\n        const rendered = untracked.render();\n        if (rendered === '') return;\n        process.stdout.write(`\\n${rendered}`);\n    }\n\n    /**\n     * The stash banner goes LAST, on purpose. It is the one thing in this command's output a reader\n     * must not miss — their files left the working tree — and the cleanup and sweep that follow the\n     * checkout print enough to scroll it away if it were emitted where it happened.\n     */\n    private reportStashed(stashed: StashedFiles): void {\n        const rendered = stashed.render();\n        if (rendered === '') return;\n        process.stdout.write(`\\n${rendered}`);\n    }\n\n    /**\n     * Sweep, then print. Never throws: the checkout and pull above already succeeded, and a tidier is not\n     * permitted to turn somebody's completed sync into a failed command.\n     */\n    private sweep(repoRoot: string): void {\n        const report = this.orphanDirSweeper.sweep(repoRoot, new Date());\n        const rendered = report.render();\n        if (rendered === '') return;\n        process.stdout.write(`\\n${rendered}`);\n    }\n}\n"]}
+{"version":3,"file":"sync-main-command.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/commands/sync-main-command.ts"],"names":[],"mappings":";;;;AAAA,yCAA2D;AAC3D,0DAIiC;AAEjC,uDAAmD;AACnD,uDAK2B;AAC3B,mDAA6D;AAC7D,2DAAsE;AAEtE,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAEH;IACA;IACA;IACA;IACA;IALrB,YACqB,cAA8B,EAC9B,cAA8B,EAC9B,gBAAkC,EAClC,eAAgC,EAChC,YAA0B;QAJ1B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,mBAAc,GAAd,cAAc,CAAgB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;QAClC,oBAAe,GAAf,eAAe,CAAiB;QAChC,iBAAY,GAAZ,YAAY,CAAc;IAC5C,CAAC;IAEJ,KAAK,CAAC,GAAG;QACL,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,kCAAkC,GAAG,IAAI,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACxE,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACzC,kGAAkG;QAClG,gGAAgG;QAChG,+FAA+F;QAC/F,sFAAsF;QACtF,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAC5C,IAAI,iCAAe,CAAC,sCAAoB,EAAE,KAAK,EAAE,EAAE,CAAC,EACpD,IAAI,iCAAe,CAAC,uCAAqB,EAAE,KAAK,EAAE,EAAE,CAAC,EACrD,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,SAAS,CAAC,QAAgB;QACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAChB,4FAA4F;cAC1F,0DAA0D;cAC1D,4FAA4F;cAC5F,8FAA8F;cAC9F,wCAAwC,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrB,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACrC,MAAM,IAAI,GAAG,2BAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC;IAClD,CAAC;IAED;;;;;;;OAOG;IACK,eAAe,CAAC,SAAyB,EAAE,OAAqB;QACpE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE;YAAE,OAAO;QAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,OAAqB;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,QAAgB;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;CACJ,CAAA;AA1FY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QACd,gCAAc;QACZ,+BAAgB;QACjB,mCAAe;QAClB,4BAAY;GANtC,eAAe,CA0F3B","sourcesContent":["import { injectable, bindingScopeValues } from 'inversify';\nimport {\n    OrphanDirSweeper,\n    RepoRootFinder,\n    dotWebpieces,\n} from '@webpieces/rules-config';\n\nimport { CleanupCommand } from './cleanup-command';\nimport {\n    CleanupOptions,\n    DeleteSelection,\n    FLAG_DELETE_BRANCHES,\n    FLAG_DELETE_WORKTREES,\n} from './cleanup-options';\nimport { MainCheckout, StashedFiles } from './main-checkout';\nimport { WorkingTreeGate, UntrackedFiles } from './working-tree-gate';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/**\n * `wp-sync-main` — go to main, get main, and take out the trash. ONE command, because the three\n * are one intention and splitting them is what let the third never happen.\n *\n * ─── ITS RELATIONSHIP TO `git checkout main && git pull origin main` (READ BEFORE \"DELETING\" THAT) ────\n * That pair was already the enforced spelling: bare `git checkout main` is blocked precisely so the pull\n * rides along. This command is the same pairing with cleanup and the sweep welded on, and the WORKFLOW\n * messages now prescribe this instead — two spellings where one sweeps and one does not is shim shape\n * #1, an agent types whichever is accepted and the corpses accumulate forever.\n *\n * The raw pair is NOT deleted, and the reason is a constraint that outranks the shim rule: it is a\n * TERMINAL ENTRY ON THE L0 ALLOWLIST (`CHECKOUT_MAIN_PULL_CMD` in ai-hook-rules\n * `src/bin/l0-allowlist.ts`, consumed as an L0 cure in `src/core/l0-matrix.ts`) — one of\n * the few commands still permitted while an L0 block denies every other tool call. In exactly that\n * state, `node_modules` is the thing that is untrustworthy, so a `pnpm wp-*` bin is the one kind of cure\n * that cannot be relied on to run. The same reasoning covers the L0 shim's own fix option in\n * `templates/ai-hook.sh` (rendered from `src/bin/shim-drift-fix.ts`).\n *\n * So the end state is TWO LAYERS, not a deletion, and it is now in place:\n *   • L0 recovery (l0-allowlist, shim-drift-fix, l0-matrix) → keeps the raw pair. It is not a shim\n *     there; it is the only thing that works when the package manager's output is what is in doubt.\n *   • the WORKFLOW layer (stale-main-bash-guard's preferred cure, merged-branch-message/-bash-guard,\n *     TreeRecovery's cleanupSteps and updateMainSteps, the L2 rows/doc, CLAUDE.md's \"Finishing a\n *     Feature\") → prescribes `pnpm wp-sync-main`, and no longer prints the pair.\n *\n * The pair remains ALLOWED as a Bash command in both layers — this changed what the guards TEACH, not\n * what they permit. Blocking it would have deleted the L0 escape along with the shim.\n *\n * ─── WHY GOING TO MAIN IS THE RIGHT MOMENT TO SWEEP ───────────────────────────────────────────────────\n * The corpses appear when git moves the working tree onto a base where the tracked files under some\n * directory are gone. Landing a PR and returning to main is when every developer does that, on every\n * clone, roughly once per merged PR — so a sweep bolted here converges the whole team's machines with no\n * new trigger, no git hook to distribute, and no background daemon. It is also the quietest moment in the\n * day to move directories: nothing is building, no dev server is watching files.\n *\n * ─── WHY THE ORDER IS FIXED AND NOT PARALLEL ──────────────────────────────────────────────────────────\n * Cleanup runs BEFORE the sweep and not beside it. `wp-cleanup` removes dead worktrees, which changes\n * what is on disk, and a scan racing that would be reading a tree mid-demolition. The scan is one\n * ignore-walk and costs about a second; there is no wall-clock worth buying with that race.\n */\n@injectable(bindingScopeValues.Singleton)\nexport class SyncMainCommand {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly cleanupCommand: CleanupCommand,\n        private readonly orphanDirSweeper: OrphanDirSweeper,\n        private readonly workingTreeGate: WorkingTreeGate,\n        private readonly mainCheckout: MainCheckout,\n    ) {}\n\n    async run(): Promise<void> {\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n        process.stdout.write(`${SEP}🧹 Checkout main, pull, clean\\n${SEP}\\n`);\n        if (this.isLinkedWorktree(repoRoot)) {\n            await this.sweepOnly(repoRoot);\n            return;\n        }\n        const untracked = this.workingTreeGate.assertNoTrackedChanges(repoRoot);\n        const stashed = this.mainCheckout.goToMain(repoRoot, untracked);\n        this.reportUntracked(untracked, stashed);\n        // No flags: this is the \"go to main and take out the trash\" path, so cleanup behaves exactly as a\n        // bare `pnpm wp-cleanup` does here — reap what is provably dead and every zero-commit husk, ask\n        // (or report) about the rest. Spelled out rather than defaulted so that if CleanupOptions ever\n        // grows a field, this call site is a compile error instead of a silent old behaviour.\n        await this.cleanupCommand.run(new CleanupOptions(\n            new DeleteSelection(FLAG_DELETE_BRANCHES, false, ''),\n            new DeleteSelection(FLAG_DELETE_WORKTREES, false, ''),\n            false, false, false));\n        this.sweep(repoRoot);\n        this.reportStashed(stashed);\n    }\n\n    /**\n     * A linked worktree has no main to check out — `git checkout main` FATALS there with \"main is already\n     * checked out at <primary clone>\", which is a footgun `.claude/rules/finishing-a-feature.md`\n     * currently has to warn about in prose.\n     * So the command does the half that IS meaningful here (worktrees accumulate corpses too, if a\n     * long-lived one keeps merging main in) and says plainly where the other half lives.\n     */\n    private async sweepOnly(repoRoot: string): Promise<void> {\n        process.stdout.write(\n            'This is a linked WORKTREE. main is checked out in the primary clone, so there is nothing\\n'\n            + 'here to check out or pull — sweeping this tree only.\\n\\n'\n            + 'Most worktrees never need this: `wp-cleanup` removes the whole directory once its branch\\n'\n            + 'lands, which takes any orphan directories inside it along. Run this command again from the\\n'\n            + 'primary clone to go to main there.\\n\\n');\n        this.sweep(repoRoot);\n        return Promise.resolve();\n    }\n\n    private isLinkedWorktree(repoRoot: string): boolean {\n        const dirs = dotWebpieces.gitDirs(repoRoot);\n        return dirs !== null && dirs.isLinkedWorktree;\n    }\n\n    /**\n     * Say which untracked files were let through, AFTER the move — so nobody has to wonder whether the\n     * files still sitting in their tree came along for the ride. Printed rather than refused on: see\n     * `WorkingTreeGate` for why an untracked file is not the hazard a tracked one is.\n     *\n     * Silent when the checkout had to stash: those files are NOT sitting in the tree any more, and\n     * \"nothing about them changed\" would be a lie. `reportStashed` speaks for that case instead.\n     */\n    private reportUntracked(untracked: UntrackedFiles, stashed: StashedFiles): void {\n        if (!stashed.isEmpty()) return;\n        const rendered = untracked.render();\n        if (rendered === '') return;\n        process.stdout.write(`\\n${rendered}`);\n    }\n\n    /**\n     * The stash banner goes LAST, on purpose. It is the one thing in this command's output a reader\n     * must not miss — their files left the working tree — and the cleanup and sweep that follow the\n     * checkout print enough to scroll it away if it were emitted where it happened.\n     */\n    private reportStashed(stashed: StashedFiles): void {\n        const rendered = stashed.render();\n        if (rendered === '') return;\n        process.stdout.write(`\\n${rendered}`);\n    }\n\n    /**\n     * Sweep, then print. Never throws: the checkout and pull above already succeeded, and a tidier is not\n     * permitted to turn somebody's completed sync into a failed command.\n     */\n    private sweep(repoRoot: string): void {\n        const report = this.orphanDirSweeper.sweep(repoRoot, new Date());\n        const rendered = report.render();\n        if (rendered === '') return;\n        process.stdout.write(`\\n${rendered}`);\n    }\n}\n"]}

package/src/scripts/workflow/build-affected.d.ts

@@ -41,7 +41,7 @@ export declare class BuildAffected {
      * A START row goes into `~/.webpieces/builds.log` before the spawn and a DONE row after it, in a
      * `finally` so a throw on the failure path still closes the pair. `opts.stage` — `build` | `review` |
      * `finish` — IS the caller id the row records; there is deliberately no second `caller` field, since
-     * two spellings of one fact is the shim CLAUDE.md rejects.
+     * two spellings of one fact is the shim `.claude/rules/no-backwards-compat.md` rejects.
      *
      * The ledger is best-effort by construction (see BuildsLog): it can never throw, so no build can die
      * because a log file was busy.

package/src/scripts/workflow/build-affected.js

@@ -68,7 +68,7 @@ let BuildAffected = class BuildAffected {
      * A START row goes into `~/.webpieces/builds.log` before the spawn and a DONE row after it, in a
      * `finally` so a throw on the failure path still closes the pair. `opts.stage` — `build` | `review` |
      * `finish` — IS the caller id the row records; there is deliberately no second `caller` field, since
-     * two spellings of one fact is the shim CLAUDE.md rejects.
+     * two spellings of one fact is the shim `.claude/rules/no-backwards-compat.md` rejects.
      *
      * The ledger is best-effort by construction (see BuildsLog): it can never throw, so no build can die
      * because a log file was busy.

package/src/scripts/workflow/build-affected.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-affected.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/build-affected.ts"],"names":[],"mappings":";;;;AAAA,0DAEiC;AACjC,4DAAoF;AACpF,yCAA2D;AAC3D,qDAAgD;AAChD,yDAAoD;AAEpD,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,oFAAoF;AACpF,oGAAoG;AACpG,iEAAiE;AAGjE;;;;GAIG;AACH,MAAa,gBAAgB;IACzB,KAAK,CAAS,CAAY,sCAAsC;IAChE,YAAY,CAAS,CAAK,gDAAgD;IAC1E,eAAe,CAAS,CAAE,gCAAgC;IAC1D,qGAAqG;IACrG,uGAAuG;IACvG,KAAK,CAAS;IAEd,YAAY,KAAa,EAAE,YAAoB,EAAE,eAAuB,EAAE,KAAa;QACnF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAdD,4CAcC;AAED;;;GAGG;AACU,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,qGAAqG;AAE9F,IAAM,aAAa,GAAnB,MAAM,aAAa;IAED;IACA;IACA;IACA;IAJrB,YACqB,QAAsB,EACtB,SAAoB,EACpB,YAA4B,EAC5B,aAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAc;QACtB,cAAS,GAAT,SAAS,CAAW;QACpB,iBAAY,GAAZ,YAAY,CAAgB;QAC5B,kBAAa,GAAb,aAAa,CAAoB;IACnD,CAAC;IAEJ;;;OAGG;IACH,mBAAmB,CAAC,QAAgB;QAChC,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACjE,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oCAAqB,CAAC;IACrG,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAsB;QACvD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACxD,mGAAmG;QACnG,mGAAmG;QACnG,sFAAsF;QACtF,EAAE;QACF,4FAA4F;QAC5F,iGAAiG;QACjG,qBAAqB;QACrB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,oGAAoG;QACpG,4FAA4F;QAC5F,8DAA8D;QAC9D,IAAI,CAAC;YACD,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,SAAS,KAAK,CAAC;YAAE,MAAM,IAAI,2BAAY,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,eAAe,CAAC,QAAgB;QACpC,MAAM,OAAO,GAAyB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,IAAI,4BAAa,CACnB,8BAAsB,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,IAAsB,EAAE,YAAoB,EAAE,OAAe;QAC7E,OAAO,OAAO,IAAI,CAAC,eAAe,IAAI;YAClC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC;YACnD,wCAAwC,IAAI,CAAC,YAAY,KAAK,CAAC;IACvE,CAAC;CACJ,CAAA;AAjGY,sCAAa;wBAAb,aAAa;IADzB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGN,6BAAY;QACX,wBAAS;QACN,iCAAc;QACb,kCAAkB;GAL7C,aAAa,CAiGzB","sourcesContent":["import {\n    loadAndValidate, CliExitError, DEFAULT_BUILD_COMMAND, BuildsLog, RuleFailError,\n} from '@webpieces/rules-config';\nimport { CodexGuardPresence, GuardPresenceVerdict } from '@webpieces/ai-hook-rules';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { BuildGateLog } from './build-gate-log';\nimport { StageOutputLog } from './stage-output-log';\n\n// Single source of truth for RUNNING the build gate. `wp-start-upsert-pr` runs NO build; stage ②\n// (`wp-review-upsert-pr`) runs it authoritatively before any reviewer is spawned, and stage ③\n// (`wp-finish-upsert-pr`) re-runs it only when HEAD has moved since. nx `affected` only rebuilds\n// changed projects. The fallback command itself lives in @webpieces/rules-config as\n// DEFAULT_BUILD_COMMAND — whole-repo-build-guard prints the same string, and one definition is what\n// keeps the refusal message naming the build that actually runs.\n\n\n/**\n * The caller-supplied framing for the build gate (label, re-run command, failure headline, stage id). Kept\n * as a parameter object so runBuildGate stays agnostic of who invokes it. A class (not an object literal)\n * per the codebase's data-structure convention.\n */\nexport class BuildGateOptions {\n    label: string;            // section header shown above the gate\n    rerunCommand: string;     // command the AI re-runs after fixing the build\n    failureHeadline: string;  // first line printed on failure\n    // WHICH stage's gate this is — REVIEW_STAGE, FINISH_STAGE or BUILD_STAGE. Required, with no default:\n    // it decides the captured log's filename, and a default would silently make two stages share one file.\n    stage: string;\n\n    constructor(label: string, rerunCommand: string, failureHeadline: string, stage: string) {\n        this.label = label;\n        this.rerunCommand = rerunCommand;\n        this.failureHeadline = failureHeadline;\n        this.stage = stage;\n    }\n}\n\n/**\n * The rule name the guard-presence refusal is reported under, so it is greppable from a transcript the\n * same way `too-many-concurrent-builds` is.\n */\nexport const CODEX_GUARDS_NEVER_RAN = 'codex-guards-never-ran';\n\n/** Runs the authoritative nx-affected build gate for wp-review-upsert-pr and wp-finish-upsert-pr. */\n@injectable(bindingScopeValues.Singleton)\nexport class BuildAffected {\n    constructor(\n        private readonly buildLog: BuildGateLog,\n        private readonly buildsLog: BuildsLog,\n        private readonly stageConsole: StageOutputLog,\n        private readonly guardPresence: CodexGuardPresence,\n    ) {}\n\n    /**\n     * Resolve the exact build command this gate will run: the project's configured\n     * PrGateConfig.buildCommand, or the default affected-ci command when none is set.\n     */\n    resolveBuildCommand(repoRoot: string): string {\n        const configured = loadAndValidate(repoRoot).prGate.buildCommand;\n        return configured !== undefined && configured.trim() !== '' ? configured : DEFAULT_BUILD_COMMAND;\n    }\n\n    /**\n     * Run the configured build gate with consistent framing, throwing CliExitError(buildCode) on\n     * failure so the bin's main()/runMain owns the exit. THE single source of truth for running a build:\n     * wp-build, wp-review-upsert-pr and wp-finish-upsert-pr all call THIS (only the BuildGateOptions\n     * differ), and there is no other way to reach the spawn.\n     *\n     * ─── EVERY BUILD ON THIS MACHINE IS LEDGERED FROM HERE ───────────────────────────────────────────\n     * A START row goes into `~/.webpieces/builds.log` before the spawn and a DONE row after it, in a\n     * `finally` so a throw on the failure path still closes the pair. `opts.stage` — `build` | `review` |\n     * `finish` — IS the caller id the row records; there is deliberately no second `caller` field, since\n     * two spellings of one fact is the shim CLAUDE.md rejects.\n     *\n     * The ledger is best-effort by construction (see BuildsLog): it can never throw, so no build can die\n     * because a log file was busy.\n     */\n    async runBuildGate(repoRoot: string, opts: BuildGateOptions): Promise<void> {\n        this.assertGuardsRan(repoRoot);\n        const buildCommand = this.resolveBuildCommand(repoRoot);\n        // TWO lines on the happy path — the command, then the result. The old framing spent a banner and a\n        // paragraph explaining how to reproduce a build that was about to pass anyway; that explanation is\n        // only useful when the build FAILS, so it now lives solely on the failure path below.\n        //\n        // `say`, so it survives a stage that is capturing its own console (see StageOutputLog): the\n        // command being run and the result of running it are exactly what a caller watching a long build\n        // needs to see live.\n        this.stageConsole.say(`\\n${opts.label}: ${buildCommand}\\n`);\n        const logPath = this.buildLog.pathFor(repoRoot, opts.stage);\n        const ticket = this.buildsLog.start(opts.stage, repoRoot);\n        let buildCode = 1;\n        // webpieces-disable no-unmanaged-exceptions -- chokepoint: the DONE row must be written whether the\n        // build passed, failed, or the spawn itself blew up; the throw is re-raised untouched below\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            buildCode = await this.buildLog.run(repoRoot, buildCommand, logPath);\n        } finally {\n            this.buildsLog.finish(ticket, buildCode);\n        }\n        if (buildCode !== 0) throw new CliExitError(buildCode, this.failureText(opts, buildCommand, logPath));\n        this.stageConsole.say(this.buildLog.successMessage(logPath));\n    }\n\n    /**\n     * Refuse when this is a Codex session in which NOT ONE guard has run.\n     *\n     * ─── Why it lives at the build, and why in THIS method ───────────────────────────────────────────\n     * `runBuildGate` is the single chokepoint every build reaches — `wp-build`, stage ② and stage ③ —\n     * so one call here is the whole wiring. It runs BEFORE the command is resolved and before the\n     * ledger row opens, because a session that was never guarded should cost nothing, not a full build\n     * followed by a refusal to believe it.\n     *\n     * The build is the right MOMENT because it is where a session's work is first claimed as verified.\n     * An unguarded Codex session that never builds has produced nothing anyone is about to trust; one\n     * that builds is asking for exactly that trust, on the strength of guards that never ran.\n     *\n     * ─── Safe to call unconditionally ────────────────────────────────────────────────────────────────\n     * Outside a Codex session `check()` is a no-op that returns ok — Claude Code sessions, CI, and a\n     * human at a terminal all pass straight through, which is why this needs no flag and no config key\n     * to sit on the shared path. The cures come from the verdict as `Option`s; this method contributes\n     * the throw and nothing else, so the two halves cannot drift into two different stories.\n     */\n    private assertGuardsRan(repoRoot: string): void {\n        const verdict: GuardPresenceVerdict = this.guardPresence.check(repoRoot);\n        if (verdict.ok) return;\n        throw new RuleFailError(\n            CODEX_GUARDS_NEVER_RAN, verdict.reason, undefined, undefined, [...verdict.cures]);\n    }\n\n    /**\n     * The failure text: this gate's own headline, then the pointer at the log the build already wrote.\n     *\n     * There is no second, streamed variant any more. Capturing used to be behind an EXPERIMENTAL\n     * machine-local opt-in, which meant the refusal an agent read depended on a file almost nobody had —\n     * and the un-captured branch's advice was \"run the build again yourself\", which is the single most\n     * expensive thing an agent can be told. Reading a FILE is now the only answer this gate gives.\n     */\n    private failureText(opts: BuildGateOptions, buildCommand: string, logPath: string): string {\n        return `\\n❌ ${opts.failureHeadline}\\n` +\n            this.buildLog.failureMessage(buildCommand, logPath) +\n            `Fix what that log shows, then re-run ${opts.rerunCommand}.\\n`;\n    }\n}\n"]}
+{"version":3,"file":"build-affected.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/build-affected.ts"],"names":[],"mappings":";;;;AAAA,0DAEiC;AACjC,4DAAoF;AACpF,yCAA2D;AAC3D,qDAAgD;AAChD,yDAAoD;AAEpD,iGAAiG;AACjG,8FAA8F;AAC9F,iGAAiG;AACjG,oFAAoF;AACpF,oGAAoG;AACpG,iEAAiE;AAGjE;;;;GAIG;AACH,MAAa,gBAAgB;IACzB,KAAK,CAAS,CAAY,sCAAsC;IAChE,YAAY,CAAS,CAAK,gDAAgD;IAC1E,eAAe,CAAS,CAAE,gCAAgC;IAC1D,qGAAqG;IACrG,uGAAuG;IACvG,KAAK,CAAS;IAEd,YAAY,KAAa,EAAE,YAAoB,EAAE,eAAuB,EAAE,KAAa;QACnF,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACvB,CAAC;CACJ;AAdD,4CAcC;AAED;;;GAGG;AACU,QAAA,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,qGAAqG;AAE9F,IAAM,aAAa,GAAnB,MAAM,aAAa;IAED;IACA;IACA;IACA;IAJrB,YACqB,QAAsB,EACtB,SAAoB,EACpB,YAA4B,EAC5B,aAAiC;QAHjC,aAAQ,GAAR,QAAQ,CAAc;QACtB,cAAS,GAAT,SAAS,CAAW;QACpB,iBAAY,GAAZ,YAAY,CAAgB;QAC5B,kBAAa,GAAb,aAAa,CAAoB;IACnD,CAAC;IAEJ;;;OAGG;IACH,mBAAmB,CAAC,QAAgB;QAChC,MAAM,UAAU,GAAG,IAAA,8BAAe,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACjE,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oCAAqB,CAAC;IACrG,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,IAAsB;QACvD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACxD,mGAAmG;QACnG,mGAAmG;QACnG,sFAAsF;QACtF,EAAE;QACF,4FAA4F;QAC5F,iGAAiG;QACjG,qBAAqB;QACrB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,KAAK,YAAY,IAAI,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,oGAAoG;QACpG,4FAA4F;QAC5F,8DAA8D;QAC9D,IAAI,CAAC;YACD,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;QACzE,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,SAAS,KAAK,CAAC;YAAE,MAAM,IAAI,2BAAY,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;QACtG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,eAAe,CAAC,QAAgB;QACpC,MAAM,OAAO,GAAyB,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO;QACvB,MAAM,IAAI,4BAAa,CACnB,8BAAsB,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED;;;;;;;OAOG;IACK,WAAW,CAAC,IAAsB,EAAE,YAAoB,EAAE,OAAe;QAC7E,OAAO,OAAO,IAAI,CAAC,eAAe,IAAI;YAClC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC;YACnD,wCAAwC,IAAI,CAAC,YAAY,KAAK,CAAC;IACvE,CAAC;CACJ,CAAA;AAjGY,sCAAa;wBAAb,aAAa;IADzB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGN,6BAAY;QACX,wBAAS;QACN,iCAAc;QACb,kCAAkB;GAL7C,aAAa,CAiGzB","sourcesContent":["import {\n    loadAndValidate, CliExitError, DEFAULT_BUILD_COMMAND, BuildsLog, RuleFailError,\n} from '@webpieces/rules-config';\nimport { CodexGuardPresence, GuardPresenceVerdict } from '@webpieces/ai-hook-rules';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { BuildGateLog } from './build-gate-log';\nimport { StageOutputLog } from './stage-output-log';\n\n// Single source of truth for RUNNING the build gate. `wp-start-upsert-pr` runs NO build; stage ②\n// (`wp-review-upsert-pr`) runs it authoritatively before any reviewer is spawned, and stage ③\n// (`wp-finish-upsert-pr`) re-runs it only when HEAD has moved since. nx `affected` only rebuilds\n// changed projects. The fallback command itself lives in @webpieces/rules-config as\n// DEFAULT_BUILD_COMMAND — whole-repo-build-guard prints the same string, and one definition is what\n// keeps the refusal message naming the build that actually runs.\n\n\n/**\n * The caller-supplied framing for the build gate (label, re-run command, failure headline, stage id). Kept\n * as a parameter object so runBuildGate stays agnostic of who invokes it. A class (not an object literal)\n * per the codebase's data-structure convention.\n */\nexport class BuildGateOptions {\n    label: string;            // section header shown above the gate\n    rerunCommand: string;     // command the AI re-runs after fixing the build\n    failureHeadline: string;  // first line printed on failure\n    // WHICH stage's gate this is — REVIEW_STAGE, FINISH_STAGE or BUILD_STAGE. Required, with no default:\n    // it decides the captured log's filename, and a default would silently make two stages share one file.\n    stage: string;\n\n    constructor(label: string, rerunCommand: string, failureHeadline: string, stage: string) {\n        this.label = label;\n        this.rerunCommand = rerunCommand;\n        this.failureHeadline = failureHeadline;\n        this.stage = stage;\n    }\n}\n\n/**\n * The rule name the guard-presence refusal is reported under, so it is greppable from a transcript the\n * same way `too-many-concurrent-builds` is.\n */\nexport const CODEX_GUARDS_NEVER_RAN = 'codex-guards-never-ran';\n\n/** Runs the authoritative nx-affected build gate for wp-review-upsert-pr and wp-finish-upsert-pr. */\n@injectable(bindingScopeValues.Singleton)\nexport class BuildAffected {\n    constructor(\n        private readonly buildLog: BuildGateLog,\n        private readonly buildsLog: BuildsLog,\n        private readonly stageConsole: StageOutputLog,\n        private readonly guardPresence: CodexGuardPresence,\n    ) {}\n\n    /**\n     * Resolve the exact build command this gate will run: the project's configured\n     * PrGateConfig.buildCommand, or the default affected-ci command when none is set.\n     */\n    resolveBuildCommand(repoRoot: string): string {\n        const configured = loadAndValidate(repoRoot).prGate.buildCommand;\n        return configured !== undefined && configured.trim() !== '' ? configured : DEFAULT_BUILD_COMMAND;\n    }\n\n    /**\n     * Run the configured build gate with consistent framing, throwing CliExitError(buildCode) on\n     * failure so the bin's main()/runMain owns the exit. THE single source of truth for running a build:\n     * wp-build, wp-review-upsert-pr and wp-finish-upsert-pr all call THIS (only the BuildGateOptions\n     * differ), and there is no other way to reach the spawn.\n     *\n     * ─── EVERY BUILD ON THIS MACHINE IS LEDGERED FROM HERE ───────────────────────────────────────────\n     * A START row goes into `~/.webpieces/builds.log` before the spawn and a DONE row after it, in a\n     * `finally` so a throw on the failure path still closes the pair. `opts.stage` — `build` | `review` |\n     * `finish` — IS the caller id the row records; there is deliberately no second `caller` field, since\n     * two spellings of one fact is the shim `.claude/rules/no-backwards-compat.md` rejects.\n     *\n     * The ledger is best-effort by construction (see BuildsLog): it can never throw, so no build can die\n     * because a log file was busy.\n     */\n    async runBuildGate(repoRoot: string, opts: BuildGateOptions): Promise<void> {\n        this.assertGuardsRan(repoRoot);\n        const buildCommand = this.resolveBuildCommand(repoRoot);\n        // TWO lines on the happy path — the command, then the result. The old framing spent a banner and a\n        // paragraph explaining how to reproduce a build that was about to pass anyway; that explanation is\n        // only useful when the build FAILS, so it now lives solely on the failure path below.\n        //\n        // `say`, so it survives a stage that is capturing its own console (see StageOutputLog): the\n        // command being run and the result of running it are exactly what a caller watching a long build\n        // needs to see live.\n        this.stageConsole.say(`\\n${opts.label}: ${buildCommand}\\n`);\n        const logPath = this.buildLog.pathFor(repoRoot, opts.stage);\n        const ticket = this.buildsLog.start(opts.stage, repoRoot);\n        let buildCode = 1;\n        // webpieces-disable no-unmanaged-exceptions -- chokepoint: the DONE row must be written whether the\n        // build passed, failed, or the spawn itself blew up; the throw is re-raised untouched below\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions\n        try {\n            buildCode = await this.buildLog.run(repoRoot, buildCommand, logPath);\n        } finally {\n            this.buildsLog.finish(ticket, buildCode);\n        }\n        if (buildCode !== 0) throw new CliExitError(buildCode, this.failureText(opts, buildCommand, logPath));\n        this.stageConsole.say(this.buildLog.successMessage(logPath));\n    }\n\n    /**\n     * Refuse when this is a Codex session in which NOT ONE guard has run.\n     *\n     * ─── Why it lives at the build, and why in THIS method ───────────────────────────────────────────\n     * `runBuildGate` is the single chokepoint every build reaches — `wp-build`, stage ② and stage ③ —\n     * so one call here is the whole wiring. It runs BEFORE the command is resolved and before the\n     * ledger row opens, because a session that was never guarded should cost nothing, not a full build\n     * followed by a refusal to believe it.\n     *\n     * The build is the right MOMENT because it is where a session's work is first claimed as verified.\n     * An unguarded Codex session that never builds has produced nothing anyone is about to trust; one\n     * that builds is asking for exactly that trust, on the strength of guards that never ran.\n     *\n     * ─── Safe to call unconditionally ────────────────────────────────────────────────────────────────\n     * Outside a Codex session `check()` is a no-op that returns ok — Claude Code sessions, CI, and a\n     * human at a terminal all pass straight through, which is why this needs no flag and no config key\n     * to sit on the shared path. The cures come from the verdict as `Option`s; this method contributes\n     * the throw and nothing else, so the two halves cannot drift into two different stories.\n     */\n    private assertGuardsRan(repoRoot: string): void {\n        const verdict: GuardPresenceVerdict = this.guardPresence.check(repoRoot);\n        if (verdict.ok) return;\n        throw new RuleFailError(\n            CODEX_GUARDS_NEVER_RAN, verdict.reason, undefined, undefined, [...verdict.cures]);\n    }\n\n    /**\n     * The failure text: this gate's own headline, then the pointer at the log the build already wrote.\n     *\n     * There is no second, streamed variant any more. Capturing used to be behind an EXPERIMENTAL\n     * machine-local opt-in, which meant the refusal an agent read depended on a file almost nobody had —\n     * and the un-captured branch's advice was \"run the build again yourself\", which is the single most\n     * expensive thing an agent can be told. Reading a FILE is now the only answer this gate gives.\n     */\n    private failureText(opts: BuildGateOptions, buildCommand: string, logPath: string): string {\n        return `\\n❌ ${opts.failureHeadline}\\n` +\n            this.buildLog.failureMessage(buildCommand, logPath) +\n            `Fix what that log shows, then re-run ${opts.rerunCommand}.\\n`;\n    }\n}\n"]}

package/src/scripts/workflow/git-findForkPoint.js

@@ -132,7 +132,8 @@ let ForkPoint = class ForkPoint {
         process.stderr.write('\n');
         // The "do NOT `git checkout main`" caveat is scoped to the WORKTREE case, where it is true.
         // Stated unconditionally it forbids a command that is perfectly good in the primary clone —
-        // and that CLAUDE.md's own post-merge cleanup recipe uses — which is how an agent talked
+        // and that `.claude/rules/finishing-a-feature.md`'s own post-merge cleanup recipe uses
+        // — which is how an agent talked
         // itself into believing a new branch was its only exit.
         process.stderr.write('2. Create a new branch OFF origin/main (this form works from ANY tree; inside a\n');
         process.stderr.write('   worktree do NOT `git checkout main` first — it fatals with "main is already\n');

package/src/scripts/workflow/git-findForkPoint.js.map

@@ -1 +1 @@
-{"version":3,"file":"git-findForkPoint.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/git-findForkPoint.ts"],"names":[],"mappings":";;;;AAAA,iDAAoD;AACpD,+CAAyB;AACzB,mDAA6B;AAC7B,0DAAiF;AACjF,yCAA2D;AAC3D,iEAAsD;AACtD,+CAA2C;AAE3C,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,oFAAoF;AAE7E,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACA;IAHrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,UAAsB;QAFtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;IACxC,CAAC;IAEJ,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,oEAAoE;IACpE,kBAAkB,CAAC,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QACtE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,uBAAQ,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,QAAgB;QAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE;gBAAE,OAAO,GAAG,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,CAAC;IACd,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QAChC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAY,CAAC,CAAC,EACpB,qCAAqC;gBACrC,uCAAuC;gBACvC,iCAAiC,CACpC,CAAC;QACN,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,IAAA,wBAAQ,EAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAEpE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QACjE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7C,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEnE,MAAM,WAAW,GAAG,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,IAAA,wBAAQ,EAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAErE,qGAAqG;QACrG,kGAAkG;QAClG,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,2BAAY,CAAC,CAAC,EAAE,wDAAwD,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAEpE,MAAM,kBAAkB,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,SAAS,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5H,MAAM,eAAe,GAAG,CAAC,kBAAkB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAExE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;YAC9B,aAAa,EAAE,SAAS;YACxB,eAAe,EAAE,WAAW;YAC5B,YAAY,EAAE,UAAU;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEZ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;QAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,SAAS,IAAI,MAAM,eAAe,CAAC,CAAC;IAC1F,CAAC;IAEO,iBAAiB,CAAC,YAAsB,EAAE,SAAiB,EAAE,MAAc,EAAE,WAAmB,EAAE,aAAqB;QAC3H,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,YAAY,CAAC,MAAM,gCAAgC,CAAC,CAAC;QAEnF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3G,MAAM,OAAO,GAAG,CAAC,aAAa,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAExE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,aAAa,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC/F,MAAM,YAAY,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAE9F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;wBAC7B,KAAK,EAAE,0BAA0B;wBACjC,WAAW,EAAE,MAAM;wBACnB,cAAc,EAAE,MAAM;wBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACtC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBAEZ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;oBAC1F,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;oBACzE,MAAM,IAAI,2BAAY,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACtE,CAAC;IAEO,uBAAuB,CAAC,MAAc,EAAE,MAAc,EAAE,WAAmB,EAAE,aAAqB;QACtG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACvG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAClG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,4FAA4F;QAC5F,4FAA4F;QAC5F,yFAAyF;QACzF,wDAAwD;QACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC1G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACzG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,WAAW,mBAAmB,CAAC,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC/F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,aAAa,IAAI,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;QAC9G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACnG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC7G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAC3G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4FAA4F,CAAC,CAAC;QACnH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;QACrH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,aAAa,KAAK,CAAC,CAAC;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,aAAa,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACJ,CAAA;AAtKY,8BAAS;oBAAT,SAAS;IADrB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,mCAAY;QACd,wBAAU;GAJlC,SAAS,CAsKrB","sourcesContent":["import { execSync, spawnSync } from 'child_process';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { prDirFor, CliExitError, RepoRootFinder } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from './git-readAiBranchName';\nimport { MergeState } from './merge-state';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/** Computes the 3-point fork point and guards against improper merges-from-main. */\n@injectable(bindingScopeValues.Singleton)\nexport class ForkPoint {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly aiBranchName: AiBranchName,\n        private readonly mergeState: MergeState,\n    ) {}\n\n    // Single source of truth for the per-feature dir fork-point output is written to — the SAME nested\n    // home the readers use (git-gatherInfo / merge-start read updatemain-hashes.json from mergeDirFor;\n    // the review flow reads from prDirFor). Routing the writer through these same helpers is what keeps\n    // them from diverging again — guarded by git-findForkPoint.spec.ts.\n    forkPointOutputDir(repoRoot: string, featureName: string, workflow: string): string {\n        return workflow === 'review' ? prDirFor(repoRoot, featureName) : this.mergeState.mergeDirFor(repoRoot, featureName);\n    }\n\n    /**\n     * The 3-point FORK POINT: where this branch diverged from main. `git merge-base origin/main HEAD`,\n     * falling back to a local `main`, and '' when neither ref resolves.\n     *\n     * Deliberately does NOT fetch. The fork point is ABSOLUTE — advancing main cannot move it, because\n     * merge-base is the most recent common ancestor and main's new commits are not on this branch. (Verified\n     * on this repo: main went f415456 → ba8f674 → 61432d6 while merge-base with one branch stayed f415456\n     * throughout.) So a caller that needs only the fork point — see ChecklistScanner — pays no network cost\n     * and works offline. `findForkPoint` below still fetches, because the MERGE flow additionally needs\n     * main's CURRENT head as hash point C, which genuinely does require a fetch.\n     *\n     * Also writes no files and runs no merge-commit scan, so it cannot throw: `wp-review-upsert-pr` must always\n     * succeed, and a raw merge-from-main is the merge flow's problem to report, not the checklist's.\n     */\n    resolveForkPoint(repoRoot: string): string {\n        for (const ref of ['origin/main', 'main']) {\n            const result = spawnSync('git', ['merge-base', ref, 'HEAD'], { cwd: repoRoot, encoding: 'utf8' });\n            const sha = (result.stdout ?? '').trim();\n            if (result.status === 0 && sha !== '') return sha;\n        }\n        return '';\n    }\n\n    async findForkPoint(workflow: string): Promise<void> {\n        if (workflow !== 'review' && workflow !== 'merge') {\n            throw new CliExitError(1,\n                'ERROR: Workflow argument required\\n' +\n                'Usage: git-findForkPoint <workflow>\\n' +\n                \"  workflow: 'review' or 'merge'\",\n            );\n        }\n\n        const featureName = this.aiBranchName.getFeatureName();\n        const currentBranch = execSync('git branch --show-current', { encoding: 'utf8' }).trim();\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n\n        const outputDir = this.forkPointOutputDir(repoRoot, featureName, workflow);\n        const prefix = workflow === 'review' ? 'review-' : 'updatemain-';\n        fs.mkdirSync(outputDir, { recursive: true });\n\n        spawnSync('git', ['fetch', 'origin', 'main'], { stdio: 'ignore' });\n\n        const featureHead = execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();\n        const originMain = execSync('git rev-parse origin/main', { encoding: 'utf8' }).trim();\n\n        process.stderr.write('Finding fork point using git merge-base...\\n');\n\n        // ONE implementation of the fork-point computation, shared with ChecklistScanner. The fetch above is\n        // what this flow needs beyond it (hash point C = main's current head), not the fork point itself.\n        const forkPoint = this.resolveForkPoint(repoRoot);\n\n        if (!forkPoint) {\n            throw new CliExitError(1, 'ERROR: Could not find common ancestor with origin/main');\n        }\n\n        process.stderr.write(`✅ Fork point found: ${forkPoint.slice(0, 7)}\\n`);\n        process.stderr.write('Checking for improper merges from main...\\n');\n\n        const mergeCommitsResult = spawnSync('git', ['log', `${forkPoint}..HEAD`, '--merges', '--format=%H'], { encoding: 'utf8' });\n        const mergeCommitsRaw = (mergeCommitsResult.stdout ?? '').trim();\n        const mergeCommits = mergeCommitsRaw ? mergeCommitsRaw.split('\\n') : [];\n\n        if (mergeCommits.length > 0) {\n            this.checkMergeCommits(mergeCommits, outputDir, prefix, featureName, currentBranch);\n        } else {\n            process.stderr.write('✅ No merge commits found (clean history)\\n');\n        }\n\n        const hashesJson = JSON.stringify({\n            hashForkPoint: forkPoint,\n            hashFeatureHead: featureHead,\n            hashMainHead: originMain,\n            timestamp: new Date().toISOString(),\n        }, null, 2);\n\n        fs.writeFileSync(path.join(outputDir, `${prefix}hashes.json`), hashesJson + '\\n');\n        process.stderr.write(`✅ Hash points written to: ${outputDir}/${prefix}hashes.json\\n`);\n    }\n\n    private checkMergeCommits(mergeCommits: string[], outputDir: string, prefix: string, featureName: string, currentBranch: string): void {\n        process.stderr.write(`Found ${mergeCommits.length} merge commit(s) to check...\\n`);\n\n        for (const commit of mergeCommits) {\n            const parentsResult = spawnSync('git', ['rev-list', '--parents', '-n', '1', commit], { encoding: 'utf8' });\n            const parents = (parentsResult.stdout ?? '').trim().split(' ').slice(1);\n\n            for (const parent of parents) {\n                const ancestorCheck = spawnSync('git', ['merge-base', '--is-ancestor', parent, 'origin/main']);\n                const reverseCheck = spawnSync('git', ['merge-base', '--is-ancestor', 'origin/main', parent]);\n\n                if (ancestorCheck.status === 0 && reverseCheck.status === 0) {\n                    const errorJson = JSON.stringify({\n                        error: 'Merge from main detected',\n                        mergeCommit: commit,\n                        parentFromMain: parent,\n                        timestamp: new Date().toISOString(),\n                    }, null, 2);\n\n                    fs.writeFileSync(path.join(outputDir, `${prefix}forkpoint-error.json`), errorJson + '\\n');\n                    this.printMergeFromMainError(commit, parent, featureName, currentBranch);\n                    throw new CliExitError(1, '');\n                }\n            }\n        }\n        process.stderr.write('✅ No improper merges from main detected\\n');\n    }\n\n    private printMergeFromMainError(commit: string, parent: string, featureName: string, currentBranch: string): void {\n        process.stderr.write('\\n');\n        process.stderr.write(SEP);\n        process.stderr.write('❌ This branch merged main without the gated update (pnpm wp-start-update, or\\n');\n        process.stderr.write('   pnpm wp-start-upsert-pr when a PR is open)\\n');\n        process.stderr.write(SEP);\n        process.stderr.write('\\n');\n        process.stderr.write(`Merge commit detected: ${commit}\\n`);\n        process.stderr.write(`Parent from main:      ${parent}\\n`);\n        process.stderr.write('\\n');\n        process.stderr.write('This prevents clean squash-merge. To recover, follow these steps:\\n');\n        process.stderr.write('\\n');\n        process.stderr.write('1. Fetch the latest main (works on the primary repo AND in a worktree):\\n');\n        process.stderr.write('   git fetch origin main\\n');\n        process.stderr.write('\\n');\n        // The \"do NOT `git checkout main`\" caveat is scoped to the WORKTREE case, where it is true.\n        // Stated unconditionally it forbids a command that is perfectly good in the primary clone —\n        // and that CLAUDE.md's own post-merge cleanup recipe uses — which is how an agent talked\n        // itself into believing a new branch was its only exit.\n        process.stderr.write('2. Create a new branch OFF origin/main (this form works from ANY tree; inside a\\n');\n        process.stderr.write('   worktree do NOT `git checkout main` first — it fatals with \"main is already\\n');\n        process.stderr.write('   checked out at <primary>\"):\\n');\n        process.stderr.write(`   git checkout -b ${featureName}-v2 origin/main\\n`);\n        process.stderr.write('\\n');\n        process.stderr.write('3. Squash merge your old branch — THIS STEP IS FOR THE HUMAN TO RUN:\\n');\n        process.stderr.write(`   git merge --squash ${currentBranch}\\n`);\n        process.stderr.write('   AI: `git merge` is blocked for you (redirect-how-to-merge-main) and you must NOT\\n');\n        process.stderr.write('   work around it. Ask the human to run that one command, and warn them:\\n');\n        process.stderr.write('   \"This is a raw git merge. It is only correct here because the branch is already\\n');\n        process.stderr.write('    broken and is being rebuilt onto origin/main. For a NORMAL update from main,\\n');\n        process.stderr.write('    push back and tell me to use the gated 3-point merge instead: `pnpm wp-start-update`\\n');\n        process.stderr.write('    (paired with `pnpm wp-finish-update`) when no PR is open, or `pnpm wp-start-upsert-pr`\\n');\n        process.stderr.write('    (paired with `pnpm wp-finish-upsert-pr`) when one is.\"\\n');\n        process.stderr.write('\\n');\n        process.stderr.write('4. Commit the squashed changes:\\n');\n        process.stderr.write(`   git add -A && git commit -m \"Squashed from ${currentBranch}\"\\n`);\n        process.stderr.write('\\n');\n        process.stderr.write('5. If you have an existing PR:\\n');\n        process.stderr.write(`   - Create a NEW PR for ${featureName}-v2\\n`);\n        process.stderr.write(`   - Close the old PR for ${currentBranch}\\n`);\n        process.stderr.write('\\n');\n        process.stderr.write(SEP);\n        process.stderr.write('\\n');\n    }\n}\n"]}
+{"version":3,"file":"git-findForkPoint.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/git-findForkPoint.ts"],"names":[],"mappings":";;;;AAAA,iDAAoD;AACpD,+CAAyB;AACzB,mDAA6B;AAC7B,0DAAiF;AACjF,yCAA2D;AAC3D,iEAAsD;AACtD,+CAA2C;AAE3C,MAAM,GAAG,GAAG,0DAA0D,CAAC;AAEvE,oFAAoF;AAE7E,IAAM,SAAS,GAAf,MAAM,SAAS;IAEG;IACA;IACA;IAHrB,YACqB,cAA8B,EAC9B,YAA0B,EAC1B,UAAsB;QAFtB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;IACxC,CAAC;IAEJ,mGAAmG;IACnG,mGAAmG;IACnG,oGAAoG;IACpG,oEAAoE;IACpE,kBAAkB,CAAC,QAAgB,EAAE,WAAmB,EAAE,QAAgB;QACtE,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,uBAAQ,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,QAAgB;QAC7B,KAAK,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAClG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,KAAK,EAAE;gBAAE,OAAO,GAAG,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,CAAC;IACd,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB;QAChC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChD,MAAM,IAAI,2BAAY,CAAC,CAAC,EACpB,qCAAqC;gBACrC,uCAAuC;gBACvC,iCAAiC,CACpC,CAAC;QACN,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QACvD,MAAM,aAAa,GAAG,IAAA,wBAAQ,EAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzF,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAEpE,MAAM,SAAS,GAAG,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;QACjE,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7C,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAEnE,MAAM,WAAW,GAAG,IAAA,wBAAQ,EAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,MAAM,UAAU,GAAG,IAAA,wBAAQ,EAAC,2BAA2B,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEtF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAErE,qGAAqG;QACrG,kGAAkG;QAClG,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,SAAS,EAAE,CAAC;YACb,MAAM,IAAI,2BAAY,CAAC,CAAC,EAAE,wDAAwD,CAAC,CAAC;QACxF,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAEpE,MAAM,kBAAkB,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,SAAS,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5H,MAAM,eAAe,GAAG,CAAC,kBAAkB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,MAAM,YAAY,GAAG,eAAe,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAExE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,iBAAiB,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACxF,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;YAC9B,aAAa,EAAE,SAAS;YACxB,eAAe,EAAE,WAAW;YAC5B,YAAY,EAAE,UAAU;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEZ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,aAAa,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;QAClF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,SAAS,IAAI,MAAM,eAAe,CAAC,CAAC;IAC1F,CAAC;IAEO,iBAAiB,CAAC,YAAsB,EAAE,SAAiB,EAAE,MAAc,EAAE,WAAmB,EAAE,aAAqB;QAC3H,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,YAAY,CAAC,MAAM,gCAAgC,CAAC,CAAC;QAEnF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3G,MAAM,OAAO,GAAG,CAAC,aAAa,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAExE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,aAAa,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;gBAC/F,MAAM,YAAY,GAAG,IAAA,yBAAS,EAAC,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;gBAE9F,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;wBAC7B,KAAK,EAAE,0BAA0B;wBACjC,WAAW,EAAE,MAAM;wBACnB,cAAc,EAAE,MAAM;wBACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACtC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;oBAEZ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,MAAM,sBAAsB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;oBAC1F,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;oBACzE,MAAM,IAAI,2BAAY,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClC,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;IACtE,CAAC;IAEO,uBAAuB,CAAC,MAAc,EAAE,MAAc,EAAE,WAAmB,EAAE,aAAqB;QACtG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACvG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,MAAM,IAAI,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QAC5F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAClG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,4FAA4F;QAC5F,4FAA4F;QAC5F,uFAAuF;QACvF,iCAAiC;QACjC,wDAAwD;QACxD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC1G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACzG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,WAAW,mBAAmB,CAAC,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;QAC/F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,aAAa,IAAI,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;QAC9G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACnG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC7G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAC3G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4FAA4F,CAAC,CAAC;QACnH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8FAA8F,CAAC,CAAC;QACrH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACrF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,aAAa,KAAK,CAAC,CAAC;QAC1F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,WAAW,OAAO,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,aAAa,IAAI,CAAC,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;CACJ,CAAA;AAvKY,8BAAS;oBAAT,SAAS;IADrB,IAAA,sBAAU,EAAC,8BAAkB,CAAC,SAAS,CAAC;6CAGA,6BAAc;QAChB,mCAAY;QACd,wBAAU;GAJlC,SAAS,CAuKrB","sourcesContent":["import { execSync, spawnSync } from 'child_process';\nimport * as fs from 'fs';\nimport * as path from 'path';\nimport { prDirFor, CliExitError, RepoRootFinder } from '@webpieces/rules-config';\nimport { injectable, bindingScopeValues } from 'inversify';\nimport { AiBranchName } from './git-readAiBranchName';\nimport { MergeState } from './merge-state';\n\nconst SEP = '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n';\n\n/** Computes the 3-point fork point and guards against improper merges-from-main. */\n@injectable(bindingScopeValues.Singleton)\nexport class ForkPoint {\n    constructor(\n        private readonly repoRootFinder: RepoRootFinder,\n        private readonly aiBranchName: AiBranchName,\n        private readonly mergeState: MergeState,\n    ) {}\n\n    // Single source of truth for the per-feature dir fork-point output is written to — the SAME nested\n    // home the readers use (git-gatherInfo / merge-start read updatemain-hashes.json from mergeDirFor;\n    // the review flow reads from prDirFor). Routing the writer through these same helpers is what keeps\n    // them from diverging again — guarded by git-findForkPoint.spec.ts.\n    forkPointOutputDir(repoRoot: string, featureName: string, workflow: string): string {\n        return workflow === 'review' ? prDirFor(repoRoot, featureName) : this.mergeState.mergeDirFor(repoRoot, featureName);\n    }\n\n    /**\n     * The 3-point FORK POINT: where this branch diverged from main. `git merge-base origin/main HEAD`,\n     * falling back to a local `main`, and '' when neither ref resolves.\n     *\n     * Deliberately does NOT fetch. The fork point is ABSOLUTE — advancing main cannot move it, because\n     * merge-base is the most recent common ancestor and main's new commits are not on this branch. (Verified\n     * on this repo: main went f415456 → ba8f674 → 61432d6 while merge-base with one branch stayed f415456\n     * throughout.) So a caller that needs only the fork point — see ChecklistScanner — pays no network cost\n     * and works offline. `findForkPoint` below still fetches, because the MERGE flow additionally needs\n     * main's CURRENT head as hash point C, which genuinely does require a fetch.\n     *\n     * Also writes no files and runs no merge-commit scan, so it cannot throw: `wp-review-upsert-pr` must always\n     * succeed, and a raw merge-from-main is the merge flow's problem to report, not the checklist's.\n     */\n    resolveForkPoint(repoRoot: string): string {\n        for (const ref of ['origin/main', 'main']) {\n            const result = spawnSync('git', ['merge-base', ref, 'HEAD'], { cwd: repoRoot, encoding: 'utf8' });\n            const sha = (result.stdout ?? '').trim();\n            if (result.status === 0 && sha !== '') return sha;\n        }\n        return '';\n    }\n\n    async findForkPoint(workflow: string): Promise<void> {\n        if (workflow !== 'review' && workflow !== 'merge') {\n            throw new CliExitError(1,\n                'ERROR: Workflow argument required\\n' +\n                'Usage: git-findForkPoint <workflow>\\n' +\n                \"  workflow: 'review' or 'merge'\",\n            );\n        }\n\n        const featureName = this.aiBranchName.getFeatureName();\n        const currentBranch = execSync('git branch --show-current', { encoding: 'utf8' }).trim();\n        const repoRoot = this.repoRootFinder.resolveRepoRoot(process.cwd());\n\n        const outputDir = this.forkPointOutputDir(repoRoot, featureName, workflow);\n        const prefix = workflow === 'review' ? 'review-' : 'updatemain-';\n        fs.mkdirSync(outputDir, { recursive: true });\n\n        spawnSync('git', ['fetch', 'origin', 'main'], { stdio: 'ignore' });\n\n        const featureHead = execSync('git rev-parse HEAD', { encoding: 'utf8' }).trim();\n        const originMain = execSync('git rev-parse origin/main', { encoding: 'utf8' }).trim();\n\n        process.stderr.write('Finding fork point using git merge-base...\\n');\n\n        // ONE implementation of the fork-point computation, shared with ChecklistScanner. The fetch above is\n        // what this flow needs beyond it (hash point C = main's current head), not the fork point itself.\n        const forkPoint = this.resolveForkPoint(repoRoot);\n\n        if (!forkPoint) {\n            throw new CliExitError(1, 'ERROR: Could not find common ancestor with origin/main');\n        }\n\n        process.stderr.write(`✅ Fork point found: ${forkPoint.slice(0, 7)}\\n`);\n        process.stderr.write('Checking for improper merges from main...\\n');\n\n        const mergeCommitsResult = spawnSync('git', ['log', `${forkPoint}..HEAD`, '--merges', '--format=%H'], { encoding: 'utf8' });\n        const mergeCommitsRaw = (mergeCommitsResult.stdout ?? '').trim();\n        const mergeCommits = mergeCommitsRaw ? mergeCommitsRaw.split('\\n') : [];\n\n        if (mergeCommits.length > 0) {\n            this.checkMergeCommits(mergeCommits, outputDir, prefix, featureName, currentBranch);\n        } else {\n            process.stderr.write('✅ No merge commits found (clean history)\\n');\n        }\n\n        const hashesJson = JSON.stringify({\n            hashForkPoint: forkPoint,\n            hashFeatureHead: featureHead,\n            hashMainHead: originMain,\n            timestamp: new Date().toISOString(),\n        }, null, 2);\n\n        fs.writeFileSync(path.join(outputDir, `${prefix}hashes.json`), hashesJson + '\\n');\n        process.stderr.write(`✅ Hash points written to: ${outputDir}/${prefix}hashes.json\\n`);\n    }\n\n    private checkMergeCommits(mergeCommits: string[], outputDir: string, prefix: string, featureName: string, currentBranch: string): void {\n        process.stderr.write(`Found ${mergeCommits.length} merge commit(s) to check...\\n`);\n\n        for (const commit of mergeCommits) {\n            const parentsResult = spawnSync('git', ['rev-list', '--parents', '-n', '1', commit], { encoding: 'utf8' });\n            const parents = (parentsResult.stdout ?? '').trim().split(' ').slice(1);\n\n            for (const parent of parents) {\n                const ancestorCheck = spawnSync('git', ['merge-base', '--is-ancestor', parent, 'origin/main']);\n                const reverseCheck = spawnSync('git', ['merge-base', '--is-ancestor', 'origin/main', parent]);\n\n                if (ancestorCheck.status === 0 && reverseCheck.status === 0) {\n                    const errorJson = JSON.stringify({\n                        error: 'Merge from main detected',\n                        mergeCommit: commit,\n                        parentFromMain: parent,\n                        timestamp: new Date().toISOString(),\n                    }, null, 2);\n\n                    fs.writeFileSync(path.join(outputDir, `${prefix}forkpoint-error.json`), errorJson + '\\n');\n                    this.printMergeFromMainError(commit, parent, featureName, currentBranch);\n                    throw new CliExitError(1, '');\n                }\n            }\n        }\n        process.stderr.write('✅ No improper merges from main detected\\n');\n    }\n\n    private printMergeFromMainError(commit: string, parent: string, featureName: string, currentBranch: string): void {\n        process.stderr.write('\\n');\n        process.stderr.write(SEP);\n        process.stderr.write('❌ This branch merged main without the gated update (pnpm wp-start-update, or\\n');\n        process.stderr.write('   pnpm wp-start-upsert-pr when a PR is open)\\n');\n        process.stderr.write(SEP);\n        process.stderr.write('\\n');\n        process.stderr.write(`Merge commit detected: ${commit}\\n`);\n        process.stderr.write(`Parent from main:      ${parent}\\n`);\n        process.stderr.write('\\n');\n        process.stderr.write('This prevents clean squash-merge. To recover, follow these steps:\\n');\n        process.stderr.write('\\n');\n        process.stderr.write('1. Fetch the latest main (works on the primary repo AND in a worktree):\\n');\n        process.stderr.write('   git fetch origin main\\n');\n        process.stderr.write('\\n');\n        // The \"do NOT `git checkout main`\" caveat is scoped to the WORKTREE case, where it is true.\n        // Stated unconditionally it forbids a command that is perfectly good in the primary clone —\n        // and that `.claude/rules/finishing-a-feature.md`'s own post-merge cleanup recipe uses\n        // — which is how an agent talked\n        // itself into believing a new branch was its only exit.\n        process.stderr.write('2. Create a new branch OFF origin/main (this form works from ANY tree; inside a\\n');\n        process.stderr.write('   worktree do NOT `git checkout main` first — it fatals with \"main is already\\n');\n        process.stderr.write('   checked out at <primary>\"):\\n');\n        process.stderr.write(`   git checkout -b ${featureName}-v2 origin/main\\n`);\n        process.stderr.write('\\n');\n        process.stderr.write('3. Squash merge your old branch — THIS STEP IS FOR THE HUMAN TO RUN:\\n');\n        process.stderr.write(`   git merge --squash ${currentBranch}\\n`);\n        process.stderr.write('   AI: `git merge` is blocked for you (redirect-how-to-merge-main) and you must NOT\\n');\n        process.stderr.write('   work around it. Ask the human to run that one command, and warn them:\\n');\n        process.stderr.write('   \"This is a raw git merge. It is only correct here because the branch is already\\n');\n        process.stderr.write('    broken and is being rebuilt onto origin/main. For a NORMAL update from main,\\n');\n        process.stderr.write('    push back and tell me to use the gated 3-point merge instead: `pnpm wp-start-update`\\n');\n        process.stderr.write('    (paired with `pnpm wp-finish-update`) when no PR is open, or `pnpm wp-start-upsert-pr`\\n');\n        process.stderr.write('    (paired with `pnpm wp-finish-upsert-pr`) when one is.\"\\n');\n        process.stderr.write('\\n');\n        process.stderr.write('4. Commit the squashed changes:\\n');\n        process.stderr.write(`   git add -A && git commit -m \"Squashed from ${currentBranch}\"\\n`);\n        process.stderr.write('\\n');\n        process.stderr.write('5. If you have an existing PR:\\n');\n        process.stderr.write(`   - Create a NEW PR for ${featureName}-v2\\n`);\n        process.stderr.write(`   - Close the old PR for ${currentBranch}\\n`);\n        process.stderr.write('\\n');\n        process.stderr.write(SEP);\n        process.stderr.write('\\n');\n    }\n}\n"]}

package/src/scripts/workflow/repo-config-testkit.d.ts

@@ -9,8 +9,9 @@
  *  1. `checklists` is dropped. Its `doc` paths are validated REPO-RELATIVE and point at
  *     `.claude/review/*.md`, which exist here and not in a temp clone.
  *  2. Every locally-known rule with no entry is SEEDED. The repo's config is validated by the PUBLISHED
- *     validator and therefore lags local source by one release (CLAUDE.md, "Published vs local
- *     source"): a rule added in this working tree cannot get a config entry until its release ships,
+ *     validator and therefore lags local source by one release
+ *     (`.claude/rules/published-vs-local-source.md`): a rule added in this working tree cannot get a
+ *     config entry until its release ships,
  *     while the LOCAL validator a spec runs already demands one. Without this, adding any rule turns
  *     these specs red for exactly one release — a failure that says nothing about the code under test.
  *  3. Every RETIRED rule entry is dropped — the same one-release lag pointing the other way. When a rule

package/src/scripts/workflow/repo-config-testkit.js

@@ -16,8 +16,9 @@ const rules_config_1 = require("@webpieces/rules-config");
  *  1. `checklists` is dropped. Its `doc` paths are validated REPO-RELATIVE and point at
  *     `.claude/review/*.md`, which exist here and not in a temp clone.
  *  2. Every locally-known rule with no entry is SEEDED. The repo's config is validated by the PUBLISHED
- *     validator and therefore lags local source by one release (CLAUDE.md, "Published vs local
- *     source"): a rule added in this working tree cannot get a config entry until its release ships,
+ *     validator and therefore lags local source by one release
+ *     (`.claude/rules/published-vs-local-source.md`): a rule added in this working tree cannot get a
+ *     config entry until its release ships,
  *     while the LOCAL validator a spec runs already demands one. Without this, adding any rule turns
  *     these specs red for exactly one release — a failure that says nothing about the code under test.
  *  3. Every RETIRED rule entry is dropped — the same one-release lag pointing the other way. When a rule

package/src/scripts/workflow/repo-config-testkit.js.map

@@ -1 +1 @@
-{"version":3,"file":"repo-config-testkit.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/repo-config-testkit.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,0DAAyG;AAEzG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAa,iBAAiB;IAC1B,0FAA0F;IAC1F,mGAAmG;IACnG,IAAI;QACA,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QACjG,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAA4B,CAAC;QACtF,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAA4C,CAAC;QAC/E,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,8FAA8F;IAC9F,iDAAiD;IACzC,gBAAgB,CAAC,MAA+B;QACpD,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5C,iEAAiE;YACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAwC,CAAC;YACvE,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,IAAI,IAAA,6BAAc,EAAC,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,CAAC;QACL,CAAC;IACL,CAAC;IAED,2FAA2F;IAC3F,iDAAiD;IACjD,OAAO,CAAC,GAAW,EAAE,MAA+B;QAChD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,iDAAiD;IACzC,gBAAgB,CAAC,MAA+B;QACpD,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAA4B,CAAC;QACzD,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAA4B,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,IAAA,2BAAY,GAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;CACJ;AA9CD,8CA8CC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { allRuleNames, retiredRuleFor, sectionForRule, seedEntryForRule } from '@webpieces/rules-config';\n\n/**\n * THIS repo's own `webpieces.config.json`, prepared for use inside a temp clone.\n *\n * Specs that exercise a command end-to-end need a config the REAL validator accepts, and using the\n * repo's own file (rather than a hand-rolled minimal one) is what keeps them honest — a stub drifts out\n * from under the validator on the next config change. Two adjustments are needed to make that file\n * usable outside this checkout, and both are the same for every such spec, so they live here once:\n *\n *  1. `checklists` is dropped. Its `doc` paths are validated REPO-RELATIVE and point at\n *     `.claude/review/*.md`, which exist here and not in a temp clone.\n *  2. Every locally-known rule with no entry is SEEDED. The repo's config is validated by the PUBLISHED\n *     validator and therefore lags local source by one release (CLAUDE.md, \"Published vs local\n *     source\"): a rule added in this working tree cannot get a config entry until its release ships,\n *     while the LOCAL validator a spec runs already demands one. Without this, adding any rule turns\n *     these specs red for exactly one release — a failure that says nothing about the code under test.\n *  3. Every RETIRED rule entry is dropped — the same one-release lag pointing the other way. When a rule\n *     is retired in this working tree, the repo's config must KEEP its entry until the release carrying\n *     the retirement ships (deleting it early would fail the published validator and block every Bash\n *     call), while the LOCAL validator already REJECTS it. Same trade as (2), same fix.\n *\n * A testkit, not product code: nothing in a published bin imports it (same role as ai-hook-rules'\n * `shim-testkit.ts`).\n */\nexport class RepoConfigFixture {\n    /** The repo's config as a mutable object, checklists dropped and missing rules seeded. */\n    // webpieces-disable no-any-unknown -- the repo's own config document, opaque until a spec edits it\n    load(): Record<string, unknown> {\n        const source = path.join(__dirname, '..', '..', '..', '..', '..', '..', 'webpieces.config.json');\n        // webpieces-disable no-any-unknown -- parsed JSON, narrowed by the accessors below\n        const config = JSON.parse(fs.readFileSync(source, 'utf8')) as Record<string, unknown>;\n        // webpieces-disable no-any-unknown -- narrowing one nested section\n        const commands = config['commands'] as Record<string, Record<string, unknown>>;\n        delete commands['pr-gate']['checklists'];\n        delete commands['pr-gate']['checklistsWhy'];\n        this.dropRetiredRules(config);\n        this.seedMissingRules(config);\n        return config;\n    }\n\n    // Drop every rule/guard name this build knows to be RETIRED, from whichever section holds it.\n    // webpieces-disable no-any-unknown -- see load()\n    private dropRetiredRules(config: Record<string, unknown>): void {\n        for (const section of ['rules', 'hookGuards']) {\n            // webpieces-disable no-any-unknown -- narrowing one rule section\n            const entries = config[section] as Record<string, unknown> | undefined;\n            if (entries === undefined) continue;\n            for (const name of Object.keys(entries)) {\n                if (retiredRuleFor(name) !== null) delete entries[name];\n            }\n        }\n    }\n\n    /** Write `config` (usually a `load()` result a spec has edited) as the config of `dir`. */\n    // webpieces-disable no-any-unknown -- see load()\n    writeTo(dir: string, config: Record<string, unknown>): void {\n        fs.writeFileSync(path.join(dir, 'webpieces.config.json'), JSON.stringify(config, null, 4) + '\\n');\n    }\n\n    // webpieces-disable no-any-unknown -- see load()\n    private seedMissingRules(config: Record<string, unknown>): void {\n        // webpieces-disable no-any-unknown -- narrowing the two rule sections\n        const rules = config['rules'] as Record<string, unknown>;\n        // webpieces-disable no-any-unknown -- narrowing the two rule sections\n        const guards = config['hookGuards'] as Record<string, unknown>;\n        for (const name of allRuleNames()) {\n            const section = sectionForRule(name) === 'hookGuards' ? guards : rules;\n            if (!(name in section)) section[name] = seedEntryForRule(name);\n        }\n    }\n}\n"]}
+{"version":3,"file":"repo-config-testkit.js","sourceRoot":"","sources":["../../../../../../../packages/tooling/pr-gate/src/scripts/workflow/repo-config-testkit.ts"],"names":[],"mappings":";;;;AAAA,+CAAyB;AACzB,mDAA6B;AAE7B,0DAAyG;AAEzG;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAa,iBAAiB;IAC1B,0FAA0F;IAC1F,mGAAmG;IACnG,IAAI;QACA,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;QACjG,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAA4B,CAAC;QACtF,mEAAmE;QACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAA4C,CAAC;QAC/E,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC;QACzC,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,8FAA8F;IAC9F,iDAAiD;IACzC,gBAAgB,CAAC,MAA+B;QACpD,KAAK,MAAM,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5C,iEAAiE;YACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAwC,CAAC;YACvE,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS;YACpC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtC,IAAI,IAAA,6BAAc,EAAC,IAAI,CAAC,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5D,CAAC;QACL,CAAC;IACL,CAAC;IAED,2FAA2F;IAC3F,iDAAiD;IACjD,OAAO,CAAC,GAAW,EAAE,MAA+B;QAChD,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtG,CAAC;IAED,iDAAiD;IACzC,gBAAgB,CAAC,MAA+B;QACpD,sEAAsE;QACtE,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAA4B,CAAC;QACzD,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAA4B,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,IAAA,2BAAY,GAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAA,6BAAc,EAAC,IAAI,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACvE,IAAI,CAAC,CAAC,IAAI,IAAI,OAAO,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAA,+BAAgB,EAAC,IAAI,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;CACJ;AA9CD,8CA8CC","sourcesContent":["import * as fs from 'fs';\nimport * as path from 'path';\n\nimport { allRuleNames, retiredRuleFor, sectionForRule, seedEntryForRule } from '@webpieces/rules-config';\n\n/**\n * THIS repo's own `webpieces.config.json`, prepared for use inside a temp clone.\n *\n * Specs that exercise a command end-to-end need a config the REAL validator accepts, and using the\n * repo's own file (rather than a hand-rolled minimal one) is what keeps them honest — a stub drifts out\n * from under the validator on the next config change. Two adjustments are needed to make that file\n * usable outside this checkout, and both are the same for every such spec, so they live here once:\n *\n *  1. `checklists` is dropped. Its `doc` paths are validated REPO-RELATIVE and point at\n *     `.claude/review/*.md`, which exist here and not in a temp clone.\n *  2. Every locally-known rule with no entry is SEEDED. The repo's config is validated by the PUBLISHED\n *     validator and therefore lags local source by one release\n *     (`.claude/rules/published-vs-local-source.md`): a rule added in this working tree cannot get a\n *     config entry until its release ships,\n *     while the LOCAL validator a spec runs already demands one. Without this, adding any rule turns\n *     these specs red for exactly one release — a failure that says nothing about the code under test.\n *  3. Every RETIRED rule entry is dropped — the same one-release lag pointing the other way. When a rule\n *     is retired in this working tree, the repo's config must KEEP its entry until the release carrying\n *     the retirement ships (deleting it early would fail the published validator and block every Bash\n *     call), while the LOCAL validator already REJECTS it. Same trade as (2), same fix.\n *\n * A testkit, not product code: nothing in a published bin imports it (same role as ai-hook-rules'\n * `shim-testkit.ts`).\n */\nexport class RepoConfigFixture {\n    /** The repo's config as a mutable object, checklists dropped and missing rules seeded. */\n    // webpieces-disable no-any-unknown -- the repo's own config document, opaque until a spec edits it\n    load(): Record<string, unknown> {\n        const source = path.join(__dirname, '..', '..', '..', '..', '..', '..', 'webpieces.config.json');\n        // webpieces-disable no-any-unknown -- parsed JSON, narrowed by the accessors below\n        const config = JSON.parse(fs.readFileSync(source, 'utf8')) as Record<string, unknown>;\n        // webpieces-disable no-any-unknown -- narrowing one nested section\n        const commands = config['commands'] as Record<string, Record<string, unknown>>;\n        delete commands['pr-gate']['checklists'];\n        delete commands['pr-gate']['checklistsWhy'];\n        this.dropRetiredRules(config);\n        this.seedMissingRules(config);\n        return config;\n    }\n\n    // Drop every rule/guard name this build knows to be RETIRED, from whichever section holds it.\n    // webpieces-disable no-any-unknown -- see load()\n    private dropRetiredRules(config: Record<string, unknown>): void {\n        for (const section of ['rules', 'hookGuards']) {\n            // webpieces-disable no-any-unknown -- narrowing one rule section\n            const entries = config[section] as Record<string, unknown> | undefined;\n            if (entries === undefined) continue;\n            for (const name of Object.keys(entries)) {\n                if (retiredRuleFor(name) !== null) delete entries[name];\n            }\n        }\n    }\n\n    /** Write `config` (usually a `load()` result a spec has edited) as the config of `dir`. */\n    // webpieces-disable no-any-unknown -- see load()\n    writeTo(dir: string, config: Record<string, unknown>): void {\n        fs.writeFileSync(path.join(dir, 'webpieces.config.json'), JSON.stringify(config, null, 4) + '\\n');\n    }\n\n    // webpieces-disable no-any-unknown -- see load()\n    private seedMissingRules(config: Record<string, unknown>): void {\n        // webpieces-disable no-any-unknown -- narrowing the two rule sections\n        const rules = config['rules'] as Record<string, unknown>;\n        // webpieces-disable no-any-unknown -- narrowing the two rule sections\n        const guards = config['hookGuards'] as Record<string, unknown>;\n        for (const name of allRuleNames()) {\n            const section = sectionForRule(name) === 'hookGuards' ? guards : rules;\n            if (!(name in section)) section[name] = seedEntryForRule(name);\n        }\n    }\n}\n"]}