javi-forge 1.32.0 → 1.34.0

package/dist/lib/secure-refusal-remediation.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Pure refusal → remediation table for the CLI layer (Linux hardening, Slice A).
+ *
+ * The secure-fs adapters stay PROVERS: they emit stable `SecureRefusal` codes
+ * plus a stable detail token and carry ZERO user copy. This module is the only
+ * place that turns one of those tokens into an actionable next step, so the
+ * proof algorithms and their refusal identities never move when the copy does.
+ *
+ * The table is deliberately narrow. A remediation is emitted ONLY when the user
+ * can actually fix the cause: an unresolvable `getfacl` is fixed by installing
+ * the `acl` package, while a REAL extended ACL (the adapter ran and found a
+ * named-user entry) is not — suggesting a package install there would be
+ * actively misleading. No I/O, no rendering, no Ink.
+ */
+import type { SecureRefusal } from "./secure-fs-transaction.js";
+/** The one actionable line for a host whose POSIX ACL adapter is missing. */
+export declare const ACL_PACKAGE_REMEDIATION = "install the acl package (provides getfacl): apt install acl \u00B7 apk add acl \u00B7 dnf install acl";
+/**
+ * The actionable line for a refusal + detail pair, or `undefined` when nothing
+ * the user can do would change the outcome.
+ */
+export declare function remediationForRefusal(refusal: SecureRefusal, detail?: string): string | undefined;
+/**
+ * The same lookup for an already-rendered refusal MESSAGE (the transaction
+ * flattens `refusal`/`detail` into strings such as `acl /path: getfacl absent`).
+ * Matching is anchored to the message TAIL so prose that merely mentions the
+ * token never triggers a wrong hint.
+ */
+export declare function remediationForMessage(message: string): string | undefined;
+//# sourceMappingURL=secure-refusal-remediation.d.ts.map

package/dist/lib/secure-refusal-remediation.js

@@ -0,0 +1,48 @@
+/**
+ * Pure refusal → remediation table for the CLI layer (Linux hardening, Slice A).
+ *
+ * The secure-fs adapters stay PROVERS: they emit stable `SecureRefusal` codes
+ * plus a stable detail token and carry ZERO user copy. This module is the only
+ * place that turns one of those tokens into an actionable next step, so the
+ * proof algorithms and their refusal identities never move when the copy does.
+ *
+ * The table is deliberately narrow. A remediation is emitted ONLY when the user
+ * can actually fix the cause: an unresolvable `getfacl` is fixed by installing
+ * the `acl` package, while a REAL extended ACL (the adapter ran and found a
+ * named-user entry) is not — suggesting a package install there would be
+ * actively misleading. No I/O, no rendering, no Ink.
+ */
+import { ACL_DETAIL } from "./secure-fs-posix.js";
+/** The one actionable line for a host whose POSIX ACL adapter is missing. */
+export const ACL_PACKAGE_REMEDIATION = "install the acl package (provides getfacl): apt install acl · apk add acl · dnf install acl";
+/** Detail tokens that map to a remediation, keyed by refusal code. */
+const REMEDIATION_TABLE = {
+    "unsupported-posix-acl": {
+        [ACL_DETAIL.getfaclAbsent]: ACL_PACKAGE_REMEDIATION,
+    },
+};
+/**
+ * The actionable line for a refusal + detail pair, or `undefined` when nothing
+ * the user can do would change the outcome.
+ */
+export function remediationForRefusal(refusal, detail) {
+    if (detail === undefined)
+        return undefined;
+    return REMEDIATION_TABLE[refusal]?.[detail];
+}
+/**
+ * The same lookup for an already-rendered refusal MESSAGE (the transaction
+ * flattens `refusal`/`detail` into strings such as `acl /path: getfacl absent`).
+ * Matching is anchored to the message TAIL so prose that merely mentions the
+ * token never triggers a wrong hint.
+ */
+export function remediationForMessage(message) {
+    for (const details of Object.values(REMEDIATION_TABLE)) {
+        for (const [detail, line] of Object.entries(details)) {
+            if (message.endsWith(detail))
+                return line;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=secure-refusal-remediation.js.map

package/dist/ui/App.js

@@ -2,6 +2,7 @@ import path from "node:path";
 import { Box } from "ink";
 import React, { useState } from "react";
 import { initProject } from "../commands/init.js";
+import { buildInitOptions } from "./build-init-options.js";
 import CISelector from "./CISelector.js";
 import Header from "./Header.js";
 import HookProfileSelector from "./HookProfileSelector.js";
@@ -80,29 +81,15 @@ export default function App({ dryRun = false, presetStack, presetCI, presetMemor
     };
     const runInit = async (opts) => {
         setStage("running");
-        await initProject({
+        await initProject(buildInitOptions(opts, {
             projectName,
             projectDir,
             stack,
             ciProvider,
             memory,
-            aiSync: opts.aiSync,
-            sdd: opts.sdd,
-            ghagga: opts.ghagga,
-            contextDir: opts.contextDir,
-            claudeMd: opts.claudeMd,
-            securityHooks: opts.securityHooks,
-            hookProfile: opts.hookProfile,
-            // Derived from securityHooks alone — ALL profiles incl. Minimal
-            // install the managed guard when security hooks are enabled.
-            claudePreToolUseGuard: opts.securityHooks,
-            codeGraph: opts.codeGraph,
-            localAi: opts.localAi,
-            dockerDeploy: false,
-            dockerServiceName: "app",
             mock: presetMock,
             dryRun,
-        }, (step) => setSteps((prev) => {
+        }), (step) => setSteps((prev) => {
             const idx = prev.findIndex((s) => s.id === step.id);
             if (idx >= 0) {
                 const next = [...prev];

package/dist/ui/build-init-options.d.ts

@@ -0,0 +1,44 @@
+import type { CIProvider, HookProfile, InitOptions, MemoryOption, Stack } from "../types/index.js";
+/**
+ * Wizard-collected toggles for an init run — the subset the user answers
+ * interactively (or via presets). Mirrors the `runInit` opts parameter.
+ */
+export interface InitOptionsWizardResult {
+    aiSync: boolean;
+    sdd: boolean;
+    contextDir: boolean;
+    claudeMd: boolean;
+    ghagga: boolean;
+    securityHooks: boolean;
+    codeGraph: boolean;
+    localAi: boolean;
+    hookProfile: HookProfile;
+}
+/**
+ * Surrounding context resolved before the wizard finishes — project identity,
+ * stack/CI/memory choices, and run flags (mock/dryRun).
+ */
+export interface InitOptionsContext {
+    projectName: string;
+    projectDir: string;
+    stack: Stack;
+    ciProvider: CIProvider;
+    memory: MemoryOption;
+    mock: boolean;
+    dryRun: boolean;
+}
+/**
+ * Pure mapping from wizard result + surrounding context to the full
+ * {@link InitOptions} contract passed to `initProject`.
+ *
+ * Extracted from the single inline object literal in `App.tsx#runInit` so the
+ * derivation is unit-testable. Behavior-identical: field values must match the
+ * previous inline literal exactly.
+ *
+ * Notably, `claudePreToolUseGuard` is derived from `securityHooks` alone — ALL
+ * hook profiles (including "minimal") install the managed guard when security
+ * hooks are enabled. A regression here silently disables managed-guard
+ * installation, so it is pinned by build-init-options.test.ts.
+ */
+export declare function buildInitOptions(opts: InitOptionsWizardResult, ctx: InitOptionsContext): InitOptions;
+//# sourceMappingURL=build-init-options.d.ts.map

package/dist/ui/build-init-options.js

@@ -0,0 +1,39 @@
+/**
+ * Pure mapping from wizard result + surrounding context to the full
+ * {@link InitOptions} contract passed to `initProject`.
+ *
+ * Extracted from the single inline object literal in `App.tsx#runInit` so the
+ * derivation is unit-testable. Behavior-identical: field values must match the
+ * previous inline literal exactly.
+ *
+ * Notably, `claudePreToolUseGuard` is derived from `securityHooks` alone — ALL
+ * hook profiles (including "minimal") install the managed guard when security
+ * hooks are enabled. A regression here silently disables managed-guard
+ * installation, so it is pinned by build-init-options.test.ts.
+ */
+export function buildInitOptions(opts, ctx) {
+    return {
+        projectName: ctx.projectName,
+        projectDir: ctx.projectDir,
+        stack: ctx.stack,
+        ciProvider: ctx.ciProvider,
+        memory: ctx.memory,
+        aiSync: opts.aiSync,
+        sdd: opts.sdd,
+        ghagga: opts.ghagga,
+        contextDir: opts.contextDir,
+        claudeMd: opts.claudeMd,
+        securityHooks: opts.securityHooks,
+        hookProfile: opts.hookProfile,
+        // Derived from securityHooks alone — ALL profiles incl. Minimal
+        // install the managed guard when security hooks are enabled.
+        claudePreToolUseGuard: opts.securityHooks,
+        codeGraph: opts.codeGraph,
+        localAi: opts.localAi,
+        dockerDeploy: false,
+        dockerServiceName: "app",
+        mock: ctx.mock,
+        dryRun: ctx.dryRun,
+    };
+}
+//# sourceMappingURL=build-init-options.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.32.0",
+	"version": "1.34.0",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {