shakers-cli 0.0.0-stage → 0.14.1

package/src/stdin-ask.js

@@ -0,0 +1,129 @@
+'use strict';
+
+const readline = require('readline');
+const { readSecretRaw, canPromptSecretly } = require('./secret-prompt');
+
+// `ask(question) => Promise<string>` factory for real stdin, used by bin/report.js to drive src/consent-flow.js's interactive disclosure.
+
+function createLineQueueAsk(writeQuestion) {
+  const queue = [];
+  let resolveNext = null;
+  let ended = false;
+
+  function pushLine(line) {
+    if (resolveNext) {
+      const resolve = resolveNext;
+      resolveNext = null;
+      resolve(line);
+    } else {
+      queue.push(line);
+    }
+  }
+
+  // Signals the stream has ended (EOF) with nothing further to give.
+  function markEnded() {
+    ended = true;
+    if (resolveNext) {
+      const resolve = resolveNext;
+      resolveNext = null;
+      resolve('');
+    }
+  }
+
+  // DELIBERATE EXCEPTION to this file's own rule ("answers arriving BEFORE ask() is called are still delivered in order" — see the test file's own name for that behaviour).
+  function drain() {
+    queue.length = 0;
+  }
+
+  function ask(question) {
+    writeQuestion(question);
+    return new Promise((resolve) => {
+      if (queue.length > 0) resolve(queue.shift());
+      else if (ended) resolve('');
+      else resolveNext = resolve;
+    });
+  }
+
+  return { ask, pushLine, markEnded, drain };
+}
+
+// `onInterrupt` (optional): a Ctrl-C (SIGINT) handler for a TTY.
+function createStdinAsk({ onInterrupt } = {}) {
+  // `rl` is re-createable (issue 102), not a `const`.
+  let rl = null;
+  let ended = false;
+  let suspending = false;
+  let currentPrompt = '';
+
+  const { ask, pushLine, markEnded, drain } = createLineQueueAsk((question) => {
+    // Long-answer wrap bug (skill-code-certification, certify agents): in a TTY, `readline` runs in terminal mode and redraws the current line on every keystroke (wrap, cursor).
+    const text = `  ${question} `;
+    const lastNewline = text.lastIndexOf('\n');
+    if (lastNewline >= 0) {
+      process.stdout.write(text.slice(0, lastNewline + 1));
+      currentPrompt = text.slice(lastNewline + 1);
+    } else {
+      currentPrompt = text;
+    }
+    if (rl) { rl.setPrompt(currentPrompt); rl.prompt(); }
+  });
+  function attach() {
+    if (rl) return;
+    rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    // The issue-088 fix, re-applied on every attach: readline must own the prompt
+    // it repaints, and a new interface does not know the old one.
+    if (currentPrompt) rl.setPrompt(currentPrompt);
+    rl.on('line', pushLine);
+    rl.on('close', () => {
+      rl = null;
+      // A `suspend()` close is intentional (the secret prompt); a real EOF is not.
+      if (!suspending) { ended = true; markEnded(); }
+    });
+    rl.on('SIGINT', onInterrupt || (() => {
+      process.stdout.write('\n');
+      if (rl) rl.close();
+      process.exit(130);
+    }));
+  }
+
+  attach();
+
+  // Releases stdin so the raw-mode secret reader can own it, WITHOUT ending the
+  // FIFO queue: buffered lines survive. Mirrors `repl-stdin.js#suspend`.
+  function suspend() {
+    if (!rl) return;
+    suspending = true;
+    const r = rl;
+    rl = null;
+    r.close();
+    suspending = false;
+  }
+  // SECRETS DO NOT ECHO (issue 102).
+  ask.secret = async (question) => {
+    if (!canPromptSecretly(process.stdin)) return ask(question);
+    process.stdout.write(`  ${question} `);
+    suspend();
+    try {
+      const value = await readSecretRaw({ input: process.stdin, output: process.stdout });
+      return value == null ? '' : value;
+    } finally {
+      // In a `finally` because a terminal left without echo is worse than the bug
+      // this replaces: re-attaching restores readline's cooked mode and its prompt.
+      attach();
+    }
+  };
+
+  ask.close = () => {
+    ended = true;
+    if (rl) { const r = rl; rl = null; r.close(); }
+    markEnded();
+  };
+  ask.suspend = suspend;
+  ask.resume = attach;
+  ask.isEnded = () => ended;
+  // See createLineQueueAsk's `drain` docblock: discards whatever is queued and unread, without ending the stream.
+  ask.drain = drain;
+  return ask;
+}
+
+module.exports = { createStdinAsk, createLineQueueAsk };

package/src/steering-extract.js

@@ -0,0 +1,43 @@
+'use strict';
+
+const { eachHumanText } = require('./transcript-turns');
+const { scrubSecrets } = require('./agent-synthesis');
+
+const MAX_EXCERPTS = 20;
+const MAX_EXCERPT_LEN = 200;
+
+const STEERING_RE =
+  /\b(no|nope|not that|don'?t|do not|instead|en vez de|en lugar de|mejor|better|change|cambia|revert|revierte|vuelve|deshaz|undo|stop|para|wrong|incorrect|incorrecto|fix|arregla|corrige|use|usa|make it|hazlo|add|añade|remove|quita|ensure|asegúrate|should|deberías|must|debes)\b/i;
+
+function makeSteeringAccumulator() {
+  let steeringTraceCount = 0;
+  const excerpts = [];
+  const seen = new Set();
+  return {
+    add(text) {
+      if (!STEERING_RE.test(text)) return;
+      steeringTraceCount += 1;
+      if (excerpts.length >= MAX_EXCERPTS) return;
+      const scrubbed = scrubSecrets(text)
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, MAX_EXCERPT_LEN);
+      if (scrubbed && !seen.has(scrubbed)) {
+        seen.add(scrubbed);
+        excerpts.push(scrubbed);
+      }
+    },
+    result() {
+      if (steeringTraceCount === 0) return null;
+      return { steeringTraceCount, redactedSteeringExcerpts: excerpts };
+    },
+  };
+}
+
+function collectSteering(env = process.env, selectedCwds = null) {
+  const acc = makeSteeringAccumulator();
+  for (const text of eachHumanText(env, { selectedCwds })) acc.add(text);
+  return acc.result();
+}
+
+module.exports = { collectSteering, makeSteeringAccumulator };

package/src/strip-internal-comments.js

@@ -0,0 +1,45 @@
+'use strict';
+
+// Our comments do not travel in the talent's shareable report (issue 098).
+
+// `<!-- … -->`, including multi-line.
+const HTML_COMMENT_RE = /<!--[\s\S]*?-->/g;
+
+// `/* … */`, the CSS and JS block form. Same verification as above.
+const BLOCK_COMMENT_RE = /\/\*[\s\S]*?\*\//g;
+
+// A whole line that is nothing but a `//` comment.
+const LINE_COMMENT_RE = /^[ \t]*\/\/[^\n]*$/gm;
+
+// Three or more consecutive newlines (what a removed comment block leaves
+// behind) collapse to two. Never touches indentation or single blank lines.
+const BLANK_RUN_RE = /\n{3,}/g;
+
+function stripTemplateComments(html) {
+  if (typeof html !== 'string' || !html) return '';
+  return html
+    .replace(HTML_COMMENT_RE, '')
+    .replace(BLOCK_COMMENT_RE, '')
+    .replace(LINE_COMMENT_RE, '')
+    .replace(BLANK_RUN_RE, '\n\n');
+}
+
+// The patterns that make a comment an INTERNAL reference — exported so the test and this module agree on one definition instead of two.
+const INTERNAL_REFERENCE_PATTERNS = Object.freeze([
+  { label: 'issue reference', re: /\bissues?\s*#?\d{2,4}\b/i },
+  { label: 'commit hash', re: /(?<![#\w])(?=[0-9a-f]{7,40}(?![\w]))(?=[0-9a-f]*[a-f])(?=[0-9a-f]*\d)[0-9a-f]{7,40}(?![\w])/ },
+  { label: 'src/ file path', re: /\bsrc\/[a-z0-9-]+\.(?:js|html|css)\b/i },
+  { label: 'ADR reference', re: /\bADR-\d{2,3}\b/ },
+]);
+
+function findInternalReferences(text) {
+  const hay = typeof text === 'string' ? text : '';
+  const found = [];
+  for (const { label, re } of INTERNAL_REFERENCE_PATTERNS) {
+    const m = hay.match(new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`));
+    if (m && m.length) found.push({ label, matches: [...new Set(m)] });
+  }
+  return found;
+}
+
+module.exports = { stripTemplateComments, findInternalReferences, INTERNAL_REFERENCE_PATTERNS };

package/src/tech-detector.js

@@ -0,0 +1,295 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const {
+  EXCLUDED_DIRS,
+  MAX_WALK_DEPTH,
+  isRefusedWalkRoot,
+  isExcludedWalkPath,
+} = require('./scan-exclusions');
+
+// Monorepo support (skill-code-certification, issue 008): manifests are discovered RECURSIVELY under `root`, not just at the top level.
+
+// Exact dependency-name -> canonical framework/library name (npm + pip).
+const EXACT_FRAMEWORK_MAP = {
+  // JS/TS — frontend
+  react: 'React',
+  'react-dom': 'React',
+  next: 'Next.js',
+  vue: 'Vue',
+  nuxt: 'Nuxt',
+  '@angular/core': 'Angular',
+  svelte: 'Svelte',
+  '@sveltejs/kit': 'SvelteKit',
+  'solid-js': 'SolidJS',
+  // JS/TS — backend
+  express: 'Express',
+  fastify: 'Fastify',
+  koa: 'Koa',
+  '@nestjs/core': 'NestJS',
+  hapi: 'Hapi',
+  '@hapi/hapi': 'Hapi',
+  // JS/TS — meta-frameworks
+  astro: 'Astro',
+  remix: 'Remix',
+  '@remix-run/react': 'Remix',
+  '@remix-run/node': 'Remix',
+  '@remix-run/server-runtime': 'Remix',
+  // JS/TS — state management
+  zustand: 'Zustand',
+  redux: 'Redux',
+  'react-redux': 'Redux',
+  '@reduxjs/toolkit': 'Redux Toolkit',
+  // JS/TS — TanStack family (each product is its own Skill)
+  '@tanstack/react-query': 'TanStack Query',
+  '@tanstack/vue-query': 'TanStack Query',
+  '@tanstack/solid-query': 'TanStack Query',
+  '@tanstack/svelte-query': 'TanStack Query',
+  'react-query': 'TanStack Query', // pre-rename package, same Skill
+  '@tanstack/react-router': 'TanStack Router',
+  '@tanstack/router': 'TanStack Router',
+  '@tanstack/react-table': 'TanStack Table',
+  '@tanstack/vue-table': 'TanStack Table',
+  '@tanstack/table-core': 'TanStack Table',
+  '@tanstack/react-form': 'TanStack Form',
+  '@tanstack/form-core': 'TanStack Form',
+  // JS/TS — data / API layer
+  prisma: 'Prisma',
+  '@prisma/client': 'Prisma',
+  graphql: 'GraphQL',
+  '@apollo/client': 'Apollo',
+  '@apollo/server': 'Apollo',
+  'apollo-server': 'Apollo',
+  '@trpc/server': 'tRPC',
+  '@trpc/client': 'tRPC',
+  zod: 'Zod',
+  // JS/TS — styling. Code-certified via its CONFIG file surface
+  // (tailwind.config.*) — see tech-extensions.js.
+  tailwindcss: 'Tailwind CSS',
+  // JS/TS — build tools & test runners.
+  vite: 'Vite',
+  webpack: 'Webpack',
+  jest: 'Jest',
+  vitest: 'Vitest',
+  // Python
+  django: 'Django',
+  flask: 'Flask',
+  fastapi: 'FastAPI',
+  pyramid: 'Pyramid',
+  tornado: 'Tornado',
+  sqlalchemy: 'SQLAlchemy',
+  pydantic: 'Pydantic',
+};
+
+// Go module paths recognized by prefix (module paths carry version suffixes
+// like "/v4" and full import sub-paths, so exact match isn't reliable).
+const GO_FRAMEWORK_PREFIXES = [
+  { prefix: 'github.com/gin-gonic/gin', name: 'Gin' },
+  { prefix: 'github.com/labstack/echo', name: 'Echo' },
+  { prefix: 'github.com/gofiber/fiber', name: 'Fiber' },
+  { prefix: 'github.com/gorilla/mux', name: 'Gorilla Mux' },
+  { prefix: 'github.com/beego/beego', name: 'Beego' },
+  { prefix: 'gorm.io/gorm', name: 'GORM' },
+  { prefix: 'github.com/jinzhu/gorm', name: 'GORM' }, // pre-move import path, same Skill
+];
+
+// Maps a raw dependency/module name to its canonical framework/library display name, or null if unrecognized.
+function canonicalFrameworkName(rawName) {
+  if (typeof rawName !== 'string' || !rawName) return null;
+  if (Object.prototype.hasOwnProperty.call(EXACT_FRAMEWORK_MAP, rawName)) {
+    return EXACT_FRAMEWORK_MAP[rawName];
+  }
+  for (const { prefix, name } of GO_FRAMEWORK_PREFIXES) {
+    if (rawName === prefix || rawName.startsWith(`${prefix}/`)) {
+      return name;
+    }
+  }
+  return null;
+}
+
+function readFileSafe(p) {
+  try {
+    return fs.readFileSync(p, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+function fromPackageJsonFile(filePath) {
+  const raw = readFileSafe(filePath);
+  if (!raw) return [];
+  let pkg;
+  try {
+    pkg = JSON.parse(raw);
+  } catch {
+    return [];
+  }
+  const groups = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies'];
+  const names = [];
+  for (const group of groups) {
+    if (pkg[group] && typeof pkg[group] === 'object') {
+      names.push(...Object.keys(pkg[group]));
+    }
+  }
+  return names;
+}
+
+function fromRequirementsTxtFile(filePath) {
+  const raw = readFileSafe(filePath);
+  if (!raw) return [];
+  const names = [];
+  for (const rawLine of raw.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || line.startsWith('#') || line.startsWith('-')) continue;
+    const match = line.match(/^([A-Za-z0-9_.-]+)/);
+    if (match) names.push(match[1].toLowerCase());
+  }
+  return names;
+}
+
+function fromGoModFile(filePath) {
+  const raw = readFileSafe(filePath);
+  if (!raw) return [];
+  const names = [];
+  const blockMatch = raw.match(/require\s*\(([\s\S]*?)\)/);
+  if (blockMatch) {
+    for (const rawLine of blockMatch[1].split(/\r?\n/)) {
+      const line = rawLine.trim();
+      if (!line || line.startsWith('//')) continue;
+      const match = line.match(/^(\S+)/);
+      if (match) names.push(match[1]);
+    }
+  }
+  const singleLineRe = /^require\s+(\S+)\s+\S+/gm;
+  let m;
+  while ((m = singleLineRe.exec(raw)) !== null) {
+    if (m[1] === '(') continue; // the block-opening "require (" line, not a single-line require
+    names.push(m[1]);
+  }
+  return names;
+}
+
+function fromPyprojectTomlFile(filePath) {
+  const raw = readFileSafe(filePath);
+  if (!raw) return [];
+  const names = [];
+
+  const sectionRe = /^\[tool\.poetry\.(?:dependencies|dev-dependencies|group\.[^\]]+\.dependencies)\]\s*$/gm;
+  const lines = raw.split(/\r?\n/);
+  let inDepsSection = false;
+  for (const line of lines) {
+    if (/^\[.*\]\s*$/.test(line)) {
+      inDepsSection = sectionRe.test(line);
+      sectionRe.lastIndex = 0;
+      continue;
+    }
+    if (!inDepsSection) continue;
+    const kv = line.match(/^([A-Za-z0-9_.-]+)\s*=/);
+    if (kv && kv[1].toLowerCase() !== 'python') names.push(kv[1].toLowerCase());
+  }
+
+  const depsArrayMatch = raw.match(/\bdependencies\s*=\s*\[([\s\S]*?)\]/);
+  if (depsArrayMatch) {
+    const itemRe = /["']([A-Za-z0-9_.-]+)/g;
+    let m;
+    while ((m = itemRe.exec(depsArrayMatch[1])) !== null) {
+      names.push(m[1].toLowerCase());
+    }
+  }
+
+  return names;
+}
+
+// Manifest filename -> reader (skill-code-certification, issue 008).
+const MANIFEST_READERS = {
+  'package.json': fromPackageJsonFile,
+  'requirements.txt': fromRequirementsTxtFile,
+  'go.mod': fromGoModFile,
+  'pyproject.toml': fromPyprojectTomlFile,
+};
+
+function findManifestFiles(root) {
+  const found = [];
+  if (isRefusedWalkRoot(root)) return found;
+
+  function walk(dir, depth) {
+    if (depth > MAX_WALK_DEPTH) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const abs = path.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (EXCLUDED_DIRS.has(entry.name)) continue;
+        if (isExcludedWalkPath(abs)) continue;
+        walk(abs, depth + 1);
+      } else if (entry.isFile() && Object.prototype.hasOwnProperty.call(MANIFEST_READERS, entry.name)) {
+        found.push(abs);
+      }
+    }
+  }
+
+  walk(root, 0);
+  return found.sort();
+}
+
+// Merges every discovered manifest's output, deduped, sorted, WITHOUT filtering through the canonical framework map.
+function detectRawDependencyNames(root) {
+  const rawNames = [];
+  for (const filePath of findManifestFiles(root)) {
+    const reader = MANIFEST_READERS[path.basename(filePath)];
+    if (reader) rawNames.push(...reader(filePath));
+  }
+  return [...new Set(rawNames)].sort();
+}
+
+// Maps the merged raw dependency names through canonicalFrameworkName, keeps only recognized names, dedupes, sorts.
+function detectTechnologies(root) {
+  const rawNames = detectRawDependencyNames(root);
+  const canonical = new Set();
+  for (const rawName of rawNames) {
+    const name = canonicalFrameworkName(rawName);
+    if (name) canonical.add(name);
+  }
+  return [...canonical].sort();
+}
+
+function detectTechnologyManifests(root) {
+  const byTech = new Map();
+  for (const filePath of findManifestFiles(root)) {
+    const reader = MANIFEST_READERS[path.basename(filePath)];
+    if (!reader) continue;
+    const rel = path.relative(root, filePath).split(path.sep).join('/');
+    const seenInFile = new Set();
+    for (const rawName of reader(filePath)) {
+      const tech = canonicalFrameworkName(rawName);
+      if (!tech || seenInFile.has(tech)) continue;
+      seenInFile.add(tech);
+      let set = byTech.get(tech);
+      if (!set) {
+        set = new Set();
+        byTech.set(tech, set);
+      }
+      set.add(rel);
+    }
+  }
+  return [...byTech.entries()]
+    .map(([tech, set]) => ({ tech, manifestPaths: [...set].sort() }))
+    .sort((a, b) => a.tech.localeCompare(b.tech));
+}
+
+module.exports = {
+  detectTechnologies,
+  detectTechnologyManifests,
+  detectRawDependencyNames,
+  canonicalFrameworkName,
+  findManifestFiles,
+  // Exported as the SOURCE OF TRUTH for the complete set of canonical technologies the detector can ever emit.
+  EXACT_FRAMEWORK_MAP,
+  GO_FRAMEWORK_PREFIXES,
+};