gitroots 0.0.0-stage → 0.6.0

package/src/commands/push.js

@@ -0,0 +1,207 @@
+// git push · gitroots checks
+//   gitroots hooks install|uninstall   writes .git/hooks/pre-push
+//   gitroots hook pre-push <remote> <url>   (called by git, refs on stdin)
+//   gitroots check [base..head]        the same checks without pushing
+import fs from 'node:fs';
+import path from 'node:path';
+import { selfCommand } from '../runtime.js';
+import { c, pad } from '../ui/ansi.js';
+import { line, runSteps } from '../ui/term.js';
+import { brand, dot, box } from '../ui/components.js';
+import { git, tryGit, ZERO, commitsToPush, changedFiles, addedLines, scanSecrets, authors, MIGRATION_RE, lastSubjectSlug } from '../git/checks.js';
+import { loadRules, decide, globMatch } from '../rules.js';
+import { Api } from '../api.js';
+
+const MARK = '# gitroots push checks';
+
+function hooksDir(dir) {
+  const top = tryGit(['rev-parse', '--show-toplevel'], dir);
+  if (!top) throw new Error(`${path.resolve(dir)} is not a git repository`);
+  return path.resolve(dir, git(['rev-parse', '--git-path', 'hooks'], dir).trim());
+}
+
+export function installHook(dir = '.', { force = false } = {}) {
+  const hd = hooksDir(dir);
+  fs.mkdirSync(hd, { recursive: true });
+  const file = path.join(hd, 'pre-push');
+  let chained = null;
+  if (fs.existsSync(file)) {
+    const existing = fs.readFileSync(file, 'utf8');
+    if (!existing.includes(MARK)) {
+      if (!force) throw new Error(`a pre-push hook already exists at ${file} · rerun with --force to keep it and run it before gitroots`);
+      chained = path.join(hd, 'pre-push.local');
+      fs.renameSync(file, chained);
+    } else if (fs.existsSync(path.join(hd, 'pre-push.local'))) chained = path.join(hd, 'pre-push.local');
+  }
+  const q = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+  // The gitroots that installed the hook; if it moved (update, node version switch), the launcher or PATH.
+  const cmd = selfCommand();
+  const self = cmd.map(q).join(' ');
+  const script = `#!/bin/sh
+${MARK} · installed by gitroots hooks install
+input=$(cat)
+here=$(dirname "$0")
+if [ -x "$here/pre-push.local" ]; then
+  printf '%s\\n' "$input" | "$here/pre-push.local" "$@" || exit $?
+fi
+if [ -x ${q(cmd[0])} ] && { [ ${cmd.length} -eq 1 ] || [ -f ${q(cmd[cmd.length - 1])} ]; }; then
+  printf '%s\\n' "$input" | ${self} hook pre-push "$@"; exit $?
+elif [ -x "$HOME/.local/bin/gitroots" ]; then
+  printf '%s\\n' "$input" | "$HOME/.local/bin/gitroots" hook pre-push "$@"; exit $?
+elif command -v gitroots >/dev/null 2>&1; then
+  printf '%s\\n' "$input" | gitroots hook pre-push "$@"; exit $?
+fi
+echo "gitroots: push checks could not run (gitroots not found) · reinstall with gitroots hooks install" >&2
+exit 1
+`;
+  fs.writeFileSync(file, script, { mode: 0o755 });
+  return { path: file, chained };
+}
+
+export function uninstallHook(dir = '.') {
+  const hd = hooksDir(dir);
+  const file = path.join(hd, 'pre-push');
+  if (!fs.existsSync(file) || !fs.readFileSync(file, 'utf8').includes(MARK)) return { removed: false };
+  fs.rmSync(file);
+  const local = path.join(hd, 'pre-push.local');
+  if (fs.existsSync(local)) fs.renameSync(local, file);
+  return { removed: true, restored: fs.existsSync(file) };
+}
+
+
+export function hookStatus(dir = '.') {
+  const top = tryGit(['rev-parse', '--show-toplevel'], dir);
+  if (!top) return { repo: null, installed: false };
+  const file = path.join(hooksDir(dir), 'pre-push');
+  return { repo: top, installed: fs.existsSync(file) && fs.readFileSync(file, 'utf8').includes(MARK), path: file };
+}
+
+const SOURCE = { gitroots: 'rules from gitroots', cache: 'rules from gitroots (cached)', '.gitroots.json': 'rules from .gitroots.json', none: 'no branch rules for this repo' };
+
+/** Run every check for one ref update. */
+async function checkRef({ set, branch, localSha, remoteSha, cwd }) {
+  const commits = commitsToPush(localSha, remoteSha, cwd);
+  const verdict = decide(set, branch);
+  if (verdict.blocked) return { blocked: true, kind: 'rule', verdict, commits };
+  line(`${brand()}  ${c.s(`checking ${commits.length} commit${commits.length === 1 ? '' : 's'} before ${commits.length === 1 ? 'it leaves' : 'they leave'}`)}  ${c.m(`${dot()} ${SOURCE[set.source]}`)}`);
+  let files = [];
+  let secretHits = [];
+  const steps = [
+    { name: 'Branch rule', live: `reading rules for ${branch}…`, ms: 250, run: async () => ({ detail: verdict.label }) },
+    {
+      name: 'Protected paths', live: 'checking changed files…', ms: 250,
+      run: async () => {
+        files = changedFiles(commits, cwd);
+        if (!set.paths.length) return { detail: `${files.length} file${files.length === 1 ? '' : 's'} changed` };
+        const hits = files.filter((f) => set.paths.some((p) => globMatch(p.pattern, f)));
+        if (!hits.length) return { detail: `no files under ${set.paths.map((p) => p.pattern).join(', ')}` };
+        const p = set.paths.find((x) => hits.some((f) => globMatch(x.pattern, f)));
+        return { status: 'warn', detail: `${hits.length} file${hits.length > 1 ? 's' : ''} under ${p.pattern} · needs ${p.needs}` };
+      },
+    },
+    {
+      name: 'Secrets scan', live: `scanning ${commits.length} commits…`, ms: 350,
+      run: async () => {
+        secretHits = scanSecrets(addedLines(commits, cwd));
+        if (!secretHits.length) return { detail: '0 keys or passwords found' };
+        const f = secretHits[0];
+        return { status: 'fail', detail: `${f.kind} in ${f.file}:${f.line}${secretHits.length > 1 ? ` · ${secretHits.length - 1} more` : ''}` };
+      },
+    },
+    {
+      name: 'Commit authors', live: 'checking authors…', ms: 200,
+      run: async () => {
+        const a = authors(commits, cwd);
+        const names = [...new Set(a.map((x) => x.name))];
+        const signed = a.filter((x) => x.signed).length;
+        const sig = !a.length ? '' : signed === a.length ? ' · signed' : signed ? ` · ${signed} of ${a.length} signed` : ' · unsigned';
+        return { detail: `${a.length} commit${a.length === 1 ? '' : 's'} · ${names.slice(0, 3).join(', ')}${names.length > 3 ? ` +${names.length - 3}` : ''}${sig}` };
+      },
+    },
+    {
+      name: 'Migration files', live: 'looking for database changes…', ms: 250,
+      run: async () => {
+        const mig = files.filter((f) => MIGRATION_RE.test(f));
+        if (!mig.length) return { detail: 'no database changes' };
+        return { status: 'warn', detail: `${path.basename(mig[0])}${mig.length > 1 ? ` +${mig.length - 1}` : ''} changes data, flag it for review` };
+      },
+    },
+  ];
+  const results = await runSteps(steps, { nameWidth: 20, showQueued: true });
+  if (secretHits.length) return { blocked: true, kind: 'secret', hits: secretHits, commits, results };
+  return { blocked: false, commits, results };
+}
+
+function ruleBox({ repo, branch, verdict, localSha, cwd, remote }) {
+  const slug = lastSubjectSlug(localSha, cwd);
+  box([
+    `${brand()}  ${c.r(c.b('✕ Push blocked'))}   ${c.m('nothing left your machine')}`,
+    `  ${c.s('repo')}     ${repo} ${dot()} ${c.s('branch')} ${branch} ${dot()} ${c.s('rule')} ${verdict.label}`,
+    `  ${c.s('you can')}  ${verdict.suggest}`,
+    `  ${c.g(`→ git switch -c feature/${slug} && git push -u ${remote || 'origin'} feature/${slug}`)}`,
+  ], 'r');
+}
+
+function secretBox(hits) {
+  box([
+    `${brand()}  ${c.r(c.b('✕ Push blocked'))}   ${c.m('nothing left your machine')}`,
+    ...hits.slice(0, 4).map((x) => `  ${c.r('✕')} ${pad(x.kind, 18)} ${x.file}:${x.line}  ${c.m(`commit ${x.sha.slice(0, 7)}`)}`),
+    `  ${c.s('you can')}  remove the secret, rotate it, then rewrite the commit (git commit --amend or git rebase -i)`,
+  ], 'r');
+}
+
+export async function prePush({ remote, input }) {
+  const cwd = process.cwd();
+  const set = await loadRules(cwd, { api: Api.fromConfig(), timeout: 2500 });
+  const updates = input.split('\n').map((l) => l.trim().split(/\s+/)).filter((p) => p.length === 4);
+  let code = 0;
+  for (const [, localSha, remoteRef, remoteSha] of updates) {
+    if (!remoteRef.startsWith('refs/heads/')) continue; // tags are not checked
+    const branch = remoteRef.slice('refs/heads/'.length);
+    if (ZERO.test(localSha)) {
+      const v = decide(set, branch);
+      if (v.blocked) { line(`${brand()}  ${c.r('✕ Deleting a protected branch is blocked')}  ${c.m(`${set.repo} · ${v.label}`)}`); code = 1; }
+      continue;
+    }
+    const res = await checkRef({ set, branch, localSha, remoteSha, cwd });
+    if (res.blocked && res.kind === 'rule') { ruleBox({ repo: set.repo, branch, verdict: res.verdict, localSha, cwd, remote }); code = 1; continue; }
+    if (res.blocked) { line(); secretBox(res.hits); code = 1; continue; }
+    const warns = res.results.filter((r) => r.status === 'warn').length;
+    line(`${brand()}  ${c.g('✓ Checks passed')} ${dot()} pushing to ${remote || 'origin'}${warns ? ` ${dot()} ${c.w(`${warns} note${warns > 1 ? 's' : ''} for review`)}` : ''}`);
+  }
+  return code;
+}
+
+/** gitroots check / the /check command: the push checks on local commits, without pushing. */
+export async function checkLocal(rest = [], { api, branch: branchFlag } = {}) {
+  const cwd = process.cwd();
+  if (!tryGit(['rev-parse', '--show-toplevel'], cwd)) throw new Error('not inside a git repository · cd into one, or run /hooks there');
+  let localSha;
+  let remoteSha = '';
+  const range = rest[0];
+  if (range && range.includes('..')) {
+    const [a, b] = range.split('..');
+    remoteSha = git(['rev-parse', a || 'HEAD'], cwd).trim();
+    localSha = git(['rev-parse', b || 'HEAD'], cwd).trim();
+  } else {
+    localSha = git(['rev-parse', range || 'HEAD'], cwd).trim();
+    remoteSha = tryGit(['rev-parse', '@{upstream}'], cwd) || '';
+  }
+  const current = tryGit(['rev-parse', '--abbrev-ref', 'HEAD'], cwd);
+  const branch = branchFlag || current;
+  const set = await loadRules(cwd, { api });
+  line(`${c.m(cwd.replace(process.env.HOME || '\u0000', '~'))} ${c.i(branch)}  ${c.m(`${dot()} ${set.repo || ''} ${dot()} ${SOURCE[set.source]}`)}`);
+  const res = await checkRef({ set, branch, localSha, remoteSha, cwd });
+  if (res.blocked && res.kind === 'rule') {
+    line(`${brand()}  ${c.r('✕ A push to this branch would be blocked')}  ${c.m(res.verdict.label)}`);
+    line(`  ${c.s('you can')}  ${res.verdict.suggest}`);
+    return 1;
+  }
+  if (res.blocked) {
+    for (const x of res.hits.slice(0, 6)) line(`  ${c.r('✕')} ${pad(x.kind, 18)} ${x.file}:${x.line}  ${c.m(`commit ${x.sha.slice(0, 7)}`)}`);
+    line(`${brand()}  ${c.r('✕ This push would be blocked')}  ${c.m('remove the secret and rewrite the commit')}`);
+    return 1;
+  }
+  line(`${brand()}  ${c.g('✓ Ready to push')}`);
+  return 0;
+}

package/src/commands/update.js

@@ -0,0 +1,69 @@
+// gitroots update · uninstall
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { c } from '../ui/ansi.js';
+import { line, spinner, bar, confirm } from '../ui/term.js';
+import { json } from '../ui/components.js';
+import { VERSION, NPM_PACKAGE, DOWNLOAD_BASE, installMethod, nativePaths, platformKey } from '../runtime.js';
+import { latestVersion, installNative, newer, onPath } from '../installer.js';
+import { home } from '../config.js';
+
+export async function run(cmd, rest, flags) {
+  if (cmd === 'uninstall') return uninstall(flags);
+  return update(flags);
+}
+
+async function update(flags) {
+  const method = installMethod();
+  if (method === 'npm') {
+    const target = `${NPM_PACKAGE}@${flags.version || 'latest'}`;
+    line(`${c.i('○')} installed with npm · running ${c.b(`npm install -g ${target}`)}`);
+    const r = spawnSync(process.platform === 'win32' ? 'npm.cmd' : 'npm', ['install', '-g', target], { stdio: 'inherit' });
+    return r.status ?? 1;
+  }
+  if (method === 'source') {
+    line(`${c.m('○')} running from a source checkout · update it with git pull, or install a release:`);
+    line(`  ${c.g(`curl -fsSL ${DOWNLOAD_BASE}/install.sh | bash`)}`);
+    return 0;
+  }
+  const sp = spinner((f) => `${c.i(f)} ${c.s(`Checking ${DOWNLOAD_BASE}…`)}`);
+  let target;
+  try { target = flags.version || await latestVersion(); } catch (e) { sp.stop(`${c.r('✕')} ${e.message}`); return 1; }
+  if (!flags.version && !newer(target, VERSION) && !flags.force) {
+    sp.stop(`${c.g('✓')} gitroots ${VERSION} is the latest`);
+    if (flags.json) json({ current: VERSION, latest: target, updated: false });
+    return 0;
+  }
+  sp.update((f) => `${c.i(f)} ${c.s(`Downloading gitroots ${target} for ${platformKey()}…`)}`);
+  let progress = 0;
+  sp.update((f) => `${c.i(f)} ${c.b('Downloading')}  ${bar(progress, 30)}  ${c.s(`${Math.round(progress * 100)}% · gitroots ${target}`)}`);
+  try {
+    const r = await installNative(target, { onProgress: (p) => { progress = p; } });
+    sp.stop(`${c.g('✓')} Updated ${VERSION} → ${c.b(target)}  ${c.m(`checksum verified · ${r.launcher}`)}`);
+    if (flags.json) json({ current: VERSION, latest: target, updated: true });
+    return 0;
+  } catch (e) {
+    sp.stop(`${c.r('✕')} ${e.message}`);
+    return 1;
+  }
+}
+
+async function uninstall(flags) {
+  const method = installMethod();
+  if (method === 'npm') { line(`installed with npm · run ${c.b(`npm uninstall -g ${NPM_PACKAGE}`)}`); return 0; }
+  const { data, launcher, bin } = nativePaths();
+  const targets = [launcher, data];
+  if (flags.purge) targets.push(home());
+  line('This removes:');
+  for (const t of targets) line(`  ${c.s(t)}${fs.existsSync(t) ? '' : c.m('  (not there)')}`);
+  line(c.w('◐ push hooks block pushes once gitroots is gone · run gitroots hooks uninstall in each repo first'));
+  const ok = await confirm('Uninstall gitroots?', { def: false, assumeYes: flags.yes || flags.y });
+  if (!ok) { line(c.m('  nothing removed')); return 1; }
+  for (const t of targets) fs.rmSync(t, { recursive: true, force: true });
+  line(`${c.g('✓')} gitroots removed${flags.purge ? '' : c.m(` · settings kept in ${home()} (--purge removes them)`)}`);
+  if (onPath(bin)) line(c.m(`  ${bin} stays on your PATH; remove the line the installer added to your shell profile if you no longer need it`));
+  return 0;
+}
+
+export { path };

package/src/config.js

@@ -0,0 +1,66 @@
+// Where gitroots keeps its settings and sign-in.
+//   ~/.gitroots/config.json   server, user, chosen workspace (no secrets)
+//   token                     macOS Keychain, or ~/.gitroots/credentials.json (mode 600) elsewhere
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+export const DEFAULT_SERVER = process.env.GITROOTS_SERVER || 'https://gitroots.com';
+
+export function home() {
+  return process.env.GITROOTS_HOME || path.join(os.homedir(), '.gitroots');
+}
+
+const file = (name) => path.join(home(), name);
+
+function readJson(name, fallback) {
+  try { return JSON.parse(fs.readFileSync(file(name), 'utf8')); } catch { return fallback; }
+}
+
+function writeJson(name, data) {
+  fs.mkdirSync(home(), { recursive: true });
+  fs.writeFileSync(file(name), JSON.stringify(data, null, 2), { mode: 0o600 });
+  try { fs.chmodSync(file(name), 0o600); } catch { /* windows */ }
+}
+
+export function readConfig() { return readJson('config.json', {}); }
+export function writeConfig(cfg) { writeJson('config.json', cfg); }
+export function updateConfig(patch) { const c = { ...readConfig(), ...patch }; writeConfig(c); return c; }
+
+const useKeychain = () => process.platform === 'darwin' && !process.env.GITROOTS_NO_KEYCHAIN;
+const service = (server) => `gitroots-cli:${server}`;
+
+export function saveToken(server, username, token) {
+  if (useKeychain()) {
+    const r = spawnSync('security', ['add-generic-password', '-U', '-a', username, '-s', service(server), '-w', token], { stdio: 'ignore' });
+    if (r.status === 0) return 'keychain';
+  }
+  const all = readJson('credentials.json', {});
+  all[`${username}@${server}`] = token;
+  writeJson('credentials.json', all);
+  return 'file';
+}
+
+export function loadToken(server, username) {
+  if (process.env.GITROOTS_TOKEN) return process.env.GITROOTS_TOKEN;
+  if (!server || !username) return null;
+  if (useKeychain()) {
+    const r = spawnSync('security', ['find-generic-password', '-a', username, '-s', service(server), '-w'], { encoding: 'utf8' });
+    if (r.status === 0) return r.stdout.replace(/\n$/, '');
+  }
+  return readJson('credentials.json', {})[`${username}@${server}`] || null;
+}
+
+export function forgetToken(server, username) {
+  if (process.platform === 'darwin') spawnSync('security', ['delete-generic-password', '-a', username, '-s', service(server)], { stdio: 'ignore' });
+  const all = readJson('credentials.json', {});
+  delete all[`${username}@${server}`];
+  writeJson('credentials.json', all);
+}
+
+// Small local caches (branch rules for the push hook, command history).
+export function readCache(name, fallback) { return readJson(`cache-${name}.json`, fallback); }
+export function writeCache(name, data) { try { writeJson(`cache-${name}.json`, data); } catch { /* read-only home */ } }
+
+export function historyFile() { return file('history'); }

package/src/git/checks.js

@@ -0,0 +1,96 @@
+// Real checks gitroots runs on commits before they leave the machine.
+import { spawnSync } from 'node:child_process';
+
+export const ZERO = /^0+$/;
+
+export function git(args, cwd = process.cwd()) {
+  const r = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  if (r.error) throw r.error;
+  if (r.status !== 0) {
+    const err = new Error((r.stderr || '').trim() || `git ${args[0]} failed`);
+    err.status = r.status;
+    throw err;
+  }
+  return r.stdout;
+}
+
+export function tryGit(args, cwd) { try { return git(args, cwd).trim(); } catch { return ''; } }
+
+const MAX_COMMITS = 500;
+
+// Commits that would be sent: local..remote, or everything not on any remote for a new branch.
+export function commitsToPush(localSha, remoteSha, cwd) {
+  const args = remoteSha && !ZERO.test(remoteSha) && objectExists(remoteSha, cwd)
+    ? ['rev-list', `--max-count=${MAX_COMMITS}`, `${remoteSha}..${localSha}`]
+    : ['rev-list', `--max-count=${MAX_COMMITS}`, localSha, '--not', '--remotes'];
+  return git(args, cwd).split('\n').filter(Boolean);
+}
+
+function objectExists(sha, cwd) {
+  const r = spawnSync('git', ['cat-file', '-e', `${sha}^{commit}`], { cwd });
+  return r.status === 0;
+}
+
+export function changedFiles(commits, cwd) {
+  const files = new Set();
+  for (const sha of commits) {
+    for (const f of git(['diff-tree', '--no-commit-id', '--name-only', '-r', '-m', '--root', sha], cwd).split('\n')) if (f) files.add(f);
+  }
+  return [...files];
+}
+
+// Added lines with file and line number, from each commit's patch.
+export function addedLines(commits, cwd) {
+  const outLines = [];
+  for (const sha of commits) {
+    const patch = git(['show', '--format=', '--unified=0', '--no-color', '--no-ext-diff', '-m', '--first-parent', sha], cwd);
+    let file = null;
+    let ln = 0;
+    for (const l of patch.split('\n')) {
+      if (l.startsWith('+++ ')) { file = l.slice(4).replace(/^b\//, ''); continue; }
+      if (l.startsWith('@@')) { const m = /\+(\d+)/.exec(l); ln = m ? Number(m[1]) : 0; continue; }
+      if (l.startsWith('+') && file && file !== '/dev/null') { outLines.push({ sha, file, line: ln, text: l.slice(1) }); ln++; continue; }
+      if (!l.startsWith('-') && !l.startsWith('\\')) ln++;
+    }
+  }
+  return outLines;
+}
+
+export const SECRET_PATTERNS = [
+  { name: 'AWS access key', re: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { name: 'AWS secret key', re: /aws_secret_access_key\s*[:=]\s*['"]?[A-Za-z0-9/+=]{40}/i },
+  { name: 'private key', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY( BLOCK)?-----/ },
+  { name: 'GitHub token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{60,}\b/ },
+  { name: 'GitLab token', re: /\bglpat-[A-Za-z0-9_-]{20}\b/ },
+  { name: 'Slack token', re: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/ },
+  { name: 'Stripe live key', re: /\b[sr]k_live_[A-Za-z0-9]{20,}\b/ },
+  { name: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { name: 'OpenAI API key', re: /\bsk-(?:proj-)?[A-Za-z0-9]{32,}\b/ },
+  { name: 'password', re: /(?:password|passwd|pwd|secret|api_key|apikey|token)\w*['"]?\s*[:=]\s*['"][^'"\s]{8,}['"]/i, skip: /(example|changeme|placeholder|your[_-]|xxx|\*\*\*|<|\$\{|os\.environ|getenv|process\.env)/i },
+];
+
+export function scanSecrets(lines) {
+  const hits = [];
+  for (const l of lines) {
+    for (const p of SECRET_PATTERNS) {
+      if (p.re.test(l.text) && !(p.skip && p.skip.test(l.text))) { hits.push({ ...l, kind: p.name }); break; }
+    }
+  }
+  return hits;
+}
+
+export function authors(commits, cwd) {
+  if (!commits.length) return [];
+  return git(['show', '-s', '--format=%H%x09%an%x09%ae%x09%G?', ...commits], cwd)
+    .split('\n').filter(Boolean)
+    .map((l) => { const [sha, name, email, sig] = l.split('\t'); return { sha, name, email, signed: sig === 'G' || sig === 'U', sig }; });
+}
+
+export const MIGRATION_RE = /(^|\/)(migrations?|migrate|alembic\/versions|db\/migrate)\/|(^|\/)[^/]*migrat[^/]*\.(py|sql|rb|js|ts)$|\.sql$/i;
+
+export function lastSubjectSlug(sha, cwd) {
+  const subj = tryGit(['log', '-1', '--format=%s', sha], cwd);
+  const slug = subj.toLowerCase().replace(/^[a-z]+(\([^)]*\))?:\s*/, '').replace(/[^a-z0-9]+/g, '-').split('-').filter(Boolean).slice(0, 4).join('-');
+  return slug || 'my-change';
+}

package/src/installer.js

@@ -0,0 +1,96 @@
+// Native install / update, mirroring install.sh:
+//   <base>/latest                         "0.5.0"
+//   <base>/<version>/manifest.json        { version, platforms: { "darwin-arm64": { file, checksum, size } } }
+//   <base>/<version>/<file>               gitroots-<version>-<platform>.tar.gz (.zip on Windows)
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { DOWNLOAD_BASE, nativePaths, platformKey } from './runtime.js';
+
+async function fetchOk(url, timeout = 30000) {
+  let res;
+  try { res = await fetch(url, { signal: AbortSignal.timeout(timeout), headers: { 'User-Agent': 'gitroots-cli' } }); } catch (e) {
+    throw new Error(`can't reach ${url} (${e.cause?.code || e.name})`);
+  }
+  if (!res.ok) throw new Error(`${res.status} from ${url}`);
+  return res;
+}
+
+export async function latestVersion(base = DOWNLOAD_BASE, timeout) {
+  const v = (await (await fetchOk(`${base}/latest`, timeout)).text()).trim();
+  if (!/^\d+\.\d+\.\d+([-+][\w.]+)?$/.test(v)) throw new Error(`${base}/latest is not a version (${v.slice(0, 40)})`);
+  return v;
+}
+
+export async function manifest(version, base = DOWNLOAD_BASE) {
+  return (await fetchOk(`${base}/${version}/manifest.json`)).json();
+}
+
+export function newer(a, b) {
+  const pa = a.split(/[.-]/).map(Number);
+  const pb = b.split(/[.-]/).map(Number);
+  for (let i = 0; i < 3; i++) if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) > (pb[i] || 0);
+  return false;
+}
+
+// Download, verify and install one version. Returns the installed binary path.
+export async function installNative(version, { base = DOWNLOAD_BASE, onProgress = () => {} } = {}) {
+  const key = platformKey();
+  const man = await manifest(version, base);
+  const entry = man.platforms && man.platforms[key];
+  if (!entry) throw new Error(`no gitroots ${version} build for ${key} · available: ${Object.keys(man.platforms || {}).join(', ')}`);
+
+  const res = await fetchOk(`${base}/${version}/${entry.file}`, 600000);
+  const total = Number(res.headers.get('content-length')) || entry.size || 0;
+  const chunks = [];
+  let got = 0;
+  for await (const chunk of res.body) { chunks.push(chunk); got += chunk.length; if (total) onProgress(got / total); }
+  const buf = Buffer.concat(chunks);
+  const sum = crypto.createHash('sha256').update(buf).digest('hex');
+  if (sum !== entry.checksum) throw new Error(`checksum mismatch for ${entry.file} · expected ${entry.checksum.slice(0, 12)}…, got ${sum.slice(0, 12)}… · nothing was installed`);
+
+  const { data, bin, launcher } = nativePaths();
+  const dir = path.join(data, 'versions', version);
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gitroots-'));
+  const archive = path.join(tmp, entry.file);
+  fs.writeFileSync(archive, buf);
+  fs.mkdirSync(dir, { recursive: true });
+  const ok = entry.file.endsWith('.zip')
+    ? spawnSync('powershell', ['-NoProfile', '-Command', `Expand-Archive -Force -Path '${archive}' -DestinationPath '${dir}'`], { stdio: 'ignore' }).status === 0
+    : spawnSync('tar', ['-xzf', archive, '-C', dir], { stdio: 'ignore' }).status === 0;
+  fs.rmSync(tmp, { recursive: true, force: true });
+  if (!ok) throw new Error(`could not unpack ${entry.file}`);
+  const exe = path.join(dir, process.platform === 'win32' ? 'gitroots.exe' : 'gitroots');
+  if (!fs.existsSync(exe)) throw new Error(`${entry.file} has no gitroots binary`);
+  if (process.platform !== 'win32') fs.chmodSync(exe, 0o755);
+
+  fs.mkdirSync(bin, { recursive: true });
+  if (process.platform === 'win32') {
+    // A running .exe can be renamed but not overwritten.
+    if (fs.existsSync(launcher)) { try { fs.rmSync(`${launcher}.old`, { force: true }); } catch { /* in use */ } fs.renameSync(launcher, `${launcher}.old`); }
+    fs.copyFileSync(exe, launcher);
+  } else {
+    const link = `${launcher}.new`;
+    try { fs.rmSync(link, { force: true }); } catch { /* none */ }
+    fs.symlinkSync(exe, link);
+    fs.renameSync(link, launcher);
+  }
+  pruneVersions(data, version);
+  return { exe, launcher, version, platform: key };
+}
+
+// Keep the current and the previous version.
+function pruneVersions(data, current) {
+  const vdir = path.join(data, 'versions');
+  let all = [];
+  try { all = fs.readdirSync(vdir); } catch { return; }
+  const sorted = all.filter((v) => /^\d/.test(v)).sort((a, b) => (newer(a, b) ? -1 : 1));
+  const keep = new Set([current, sorted.find((v) => v !== current)]);
+  for (const v of sorted) if (!keep.has(v)) fs.rmSync(path.join(vdir, v), { recursive: true, force: true });
+}
+
+export function onPath(dir) {
+  return (process.env.PATH || '').split(path.delimiter).some((p) => path.resolve(p) === path.resolve(dir));
+}

package/src/rules.js

@@ -0,0 +1,88 @@
+// Branch rules for the repo being pushed, from (in order):
+//   1. gitroots: the workspace's branch rules for this GitHub repo (cached for offline pushes)
+//   2. .gitroots.json at the repo root: { "protected": ["main", "release/*"], "paths": [{ "pattern": "infra/**", "needs": "an ops review" }] }
+import fs from 'node:fs';
+import path from 'node:path';
+import { tryGit } from './git/checks.js';
+import { readCache, writeCache, readConfig } from './config.js';
+
+export function remoteFullName(url) {
+  if (!url) return null;
+  const m = /github\.com[:/]+([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/i.exec(url.trim());
+  return m ? `${m[1]}/${m[2]}` : null;
+}
+
+export function globMatch(pattern, value) {
+  const re = new RegExp(`^${pattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*/g, '\u0000')
+    .replace(/\*/g, '[^/]*')
+    .replace(/\u0000/g, '.*')
+    .replace(/\?/g, '.')}$`);
+  return re.test(value);
+}
+
+function localConfig(top) {
+  try {
+    const cfg = JSON.parse(fs.readFileSync(path.join(top, '.gitroots.json'), 'utf8'));
+    return {
+      rules: (cfg.protected || []).map((p) => ({ pattern: p, level: 'protected', allow_direct_push: false, required_approvals: 0, description: 'No direct pushes · .gitroots.json' })),
+      paths: (cfg.paths || []).map((p) => (typeof p === 'string' ? { pattern: p, needs: 'a review' } : p)),
+      suggest: cfg.suggest,
+    };
+  } catch { return null; }
+}
+
+/** Rules for the repository at cwd. api is optional; with it, rules are refreshed from gitroots. */
+export async function loadRules(cwd, { api = null, timeout = 3000 } = {}) {
+  const top = tryGit(['rev-parse', '--show-toplevel'], cwd);
+  if (!top) return { source: 'none', repo: null, rules: [], paths: [] };
+  const url = tryGit(['remote', 'get-url', 'origin'], cwd);
+  const fullName = remoteFullName(url);
+  const local = localConfig(top);
+  const cache = readCache('rules', {});
+  let source = 'none';
+  let rules = [];
+  if (fullName && api && api.signedIn) {
+    try {
+      const d = await api.repo(fullName, { timeout });
+      rules = d.branch_rules || [];
+      cache[fullName.toLowerCase()] = { rules, at: new Date().toISOString(), org: api.orgId };
+      writeCache('rules', cache);
+      source = 'gitroots';
+    } catch (e) {
+      if (e.status === 404) { delete cache[fullName.toLowerCase()]; writeCache('rules', cache); }
+    }
+  }
+  if (source === 'none' && fullName && cache[fullName.toLowerCase()]) {
+    rules = cache[fullName.toLowerCase()].rules;
+    source = 'cache';
+  }
+  if (local) {
+    rules = [...rules, ...local.rules];
+    if (source === 'none') source = '.gitroots.json';
+  }
+  return { source, repo: fullName || path.basename(top), top, rules, paths: local ? local.paths : [], suggest: local?.suggest };
+}
+
+export function ruleFor(rules, branch) {
+  return rules.find((r) => r.pattern === branch) || rules.find((r) => globMatch(r.pattern, branch)) || null;
+}
+
+const LEAD_ROLES = new Set(['owner', 'lead', 'admin']);
+
+/** Is a direct push of `branch` allowed? */
+export function decide(set, branch) {
+  const rule = ruleFor(set.rules, branch);
+  if (!rule) return { blocked: false, rule: null, label: set.source === 'none' ? 'no rules for this repo' : `${branch} · no rule, developers can push` };
+  const role = (readConfig().org?.role || '').toLowerCase();
+  const label = `${rule.pattern}: ${rule.description || rule.level}`;
+  if (rule.allow_direct_push === false) {
+    const needs = rule.required_approvals ? `, it needs ${rule.required_approvals} approval${rule.required_approvals > 1 ? 's' : ''}` : '';
+    return { blocked: true, rule, label, suggest: set.suggest || `push to a feature branch, then open a pull request into ${branch}${needs}` };
+  }
+  if (rule.level === 'leads' && !LEAD_ROLES.has(role)) {
+    return { blocked: true, rule, label, suggest: 'only workspace leads push here · push to a feature branch and ask a lead to merge' };
+  }
+  return { blocked: false, rule, label };
+}