gitroots 0.5.0 → 0.6.0

package/src/cli.js

@@ -1,15 +1,11 @@
 import { setColor, c } from './ui/ansi.js';
-import { line } from './ui/term.js';
-import { brand, dot } from './ui/components.js';
-import { Store } from './data/store.js';
+import { line, interactive } from './ui/term.js';
 import { VERSION } from './runtime.js';
-import { connect } from './connected.js';
 
-export { VERSION } from './runtime.js';
+export { VERSION };
 
 // Flags that never take a value.
-const BOOL = new Set(['password-stdin', 'purge', 'draft', 'json', 'csv', 'all', 'pick', 'read-only', 'shell', 'request-changes', 'approve', 'comment', 'yes', 'y',
-  'help', 'h', 'version', 'v', 'no-color', 'fork', 'follow', 'squash', 'rebase', 'merge-commit', 'keep-branch', 'no-hooks', 'force', 'dry-run']);
+const BOOL = new Set(['json', 'help', 'h', 'version', 'v', 'no-color', 'yes', 'y', 'force', 'blocked', 'purge', 'no-browser']);
 
 export function parseArgs(argv) {
   const args = { _: [], flags: {} };
@@ -20,7 +16,6 @@ export function parseArgs(argv) {
       const eq = a.indexOf('=');
       if (eq > -1) { args.flags[a.slice(2, eq)] = a.slice(eq + 1); continue; }
       const key = a.slice(2);
-      if (key.startsWith('no-') && !BOOL.has(key)) { args.flags[key.slice(3)] = false; continue; }
       const nxt = argv[i + 1];
       if (!BOOL.has(key) && nxt !== undefined && !nxt.startsWith('-')) { args.flags[key] = nxt; i++; } else args.flags[key] = true;
       continue;
@@ -36,115 +31,46 @@ export function parseArgs(argv) {
   return args;
 }
 
-const COMMANDS = {
-  status: () => import('./commands/status.js'),
-  repo: () => import('./commands/repos.js'),
-  repos: () => import('./commands/repos.js'),
-  branch: () => import('./commands/repos.js'),
-  clone: () => import('./commands/repos.js'),
-  hooks: () => import('./commands/push.js'),
-  hook: () => import('./commands/push.js'),
-  check: () => import('./commands/push.js'),
-  pr: () => import('./commands/pr.js'),
-  audit: () => import('./commands/audit.js'),
-  watch: () => import('./commands/watch.js'),
-  attach: () => import('./commands/attach.js'),
-  transfer: () => import('./commands/transfer.js'),
-  backup: () => import('./commands/backup.js'),
-  backups: () => import('./commands/backup.js'),
-  restore: () => import('./commands/restore.js'),
-  tunnel: () => import('./commands/tunnel.js'),
-  share: () => import('./commands/tunnel.js'),
-  sessions: () => import('./commands/watch.js'),
-  demo: () => import('./commands/demo.js'),
-  login: () => import('./commands/auth.js'),
-  logout: () => import('./commands/auth.js'),
-  whoami: () => import('./commands/auth.js'),
-  doctor: () => import('./commands/doctor.js'),
-  completion: () => import('./commands/completion.js'),
-  __complete: () => import('./commands/completion.js'),
-  update: () => import('./commands/update.js'),
-  upgrade: () => import('./commands/update.js'),
-  uninstall: () => import('./commands/update.js'),
-};
-
 export async function main(argv) {
   const args = parseArgs(argv);
-  if (args.flags.color === false || args.flags['no-color']) setColor(false);
-  if (args.flags.json || args.flags.csv) setColor(false);
+  if (args.flags['no-color'] || args.flags.json) setColor(false);
   if (args.flags.version || args.flags.v) { line(`gitroots ${VERSION}`); return 0; }
+  const [name, ...rest] = args._;
 
-  const [cmd, ...rest] = args._;
-  if (!cmd) {
-    if (args.flags.help || args.flags.h) { help(); return 0; }
-    const { default: splash } = await import('./commands/splash.js');
-    return splash(connect(Store.open()), args);
+  // Hidden plumbing
+  if (name === 'hook') {
+    const fs = await import('node:fs');
+    const { prePush } = await import('./commands/push.js');
+    if (rest[0] !== 'pre-push') throw new Error(`unknown hook ${rest[0]}`);
+    let input = '';
+    try { input = fs.readFileSync(0, 'utf8'); } catch { /* no stdin */ }
+    return prePush({ remote: rest[1], url: rest[2], input });
   }
-  if (cmd === 'help' || args.flags.help || args.flags.h) { help(cmd === 'help' ? rest[0] : cmd); return 0; }
-  if (cmd === 'version') { line(`gitroots ${VERSION}`); return 0; }
+  if (name === 'completion') return (await import('./commands/completion.js')).run(rest, args.flags);
+  if (name === 'uninstall') return (await import('./commands/update.js')).run('uninstall', rest, args.flags);
+  if (name === 'version') { line(`gitroots ${VERSION}`); return 0; }
 
-  const load = COMMANDS[cmd];
-  if (!load) {
-    line(`${c.r('✕')} unknown command ${c.b(cmd)}`);
-    line(`  ${c.g('→ gitroots help')}`);
-    return 2;
-  }
-  const mod = await load();
-  const store = connect(Store.open());
-  const code = await mod.run(cmd, rest, args.flags, store);
-  return code ?? 0;
-}
+  const { find, suggest } = await import('./session/registry.js');
+  const { makeCtx, printHelp, startSession } = await import('./session/repl.js');
 
-const HELP = [
-  ['repos', 'gitroots repo list · branch list <repo> · branch rules <repo> <branch> · clone <repo>', 'repositories and branch rules'],
-  ['push', 'git push  (after gitroots hooks install)  · gitroots check', 'gitroots checks every push before it leaves'],
-  ['review', 'gitroots pr list · pr view <n> · pr diff <n> · pr approve <n> · pr merge <n>', 'reviews and merges'],
-  ['audit', 'gitroots audit · audit <ev-id> · audit follow', 'who did what, when, and what was blocked'],
-  ['agents', 'gitroots watch · attach · transfer · backup · backups · restore · tunnel · share', 'every agent session, one place'],
-  ['account', 'gitroots login · whoami · logout', 'sign in to your gitroots server'],
-  ['setup', 'gitroots doctor · update · completion <shell> · uninstall', 'keep the CLI healthy and current'],
-];
-
-const DETAIL = {
-  status: ['gitroots status', 'Everything at a glance: what needs you, repositories, agent sessions, the last hour.'],
-  repo: ['gitroots repo list', 'List repositories you can see, with protected branches and your role.'],
-  branch: ['gitroots branch list <repo> [--all]\ngitroots branch rules <repo> <branch>', 'Branches and the rules gitroots enforces on them.'],
-  clone: ['gitroots clone <repo|git-url> [dir] [--url <git-url>]', 'Clone a repository and install the gitroots push checks.'],
-  hooks: ['gitroots hooks install [--force]\ngitroots hooks uninstall', 'Install the pre-push hook so git push runs gitroots checks first.'],
-  check: ['gitroots check [<base>..<head>] [--branch <name>]', 'Run the push checks on local commits without pushing.'],
-  pr: ['gitroots pr list [repo] [--state open|merged|all]\ngitroots pr view <n>\ngitroots pr diff <n>\ngitroots pr create [--base staging] [--head branch] [--title "…"] [--draft]\ngitroots pr approve <n> [-m "note"]\ngitroots pr review <n> --request-changes -m "why"\ngitroots pr merge <n> [--yes] [--squash|--rebase|--merge-commit] [--keep-branch]', 'Pull requests: review, approve and merge under the branch rules.'],
-  audit: ['gitroots audit [--repo r] [--since 2h] [--actor a] [--action a] [--decision blocked] [--pr n] [--csv]\ngitroots audit <ev-id>\ngitroots audit follow', 'History of every push, approval, merge and rule change, plus a live stream.'],
-  watch: ['gitroots watch [--machine m]', 'Live dashboard of every agent session. Keys: ↑↓ move · tab machines/sessions · a attach · t transfer · b backup · r restore · f fork · u tunnel · p pause · s stop · / filter · ? help · q quit'],
-  attach: ['gitroots attach <session>', 'Attach to an agent session. Prefix ctrl-g: d detach · b backup · t transfer · f fork · s share read-only. Everything else goes to the agent.'],
-  transfer: ['gitroots transfer <session> --to <machine>', 'Move a running agent session to another machine with its conversation and workspace.'],
-  backup: ['gitroots backup <session> [--label "…"]\ngitroots backups [--repo r] [--session s] [--all]\ngitroots backup policy', 'Snapshot an agent session: conversation, workspace and environment.'],
-  restore: ['gitroots restore <session|backup> [--machine m] [--pick] [--point turn|backup] [--fork]', 'Bring a session back to an earlier point, on any machine.'],
-  tunnel: ['gitroots tunnel <session> --port <n>  [--shell]\ngitroots tunnel ls\ngitroots tunnel close <t-id> | --all\ngitroots share <session> --read-only [--expires 1h]', 'Reach a port on the agent\'s machine, or share a read-only live view.'],
-  demo: ['gitroots demo reset', 'Reset the demo organisation to its starting state.'],
-  login: ['gitroots login [--server https://gitroots.com] [--username u] [--org slug] [--password-stdin]', 'Sign in to a gitroots server. Repositories, branches and audit then come from the API.'],
-  whoami: ['gitroots whoami', 'Show who you are signed in as.'],
-  logout: ['gitroots logout', 'Sign out and forget the stored password.'],
-  doctor: ['gitroots doctor', 'Check the install, git, hooks in this repo, sign-in and terminal support.'],
-  update: ['gitroots update [--version x.y.z]', 'Update to the latest release, the same way gitroots was installed.'],
-  completion: ['gitroots completion bash|zsh|fish', 'Print a shell completion script. e.g. gitroots completion zsh > "${fpath[1]}/_gitroots"'],
-  uninstall: ['gitroots uninstall [--purge]', 'Remove the native install (--purge also removes ~/.gitroots).'],
-};
-DETAIL.upgrade = DETAIL.update; DETAIL.repos = DETAIL.repo; DETAIL.backups = DETAIL.backup; DETAIL.share = DETAIL.tunnel; DETAIL.hook = DETAIL.hooks;
+  if (!name) {
+    if (args.flags.help || args.flags.h || !interactive()) { printHelp(false); return 0; }
+    return startSession();
+  }
+  if (name === 'help' || args.flags.help || args.flags.h) { printHelp(false); return 0; }
 
-export function help(topic) {
-  if (topic && DETAIL[topic]) {
-    const [usage, desc] = DETAIL[topic];
-    line(desc);
-    line();
-    for (const u of usage.split('\n')) line(`  ${c.g(u)}`);
-    line();
-    line(c.m('  --json on every command · colors and motion drop when piped or with NO_COLOR'));
-    return;
+  const cmd = find(name);
+  if (!cmd || cmd.session || !cmd.run) {
+    const near = suggest(name);
+    line(`${c.r('✕')} unknown command ${c.b(name)}${near.length ? `  ${c.m('did you mean')} ${near.map((x) => c.g(x.name)).join(', ')}?` : ''}`);
+    line(`  ${c.m('gitroots help lists them all · gitroots on its own opens a session')}`);
+    return 2;
   }
-  line(`${brand()}  ${c.s(`v${VERSION}`)}  ${dot()}  ${c.s('code governance and agent sessions')}`);
-  line();
-  line(c.m('QUICK START'));
-  for (const [k, cmds, what] of HELP) line(`  ${c.s(k.padEnd(8))}  ${c.g(cmds)}`), line(`  ${' '.repeat(8)}  ${c.m(what)}`);
-  line();
-  line(c.m('  gitroots help <command> for details · --json on every command'));
+  const ctx = makeCtx({ session: false });
+  ctx.json = Boolean(args.flags.json);
+  const ac = new AbortController();
+  ctx.signal = ac.signal;
+  process.on('SIGINT', () => { ac.abort(); process.exit(130); });
+  const code = await cmd.run(ctx, rest, args.flags);
+  return code ?? 0;
 }

package/src/commands/completion.js

@@ -1,37 +1,21 @@
-// gitroots completion bash|zsh|fish · and the hidden `gitroots __complete <kind>` it calls for live ids
-const TREE = {
-  status: [], repo: ['list', 'view'], branch: ['list', 'rules', 'restore'], clone: [], hooks: ['install', 'uninstall'], check: [],
-  pr: ['list', 'view', 'diff', 'create', 'approve', 'review', 'merge'], audit: ['follow'], watch: [], sessions: [],
-  attach: '@sessions', transfer: '@sessions', backup: '@sessions', backups: [], restore: '@sessions', tunnel: ['ls', 'close'], share: '@sessions',
-  login: [], logout: [], whoami: [], doctor: [], update: [], uninstall: [], completion: ['bash', 'zsh', 'fish'], demo: ['reset'], help: [],
-};
-const FLAGS = '--json --help --no-color --repo --since --actor --action --decision --to --machine --label --pick --fork --point --port --read-only --expires --yes --all --base --head --title --draft';
+// gitroots completion bash|zsh|fish
+import { COMMANDS } from '../session/registry.js';
 
-export async function run(cmd, rest, flags, store) {
-  if (cmd === '__complete') {
-    const kind = rest[0];
-    const ids = kind === 'sessions' ? store.sessions().map((s) => s.id)
-      : kind === 'prs' ? store.prs().map((p) => String(p.number))
-        : kind === 'machines' ? store.machines().map((m) => m.name)
-          : kind === 'repos' ? store.repos().map((r) => r.name)
-            : kind === 'backups' ? store.backups().map((b) => b.id) : [];
-    process.stdout.write(`${ids.join('\n')}\n`);
-    return 0;
-  }
+const SUBS = { hooks: ['install', 'uninstall'], approvals: ['waiting', 'approved', 'declined'], audit: ['blocked', 'merges', 'access', 'other'] };
+const FLAGS = '--json --help --no-color --blocked --force --server';
+
+export async function run(rest) {
   const shell = rest[0] || (process.env.SHELL || '').split('/').pop();
-  const cmds = Object.keys(TREE).join(' ');
-  const subs = Object.entries(TREE).filter(([, v]) => Array.isArray(v) && v.length);
+  const cmds = COMMANDS.filter((c) => !c.session).map((c) => c.name).join(' ');
+  const subs = Object.entries(SUBS);
   if (shell === 'bash') {
     process.stdout.write(`# gitroots bash completion · eval "$(gitroots completion bash)"
 _gitroots() {
-  local cur prev words cword
-  cur="\${COMP_WORDS[COMP_CWORD]}"; prev="\${COMP_WORDS[COMP_CWORD-1]}"
+  local cur="\${COMP_WORDS[COMP_CWORD]}"
   if [ "$COMP_CWORD" -eq 1 ]; then COMPREPLY=( $(compgen -W "${cmds}" -- "$cur") ); return; fi
   case "$cur" in -*) COMPREPLY=( $(compgen -W "${FLAGS}" -- "$cur") ); return;; esac
-  case "$prev" in --to|--machine) COMPREPLY=( $(compgen -W "$(gitroots __complete machines 2>/dev/null)" -- "$cur") ); return;; esac
   case "\${COMP_WORDS[1]}" in
-${subs.map(([k, v]) => `    ${k}) if [ "$COMP_CWORD" -eq 2 ]; then COMPREPLY=( $(compgen -W "${v.join(' ')}" -- "$cur") ); fi;;`).join('\n')}
-    attach|transfer|backup|restore|share) COMPREPLY=( $(compgen -W "$(gitroots __complete sessions 2>/dev/null)" -- "$cur") );;
+${subs.map(([k, v]) => `    ${k}) COMPREPLY=( $(compgen -W "${v.join(' ')}" -- "$cur") );;`).join('\n')}
   esac
 }
 complete -F _gitroots gitroots
@@ -40,16 +24,12 @@ complete -F _gitroots gitroots
   }
   if (shell === 'zsh') {
     process.stdout.write(`#compdef gitroots
-# gitroots zsh completion · gitroots completion zsh > "\${fpath[1]}/_gitroots"  (or: source <(gitroots completion zsh))
+# gitroots zsh completion · gitroots completion zsh > "\${fpath[1]}/_gitroots"
 _gitroots() {
-  local -a cmds
-  cmds=(${cmds})
-  if (( CURRENT == 2 )); then compadd -a cmds; return; fi
+  if (( CURRENT == 2 )); then compadd -- ${cmds}; return; fi
   if [[ $words[CURRENT] == -* ]]; then compadd -- ${FLAGS}; return; fi
-  if [[ $words[CURRENT-1] == (--to|--machine) ]]; then compadd -- \${(f)"$(gitroots __complete machines 2>/dev/null)"}; return; fi
   case $words[2] in
-${subs.map(([k, v]) => `    ${k}) (( CURRENT == 3 )) && compadd -- ${v.join(' ')};;`).join('\n')}
-    attach|transfer|backup|restore|share) compadd -- \${(f)"$(gitroots __complete sessions 2>/dev/null)"};;
+${subs.map(([k, v]) => `    ${k}) compadd -- ${v.join(' ')};;`).join('\n')}
   esac
 }
 compdef _gitroots gitroots
@@ -57,11 +37,8 @@ compdef _gitroots gitroots
     return 0;
   }
   if (shell === 'fish') {
-    const lines = ['# gitroots fish completion · gitroots completion fish > ~/.config/fish/completions/gitroots.fish', 'complete -c gitroots -f'];
-    lines.push(`complete -c gitroots -n __fish_use_subcommand -a "${cmds}"`);
+    const lines = ['# gitroots fish completion · gitroots completion fish > ~/.config/fish/completions/gitroots.fish', 'complete -c gitroots -f', `complete -c gitroots -n __fish_use_subcommand -a "${cmds}"`];
     for (const [k, v] of subs) lines.push(`complete -c gitroots -n "__fish_seen_subcommand_from ${k}" -a "${v.join(' ')}"`);
-    lines.push('complete -c gitroots -n "__fish_seen_subcommand_from attach transfer backup restore share" -a "(gitroots __complete sessions 2>/dev/null)"');
-    lines.push('complete -c gitroots -l to -l machine -a "(gitroots __complete machines 2>/dev/null)"');
     process.stdout.write(`${lines.join('\n')}\n`);
     return 0;
   }

package/src/commands/push.js

@@ -1,46 +1,19 @@
 // git push · gitroots checks
 //   gitroots hooks install|uninstall   writes .git/hooks/pre-push
 //   gitroots hook pre-push <remote> <url>   (called by git, refs on stdin)
-//   gitroots check [base..head]        same checks without pushing
+//   gitroots check [base..head]        the same checks without pushing
 import fs from 'node:fs';
 import path from 'node:path';
 import { selfCommand } from '../runtime.js';
 import { c, pad } from '../ui/ansi.js';
 import { line, runSteps } from '../ui/term.js';
-import { brand, dot, box, json } from '../ui/components.js';
+import { brand, dot, box } from '../ui/components.js';
 import { git, tryGit, ZERO, commitsToPush, changedFiles, addedLines, scanSecrets, authors, MIGRATION_RE, lastSubjectSlug } from '../git/checks.js';
+import { loadRules, decide, globMatch } from '../rules.js';
+import { Api } from '../api.js';
 
 const MARK = '# gitroots push checks';
 
-export async function run(cmd, rest, flags, store) {
-  if (cmd === 'hooks') {
-    const [sub = 'install', dir = '.'] = rest;
-    if (sub === 'install') {
-      const r = installHook(dir, { force: flags.force });
-      if (flags.json) { json(r); return 0; }
-      line(`  ${c.g('✓')} Push checks installed   ${c.m(r.path.replace(process.env.HOME || '\u0000', '~'))}${r.chained ? c.m(` · your previous hook runs first (${path.basename(r.chained)})`) : ''}`);
-      line(`    ${c.m('git push now runs gitroots checks first')}     ${c.g('→ gitroots check')}`);
-      return 0;
-    }
-    if (sub === 'uninstall') {
-      const r = uninstallHook(dir);
-      if (flags.json) { json(r); return 0; }
-      line(r.removed ? `  ${c.g('✓')} Push checks removed` : `  ${c.m('○ no gitroots hook installed')}`);
-      return 0;
-    }
-    throw new Error('usage: gitroots hooks install|uninstall [dir]');
-  }
-  if (cmd === 'hook') {
-    const [kind, remote, url] = rest;
-    if (kind !== 'pre-push') throw new Error(`unknown hook ${kind}`);
-    let input = '';
-    try { input = fs.readFileSync(0, 'utf8'); } catch { /* no stdin */ }
-    return prePush({ remote, url, input, store, flags });
-  }
-  // check
-  return checkLocal(rest, flags, store);
-}
-
 function hooksDir(dir) {
   const top = tryGit(['rev-parse', '--show-toplevel'], dir);
   if (!top) throw new Error(`${path.resolve(dir)} is not a git repository`);
@@ -85,7 +58,7 @@ exit 1
   return { path: file, chained };
 }
 
-function uninstallHook(dir = '.') {
+export function uninstallHook(dir = '.') {
   const hd = hooksDir(dir);
   const file = path.join(hd, 'pre-push');
   if (!fs.existsSync(file) || !fs.readFileSync(file, 'utf8').includes(MARK)) return { removed: false };
@@ -95,36 +68,39 @@ function uninstallHook(dir = '.') {
   return { removed: true, restored: fs.existsSync(file) };
 }
 
-/**
- * Run every check for one ref update. Returns { blocked, reason, results }.
- */
-async function checkRef({ store, repoName, branch, localSha, remoteSha, cwd, quiet }) {
-  const commits = commitsToPush(localSha, remoteSha, cwd);
-  const cfg = repoName ? null : repoConfig(cwd);
-  const rule = repoName ? store.ruleFor(repoName, branch) : configRule(store, cfg, branch);
-  const paths = repoName ? store.protectedPaths(repoName) : (cfg?.paths || []);
 
-  if (rule.protected && rule.directPush === false) {
-    return { blocked: true, kind: 'rule', rule, commits };
-  }
-  if (!quiet) line(`${brand()}  ${c.s(`checking ${commits.length} commit${commits.length === 1 ? '' : 's'} before ${commits.length === 1 ? 'it leaves' : 'they leave'}`)}`);
+export function hookStatus(dir = '.') {
+  const top = tryGit(['rev-parse', '--show-toplevel'], dir);
+  if (!top) return { repo: null, installed: false };
+  const file = path.join(hooksDir(dir), 'pre-push');
+  return { repo: top, installed: fs.existsSync(file) && fs.readFileSync(file, 'utf8').includes(MARK), path: file };
+}
+
+const SOURCE = { gitroots: 'rules from gitroots', cache: 'rules from gitroots (cached)', '.gitroots.json': 'rules from .gitroots.json', none: 'no branch rules for this repo' };
+
+/** Run every check for one ref update. */
+async function checkRef({ set, branch, localSha, remoteSha, cwd }) {
+  const commits = commitsToPush(localSha, remoteSha, cwd);
+  const verdict = decide(set, branch);
+  if (verdict.blocked) return { blocked: true, kind: 'rule', verdict, commits };
+  line(`${brand()}  ${c.s(`checking ${commits.length} commit${commits.length === 1 ? '' : 's'} before ${commits.length === 1 ? 'it leaves' : 'they leave'}`)}  ${c.m(`${dot()} ${SOURCE[set.source]}`)}`);
   let files = [];
   let secretHits = [];
   const steps = [
-    { name: 'Branch rule', live: `reading rules for ${branch}…`, ms: 400, run: async () => ({ detail: `${rule.name === '*' ? branch : rule.name} · ${rule.label.replace(/^[^·]*· /, '')}` }) },
+    { name: 'Branch rule', live: `reading rules for ${branch}…`, ms: 250, run: async () => ({ detail: verdict.label }) },
     {
-      name: 'Protected paths', live: 'checking changed files…', ms: 400,
+      name: 'Protected paths', live: 'checking changed files…', ms: 250,
       run: async () => {
         files = changedFiles(commits, cwd);
-        if (!paths.length) return { detail: `${files.length} files changed · no protected paths on ${branch}` };
-        const hits = files.filter((f) => paths.some((p) => store.matchPath(p.pattern, f)));
-        if (!hits.length) return { detail: `no files under ${paths.map((p) => p.pattern).join(', ')}` };
-        const p = paths.find((x) => hits.some((f) => store.matchPath(x.pattern, f)));
-        return { status: 'warn', detail: `${hits.length} file${hits.length > 1 ? 's' : ''} under ${p.pattern} · needs ${p.needs}`, hits };
+        if (!set.paths.length) return { detail: `${files.length} file${files.length === 1 ? '' : 's'} changed` };
+        const hits = files.filter((f) => set.paths.some((p) => globMatch(p.pattern, f)));
+        if (!hits.length) return { detail: `no files under ${set.paths.map((p) => p.pattern).join(', ')}` };
+        const p = set.paths.find((x) => hits.some((f) => globMatch(x.pattern, f)));
+        return { status: 'warn', detail: `${hits.length} file${hits.length > 1 ? 's' : ''} under ${p.pattern} · needs ${p.needs}` };
       },
     },
     {
-      name: 'Secrets scan', live: `scanning ${commits.length} commits…`, ms: 600,
+      name: 'Secrets scan', live: `scanning ${commits.length} commits…`, ms: 350,
       run: async () => {
         secretHits = scanSecrets(addedLines(commits, cwd));
         if (!secretHits.length) return { detail: '0 keys or passwords found' };
@@ -133,113 +109,73 @@ async function checkRef({ store, repoName, branch, localSha, remoteSha, cwd, qui
       },
     },
     {
-      name: 'Commit authors', live: 'checking authors…', ms: 300,
+      name: 'Commit authors', live: 'checking authors…', ms: 200,
       run: async () => {
         const a = authors(commits, cwd);
         const names = [...new Set(a.map((x) => x.name))];
         const signed = a.filter((x) => x.signed).length;
-        const sig = !a.length ? '' : signed === a.length ? ' · verified' : signed ? ` · ${signed} of ${a.length} signed` : ' · unsigned';
+        const sig = !a.length ? '' : signed === a.length ? ' · signed' : signed ? ` · ${signed} of ${a.length} signed` : ' · unsigned';
         return { detail: `${a.length} commit${a.length === 1 ? '' : 's'} · ${names.slice(0, 3).join(', ')}${names.length > 3 ? ` +${names.length - 3}` : ''}${sig}` };
       },
     },
     {
-      name: 'Migration files', live: 'looking for database changes…', ms: 400,
+      name: 'Migration files', live: 'looking for database changes…', ms: 250,
       run: async () => {
         const mig = files.filter((f) => MIGRATION_RE.test(f));
         if (!mig.length) return { detail: 'no database changes' };
-        return { status: 'warn', detail: `${path.basename(mig[0])}${mig.length > 1 ? ` +${mig.length - 1}` : ''} changes data, flagged for review` };
+        return { status: 'warn', detail: `${path.basename(mig[0])}${mig.length > 1 ? ` +${mig.length - 1}` : ''} changes data, flag it for review` };
       },
     },
   ];
   const results = await runSteps(steps, { nameWidth: 20, showQueued: true });
-  if (secretHits.length) return { blocked: true, kind: 'secret', hits: secretHits, rule, commits, results };
-  return { blocked: false, rule, commits, results, files };
-}
-
-// Rules for repositories outside the gitroots org: .gitroots.json at the repo root.
-//   { "protected": ["main", "release/*"], "paths": [{ "pattern": "infra/**", "needs": "an ops review" }] }
-export function repoConfig(cwd) {
-  const top = tryGit(['rev-parse', '--show-toplevel'], cwd);
-  if (!top) return null;
-  try {
-    const cfg = JSON.parse(fs.readFileSync(path.join(top, '.gitroots.json'), 'utf8'));
-    return { repo: cfg.repo || path.basename(top), protected: cfg.protected || [], paths: (cfg.paths || []).map((p) => (typeof p === 'string' ? { pattern: p, needs: 'a review' } : p)), suggest: cfg.suggest };
-  } catch { return null; }
+  if (secretHits.length) return { blocked: true, kind: 'secret', hits: secretHits, commits, results };
+  return { blocked: false, commits, results };
 }
 
-function configRule(store, cfg, branch) {
-  if (!cfg) return { name: '*', protected: false, directPush: true, label: 'repository not managed by gitroots' };
-  const hit = cfg.protected.find((p) => store.matchPath(p, branch));
-  if (hit) return { name: hit, protected: true, directPush: false, label: `${hit}: no direct push, PR only`, suggest: cfg.suggest || 'push to a feature branch, then open a PR' };
-  return { name: '*', protected: false, directPush: true, label: 'developers can push · .gitroots.json' };
+function ruleBox({ repo, branch, verdict, localSha, cwd, remote }) {
+  const slug = lastSubjectSlug(localSha, cwd);
+  box([
+    `${brand()}  ${c.r(c.b('✕ Push blocked'))}   ${c.m('nothing left your machine')}`,
+    `  ${c.s('repo')}     ${repo} ${dot()} ${c.s('branch')} ${branch} ${dot()} ${c.s('rule')} ${verdict.label}`,
+    `  ${c.s('you can')}  ${verdict.suggest}`,
+    `  ${c.g(`→ git switch -c feature/${slug} && git push -u ${remote || 'origin'} feature/${slug}`)}`,
+  ], 'r');
 }
 
-function blockedBox(store, { repoName, branch, rule, localSha, cwd, ev, remote }) {
-  const slug = lastSubjectSlug(localSha, cwd);
+function secretBox(hits) {
   box([
     `${brand()}  ${c.r(c.b('✕ Push blocked'))}   ${c.m('nothing left your machine')}`,
-    `  ${c.s('repo')}     ${repoName} ${dot()} ${c.s('branch')} ${branch} ${dot()} ${c.s('rule')} ${rule.label}`,
-    `  ${c.s('you can')}  ${rule.suggest || 'push to a feature branch, then open a PR'}`,
-    `  ${c.g(`→ git switch -c feature/${slug} && git push -u ${remote || 'origin'} feature/${slug}`)}      ${c.m(`this attempt is logged · ${ev.id}`)}`,
+    ...hits.slice(0, 4).map((x) => `  ${c.r('✕')} ${pad(x.kind, 18)} ${x.file}:${x.line}  ${c.m(`commit ${x.sha.slice(0, 7)}`)}`),
+    `  ${c.s('you can')}  remove the secret, rotate it, then rewrite the commit (git commit --amend or git rebase -i)`,
   ], 'r');
 }
 
-export async function prePush({ remote, url, input, store, flags }) {
+export async function prePush({ remote, input }) {
   const cwd = process.cwd();
-  const repo = store.repoByRemote(url);
-  const repoName = repo ? repo.name : null;
-  const shownName = repoName || repoConfig(cwd)?.repo || path.basename(cwd);
+  const set = await loadRules(cwd, { api: Api.fromConfig(), timeout: 2500 });
   const updates = input.split('\n').map((l) => l.trim().split(/\s+/)).filter((p) => p.length === 4);
   let code = 0;
-  for (const [localRef, localSha, remoteRef, remoteSha] of updates) {
+  for (const [, localSha, remoteRef, remoteSha] of updates) {
     if (!remoteRef.startsWith('refs/heads/')) continue; // tags are not checked
     const branch = remoteRef.slice('refs/heads/'.length);
     if (ZERO.test(localSha)) {
-      const rule = repoName ? store.ruleFor(repoName, branch) : configRule(store, repoConfig(cwd), branch);
-      if (rule.protected) {
-        const ev = store.record({ actor: store.org.user, action: 'delete branch', target: `${branch}`, decision: 'blocked', note: rule.label, repo: shownName, rule: rule.label });
-        store.save();
-        line(`${brand()}  ${c.r('✕ Deleting a protected branch is blocked')}  ${c.m(`${shownName} · ${branch} · ${ev.id}`)}`);
-        code = 1;
-      }
-      continue;
-    }
-    const res = await checkRef({ store, repoName, branch, localSha, remoteSha, cwd });
-    if (res.blocked && res.kind === 'rule') {
-      const ev = store.record({ actor: store.org.user, action: 'push', target: `${branch} · ${res.commits.length} commit${res.commits.length === 1 ? '' : 's'}`, decision: 'blocked', note: res.rule.label, repo: shownName, rule: res.rule.label, ack: true });
-      store.save();
-      blockedBox(store, { repoName: shownName, branch, rule: res.rule, localSha, cwd, ev, remote });
-      code = 1;
-      continue;
-    }
-    if (res.blocked) {
-      const h0 = res.hits[0];
-      const ev = store.record({ actor: store.org.user, action: 'push', target: `${branch} · secrets scan`, decision: 'blocked', note: `${h0.kind} in ${path.basename(h0.file)}`, repo: shownName });
-      store.save();
-      line();
-      box([
-        `${brand()}  ${c.r(c.b('✕ Push blocked'))}   ${c.m('nothing left your machine')}`,
-        ...res.hits.slice(0, 4).map((x) => `  ${c.r('✕')} ${pad(x.kind, 18)} ${x.file}:${x.line}  ${c.m(`commit ${x.sha.slice(0, 7)}`)}`),
-        `  ${c.s('you can')}  remove the secret, rotate it, then rewrite the commit (git commit --amend or git rebase -i)`,
-        `  ${c.m(`this attempt is logged · ${ev.id}`)}`,
-      ], 'r');
-      code = 1;
+      const v = decide(set, branch);
+      if (v.blocked) { line(`${brand()}  ${c.r('✕ Deleting a protected branch is blocked')}  ${c.m(`${set.repo} · ${v.label}`)}`); code = 1; }
       continue;
     }
+    const res = await checkRef({ set, branch, localSha, remoteSha, cwd });
+    if (res.blocked && res.kind === 'rule') { ruleBox({ repo: set.repo, branch, verdict: res.verdict, localSha, cwd, remote }); code = 1; continue; }
+    if (res.blocked) { line(); secretBox(res.hits); code = 1; continue; }
     const warns = res.results.filter((r) => r.status === 'warn').length;
-    store.record({ actor: store.org.user, action: 'push', target: `${branch} · ${res.commits.length} commit${res.commits.length === 1 ? '' : 's'}`, decision: 'allowed', note: warns ? `${warns} note${warns > 1 ? 's' : ''} for review` : 'checks passed', repo: shownName });
-    store.save();
-    const pr = repoName && store.prs(repoName).find((p) => p.from === branch && p.state === 'open');
-    const tail = pr ? `PR #${pr.number} will update ${dot()} reviewers notified` : `pushing to ${remote || 'origin'}`;
-    line(`${brand()}  ${c.g('✓ Checks passed')} ${dot()} ${tail}${warns ? ` ${dot()} ${warns} note${warns > 1 ? 's' : ''} for review` : ''}${pr ? `       ${c.g(`→ gitroots pr view ${pr.number}`)}` : ''}`);
+    line(`${brand()}  ${c.g('✓ Checks passed')} ${dot()} pushing to ${remote || 'origin'}${warns ? ` ${dot()} ${c.w(`${warns} note${warns > 1 ? 's' : ''} for review`)}` : ''}`);
   }
-  if (flags?.json) json({ ok: code === 0 });
   return code;
 }
 
-async function checkLocal(rest, flags, store) {
+/** gitroots check / the /check command: the push checks on local commits, without pushing. */
+export async function checkLocal(rest = [], { api, branch: branchFlag } = {}) {
   const cwd = process.cwd();
-  if (!tryGit(['rev-parse', '--show-toplevel'], cwd)) throw new Error('not inside a git repository');
+  if (!tryGit(['rev-parse', '--show-toplevel'], cwd)) throw new Error('not inside a git repository · cd into one, or run /hooks there');
   let localSha;
   let remoteSha = '';
   const range = rest[0];
@@ -249,18 +185,16 @@ async function checkLocal(rest, flags, store) {
     localSha = git(['rev-parse', b || 'HEAD'], cwd).trim();
   } else {
     localSha = git(['rev-parse', range || 'HEAD'], cwd).trim();
-    const up = tryGit(['rev-parse', '@{upstream}'], cwd);
-    remoteSha = up || '';
+    remoteSha = tryGit(['rev-parse', '@{upstream}'], cwd) || '';
   }
   const current = tryGit(['rev-parse', '--abbrev-ref', 'HEAD'], cwd);
-  const branch = flags.branch || current;
-  const url = tryGit(['remote', 'get-url', tryGit(['config', `branch.${current}.remote`], cwd) || 'origin'], cwd);
-  const repo = store.repoByRemote(url) || (flags.repo ? store.repo(flags.repo) : null);
-  line(`${c.m(cwd.replace(process.env.HOME || '\u0000', '~'))} ${c.i(branch)}${repo ? c.m(`  ${dot()} gitroots repo ${repo.name}`) : (repoConfig(cwd) ? c.m(`  ${dot()} rules from .gitroots.json`) : c.m(`  ${dot()} not a gitroots repo, default rules`))}`);
-  const res = await checkRef({ store, repoName: repo?.name, branch, localSha, remoteSha, cwd });
+  const branch = branchFlag || current;
+  const set = await loadRules(cwd, { api });
+  line(`${c.m(cwd.replace(process.env.HOME || '\u0000', '~'))} ${c.i(branch)}  ${c.m(`${dot()} ${set.repo || ''} ${dot()} ${SOURCE[set.source]}`)}`);
+  const res = await checkRef({ set, branch, localSha, remoteSha, cwd });
   if (res.blocked && res.kind === 'rule') {
-    line(`${brand()}  ${c.r('✕ This push would be blocked')}  ${c.m(`rule ${res.rule.label}`)}`);
-    line(`  ${c.s('you can')}  ${res.rule.suggest || 'push to a feature branch, then open a PR'}`);
+    line(`${brand()}  ${c.r('✕ A push to this branch would be blocked')}  ${c.m(res.verdict.label)}`);
+    line(`  ${c.s('you can')}  ${res.verdict.suggest}`);
     return 1;
   }
   if (res.blocked) {
@@ -268,6 +202,6 @@ async function checkLocal(rest, flags, store) {
     line(`${brand()}  ${c.r('✕ This push would be blocked')}  ${c.m('remove the secret and rewrite the commit')}`);
     return 1;
   }
-  line(`${brand()}  ${c.g('✓ Ready to push')}       ${c.g('→ git push')}`);
+  line(`${brand()}  ${c.g('✓ Ready to push')}`);
   return 0;
 }

package/src/commands/update.js

@@ -7,7 +7,7 @@ import { line, spinner, bar, confirm } from '../ui/term.js';
 import { json } from '../ui/components.js';
 import { VERSION, NPM_PACKAGE, DOWNLOAD_BASE, installMethod, nativePaths, platformKey } from '../runtime.js';
 import { latestVersion, installNative, newer, onPath } from '../installer.js';
-import { home } from '../data/store.js';
+import { home } from '../config.js';
 
 export async function run(cmd, rest, flags) {
   if (cmd === 'uninstall') return uninstall(flags);