deploy-verify

1import type { Register, EngineInterface } from 'claude-code'
2import { isDeploy, isCiOnly, isPush, isGh, pushBranch, RUN_URL } from './detect.ts'
3
4// A deploy is not done when the push exits 0, it is done when the live URL serves the change.
5// This mod closes that gap mechanically: after a deploy command succeeds it waits for the GitHub
6// Actions run the push started (when the repo has one), then fetches the target with cache-busting
7// and appends the verdict to the tool result as context the model must read.
8//
9// Per-repo config lives at <repo>/.claude/deploy-verify.json:
10//   { "url": "https://example.com", "match": "v3.10.10" }
11//   { "url": "https://example.com", "matchFile": "VERSION" }
12//   { "targets": [ { "url": "...", "match": "..." }, ... ] }
13// `match` may be omitted, in which case a 200 with a non-empty body is the whole test.
14
15// A hook that outruns its budget is dropped by the engine: core's result is used and everything
16// the hook returned is discarded. `$` calls are free but `$.clock.sleep` is not, so the in-call
17// check retries every RETRY_MS while the budget allows, and a slow CDN is waited out by a timer
18// afterwards, outside any hook's budget.
19const RETRY_MS = 4000
20const WATCH_MS = 15000
21const WATCH_TICKS = 12
22const CI_POLL_MS = 15000
23const CI_CAP_MS = 20 * 60 * 1000
24const CI_NO_RUN_MS = 3 * 60 * 1000
25const CLOCK_SKEW_MS = 10000
26
27type Target = { url: string; match?: string; matchFile?: string }
28type Config = { url?: string; match?: string; matchFile?: string; targets?: Target[] }
29
30const readConfig = async ($: EngineInterface, root: string): Promise<Config | undefined> => {
31  const path = `${root}/.claude/deploy-verify.json`
32  if (!(await $.fs.exists(path).catch(() => false))) return undefined
33  try {
34    return JSON.parse(await $.fs.read(path)) as Config
35  } catch (err) {
36    $.ui.log(`deploy-verify: ${path} is not valid JSON: ${err}`)
37    return undefined
38  }
39}
40
41const targetsOf = (config: Config): Target[] =>
42  config.targets?.length ? config.targets : config.url ? [{ url: config.url, match: config.match, matchFile: config.matchFile }] : []
43
44const wanted = async ($: EngineInterface, root: string, target: Target): Promise<string | undefined> => {
45  if (target.match) return target.match
46  if (!target.matchFile) return undefined
47  const path = target.matchFile.startsWith('/') ? target.matchFile : `${root}/${target.matchFile}`
48  const text = await $.fs.read(path).catch(() => '')
49  return text.trim().split('\n')[0]?.trim() || undefined
50}
51
52const bust = (url: string, now: number) => `${url}${url.includes('?') ? '&' : '?'}cb=${now}`
53
54const fetchLive = async ($: EngineInterface, url: string) =>
55  $.process.run(
56    [
57      'curl', '-sS', '-L', '--max-time', '20',
58      '-H', 'Cache-Control: no-cache',
59      '-H', 'Pragma: no-cache',
60      '-w', '\n__STATUS__%{http_code}',
61      url,
62    ],
63    { timeoutMs: 25000 },
64  )
65
66type Probe = { ok: boolean; status: string; line: string }
67
68const probe = async ($: EngineInterface, root: string, target: Target): Promise<Probe> => {
69  const needle = await wanted($, root, target)
70  const now = await $.clock.now()
71  const r = await fetchLive($, bust(target.url, now)).catch(err => ({ error: `${err}` }))
72  if ('error' in r) return { ok: false, status: 'curl', line: `NOT VERIFIED ${target.url} — curl failed: ${r.error}` }
73  const status = r.stdout.match(/__STATUS__(\d{3})\s*$/)?.[1] ?? '000'
74  const body = r.stdout.replace(/\n?__STATUS__\d{3}\s*$/, '')
75  if (status !== '200') return { ok: false, status, line: `NOT VERIFIED ${target.url} — HTTP ${status}` }
76  if (!needle) return { ok: true, status, line: `VERIFIED ${target.url} — HTTP 200, ${body.length} bytes (no match string configured)` }
77  if (body.includes(needle)) return { ok: true, status, line: `VERIFIED live: ${target.url} served "${needle}"` }
78  return { ok: false, status, line: `NOT VERIFIED ${target.url} — HTTP 200 but "${needle}" not in the ${body.length} bytes returned` }
79}
80
81const probeAll = async ($: EngineInterface, root: string, targets: Target[]) => {
82  const out: Probe[] = []
83  for (const target of targets) out.push(await probe($, root, target))
84  return out
85}
86
87// Retries inside the hook while its budget allows one more wait; `remaining` reads the budget fresh.
88const probeWithin = async ($: EngineInterface, root: string, targets: Target[], remaining: () => number) => {
89  let waited = 0
90  let probes = await probeAll($, root, targets)
91  while (probes.some(p => !p.ok) && remaining() > RETRY_MS + 1500) {
92    await $.clock.sleep(RETRY_MS)
93    waited += RETRY_MS
94    probes = await probeAll($, root, targets)
95  }
96  return probes.map(p => (p.ok && waited ? { ...p, line: `${p.line} after ${waited / 1000}s` } : p))
97}
98
99// A band draws for the person; a context block draws for the model. The last live check goes into
100// the first user message's context under this name, replacing its own previous copy rather than
101// accumulating, and `$.ui.invalidate('prompt.context')` refreshes it after every check. This is the
102// difference between evidence the model can talk around and evidence it cannot.
103const CONTEXT_BLOCK = 'deployVerify'
104let lastVerdict: { lines: string[]; at: number } | undefined
105
106const record = async ($: EngineInterface, lines: string[]) => {
107  lastVerdict = { lines, at: await $.clock.now() }
108  $.ui.invalidate('prompt.context')
109}
110
111const ago = (then: number, now: number) => {
112  const mins = Math.round((now - then) / 60000)
113  return mins < 1 ? 'just now' : mins === 1 ? '1 minute ago' : `${mins} minutes ago`
114}
115
116// One watch at a time: a CI poll, then a live poll, each a self-rearming `$.clock.after`.
117// Cancelled by the next deploy and by /deploy-verify stop.
118// A tick awaits curl or gh for up to 25s; a stop that lands mid-await bumps the epoch, and the
119// old loop sees its token is stale after every await and steps out instead of re-arming over
120// the new watcher. A tick that throws ends its chain: logged, state cleared, no follow-up.
121let watcher: { cancel: () => void } | undefined
122let epoch = 0
123
124const stopWatch = () => {
125  epoch++
126  watcher?.cancel()
127  watcher = undefined
128}
129
130const arm = ($: EngineInterface, token: number, ms: number, tick: () => Promise<void>) => {
131  watcher = $.clock.after(ms, () => {
132    tick().catch(err => {
133      $.ui.log(`deploy-verify: watcher stopped on an error: ${err}`)
134      if (token !== epoch) return
135      watcher = undefined
136      followUpArmed = false
137    })
138  })
139}
140
141// A mod cannot hold a turn open, so a watch that ends unverified after the model has answered
142// arrives as the next prompt. One per deploy: armed by the deploy, spent by the first unverified
143// end, and held until the deploying turn has completed.
144let turnBusy = false
145let followUpArmed = false
146let pendingFollowUp: string | undefined
147
148const armFollowUp = () => {
149  turnBusy = true
150  followUpArmed = true
151  pendingFollowUp = undefined
152}
153
154const submitLater = ($: EngineInterface, text: string) =>
155  $.clock.after(0, () => {
156    $.prompt.submit({ text }).catch(err => $.ui.log(`deploy-verify: follow-up not submitted: ${err}`))
157  })
158
159const unverified = ($: EngineInterface, lines: string[]) => {
160  if (!followUpArmed) return
161  followUpArmed = false
162  const text = [
163    'deploy-verify: the live check for the last deploy never passed.',
164    ...lines.map(l => `  ${l}`),
165    'Tell the user the deploy is NOT verified, with these lines as the evidence, and ask how to proceed.',
166  ].join('\n')
167  if (turnBusy) pendingFollowUp = text
168  else submitLater($, text)
169}
170
171// Keeps curling after the tool call has already answered, so a CDN that catches up a minute later
172// still says so. Toasts only when a target's HTTP status changes between polls, and at the end.
173const watchLive = ($: EngineInterface, root: string, targets: Target[], prior: string[] = []) => {
174  stopWatch()
175  const token = epoch
176  let left = WATCH_TICKS
177  let lastStatus: string[] | undefined
178  const tick = async () => {
179    left--
180    const probes = await probeAll($, root, targets)
181    if (token !== epoch) return
182    const was = lastStatus
183    if (was) probes.forEach((p, i) => was[i] !== p.status && $.ui.toast(`deploy-verify: ${targets[i]?.url} went HTTP ${was[i]} → ${p.status}`))
184    lastStatus = probes.map(p => p.status)
185    const lines = [...prior, ...probes.map(p => p.line)]
186    if (probes.every(p => p.ok)) {
187      watcher = undefined
188      await record($, lines)
189      $.ui.toast(`deploy-verify: live now — ${probes[0]?.line}`, { timeoutMs: 15000 })
190      return
191    }
192    if (left <= 0) {
193      watcher = undefined
194      await record($, lines)
195      $.ui.toast(`deploy-verify: still not live after ${Math.round((WATCH_MS * WATCH_TICKS) / 60000)} minutes — ${probes.find(p => !p.ok)?.line}`, { timeoutMs: 15000 })
196      unverified($, lines)
197      return
198    }
199    arm($, token, WATCH_MS, tick)
200  }
201  arm($, token, WATCH_MS, tick)
202}
203
204type Run = { databaseId: number; status: string; conclusion: string | null; createdAt: string; url: string; headBranch: string }
205
206// Only the deploying branch's runs: an unfiltered `on: push` workflow also runs for every other
207// ref pushed meanwhile (mini-offload force-pushes _offload/<branch>), and the newest of those
208// would otherwise stand in for the deploy's.
209const listRuns = async ($: EngineInterface, root: string, branch: string | undefined): Promise<Run[] | undefined> => {
210  const r = await $.process
211    .run(
212      ['gh', 'run', 'list', '--json', 'databaseId,status,conclusion,createdAt,url,headBranch', '--limit', '15', ...(branch ? ['--branch', branch] : [])],
213      { cwd: root, timeoutMs: 20000 },
214    )
215    .catch(() => undefined)
216  if (!r || r.exitCode !== 0) return undefined
217  try {
218    return (JSON.parse(r.stdout) as Run[]).filter(run => !branch || run.headBranch === branch)
219  } catch {
220    return undefined
221  }
222}
223
224const headBranch = async ($: EngineInterface, root: string) => {
225  const r = await $.process.run(['git', 'rev-parse', '--abbrev-ref', 'HEAD'], { cwd: root, timeoutMs: 10000 }).catch(() => undefined)
226  const name = r?.exitCode === 0 ? r.stdout.trim() : ''
227  return name && name !== 'HEAD' ? name : undefined
228}
229
230// Watches the GitHub Actions run the deploy started: the newest run on the deploying branch
231// created at or after the push (10s of clock skew allowed), or the one a `gh` command printed.
232// Success hands over to the live check; failure is the verdict, and no live check is made.
233const watchCi = ($: EngineInterface, root: string, targets: Target[], since: number, url: string | undefined, branch: string | undefined) => {
234  stopWatch()
235  const token = epoch
236  let last: string | undefined
237  let warned = false
238  const finish = async (lines: string[], ok: boolean) => {
239    watcher = undefined
240    await record($, lines)
241    if (!ok) {
242      unverified($, lines)
243      return
244    }
245    if (!targets.length) return
246    watchLive($, root, targets, lines)
247  }
248  const tick = async () => {
249    const now = await $.clock.now()
250    const runs = await listRuns($, root, url ? undefined : branch)
251    if (token !== epoch) return
252    if (!runs && !warned) {
253      warned = true
254      $.ui.log('deploy-verify: `gh run list` failed; is gh logged in?')
255    }
256    const id = url?.match(/actions\/runs\/(\d+)/)?.[1]
257    const run = runs?.find(r => (id ? `${r.databaseId}` === id : Date.parse(r.createdAt) >= since - CLOCK_SKEW_MS))
258    if (!run) {
259      if (now - since >= CI_NO_RUN_MS) {
260        await finish([`CI: no GitHub Actions run appeared within ${CI_NO_RUN_MS / 60000} minutes of ${url ?? 'the push'}; checking live directly`], true)
261        return
262      }
263      arm($, token, CI_POLL_MS, tick)
264      return
265    }
266    const state = run.status === 'completed' ? (run.conclusion ?? 'completed') : run.status
267    if (last !== undefined && last !== state) $.ui.toast(`deploy-verify: CI ${last} → ${state} (${run.url})`)
268    last = state
269    if (run.status !== 'completed') {
270      if (now - since >= CI_CAP_MS) {
271        await finish([`NOT VERIFIED — CI still ${state} after ${CI_CAP_MS / 60000} minutes: ${run.url}; no live check was made`], false)
272        return
273      }
274      arm($, token, CI_POLL_MS, tick)
275      return
276    }
277    if (run.conclusion === 'success') {
278      await finish([`CI passed: ${run.url}`], true)
279      return
280    }
281    await finish([`NOT VERIFIED — CI failed for ${run.url} (${run.conclusion}); no live check was made`], false)
282  }
283  arm($, token, CI_POLL_MS, tick)
284}
285
286// Hook advisories repeat. The same "no target configured" paragraph lands on every deploy in a repo
287// that has none, and each copy costs context to say what the last one said. Each advisory is hashed
288// and suppressed for a cooldown. Verdicts are never throttled: a verdict is evidence, and it differs.
289const ADVISORY_COOLDOWN_MS = 10 * 60 * 1000
290const advised = new Map<string, number>()
291
292const digest = (text: string) => {
293  let h = 5381
294  for (let i = 0; i < text.length; i++) h = ((h * 33) ^ text.charCodeAt(i)) >>> 0
295  return `${h}`
296}
297
298const fresh = async ($: EngineInterface, text: string): Promise<boolean> => {
299  const key = digest(text)
300  const now = await $.clock.now()
301  const seen = advised.get(key)
302  if (seen !== undefined && now - seen < ADVISORY_COOLDOWN_MS) return false
303  advised.set(key, now)
304  return true
305}
306
307// The first thing anyone does when a mod misbehaves is try to turn it off. `CLAUDE_MODS_DISABLE=all`,
308// or a comma list naming this mod, makes every hook here a pass-through and registers no command.
309const MOD = 'deploy-verify'
310let disabled = false
311const readDisabled = async ($: EngineInterface): Promise<boolean> => {
312  const raw = (await $.env.get('CLAUDE_MODS_DISABLE').catch(() => undefined)) ?? ''
313  disabled = raw
314    .split(',')
315    .map(v => v.trim())
316    .some(v => v === 'all' || v === MOD)
317  return disabled
318}
319
320export const register: Register = on => {
321  on('session.start', async ($, e, next) => {
322    const r = await next(e)
323    if (await readDisabled($)) return r
324    await $.command
325      .register({
326        name: 'deploy-verify',
327        description: 'Check the live URL for this repo now, waiting out a slow CDN (deploy-verify)',
328        argumentHint: '[check | status | stop]',
329        immediate: true,
330      })
331      .catch(err => $.ui.log(`deploy-verify: /deploy-verify not registered: ${err}`))
332    return r
333  })
334
335  on('command.run', { command: 'deploy-verify' }, async ($, e, next) => {
336    const repo = await $.session.repo().catch(() => null)
337    const root = repo?.root ?? (await $.session.cwd())
338    const config = await readConfig($, root)
339    const targets = config ? targetsOf(config) : []
340    if (!targets.length) {
341      return {
342        text: [
343          `deploy-verify: no ${root}/.claude/deploy-verify.json, so deploys here are never checked.`,
344          '',
345          'Write one of:',
346          '  { "url": "https://example.com", "match": "v1.2.3" }',
347          '  { "url": "https://example.com", "matchFile": "VERSION" }',
348          '  { "targets": [ { "url": "...", "match": "..." } ] }',
349        ].join('\n'),
350      }
351    }
352    if (e.args.trim().toLowerCase() === 'status') {
353      const rows = await Promise.all(targets.map(async t => `  ${t.url} — expects ${(await wanted($, root, t)) ?? 'HTTP 200 only'}`))
354      return { text: [`deploy-verify checks ${targets.length} target(s) after every deploy command:`, ...rows].join('\n') }
355    }
356    if (e.args.trim().toLowerCase() === 'stop') {
357      stopWatch()
358      return { text: 'deploy-verify: watcher stopped' }
359    }
360    const probes = await probeWithin($, root, targets, () => next.budget.remainingMs)
361    const lines = probes.map(p => p.line)
362    await record($, lines)
363    if (probes.some(p => !p.ok)) {
364      watchLive($, root, targets)
365      return { text: [...lines, '', `still checking every ${WATCH_MS / 1000}s for the next ${Math.round((WATCH_MS * WATCH_TICKS) / 60000)} minutes; a toast will say when it lands (/deploy-verify stop ends it)`].join('\n') }
366    }
367    return { text: lines.join('\n') }
368  })
369
370  on('prompt.context', async ($, e, next) => {
371    const below = await next(e)
372    if (disabled || !lastVerdict) return below
373    const now = await $.clock.now()
374    const text = [
375      `Last live deploy check, ${ago(lastVerdict.at, now)}:`,
376      ...lastVerdict.lines.map(v => `  ${v}`),
377      'This is the only evidence about the live site in this session. Do not describe the deploy as',
378      'verified unless a line above starts with VERIFIED, and do not re-state an older claim over it.',
379    ].join('\n')
380    return { ...below, blocks: [...below.blocks.filter(b => b.name !== CONTEXT_BLOCK), { name: CONTEXT_BLOCK, text }] }
381  })
382
383  on('turn.complete', async ($, e, next) => {
384    const r = await next(e)
385    if (disabled || e.agentId !== undefined) return r
386    turnBusy = false
387    if (pendingFollowUp !== undefined) {
388      submitLater($, pendingFollowUp)
389      pendingFollowUp = undefined
390    }
391    return r
392  })
393
394  on('tool.call', { tool: 'Bash' }, async ($, e, next) => {
395    if (disabled) return next(e)
396    const deploy = isDeploy(e.command)
397    const ciOnly = !deploy && isCiOnly(e.command)
398    if (!deploy && !ciOnly) return next(e)
399    const since = await $.clock.now()
400    const r = await next(e)
401    if ('deny' in r) return r
402
403    const add = (...lines: string[]) => ({ ...r, context: [...(r.context ?? []), lines.join('\n')] })
404
405    // Advisories are throttled; verdicts below are not.
406    const advise = async (...lines: string[]) => ((await fresh($, lines.join('\n'))) ? add(...lines) : r)
407
408    if (r.isError) {
409      if (ciOnly) return r
410      return advise(
411        'deploy-verify: the deploy command did not succeed. Do not report a deploy as done.',
412        'Report the failure with its output, then stop or fix it — whichever the user asked for.',
413      )
414    }
415
416    const repo = await $.session.repo().catch(() => null)
417    const root = repo?.root ?? (await $.session.cwd())
418    const config = await readConfig($, root)
419    const targets = config ? targetsOf(config) : []
420
421    const url = isGh(e.command) ? `${r.result.stdout}\n${r.result.stderr}`.match(RUN_URL)?.[0] : undefined
422    const ciTrigger = isPush(e.command) || url !== undefined
423    const hasCi = ciTrigger && (await $.fs.exists(`${root}/.github/workflows`).catch(() => false))
424
425    if (hasCi) {
426      const live = ciOnly ? [] : targets
427      const branch = url ? undefined : (pushBranch(e.command) ?? (await headBranch($, root)))
428      armFollowUp()
429      watchCi($, root, live, since, url, branch)
430      await record($, [`CI PENDING for ${url ?? 'the push'} — watching GitHub Actions, then ${live.length ? 'the live URL' : ciOnly ? 'nothing (a pull request deploys nothing)' : 'nothing (no verify target configured)'}`])
431      return add(
432        `deploy-verify: this repo has GitHub Actions workflows, so the run for ${url ?? 'this push'} is being watched (polling every ${CI_POLL_MS / 1000}s, up to ${CI_CAP_MS / 60000} minutes) before any live check.`,
433        'NOTHING is verified yet. Say the command exited 0 and that CI and the live site are still being checked.',
434        live.length
435          ? 'When CI passes the live URL is checked with cache-busting; the verdict lands in your context, and a follow-up prompt arrives if it never passes.'
436          : ciOnly
437            ? 'The pull request deploys nothing, so no live check follows; the CI verdict lands in your context.'
438            : `No live URL is configured; write ${root}/.claude/deploy-verify.json as {"url":"https://…","match":"<string that proves the new version>"} to check one after CI.`,
439      )
440    }
441
442    if (ciOnly) return r
443
444    if (!targets.length) {
445      return advise(
446        'deploy-verify: no verify target configured for this repo, so NOTHING about the live site has been checked.',
447        'You MUST NOT say "deployed successfully" or "live". Say the command exited 0 and the live site is unverified.',
448        `To make this automatic, write ${root}/.claude/deploy-verify.json as {"url":"https://…","match":"<string that proves the new version>"}.`,
449      )
450    }
451
452    $.ui.status('verifying live deploy…')
453    const probes = await probeWithin($, root, targets, () => next.budget.remainingMs)
454    $.ui.status(undefined)
455
456    const lines = probes.map(p => p.line)
457    await record($, lines)
458    if (probes.some(p => !p.ok)) {
459      armFollowUp()
460      watchLive($, root, targets)
461      return add(
462        'deploy-verify ran the live check and it did NOT pass:',
463        ...lines.map(v => `  ${v}`),
464        'Report exactly this: "deploy succeeded but live content not yet showing — likely CDN", and ask the user to hard-refresh.',
465        `Do not claim the deploy is verified. A watcher is now retrying every ${WATCH_MS / 1000}s for ${Math.round((WATCH_MS * WATCH_TICKS) / 60000)} minutes; it toasts when it lands and sends a follow-up prompt if it never does.`,
466      )
467    }
468
469    stopWatch()
470    $.ui.toast('deploy-verify: live content confirmed')
471    return add(
472      'deploy-verify checked the live URL(s) with cache-busting and they pass:',
473      ...lines.map(v => `  ${v}`),
474      'Quote the matched string back to the user as the evidence.',
475    )
476  }).catch(async ($, e, next) => {
477    const r = await next(e)
478    if ('deny' in r || !(isDeploy(e.command) || isCiOnly(e.command))) return r
479    $.ui.log(`deploy-verify: the check failed (${next.error.message ?? next.error.kind})`)
480    return {
481      ...r,
482      context: [
483        ...(r.context ?? []),
484        `deploy-verify failed to check this deploy (${next.error.kind}); NOTHING about CI or the live site is known. Do not claim the deploy verified; run /deploy-verify to check by hand.`,
485      ],
486    }
487  })
488}
489

1// Deploy detection, kept free of `$` so it can be tested directly. The loader follows `$` only
2// into functions of the module that registers hooks, so pure logic is what may live in its own file.
3
4export const DEPLOY = [
5  /(^|[^\w./-])git(\s+-\S+(\s+\S+)?)*\s+push(\s|$)/,
6  /\bwrangler\s+(pages\s+)?deploy\b/,
7  /\bvercel\b.*--prod\b/,
8  /\bnetlify\s+deploy\b.*--prod\b/,
9  /\brailway\s+up\b/,
10  /\b(fly|flyctl)\s+deploy\b/,
11  /\b(npm|pnpm|yarn|bun)\s+run\s+deploy\b/,
12  /\bgcloud\s+run\s+deploy\b/,
13  /\bgh\s+workflow\s+run\b/,
14  /\bgh\s+pr\s+merge\b/,
15  /\bgh\s+run\s+rerun\b/,
16  /\bmake\s+deploy\b/,
17]
18
19// Opens a pull request: nothing is deployed, but CI runs on it, so its run is watched and reported.
20export const CI_ONLY = [/\bgh\s+pr\s+create\b/]
21
22const DRY_RUN = /\bpush\b.*(--dry-run|\s-n\b)/
23
24// A command is not a deploy because the words appear somewhere in it. `echo "git push"`, a commit
25// message quoting one, and `grep -r "wrangler deploy"` all match a naive pattern, and each one
26// fires a verification against a site nothing was deployed to. So only what the shell would
27// actually execute is tested: heredoc bodies go first (their markers may themselves be quoted),
28// then quoted spans, then comments. A deploy hidden inside quotes — `ssh host "git push"` — is
29// missed by this, which is the right way round: a missed check costs a reminder, a phantom check
30// costs trust in the verdict.
31export const sanitise = (command: string): string =>
32  command
33    .replace(/<<-?\s*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1[\s\S]*?^\s*\2\s*$/gm, ' ')
34    .replace(/<<-?\s*(['"]?)[A-Za-z_][A-Za-z0-9_]*\1[\s\S]*$/, ' ')
35    .replace(/'[^']*'/g, ' ')
36    .replace(/"(?:[^"\\]|\\.)*"/g, ' ')
37    .replace(/(^|\s)#[^\n]*/g, '$1 ')
38
39// Each segment of the line counts on its own, so `echo ok && git push` is a push and a dry run
40// only turns off the push it is in.
41export const segments = (command: string): string[] => sanitise(command).split(/&&|\|\|?|;|\n/)
42
43const matches = (patterns: RegExp[], command: string) =>
44  segments(command).some(s => patterns.some(re => re.test(s)) && !DRY_RUN.test(s))
45
46export const isDeploy = (command: string) => matches(DEPLOY, command)
47
48export const isCiOnly = (command: string) => !isDeploy(command) && matches(CI_ONLY, command)
49
50export const isPush = (command: string) => segments(command).some(s => DEPLOY[0]!.test(s) && !DRY_RUN.test(s))
51
52// `gh` prints the run or pull request it created; a `git push` prints neither, its run is found by time.
53export const isGh = (command: string) => segments(command).some(s => /\bgh\s+(pr|workflow|run)\s/.test(s))
54
55export const RUN_URL = /https:\/\/github\.com\/[\w.-]+\/[\w.-]+\/(actions\/runs|pull)\/\d+/
56
57// The branch a push lands on: the refspec's destination when the command names one, else unknown
58// (the caller asks git for HEAD). `git push -u origin feat` and `git push origin main:prod` both work.
59export const pushBranch = (command: string): string | undefined => {
60  const segment = segments(command).find(s => DEPLOY[0]!.test(s) && !DRY_RUN.test(s))
61  if (!segment) return undefined
62  const words = segment.slice(segment.search(/\bpush(\s|$)/) + 4).trim().split(/\s+/).filter(w => w && !w.startsWith('-'))
63  const refspec = words[1]
64  if (!refspec) return undefined
65  const dst = refspec.replace(/^\+/, '').split(':').pop() ?? ''
66  return dst.replace(/^refs\/heads\//, '') || undefined
67}
68