muse-crew 0.14.3 → 0.14.5

package/lib/compute-publish-diff.js

@@ -14,7 +14,7 @@
 // small JSON summary verbatim. The diff bytes live in a file; the LLM
 // never carries them:
 //
-//   node compute-publish-diff.js --repo-path <path> --base <sha> --out <file>
+//   node compute-publish-diff.js --repo-path <path> --base <sha> --out <file> [--commit <sha>]
 //
 // --base is the previously-stamped provenance source_commit (or the
 // empty-tree sha 4b825dc642cb6eb9a060e54bf8d69288fbee4904 for a first
@@ -22,6 +22,14 @@
 // script echoes the base it used so the workflow can guard against the
 // agent running the wrong command (fail-closed, as before).
 //
+// --commit is the diff's head end (2026-09-20, critic-0145 F-O2): the
+// script used to ignore it and always diff base..HEAD. Optional, defaults
+// to HEAD; the workflow's first-prepare call passes nothing (HEAD is the
+// merge commit it just created), while the tick's byte-identical
+// regeneration passes the intent's commit explicitly. The ancestor check,
+// the diff range, and the reported `commit` all target --commit, never an
+// implicit HEAD.
+//
 // Stdout contract: exactly one JSON object, always small (no diff text):
 //   { ok:true, commit, base, ancestor:"yes", diff_file, sha256, bytes,
 //     file_count, changed_lines, files:[<paths>], has_binary, has_rename }
@@ -40,6 +48,15 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, statSync, writeFileSync, readFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 
+// --help: before required-arg parsing (shebang⇔CLI contract).
+if (process.argv.slice(2).includes("--help")) {
+  console.log(
+    "usage: node compute-publish-diff.js --repo-path <path> --base <sha> --out <file> [--commit <sha>]\n" +
+    "runs git diff <base> <commit> (default <commit> = HEAD), writes the raw diff bytes to --out, prints the small JSON summary on stdout"
+  );
+  process.exit(0);
+}
+
 const EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 
 function arg(name, required = true) {
@@ -65,36 +82,49 @@ function git(repoPath, args) {
 const repoPath = arg("--repo-path");
 const base = arg("--base");
 const outFile = arg("--out");
+const commitArg = arg("--commit", false);
 
 if (!/^[0-9a-f]{40}$/.test(base)) fail("usage", "--base must be a 40-char hex commit SHA (or the empty-tree SHA).", 2);
 let st = null;
 try { st = statSync(repoPath); } catch { /* falls through */ }
 if (!st || !st.isDirectory()) fail("usage", "--repo-path must be an existing directory.", 2);
 
-const head = git(repoPath, ["rev-parse", "HEAD"]).trim();
-if (!/^[0-9a-f]{40}$/.test(head)) fail("git-failed", "rev-parse HEAD did not return a commit SHA.", 1);
+// The diff's head end: explicit --commit, or HEAD when omitted (the
+// workflow's first-prepare call passes nothing — HEAD is the merge commit
+// it just created). Validated as a 40-hex commit object in this repo;
+// everything below (ancestor check, diff range, reported commit) targets
+// it, never an implicit HEAD (2026-09-20, critic-0145 F-O2).
+let commit;
+if (commitArg === null) {
+  commit = git(repoPath, ["rev-parse", "HEAD"]).trim();
+} else {
+  if (!/^[0-9a-f]{40}$/.test(commitArg)) fail("usage", "--commit must be a 40-char hex commit SHA.", 2);
+  commit = git(repoPath, ["rev-parse", "--verify", commitArg + "^{commit}"]).trim();
+}
+if (!/^[0-9a-f]{40}$/.test(commit)) fail("git-failed", "could not resolve the diff target to a commit SHA.", 1);
 
-// Ancestor check — deterministic, in code. The empty tree is not a commit:
-// git merge-base --is-ancestor fails on it, so a first publish hardcodes
-// ANCESTOR=yes here instead of executing the conditional (clean-room
-// 2026-09-16: an agent ran merge-base on the empty tree directly and parked).
+// Ancestor check — deterministic, in code, against the diff target. The
+// empty tree is not a commit: git merge-base --is-ancestor fails on it, so
+// a first publish hardcodes ANCESTOR=yes here instead of executing the
+// conditional (clean-room 2026-09-16: an agent ran merge-base on the empty
+// tree directly and parked).
 let ancestor = "yes";
 if (base !== EMPTY_TREE) {
   try {
-    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, head], { stdio: "ignore" });
+    execFileSync("git", ["-C", repoPath, "merge-base", "--is-ancestor", base, commit], { stdio: "ignore" });
     ancestor = "yes";
   } catch {
     ancestor = "no";
   }
 }
 if (ancestor !== "yes") {
-  process.stdout.write(JSON.stringify({ ok: false, error: "not-ancestor", commit: head, base }) + "\n");
+  process.stdout.write(JSON.stringify({ ok: false, error: "not-ancestor", commit, base }) + "\n");
   process.exit(0);
 }
 
 const outPath = resolve(outFile);
 mkdirSync(dirname(outPath), { recursive: true });
-const diffText = git(repoPath, ["diff", base, head]);
+const diffText = git(repoPath, ["diff", base, commit]);
 writeFileSync(outPath, diffText, "utf8");
 const bytes = readFileSync(outPath);
 const sha256 = createHash("sha256").update(bytes).digest("hex");
@@ -131,7 +161,7 @@ for (const line of diffText.split("\n")) {
 
 process.stdout.write(JSON.stringify({
   ok: true,
-  commit: head,
+  commit,
   base,
   ancestor: "yes",
   diff_file: outPath,