cawdev-cli 1.1.1 → 1.2.0

package/lib/version-files.mjs

@@ -0,0 +1,99 @@
+// R587: the project's version out of a file that declares it. Moved from
+// tools/release/plan.mjs so the release plan, `sonar.sh` (through
+// tools/quality/scan.mjs) and the daemon's scan (runner.mjs, scanQuality) read
+// a version one way. Pure and zero dependencies, like all of tools/.
+//
+// A file is told apart by its NAME: `pom.xml`, `package.json`, and a `.yaml` /
+// `.yml` with an `info:` block (openapi.yaml). Anything else has no version
+// here: null, never a guess.
+
+import { readFile } from 'node:fs/promises';
+import { basename, isAbsolute, resolve, sep } from 'node:path';
+
+/**
+ * The project's own version in a pom: the first `<version>` OUTSIDE
+ * `<parent>`, which carries Spring Boot's, and outside `<dependencies>`,
+ * `<build>` and the rest, which carry their libraries'.
+ */
+export function pomVersion(pom) {
+  const top = pom
+    .replace(/<!--[\s\S]*?-->/g, '')
+    .replace(/<(parent|dependencies|dependencyManagement|build|profiles|properties)>[\s\S]*?<\/\1>/g, '');
+  const match = /<version>\s*([^<\s]+)\s*<\/version>/.exec(top);
+  return match ? match[1] : null;
+}
+
+/**
+ * `info.version` in openapi.yaml: a `version:` key directly under `info:`,
+ * at the block's own indentation: `info.description` is a block scalar
+ * with blank lines in it, and a deeper `version:` is somebody's schema.
+ */
+export function openapiVersion(yaml) {
+  const lines = yaml.split('\n');
+  const start = lines.findIndex((line) => /^info:\s*$/.test(line));
+  if (start === -1) return null;
+  let indent = null;
+  for (const line of lines.slice(start + 1)) {
+    if (!line.trim()) continue;
+    const own = /^(\s*)/.exec(line)[1].length;
+    if (own === 0) return null;
+    indent ??= own;
+    if (own !== indent) continue;
+    const match = /^\s*version:\s*['"]?([^'"\s]+)/.exec(line);
+    if (match) return match[1];
+  }
+  return null;
+}
+
+/** The top-level `version` of a package.json, or null (not JSON, no version). */
+export function packageJsonVersion(text) {
+  try {
+    const version = JSON.parse(text)?.version;
+    return typeof version === 'string' && version.trim() ? version.trim() : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The version `text` declares, by what `path` is called; null for a kind it does not know. */
+export function versionOf(path, text) {
+  const name = basename(String(path));
+  if (name === 'pom.xml') return pomVersion(text);
+  if (name === 'package.json') return packageJsonVersion(text);
+  if (/\.ya?ml$/i.test(name)) return openapiVersion(text);
+  return null;
+}
+
+/**
+ * The first declared file that yields a version: `{version, file}`, or null.
+ * `read(path)` returns the text, or throws for a file that is not there; both
+ * a throw and a non-string mean "not this one". Order is the project's.
+ */
+export async function firstVersion(files, read) {
+  for (const file of files ?? []) {
+    let text;
+    try { text = await read(file); } catch { continue; }
+    if (typeof text !== 'string') continue;
+    const version = versionOf(file, text);
+    if (version) return { version, file };
+  }
+  return null;
+}
+
+/**
+ * R587: the first of the project's declared version files that parses, read
+ * from the workspace: `{version, file}` or null. A file that is missing, does
+ * not parse, or would climb out of the checkout is skipped, never an error.
+ * Only a branch analysis has a new-code period of its own and never touches the
+ * project's gate; a MAIN analysis (`whenBranchesRefused: "main"`) is the one
+ * the version matters to, since SonarQube reads a versionless one as a change.
+ */
+export async function workspaceVersion(cwd, files) {
+  const root = resolve(cwd);
+  return firstVersion(files, async (file) => {
+    if (isAbsolute(file)) return null;
+    const path = resolve(root, file);
+    if (path !== root && !path.startsWith(`${root}${sep}`)) return null;
+    return readFile(path, 'utf8');
+  });
+}

package/mcp/server.mjs

@@ -2390,6 +2390,14 @@ function formatFileDeps(map, path) {
 /** How many finding lines a reading prints before saying "and N more" — R302. */
 const FINDING_LINES = 50;
 
+/** One failed gate condition, as SonarQube words it: `new_violations 1287 > 0`. A rating's step is its letter. */
+function describeCondition({ metric, comparator, threshold, actual }) {
+  const letter = (step) => ('12345'.includes(step) && step.length === 1 ? 'ABCDE'['12345'.indexOf(step)] : step);
+  if (metric.endsWith('_rating')) return `${metric} ${letter(actual)} worse than ${letter(threshold)}`;
+  const symbol = { GT: '>', LT: '<', EQ: '=', NE: '!=' }[comparator] ?? comparator;
+  return `${metric} ${actual} ${symbol} ${threshold}`;
+}
+
 /**
  * The reading as a session should read it — R302: one line for the default
  * branch, one for the branch asked about, then the open findings.
@@ -2415,6 +2423,12 @@ function formatQualityReading(reading, branch) {
     const parts = project.error
       ? [`the last read failed: ${project.error}`, `before that: gate ${project.gate ?? 'NONE'}`]
       : [`gate ${project.gate ?? 'NONE'}`];
+    // R587: which version was analysed, right after the verdict it belongs to.
+    if (project.analysedVersion) parts.push(`v${project.analysedVersion.replace(/^v/i, '')}`);
+    // R587: the conditions the gate failed on, the cause a session would otherwise guess at.
+    if (project.gateConditions?.length) {
+      parts.push(`failing: ${project.gateConditions.map(describeCondition).join(', ')}`);
+    }
     parts.push(
       `${count(project.bugs)} bugs`,
       `${count(project.vulnerabilities)} vulnerabilities`,
@@ -2423,6 +2437,7 @@ function formatQualityReading(reading, branch) {
       `coverage ${percent(project.coverage)}`,
     );
     if (project.analysedAt) parts.push(`analysed ${project.analysedAt}`);
+    if (project.newCodeSince) parts.push(`new code since ${project.newCodeSince}`);
     if (project.dashboardUrl) parts.push(project.dashboardUrl);
     lines.push(`Default branch: ${parts.join(' · ')}`);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cawdev-cli",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "cawdev's terminal client and runner daemon — zero dependencies, on purpose",
   "type": "module",
   "bin": {

package/runner/runner.mjs

@@ -30,6 +30,7 @@ import { bannerLines, tintLog } from './banner.mjs';
 import { codeMapOf } from '../lib/code-map.mjs';
 import { sonarqubeLaunch } from '../lib/sonarqube-mcp.mjs';
 import { parseProperties, sonarAsker, waitForAnalysis } from '../lib/sonar-analysis.mjs';
+import { workspaceVersion } from '../lib/version-files.mjs';
 import { usageLimitOf } from '../lib/usage-limit.mjs';
 import { TranscriptBatch } from '../lib/transcript-batch.mjs';
 import { parseUsage } from '../lib/usage-report.mjs';
@@ -2704,9 +2705,16 @@ async function scanQuality(config, run, cwd, branch) {
     workDir = await mkdtemp(join(tmpdir(), 'cawdev-sonar-'));
     const deadline = Date.now() + quality.timeoutSeconds * 1000;
     const remaining = () => Math.max(1000, deadline - Date.now());
+    // R587: the version the CODE at this checkout declares. Never a guess and
+    // never `git describe`: a version that moves per commit would move
+    // SonarQube's new-code baseline at every scan.
+    const found = await workspaceVersion(cwd, run.versionFiles);
+    const version = found?.version ?? null;
+    log(versionLogLine(found, run.versionFiles));
     const scannerArgs = (withBranch) => [
       `-Dsonar.host.url=${url}`,
       `-Dsonar.projectKey=${key}`,
+      ...(version ? [`-Dsonar.projectVersion=${version}`] : []),
       ...(withBranch ? [`-Dsonar.branch.name=${branch}`] : []),
       `-Dsonar.scm.revision=${headSha}`,
       `-Dsonar.working.directory=${workDir}`,
@@ -2727,7 +2735,7 @@ async function scanQuality(config, run, cwd, branch) {
         // function's own try/catch, which `return somePromise` would skip —
         // control leaves before the promise settles.
         return await scanAsScratchProject(
-          { quality, run, cwd, branch, key, url, token, headSha, workDir, deadline, report });
+          { quality, run, cwd, branch, key, url, token, headSha, workDir, deadline, report, version });
       }
       // 'main', and known refused: no reason to run the branch scan first.
       const ran = await runSkillCommand(quality.command, scannerArgs(false), { cwd, env, timeoutMs: remaining() });
@@ -2760,7 +2768,7 @@ async function scanQuality(config, run, cwd, branch) {
       if (/sonar\.branch\.name.*(Developer Edition|above is required)/is.test(ran.said)) {
         if (quality.whenBranchesRefused === 'project') {
           return await scanAsScratchProject(
-            { quality, run, cwd, branch, key, url, token, headSha, workDir, deadline, report });
+            { quality, run, cwd, branch, key, url, token, headSha, workDir, deadline, report, version });
         }
         if (quality.whenBranchesRefused !== 'main') {
           return report({
@@ -2868,7 +2876,14 @@ function shortHash(text) {
  * always `NONE`: a quality gate over a whole scratch project would judge
  * code this branch did not write.
  */
-async function scanAsScratchProject({ quality, run, cwd, branch, key, url, token, headSha, workDir, deadline, report }) {
+/** The one line the scan logs about its version: found, declared but empty, or never declared (R587). */
+function versionLogLine(found, declared) {
+  if (found) return `  quality: version ${found.version} (${found.file})`;
+  if (declared?.length > 0) return '  quality: no version found in the declared version files: scanned without a version';
+  return '  quality: no version file declared: scanned without a version';
+}
+
+async function scanAsScratchProject({ quality, run, cwd, branch, key, url, token, headSha, workDir, deadline, report, version = null }) {
   const baseName = run.baseBranch ?? run.defaultBranch ?? 'main';
   const ref = await firstRef(cwd, [`origin/${baseName}`, baseName]);
   const mergeBase = ref ? await git(cwd, ['merge-base', 'HEAD', ref]).catch(() => null) : null;
@@ -2882,6 +2897,7 @@ async function scanAsScratchProject({ quality, run, cwd, branch, key, url, token
     `-Dsonar.host.url=${url}`,
     `-Dsonar.projectKey=${scratchKey}`,
     `-Dsonar.projectName=${key} · ${branch}`,
+    ...(version ? [`-Dsonar.projectVersion=${version}`] : []),
     `-Dsonar.scm.revision=${headSha}`,
     `-Dsonar.working.directory=${workDir}`,
   ];
@@ -6858,6 +6874,9 @@ async function startRun(config, offered, workspace, source = null) {
     // R316. Whether the project SAYS its server refuses branches — null is
     // "not sure, try the branch scan first", today's behaviour.
     run.sonarBranches = claimed.sonarBranches ?? null;
+    // R587. The project's declared version files: the scan reads the first it
+    // can parse from the workspace and sends it as sonar.projectVersion.
+    run.versionFiles = Array.isArray(claimed.versionFiles) ? claimed.versionFiles : [];
     // R69. Whether this is the same conversation picked back up, and which one.
     // Null on an ordinary claim, which is nearly all of them.
     resume = claimed.resume ?? null;