overlord-cli 0.2607292110.0 → 0.2607301714.0

package/dist/index.js

@@ -12437,8 +12437,102 @@ var init_util2 = __esm({
 });
 
 // ../packages/core/dist/service/local-target/project-metadata.js
-import { existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { chmodSync as chmodSync3, existsSync as existsSync11, mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync4 } from "node:fs";
 import path11 from "node:path";
+function writeIfChanged(filePath, content) {
+  if (!existsSync11(filePath) || readFileSync9(filePath, "utf8") !== content) {
+    writeFileSync4(filePath, content);
+  }
+}
+function replaceManagedBlock(content, block) {
+  const blockPattern = new RegExp(`${INSTRUCTION_BLOCK_START}[\\s\\S]*?${INSTRUCTION_BLOCK_END}\\n?`, "g");
+  const withoutExisting = content.replace(blockPattern, "").trimEnd();
+  return `${withoutExisting}${withoutExisting ? "\n\n" : ""}${block}
+`;
+}
+function ensureAgentInstructions(checkoutPath) {
+  for (const filename of ["AGENTS.md", "CLAUDE.md"]) {
+    const instructionPath = path11.join(checkoutPath, filename);
+    const existing = existsSync11(instructionPath) ? readFileSync9(instructionPath, "utf8") : "";
+    writeIfChanged(instructionPath, replaceManagedBlock(existing, PROJECT_METADATA_INSTRUCTION));
+  }
+}
+function ensureGitignore(checkoutPath) {
+  const gitignorePath = path11.join(checkoutPath, ".gitignore");
+  const existing = existsSync11(gitignorePath) ? readFileSync9(gitignorePath, "utf8") : "";
+  const existingPatterns = new Set(existing.split(/\r?\n/).map((line) => line.trim().replace(/^\//, "")).filter(Boolean));
+  const additions = [".overlord/tmp/", ".overlord/logs/"].filter((pattern) => !existingPatterns.has(pattern));
+  if (additions.length === 0)
+    return;
+  const separator = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+  writeFileSync4(gitignorePath, `${existing}${separator}${additions.join("\n")}
+`);
+}
+function resolveGitRoot(directoryPath) {
+  try {
+    return execFileSync("git", ["-C", directoryPath, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function resolveGitHooksDirectory(gitRoot) {
+  try {
+    const gitPath2 = execFileSync("git", ["-C", gitRoot, "rev-parse", "--git-path", "hooks"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    return path11.isAbsolute(gitPath2) ? gitPath2 : path11.resolve(gitRoot, gitPath2);
+  } catch {
+    return null;
+  }
+}
+function ensurePreCommitGuard(gitRoot) {
+  const hooksDirectory = resolveGitHooksDirectory(gitRoot);
+  if (!hooksDirectory)
+    return;
+  mkdirSync5(hooksDirectory, { recursive: true });
+  const guardPath = path11.join(hooksDirectory, HOOK_GUARD_FILENAME);
+  writeIfChanged(guardPath, `#!/bin/sh
+# Managed by Overlord: reject any staged project-link metadata change.
+if git diff --cached --quiet -- .overlord/project.json; then
+  exit 0
+fi
+echo "Overlord blocked this commit: .overlord/project.json is managed metadata and must not be changed." >&2
+exit 1
+`);
+  chmodSync3(guardPath, 493);
+  const preCommitPath = path11.join(hooksDirectory, "pre-commit");
+  const hookBlock = `${HOOK_BLOCK_START}
+"$(dirname "$0")/${HOOK_GUARD_FILENAME}" || exit $?
+${HOOK_BLOCK_END}`;
+  if (!existsSync11(preCommitPath)) {
+    writeFileSync4(preCommitPath, `#!/bin/sh
+${hookBlock}
+`);
+    chmodSync3(preCommitPath, 493);
+    return;
+  }
+  const existing = readFileSync9(preCommitPath, "utf8");
+  const blockPattern = new RegExp(`${HOOK_BLOCK_START}[\\s\\S]*?${HOOK_BLOCK_END}\\n?`, "g");
+  const updated = `${existing.replace(blockPattern, "").trimEnd()}
+
+${hookBlock}
+`;
+  writeIfChanged(preCommitPath, updated);
+  chmodSync3(preCommitPath, 493);
+}
+function protectProjectMetadata(directoryPath) {
+  const gitRoot = resolveGitRoot(directoryPath);
+  const checkoutPath = gitRoot ?? directoryPath;
+  ensureAgentInstructions(checkoutPath);
+  ensureGitignore(checkoutPath);
+  if (gitRoot)
+    ensurePreCommitGuard(gitRoot);
+}
 function parseProjectJson(projectJsonPath) {
   if (!existsSync11(projectJsonPath))
     return null;
@@ -12446,12 +12540,13 @@ function parseProjectJson(projectJsonPath) {
   if (typeof parsed.projectId !== "string" || typeof parsed.resourceId !== "string")
     return null;
   const resourceIdsByExecutionTarget = parsed.resourceIdsByExecutionTarget && typeof parsed.resourceIdsByExecutionTarget === "object" && !Array.isArray(parsed.resourceIdsByExecutionTarget) ? Object.fromEntries(Object.entries(parsed.resourceIdsByExecutionTarget).filter((entry) => typeof entry[0] === "string" && entry[0].trim().length > 0 && typeof entry[1] === "string" && entry[1].trim().length > 0)) : {};
+  const resourceKey = typeof parsed.resourceKey === "string" && parsed.resourceKey.trim().length > 0 ? parsed.resourceKey.trim() : void 0;
   return {
-    _warning: typeof parsed._warning === "string" ? parsed._warning : "This file is managed by Overlord and is regenerated automatically when this folder is linked as a project resource. Do not edit it manually \u2014 manual changes will be overwritten.",
+    _warning: typeof parsed._warning === "string" ? parsed._warning : PROJECT_JSON_WARNING,
     version: typeof parsed.version === "number" ? parsed.version : 1,
     projectId: parsed.projectId,
     resourceId: parsed.resourceId,
-    resourceKey: typeof parsed.resourceKey === "string" && parsed.resourceKey.trim().length > 0 ? parsed.resourceKey.trim() : void 0,
+    ...resourceKey ? { resourceKey } : {},
     resourceIdsByExecutionTarget,
     isPrimary: parsed.isPrimary === true,
     linkedAt: typeof parsed.linkedAt === "string" ? parsed.linkedAt : nowIso()
@@ -12476,6 +12571,7 @@ function writeProjectJson({ directoryPath, projectId, resourceId, resourceKey, e
   mkdirSync5(overlordDir, { recursive: true });
   mkdirSync5(path11.join(overlordDir, "tmp"), { recursive: true });
   mkdirSync5(path11.join(overlordDir, "logs"), { recursive: true });
+  protectProjectMetadata(directoryPath);
   const projectJsonPath = path11.join(overlordDir, "project.json");
   const existing = readProjectJsonLink(projectJsonPath);
   const resourceIdsByExecutionTarget = {
@@ -12485,7 +12581,7 @@ function writeProjectJson({ directoryPath, projectId, resourceId, resourceKey, e
     resourceIdsByExecutionTarget[executionTargetId.trim()] = resourceId;
   }
   writeFileSync4(projectJsonPath, `${JSON.stringify({
-    _warning: "This file is managed by Overlord and is regenerated automatically when this folder is linked as a project resource. Do not edit it manually \u2014 manual changes will be overwritten.",
+    _warning: PROJECT_JSON_WARNING,
     version: PROJECT_JSON_VERSION,
     projectId,
     resourceId,
@@ -12497,21 +12593,34 @@ function writeProjectJson({ directoryPath, projectId, resourceId, resourceKey, e
 `);
   return projectJsonPath;
 }
-var PROJECT_JSON_VERSION;
+var PROJECT_JSON_VERSION, PROJECT_JSON_WARNING, INSTRUCTION_BLOCK_START, INSTRUCTION_BLOCK_END, PROJECT_METADATA_INSTRUCTION, HOOK_GUARD_FILENAME, HOOK_BLOCK_START, HOOK_BLOCK_END;
 var init_project_metadata = __esm({
   "../packages/core/dist/service/local-target/project-metadata.js"() {
     "use strict";
     init_util2();
     PROJECT_JSON_VERSION = 2;
+    PROJECT_JSON_WARNING = "STRICTLY PROTECTED: This file is managed exclusively by Overlord. Agents and users must not edit, replace, stage, commit, or delete it. Re-link the resource with Overlord to change it.";
+    INSTRUCTION_BLOCK_START = "<!-- OVERLORD PROJECT METADATA PROTECTION: START -->";
+    INSTRUCTION_BLOCK_END = "<!-- OVERLORD PROJECT METADATA PROTECTION: END -->";
+    PROJECT_METADATA_INSTRUCTION = `${INSTRUCTION_BLOCK_START}
+## Overlord project metadata \u2014 do not edit
+
+\`.overlord/project.json\` is exclusively managed by Overlord. Do not edit,
+replace, stage, commit, delete, or revert it. If its link metadata needs to
+change, use Overlord's resource-linking command instead.
+${INSTRUCTION_BLOCK_END}`;
+    HOOK_GUARD_FILENAME = "overlord-project-json-guard";
+    HOOK_BLOCK_START = "# >>> Overlord project metadata guard >>>";
+    HOOK_BLOCK_END = "# <<< Overlord project metadata guard <<<";
   }
 });
 
 // ../packages/core/dist/repository/git-tree.js
-import { execFileSync } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 import path12 from "node:path";
 function runGit(cwd, args) {
   try {
-    return execFileSync("git", args, {
+    return execFileSync2("git", args, {
       cwd,
       encoding: "utf8",
       maxBuffer: 10 * 1024 * 1024,
@@ -12599,10 +12708,10 @@ var init_git_tree = __esm({
 });
 
 // ../packages/core/dist/service/local-target/git-run.js
-import { execFileSync as execFileSync2 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 function runGit2(cwd, args) {
   try {
-    return execFileSync2("git", args, {
+    return execFileSync3("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -12614,7 +12723,7 @@ function runGit2(cwd, args) {
 }
 function runGitResult(cwd, args) {
   try {
-    const stdout = execFileSync2("git", args, {
+    const stdout = execFileSync3("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -13001,10 +13110,10 @@ var init_commit_message_diff_git = __esm({
 });
 
 // ../packages/core/dist/service/local-target/doctor-checks.js
-import { execFileSync as execFileSync3 } from "node:child_process";
+import { execFileSync as execFileSync4 } from "node:child_process";
 function commandOnPath(command, args) {
   try {
-    const detail = execFileSync3(command, args, {
+    const detail = execFileSync4(command, args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -13498,13 +13607,13 @@ var init_branch_planning = __esm({
 });
 
 // src/branch-preparation.ts
-import { execFileSync as execFileSync4 } from "node:child_process";
+import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync17, mkdirSync as mkdirSync7, statSync as statSync3 } from "node:fs";
 import os3 from "node:os";
 import path17 from "node:path";
 function runGit3(cwd, args, options = {}) {
   try {
-    return execFileSync4("git", args, {
+    return execFileSync5("git", args, {
       cwd,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
@@ -13519,7 +13628,7 @@ function runGit3(cwd, args, options = {}) {
 function lines(value) {
   return value.split("\n").map((line) => line.trim()).filter(Boolean);
 }
-function resolveGitRoot(workingDirectory) {
+function resolveGitRoot2(workingDirectory) {
   const root = runGit3(workingDirectory, ["rev-parse", "--show-toplevel"]);
   if (!root) throw new Error(`${workingDirectory} is not inside a git repository.`);
   return path17.resolve(root);
@@ -13744,7 +13853,7 @@ async function prepareMissionBranch({
   if (options.dryRun) {
     return { workingDirectory: options.workingDirectory, branchAutomation: null };
   }
-  const gitRoot = resolveGitRoot(options.workingDirectory);
+  const gitRoot = resolveGitRoot2(options.workingDirectory);
   const mission = await runtime.backend.get(
     `/api/missions/${encodeURIComponent(options.missionId)}`
   );
@@ -14373,7 +14482,7 @@ var init_terminal_launcher = __esm({
 
 // src/launch.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { chmodSync as chmodSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { chmodSync as chmodSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import path19 from "node:path";
 function overlordLaunchEnv({
   backendUrl,
@@ -14581,7 +14690,7 @@ Execution request: ${options.executionRequestId}` : context.launchContext;
         missionLink: { displayId: context.displayId, title: context.title }
       })
     );
-    chmodSync3(terminalScriptPath, 448);
+    chmodSync4(terminalScriptPath, 448);
   }
   const execution = resolveLaunchExecution({
     command: command.command,
@@ -15390,7 +15499,7 @@ var init_vcs_sessions = __esm({
 });
 
 // src/vcs.ts
-import { execFileSync as execFileSync5 } from "node:child_process";
+import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash6 } from "node:crypto";
 import {
   existsSync as existsSync20,
@@ -15426,7 +15535,7 @@ function hashWorktreeFile({
   filePath
 }) {
   try {
-    return execFileSync5("git", ["hash-object", filePath], {
+    return execFileSync6("git", ["hash-object", filePath], {
       cwd: workingDirectory,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -15437,7 +15546,7 @@ function hashWorktreeFile({
 }
 function readChangedFiles(workingDirectory) {
   try {
-    const output = execFileSync5("git", ["status", "--porcelain"], {
+    const output = execFileSync6("git", ["status", "--porcelain"], {
       cwd: workingDirectory,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
@@ -15578,7 +15687,7 @@ function normalizeAbsolute(filePath) {
 }
 function gitRepoRoot(workingDirectory) {
   try {
-    const root = execFileSync5("git", ["rev-parse", "--show-toplevel"], {
+    const root = execFileSync6("git", ["rev-parse", "--show-toplevel"], {
       cwd: workingDirectory,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
@@ -16301,13 +16410,13 @@ var init_runner_identity = __esm({
 
 // src/runner-service.ts
 import { execFile } from "node:child_process";
-import { chmodSync as chmodSync4, existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync17, rmSync as rmSync5, writeFileSync as writeFileSync10 } from "node:fs";
+import { chmodSync as chmodSync5, existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync17, rmSync as rmSync5, writeFileSync as writeFileSync10 } from "node:fs";
 import os4 from "node:os";
 import path26 from "node:path";
 import { promisify } from "node:util";
 function writeServiceFile(filePath, contents) {
   writeFileSync10(filePath, contents, { mode: 384 });
-  chmodSync4(filePath, 384);
+  chmodSync5(filePath, 384);
 }
 function emptyRunnerServiceState() {
   return {