altimate-receipts 0.5.0 → 0.5.2

package/dist/cli.js

@@ -13,13 +13,13 @@ import {
   renderShareMarkdown,
   sliceByBranch,
   toDsseEnvelope
-} from "./chunk-WISVSYA7.js";
+} from "./chunk-GOLRNSZT.js";
 import {
   computeTrends,
   deriveTargets,
   renderTrends,
   upsertTrendsSection
-} from "./chunk-QGUQOQXO.js";
+} from "./chunk-EKMFU3ES.js";
 import {
   agentIds,
   anyDetected,
@@ -43,10 +43,10 @@ import {
   selectSummary,
   upsertGuardrailsSection,
   verifyBundle
-} from "./chunk-2QTR3AF4.js";
+} from "./chunk-EYM5WETZ.js";
 
 // src/cli.ts
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import {
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
@@ -177,17 +177,13 @@ function wirePrepareScript(pkgPath) {
 import { spawnSync as spawnSync2 } from "child_process";
 import { existsSync as existsSync2 } from "fs";
 import { join as join2 } from "path";
-var REPUSH_EXIT = 42;
-var ATTACH_SUBJECT = (branch) => `chore(receipts): attach agent receipt for ${branch}`;
-function git2(args, cwd) {
-  const r = spawnSync2("git", args, { encoding: "utf8", cwd });
-  return r.status === 0 ? r.stdout.trim() : "";
-}
+
+// src/trace/gitCommand.ts
 var WRAPPERS = /* @__PURE__ */ new Set(["command", "exec", "nohup", "time", "env"]);
 var GIT_VALUE_FLAGS = /* @__PURE__ */ new Set(["-C", "-c", "--git-dir", "--work-tree", "--exec-path"]);
-var TAG_REFSPEC = /^(refs\/tags\/|v\d+(\.\d+)*$)/;
-function isGitPush(command) {
+function gitInvocations(command) {
   const blanked = command.replace(/\\["']/g, "  ").replace(/'[^']*'/g, " ").replace(/"[^"]*"/g, " ");
+  const out = [];
   for (const simple of blanked.split(/(?:&&|\|\||[;|\n])/)) {
     const tokens = simple.trim().split(/\s+/).filter(Boolean);
     let i = 0;
@@ -205,15 +201,31 @@ function isGitPush(command) {
         i++;
       }
     }
-    if (tokens[i] !== "push") {
+    const sub = tokens[i];
+    if (sub) {
+      out.push({ sub, rest: tokens.slice(i + 1) });
+    }
+  }
+  return out;
+}
+
+// src/hook/prePush.ts
+var REPUSH_EXIT = 42;
+var ATTACH_SUBJECT = (branch) => `chore(receipts): attach agent receipt for ${branch}`;
+function git2(args, cwd) {
+  const r = spawnSync2("git", args, { encoding: "utf8", cwd });
+  return r.status === 0 ? r.stdout.trim() : "";
+}
+var TAG_REFSPEC = /^(refs\/tags\/|v\d+(\.\d+)*$)/;
+function isGitPush(command) {
+  for (const { sub, rest } of gitInvocations(command)) {
+    if (sub !== "push") {
       continue;
     }
-    const rest = tokens.slice(i + 1);
     if (rest.includes("--dry-run") || rest.includes("-n") || rest.includes("--tags")) {
       continue;
     }
-    const positionals = rest.filter((t) => !t.startsWith("-"));
-    const refspecs = positionals.slice(1);
+    const refspecs = rest.filter((t) => !t.startsWith("-")).slice(1);
     if (refspecs.length > 0 && refspecs.every((r) => TAG_REFSPEC.test(r))) {
       continue;
     }
@@ -224,8 +236,19 @@ function isGitPush(command) {
 function gitStdinPushesBranch(stdin) {
   return stdin.split("\n").some((line) => line.trim().startsWith("refs/heads/"));
 }
+var hasMarker = (root) => existsSync2(join2(root, ".github", "workflows", "receipts.yml")) || existsSync2(join2(root, ".receipts"));
 function repoOptedIn(repoRoot) {
-  return existsSync2(join2(repoRoot, ".github", "workflows", "receipts.yml")) || existsSync2(join2(repoRoot, ".receipts"));
+  if (hasMarker(repoRoot)) {
+    return true;
+  }
+  const common = git2(["rev-parse", "--git-common-dir"], repoRoot);
+  if (common.endsWith("/.git")) {
+    const primary = common.slice(0, -"/.git".length);
+    if (primary && primary !== repoRoot) {
+      return hasMarker(primary);
+    }
+  }
+  return false;
 }
 function headIsAttachCommit(branch, cwd) {
   return git2(["log", "-1", "--format=%s"], cwd) === ATTACH_SUBJECT(branch);
@@ -245,7 +268,7 @@ async function runHookPrePush(dialect, stdin, generate) {
     if ((process.env.RECEIPTS_STORE || "commit").toLowerCase() === "none") {
       return { exit: 0 };
     }
-    if (dialect === "claude") {
+    if (dialect === "claude" || dialect === "codex") {
       let payload;
       try {
         payload = JSON.parse(stdin);
@@ -301,7 +324,7 @@ async function runHookPrePush(dialect, stdin, generate) {
     if (dialect === "git") {
       return {
         exit: REPUSH_EXIT,
-        message: `\u{1F4CE} Receipts: attached an agent receipt for '${branch}' \u2014 run \`git push\` again to include it.`
+        message: `\u{1F4CE} Receipts: attached an agent receipt for '${branch}' \u2014 rerun the same \`git push\` command to include it.`
       };
     }
     return {
@@ -317,7 +340,7 @@ async function runHookPrePush(dialect, stdin, generate) {
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname } from "path";
 var HOOK_COMMAND = "npx -y altimate-receipts@latest hook pre-push";
-function mergeHookIntoSettings(path) {
+function mergeHookIntoSettings(path, command = HOOK_COMMAND) {
   let settings = {};
   if (existsSync3(path)) {
     let parsed;
@@ -345,11 +368,11 @@ function mergeHookIntoSettings(path) {
   if (!Array.isArray(pre)) {
     return { ok: false, reason: `${path} has a non-array hooks.PreToolUse \u2014 leaving it untouched` };
   }
-  const present = pre.some((e) => e?.hooks?.some((h) => h?.command === HOOK_COMMAND));
+  const present = pre.some((e) => e?.hooks?.some((h) => h?.command === command));
   if (present) {
     return { ok: true, changed: false };
   }
-  pre.push({ matcher: "Bash", hooks: [{ type: "command", command: HOOK_COMMAND }] });
+  pre.push({ matcher: "Bash", hooks: [{ type: "command", command }] });
   mkdirSync2(dirname(path), { recursive: true });
   writeFileSync2(path, `${JSON.stringify(settings, null, 2)}
 `);
@@ -1003,6 +1026,72 @@ function renderHandoffMarkdown(h) {
 `;
 }
 
+// src/trace/commitMatch.ts
+import { spawnSync as spawnSync3 } from "child_process";
+var SHA_CAP = 200;
+function branchShas(base, cwd) {
+  if (!base) {
+    return [];
+  }
+  const r = spawnSync3("git", ["log", `--max-count=${SHA_CAP}`, "--format=%H", `${base}..HEAD`], {
+    encoding: "utf8",
+    cwd
+  });
+  if (r.status !== 0) {
+    return [];
+  }
+  return r.stdout.split("\n").filter((s) => /^[0-9a-f]{40}$/.test(s));
+}
+var HEX_RUN = /\b[0-9a-f]{7,40}\b/g;
+function commandOf(input) {
+  if (typeof input === "string") {
+    const t = input.trim();
+    if (t.startsWith("{")) {
+      try {
+        return commandOf(JSON.parse(t));
+      } catch {
+        return input;
+      }
+    }
+    return input;
+  }
+  if (input && typeof input === "object") {
+    const o = input;
+    for (const key of ["command", "cmd"]) {
+      const v = o[key];
+      if (typeof v === "string") {
+        return v;
+      }
+      if (Array.isArray(v)) {
+        return v.filter((t) => typeof t === "string").join(" ");
+      }
+    }
+  }
+  return "";
+}
+function isGitWrite(command) {
+  return gitInvocations(command).some((g) => g.sub === "commit" || g.sub === "push");
+}
+function authoredBranch(spans, shas) {
+  if (shas.length === 0) {
+    return false;
+  }
+  for (const s of spans) {
+    if (s.kind !== "tool" || typeof s.output !== "string") {
+      continue;
+    }
+    if (!isGitWrite(commandOf(s.input))) {
+      continue;
+    }
+    for (const token of s.output.match(HEX_RUN) ?? []) {
+      if (shas.some((full) => full.startsWith(token))) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
 // src/cli.ts
 var HELP = `
 \u{1F9FE}  receipts \u2014 proof, not vibes
@@ -1032,9 +1121,10 @@ Usage
   receipts sarif [receipt]      SARIF 2.1.0 for GitHub code-scanning (inline + Security tab; --out f)
   receipts prune [dir]          Remove committed receipts for merged/deleted branches (--dry-run)
   receipts init                 One-command adopt: PR-check workflow + the repo-committed
-                                agent hook (--prepare also wires the git-hook floor)
+                                agent hook; --pr also branches, commits, pushes + opens the PR
+                                (--prepare wires the git floor; --agents codex too)
   receipts hook pre-push        (called by hooks, not humans) attach the receipt on push
-                                (--agent claude | git selects the payload dialect)
+                                (--agent claude | codex | git selects the payload dialect)
   receipts install-hook         Write the self-updating pre-push hook into .git/hooks
   receipts setup-local          Add the hook to YOUR ~/.claude/settings.json (only fires
                                 in repos that have adopted the Receipts workflow)
@@ -1112,6 +1202,7 @@ function parseArgs(argv) {
     dryRun: false,
     wholeSession: false,
     prepare: false,
+    pr: false,
     color: !process.env.NO_COLOR && process.stdout.isTTY === true
   };
   const positionals = [];
@@ -1156,12 +1247,16 @@ function parseArgs(argv) {
       parsed.wholeSession = true;
     } else if (a === "--prepare") {
       parsed.prepare = true;
+    } else if (a === "--pr") {
+      parsed.pr = true;
+    } else if (a === "--agents") {
+      parsed.agents = (args[++i] ?? "").split(",").filter(Boolean);
     } else if (a === "--agent") {
       const next = args[i + 1];
       if (next && agentIds().includes(next)) {
         parsed.agent = next;
         i++;
-      } else if (next === "claude" || next === "git") {
+      } else if (next === "claude" || next === "codex" || next === "git") {
         parsed.hookDialect = next;
         i++;
       }
@@ -1222,7 +1317,7 @@ async function run(argv) {
     return runPrune(args.file, { dryRun: args.dryRun });
   }
   if (args.command === "init") {
-    return runInit({ prepare: args.prepare });
+    return runInit({ prepare: args.prepare, agents: args.agents, pr: args.pr });
   }
   if (args.command === "hook") {
     return runHook(args.file, args.hookDialect ?? "claude");
@@ -1342,7 +1437,7 @@ Run a coding-agent session first, then try again.
   return 0;
 }
 function git3(args) {
-  const r = spawnSync3("git", args, { encoding: "utf8" });
+  const r = spawnSync4("git", args, { encoding: "utf8" });
   return r.status === 0 ? r.stdout.trim() : "";
 }
 var PR_SELECT_SCAN = 150;
@@ -1360,7 +1455,7 @@ function branchBirthMs(base) {
 function staleForBranch(endedAt, birthMs) {
   return birthMs != null && endedAt != null && endedAt < birthMs;
 }
-async function pickForDiff(all, branch, repoRoot, files, birthMs = null) {
+async function pickForDiff(all, branch, repoRoot, files, birthMs = null, shas = []) {
   const load = async (sum) => {
     const session = await loadSession(sum);
     if (!session) {
@@ -1368,6 +1463,14 @@ async function pickForDiff(all, branch, repoRoot, files, birthMs = null) {
     }
     return { summary: sum, session, derived: deriveSpans(session) };
   };
+  if (shas.length > 0) {
+    for (const sum of all.slice(0, PR_SELECT_SCAN)) {
+      const cand = await load(sum);
+      if (cand && authoredBranch(cand.derived.spans, shas)) {
+        return cand;
+      }
+    }
+  }
   const primarySum = selectForBranch(all, branch, repoRoot);
   const primary = primarySum ? await load(primarySum) : null;
   if (primary && diffOverlap(primary.derived, files) > 0) {
@@ -1398,7 +1501,14 @@ async function runPr(opts) {
   }
   const diff = opts.wholeSession ? null : changedFiles(opts.base);
   const all = await listSessions();
-  const picked = diff ? await pickForDiff(all, branch, repoRoot || void 0, diff.files, branchBirthMs(diff.base)) : await (async () => {
+  const picked = diff ? await pickForDiff(
+    all,
+    branch,
+    repoRoot || void 0,
+    diff.files,
+    branchBirthMs(diff.base),
+    branchShas(diff.base)
+  ) : await (async () => {
     const sum = selectForBranch(all, branch, repoRoot || void 0);
     return sum ? { summary: sum, session: await loadSession(sum), derived: null } : null;
   })();
@@ -1417,7 +1527,7 @@ Build the branch with a coding agent first, or run \`receipts --list\`.
   let scope = { kind: "session" };
   let scopeNote = "whole session";
   if (diff) {
-    const sd = applyDiffScope(derived, findings, diff.files);
+    const sd = applyDiffScope(derived, findings, diff.files, session.projectPath);
     derived = sd.derived;
     findings = sd.findings;
     scope = { kind: "diff", base: diff.base, files: diff.files };
@@ -1465,6 +1575,11 @@ Build the branch with a coding agent first, or run \`receipts --list\`.
   const dir = join6(repoRoot || ".", ".receipts");
   const out = opts.out ?? join6(dir, `${safe}.json`);
   mkdirSync3(dir, { recursive: true });
+  const attrs = join6(dir, ".gitattributes");
+  if (!existsSync4(attrs)) {
+    writeFileSync3(attrs, "* linguist-generated\n");
+    git3(["add", attrs]);
+  }
   writeFileSync3(out, json);
   git3(["add", out]);
   const rel = repoRoot ? relative(repoRoot, out) : out;
@@ -1844,6 +1959,7 @@ async function runEval(opts = {}) {
 }
 function runInit(opts = {}) {
   const lines = [];
+  const written = [];
   const v = getVersion();
   const major = /^(\d+)\.\d+\.\d+/.exec(v)?.[1];
   const tag = major ? `v${major}` : "v0";
@@ -1854,6 +1970,7 @@ function runInit(opts = {}) {
   } else {
     mkdirSync3(dir, { recursive: true });
     writeFileSync3(path, workflowContent(tag, v));
+    written.push(path);
     lines.push(`receipts init: wrote ${path} (tracking ${tag}, quiet + non-blocking).`);
   }
   const settingsPath = join6(".claude", "settings.json");
@@ -1861,6 +1978,7 @@ function runInit(opts = {}) {
   if (!merged.ok) {
     lines.push(`receipts init: ${merged.reason}.`);
   } else if (merged.changed) {
+    written.push(settingsPath);
     lines.push(`receipts init: added the receipts pre-push hook to ${settingsPath}.`);
   } else {
     lines.push(`receipts init: ${settingsPath} already has the receipts hook.`);
@@ -1868,13 +1986,37 @@ function runInit(opts = {}) {
   const ignorePath = join6(".claude", ".gitignore");
   if (!existsSync4(ignorePath)) {
     writeFileSync3(ignorePath, "*\n!settings.json\n!.gitignore\n");
+    written.push(ignorePath);
     lines.push(`receipts init: wrote ${ignorePath} (commit settings.json, ignore the rest).`);
   }
+  if (opts.agents?.includes("codex") || existsSync4(".codex")) {
+    const codexPath = join6(".codex", "hooks.json");
+    const m = mergeHookIntoSettings(
+      codexPath,
+      "npx -y altimate-receipts@latest hook pre-push --agent codex"
+    );
+    if (!m.ok) {
+      lines.push(`receipts init: ${m.reason}.`);
+    } else if (m.changed) {
+      written.push(codexPath);
+      lines.push(`receipts init: added the receipts pre-push hook to ${codexPath}.`);
+    } else {
+      lines.push(`receipts init: ${codexPath} already has the receipts hook.`);
+    }
+  }
+  const attrsPath = join6(".receipts", ".gitattributes");
+  if (!existsSync4(attrsPath)) {
+    mkdirSync3(".receipts", { recursive: true });
+    writeFileSync3(attrsPath, "* linguist-generated\n");
+    written.push(attrsPath);
+    lines.push(`receipts init: wrote ${attrsPath} (receipts collapse in PR diffs).`);
+  }
   if (opts.prepare) {
     const wired = wirePrepareScript("package.json");
     if (!wired.ok) {
       lines.push(`receipts init: ${wired.reason}.`);
     } else if (wired.changed) {
+      written.push("package.json");
       lines.push(
         "receipts init: wired `prepare` in package.json \u2014 `npm install` now self-installs the git hook."
       );
@@ -1882,11 +2024,82 @@ function runInit(opts = {}) {
       lines.push("receipts init: package.json `prepare` already wired.");
     }
   }
-  lines.push("  Commit these, open a PR, and receipts attach themselves from then on.");
+  if (opts.pr) {
+    openAdoptionPr(written, lines);
+  } else {
+    lines.push("  Commit these, open a PR, and receipts attach themselves from then on.");
+    lines.push("  (Or let init do that too: `npx altimate-receipts init --pr`.)");
+  }
+  if (written.includes(settingsPath)) {
+    lines.push("  Note: agent sessions load hooks at startup \u2014 restart any running session once.");
+  }
   process.stdout.write(`${lines.join("\n")}
 `);
   return 0;
 }
+var ADOPT_BRANCH = "chore/adopt-receipts";
+function openAdoptionPr(written, lines) {
+  if (written.length === 0) {
+    lines.push("receipts init: nothing new to commit \u2014 the repo is already integrated.");
+    return;
+  }
+  if (!git3(["rev-parse", "--git-dir"])) {
+    lines.push("receipts init: not a git repository \u2014 commit the files above manually.");
+    return;
+  }
+  if (git3(["rev-parse", "--verify", "--quiet", ADOPT_BRANCH]) !== "") {
+    lines.push(
+      `receipts init: branch ${ADOPT_BRANCH} already exists \u2014 commit the files above to it manually.`
+    );
+    return;
+  }
+  if (spawnSync4("git", ["checkout", "-b", ADOPT_BRANCH], { encoding: "utf8" }).status !== 0) {
+    lines.push(`receipts init: could not create branch ${ADOPT_BRANCH} \u2014 commit manually.`);
+    return;
+  }
+  spawnSync4("git", ["add", "--", ...written], { encoding: "utf8" });
+  const commit = spawnSync4(
+    "git",
+    ["commit", "-m", "chore: adopt receipts \u2014 zero-install agent-work verification"],
+    { encoding: "utf8" }
+  );
+  if (commit.status !== 0) {
+    lines.push(
+      `receipts init: commit failed (pre-commit hooks?) \u2014 files are staged on ${ADOPT_BRANCH}; finish manually.`
+    );
+    return;
+  }
+  lines.push(`receipts init: committed ${written.length} file(s) on ${ADOPT_BRANCH}.`);
+  const push = spawnSync4("git", ["push", "-u", "origin", ADOPT_BRANCH], { encoding: "utf8" });
+  if (push.status !== 0) {
+    lines.push(
+      "receipts init: push failed (no remote / auth?) \u2014 push the branch and open a PR manually."
+    );
+    return;
+  }
+  lines.push(`receipts init: pushed ${ADOPT_BRANCH}.`);
+  const gh = spawnSync4(
+    "gh",
+    [
+      "pr",
+      "create",
+      "--title",
+      "chore: adopt receipts \u2014 zero-install agent-work verification",
+      "--body",
+      "Adds the Verified-by-Receipts PR check and the repo-committed agent hook (generated by `npx altimate-receipts init --pr`). Contributors install nothing \u2014 see https://github.com/AltimateAI/altimate-receipts/blob/main/docs/onboarding.md"
+    ],
+    { encoding: "utf8" }
+  );
+  if (gh.status === 0) {
+    lines.push(`receipts init: opened the PR \u2014 ${gh.stdout.trim().split("\n").pop()}`);
+    return;
+  }
+  const remote = git3(["remote", "get-url", "origin"]);
+  const slug = remote ? /github\.com[:/]([^/]+\/[^/.]+)/.exec(remote)?.[1] : void 0;
+  lines.push(
+    slug ? `receipts init: open the PR here \u2014 https://github.com/${slug}/pull/new/${ADOPT_BRANCH}` : "receipts init: branch pushed \u2014 open a PR from it in your forge."
+  );
+}
 function workflowContent(tag, v) {
   return `name: Verified by Receipts