@webpieces/rules-config 0.4.540 → 0.4.541

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/rules-config",
-  "version": "0.4.540",
+  "version": "0.4.541",
   "description": "Shared webpieces.config.json loader. Single source of truth for validation rule configuration consumed by @webpieces/ai-hook-rules, @webpieces/code-rules, and @webpieces/nx-webpieces-rules.",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/main-sync-guard-configs.js

@@ -77,6 +77,11 @@ exports.MergedBranchBashGuardConfig = MergedBranchBashGuardConfig;
 // METADATA stay open, and only CONTENT reads of workspace files are blocked. Shares the same
 // precomputed cache (main-sync-status.json → localMain vs originMain) the file guards read;
 // hangTimeoutMinutes tunes the detached refresher's stale-lock reclaim window, as on those guards.
+//
+// It also carries the PREVENTIVE half of the same protection — blocking a bare `git checkout main`
+// unless the pull rides along in the same command — under this one key rather than a second guard,
+// because it is the same failure being stopped one step earlier and one on/off switch should govern
+// both. That half needs no cache and no timeout, so the config shape is unchanged.
 class StaleMainBashGuardConfig extends rule_configs_1.BaseRuleConfig {
     hangTimeoutMinutes;
     static SCHEMA = {

package/src/main-sync-guard-configs.js.map

@@ -1 +1 @@
-{"version":3,"file":"main-sync-guard-configs.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/main-sync-guard-configs.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AACpD,iDAA2F;AAE3F;;;;;;;;;;;;GAYG;AAEH,+FAA+F;AAC/F,mFAAmF;AACnF,iFAAiF;AACjF,oFAAoF;AACpF,4EAA4E;AAC5E,mGAAmG;AACnG,yCAAyC;AACzC,MAAa,wBAAyB,SAAQ,6BAAc;IAExD,sBAAsB,CAAU;IAChC,kBAAkB,CAAU;IAE5B,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAY,CAAC;QAC1C,sBAAsB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnD,kBAAkB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,GAAG,+BAAgB;KACtB,CAAC;;AAVN,4DAWC;AAED,sGAAsG;AACtG,oGAAoG;AACpG,oGAAoG;AACpG,uGAAuG;AACvG,4FAA4F;AAC5F,sGAAsG;AACtG,qFAAqF;AACrF,wDAAwD;AACxD,MAAa,oBAAqB,SAAQ,6BAAc;IAEpD,kBAAkB,CAAU;IAE5B,MAAM,CAAU,MAAM,GAAsC;QACxD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAY,CAAC;QAC1C,kBAAkB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,GAAG,+BAAgB;KACtB,CAAC;;AARN,oDASC;AAED,iGAAiG;AACjG,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,6FAA6F;AAC7F,4FAA4F;AAC5F,mGAAmG;AACnG,MAAa,2BAA4B,SAAQ,6BAAc;IAE3D,kBAAkB,CAAU;IAE5B,MAAM,CAAU,MAAM,GAA6C;QAC/D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAY,CAAC;QAC1C,kBAAkB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,GAAG,+BAAgB;KACtB,CAAC;;AARN,kEASC;AAED,iGAAiG;AACjG,qGAAqG;AACrG,oGAAoG;AACpG,8FAA8F;AAC9F,uGAAuG;AACvG,gGAAgG;AAChG,6FAA6F;AAC7F,4FAA4F;AAC5F,mGAAmG;AACnG,MAAa,wBAAyB,SAAQ,6BAAc;IAExD,kBAAkB,CAAU;IAE5B,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAY,CAAC;QAC1C,kBAAkB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,GAAG,+BAAgB;KACtB,CAAC;;AARN,4DASC","sourcesContent":["import { FieldDef, SchemaShape } from './field-def';\nimport { BaseRuleConfig, BASE_RULE_SCHEMA, OnOffMode, ON_OFF_MODES } from './rule-configs';\n\n/**\n * The four guards driven by the SHARED main-sync cache (`.webpieces/main-sync-status.json`, written\n * by the detached refresher): two file-scoped and two bash-scoped, covering the same two states.\n *\n *                     | on stale `main` (state A)  | on an already-merged branch (state B)\n *   Write/Edit        | feature-branch-guard       | feature-branch-guard\n *   Read              | read-stale-guard           | read-stale-guard\n *   Bash              | stale-main-bash-guard      | merged-branch-bash-guard\n *\n * They live together, apart from the code-rule configs, because they share that cache, the\n * `hangTimeoutMinutes` knob that tunes its refresher, and the fail-open discipline that goes with\n * acting on asynchronously-computed data.\n */\n\n// Comprehensive \"are you on a proper feature branch?\" guard. Replaces the old no-edit-on-main:\n//  - on main (synchronous check)                  → block, create a feature branch\n//  - branch already merged into main (merged PR)  → block, branch off fresh main\n//  - no fork point with origin/main               → block, squash onto a new branch\n//  - origin/main moved & touches your files       → block, merge main first\n// branchNamingConvention is surfaced in the on-main message; hangTimeoutMinutes tunes the detached\n// refresher's stale-lock reclaim window.\nexport class FeatureBranchGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n    branchNamingConvention?: string;\n    hangTimeoutMinutes?: number;\n\n    static readonly SCHEMA: SchemaShape<FeatureBranchGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        branchNamingConvention: FieldDef.optional('string'),\n        hangTimeoutMinutes: FieldDef.optional('number'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Blocks Read while the checked-out branch is stale to read FROM — either main is behind origin/main,\n// or the feature branch's PR is already merged (a pre-merge snapshot). Both mean the AI reads stale\n// FILES, which is the actual damage. Deliberately scoped to Read only: every cure (`git pull origin\n// main`, `git checkout -b <new> origin/main`, `pnpm install`, any upgrade) is a Bash command, and Bash\n// is never touched by this guard, so there is no allowlist to maintain and no way to wedge.\n// (Named main-stale-guard through 0.4.x; the old config key still loads via DEPRECATED_RULE_ALIASES.)\n// hangTimeoutMinutes tunes the detached refresher's stale-lock reclaim window (as on\n// feature-branch-guard, whose cache this guard shares).\nexport class ReadStaleGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n    hangTimeoutMinutes?: number;\n\n    static readonly SCHEMA: SchemaShape<ReadStaleGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        hangTimeoutMinutes: FieldDef.optional('number'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// The BASH-side half of the merged-branch protection. feature-branch-guard blocks Write/Edit and\n// read-stale-guard blocks the Read tool when the checked-out branch's PR is already merged — but\n// NOTHING blocked ordinary Bash, so an agent that only ran shell (booting servers, `cat`-ing files,\n// git) sailed through a whole session on a merged branch (the incident this guard closes). It is a\n// bash-scope hookGuard that DEFAULT-DENIES Bash on a merged branch, allowlisting only the recovery /\n// cleanup / read-only-inspection commands that get the agent OFF the branch. Shares the same\n// precomputed cache (main-sync-status.json / branchAlreadyMerged) the two file guards read.\n// hangTimeoutMinutes tunes the detached refresher's stale-lock reclaim window, as on those guards.\nexport class MergedBranchBashGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n    hangTimeoutMinutes?: number;\n\n    static readonly SCHEMA: SchemaShape<MergedBranchBashGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        hangTimeoutMinutes: FieldDef.optional('number'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// The BASH-side half of the STALE-MAIN protection (read-stale-guard's State A). read-stale-guard\n// blocks the Read tool when local main is behind origin/main, but deliberately never looks at Bash —\n// so `cat`/`grep`/`ls` walked the same stale tree through the side door, for a whole session, while\n// the logs read \"handled\" (the incident this guard closes: a main 18 commits behind, an agent\n// describing a workflow set missing a workflow that existed upstream). Unlike merged-branch-bash-guard\n// this one does NOT default-deny Bash: builds, tests, installs, the `git pull` cure and all git\n// METADATA stay open, and only CONTENT reads of workspace files are blocked. Shares the same\n// precomputed cache (main-sync-status.json → localMain vs originMain) the file guards read;\n// hangTimeoutMinutes tunes the detached refresher's stale-lock reclaim window, as on those guards.\nexport class StaleMainBashGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n    hangTimeoutMinutes?: number;\n\n    static readonly SCHEMA: SchemaShape<StaleMainBashGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        hangTimeoutMinutes: FieldDef.optional('number'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}
+{"version":3,"file":"main-sync-guard-configs.js","sourceRoot":"","sources":["../../../../../packages/tooling/rules-config/src/main-sync-guard-configs.ts"],"names":[],"mappings":";;;AAAA,2CAAoD;AACpD,iDAA2F;AAE3F;;;;;;;;;;;;GAYG;AAEH,+FAA+F;AAC/F,mFAAmF;AACnF,iFAAiF;AACjF,oFAAoF;AACpF,4EAA4E;AAC5E,mGAAmG;AACnG,yCAAyC;AACzC,MAAa,wBAAyB,SAAQ,6BAAc;IAExD,sBAAsB,CAAU;IAChC,kBAAkB,CAAU;IAE5B,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAY,CAAC;QAC1C,sBAAsB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnD,kBAAkB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,GAAG,+BAAgB;KACtB,CAAC;;AAVN,4DAWC;AAED,sGAAsG;AACtG,oGAAoG;AACpG,oGAAoG;AACpG,uGAAuG;AACvG,4FAA4F;AAC5F,sGAAsG;AACtG,qFAAqF;AACrF,wDAAwD;AACxD,MAAa,oBAAqB,SAAQ,6BAAc;IAEpD,kBAAkB,CAAU;IAE5B,MAAM,CAAU,MAAM,GAAsC;QACxD,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAY,CAAC;QAC1C,kBAAkB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,GAAG,+BAAgB;KACtB,CAAC;;AARN,oDASC;AAED,iGAAiG;AACjG,iGAAiG;AACjG,oGAAoG;AACpG,mGAAmG;AACnG,qGAAqG;AACrG,6FAA6F;AAC7F,4FAA4F;AAC5F,mGAAmG;AACnG,MAAa,2BAA4B,SAAQ,6BAAc;IAE3D,kBAAkB,CAAU;IAE5B,MAAM,CAAU,MAAM,GAA6C;QAC/D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAY,CAAC;QAC1C,kBAAkB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,GAAG,+BAAgB;KACtB,CAAC;;AARN,kEASC;AAED,iGAAiG;AACjG,qGAAqG;AACrG,oGAAoG;AACpG,8FAA8F;AAC9F,uGAAuG;AACvG,gGAAgG;AAChG,6FAA6F;AAC7F,4FAA4F;AAC5F,mGAAmG;AACnG,EAAE;AACF,mGAAmG;AACnG,mGAAmG;AACnG,oGAAoG;AACpG,mFAAmF;AACnF,MAAa,wBAAyB,SAAQ,6BAAc;IAExD,kBAAkB,CAAU;IAE5B,MAAM,CAAU,MAAM,GAA0C;QAC5D,IAAI,EAAE,IAAI,oBAAQ,CAAC,QAAQ,EAAE,2BAAY,CAAC;QAC1C,kBAAkB,EAAE,oBAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC/C,GAAG,+BAAgB;KACtB,CAAC;;AARN,4DASC","sourcesContent":["import { FieldDef, SchemaShape } from './field-def';\nimport { BaseRuleConfig, BASE_RULE_SCHEMA, OnOffMode, ON_OFF_MODES } from './rule-configs';\n\n/**\n * The four guards driven by the SHARED main-sync cache (`.webpieces/main-sync-status.json`, written\n * by the detached refresher): two file-scoped and two bash-scoped, covering the same two states.\n *\n *                     | on stale `main` (state A)  | on an already-merged branch (state B)\n *   Write/Edit        | feature-branch-guard       | feature-branch-guard\n *   Read              | read-stale-guard           | read-stale-guard\n *   Bash              | stale-main-bash-guard      | merged-branch-bash-guard\n *\n * They live together, apart from the code-rule configs, because they share that cache, the\n * `hangTimeoutMinutes` knob that tunes its refresher, and the fail-open discipline that goes with\n * acting on asynchronously-computed data.\n */\n\n// Comprehensive \"are you on a proper feature branch?\" guard. Replaces the old no-edit-on-main:\n//  - on main (synchronous check)                  → block, create a feature branch\n//  - branch already merged into main (merged PR)  → block, branch off fresh main\n//  - no fork point with origin/main               → block, squash onto a new branch\n//  - origin/main moved & touches your files       → block, merge main first\n// branchNamingConvention is surfaced in the on-main message; hangTimeoutMinutes tunes the detached\n// refresher's stale-lock reclaim window.\nexport class FeatureBranchGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n    branchNamingConvention?: string;\n    hangTimeoutMinutes?: number;\n\n    static readonly SCHEMA: SchemaShape<FeatureBranchGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        branchNamingConvention: FieldDef.optional('string'),\n        hangTimeoutMinutes: FieldDef.optional('number'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// Blocks Read while the checked-out branch is stale to read FROM — either main is behind origin/main,\n// or the feature branch's PR is already merged (a pre-merge snapshot). Both mean the AI reads stale\n// FILES, which is the actual damage. Deliberately scoped to Read only: every cure (`git pull origin\n// main`, `git checkout -b <new> origin/main`, `pnpm install`, any upgrade) is a Bash command, and Bash\n// is never touched by this guard, so there is no allowlist to maintain and no way to wedge.\n// (Named main-stale-guard through 0.4.x; the old config key still loads via DEPRECATED_RULE_ALIASES.)\n// hangTimeoutMinutes tunes the detached refresher's stale-lock reclaim window (as on\n// feature-branch-guard, whose cache this guard shares).\nexport class ReadStaleGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n    hangTimeoutMinutes?: number;\n\n    static readonly SCHEMA: SchemaShape<ReadStaleGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        hangTimeoutMinutes: FieldDef.optional('number'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// The BASH-side half of the merged-branch protection. feature-branch-guard blocks Write/Edit and\n// read-stale-guard blocks the Read tool when the checked-out branch's PR is already merged — but\n// NOTHING blocked ordinary Bash, so an agent that only ran shell (booting servers, `cat`-ing files,\n// git) sailed through a whole session on a merged branch (the incident this guard closes). It is a\n// bash-scope hookGuard that DEFAULT-DENIES Bash on a merged branch, allowlisting only the recovery /\n// cleanup / read-only-inspection commands that get the agent OFF the branch. Shares the same\n// precomputed cache (main-sync-status.json / branchAlreadyMerged) the two file guards read.\n// hangTimeoutMinutes tunes the detached refresher's stale-lock reclaim window, as on those guards.\nexport class MergedBranchBashGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n    hangTimeoutMinutes?: number;\n\n    static readonly SCHEMA: SchemaShape<MergedBranchBashGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        hangTimeoutMinutes: FieldDef.optional('number'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n\n// The BASH-side half of the STALE-MAIN protection (read-stale-guard's State A). read-stale-guard\n// blocks the Read tool when local main is behind origin/main, but deliberately never looks at Bash —\n// so `cat`/`grep`/`ls` walked the same stale tree through the side door, for a whole session, while\n// the logs read \"handled\" (the incident this guard closes: a main 18 commits behind, an agent\n// describing a workflow set missing a workflow that existed upstream). Unlike merged-branch-bash-guard\n// this one does NOT default-deny Bash: builds, tests, installs, the `git pull` cure and all git\n// METADATA stay open, and only CONTENT reads of workspace files are blocked. Shares the same\n// precomputed cache (main-sync-status.json → localMain vs originMain) the file guards read;\n// hangTimeoutMinutes tunes the detached refresher's stale-lock reclaim window, as on those guards.\n//\n// It also carries the PREVENTIVE half of the same protection — blocking a bare `git checkout main`\n// unless the pull rides along in the same command — under this one key rather than a second guard,\n// because it is the same failure being stopped one step earlier and one on/off switch should govern\n// both. That half needs no cache and no timeout, so the config shape is unchanged.\nexport class StaleMainBashGuardConfig extends BaseRuleConfig {\n    declare mode?: OnOffMode;\n    hangTimeoutMinutes?: number;\n\n    static readonly SCHEMA: SchemaShape<StaleMainBashGuardConfig> = {\n        mode: new FieldDef('string', ON_OFF_MODES),\n        hangTimeoutMinutes: FieldDef.optional('number'),\n        ...BASE_RULE_SCHEMA,\n    };\n}\n"]}