arcane-cli 0.22.13 → 0.22.14

package/dist/index.js

@@ -3595,8 +3595,8 @@ Run \`spell unblock-push\` first (interactive), then uninstall.`
 // src/commands/doctor.ts
 import { access as access4, readFile as readFile6, mkdir as mkdir6, copyFile as fsCopyFile2 } from "fs/promises";
 import { join as join11, dirname as dirname3 } from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify } from "util";
+import { execFile as execFile3 } from "child_process";
+import { promisify as promisify2 } from "util";
 
 // src/config/incidents.ts
 var INCIDENT_QUEUE = [
@@ -3663,8 +3663,177 @@ function evaluateIncidentGate(records) {
   };
 }
 
-// src/commands/doctor.ts
+// src/modules/platform-policy.ts
+import { execFile as execFile2 } from "child_process";
+import { promisify } from "util";
 var execFileAsync = promisify(execFile2);
+var SANCTIONED_MERGE_METHODS = ["merge", "rebase"];
+function compareToLadder(effective, declaredButBlocked, interactionNote) {
+  const disallowedButPermitted = effective.filter(
+    (m) => !SANCTIONED_MERGE_METHODS.includes(m)
+  );
+  const missingSanctioned = SANCTIONED_MERGE_METHODS.filter(
+    (m) => !effective.includes(m)
+  );
+  const passed = disallowedButPermitted.length === 0 && missingSanctioned.length === 0;
+  const messages = [];
+  if (interactionNote) messages.push(interactionNote);
+  if (disallowedButPermitted.length > 0) {
+    messages.push(
+      `disallowed method(s) effectively permitted: ${disallowedButPermitted.join(", ")} (never sanctioned per git-conventions.md)`
+    );
+  }
+  if (missingSanctioned.length > 0) {
+    messages.push(
+      `sanctioned method(s) not effectively available: ${missingSanctioned.join(", ")}`
+    );
+  }
+  return {
+    passed,
+    effectiveMergeMethods: effective,
+    declaredButBlocked,
+    disallowedButPermitted,
+    message: passed ? `effective merge methods [${effective.join(", ")}] match the declared ladder` : messages.join("; ")
+  };
+}
+function evaluateGitHubMergePolicy(rulesets) {
+  const active = rulesets.filter(
+    (r) => r.enforcement === "active" && r.target === "branch"
+  );
+  if (active.length === 0) {
+    return {
+      passed: false,
+      effectiveMergeMethods: null,
+      declaredButBlocked: [],
+      disallowedButPermitted: [],
+      message: "No active branch ruleset covers the target branch (checked via Rulesets, not the classic protection endpoint, which false-negatives on Rulesets-only repos)."
+    };
+  }
+  let allowedMergeMethods = null;
+  let hasRequiredLinearHistory = false;
+  for (const ruleset of active) {
+    for (const rule of ruleset.rules) {
+      if (rule.type === "required_linear_history") {
+        hasRequiredLinearHistory = true;
+      }
+      if (rule.type === "pull_request") {
+        const methods = rule.parameters?.["allowed_merge_methods"];
+        if (Array.isArray(methods)) {
+          const typed = methods;
+          allowedMergeMethods = allowedMergeMethods === null ? typed : allowedMergeMethods.filter((m) => typed.includes(m));
+        }
+      }
+    }
+  }
+  const nominal = allowedMergeMethods ?? ["merge", "squash", "rebase"];
+  const effective = hasRequiredLinearHistory ? nominal.filter((m) => m !== "merge") : nominal;
+  const declaredButBlocked = hasRequiredLinearHistory && nominal.includes("merge") ? ["merge"] : [];
+  const interactionNote = declaredButBlocked.length > 0 ? `allowed_merge_methods declares [${nominal.join(", ")}] but a required_linear_history rule silently blocks merge commits regardless -- effective methods are [${effective.join(", ")}]` : void 0;
+  return compareToLadder(effective, declaredButBlocked, interactionNote);
+}
+async function fetchGitHubRulesets(owner, repo) {
+  try {
+    const { stdout: listOut } = await execFileAsync("gh", [
+      "api",
+      `repos/${owner}/${repo}/rulesets`
+    ]);
+    const summaries = JSON.parse(listOut);
+    const detailed = await Promise.all(
+      summaries.map(async (s) => {
+        const { stdout } = await execFileAsync("gh", [
+          "api",
+          `repos/${owner}/${repo}/rulesets/${s.id}`
+        ]);
+        return JSON.parse(stdout);
+      })
+    );
+    return detailed;
+  } catch {
+    return null;
+  }
+}
+function evaluateAdoMergePolicy(policies) {
+  const enabled = policies.filter((p) => p.isEnabled);
+  if (enabled.length === 0) {
+    return {
+      passed: false,
+      effectiveMergeMethods: null,
+      declaredButBlocked: [],
+      disallowedButPermitted: [],
+      message: 'No enabled "Limit merge types" branch policy found for the target branch.'
+    };
+  }
+  const effective = /* @__PURE__ */ new Set();
+  for (const policy of enabled) {
+    const s = policy.settings ?? {};
+    if (s.allowNoFastForward) effective.add("merge");
+    if (s.allowRebase || s.allowRebaseMerge) effective.add("rebase");
+    if (s.useSquashMerge) effective.add("squash");
+  }
+  return compareToLadder([...effective], []);
+}
+async function fetchAdoMergeTypePolicies(org, project, repoName, branch) {
+  try {
+    const orgUrl = `https://dev.azure.com/${org}`;
+    const { stdout: repoOut } = await execFileAsync("az", [
+      "repos",
+      "show",
+      "--repository",
+      repoName,
+      "--org",
+      orgUrl,
+      "--project",
+      project,
+      "--query",
+      "id",
+      "--output",
+      "tsv"
+    ]);
+    const repositoryId = repoOut.trim();
+    if (!repositoryId) return null;
+    const { stdout } = await execFileAsync("az", [
+      "repos",
+      "policy",
+      "list",
+      "--repository-id",
+      repositoryId,
+      "--branch",
+      branch,
+      "--org",
+      orgUrl,
+      "--project",
+      project,
+      "--output",
+      "json"
+    ]);
+    return JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+}
+function parseGitHubRemote(url) {
+  const match = /github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?\/?$/.exec(url);
+  if (!match) return null;
+  const [, owner, repo] = match;
+  if (!owner || !repo) return null;
+  return { owner, repo };
+}
+function parseAdoRemote(url) {
+  const modern = /dev\.azure\.com\/([^/]+)\/([^/]+)\/_git\/([^/?]+)/.exec(url);
+  if (modern) {
+    const [, org, project, repo] = modern;
+    if (org && project && repo) return { org, project, repo };
+  }
+  const legacy = /([^./]+)\.visualstudio\.com\/([^/]+)\/_git\/([^/?]+)/.exec(url);
+  if (legacy) {
+    const [, org, project, repo] = legacy;
+    if (org && project && repo) return { org, project, repo };
+  }
+  return null;
+}
+
+// src/commands/doctor.ts
+var execFileAsync2 = promisify2(execFile3);
 async function checkNodeVersion() {
   const name = "Node.js version";
   const raw = process.version;
@@ -3702,7 +3871,7 @@ async function checkVSCodeExtension(id, label) {
   let installBin = "code";
   for (const bin of ["code", "code-insiders"]) {
     try {
-      await execFileAsync(bin, ["--version"]);
+      await execFileAsync2(bin, ["--version"]);
       installBin = bin;
       break;
     } catch {
@@ -3894,6 +4063,49 @@ async function checkPushPolicy(targetDir) {
     message: `declared "blocked" but not enforced \u2014 ${missing.join("; ")}. The manifest claims a protection this repository does not have.`
   };
 }
+async function checkPlatformBranchPolicy(targetDir) {
+  const name = "Platform branch/merge policy (T11)";
+  const targets = await pushTargets(targetDir);
+  const origin = targets.find((t) => t.remote === "origin") ?? targets[0];
+  const url = origin?.urls[0];
+  if (!url) {
+    return { name, passed: true, message: "no remote configured \u2014 nothing to check", blocking: false };
+  }
+  const github = parseGitHubRemote(url);
+  if (github) {
+    const rulesets = await fetchGitHubRulesets(github.owner, github.repo);
+    if (rulesets === null) {
+      return {
+        name,
+        passed: false,
+        blocking: false,
+        message: `could not query GitHub Rulesets for ${github.owner}/${github.repo} \u2014 is \`gh\` installed and authenticated? Verify manually: gh api repos/${github.owner}/${github.repo}/rulesets`
+      };
+    }
+    const result = evaluateGitHubMergePolicy(rulesets);
+    return { name, passed: result.passed, blocking: false, message: result.message };
+  }
+  const ado = parseAdoRemote(url);
+  if (ado) {
+    const policies = await fetchAdoMergeTypePolicies(ado.org, ado.project, ado.repo, "main");
+    if (policies === null) {
+      return {
+        name,
+        passed: false,
+        blocking: false,
+        message: `could not query the Azure DevOps "Limit merge types" branch policy for ${ado.org}/${ado.project}/${ado.repo} \u2014 is \`az\` installed and authenticated? Verify manually in the ADO web UI under Branch Policies.`
+      };
+    }
+    const result = evaluateAdoMergePolicy(policies);
+    return { name, passed: result.passed, blocking: false, message: result.message };
+  }
+  return {
+    name,
+    passed: true,
+    blocking: false,
+    message: "remote is neither GitHub nor Azure DevOps \u2014 platform policy verification not available for this provider"
+  };
+}
 async function runDoctor(targetDir, options = {}, assetsDir) {
   console.log("\nspell doctor \u2014 checking your Arcane environment\n");
   const results = await Promise.all([
@@ -3902,7 +4114,8 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
     checkArcaneManifest(targetDir),
     Promise.resolve(checkIncidentReleaseGate()),
     checkPullRebase(targetDir),
-    checkPushPolicy(targetDir)
+    checkPushPolicy(targetDir),
+    checkPlatformBranchPolicy(targetDir)
   ]);
   const sessionResults = await checkSessionContinuity(targetDir);
   results.push(...sessionResults);