forge-workflow 0.0.4 → 0.0.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (248) hide show
  1. package/.claude/commands/dev.md +345 -340
  2. package/.claude/commands/plan.md +566 -521
  3. package/.claude/commands/premerge.md +186 -176
  4. package/.claude/commands/research.md +42 -42
  5. package/.claude/commands/review.md +448 -442
  6. package/.claude/commands/rollback.md +721 -721
  7. package/.claude/commands/ship.md +212 -164
  8. package/.claude/commands/sonarcloud.md +152 -152
  9. package/.claude/commands/status.md +90 -48
  10. package/.claude/commands/validate.md +288 -282
  11. package/.claude/commands/verify.md +269 -221
  12. package/.claude/rules/greptile-review-process.md +285 -285
  13. package/.claude/rules/workflow.md +121 -105
  14. package/.claude/scripts/greptile-resolve.sh +558 -526
  15. package/.claude/scripts/load-env.sh +32 -32
  16. package/.cline/workflows/dev.md +342 -337
  17. package/.cline/workflows/plan.md +563 -518
  18. package/.cline/workflows/premerge.md +183 -173
  19. package/.cline/workflows/research.md +39 -39
  20. package/.cline/workflows/review.md +445 -439
  21. package/.cline/workflows/rollback.md +718 -718
  22. package/.cline/workflows/ship.md +209 -161
  23. package/.cline/workflows/sonarcloud.md +146 -146
  24. package/.cline/workflows/status.md +87 -45
  25. package/.cline/workflows/validate.md +285 -279
  26. package/.cline/workflows/verify.md +266 -218
  27. package/.codex/config.toml +11 -11
  28. package/.codex/skills/dev/SKILL.md +345 -340
  29. package/.codex/skills/plan/SKILL.md +566 -521
  30. package/.codex/skills/premerge/SKILL.md +186 -176
  31. package/.codex/skills/research/SKILL.md +42 -42
  32. package/.codex/skills/review/SKILL.md +448 -442
  33. package/.codex/skills/rollback/SKILL.md +721 -721
  34. package/.codex/skills/ship/SKILL.md +212 -164
  35. package/.codex/skills/sonarcloud/SKILL.md +149 -149
  36. package/.codex/skills/status/SKILL.md +90 -48
  37. package/.codex/skills/validate/SKILL.md +288 -282
  38. package/.codex/skills/verify/SKILL.md +269 -221
  39. package/.cursor/commands/dev.md +342 -337
  40. package/.cursor/commands/plan.md +563 -518
  41. package/.cursor/commands/premerge.md +183 -173
  42. package/.cursor/commands/research.md +39 -39
  43. package/.cursor/commands/review.md +445 -439
  44. package/.cursor/commands/rollback.md +718 -718
  45. package/.cursor/commands/ship.md +209 -161
  46. package/.cursor/commands/sonarcloud.md +146 -146
  47. package/.cursor/commands/status.md +87 -45
  48. package/.cursor/commands/validate.md +285 -279
  49. package/.cursor/commands/verify.md +266 -218
  50. package/.cursor/rules/permissions-guidance.mdc +37 -37
  51. package/.forge/hooks/check-tdd.js +240 -240
  52. package/.github/PLUGIN_TEMPLATE.json +32 -32
  53. package/.github/prompts/dev.prompt.md +347 -342
  54. package/.github/prompts/plan.prompt.md +568 -523
  55. package/.github/prompts/premerge.prompt.md +188 -178
  56. package/.github/prompts/research.prompt.md +44 -44
  57. package/.github/prompts/review.prompt.md +450 -444
  58. package/.github/prompts/rollback.prompt.md +723 -723
  59. package/.github/prompts/ship.prompt.md +214 -166
  60. package/.github/prompts/sonarcloud.prompt.md +151 -151
  61. package/.github/prompts/status.prompt.md +92 -50
  62. package/.github/prompts/validate.prompt.md +290 -284
  63. package/.github/prompts/verify.prompt.md +271 -223
  64. package/.github/workflows/beads-to-github.yml +56 -0
  65. package/.github/workflows/github-to-beads.yml +97 -0
  66. package/.kilocode/workflows/dev.md +346 -341
  67. package/.kilocode/workflows/plan.md +567 -522
  68. package/.kilocode/workflows/premerge.md +187 -177
  69. package/.kilocode/workflows/research.md +43 -43
  70. package/.kilocode/workflows/review.md +449 -443
  71. package/.kilocode/workflows/rollback.md +722 -722
  72. package/.kilocode/workflows/ship.md +213 -165
  73. package/.kilocode/workflows/sonarcloud.md +150 -150
  74. package/.kilocode/workflows/status.md +91 -49
  75. package/.kilocode/workflows/validate.md +289 -283
  76. package/.kilocode/workflows/verify.md +270 -222
  77. package/.mcp.json.example +12 -12
  78. package/.opencode/commands/dev.md +345 -340
  79. package/.opencode/commands/plan.md +566 -521
  80. package/.opencode/commands/premerge.md +186 -176
  81. package/.opencode/commands/research.md +42 -42
  82. package/.opencode/commands/review.md +448 -442
  83. package/.opencode/commands/rollback.md +721 -721
  84. package/.opencode/commands/ship.md +212 -164
  85. package/.opencode/commands/sonarcloud.md +149 -149
  86. package/.opencode/commands/status.md +90 -48
  87. package/.opencode/commands/validate.md +288 -282
  88. package/.opencode/commands/verify.md +269 -221
  89. package/.roo/commands/dev.md +346 -341
  90. package/.roo/commands/plan.md +567 -522
  91. package/.roo/commands/premerge.md +187 -177
  92. package/.roo/commands/research.md +43 -43
  93. package/.roo/commands/review.md +449 -443
  94. package/.roo/commands/rollback.md +722 -722
  95. package/.roo/commands/ship.md +213 -165
  96. package/.roo/commands/sonarcloud.md +150 -150
  97. package/.roo/commands/status.md +91 -49
  98. package/.roo/commands/validate.md +289 -283
  99. package/.roo/commands/verify.md +270 -222
  100. package/AGENTS.md +272 -175
  101. package/CLAUDE.md +110 -100
  102. package/README.md +429 -416
  103. package/bin/forge-cmd.js +317 -313
  104. package/bin/forge-preflight.js +322 -309
  105. package/bin/forge.js +4765 -4303
  106. package/docs/AGENT_INSTALL_PROMPT.md +342 -342
  107. package/docs/BEADS_GITHUB_SYNC.md +251 -251
  108. package/docs/ENHANCED_ONBOARDING.md +612 -602
  109. package/docs/EXAMPLES.md +482 -482
  110. package/docs/GREPTILE_SETUP.md +400 -400
  111. package/docs/MANUAL_REVIEW_GUIDE.md +106 -106
  112. package/docs/ROADMAP.md +359 -359
  113. package/docs/SETUP.md +663 -631
  114. package/docs/TOOLCHAIN.md +653 -630
  115. package/docs/VALIDATION.md +363 -363
  116. package/install.sh +40 -1056
  117. package/lefthook.yml +50 -39
  118. package/lib/agents/README.md +198 -198
  119. package/lib/agents/claude.plugin.json +28 -28
  120. package/lib/agents/cline.plugin.json +22 -22
  121. package/lib/agents/codex.plugin.json +19 -19
  122. package/lib/agents/copilot.plugin.json +24 -24
  123. package/lib/agents/cursor.plugin.json +25 -25
  124. package/lib/agents/kilocode.plugin.json +22 -22
  125. package/lib/agents/opencode.plugin.json +20 -20
  126. package/lib/agents/roo.plugin.json +23 -23
  127. package/lib/agents-config.js +2112 -2112
  128. package/lib/beads-health-check.js +143 -0
  129. package/lib/beads-setup.js +341 -0
  130. package/lib/beads-sync-scaffold.js +260 -0
  131. package/lib/commands/_registry.js +134 -0
  132. package/lib/commands/clean.js +181 -0
  133. package/lib/commands/dev.js +571 -513
  134. package/lib/commands/plan.js +692 -692
  135. package/lib/commands/push.js +196 -0
  136. package/lib/commands/recommend.js +119 -119
  137. package/lib/commands/ship.js +377 -377
  138. package/lib/commands/status.js +378 -378
  139. package/lib/commands/sync.js +55 -0
  140. package/lib/commands/team.js +37 -0
  141. package/lib/commands/test.js +207 -0
  142. package/lib/commands/validate.js +602 -602
  143. package/lib/commands/worktree.js +310 -0
  144. package/lib/context-merge.js +359 -359
  145. package/lib/dep-guard/analyzer.js +294 -294
  146. package/lib/dep-guard/behavior-detector.js +98 -98
  147. package/lib/dep-guard/contract-detector.js +162 -162
  148. package/lib/dep-guard/import-detector.js +498 -498
  149. package/lib/dep-guard/path-utils.js +13 -13
  150. package/lib/dep-guard/rubric.js +120 -120
  151. package/lib/dep-guard/task-parser.js +318 -318
  152. package/lib/detect-agent.js +191 -191
  153. package/lib/detect-worktree.js +47 -47
  154. package/lib/docs-command.js +51 -0
  155. package/lib/docs-copy.js +50 -0
  156. package/lib/file-hash.js +26 -26
  157. package/lib/freshness-token.js +148 -0
  158. package/lib/greptile-match.js +80 -0
  159. package/lib/husky-migration.js +450 -0
  160. package/lib/lefthook-check.js +65 -0
  161. package/lib/pat-setup.js +207 -0
  162. package/lib/plugin-catalog.js +350 -350
  163. package/lib/plugin-manager.js +166 -166
  164. package/lib/plugin-recommender.js +141 -141
  165. package/lib/project-discovery.js +491 -491
  166. package/lib/reset.js +309 -0
  167. package/lib/setup-action-log.js +139 -139
  168. package/lib/setup-summary-renderer.js +106 -106
  169. package/lib/setup-utils.js +96 -0
  170. package/lib/setup.js +192 -192
  171. package/lib/smart-merge.js +64 -0
  172. package/lib/symlink-utils.js +81 -0
  173. package/lib/task-ownership.js +117 -0
  174. package/lib/workflow-profiles.js +197 -197
  175. package/package.json +131 -128
  176. package/scripts/beads-context.sh +426 -0
  177. package/scripts/beads-context.test.js +567 -0
  178. package/scripts/behavioral-judge.sh +378 -0
  179. package/scripts/benchmark.js +85 -0
  180. package/scripts/branch-protection.js +183 -0
  181. package/scripts/check-agents.js +172 -0
  182. package/scripts/check-forge-token.js +98 -0
  183. package/scripts/commitlint.js +42 -0
  184. package/scripts/conflict-detect.sh +323 -0
  185. package/scripts/dep-guard-analyze.js +71 -0
  186. package/scripts/dep-guard.sh +789 -0
  187. package/scripts/eval_win.py +249 -0
  188. package/scripts/file-index.sh +493 -0
  189. package/scripts/forge-team/index.sh +86 -0
  190. package/scripts/forge-team/lib/agent-prompt.sh +52 -0
  191. package/scripts/forge-team/lib/claim.sh +256 -0
  192. package/scripts/forge-team/lib/dashboard.sh +341 -0
  193. package/scripts/forge-team/lib/epic.sh +332 -0
  194. package/scripts/forge-team/lib/hooks.sh +253 -0
  195. package/scripts/forge-team/lib/identity.sh +235 -0
  196. package/scripts/forge-team/lib/sync-github.sh +317 -0
  197. package/scripts/forge-team/lib/verify.sh +284 -0
  198. package/scripts/forge-team/lib/workload.sh +296 -0
  199. package/scripts/forge-team/tests/agent-prompt.test.sh +72 -0
  200. package/scripts/forge-team/tests/claim.test.sh +179 -0
  201. package/scripts/forge-team/tests/dashboard.test.sh +170 -0
  202. package/scripts/forge-team/tests/dispatcher.test.sh +79 -0
  203. package/scripts/forge-team/tests/epic.test.sh +176 -0
  204. package/scripts/forge-team/tests/hooks.test.sh +239 -0
  205. package/scripts/forge-team/tests/identity.test.sh +176 -0
  206. package/scripts/forge-team/tests/integration.test.sh +371 -0
  207. package/scripts/forge-team/tests/sync-github.test.sh +209 -0
  208. package/scripts/forge-team/tests/verify.test.sh +314 -0
  209. package/scripts/forge-team/tests/workflow-integration.test.sh +43 -0
  210. package/scripts/forge-team/tests/workload.test.sh +209 -0
  211. package/scripts/github-beads-sync/comment.mjs +64 -0
  212. package/scripts/github-beads-sync/config.mjs +148 -0
  213. package/scripts/github-beads-sync/github-api.mjs +131 -0
  214. package/scripts/github-beads-sync/index.mjs +332 -0
  215. package/scripts/github-beads-sync/label-mapper.mjs +54 -0
  216. package/scripts/github-beads-sync/mapping.mjs +78 -0
  217. package/scripts/github-beads-sync/reverse-sync-cli.mjs +31 -0
  218. package/scripts/github-beads-sync/reverse-sync.mjs +138 -0
  219. package/scripts/github-beads-sync/run-bd.mjs +159 -0
  220. package/scripts/github-beads-sync/sanitize.mjs +121 -0
  221. package/scripts/github-beads-sync.config.json +26 -0
  222. package/scripts/improve-command.js +375 -0
  223. package/scripts/lib/eval-runner.js +268 -0
  224. package/scripts/lib/eval-schema.js +135 -0
  225. package/scripts/lib/eval-storage.js +78 -0
  226. package/scripts/lib/grading.js +203 -0
  227. package/scripts/lib/jsonl-lock.sh +48 -0
  228. package/scripts/lib/sanitize.sh +116 -0
  229. package/scripts/lib/transcript-parser.js +63 -0
  230. package/scripts/lint.js +47 -0
  231. package/scripts/migrate-to-bun-test.js +412 -0
  232. package/scripts/pr-coordinator.sh +706 -0
  233. package/scripts/run-command-eval.js +236 -0
  234. package/scripts/smart-status.sh +809 -0
  235. package/scripts/sync-commands.js +571 -0
  236. package/scripts/sync-utils.sh +455 -0
  237. package/scripts/test-dashboard.js +123 -0
  238. package/scripts/test.js +46 -0
  239. package/scripts/validate.sh +94 -0
  240. package/skills/parallel-deep-research/SKILL.md +108 -108
  241. package/skills/parallel-deep-research/evals/README.md +27 -27
  242. package/skills/parallel-deep-research/evals/evals.json +62 -62
  243. package/skills/sonarcloud-analysis/SKILL.md +171 -171
  244. package/skills/sonarcloud-analysis/evals/README.md +27 -27
  245. package/skills/sonarcloud-analysis/evals/evals.json +50 -50
  246. package/skills/sonarcloud-analysis/references/api-reference.md +466 -466
  247. package/.cursor/hooks/state/continual-learning-index.json +0 -19
  248. package/.cursor/hooks/state/continual-learning.json +0 -8
@@ -0,0 +1,148 @@
1
+ /**
2
+ * Freshness Token — Validate/Ship stage freshness state
3
+ *
4
+ * Tracks whether `main` has moved forward since /validate ran,
5
+ * so /ship can warn if validation results are stale.
6
+ *
7
+ * Token file: `<projectRoot>/.forge-freshness` (ephemeral, gitignored)
8
+ *
9
+ * @module freshness-token
10
+ */
11
+
12
+ const fs = require('node:fs');
13
+ const path = require('node:path');
14
+ const { execFileSync } = require('node:child_process');
15
+
16
+ const TOKEN_FILENAME = '.forge-freshness';
17
+
18
+ /**
19
+ * Get the current git branch name.
20
+ * @param {string} projectRoot - Absolute path to the project root.
21
+ * @returns {string} Current branch name.
22
+ */
23
+ function getCurrentBranch(projectRoot) {
24
+ // Safe: execFileSync with array args prevents injection (OWASP A03). PATH is OS-controlled.
25
+ return execFileSync('git', ['-C', projectRoot, 'rev-parse', '--abbrev-ref', 'HEAD'], {
26
+ encoding: 'utf8'
27
+ }).trim();
28
+ }
29
+
30
+ /**
31
+ * Detect the default branch (main, master, develop, trunk).
32
+ * @param {string} projectRoot - Absolute path to the project root.
33
+ * @returns {string} Default branch name.
34
+ */
35
+ function getDefaultBranch(projectRoot) {
36
+ try {
37
+ // Safe: execFileSync with array args prevents injection (OWASP A03). PATH is OS-controlled.
38
+ return execFileSync('git', ['-C', projectRoot, 'rev-parse', '--abbrev-ref', 'origin/HEAD'], {
39
+ encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe']
40
+ }).trim().replace('origin/', '');
41
+ } catch (_e) { /* intentional: origin/HEAD not set, probe common branch names */ // NOSONAR S2486
42
+ for (const name of ['main', 'master', 'develop', 'trunk']) {
43
+ try {
44
+ // Safe: execFileSync with array args prevents injection (OWASP A03). PATH is OS-controlled.
45
+ execFileSync('git', ['-C', projectRoot, 'rev-parse', '--verify', name], { stdio: 'pipe' });
46
+ return name;
47
+ } catch (_e2) { /* intentional: branch doesn't exist, try next name */ } // NOSONAR S2486
48
+ }
49
+ return 'main';
50
+ }
51
+ }
52
+
53
+ /**
54
+ * Get the merge-base commit between HEAD and the default branch.
55
+ * @param {string} projectRoot - Absolute path to the project root.
56
+ * @returns {string} The merge-base commit SHA.
57
+ * @throws {Error} If git merge-base fails (no common ancestor, detached HEAD, etc.)
58
+ */
59
+ function getMergeBase(projectRoot) {
60
+ const base = getDefaultBranch(projectRoot);
61
+ try {
62
+ // Safe: execFileSync with array args prevents injection (OWASP A03). PATH is OS-controlled.
63
+ return execFileSync('git', ['-C', projectRoot, 'merge-base', 'HEAD', base], {
64
+ encoding: 'utf8',
65
+ stdio: ['pipe', 'pipe', 'pipe']
66
+ }).trim();
67
+ } catch (err) {
68
+ throw new Error(
69
+ `Failed to compute merge-base for HEAD and ${base} in "${projectRoot}": ${err.message}`
70
+ );
71
+ }
72
+ }
73
+
74
+ /**
75
+ * Write a freshness token to `<projectRoot>/.forge-freshness`.
76
+ *
77
+ * Records the current branch, base commit (merge-base HEAD main),
78
+ * and a timestamp so /ship can detect if validation is stale.
79
+ *
80
+ * @param {string} projectRoot - Absolute path to the project root.
81
+ * @returns {{ timestamp: number, branch: string, baseCommit: string }} The written token.
82
+ * @throws {Error} If git merge-base fails (no common ancestor, detached HEAD, etc.)
83
+ */
84
+ function writeFreshnessToken(projectRoot) {
85
+ const branch = getCurrentBranch(projectRoot);
86
+ const baseCommit = getMergeBase(projectRoot);
87
+
88
+ const token = {
89
+ timestamp: Date.now(),
90
+ branch,
91
+ baseCommit
92
+ };
93
+
94
+ const tokenPath = path.join(projectRoot, TOKEN_FILENAME);
95
+ fs.writeFileSync(tokenPath, JSON.stringify(token, null, 2), 'utf8');
96
+
97
+ return token;
98
+ }
99
+
100
+ /**
101
+ * Read and parse the freshness token from `<projectRoot>/.forge-freshness`.
102
+ *
103
+ * @param {string} projectRoot - Absolute path to the project root.
104
+ * @returns {{ timestamp: number, branch: string, baseCommit: string } | null}
105
+ * The token object, or null if the file is missing or corrupted.
106
+ */
107
+ function readFreshnessToken(projectRoot) {
108
+ const tokenPath = path.join(projectRoot, TOKEN_FILENAME);
109
+
110
+ try {
111
+ const content = fs.readFileSync(tokenPath, 'utf8');
112
+ return JSON.parse(content);
113
+ } catch (_err) { /* intentional: missing file (ENOENT), corrupted JSON, or empty file — return null */ // NOSONAR S2486
114
+ return null;
115
+ }
116
+ }
117
+
118
+ /**
119
+ * Check if a freshness token is stale.
120
+ *
121
+ * A token is stale when:
122
+ * - It is null (missing or corrupted)
123
+ * - The current merge-base differs from the token's baseCommit
124
+ * (meaning main has moved forward since validation)
125
+ * - git merge-base fails (can't verify freshness)
126
+ *
127
+ * @param {{ timestamp: number, branch: string, baseCommit: string } | null} token
128
+ * @param {string} projectRoot - Absolute path to the project root.
129
+ * @returns {boolean} True if validation results are stale and should be re-run.
130
+ */
131
+ function isStale(token, projectRoot) {
132
+ if (token === null) {
133
+ return true;
134
+ }
135
+
136
+ try {
137
+ const currentBase = getMergeBase(projectRoot);
138
+ return currentBase !== token.baseCommit;
139
+ } catch (_err) { /* intentional: merge-base failed, treat as stale since freshness can't be verified */ // NOSONAR S2486
140
+ return true;
141
+ }
142
+ }
143
+
144
+ module.exports = {
145
+ writeFreshnessToken,
146
+ readFreshnessToken,
147
+ isStale
148
+ };
@@ -0,0 +1,80 @@
1
+ 'use strict';
2
+
3
+ const { execFileSync } = require('node:child_process');
4
+
5
+ /**
6
+ * Match unresolved review threads to recent commits that touched the same files.
7
+ *
8
+ * For each thread, runs `git log --oneline --follow -- <file>` to find
9
+ * recent commits. If a commit exists, the thread is considered resolved
10
+ * (the file was modified after the review comment).
11
+ *
12
+ * Uses execFileSync (not exec) to prevent shell injection (OWASP A03).
13
+ *
14
+ * @param {Array<{file: string, line: number}>} threads - Review threads with file paths
15
+ * @param {string} projectRoot - Absolute path to the project root (used with git -C)
16
+ * @param {object} [opts] - Options
17
+ * @param {Function} [opts._exec] - Injected exec function for testing (defaults to execFileSync)
18
+ * @param {string} [opts.sinceCommit] - Merge-base SHA to restrict log to PR commits only
19
+ * @returns {Array<{file: string, line: number, resolved: boolean, sha?: string, reason?: string}>}
20
+ */
21
+ function matchThreadsToCommits(threads, projectRoot, opts = {}) {
22
+ if (!threads || threads.length === 0) {
23
+ return [];
24
+ }
25
+
26
+ const exec = opts._exec || ((cmd, args) => {
27
+ return execFileSync(cmd, args, { encoding: 'utf8' });
28
+ });
29
+
30
+ // Determine commit range — restrict to PR commits when sinceCommit provided
31
+ let sinceCommit = opts.sinceCommit;
32
+ if (!sinceCommit) {
33
+ try {
34
+ sinceCommit = exec('git', ['-C', projectRoot, 'merge-base', 'HEAD', 'main']).trim();
35
+ } catch (_e) { // NOSONAR S2486
36
+ /* intentional: main branch not found, try master instead */
37
+ try {
38
+ sinceCommit = exec('git', ['-C', projectRoot, 'merge-base', 'HEAD', 'master']).trim();
39
+ } catch (_e2) { /* intentional: no merge-base available, fall back to unbounded log */ // NOSONAR S2486
40
+ sinceCommit = null;
41
+ }
42
+ }
43
+ }
44
+
45
+ return threads.map((thread) => {
46
+ const { file, line } = thread;
47
+
48
+ try {
49
+ const logArgs = [
50
+ '-C', projectRoot,
51
+ 'log',
52
+ '--oneline',
53
+ '--follow',
54
+ ];
55
+ if (sinceCommit) {
56
+ logArgs.push(`${sinceCommit}..HEAD`);
57
+ }
58
+ logArgs.push('--', file);
59
+
60
+ const output = exec('git', logArgs);
61
+
62
+ const trimmed = (output || '').trim();
63
+
64
+ if (!trimmed) {
65
+ return { file, line, resolved: false, reason: 'no matching commit' };
66
+ }
67
+
68
+ // git log --oneline format: "<sha> <message>"
69
+ // Take the first (most recent) line
70
+ const firstLine = trimmed.split('\n')[0];
71
+ const sha = firstLine.split(' ')[0];
72
+
73
+ return { file, line, resolved: true, sha };
74
+ } catch (_err) { /* intentional: git log failed (file missing or git unavailable), mark unresolved */ // NOSONAR S2486
75
+ return { file, line, resolved: false, reason: 'no matching commit' };
76
+ }
77
+ });
78
+ }
79
+
80
+ module.exports = { matchThreadsToCommits };
@@ -0,0 +1,450 @@
1
+ /**
2
+ * Husky detection and automated migration to Lefthook.
3
+ *
4
+ * Detects existing Husky installations, maps hook scripts to Lefthook format,
5
+ * and orchestrates a safe migration with symlink validation (OWASP A08).
6
+ *
7
+ * @module lib/husky-migration
8
+ */
9
+
10
+ const fs = require('node:fs');
11
+ const path = require('node:path');
12
+ const { execFileSync, spawnSync } = require('node:child_process');
13
+
14
+ /**
15
+ * Resolve a command to its full path to avoid relying on inherited PATH.
16
+ * Falls back to the command name if resolution fails.
17
+ * @param {string} command
18
+ * @returns {string}
19
+ */
20
+ function resolveCommand(command) {
21
+ const resolver = process.platform === 'win32' ? 'where.exe' : 'which';
22
+ try {
23
+ const result = spawnSync(resolver, [command], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
24
+ if (result.status === 0 && result.stdout) {
25
+ return result.stdout.trim().split(/\r?\n/)[0].trim();
26
+ }
27
+ } catch (_e) {
28
+ // Expected: command resolution may fail if 'which'/'where.exe' is unavailable — fall back to bare command name
29
+ }
30
+ return command;
31
+ }
32
+
33
+ /**
34
+ * Known hook-command patterns that can be auto-mapped to Lefthook.
35
+ * Each entry: { pattern: RegExp, name: string|function, run: string|function }
36
+ *
37
+ * @type {Array<{pattern: RegExp, name: string|((m: RegExpMatchArray) => string), run: string|((m: RegExpMatchArray) => string)}>}
38
+ */
39
+ const KNOWN_PATTERNS = [
40
+ {
41
+ pattern: /^npx\s+lint-staged$/m,
42
+ name: 'lint-staged',
43
+ run: 'npx lint-staged',
44
+ },
45
+ {
46
+ pattern: /^npx\s+(?:--no\s+--\s+)?commitlint\s+--edit\s+\$\{?1\}?$/m,
47
+ name: 'commitlint',
48
+ run: 'npx --no -- commitlint --edit {1}',
49
+ },
50
+ {
51
+ // npm run <script>, yarn run <script>, bun run <script>, pnpm run <script>
52
+ pattern: /^(npm|yarn|bun|pnpm)\s+run\s+(\S+)$/m,
53
+ name: (m) => m[2],
54
+ run: (m) => `${m[1]} run ${m[2]}`,
55
+ },
56
+ {
57
+ // npx <tool> (simple single-command invocations, no pipes/conditionals)
58
+ pattern: /^npx\s+(\S+)$/m,
59
+ name: (m) => m[1],
60
+ run: (m) => `npx ${m[1]}`,
61
+ },
62
+ ];
63
+
64
+ /**
65
+ * Files/directories inside .husky/ that are internal to Husky and should be skipped.
66
+ * @type {Set<string>}
67
+ */
68
+ const HUSKY_INTERNAL = new Set(['_', '.gitignore', 'husky.sh']);
69
+
70
+ /**
71
+ * Detect whether Husky is installed in a project.
72
+ *
73
+ * @param {string} projectRoot - Absolute path to the project root.
74
+ * @returns {{ found: boolean, huskyDir: string|null, hasHooksPath: boolean }}
75
+ */
76
+ function detectHusky(projectRoot) {
77
+ const huskyDir = path.join(projectRoot, '.husky');
78
+ const found = fs.existsSync(huskyDir) && fs.statSync(huskyDir).isDirectory();
79
+
80
+ if (!found) {
81
+ return { found: false, huskyDir: null, hasHooksPath: false };
82
+ }
83
+
84
+ // Check for core.hooksPath in .git/config
85
+ let hasHooksPath = false;
86
+ const gitConfigPath = path.join(projectRoot, '.git', 'config');
87
+ if (fs.existsSync(gitConfigPath)) {
88
+ try {
89
+ const gitConfig = fs.readFileSync(gitConfigPath, 'utf8');
90
+ hasHooksPath = /hooksPath\s*=/.test(gitConfig);
91
+ } catch (_err) {
92
+ // Expected: .git/config may be unreadable or malformed — assume no hooksPath is configured
93
+ }
94
+ }
95
+
96
+ return { found: true, huskyDir, hasHooksPath };
97
+ }
98
+
99
+ /**
100
+ * Strip Husky boilerplate (shebang, sourcing _/husky.sh, blank lines) from hook content.
101
+ *
102
+ * @param {string} content - Raw hook file content.
103
+ * @returns {string} Cleaned command lines.
104
+ */
105
+ function stripHuskyBoilerplate(content) {
106
+ return content
107
+ .split('\n')
108
+ .filter((line) => {
109
+ const trimmed = line.trim();
110
+ if (!trimmed) return false;
111
+ if (trimmed.startsWith('#!')) return false;
112
+ if (trimmed.startsWith('. "$(dirname')) return false;
113
+ if (trimmed.startsWith('# ')) return false;
114
+ return true;
115
+ })
116
+ .join('\n')
117
+ .trim();
118
+ }
119
+
120
+ /**
121
+ * Try to match a cleaned hook body against known auto-mappable patterns.
122
+ *
123
+ * @param {string} body - Cleaned hook body (no shebang/boilerplate).
124
+ * @returns {{ name: string, run: string } | null} Mapped command or null.
125
+ */
126
+ function matchKnownPattern(body) {
127
+ for (const entry of KNOWN_PATTERNS) {
128
+ const m = entry.pattern.exec(body);
129
+ if (m) {
130
+ const name = typeof entry.name === 'function' ? entry.name(m) : entry.name;
131
+ const run = typeof entry.run === 'function' ? entry.run(m) : entry.run;
132
+ return { name, run };
133
+ }
134
+ }
135
+ return null;
136
+ }
137
+
138
+ /**
139
+ * Determine if a hook body is "complex" — contains conditionals, pipes, loops, etc.
140
+ *
141
+ * @param {string} body - Cleaned hook body.
142
+ * @returns {boolean}
143
+ */
144
+ function isComplexScript(body) {
145
+ // Multiple non-blank lines that aren't a single command
146
+ const lines = body.split('\n').filter((l) => l.trim().length > 0);
147
+ if (lines.length > 1) return true;
148
+
149
+ // Contains shell constructs
150
+ if (/\b(if|then|else|fi|for|while|do|done|case|esac)\b/.test(body)) return true;
151
+ if (/[|&;]/.test(body) && !/^npx\s+--no\s+--/.test(body)) return true;
152
+
153
+ return false;
154
+ }
155
+
156
+ /**
157
+ * Parse a single hook file and classify it as mapped or unmapped.
158
+ *
159
+ * @param {string} huskyDir - Absolute path to .husky/ directory.
160
+ * @param {string} hookName - Name of the hook file (e.g., "pre-commit").
161
+ * @param {Array<{hook: string, name: string, run: string}>} mapped - Accumulator for mapped hooks.
162
+ * @param {Array<{hook: string, reason: string}>} unmapped - Accumulator for unmapped hooks.
163
+ */
164
+ function parseHookFile(huskyDir, hookName, mapped, unmapped) {
165
+ const filePath = path.join(huskyDir, hookName);
166
+
167
+ let content;
168
+ try {
169
+ content = fs.readFileSync(filePath, 'utf8');
170
+ } catch (_err) {
171
+ // Expected: hook file may be unreadable due to permissions — report as unmapped
172
+ unmapped.push({ hook: hookName, reason: `Cannot read file: ${_err.message}` });
173
+ return;
174
+ }
175
+
176
+ const body = stripHuskyBoilerplate(content);
177
+ if (!body) {
178
+ // Empty hook — skip silently
179
+ return;
180
+ }
181
+
182
+ const match = matchKnownPattern(body);
183
+ if (match) {
184
+ mapped.push({ hook: hookName, name: match.name, run: match.run });
185
+ } else if (isComplexScript(body)) {
186
+ unmapped.push({
187
+ hook: hookName,
188
+ reason: `Complex script with conditionals/multiple commands — requires manual conversion`,
189
+ });
190
+ } else {
191
+ // Single unknown command — still try to map it literally
192
+ const singleLine = body.split('\n')[0].trim();
193
+ if (singleLine) {
194
+ mapped.push({ hook: hookName, name: hookName, run: singleLine });
195
+ } else {
196
+ unmapped.push({ hook: hookName, reason: 'Unrecognized command pattern' });
197
+ }
198
+ }
199
+ }
200
+
201
+ /**
202
+ * Read .husky/ hook files and map them to Lefthook format.
203
+ *
204
+ * @param {string} huskyDir - Absolute path to .husky/ directory.
205
+ * @returns {{ mapped: Array<{hook: string, name: string, run: string}>, unmapped: Array<{hook: string, reason: string}> }}
206
+ */
207
+ function mapHuskyHooks(huskyDir) {
208
+ const mapped = [];
209
+ const unmapped = [];
210
+
211
+ let entries;
212
+ try {
213
+ entries = fs.readdirSync(huskyDir, { withFileTypes: true });
214
+ } catch (_err) {
215
+ // Expected: .husky/ directory may be unreadable — return empty results
216
+ return { mapped, unmapped };
217
+ }
218
+
219
+ for (const entry of entries) {
220
+ // Skip internal Husky files/directories
221
+ if (HUSKY_INTERNAL.has(entry.name)) continue;
222
+ if (entry.isDirectory()) continue;
223
+ parseHookFile(huskyDir, entry.name, mapped, unmapped);
224
+ }
225
+
226
+ return { mapped, unmapped };
227
+ }
228
+
229
+ /**
230
+ * Validate that all files in .husky/ are regular files, not symlinks.
231
+ * OWASP A08: Rejects symlinks to prevent path traversal attacks.
232
+ *
233
+ * @param {string} huskyDir - Absolute path to .husky/ directory.
234
+ * @returns {{ valid: boolean, symlinkFiles: string[] }}
235
+ */
236
+ function validateNoSymlinks(huskyDir) {
237
+ const symlinkFiles = [];
238
+
239
+ let entries;
240
+ try {
241
+ entries = fs.readdirSync(huskyDir, { withFileTypes: true });
242
+ } catch (_err) {
243
+ // Expected: .husky/ directory may be unreadable — treat as valid since we cannot detect symlinks
244
+ return { valid: true, symlinkFiles };
245
+ }
246
+
247
+ for (const entry of entries) {
248
+ if (HUSKY_INTERNAL.has(entry.name)) continue;
249
+ if (entry.isDirectory()) continue;
250
+
251
+ const filePath = path.join(huskyDir, entry.name);
252
+ try {
253
+ const stat = fs.lstatSync(filePath);
254
+ if (stat.isSymbolicLink()) {
255
+ symlinkFiles.push(entry.name);
256
+ }
257
+ } catch (_err) {
258
+ // Expected: file may have been removed between readdir and lstat — skip unstattable entries
259
+ }
260
+ }
261
+
262
+ return { valid: symlinkFiles.length === 0, symlinkFiles };
263
+ }
264
+
265
+ /**
266
+ * Format an array of hooks as YAML command entries.
267
+ *
268
+ * @param {Array<{hook: string, name: string, run: string}>} hooks - Hooks to format.
269
+ * @returns {string} YAML snippet with indented command entries.
270
+ */
271
+ function formatHookCommands(hooks) {
272
+ let result = '';
273
+ for (const h of hooks) {
274
+ result += ` ${h.name}:\n run: ${h.run}\n`;
275
+ }
276
+ return result;
277
+ }
278
+
279
+ /**
280
+ * Merge hooks into an existing YAML string for a given hook type.
281
+ *
282
+ * @param {string} yaml - Current YAML content.
283
+ * @param {string} hookType - Hook type name (e.g., "pre-commit").
284
+ * @param {Array<{hook: string, name: string, run: string}>} hooks - Hooks to merge.
285
+ * @returns {string} Updated YAML content with hooks merged in.
286
+ */
287
+ function mergeHookTypeIntoYaml(yaml, hookType, hooks) {
288
+ const commandsRegex = new RegExp(String.raw`(` + hookType + String.raw`:\s*\n(?:.*\n)*?\s+commands:\s*\n)`, 'm');
289
+ const commandsMatch = commandsRegex.exec(yaml);
290
+ if (commandsMatch) {
291
+ const insertion = formatHookCommands(hooks);
292
+ return yaml.replace(commandsMatch[1], commandsMatch[1] + insertion);
293
+ }
294
+ return yaml;
295
+ }
296
+
297
+ /**
298
+ * Generate Lefthook YAML content for mapped hooks.
299
+ * Merges into existing lefthook.yml content if provided.
300
+ *
301
+ * @param {Array<{hook: string, name: string, run: string}>} mappedHooks - Mapped hooks.
302
+ * @param {string} [existingContent] - Existing lefthook.yml content to merge into.
303
+ * @returns {string} Generated YAML content.
304
+ */
305
+ function generateLefthookYaml(mappedHooks, existingContent) {
306
+ // Group hooks by hook type (pre-commit, commit-msg, etc.)
307
+ const hookGroups = {};
308
+ for (const h of mappedHooks) {
309
+ if (!hookGroups[h.hook]) hookGroups[h.hook] = [];
310
+ hookGroups[h.hook].push(h);
311
+ }
312
+
313
+ // Start with existing content or empty string
314
+ let yaml = existingContent ? existingContent.trimEnd() + '\n' : '';
315
+
316
+ for (const [hookType, hooks] of Object.entries(hookGroups)) {
317
+ // Check if this hook type already exists in existing content
318
+ const hookRegex = new RegExp(`^${hookType}:`, 'm');
319
+ if (existingContent && hookRegex.test(existingContent)) {
320
+ yaml = mergeHookTypeIntoYaml(yaml, hookType, hooks);
321
+ continue;
322
+ }
323
+
324
+ // New hook type — append full block
325
+ if (yaml && !yaml.endsWith('\n')) yaml += '\n';
326
+ yaml += `${hookType}:\n commands:\n`;
327
+ yaml += formatHookCommands(hooks);
328
+ }
329
+
330
+ return yaml;
331
+ }
332
+
333
+ /**
334
+ * Try to unset core.hooksPath via git config.
335
+ * Uses execFileSync (not execSync) to prevent command injection.
336
+ *
337
+ * @param {string} projectRoot - Absolute path to the project root.
338
+ * @returns {boolean} Whether the unset was attempted.
339
+ */
340
+ function unsetHooksPath(projectRoot) {
341
+ try {
342
+ execFileSync(resolveCommand('git'), ['config', '--unset', 'core.hooksPath'], {
343
+ cwd: projectRoot,
344
+ stdio: 'ignore',
345
+ });
346
+ return true;
347
+ } catch (_err) {
348
+ // Expected: git config --unset fails when core.hooksPath is not set — safe to ignore
349
+ return false;
350
+ }
351
+ }
352
+
353
+ /**
354
+ * Orchestrate a full Husky-to-Lefthook migration.
355
+ *
356
+ * @param {string} projectRoot - Absolute path to the project root.
357
+ * @param {object} [options] - Migration options.
358
+ * @param {boolean} [options.nonInteractive=false] - Skip user prompts.
359
+ * @returns {{ success: boolean, mappedCount: number, unmappedCount: number, warnings: string[], hooksPathUnset?: boolean }}
360
+ */
361
+ function migrateHusky(projectRoot, options = {}) {
362
+ const warnings = [];
363
+
364
+ // Step 1: Detect Husky
365
+ const detection = detectHusky(projectRoot);
366
+ if (!detection.found) {
367
+ return {
368
+ success: false,
369
+ mappedCount: 0,
370
+ unmappedCount: 0,
371
+ warnings: ['No .husky/ directory found — nothing to migrate'],
372
+ };
373
+ }
374
+
375
+ // Step 2: Validate no symlinks (OWASP A08)
376
+ const symCheck = validateNoSymlinks(detection.huskyDir);
377
+ if (!symCheck.valid) {
378
+ return {
379
+ success: false,
380
+ mappedCount: 0,
381
+ unmappedCount: 0,
382
+ warnings: [
383
+ `Security: symlink detected in .husky/ — rejecting migration. Symlinked files: ${symCheck.symlinkFiles.join(', ')}`,
384
+ ],
385
+ };
386
+ }
387
+
388
+ // Step 3: Map hooks
389
+ const { mapped, unmapped } = mapHuskyHooks(detection.huskyDir);
390
+
391
+ // Step 4: Warn about unmapped hooks
392
+ for (const u of unmapped) {
393
+ warnings.push(`Unmapped hook '${u.hook}': ${u.reason}`);
394
+ }
395
+
396
+ // Step 5: In non-interactive mode, proceed automatically
397
+ // In interactive mode, the caller (bin/forge.js) handles the prompt
398
+ if (!options.nonInteractive) {
399
+ return {
400
+ success: false,
401
+ mappedCount: mapped.length,
402
+ unmappedCount: unmapped.length,
403
+ warnings: [...warnings, 'Interactive mode — caller must confirm before proceeding'],
404
+ };
405
+ }
406
+
407
+ // Step 6: Generate/merge lefthook.yml
408
+ const lefthookPath = path.join(projectRoot, 'lefthook.yml');
409
+ let existingContent = null;
410
+ if (fs.existsSync(lefthookPath)) {
411
+ try {
412
+ existingContent = fs.readFileSync(lefthookPath, 'utf8');
413
+ } catch (_err) {
414
+ // Expected: existing lefthook.yml may be unreadable — will create a new one instead
415
+ }
416
+ }
417
+
418
+ if (mapped.length > 0) {
419
+ const yaml = generateLefthookYaml(mapped, existingContent);
420
+ fs.writeFileSync(lefthookPath, yaml, 'utf8');
421
+ }
422
+
423
+ // Step 7: Unset core.hooksPath if set
424
+ let hooksPathUnset = false;
425
+ if (detection.hasHooksPath) {
426
+ hooksPathUnset = unsetHooksPath(projectRoot);
427
+ }
428
+
429
+ // Step 8: Remove .husky/ directory
430
+ try {
431
+ fs.rmSync(detection.huskyDir, { recursive: true, force: true });
432
+ } catch (_err) {
433
+ // Expected: .husky/ removal may fail due to file locks or permissions
434
+ warnings.push(`Could not remove .husky/ directory: ${_err.message}`);
435
+ }
436
+
437
+ return {
438
+ success: true,
439
+ mappedCount: mapped.length,
440
+ unmappedCount: unmapped.length,
441
+ warnings,
442
+ hooksPathUnset,
443
+ };
444
+ }
445
+
446
+ module.exports = {
447
+ detectHusky,
448
+ mapHuskyHooks,
449
+ migrateHusky,
450
+ };