diff --git a/.gstack/pregate.json b/.gstack/pregate.json index 737703bbe..6f86797c9 100644 --- a/.gstack/pregate.json +++ b/.gstack/pregate.json @@ -39,7 +39,8 @@ { "id": "context-budget", "when": ["SKILL.md", "*/SKILL.md", "*/sections/*.md", "SKILL.md.tmpl", "*/SKILL.md.tmpl", "*/sections/*.tmpl", "*/sections/manifest.json", "*/templates/*.tmpl", "hosts/**", "model-overlays/**", "scripts/gen-skill-docs.ts", "scripts/resolvers/**", "test/context-budget-ratchet.test.ts", "test/fixtures/context-budget*.json"], "command": "bun test test/context-budget-ratchet.test.ts", "fix": "shorten the skill under its token ceiling, or lower the ceiling when the skill shrank" }, { "id": "module-size", "when": ["lib/**/*.ts", "bin/**", "scripts/**/*.ts", "browse/src/**/*.ts", "test/helpers/**/*.ts", "test/module-size-ratchet.test.ts", "test/fixtures/module-size-ratchet.json"], "command": "bun test test/module-size-ratchet.test.ts", "fix": "split the module or function the failure names; it may not grow past its recorded size" }, { "id": "goldens", "when": ["SKILL.md", "*/SKILL.md", "*/sections/*.md", "SKILL.md.tmpl", "*/SKILL.md.tmpl", "*/sections/*.tmpl", "*/sections/manifest.json", "*/templates/*.tmpl", "hosts/**", "model-overlays/**", "scripts/gen-skill-docs.ts", "scripts/resolvers/**", "ship/**", "scripts/gen-ship-goldens.ts", "test/host-config.test.ts", "test/fixtures/golden/**"], "command": "bun test test/host-config.test.ts", "fix": "when the render change is intended, run bun scripts/gen-ship-goldens.ts and commit the updated goldens" }, - { "id": "doc-caps", "when": ["CLAUDE.md", "test/claude-md-size.test.ts"], "command": "bun test test/claude-md-size.test.ts", "fix": "move contributor-only detail from CLAUDE.md into docs/ and leave a one-line pointer" } + { "id": "doc-caps", "when": ["CLAUDE.md", "test/claude-md-size.test.ts"], "command": "bun test test/claude-md-size.test.ts", "fix": "move contributor-only detail from CLAUDE.md into docs/ and leave a one-line pointer" }, + { "id": "conflict-markers", "when": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.mjs", "**/*.cjs", "**/*.sh", "**/*.json", "**/*.yml", "**/*.yaml", "**/*.tmpl", "bin/**"], "command": "bun scripts/check-conflict-markers.ts", "fix": "finish the merge in each file it names, delete the marker lines and commit; a fixture that shows markers on purpose declares itself as docs/pregate.md describes" } ], "strays": { "allow": ["modules/loadouts.json", "modules/loadouts.schema.json"] } } diff --git a/CHANGELOG.md b/CHANGELOG.md index b98f91f8f..fdb4f2f1b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,12 @@ # Changelog +## [1.95.2.0] - 2026-11-04 + +- Pushes from /ship now stop on leftover merge conflict markers. A new `conflict-markers` guard reads every line the branch adds, in the commit being pushed and in the working tree, and refuses one that starts with `<<<<<<<` or `>>>>>>>`, or is exactly `=======`, even inside a template literal that still parses and passes its tests (GST-1190, seen on #3927). Markdown code blocks that show git output (an unlabeled, `text` or `diff` fence) are skipped, while a conflict inside a `bash` or `ts` fence is still refused. A fixture that shows markers on purpose declares `gstack-conflict-markers: fixture` on a line of its own near the top. + +### Tests +- `test/conflict-markers.test.ts`: a marker inside a template literal is refused (it failed before the guard existed); a Markdown code block that shows a marker passes while the same lines outside a fence or in a bash fence are refused; unchanged lines, declared fixtures, untracked files, quoted file names, git prefix settings and a committed conflict hidden by an unstaged repair are handled. + ## [1.95.1.0] - 2026-11-04 **/ship's review depth now follows what the code does, not what a file is named (GST-1177).** An executable file stays code wherever it sits and whatever its name, and code that seals eval custody or decides what reaches an outside model now gets full review. Over the last 200 commits on main, no commit's review depth went down. Six gained a risk class, and three of those went from light to full, including the secret-egress fix in #3921 that had been planned light. diff --git a/VERSION b/VERSION index b28cd731d..936be4c1b 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.95.1.0 +1.95.2.0 diff --git a/agents-digest/gstack-AGENTS.md b/agents-digest/gstack-AGENTS.md index aa2782464..6ff7813de 100644 --- a/agents-digest/gstack-AGENTS.md +++ b/agents-digest/gstack-AGENTS.md @@ -1,4 +1,4 @@ -# gstack digest v1.95.1.0 — regenerate/re-copy after upgrading gstack +# gstack digest v1.95.2.0 — regenerate/re-copy after upgrading gstack Behavioral rules from gstack (https://github.com/garrytan/gstack), compressed for agent hosts without a full skill install. The full skills add workflows, diff --git a/docs/pregate.md b/docs/pregate.md index 50d96c7e3..5ca21a0b9 100644 --- a/docs/pregate.md +++ b/docs/pregate.md @@ -1402,8 +1402,22 @@ being pushed skips the guards, as `GUARDS: not run`. Outside /ship, run the command above yourself before `git push`. gstack declares its own list in `.gstack/pregate.json`: `typecheck`, -`skill-size`, `parity-suite`, `context-budget`, `module-size`, `goldens` and -`doc-caps`. Generated SKILL.md freshness is the `regen` check's job. Other +`skill-size`, `parity-suite`, `context-budget`, `module-size`, `goldens`, +`doc-caps` and `conflict-markers`. Generated SKILL.md freshness is the `regen` +check's job. `conflict-markers` runs `scripts/check-conflict-markers.ts` on a +change to code, templates or config, and reads every line the branch adds +against its merge base with `origin/main`, both in the committed HEAD (what the +push publishes) and in the working tree's tracked files. A line starting with +`<<<<<<<` or `>>>>>>>` (then a space or the line end), or a line that is exactly +`=======`, stops the push, even inside a template literal the parser accepts. +In Markdown (`.md`, `.mdx`, `.markdown`, `.md.tmpl`) it skips fences whose info +string is empty, `text`, `txt`, `plaintext`, `diff` or `console`, the fences a +doc uses to show git output, and counts `=======` only between a `<<<<<<<` and +its close, so such a code block and a heading underline both pass; a conflict +inside a `bash` or `ts` fence is still refused. A fixture that shows markers on +purpose puts a line that is only `gstack-conflict-markers: fixture` (a comment +leader such as `#` or `//` is fine) in its first five lines; the phrase +anywhere else exempts nothing. Other repos add their own `guards` the same way; the key needs no newer gstack than the one that already reads `guards`. diff --git a/package.json b/package.json index 61e20b310..25c309d38 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "gstack", - "version": "1.95.1", + "version": "1.95.2", "description": "Garry's Stack — Claude Code skills + fast headless browser. One repo, one install, entire AI engineering workflow.", "license": "MIT", "type": "module", diff --git a/scripts/check-conflict-markers.ts b/scripts/check-conflict-markers.ts new file mode 100755 index 000000000..4389ef0e6 --- /dev/null +++ b/scripts/check-conflict-markers.ts @@ -0,0 +1,105 @@ +#!/usr/bin/env -S bun --no-env-file --config=/dev/null +/** + * check-conflict-markers — refuse merge conflict markers on the lines a branch changed (GST-1190). + * + * bun scripts/check-conflict-markers.ts [--base ] + * + * Reads every line the branch adds against its merge base with (default origin/main) twice: in the + * committed HEAD, which is what a push publishes, and in the working tree's tracked files (deleted files are + * skipped; untracked files are never pushed, so they are not read). A line starting with `<<<<<<<` or + * `>>>>>>>` followed by a space or the line end, or a line that is exactly `=======`, is a marker. This + * catches a marker the parser accepts, such as one inside a template literal (#3927). Markdown files + * (`.md`, `.mdx`, `.markdown`, `.md.tmpl`) skip lines inside a ``` or ~~~ fence whose info string is empty, + * text, txt, plaintext, diff or console, the fences a doc uses to show git output; a conflict inside a bash, + * ts or other code fence is still refused. They count `=======` only between a `<<<<<<<` and its close, so a + * setext heading underline passes. A file whose first five lines include one that is only the declaration + * `gstack-conflict-markers: fixture` (after an optional comment leader such as `#`, `//` or `)?\s*$/; +const GIT = ['-c', 'core.quotePath=false', '-c', 'diff.noprefix=false', '-c', 'diff.mnemonicPrefix=false']; + +function git(args: string[], allowFail = false): string | null { + const r = spawnSync('git', [...GIT, ...args], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024, timeout: 120_000 }); + if (r.status === 0) return r.stdout; + if (allowFail) return null; + console.error(`check-conflict-markers: git ${args.join(' ')} failed: ${(r.stderr || r.error?.message || '').trim()}`); + process.exit(2); +} + +/** The added line numbers per path, from a zero-context diff whose headers name paths with fixed a/ and b/ prefixes. */ +function addedLines(diff: string): Map> { + const added = new Map>(); + let file = '', header = false; + for (const line of diff.split('\n')) { + if (line.startsWith('diff --git ')) { header = true; file = ''; continue; } + if (header && line.startsWith('+++ ')) { file = line.startsWith('+++ b/') ? line.slice(6).replace(/\t$/, '') : ''; header = false; continue; } + if (header) continue; + const hunk = /^@@ -\S+ \+(\d+)(?:,(\d+))? @@/.exec(line); + if (!hunk || !file) continue; + const start = Number(hunk[1]), count = hunk[2] === undefined ? 1 : Number(hunk[2]); + const set = added.get(file) ?? new Set(); + for (let n = start; n < start + count; n++) set.add(n); + added.set(file, set); + } + return added; +} + +const seen = new Set(); +function scan(f: string, text: string, lines: Set, where: string, hits: Set): void { + const all = text.split('\n'); + if (text.includes('\0') || all.slice(0, 5).some(l => DECLARATION.test(l))) return; + const md = MARKDOWN.test(f); + let fence = '', shown = false, open = false; + all.forEach((raw, idx) => { + const l = raw.replace(/\r$/, ''); + if (md) { + const m = FENCE.exec(l); + if (m && !fence) { fence = m[1]!; shown = SHOWN.test(m[2]!); return; } + if (m && !m[2] && m[1]![0] === fence[0] && m[1]!.length >= fence.length) { fence = ''; shown = false; return; } + if (shown) return; + } + const marker = OPEN.test(l) ? '<'.repeat(7) : CLOSE.test(l) ? '>'.repeat(7) : MID.test(l) && (!md || open) ? '='.repeat(7) : ''; + if (OPEN.test(l)) open = true; + if (CLOSE.test(l)) open = false; + if (!marker || !lines.has(idx + 1) || seen.has(`${f}:${idx + 1}`)) return; + seen.add(`${f}:${idx + 1}`); + hits.add(`CONFLICT_MARKER: ${f}:${idx + 1} ${marker}${where}`); + }); +} + +const i = process.argv.indexOf('--base'); +const base = i > 0 ? process.argv[i + 1]! : 'origin/main'; +const root = git(['rev-parse', '--show-toplevel'])!.trim(); +process.chdir(root); +const fork = git(['merge-base', base, 'HEAD'])!.trim(); +const DIFF = ['diff', '-U0', '--no-color', '--no-ext-diff', '--no-renames', '--src-prefix=a/', '--dst-prefix=b/', '--diff-filter=AM']; + +const hits = new Set(); +const committed = addedLines(git([...DIFF, fork, 'HEAD', '--'])!); +for (const [f, lines] of committed) { + const text = git(['show', `HEAD:${f}`], true); + if (text !== null) scan(f, text, lines, '', hits); +} +const working = addedLines(git([...DIFF, fork, '--'])!); +for (const [f, lines] of working) { + let text: string; + try { text = fs.readFileSync(path.join(root, f), 'utf8'); } catch { continue; } + scan(f, text, lines, ' (working tree)', hits); +} +const files = new Set([...committed.keys(), ...working.keys()]).size; +if (hits.size) { + console.log([...hits].sort().join('\n')); + console.log('fix: finish the merge in each file above (keep the right side, delete the marker lines) and commit; a fixture that shows markers on purpose declares the fixture line documented in docs/pregate.md#prepush in its first five lines'); + process.exit(1); +} +console.log(`CONFLICT_MARKERS: none (${files} changed file(s) against ${fork.slice(0, 12)})`); diff --git a/test/conflict-markers.test.ts b/test/conflict-markers.test.ts new file mode 100644 index 000000000..14e285e91 --- /dev/null +++ b/test/conflict-markers.test.ts @@ -0,0 +1,86 @@ +import { afterAll, describe, expect, test } from 'bun:test'; +import { spawnSync } from 'node:child_process'; +import * as fs from 'node:fs'; +import * as os from 'node:os'; +import * as path from 'node:path'; +import { bunIsolationArgs } from '../lib/bun-isolation'; + +const SCRIPT = path.resolve(import.meta.dir, '..', 'scripts/check-conflict-markers.ts'); +const OPEN = '<'.repeat(7), MID = '='.repeat(7), CLOSE = '>'.repeat(7); +const dirs: string[] = []; +afterAll(() => { for (const d of dirs) fs.rmSync(d, { recursive: true, force: true }); }); + +function repo(base: Record = { 'README.md': 'base\n' }) { + const root = fs.mkdtempSync(path.join(os.tmpdir(), 'gstack-markers-')); + dirs.push(root); + const git = (...args: string[]) => { + const r = spawnSync('git', ['-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', '-c', 'user.email=test@example.com', '-c', 'user.name=test', ...args], { cwd: root, encoding: 'utf8', timeout: 30_000 }); + if (r.status !== 0) throw new Error(`git ${args.join(' ')}: ${r.stderr}`); + return r.stdout; + }; + git('init', '-q'); + git('symbolic-ref', 'HEAD', 'refs/heads/main'); + const write = (files: Record) => { for (const [p, c] of Object.entries(files)) { fs.mkdirSync(path.dirname(path.join(root, p)), { recursive: true }); fs.writeFileSync(path.join(root, p), c); } }; + write(base); + git('add', '-A'); + git('commit', '-q', '-m', 'base'); + git('checkout', '-q', '-b', 'feat'); + const change = (files: Record) => { write(files); git('add', '-A'); git('commit', '-q', '-m', 'change'); }; + const run = (env: Record = {}) => spawnSync('bun', [...bunIsolationArgs(), SCRIPT, '--base', 'main'], { cwd: root, encoding: 'utf8', timeout: 60_000, env: { ...process.env, ...env } }); + return { root, git, change, write, run }; +} + +describe('check-conflict-markers (GST-1190: #3927 kept markers inside a template literal and its tests passed)', () => { + // Value: protects=a merge that leaves conflict markers in a changed file is refused before the push, even where the + // markers sit inside a string the parser accepts; fails_when=a marker line in a template literal passes, a markdown + // code block that shows a marker is refused, or a git display setting hides a file; why_new=GSTA-234 #3927; + // seam=a real git repository and the script + test('a marker inside a template literal is refused', () => { + const r = repo(); + r.change({ 'lib/prompt.ts': `export const PROMPT = \`\n${OPEN} HEAD\nkeep this\n${MID}\nor this\n${CLOSE} origin/main\n\`;\n` }); + const out = r.run(); + expect(out.status).toBe(1); + expect(out.stdout).toContain(`CONFLICT_MARKER: lib/prompt.ts:2 ${OPEN}\n`); + expect(out.stdout).toContain(`CONFLICT_MARKER: lib/prompt.ts:4 ${MID}\n`); + expect(out.stdout).toContain(`CONFLICT_MARKER: lib/prompt.ts:6 ${CLOSE}\n`); + }); + + test('a markdown code block that shows a marker is not refused; the same lines outside a fence, or in a bash fence, are', () => { + const r = repo(); + const block = `${OPEN} HEAD\nours\n${MID}\ntheirs\n${CLOSE} main\n`; + r.change({ 'docs/merging.md': `# Merging\n\nGit writes this:\n\n\`\`\`\n${block}\`\`\`\n\nA heading\n${MID}\n` }); + const fenced = r.run(); + expect([fenced.status, fenced.stdout]).toEqual([0, expect.stringContaining('CONFLICT_MARKERS: none')]); + r.change({ 'docs/merging.md': `# Merging\n\n${block}` }); + const bare = r.run(); + expect(bare.status).toBe(1); + expect(bare.stdout).toContain(`CONFLICT_MARKER: docs/merging.md:3 ${OPEN}`); + expect(bare.stdout).toContain(`CONFLICT_MARKER: docs/merging.md:5 ${MID}`); + r.change({ 'skill/sections/x.md': `# X\n\n\`\`\`bash\n${OPEN} HEAD\necho a\n${MID}\necho b\n${CLOSE} feat\n\`\`\`\n` }); + expect(r.run().stdout).toContain(`CONFLICT_MARKER: skill/sections/x.md:4 ${OPEN}`); + }); + + test('only changed lines count; a fixture declares itself on a line of its own, a mention elsewhere does not exempt a file', () => { + const r = repo({ 'old.txt': `${OPEN} kept on main\n` }); + r.change({ 'old.txt': `${OPEN} kept on main\nnew line\n`, 'test/fixtures/merge.txt': `# gstack-conflict-markers: fixture\n${OPEN} HEAD\n${CLOSE} main\n` }); + expect(r.run()).toMatchObject({ status: 0 }); + r.change({ 'cfg.json': `{"fix": "declare gstack-conflict-markers: fixture"}\n${OPEN} HEAD\n` }); + expect(r.run().stdout).toContain(`CONFLICT_MARKER: cfg.json:2 ${OPEN}`); + }); + + test('the pushed commit is read, not only the working tree; untracked files are not; git display settings change nothing', () => { + const r = repo(); + r.change({ 'src/a b/ünï.ts': `const s = \`\n${CLOSE} theirs\n\`;\n` }); + for (const env of []>[{}, { GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: 'diff.noprefix', GIT_CONFIG_VALUE_0: 'true' }, { GIT_CONFIG_COUNT: '1', GIT_CONFIG_KEY_0: 'diff.mnemonicPrefix', GIT_CONFIG_VALUE_0: 'true' }]) { + expect(r.run(env).stdout, JSON.stringify(env)).toContain(`CONFLICT_MARKER: src/a b/ünï.ts:2 ${CLOSE}`); + } + r.write({ 'src/a b/ünï.ts': 'const s = 1;\n', 'merge.ts.orig': `${OPEN} HEAD\n` }); + const repaired = r.run(); + expect([repaired.status, repaired.stdout]).toEqual([1, expect.stringContaining(`CONFLICT_MARKER: src/a b/ünï.ts:2 ${CLOSE}`)]); + expect(repaired.stdout).not.toContain('merge.ts.orig'); + r.write({ 'README.md': `base\n${MID}\n` }); + r.git('add', '-A'); r.git('commit', '-q', '-m', 'repair'); + r.write({ 'lib/wip.ts': `${CLOSE} uncommitted\n` }); r.git('add', 'lib/wip.ts'); r.git('commit', '-q', '-m', 'wip'); r.write({ 'lib/wip.ts': `ok\n${OPEN} x\n` }); + expect(r.run().stdout).toContain(`CONFLICT_MARKER: lib/wip.ts:2 ${OPEN} (working tree)`); + }); +}); diff --git a/test/pregate-guards.test.ts b/test/pregate-guards.test.ts index 3edc4595e..88b7055c8 100644 --- a/test/pregate-guards.test.ts +++ b/test/pregate-guards.test.ts @@ -275,7 +275,7 @@ describe("gstack's own pre-push guards (GST-1138)", () => { test('the list validates, every guard has a fix, and every test file it names exists', () => { expect(codes(policy)).toEqual([]); - expect(guards.map(g => g.id).sort()).toEqual(['context-budget', 'doc-caps', 'goldens', 'module-size', 'parity-suite', 'skill-size', 'typecheck']); + expect(guards.map(g => g.id).sort()).toEqual(['conflict-markers', 'context-budget', 'doc-caps', 'goldens', 'module-size', 'parity-suite', 'skill-size', 'typecheck']); for (const g of guards) { expect(g.fix, g.id).toBeTruthy(); for (const f of g.command.match(/test\/[\w./-]+\.test\.ts/g) ?? []) expect(fs.existsSync(path.join(GSTACK, f)), `${g.id}: ${f}`).toBe(true); @@ -283,8 +283,8 @@ describe("gstack's own pre-push guards (GST-1138)", () => { }); test('each guard fires on its own inputs and none fires on a docs-only change', () => { - expect(selected('ship/SKILL.md.tmpl')).toEqual(['context-budget', 'goldens', 'parity-suite', 'skill-size']); - expect(selected('lib/pregate/index.ts')).toEqual(['module-size', 'typecheck']); + expect(selected('ship/SKILL.md.tmpl')).toEqual(['conflict-markers', 'context-budget', 'goldens', 'parity-suite', 'skill-size']); + expect(selected('lib/pregate/index.ts')).toEqual(['conflict-markers', 'module-size', 'typecheck']); expect(selected('test/fixtures/golden/claude-ship-SKILL.md')).toEqual(['goldens']); expect(selected('CLAUDE.md')).toEqual(['doc-caps']); expect(selected('docs/pregate.md')).toEqual([]);