filegrc 0.16.20 → 0.16.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.16.20",
+  "version": "0.16.22",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/retention.js

@@ -167,16 +167,17 @@ export async function resourceReviewRevisions(loaded, ids, scopeHashInput = "leg
     const entry = effectiveReviewEntry(loaded, entries.get(id));
     if (!entry || reviewing.has(key)) return null;
     reviewing.add(key);
-    const parts = [reviewSource(loaded, entry, scopeHashInput, false, heading, reviewer)];
-    let matchedSection = !heading;
-    for (const markdown of reviewMarkdownEntries(loaded, entry, false)) {
+    const decisionHeading = heading || retentionPolicyHeading(loaded, entry, reviewer);
+    const parts = [reviewSource(loaded, entry, scopeHashInput, false, decisionHeading, reviewer)];
+    let matchedSection = !decisionHeading;
+    for (const markdown of reviewMarkdownEntries(loaded, entry, false, reviewer)) {
       try {
         const source = entry.reviewCommit
           ? entry.reviewFiles?.get(`data/${markdown.path}`)
             ?? getFileAtRevision(loaded.root, entry.reviewCommit, `data/${markdown.path}`)
           : await readFile(resolveDataPath(loaded.root, markdown.path), "utf8");
         if (source !== null) {
-          const section = reviewedMarkdownSection(source, heading);
+          const section = reviewedMarkdownSection(source, decisionHeading);
           if (section !== null) { parts.push(section); matchedSection = true; }
         }
       } catch (error) {
@@ -214,9 +215,10 @@ export function resourceReviewRevisionsSync(loaded, ids, scopeHashInput = "legac
     const entry = historicalCommit ? entries.get(id) : effectiveReviewEntry(loaded, entries.get(id));
     if (!entry || reviewing.has(key)) return null;
     reviewing.add(key);
-    const parts = [reviewSource(loaded, entry, scopeHashInput, legacySource, heading, reviewer)];
-    let matchedSection = !heading;
-    for (const markdown of reviewMarkdownEntries(loaded, entry, legacySource)) {
+    const decisionHeading = legacySource ? heading : heading || retentionPolicyHeading(loaded, entry, reviewer);
+    const parts = [reviewSource(loaded, entry, scopeHashInput, legacySource, decisionHeading, reviewer)];
+    let matchedSection = !decisionHeading;
+    for (const markdown of reviewMarkdownEntries(loaded, entry, legacySource, reviewer)) {
       try {
         const source = (historicalCommit || entry.reviewCommit)
           ? loaded.historicalFiles?.get(`data/${markdown.path}`)
@@ -224,7 +226,7 @@ export function resourceReviewRevisionsSync(loaded, ids, scopeHashInput = "legac
             ?? getFileAtRevision(loaded.root, historicalCommit || entry.reviewCommit, `data/${markdown.path}`)
           : readFileSync(resolveDataPath(loaded.root, markdown.path), "utf8");
         if (source !== null) {
-          const section = legacySource ? source : reviewedMarkdownSection(source, heading);
+          const section = legacySource ? source : reviewedMarkdownSection(source, decisionHeading);
           if (section !== null) { parts.push(section); matchedSection = true; }
         }
       } catch (error) {
@@ -368,11 +370,16 @@ function reviewSource(loaded, entry, scopeHashInput = "legacy", legacySource = f
     )), scopeHashInput);
 }
 
-function reviewMarkdownEntries(loaded, entry, legacySource) {
+function reviewMarkdownEntries(loaded, entry, legacySource, reviewer = null) {
   // Control Markdown records the implementation procedure. Retention and
   // mapping decisions depend on the structured Control design instead.
   if (!legacySource && modelSupports(loaded.model, "retention-schedule-approval")
     && entry.record.type === "control") return [];
+  // A Component's Markdown explains how to retrieve evidence. Retention
+  // decisions depend on its information uses and scope, not those steps.
+  // Keep the Markdown in legacy hashes so committed approvals can be found.
+  if (!legacySource && reviewer?.type === "retention-schedule-item"
+    && entry.record.type === "component") return [];
   return markdownEntries(loaded.model, entry.record);
 }
 
@@ -460,6 +467,32 @@ function sourceHeading(record, sourceId) {
     ? headings[sourceId] : null;
 }
 
+function retentionPolicyHeading(loaded, entry, reviewer) {
+  if (reviewer?.type !== "retention-schedule-item" || entry.record.type !== "policy") return null;
+  // Older rows often bind a whole Policy. A single retention section gives
+  // that decision a narrower basis while an explicit heading still wins.
+  const headings = new Set();
+  for (const markdown of markdownEntries(loaded.model, entry.record)) {
+    let source;
+    try {
+      source = loaded.historicalFiles?.get(`data/${markdown.path}`)
+        ?? (entry.reviewCommit
+          ? entry.reviewFiles?.get(`data/${markdown.path}`)
+            ?? getFileAtRevision(loaded.root, entry.reviewCommit, `data/${markdown.path}`)
+          : readFileSync(resolveDataPath(loaded.root, markdown.path), "utf8"));
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      throw error;
+    }
+    for (const line of (source || "").split("\n")) {
+      const heading = /^#{2,6}\s+(.+?)\s*#*\s*$/.exec(line)?.[1];
+      if (heading && /\b(retention|disposal|deletion|destruction|archiving)\b/i.test(heading)
+        && reviewedMarkdownSection(source, heading) !== null) headings.add(heading);
+    }
+  }
+  return headings.size === 1 ? [...headings][0] : null;
+}
+
 const reviewDecisionFields = {
   control: ["statement", "requirementIds", "code", "activity", "controlType", "operationMode", "operationPattern", "systemIds", "policyIds", "componentIds", "evidenceSourceComponentIds"],
   commitment: ["commitmentKind", "statement", "systemIds", "sourceResourceIds", "sourceSectionHeadings", "requirementIds", "controlIds", "customerFacing", "effectiveOn", "reportingRouteRequirements"],
@@ -489,6 +522,7 @@ function substantiveReviewSource(record, currentModel, reviewer = null) {
     }
     if (record.type === "component" && reviewer?.type === "retention-schedule-item") {
       decision.systemUses = retentionSystemUses(decision.systemUses);
+      delete decision.evidenceSourceKinds;
     }
     if (["control", "commitment", "complementary-control"].includes(record.type)) {
       decision.nonApplicableDecision = ["not-applicable", "externally-managed", "zero-population"]

package/src/workflow.js

@@ -1,6 +1,6 @@
-import { cp, mkdtemp, rm } from "node:fs/promises";
+import { cp, mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, relative } from "node:path";
 import { modelSupports } from "../model/index.js";
 import { buildActionContext } from "./action-context.js";
 import { applicabilityReviewIsCurrent, applicabilityScopeRevision } from "./applicability-scope.js";
@@ -14,7 +14,7 @@ import {
   deleteResource,
   updateResource
 } from "./files.js";
-import { getGitSummary, getWorkspaceHistories } from "./git.js";
+import { getGitSummary, getWorkspaceHistories, runGitCommandSync } from "./git.js";
 import {
   completeObligationAction,
   completeObligationEvent,
@@ -260,13 +260,39 @@ function contextualAction(item, loaded) {
 
 export async function previewWorkflowMutation(input, mutation) {
   const loaded = await loadWorkspace(input);
-  const previewRoot = await mkdtemp(join(tmpdir(), "filegrc-workflow-preview-"));
+  const previewCheckout = await mkdtemp(join(tmpdir(), "filegrc-workflow-preview-"));
   try {
+    const repository = getGitSummary(loaded.root);
+    if (repository.available) {
+      // Legacy review bindings need committed source versions. A local clone
+      // gives preview the same history as update without touching the source.
+      runGitCommandSync(loaded.root, ["clone", "--shared", "--no-checkout", "--quiet", repository.root, previewCheckout], {
+        timeoutMs: 30_000
+      });
+    }
+    const previewRoot = repository.available
+      ? join(previewCheckout, relative(repository.root, loaded.root))
+      : previewCheckout;
+    await mkdir(previewRoot, { recursive: true });
+    if (repository.commit) {
+      // Restore the index and tracked workspace files. A no-checkout clone
+      // otherwise reports every source file as deleted and copied data as new.
+      runGitCommandSync(loaded.root, ["-C", previewCheckout, "reset", "--mixed", "HEAD"]);
+      if (runGitCommandSync(loaded.root, ["-C", previewRoot, "ls-files", "--", "."])) {
+        runGitCommandSync(loaded.root, ["-C", previewRoot, "restore", "--worktree", "--", "."]);
+      }
+    }
+    await rm(join(previewRoot, "data"), { recursive: true, force: true });
     await cp(join(loaded.root, "data"), join(previewRoot, "data"), {
       recursive: true,
       errorOnExist: true,
       force: false
     });
+    if (repository.available && !repository.clean && getGitSummary(previewRoot).clean) {
+      const marker = join(previewRoot, "preview-source-dirty.marker");
+      await writeFile(marker, "The source workspace has uncommitted files.\n");
+      runGitCommandSync(loaded.root, ["-C", previewRoot, "add", "-N", "-f", "--", "preview-source-dirty.marker"]);
+    }
     const before = await assessWorkflow(loaded.root, mutation?.assessment || {});
     const record = mutation?.record;
     const existing = record?.id
@@ -307,7 +333,7 @@ export async function previewWorkflowMutation(input, mutation) {
       workflow: after
     };
   } finally {
-    await rm(previewRoot, { recursive: true, force: true });
+    await rm(previewCheckout, { recursive: true, force: true });
   }
 }