@whitehatd/crag 0.2.5 → 0.2.6

package/README.md

@@ -199,21 +199,20 @@ crag version / crag help
 The only file you maintain. 20–30 lines. Everything else is universal or generated.
 
 ```markdown
-# Governance — StructuAI
+# Governance — example-app
 
 ## Identity
-- Project: StructuAI
-- Description: AI-powered Minecraft schematic describer
+- Project: example-app
+- Description: Example project using crag
 
 ## Gates (run in order, stop on failure)
-### Frontend (path: frontend/)
-- npx eslint frontend/ --max-warnings 0
-- cd frontend && npx vite build
+### Frontend (path: web/)
+- npx eslint web/ --max-warnings 0
+- cd web && npx vite build
 
 ### Backend
-- node --check scripts/api-server.js
-- cargo clippy --manifest-path source/decode/Cargo.toml
-- cargo test --manifest-path source/decode/Cargo.toml
+- cargo clippy --all-targets -- -D warnings
+- cargo test
 
 ### Infrastructure
 - docker compose config --quiet
@@ -223,7 +222,6 @@ The only file you maintain. 20–30 lines. Everything else is universal or gener
 - Auto-commit after gates pass
 
 ## Security
-- Schematic file uploads only (validate server-side)
 - No hardcoded secrets or API keys
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whitehatd/crag",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "The bedrock layer for AI coding agents. One governance.md. Any project. Never stale.",
   "bin": {
     "crag": "bin/crag.js"

package/src/analyze/ci-extractors.js

@@ -21,7 +21,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { extractRunCommands } = require('../governance/yaml-run');
+const { extractRunCommands, stripYamlQuotes } = require('../governance/yaml-run');
 const { safeRead } = require('./stacks');
 
 /**
@@ -165,7 +165,7 @@ function extractCircleCommands(content) {
       const rest = inline[1].trim();
       if (rest && !rest.startsWith('#') && !rest.startsWith('|') && !rest.startsWith('>') &&
           !rest.startsWith('{') && !rest.startsWith('name:') && !rest.startsWith('command:')) {
-        commands.push(rest.replace(/^["']|["']$/g, ''));
+        commands.push(stripYamlQuotes(rest));
       }
     }
     // Nested: command: ...
@@ -173,7 +173,7 @@ function extractCircleCommands(content) {
     if (cmdMatch) {
       const rest = cmdMatch[1].trim();
       if (rest && !rest.startsWith('|') && !rest.startsWith('>') && !rest.startsWith('#')) {
-        commands.push(rest.replace(/^["']|["']$/g, ''));
+        commands.push(stripYamlQuotes(rest));
       } else if (rest === '|' || rest === '>-' || rest.startsWith('|') || rest.startsWith('>')) {
         // Block scalar — collect following lines with greater indent
         const baseIndent = (line.match(/^(\s*)/) || ['', ''])[1].length;
@@ -220,7 +220,7 @@ function extractAzureCommands(content) {
         commands.push(inner.trim());
       }
     } else if (rest && !rest.startsWith('#')) {
-      commands.push(rest.replace(/^["']|["']$/g, ''));
+      commands.push(stripYamlQuotes(rest));
     }
   }
   return commands;
@@ -287,7 +287,7 @@ function extractYamlListField(content, fields) {
         if (innerIndent <= baseIndent) break;
         const listItem = inner.match(/^\s*-\s*(.+)$/);
         if (listItem) {
-          commands.push(listItem[1].trim().replace(/^["']|["']$/g, ''));
+          commands.push(stripYamlQuotes(listItem[1].trim()));
         }
       }
     } else if (/^[|>][+-]?\s*$/.test(rest)) {
@@ -303,11 +303,11 @@ function extractYamlListField(content, fields) {
       // Inline list: script: [cmd1, cmd2]
       const inner = rest.slice(1, rest.indexOf(']') === -1 ? rest.length : rest.indexOf(']'));
       for (const item of inner.split(',')) {
-        const trimmed = item.trim().replace(/^["']|["']$/g, '');
+        const trimmed = stripYamlQuotes(item.trim());
         if (trimmed) commands.push(trimmed);
       }
     } else if (!rest.startsWith('#')) {
-      commands.push(rest.replace(/^["']|["']$/g, ''));
+      commands.push(stripYamlQuotes(rest));
     }
   }
 

package/src/analyze/normalize.js

@@ -94,6 +94,22 @@ function isNoise(cmd) {
   // License checkers are typically gates, but their exact invocation is
   // long and project-specific. Keep them.
 
+  // Dev/maintenance scripts under a `scripts/` directory are one-off tasks,
+  // not gates. FastAPI runs its doc, sponsor, people, translation pipelines
+  // this way via `uv run ./scripts/*.py`. These are publishing automations,
+  // not quality checks.
+  if (/^(uv|poetry|pdm|hatch|rye|pipenv)\s+run\s+(\.\/)?scripts\//.test(trimmed)) return true;
+  if (/^python3?\s+(\.\/)?scripts\//.test(trimmed)) return true;
+  if (/^node\s+(\.\/)?scripts\//.test(trimmed)) return true;
+  if (/^(bash|sh)\s+(\.\/)?scripts\//.test(trimmed)) return true;
+  if (/^npx\s+(tsx?|ts-node)\s+(\.\/)?scripts\//.test(trimmed)) return true;
+
+  // Shell control-flow fragments leaked from block scalars. When a `run: |`
+  // wraps a multi-line if/for/while/case, our line-based extractor pulls out
+  // the control keyword line as a pseudo-command.
+  if (/^(if|then|else|elif|fi|for|do|done|while|until|case|esac)\s/.test(trimmed)) return true;
+  if (/^(then|else|fi|do|done|esac)$/.test(trimmed)) return true;
+
   return false;
 }
 

package/src/governance/yaml-run.js

@@ -1,5 +1,18 @@
 'use strict';
 
+/**
+ * Strip surrounding matching quotes from a YAML scalar value.
+ *
+ * Only strips when the ENTIRE string is wrapped in matching single or double
+ * quotes. Previously we used `replace(/^["']|["']$/g, '')` which stripped a
+ * trailing quote even when no leading quote existed — that truncated commands
+ * like `make test-X ARGS='--workspace --benches'` to `make test-X ARGS='--workspace --benches`.
+ */
+function stripYamlQuotes(str) {
+  const m = str.match(/^(['"])(.*)\1$/);
+  return m ? m[2] : str;
+}
+
 /**
  * Shared YAML `run:` command extraction for GitHub Actions workflows.
  *
@@ -42,8 +55,7 @@ function extractRunCommands(content) {
         if (trimmed && !trimmed.startsWith('#')) commands.push(trimmed);
       }
     } else if (rest && !rest.startsWith('#')) {
-      // Inline: strip surrounding single/double quotes if present
-      commands.push(rest.replace(/^["']|["']$/g, ''));
+      commands.push(stripYamlQuotes(rest));
     }
   }
 
@@ -142,4 +154,4 @@ function isGateCommand(cmd) {
   return patterns.some((p) => p.test(cmd));
 }
 
-module.exports = { extractRunCommands, isGateCommand };
+module.exports = { extractRunCommands, isGateCommand, stripYamlQuotes };