geonosis 3.6.1 → 3.7.0

package/CHANGELOG.md

@@ -1,5 +1,60 @@
 # geonosis
 
+## 3.7.0
+
+### Patch Changes
+
+- d9105ef: The commit guard refuses `git am` in a kit repo: a patch am applies becomes a commit no gate judged, so it names `git apply --index <patch>` and then `git commit`, which both gates judge; `--abort`, `--quit` and `--show-current-patch` make no commit and pass. A non-interactive `git rebase` and `git pull --rebase` pass, since they replay commits already judged; a `git pull` that merges gets the message gate `git merge` gets, so `-e`, `--edit` and `--log` are refused. An alias set on the same line through `GIT_CONFIG_COUNT`/`GIT_CONFIG_KEY_<n>`/`GIT_CONFIG_VALUE_<n>` or `GIT_CONFIG_PARAMETERS` is read like `-c alias.<name>=…`, with `-c` winning as it does in git; a non-builtin subcommand under a config the guard cannot resolve (a `-c` or `GIT_CONFIG_*` value it cannot expand, `--config-env`, or a `GIT_CONFIG_*` variable assigned or exported earlier in the line) is refused. A line too long or too deeply nested to read is refused for every commit-making command its text names (`commit`, `revert`, `cherry-pick`, `commit-tree`, `am`, `merge`, `pull`), where it used to catch only `git commit`, and with a refusal that says the line could not be read.
+- aecc334: The commit guard judges every git command that makes a commit. `git commit --amend` is judged by the commit it produces (HEAD and the staged change together, through `delivery check --commit HEAD`), so a rename amended into a commit of runtime code goes through. `git revert` and `git cherry-pick` are judged by the delivery of each commit they replay, and a cherry-pick by each picked message (with the `-x` line counted); `git commit-tree` by its tree against its first parent and its `-m`/`-F` message, refused when its tree or parent cannot be resolved before the shell runs or its message comes from stdin. `git merge` gets the message gate only, since the commits it joins were judged when they were made. A git alias is resolved (`git config --get alias.<name>`, or `-c alias.<name>=…` on the line) and judged as the command it stands for; a shell alias from the config that runs a commit is refused. A commit into a repository a `git init` earlier in the same line creates is refused, naming the init, where it used to go through unchecked or be judged against the repository around it.
+- d0c70dc: The commit guard refuses an interactive rebase in a kit repo, since it can reword, squash, split or rewrite commits no gate reads, and says a person runs it in their own terminal: `git rebase -i`/`--interactive`/`--edit-todo` (abbreviations and clusters such as `-qi` included), `--exec`/`-x`, a rebase with `GIT_SEQUENCE_EDITOR`, `GIT_EDITOR`, `-c sequence.editor` or `-c core.editor` set beside it or a config beside it the guard cannot read, and `git pull --rebase=interactive` (or `=i`, `-ri`, or `pull.rebase`/`branch.<name>.rebase` set to it with no rebase flag on the line). A plain `git rebase <upstream>` and `git pull --rebase` still pass, in a directory the guard cannot resolve too. A line too long to read is refused for a `git rebase` its text names, as for the other commit-making commands.
+- ef6f65e: The commit and push hooks fail closed. A commit or push in a repository with no `geonosis-ledger` and no `geonosis` door is refused, naming the paths it looked for and the check to run by hand; a commit or push whose check runs past the hook budget is refused, naming the budget, the measured time and the exact command. A delivery check, commit-message check, shape lock or push guard that exits with anything but 0 or 1 refuses too, naming the exit and what it said; one a signal ended before the budget is refused naming the signal, the time and what it said, where it used to be reported as past the budget. All of these used to let the commit through unchecked (#215, plan 049 T2).
+- 018a049: The guard refuses a gate chained into a commit when the gate is a versioned door (`npx geonosis@3.7.0 verify`, `pnpm dlx geonosis@latest verify`, `npx @geonosis/verify@3.7.0`) or the commit is an inline git alias of one (`git -c alias.ci=commit ci`, an alias of an alias, `!git merge`), as it refuses `geonosis verify fast` chained into `git commit`. Both used to be let through.
+- e0f0882: New `@geonosis/gate`: the heavy slots, the machine-wide heavy lock and the `geonosis-gate` daemon, moved out of `@geonosis/ratchet` with their behaviour and tests unchanged (#215, plan 049 T5). It joins the fixed group; `geonosis-gate serve`, `status` and `stop` are its bin now, and a repo that starts the daemon adds `@geonosis/gate` by name.
+  
+  `@geonosis/ratchet` no longer ships the `geonosis-gate` bin and re-exports none of what moved. Import these from `@geonosis/gate` instead: `@geonosis/ratchet: acquireExclusive`, `@geonosis/ratchet: availableMemoryMb`, `@geonosis/ratchet: buildLockPath`, `@geonosis/ratchet: DEFAULT_MEMORY_MB_PER_SLOT`, `@geonosis/ratchet: describeBudget`, `@geonosis/ratchet: describeHolders`, `@geonosis/ratchet: GATE_PARENT`, `@geonosis/ratchet: GATE_RUN`, `@geonosis/ratchet: GateAccepted`, `@geonosis/ratchet: GateAnswer`, `@geonosis/ratchet: gateCacheDir`, `@geonosis/ratchet: gateDaemonPid`, `@geonosis/ratchet: gateKey`, `@geonosis/ratchet: gateLastLine`, `@geonosis/ratchet: gateLogPath`, `@geonosis/ratchet: GateLost`, `@geonosis/ratchet: GateRefused`, `@geonosis/ratchet: GateRun`, `@geonosis/ratchet: gateRunsDir`, `@geonosis/ratchet: gateSocketPath`, `@geonosis/ratchet: gateStatus`, `@geonosis/ratchet: HEAVY_SLOT_HELD`, `@geonosis/ratchet: HeavyBudget`, `@geonosis/ratchet: heavyBudget`, `@geonosis/ratchet: heavyLockPath`, `@geonosis/ratchet: heavySlotDir`, `@geonosis/ratchet: HeavySlotHolder`, `@geonosis/ratchet: heavySlots`, `@geonosis/ratchet: HeavySlotTimeout`, `@geonosis/ratchet: Holder`, `@geonosis/ratchet: readCacheEntry`, `@geonosis/ratchet: runViaGate`, `@geonosis/ratchet: serveGate`, `@geonosis/ratchet: slotHolders`, `@geonosis/ratchet: slotInherited`, `@geonosis/ratchet: stopGate`, `@geonosis/ratchet: submitToGate`, `@geonosis/ratchet: takeSlot`, `@geonosis/ratchet: waitForBuild`, `@geonosis/ratchet: watchGateParent`.
+  
+  `@geonosis/verify`, `@geonosis/evals`, `@geonosis/rails` and `@geonosis/release` import them from `@geonosis/gate` and depend on it. The doctor's fixed group and the metapackage's by-name list name `@geonosis/gate`.
+- 48736d0: The plugin asks before `green record` whatever comes between the words: a flag such as `--asked q` before `record` or before `green`, `--` before the name, and verify run as `npx @geonosis/verify` or `pnpm dlx @geonosis/verify@<version>`. These wrote a tool-green record without asking.
+- 9d5e1ab: The commit guard checks a commit in the tree it runs in. A pipe anywhere in the command, a `$(… | …)` substitution included, used to make every `cd` before the commit unknown, so `cd <worktree> && git status --short | cat && git commit -m … -- src/a.ts` was checked in the session's checkout. The guard now reads where the shell leaves the directory: a variable assigned earlier in the same line (`D=/abs/wt && cd "$D"`, `export D=…`, `${D}/sub`) and `$HOME` are resolved; a group (`{ … }`, `if`, a loop) that is piped or backgrounded leaves the directory where it was before the group; `pushd` and `popd` follow the directory stack. A commit or push whose directory the guard still cannot resolve (`cd "$(…)"`, a variable never assigned, a `cd` that is the last member of a pipeline, which bash runs in a subshell and zsh does not) is refused, naming the command it could not follow, where it used to be checked in the session's checkout. A commit whose paths or `git add` paths hold a word the guard cannot resolve (`-- $F` with `F=$(…)`) is refused naming the word, where the literal `$F` used to be handed to the check. A redirection (`2>&1`, `> out.txt`) is never read as a pathspec or a path `git add` stages. A commit whose paths hold no change because an edit earlier in the same command has not run yet (`python3 edit.py && git commit -- f`, and an edit by `echo … >`, `printf … >`, `cat > f <<EOF` or `tee`) is refused saying so, naming the commands that had not run, and asking for the edit first and the commit as its own command; a commit with nothing before it keeps the refusal it had (#215).
+- 1315558: The commit and push guards find the ledger the way the `geonosis` door does: the repo's own `geonosis-ledger` bin in its `node_modules/.bin`, else the repo's `geonosis` door running `geonosis ledger …`, and only then a `geonosis-ledger` or `geonosis` on the PATH. A pnpm repo that installs only `geonosis` links no `geonosis-ledger`, and since the guards fail closed every commit and push there was refused; and a stale `geonosis-ledger` on the PATH used to answer before the repo's own door. They still refuse when neither bin is installed, and the refusal names both paths it looked for and the check to run by hand as `geonosis ledger …` (#215, #68).
+- fa7dec9: The Stop hook's fast tier, the SessionStart doctor and the lint-config listing and approval run their tool the way the commit guard does: the repo's own `geonosis-verify` or `geonosis-doctor`, else the repo's `geonosis` door running `verify` or `doctor`, and only then a copy on the PATH, which used to answer first. A pnpm repo that installs only `geonosis` had no fast tier at a turn's end, no doctor line at a session's start, and an approval that could not list the changes it approved. The session doctor reads the doctor's report past the door's note that it runs the cli's own copy (#215, #68).
+- a8d566c: The LAW 4 guard refuses the packages that run prettier under another name: `npx @prettier/cli`, `npx pretty-quick` and their `pnpm dlx`, `pnpm exec` and `bunx` forms are refused in a kit repository as `npx prettier` is, where they used to be let through.
+- ef6f65e: The LAW 4 guard refuses a prettier run only when a command actually invokes it, in the directory it runs in. A word inside an argument, a quoted issue body, a heredoc or a grep pattern is not a run; a run whose directory (after `cd`, `-C`, `--cwd`, `--dir`) is outside every kit repository goes through, as does one inside a kit tree in a repository that pins prettier and has a prettier config. The session's kit repository (`corepack pnpm dlx prettier` included), a path argument into a kit repository (spelled with `$HOME` or a variable assigned earlier in the line, or a glob such as `'../kit/**/*.ts'`, judged by the directory it starts from), an argument the guard cannot resolve (`$(…)`, a variable never assigned), and a directory it cannot resolve are still refused (#216).
+- 8301315: The rule files, skills, commands and agents spell the ledger `geonosis ledger …`, the command the metapackage links under every package manager; under pnpm `geonosis-ledger` is a command only where `@geonosis/ledger` is a direct dependency. The rule files `geonosis rules` copies and the `todo-names-its-plan` fix shape say it that way. The `@geonosis/cli` README says what a pnpm consumer installs directly: `geonosis` or `@geonosis/cli` for the door, which the plugin's hooks, the commit guard included, run where the repo links no tool of its own. The `geonosis` README no longer says the package ships no bin (#68).
+- c19e51a: A message that tells a person what to run names it through the `geonosis` door: the baseline write refusal and the ratchet's FAIL name `geonosis ratchet --raise …`, an unproven fall `geonosis ratchet --bank …`, a missing or stale recording `geonosis ratchet --record …`, the session doctor `geonosis doctor`, the Stop hook, `geonosis verify` and the doctor's `runner` check `geonosis verify prove`, the ledger's handoff check `geonosis ledger handoff`, its push guard `geonosis ledger land --attest-only`, a plan envelope's next step `geonosis ledger plan check`, the release's smoke and migrations messages `geonosis release …`, each tool's `--help` and `--print-config-shape` pointers `geonosis <tool> …`, the write guard on `.geonosis/` `geonosis verify fast`, and init and post-update's census line name `geonosis ratchet` and `geonosis verify` for the gates init writes. Init no longer asks the root to declare `@geonosis/ratchet` and `@geonosis/verify` for their bins: its gates call the door. Under pnpm a tool's own bin is a command only where its package is a direct dependency (#68).
+- d0bfbee: The plugin's questions can be switched off by the person: `GEONOSIS_ASK=off`, or `off` in `~/.config/geonosis/ask`. Each hook that would ask (a ratchet raise, a visual approval, a lint-config change, a recorded green, a D1 restore) allows instead and notes what it would have asked. Refusals are unchanged, and `GEONOSIS_ASK=on` asks again.
+- c396720: The LAW 4 guard resolves a run's command word the way it already resolved its arguments: `x=prettier; npx $x --write .` and `p=pret; t=tier; pnpm dlx $p$t --write .` are refused, where they used to go through. A command word it cannot resolve is refused when `npx`, `bunx`, `pnpx` or a package manager's `dlx`/`exec` runs it, or when the line names prettier anywhere (`x=$(echo prettier); $x --write .`).
+- 957ee47: The ratchet keys each finding of `oxlintErrors`, `oxlintWarnings` and `oxlintRule`, as Betterer does: by file, rule and a hash of the whole flagged line (whitespace collapsed), never by line number, kept in `gate-baseline.findings.json` beside the baseline. One fix plus one new finding at an unchanged total now fails the run, naming the new finding's file, line, column and rule. Before, it passed. A fixed finding is banked with the number. A counter with a number and no findings yet has them written without a judgement, and the run passes. A findings file that does not parse refuses those counters. `--raise` records a finding that moved (a renamed file, an edited line) at the same number. `--prove` plants a new finding beside a removed one at an unchanged total and requires the refusal. An entry whose command prints paths from a subdirectory names it as `pathsFrom`. Counters that read no findings are unchanged (#215, plan 049 T6). The plugin's write guard refuses an edit of `gate-baseline.findings.json` as it refuses the baseline's, and the question a person is asked before `--raise` at the baseline says the findings read now replace those held.
+- 33a09bf: `geonosis-release restore <db>` puts a D1 database back to the restore point `migrations --record-bookmark` recorded, or a `--bookmark` or `--timestamp` named, through `cf d1 time-travel restore --force`. It needs `--yes`, and the geonosis plugin asks the person before it runs, naming the database, the point and that every later write is lost. A time without `Z` or an offset, a date the calendar does not have, a precision finer than a millisecond and a point older than the 30 days Time Travel keeps are refused before Cloudflare is asked. It prints the bookmark that undoes it and the migrations the restore rewound, which the next apply runs again. A refused `prove` names each recorded restore point, because a Worker rollback does not undo a migration.
+- c5d953b: The Stop hook reads geonosis-verify's green record: after an edit that went red is reverted, or a `keyFiles` file is set back to a value that was green, the turn ends green without launching a tier. It launched one, verify answered from that record and wrote no report, and the next Stop exited 2 with "wrote no report — it could not run". The hook's tree hash now counts the install records, as the gate daemon's and verify's do, so a green kept by either over a tree with `node_modules` is the one the hook looks up.
+- 49735bb: The skills, rules, agents and commands run every tool the `geonosis` door fronts through it: `geonosis review check`, `geonosis ratchet --raise`, `geonosis verify fast`, `geonosis doctor`, `geonosis lint-parity --corpus`, `geonosis walk`. Under pnpm a tool's own bin is a command only where its package is a direct dependency. The rule files `geonosis rules` copies say it that way, and the guard that refuses a gate chained into a commit or merge now recognises `geonosis verify` as a gate (#68).
+- 3d313a8: `geonosis-verify green record <name> [--asked <text>]` and `green check <name> [--asked <text>]` give a tool that keeps a green of its own a record shaped as a tier's: `.geonosis/tool-green-<name>.json`, the tree hash, and a question that must match. `check` prints the record and exits 0 while the tree hashes as it did, and exits 1 otherwise. No tier, Stop hook or release check reads it, so `green record fast` cannot turn a red tier green: a tier is green only by a run of its own. A name that is not one path segment is refused. The plugin's PreToolUse Bash hook asks the person before any `geonosis-verify green record …` or `geonosis verify green record …` an agent runs, naming the record, the tree it is written over and what it lets a tool skip; `geonosis update` writes its own records through the binary and is not asked. `geonosis update` keeps its resume records with it (#186).
+- 7b1e29c: `keyFiles` in `geonosis.json`, beside `keyEnv`, names git-ignored files a tier reads, such as a Worker's `.dev.vars` (#209). Their content is hashed into the key the gate daemon and verify's own green record are kept under, so a changed file runs the tier again and an unchanged one is answered from the green. A path outside the repo is refused. The gate report records that key as `inputs`, and the plugin's Stop hook computes it too: it reads a green report, a judged tree or a daemon's green only while the `keyEnv` values and `keyFiles` contents are the ones it was run under, and hands the daemon the key verify asks under, so a changed `.dev.vars` runs the fast tier again at the next turn end.
+- Updated dependencies [c990bf2]
+- Updated dependencies [3251966]
+- Updated dependencies [5b5e373]
+- Updated dependencies [3e46e76]
+- Updated dependencies [070a593]
+- Updated dependencies [aab823c]
+- Updated dependencies [1dabee8]
+- Updated dependencies [8301315]
+- Updated dependencies [c19e51a]
+- Updated dependencies [98a2c5a]
+- Updated dependencies [d351529]
+- Updated dependencies [69be472]
+- Updated dependencies [22d3360]
+- Updated dependencies [74147f7]
+- Updated dependencies [7819143]
+- Updated dependencies [fb83671]
+- Updated dependencies [ef78e9d]
+- Updated dependencies [9fbc4b3]
+- Updated dependencies [015ddf8]
+- Updated dependencies [05fb7da]
+- Updated dependencies [1fbd2df]
+- Updated dependencies [821e940]
+- Updated dependencies [b505542]
+  - @geonosis/cli@3.7.0
+
 ## 3.6.1
 
 ### Patch Changes

package/README.md

@@ -7,11 +7,17 @@ pnpm add -D geonosis     # or: bun add -d geonosis
 npx geonosis --help
 ```
 
-That line installs `@geonosis/cli` and every gate it runs — `@geonosis/base`, the helpers they
-share, the plugin, the doctor, the ratchet, verify, verify-arch, lint-parity, the ledger, release,
-review, testbed, observability, walk and visual-diff — all on the same version, because the whole
-group publishes as one fixed set. The commands come from the packages it pins; this package ships no
-bin of its own.
+That line installs the door and every gate it runs, all on the same version, because the whole
+group publishes as one fixed set: `@geonosis/base`, `@geonosis/cli`, `@geonosis/doctor`,
+`@geonosis/ledger`, `@geonosis/lint-parity`, `@geonosis/observability`,
+`@geonosis/oxlint-plugin-biological-architecture`, `@geonosis/ratchet`, `@geonosis/release`,
+`@geonosis/review`, `@geonosis/testbed`, `@geonosis/verify`, `@geonosis/verify-arch`,
+`@geonosis/visual-diff` and `@geonosis/walk`. This package links one bin, `geonosis`, which runs
+`@geonosis/cli`: pnpm links only a direct dependency's bins, so the door has to be this package's
+own. Every tool is reached through it, `geonosis ledger tick …` and `geonosis ratchet` alike, under
+every package manager, and the geonosis plugin's hooks and commit guard run the tools through it
+where the repo links no tool bin of its own; `@geonosis/cli`'s README says what a pnpm consumer
+installs directly.
 
 `geonosis update --to <version>` bumps every pin in every workspace afterwards, in one command.
 
@@ -27,7 +33,7 @@ for everyone, whatever it is called.
 |---|---|---|
 | `playwright` | `@geonosis/walk` | `pnpm add -D playwright` · `bun add -d playwright` |
 | `posthog-node` | `@geonosis/observability` | `pnpm add -D posthog-node` · `bun add -d posthog-node` |
-| `squawk-cli` | `@geonosis/release` (postgres, mikro-orm-ts) | `pnpm add -D squawk-cli@2.69.0` |
+| `squawk-cli` | `@geonosis/release` (postgres, mikro-orm-ts) | `pnpm add -D squawk-cli@2.69.0` · `bun add -d squawk-cli@2.69.0` |
 
 The peers everybody does pay for are `oxlint`, because every gate lints and oxlint is what loads the
 plugin, and `zod` and `better-result`, because `@geonosis/review` and `@geonosis/observability`
@@ -35,7 +41,11 @@ put them in their public types. A consumer cannot call those packages without it
 
 Libraries a repo imports from its own source are added by name, on the same version:
 `@geonosis/policy`, `@geonosis/integrations`, `@geonosis/themekit`, `@geonosis/rails`,
-`@geonosis/evals`, `@geonosis/mcp`, and `create-geonosis` for a new repo.
+`@geonosis/evals`, `@geonosis/mcp`, and `create-geonosis` for a new repo. `@geonosis/gate` is added
+by name for its `geonosis-gate` command, which starts the opt-in gate daemon; the tools already
+install it as a library. So is `@geonosis/release`, though the door installs it, where a repo runs
+the `geonosis-release-cloudflare` runner by its path: under pnpm a bin is linked only for a direct
+dependency.
 
 The floor packages under `foundations/` and `domains/` (`@geonosis/events`, `@geonosis/db` and the
 rest) each version on a line of their own, so this number says nothing about which one to install.

package/dist/toolchain.js

@@ -18,6 +18,7 @@ var TOOLCHAIN = [
 ];
 var BY_NAME = [
   "@geonosis/evals",
+  "@geonosis/gate",
   "@geonosis/integrations",
   "@geonosis/mcp",
   "@geonosis/policy",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "geonosis",
-  "version": "3.6.1",
+  "version": "3.7.0",
   "types": "./dist/index.d.ts",
   "bin": {
     "geonosis": "bin/geonosis.mjs"
@@ -36,7 +36,7 @@
     "dist"
   ],
   "dependencies": {
-    "@geonosis/cli": "3.6.1"
+    "@geonosis/cli": "3.7.0"
   },
   "peerDependencies": {
     "oxlint": ">=1.77",