mergejudge-runner 0.4.2 → 0.4.3

package/README.md

@@ -124,6 +124,7 @@ Logs go to stderr.
 
 ## Changelog
 
+- **0.4.3** (2026-10-17): bundles the MergeJudge #92 rules fix: a safety guard (e.g. `persist-credentials: false`) removed together with its whole YAML step or job no longer forces block. No config or protocol changes.
 - **0.4.2** (2026-10-17): a heartbeat answered with `done` after the result was accepted is treated as benign, not as a lost lease (MergeJudge #86). In deep-local mode the runner secret-scans the full local diff, including files GitHub strips from the API diff (large or generated files) (MergeJudge #87). No config changes.
 - **0.4.1** (2026-10-16): local-code deep reviews use the new retrieval from MergeJudge #82: two-hop importers/imports and a repo search for changed string literals, keys and env names, within fixed budgets. No config or protocol changes.
 - **0.4.0**: local code source (`runner.code_source: local`).

package/dist/cli.js

@@ -29173,15 +29173,73 @@ var SAFETY_GUARDS = [
   { name: "set -e", why: "shell fail-fast guard", re: /^\s*(?:run\s*:\s*)?set\s+-[a-z]*e[a-z]*(?:\s|$)/ },
   { name: "--frozen-lockfile", why: "dependency-integrity guard", re: /--frozen-lockfile\b|\bnpm\s+ci\b/ }
 ];
-function findRemovedGuards(patch) {
-  if (!patch) return [];
-  const removed = [];
-  const added = [];
+function parsePatchLines(patch) {
+  const out = [];
+  let hunk = 0;
   for (const line of patch.split("\n")) {
-    if (line.startsWith("-")) removed.push(line.slice(1));
-    else if (line.startsWith("+")) added.push(line.slice(1));
+    if (line.startsWith("@@")) hunk++;
+    else if (line.startsWith("-")) out.push({ op: "del", text: line.slice(1), hunk });
+    else if (line.startsWith("+")) out.push({ op: "add", text: line.slice(1), hunk });
+    else if (line.startsWith(" ")) out.push({ op: "ctx", text: line.slice(1), hunk });
+  }
+  return out;
+}
+function yamlIndent(text) {
+  const m = /^( *)\S/.exec(text);
+  return m ? m[1].length : void 0;
+}
+var isListItemStart = (text) => /^ *-(?: |$)/.test(text);
+function isBlockKey(text) {
+  if (isListItemStart(text)) return false;
+  const i = text.indexOf(":");
+  if (i < 1 || /[#{}\[\],&*!|>'"@`]/.test(text.slice(0, i))) return false;
+  return /^:(\s*(?:[|>][+-]?\d*)?)(\s+#.*)?$/.test(text.slice(i));
+}
+function opensStepContainer(lines, j) {
+  const h = yamlIndent(lines[j].text);
+  for (let k = j + 1; k < lines.length && lines[k].hunk === lines[j].hunk; k++) {
+    const ind = yamlIndent(lines[k].text);
+    if (ind === void 0) continue;
+    if (ind <= h) return false;
+    if (isListItemStart(lines[k].text)) return true;
+  }
+  return false;
+}
+function blockRemovedWhole(lines, j, g) {
+  const h = yamlIndent(lines[j].text);
+  let sawGuard = j === g;
+  for (let k = j + 1; k < lines.length && lines[k].hunk === lines[j].hunk; k++) {
+    const e = lines[k];
+    if (e.op === "add") return false;
+    const ind = yamlIndent(e.text);
+    if (ind === void 0) continue;
+    if (ind <= h) return sawGuard;
+    if (e.op === "ctx") return false;
+    if (k === g) sawGuard = true;
+  }
+  return false;
+}
+function guardRemovedWithItsBlock(lines, i) {
+  const guard = yamlIndent(lines[i].text);
+  if (guard === void 0) return false;
+  for (let j = i; j >= 0 && lines[j].op === "del" && lines[j].hunk === lines[i].hunk; j--) {
+    const text = lines[j].text;
+    const h = yamlIndent(text);
+    if (h === void 0 || j < i && h >= guard) continue;
+    const isStep = isListItemStart(text);
+    if (!isStep && !(isBlockKey(text) && opensStepContainer(lines, j))) continue;
+    if (blockRemovedWhole(lines, j, i)) return true;
   }
-  return SAFETY_GUARDS.filter((g) => removed.some((l) => g.re.test(l)) && !added.some((l) => g.re.test(l))).map((g) => g.name);
+  return false;
+}
+function findRemovedGuards(patch, path2 = "") {
+  if (!patch) return [];
+  const lines = parsePatchLines(patch);
+  const added = lines.filter((l) => l.op === "add").map((l) => l.text);
+  const yaml = /\.ya?ml$/i.test(path2);
+  return SAFETY_GUARDS.filter(
+    (g) => !added.some((l) => g.re.test(l)) && lines.some((l, i) => l.op === "del" && g.re.test(l.text) && (!yaml || !guardRemovedWithItsBlock(lines, i)))
+  ).map((g) => g.name);
 }
 var CODE_AUTO_NEVER_GLOBS = [".github/**", "**/.env*", "_headers", "**/_headers"];
 var ALWAYS_REVIEW_GLOBS = ["_headers", "**/_headers"];
@@ -29213,7 +29271,7 @@ function classifyFileInner(file2, cfg) {
   const isProtected = paths.some((p) => matchesAny(p, cfg.lanes.protected));
   if (isProtected) {
     raise("review", "protected path");
-    const gone = findRemovedGuards(file2.patch);
+    const gone = findRemovedGuards(file2.patch, file2.path);
     for (const g of SAFETY_GUARDS.filter((g2) => gone.includes(g2.name)))
       raise("block", `removes ${g.why} \`${g.name}\` from a protected path`);
   }
@@ -32663,7 +32721,7 @@ function installAutostart(d, bundle) {
 }
 
 // src/version.ts
-var VERSION = "0.4.2";
+var VERSION = "0.4.3";
 var MODES = ["diff", "context", "deep"];
 var FEATURES = ["local-code"];
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mergejudge-runner",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "license": "MIT",
   "type": "module",
   "description": "Run MergeJudge reviews on your own machine with your own Claude Code login (runner protocol /runner/v1)",