simt-dev 0.6.2 → 0.6.3

package/src/hooks/dispatcher.mjs

@@ -29,6 +29,7 @@ import { CLI } from '../name.mjs';
 import { MANIFEST_FILE } from '../name.mjs';
 import { assertVersionPin } from '../package-version.mjs';
 import { recordRun } from '../ledger/index.mjs';
+import { renderFindings, scanStaged } from '../secrets.mjs';
 
 const exec = promisify(execFile);
 
@@ -121,6 +122,37 @@ export async function runGates(event, { root, manifest }) {
       });
       continue;
     }
+
+    // A built-in gate runs here, in this process: no script, no command, no
+    // tool on disk (ADR-100). It gets the same ledger line and the same
+    // fail-closed reporting as every other gate; only the source of the bytes
+    // it runs over differs. Keyed on the RESOLUTION rather than the gate, so a
+    // declared command for this name takes the shell path below instead.
+    if (resolution.builtin !== undefined) {
+      const startedBuiltin = Date.now();
+      const outcome = await runBuiltinGate(resolution.builtin, { root, staged });
+      try {
+        await recordRun(root, {
+          cmd: `builtin:${resolution.builtin}`,
+          exit: outcome.ok ? 0 : 1,
+          ms: Date.now() - startedBuiltin,
+          output: outcome.output,
+        });
+      } catch {
+        // Recorded by absence: the next evidence read for this tree has no line.
+      }
+      results.push({
+        name,
+        status: outcome.ok ? 'passed' : 'failed',
+        detail: outcome.detail,
+        output: outcome.ok ? '' : outcome.output,
+        ...(outcome.remedy !== undefined ? { remedy: outcome.remedy } : {}),
+        adr: gate.adr,
+        exitCode: outcome.ok ? 0 : 1,
+      });
+      continue;
+    }
+
     if (resolution.argv === null) {
       results.push({ name, status: 'skipped', detail: resolution.detail, adr: gate.adr, exitCode: null });
       continue;
@@ -241,6 +273,31 @@ export async function runGates(event, { root, manifest }) {
   return { event, gates: results, failed: results.some((r) => r.status === 'failed') };
 }
 
+/**
+ * The lines that report one event's gate run: the event, what was declared, every
+ * gate with its disposition, its reason and its remedy, and the verdict.
+ *
+ * Shared by `hooks run` and `slice finish` rather than written twice (ADR-002: the
+ * second real use is what the extraction exists for). Both run this dispatcher over
+ * the same event, and two renderings of one run are two ways for one of them to
+ * quietly stop printing a gate that failed.
+ *
+ * @param {string} event the hook event as git spells it
+ * @param {string[]} declared the gate names the manifest declares for it
+ * @param {object} result the value `runGates` returned
+ * @returns {string[]} the report lines, newline-free, in print order
+ */
+export function renderGateReport(event, declared, result) {
+  const lines = [`hooks    ${event}`, `gates    ${(declared ?? []).join(', ') || '(none declared)'}`];
+  for (const g of result.gates) {
+    lines.push(`${g.status.toUpperCase().padEnd(8)} ${g.name.padEnd(20)} ${g.detail}${g.adr ? `  [${g.adr}]` : ''}`);
+    if (g.remedy) lines.push(`        remedy: ${g.remedy}`);
+    if (g.output) lines.push(...g.output.split('\n').map((l) => `        ${l}`));
+  }
+  lines.push(result.failed ? 'BLOCKED  at least one gate failed' : 'PASSED');
+  return lines;
+}
+
 async function run(argv, cwd) {
   try {
     const { stdout, stderr } = await exec(argv[0], argv.slice(1), { cwd, maxBuffer: 8 * 1024 * 1024 });
@@ -250,6 +307,59 @@ async function run(argv, cwd) {
   }
 }
 
+/** The built-in gates this dispatcher can run, by name. */
+const BUILTIN_GATES = new Map([['secret-scan', scanStaged]]);
+
+/** How many findings the report prints; the detail carries the true count. */
+const BUILTIN_REPORT_MAX = 12;
+
+/**
+ * Run a `builtin` gate in this process (ADR-100).
+ * Every outcome is a verdict with a reason: a built-in that does not exist, a
+ * diff git cannot read, or a secret found each fail with their own detail —
+ * none of them can degrade into a pass, which is the same fail-closed contract
+ * an unresolvable script gate has.
+ */
+async function runBuiltinGate(name, { root, staged }) {
+  const scan = BUILTIN_GATES.get(name);
+  if (scan === undefined) {
+    return {
+      ok: false,
+      detail: `no built-in implementation for gate "${name}"; this is a bug in ${CLI}`,
+      remedy: `remove "${name}" from ${MANIFEST_FILE} gates`,
+      output: '',
+    };
+  }
+  if (staged.length === 0) {
+    return { ok: true, detail: 'nothing staged; no added line to scan', output: '' };
+  }
+  const result = await scan(root);
+  if (result.error !== null) {
+    return {
+      ok: false,
+      detail: `the staged diff could not be read: ${result.error}`,
+      remedy: 'the gate fails closed; inspect the repository state and commit again',
+      output: '',
+    };
+  }
+  if (result.findings.length === 0) {
+    return { ok: true, detail: `${result.lines} added line(s) scanned, no secret found`, output: '' };
+  }
+  const files = new Set(result.findings.map((f) => f.file));
+  const shown = result.findings.slice(0, BUILTIN_REPORT_MAX);
+  const more = result.findings.length - shown.length;
+  return {
+    ok: false,
+    detail: `${result.findings.length} probable secret(s) in ${files.size} staged file(s)`,
+    remedy:
+      'remove the value from the staged file (or unstage it with git restore --staged <path>) ' +
+      'and commit again; the report never prints the matched bytes',
+    output:
+      renderFindings(shown) +
+      (more > 0 ? `\n  … ${more} more finding(s) not shown` : ''),
+  };
+}
+
 /**
  * Run a gate's resolution, as a shell line or as an argv.
  *

package/src/hooks/gates.mjs

@@ -1,7 +1,7 @@
 import { MANIFEST_FILE } from '../name.mjs';
 // Gate definitions for the shared hook dispatcher.
 //
-// A gate has one of three kinds, and the choice is not cosmetic:
+// A gate has one of four kinds, and the choice is not cosmetic:
 //
 //   staged   run a formatter over the STAGED FILES ONLY, then re-stage them.
 //            Whole-repo formatting from a pre-commit hook would rewrite
@@ -14,13 +14,18 @@ import { MANIFEST_FILE } from '../name.mjs';
 //            know what monkeyc or a Kotlin script path looks like in one repo
 //            and something else in another. Plan 0001 section 3.2 keeps repo
 //            commands and paths local; this is that ruling in code.
+//   builtin  run inside this binary, with nothing to resolve on disk. For a
+//            check whose whole value is that a fresh clone has it: the staged-
+//            diff secret scan needs no script, no command and no tool in
+//            node_modules, and a gate that needed an install step would be a
+//            gate the repository that most needs it does not have (ADR-100).
 //
 // ADR-010 note: no gate invokes `npx` or `npm exec`. Script gates go through
 // `npm run`, and staged gates resolve the formatter from the project's own
 // `node_modules/.bin`, which is the declared dependency's binary rather than
 // one fetched at hook time.
 
-export const GATE_KINDS = new Set(['staged', 'script', 'command']);
+export const GATE_KINDS = new Set(['staged', 'script', 'command', 'builtin']);
 
 /** Extensions a `staged` formatter gate will hand to the tool. */
 export const FORMATTABLE = new Set([
@@ -29,7 +34,7 @@ export const FORMATTABLE = new Set([
 ]);
 
 /**
- * @typedef {{name: string, kind: 'staged'|'script'|'command', adr: string,
+ * @typedef {{name: string, kind: 'staged'|'script'|'command'|'builtin', adr: string,
  *            script?: string, tools?: string[], why: string}} Gate
  */
 
@@ -88,6 +93,12 @@ export const GATES = {
     adr: 'ADR-002',
     why: 'a protocol change is a two-repo change; the drift check is what makes half of it fail loudly',
   },
+  'secret-scan': {
+    name: 'secret-scan',
+    kind: 'builtin',
+    adr: 'ADR-100',
+    why: 'a staged diff is the last moment a secret can still be kept out of history, and the scan must be runnable by a clone with nothing installed',
+  },
 };
 
 export function getGate(name) {

package/src/hooks/resolve.mjs

@@ -119,6 +119,20 @@ export async function resolveGate(gate, { root, pkg, staged, commands }) {
     };
   }
 
+  if (gate.kind === 'builtin') {
+    // Nothing on disk to resolve: the implementation IS this binary, which is
+    // the whole point of the kind (ADR-100). A declared command was handled
+    // above and still wins, so a repository can swap the built-in for its own
+    // program exactly the way it can for any other gate.
+    return {
+      ok: true,
+      kind: gate.kind,
+      argv: null,
+      builtin: gate.name,
+      detail: `built-in: ${gate.name}`,
+    };
+  }
+
   if (gate.kind === 'staged') {
     const tool = await resolveStagedTool(root, gate);
     if (tool.path === null) {

package/src/ignore.mjs

@@ -0,0 +1,133 @@
+// One ignore list, four readers' dialects (plan 0003 R52).
+//
+// Cursor, Aider, Gemini and Claude each want the same fact — "the agent must
+// not load these paths" — in a different place: three gitignore-style files and
+// one array inside a JSON settings object. Hand-maintaining four copies is four
+// chances to forget one, and a forget is silent: the agent reads the file that
+// did get updated and confidently loads the path the other three excluded. So
+// the list lives in exactly one file (`.simtignore`, at the repository root,
+// where a gitignore-syntax list already belongs) and everything else is
+// rendered from it.
+//
+// Two ownership rules, because the four targets are not equally ours:
+//
+//   - The three ignore files are GENERATED: whatever they held is what the list
+//     says after `simt ignore --yes`. A line that is in one and not in the list
+//     is drift between four files that claim to agree, and the plan prints it
+//     as a removal before anything is written.
+//   - `.claude/settings.json` is the READER'S file that merely contains our
+//     entries. We merge: every key, every permission and every deny entry that
+//     was already there survives byte-for-byte, and we only add `Read(...)`
+//     lines. In particular we never REMOVE a deny entry, because deleting a
+//     permission is a security decision that belongs to whoever wrote it — an
+//     entry dropped from `.simtignore` leaves a stale deny in Claude (safe
+//     direction) while the three generated files converge immediately.
+
+/** The one list. gitignore syntax: one path or glob per line, `#` comments. */
+export const IGNORE_FILE = '.simtignore';
+
+/** The three readers that take the list verbatim. */
+const TEXT_TARGETS = ['.cursorignore', '.aiderignore', '.geminiignore'];
+
+/** The reader that takes it as `permissions.deny` `Read(...)` entries. */
+export const CLAUDE_SETTINGS = '.claude/settings.json';
+
+/**
+ * Parse the list: trim, drop blanks and `#` comments, keep entries verbatim.
+ *
+ * Verbatim matters — `.env.local` and `secrets/` and `*.pem` are the reader's
+ * globs, and normalising them would be this tool guessing at another tool's
+ * pattern language.
+ */
+export function parseIgnoreList(text) {
+  return String(text)
+    .split('\n')
+    .map((line) => line.replace(/\r$/, '').trim())
+    .filter((line) => line !== '' && !line.startsWith('#'));
+}
+
+/** The bytes of one of the three generated ignore files. */
+export function renderTextIgnore(entries) {
+  return entries.length === 0 ? '' : `${entries.join('\n')}\n`;
+}
+
+/** The list as Claude deny entries: `Read(.env)`, `Read(secrets/**)`, … */
+export function denyEntries(entries) {
+  return entries.map((entry) => `Read(${entry})`);
+}
+
+/**
+ * Merge the list into `.claude/settings.json`, preserving everything else.
+ *
+ * @param {string|null} existingText current bytes, or null when absent
+ * @param {string[]} entries the parsed list
+ * @returns {{ok: true, text: string} | {ok: false, error: string}} — a settings
+ *   file that is not valid JSON OBJECT is refused rather than replaced: the one
+ *   failure that loses a reader's whole Claude configuration is a renderer that
+ *   "repairs" what it could not parse.
+ */
+export function renderClaudeSettings(existingText, entries) {
+  let settings = {};
+  if (existingText !== null) {
+    try {
+      settings = JSON.parse(existingText);
+    } catch (error) {
+      return { ok: false, error: `${CLAUDE_SETTINGS} is not valid JSON: ${error.message}` };
+    }
+    if (settings === null || typeof settings !== 'object' || Array.isArray(settings)) {
+      return { ok: false, error: `${CLAUDE_SETTINGS} is not a JSON object; it cannot hold permissions` };
+    }
+  }
+
+  const current =
+    settings.permissions !== null &&
+    typeof settings.permissions === 'object' &&
+    !Array.isArray(settings.permissions)
+      ? { ...settings.permissions }
+      : {};
+  const existing = Array.isArray(current.deny)
+    ? current.deny.filter((entry) => typeof entry === 'string')
+    : [];
+  const wanted = denyEntries(entries);
+  // Existing entries keep their order and their bytes; ours append in list
+  // order, deduplicated so a re-run is byte-idempotent.
+  current.deny = [...existing, ...wanted.filter((entry) => !existing.includes(entry))];
+  settings.permissions = current;
+
+  return { ok: true, text: `${JSON.stringify(settings, null, 2)}\n` };
+}
+
+/**
+ * The four targets with their desired bytes, from the current bytes of each.
+ *
+ * @param {string[]} entries the parsed list
+ * @param {(path: string) => Promise<string|null>} read current bytes or null
+ * @returns {Promise<{ok: true, targets: {path: string, action: 'create'|'update'|'unchanged',
+ *   before: string|null, after: string}[]} | {ok: false, error: string}>}
+ */
+export async function planIgnore(entries, read) {
+  const text = renderTextIgnore(entries);
+  const targets = [];
+
+  for (const path of TEXT_TARGETS) {
+    const before = await read(path);
+    targets.push({
+      path,
+      action: before === null ? 'create' : before === text ? 'unchanged' : 'update',
+      before,
+      after: text,
+    });
+  }
+
+  const claudeBefore = await read(CLAUDE_SETTINGS);
+  const merged = renderClaudeSettings(claudeBefore, entries);
+  if (!merged.ok) return { ok: false, error: merged.error };
+  targets.push({
+    path: CLAUDE_SETTINGS,
+    action: claudeBefore === null ? 'create' : claudeBefore === merged.text ? 'unchanged' : 'update',
+    before: claudeBefore,
+    after: merged.text,
+  });
+
+  return { ok: true, targets };
+}

package/src/index/persist.mjs

@@ -4,7 +4,7 @@
 // rows. This file is the format; store.mjs is the walk that fills it. They are
 // split because the walk and the format together crossed the review trigger.
 
-import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
+import { mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 
 export const SQLITE_FILE = '.simt/index.sqlite';
@@ -44,18 +44,53 @@ export function decodeVectorBlob(blob) {
   return new Float32Array(copy.buffer);
 }
 
+let tmpSeq = 0;
+
+/** A per-writer temp file: pid plus a sequence, so in-process concurrent writers meet on no shared path. */
+function tmpFor(file) {
+  tmpSeq += 1;
+  return `${file}.${process.pid}.${tmpSeq}.tmp`;
+}
+
 export async function writeSqlite(root, next, removed, symbols, edges, fts, embeddings = []) {
   const { DatabaseSync } = await import('node:sqlite');
   const file = join(root, SQLITE_FILE);
   await mkdir(dirname(file), { recursive: true });
-  const db = new DatabaseSync(file);
+  // A cold build goes to a temp file that is renamed over the target: three
+  // concurrent cold runs used to interleave schema creation and leave a locked,
+  // table-less database behind (Q08). Each writer builds its own complete file
+  // and the rename is atomic, so the last writer wins with a whole index.
+  let cold = false;
   try {
+    await stat(file);
+  } catch {
+    cold = true;
+  }
+  const target = cold ? tmpFor(file) : file;
+  if (cold) {
+    try {
+      await stat(target);
+      const { unlink } = await import('node:fs/promises');
+      await unlink(target);
+    } catch {
+      // No stale temp file: build fresh.
+    }
+  }
+  const db = new DatabaseSync(target);
+  try {
+    db.exec('pragma journal_mode = WAL');
+    db.exec('pragma busy_timeout = 5000');
+    db.exec('pragma synchronous = normal');
     db.exec(SCHEMA);
-    db.exec('begin');
+    db.exec('begin immediate');
     const upsert = db.prepare(`insert into files(path, blob, lang, bytes, pkg) values (?, ?, ?, ?, ?)
       on conflict(path) do update set blob = excluded.blob, lang = excluded.lang, bytes = excluded.bytes, pkg = excluded.pkg`);
     const dropSymbols = db.prepare('delete from symbols where path = ?');
-    const dropEdges = db.prepare('delete from edges where src = ? or dst = ?');
+    // An importer owns its outgoing edges: re-extracting a changed file drops
+    // only `src = ?`, so the unchanged importers' edges pointing into it survive
+    // (Q07). A removed file's incoming edges dangle, so they drop with it.
+    const dropEdges = db.prepare('delete from edges where src = ?');
+    const dropIncoming = db.prepare('delete from edges where dst = ?');
     const dropFts = db.prepare('delete from fts where ref = ?');
     const dropEmbed = db.prepare('delete from embeddings where path = ?');
     const dropFile = db.prepare('delete from files where path = ?');
@@ -67,14 +102,15 @@ export async function writeSqlite(root, next, removed, symbols, edges, fts, embe
     for (const row of next) {
       upsert.run(row.path, row.blob, row.lang, row.bytes, row.pkg);
       dropSymbols.run(row.path);
-      dropEdges.run(row.path, row.path);
+      dropEdges.run(row.path);
       dropFts.run(row.path);
       dropEmbed.run(row.path);
     }
     for (const path of removed) {
       dropFile.run(path);
       dropSymbols.run(path);
-      dropEdges.run(path, path);
+      dropEdges.run(path);
+      dropIncoming.run(path);
       dropFts.run(path);
       dropEmbed.run(path);
     }
@@ -90,10 +126,26 @@ export async function writeSqlite(root, next, removed, symbols, edges, fts, embe
     db.exec('commit');
   } catch (error) {
     try { db.exec('rollback'); } catch { /* a failed begin has nothing to undo */ }
-    throw error;
+    throw asIndexError(error);
   } finally {
     db.close();
   }
+  if (cold) await rename(target, file);
+}
+
+/**
+ * A contended index write is a retryable race, not a broken repository: name it
+ * so the command maps its own remedy instead of blaming the git checkout (Q08).
+ */
+function asIndexError(error) {
+  const code = error?.code ?? error?.errno;
+  if (code === 'SQLITE_BUSY' || code === 5 || /database is locked/i.test(error?.message ?? '')) {
+    const busy = new Error('another index run is writing; wait a moment and run again');
+    busy.code = 'INDEX_BUSY';
+    busy.cause = error;
+    return busy;
+  }
+  return error;
 }
 
 export async function writeJsonl(root, previous, next, removed, symbols, edges, fts, force, embeddings = []) {
@@ -109,7 +161,9 @@ export async function writeJsonl(root, previous, next, removed, symbols, edges,
   for (const row of replaced.values()) files.push(row);
   files.sort(byPath);
   const keptSymbols = force ? [] : (await readJsonl(root, 'symbols')).filter((row) => !drop.has(row.path));
-  const keptEdges = force ? [] : (await readJsonl(root, 'edges')).filter((row) => !drop.has(row.src) && !drop.has(row.dst));
+  // Edge ownership mirrors the sqlite backend: a changed file loses only the edges
+  // it owns (src), while a removed file also drops the edges that pointed at it.
+  const keptEdges = force ? [] : (await readJsonl(root, 'edges')).filter((row) => !drop.has(row.src) && !gone.has(row.dst));
   const keptFts = force ? [] : (await readJsonl(root, 'fts')).filter((row) => !drop.has(row.ref));
   const newEmbedPaths = new Set(embeddings.map((row) => row.path));
   const keptEmbeddings = force
@@ -121,6 +175,8 @@ export async function writeJsonl(root, previous, next, removed, symbols, edges,
   const allEmbeddings = [...keptEmbeddings, ...embeddings].sort(byPath);
   const file = join(root, JSONL_FILE);
   await mkdir(dirname(file), { recursive: true });
+  // Written atomically: a concurrent reader never sees a half-written file.
+  const tmp = tmpFor(file);
   const lines = [
     JSON.stringify({ table: 'meta', key: 'schema', value: SCHEMA_V }),
     ...files.map((row) => JSON.stringify({ table: 'files', path: row.path, blob: row.blob, lang: row.lang, bytes: row.bytes, pkg: row.pkg })),
@@ -140,7 +196,8 @@ export async function writeJsonl(root, previous, next, removed, symbols, edges,
       });
     }),
   ];
-  await writeFile(file, `${lines.join('\n')}\n`);
+  await writeFile(tmp, `${lines.join('\n')}\n`);
+  await rename(tmp, file);
   return { symbols: allSymbols.length, edges: allEdges.length, embeddings: allEmbeddings.length };
 }