agents-gitflow-guard 0.0.1 → 0.0.2

package/lib/cli.mjs

@@ -1,39 +1,115 @@
-import { a as stateDir, c as gitRunner, d as loadConfig, l as isAncestor, o as currentBranch, s as findRepoRoot, t as appendAudit, u as openPermitStore } from "./src-DWE1n9Zh.mjs";
+import { c as findRepoRoot, d as roleMatches, f as classify, i as formatDeny, l as gitRunner, o as stateDir, r as evaluateCommand, s as currentBranch, u as loadConfig } from "./src-Dv6jKDsO.mjs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
+//#region src/platform.ts
+function str(v) {
+	return typeof v === "string" ? v : "";
+}
+function eventFrom(hookEventName) {
+	if (hookEventName === "PostToolUse") return "post";
+	if (hookEventName === "PostToolUseFailure") return "post-failure";
+	return "pre";
+}
+function parseRaw(raw) {
+	if (!raw) return null;
+	try {
+		const j = JSON.parse(raw);
+		if (typeof j !== "object" || j === null) return null;
+		return j;
+	} catch {
+		return null;
+	}
+}
+/** 从 stdin JSON 提取 command/cwd/event; 无法识别返回 null(放行) */
+function extractHookPayload(raw, platform = "auto") {
+	const j = parseRaw(raw);
+	if (!j) return null;
+	const plat = platform === "auto" ? detectPlatform(raw) : platform;
+	let command = "";
+	let cwd = "";
+	if (plat === "claude" || plat === "codex") {
+		command = str(j.tool_input?.command);
+		cwd = str(j.cwd);
+	} else if (plat === "copilot") {
+		command = str(j.tool_input?.command) || str(j.toolArgs?.command);
+		cwd = str(j.cwd);
+	} else if (plat === "antigravity") {
+		command = str(j.toolCall?.args?.CommandLine);
+		cwd = str(j.cwd);
+	}
+	if (!command) return null;
+	return {
+		command,
+		cwd: cwd || void 0,
+		toolUseId: str(j.tool_use_id) || void 0,
+		event: eventFrom(j.hook_event_name)
+	};
+}
+/** 按 payload 判别平台: 非空 turn_id→codex, toolCall→antigravity, 其余→claude */
+function detectPlatform(raw) {
+	const j = parseRaw(raw);
+	if (!j) return "claude";
+	if (j.turn_id) return "codex";
+	if (j.toolCall) return "antigravity";
+	return "claude";
+}
+/** deny 编码: 各平台的拦截协议(exit 码 + stdout/stderr) */
+function encodeDeny(platform, reason) {
+	switch (platform) {
+		case "claude": return {
+			exitCode: 2,
+			stderr: reason
+		};
+		case "codex": return {
+			exitCode: 0,
+			stdout: JSON.stringify({ hookSpecificOutput: {
+				hookEventName: "PreToolUse",
+				permissionDecision: "deny",
+				permissionDecisionReason: reason
+			} }),
+			stderr: reason
+		};
+		case "antigravity": return {
+			exitCode: 0,
+			stdout: JSON.stringify({
+				decision: "block",
+				reason
+			})
+		};
+		case "copilot": return {
+			exitCode: 2,
+			stderr: reason
+		};
+	}
+}
+//#endregion
 //#region src/cli.ts
-const USAGE = `gitflow-guard — GitFlow 流程守卫 CLI(用户终端专属)
+const USAGE = `gitflow-guard — GitFlow 流程守卫 CLI
 
 用法:
-  gitflow-guard permit <feature> [--kind early-pr|confirm|trunk-pr] [--ttl <分钟>] [--repo <路径>]
-  gitflow-guard confirm <feature> [--ttl <分钟>] [--repo <路径>]
   gitflow-guard status [--repo <路径>]
   gitflow-guard audit [--lines <数量>] [--repo <路径>]
+  gitflow-guard check [--platform <claude|auto>] [--command "<cmd>"] [--repo <路径>]
   gitflow-guard --help
 
 说明:
-  permit/confirm 是用户专属授权操作, agent 执行会被插件拦截。
-  status/audit 只读, agent 可自查。`;
+  status/audit 只读, agent 可自查。
+  check 读 stdin hook payload 做门禁(exit 0=放行 / 2=拦截), 供 Claude Code 等 agent 的 pre/post hook 调用。`;
 function parseFlags(argv) {
-	const positional = [];
 	const flags = {};
 	for (let i = 0; i < argv.length; i++) {
 		const a = argv[i];
 		const next = () => argv[++i];
 		if (a === "--repo") flags.repo = next();
-		else if (a === "--kind") flags.kind = next();
-		else if (a === "--ttl") flags.ttl = Number(next());
 		else if (a === "--lines") flags.lines = Number(next());
+		else if (a === "--platform") flags.platform = next();
+		else if (a === "--command") flags.command = next();
 		else if (a.startsWith("--repo=")) flags.repo = a.slice(7);
-		else if (a.startsWith("--kind=")) flags.kind = a.slice(7);
-		else if (a.startsWith("--ttl=")) flags.ttl = Number(a.slice(6));
 		else if (a.startsWith("--lines=")) flags.lines = Number(a.slice(8));
-		else positional.push(a);
+		else if (a.startsWith("--platform=")) flags.platform = a.slice(11);
+		else if (a.startsWith("--command=")) flags.command = a.slice(10);
 	}
-	return {
-		positional,
-		flags
-	};
+	return flags;
 }
 async function resolveRepo(flags) {
 	if (flags.repo) return flags.repo;
@@ -46,15 +122,11 @@ async function main(argv, opts = {}) {
 		console.log(USAGE);
 		return 0;
 	}
-	const { positional, flags } = parseFlags(rest);
+	const flags = parseFlags(rest);
 	try {
-		if (cmd === "permit") return await permit(positional, flags, runner);
-		if (cmd === "confirm") return await permit(positional, {
-			...flags,
-			kind: "confirm"
-		}, runner);
 		if (cmd === "status") return await status(flags, runner);
 		if (cmd === "audit") return await audit(flags);
+		if (cmd === "check") return await check(flags);
 		console.error(`[gitflow-guard] 未知子命令: ${cmd ?? ""}\n\n${USAGE}`);
 		return 1;
 	} catch (e) {
@@ -62,38 +134,6 @@ async function main(argv, opts = {}) {
 		return 1;
 	}
 }
-async function permit(positional, flags, runner) {
-	const feature = positional[0];
-	if (!feature) {
-		console.error("[gitflow-guard] 用法: gitflow-guard permit <feature> [--kind early-pr|confirm|trunk-pr]");
-		return 1;
-	}
-	const kind = flags.kind ?? "confirm";
-	if (kind !== "early-pr" && kind !== "confirm" && kind !== "trunk-pr") {
-		console.error("[gitflow-guard] --kind 必须是 early-pr / confirm / trunk-pr");
-		return 1;
-	}
-	const ttlMs = flags.ttl != null && Number.isFinite(flags.ttl) && flags.ttl > 0 ? flags.ttl * 6e4 : void 0;
-	const repoRoot = await resolveRepo(flags);
-	if (!repoRoot) {
-		console.error("[gitflow-guard] 无法定位 git 仓库(当前目录不在仓库内, 或用 --repo 指定)");
-		return 1;
-	}
-	const { config } = await loadConfig(repoRoot);
-	if (!config?.enabled) {
-		console.error(`[gitflow-guard] 项目未启用 gitflow-guard(${join(repoRoot, "gitflow-guard.config.json")} 不存在或 enabled=false)`);
-		return 1;
-	}
-	const granted = await (await openPermitStore(join(stateDir(repoRoot), "state.json"))).grant(kind, feature, ttlMs != null ? { ttlMs } : void 0);
-	await appendAudit(repoRoot, {
-		time: Date.now(),
-		event: "grant",
-		kind,
-		feature
-	});
-	console.log(`[gitflow-guard] 已授权: ${kind} → ${feature}${granted.expiresAt ? `(有效期至 ${new Date(granted.expiresAt).toLocaleString()})` : "(长期有效)"}`);
-	return 0;
-}
 async function status(flags, runner) {
 	const repoRoot = await resolveRepo(flags);
 	if (!repoRoot) {
@@ -109,37 +149,29 @@ async function status(flags, runner) {
 		return 0;
 	}
 	const branch = await currentBranch(runner, repoRoot);
-	console.log(`配置: 已启用(${config.mode} 模式) | 基线: ${config.branches.base} | 预览: ${config.branches.preview}${config.branches.trunk ? ` | 主干: ${config.branches.trunk}` : ""}`);
+	const c = config;
+	console.log(`配置: 已启用 | featurePattern: ${c.featurePattern}`);
+	console.log(`集成分支: ${c.branches.integration.branches.join(", ")} (update=${c.branches.integration.update || "pr"})`);
+	if (c.branches.preview) console.log(`预览分支: ${c.branches.preview.branches.join(", ")} (update=${c.branches.preview.update || "pr"})`);
+	if (c.branches.production) console.log(`生产分支: ${c.branches.production.branches.join(", ")} (update=${c.branches.production.update || "pr"}, 合并=${c.branches.production.mergeBy || "user"})`);
+	if (c.branches.archive) console.log(`归档分支: ${c.branches.archive.branches.join(", ")}`);
 	console.log(`当前分支: ${branch ?? "(未知)"}`);
-	const pattern = new RegExp(config.confirm.featurePattern);
 	const r = await runner.run([
 		"for-each-ref",
 		"--format=%(refname:short)",
 		"refs/heads/"
 	], repoRoot);
-	const features = (r.code === 0 ? r.stdout.split("\n").map((s) => s.trim()).filter(Boolean) : []).filter((b) => pattern.test(b));
-	const store = await openPermitStore(join(stateDir(repoRoot), "state.json"));
-	const inPreview = [];
-	for (const f of features) if (await isAncestor(runner, repoRoot, f, config.branches.preview)) inPreview.push(f);
-	console.log(`预览分支(${config.branches.preview})包含的 feature:`);
-	for (const f of inPreview) console.log(`  ✓ ${f}`);
-	if (inPreview.length === 0) console.log("  (无)");
-	console.log("feature 状态一览:");
-	for (const f of features) {
-		const confirmed = store.hasValid("confirm", f);
-		const early = store.hasValid("early-pr", f);
-		const trunk = store.hasValid("trunk-pr", f);
-		const mark = (ok) => ok ? "✓" : "✗";
-		console.log(`  ${f}: 已合预览 ${mark(inPreview.includes(f))} | 已确认(P2) ${mark(confirmed)} | P1 ${early ? "✓" : "-"} | P3 ${trunk ? "✓" : "-"}`);
-	}
-	const permits = store.list();
-	if (permits.length > 0) {
-		console.log("特许记录:");
-		for (const p of permits) {
-			const state = p.used ? "已使用" : p.expiresAt && p.expiresAt <= Date.now() ? "已过期" : "未使用";
-			console.log(`  ${p.kind} ${p.feature} (${state})`);
-		}
-	}
+	const localBranches = r.code === 0 ? r.stdout.split("\n").map((s) => s.trim()).filter(Boolean) : [];
+	const classifyBranch = (b) => {
+		if (c.branches.production && roleMatches(b, c.branches.production)) return "production";
+		if (c.branches.preview && roleMatches(b, c.branches.preview)) return "preview";
+		if (roleMatches(b, c.branches.integration)) return "integration";
+		if (c.branches.archive && roleMatches(b, c.branches.archive)) return "archive";
+		if (new RegExp(c.featurePattern).test(b)) return "feature";
+		return "other";
+	};
+	console.log("本地分支(按角色):");
+	for (const b of localBranches) console.log(`  ${b} → ${classifyBranch(b)}`);
 	return 0;
 }
 async function audit(flags) {
@@ -153,7 +185,7 @@ async function audit(flags) {
 		const all = (await readFile(join(stateDir(repoRoot), "audit.jsonl"), "utf8")).split("\n").filter(Boolean);
 		for (const line of all.slice(-lines)) try {
 			const e = JSON.parse(line);
-			console.log(`  ${new Date(e.time).toLocaleString()} ${e.event} ${e.kind ?? ""} ${e.feature ?? ""}${e.command ? ` | ${e.command.slice(0, 80)}` : ""}`);
+			console.log(`  ${new Date(e.time).toLocaleString()} ${e.event} ${e.role ?? ""}${e.command ? ` | ${e.command.slice(0, 80)}` : ""}${e.reason ? ` | ${e.reason.slice(0, 60)}` : ""}`);
 		} catch {
 			console.log(`  ${line}`);
 		}
@@ -162,5 +194,46 @@ async function audit(flags) {
 	}
 	return 0;
 }
+function readStdin() {
+	return new Promise((resolve) => {
+		let data = "";
+		process.stdin.setEncoding("utf8");
+		process.stdin.on("data", (chunk) => data += chunk);
+		process.stdin.on("end", () => resolve(data));
+		process.stdin.on("error", () => resolve(data));
+	});
+}
+/** check: agent hook 门禁。读 stdin hook payload(或 --command), exit 0=放行 / 2=拦截(按平台编码) */
+async function check(flags) {
+	const platform = flags.platform ?? "auto";
+	try {
+		const raw = flags.command != null ? "" : await readStdin();
+		const payload = flags.command != null ? {
+			command: flags.command,
+			cwd: flags.repo,
+			event: "pre"
+		} : extractHookPayload(raw, platform);
+		if (!payload?.command) return 0;
+		const segments = classify(payload.command);
+		if (segments.length === 0 || segments.every((s) => s.kind === "other")) return 0;
+		const cwd = payload.cwd ?? process.cwd();
+		const repoRoot = flags.repo ?? await findRepoRoot(gitRunner, cwd);
+		if (!repoRoot) return 0;
+		const { config } = await loadConfig(repoRoot);
+		if (!config?.enabled) return 0;
+		const hookPlatform = platform === "auto" ? detectPlatform(raw) : platform;
+		const result = await evaluateCommand(payload.command, { repoRoot });
+		if (result.outcome === "deny" && result.reason) {
+			const enc = encodeDeny(hookPlatform, formatDeny(result.reason.why, result.reason.next));
+			if (enc.stdout) process.stdout.write(enc.stdout + "\n");
+			if (enc.stderr) process.stderr.write(enc.stderr + "\n");
+			return enc.exitCode;
+		}
+		return 0;
+	} catch (e) {
+		process.stderr.write(`[gitflow-guard] check 内部错误, 已放行: ${e.message}\n`);
+		return 0;
+	}
+}
 //#endregion
 export { main };

package/lib/index.d.mts

@@ -1,29 +1,20 @@
 import { t as Runner } from "./repo-DrgptHl1.mjs";
 import { Context } from "@deepseek-ai/cordis";
-//#region src/types.d.ts
-/** 特许类型: P1 提前建 PR / P2 确认合入 / P3 许可 trunk PR */
-type PermitKind = 'early-pr' | 'confirm' | 'trunk-pr';
-//#endregion
 //#region src/index.d.ts
 declare const name = "gitflow-guard";
 interface PluginConfig {
   /** 拦截哪些工具的命令文本(默认 pwsh / bash) */
   toolNames?: string[];
-  /** 特许默认有效期(毫秒; 默认不过期) */
-  permitTtlMs?: number;
 }
 interface EvaluateOptions {
   repoRoot: string;
   runner?: Runner;
-  /** gh 适配器执行器(测试注入; 默认真实 gh) */
+  /** GitHub gh 适配器执行器(测试注入; 默认真实 gh) */
   ghRunner?: Runner;
+  /** GitLab glab 适配器执行器(测试注入; 默认真实 glab) */
+  glabRunner?: Runner;
   /** 当前分支(缺省时内部查询) */
   currentBranch?: string | null;
-  now?: () => number;
-}
-interface PendingConsume {
-  kind: PermitKind;
-  feature: string;
 }
 interface EvaluateResult {
   outcome: 'allow' | 'deny' | 'skipped';
@@ -32,15 +23,12 @@ interface EvaluateResult {
     next: string;
   };
   segmentCount: number;
-  /** 放行时可能被本次动作消费的特许(动作成功后由 post-execute 消费) */
-  pendingConsume: PendingConsume[];
 }
 interface AuditEntry {
   time: number;
-  event: 'allow' | 'deny' | 'grant' | 'consume' | 'remind' | 'ci';
+  event: 'deny' | 'ci';
   command?: string;
-  feature?: string;
-  kind?: string;
+  role?: string;
   reason?: string;
 }
 declare function stateDir(repoRoot: string): string;
@@ -48,6 +36,7 @@ declare function stateDir(repoRoot: string): string;
 declare function appendAudit(repoRoot: string, entry: AuditEntry): Promise<void>;
 /** 解析一条命令: 分类 → git 事实 → 门禁 → allow/deny */
 declare function evaluateCommand(command: string, opts: EvaluateOptions): Promise<EvaluateResult>;
+declare function formatDeny(why: string, next: string): string;
 declare function apply(ctx: Context, pluginConfig?: PluginConfig): void;
 //#endregion
-export { AuditEntry, EvaluateOptions, EvaluateResult, PendingConsume, PluginConfig, appendAudit, apply, evaluateCommand, name, stateDir };
+export { AuditEntry, EvaluateOptions, EvaluateResult, PluginConfig, appendAudit, apply, evaluateCommand, formatDeny, name, stateDir };

package/lib/index.mjs

@@ -1,2 +1,2 @@
-import { a as stateDir, i as name, n as apply, r as evaluateCommand, t as appendAudit } from "./src-DWE1n9Zh.mjs";
-export { appendAudit, apply, evaluateCommand, name, stateDir };
+import { a as name, i as formatDeny, n as apply, o as stateDir, r as evaluateCommand, t as appendAudit } from "./src-Dv6jKDsO.mjs";
+export { appendAudit, apply, evaluateCommand, formatDeny, name, stateDir };