@ai-sdlc/orchestrator 0.5.0 → 0.6.0

package/dist/fix-review.js

@@ -0,0 +1,441 @@
+/**
+ * Fix-Review orchestrator — detects review findings on agent-created PRs,
+ * fetches review comments, and re-invokes the agent with review context.
+ * Capped at MAX_FIX_ATTEMPTS to prevent infinite loops.
+ */
+import { createGitHubIssueTracker, evaluateDemotion, withSpan, getMeter, SPAN_NAMES, METRIC_NAMES, ATTRIBUTE_KEYS, } from '@ai-sdlc/reference';
+import { loadConfig } from './config.js';
+import { createLogger } from './logger.js';
+import { createStructuredConsoleLogger } from './structured-logger.js';
+import { ClaudeCodeRunner } from './runners/claude-code.js';
+import { execFileAsync, getGitHubConfig, extractIssueId, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, recordMetric, validateAndAuditOutput, authorizeFilesChanged, issueIdToNumber, } from './shared.js';
+import { renderTemplate } from './notifications.js';
+import { parseDuration } from './policy-evaluators.js';
+import { checkKillSwitch, issueAgentCredentials, revokeAgentCredentials, } from './security.js';
+import { DEFAULT_GH_CLI_TIMEOUT_MS, DEFAULT_CONFIG_DIR_NAME, defaultSandboxConstraints, NOTIFICATION_TITLES, } from './defaults.js';
+import { createCycleDetectorFromConfig, checkAndHandleCycle } from './cycle-utils.js';
+// Default max review-fix attempts (lower than CI-fix since reviews are more deterministic)
+export const MAX_REVIEW_FIX_ATTEMPTS = 2;
+export const RETRY_MARKER = '<!-- ai-sdlc-fix-review-attempt -->';
+/**
+ * Count how many fix-review retry attempts have been made on a PR
+ * by scanning comments for the hidden retry marker.
+ */
+export function countRetryAttempts(comments) {
+    let count = 0;
+    for (const body of comments) {
+        const matches = body.match(new RegExp(RETRY_MARKER.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'));
+        if (matches) {
+            count += matches.length;
+        }
+    }
+    return count;
+}
+/**
+ * Validate that a PR number is a positive integer.
+ */
+export function validatePrNumber(prNumber) {
+    if (!Number.isInteger(prNumber) || prNumber <= 0) {
+        throw new Error(`Invalid PR number: ${prNumber} (must be a positive integer)`);
+    }
+}
+/**
+ * Sanitize a git branch name to prevent command injection.
+ * Allows only alphanumeric characters, slashes, dashes, underscores, and dots.
+ */
+export function sanitizeBranchName(branch) {
+    if (!/^[a-zA-Z0-9/_.-]+$/.test(branch)) {
+        throw new Error(`Invalid branch name: "${branch}" (only alphanumeric, /, -, _, . allowed)`);
+    }
+    return branch;
+}
+/**
+ * Fetch review findings from PR reviews that requested changes.
+ * Returns a formatted string with all findings from review agents.
+ */
+export async function fetchReviewFindings(prNumber, injectedFindings, _secretStore) {
+    if (injectedFindings !== undefined) {
+        return injectedFindings;
+    }
+    // Validate PR number to prevent command injection
+    validatePrNumber(prNumber);
+    // Fetch reviews using gh CLI
+    const { stdout } = await execFileAsync('gh', ['pr', 'review', String(prNumber), '--json', 'state,body,author'], { timeout: DEFAULT_GH_CLI_TIMEOUT_MS });
+    let reviews;
+    try {
+        reviews = JSON.parse(stdout);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse review data from gh CLI: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const changesRequestedReviews = reviews.filter((r) => r.state === 'CHANGES_REQUESTED');
+    if (changesRequestedReviews.length === 0) {
+        return 'No review findings (all reviews approved or pending)';
+    }
+    // Format findings from all reviews
+    const findings = changesRequestedReviews
+        .map((r) => `### Review by ${r.author.login}\n\n${r.body}\n\n---\n`)
+        .join('\n');
+    return findings;
+}
+/**
+ * Execute the fix-review pipeline for a PR with review findings.
+ *
+ * Returns gracefully (no throw) when the retry limit is reached.
+ * Throws on agent failure or guardrail violations.
+ */
+export async function executeFixReview(prNumber, options = {}) {
+    const workDir = options.workDir ?? (await resolveRepoRoot());
+    const configDir = options.configDir ?? `${workDir}/${DEFAULT_CONFIG_DIR_NAME}`;
+    const log = options.logger ??
+        (options.useStructuredLogger ? createStructuredConsoleLogger() : createLogger());
+    const auditLog = options.auditLog ?? createDefaultAuditLog(workDir);
+    const metricStore = options.metricStore;
+    // 1. Load config
+    log.stage('load-config');
+    const config = loadConfig(configDir);
+    log.stageEnd('load-config');
+    // Kill switch check (before any work)
+    if (options.security) {
+        await checkKillSwitch(options.security);
+    }
+    if (!config.agentRole) {
+        throw new Error('No AgentRole resource found in .ai-sdlc/');
+    }
+    if (!config.autonomyPolicy) {
+        throw new Error('No AutonomyPolicy resource found in .ai-sdlc/');
+    }
+    const agentRole = config.agentRole;
+    const autonomyPolicy = config.autonomyPolicy;
+    // Derive max fix attempts from pipeline config (review stage onFailure.maxRetries)
+    const reviewStage = config.pipeline?.spec.stages.find((s) => s.name === 'review');
+    const maxFixAttempts = reviewStage?.onFailure?.maxRetries ?? MAX_REVIEW_FIX_ATTEMPTS;
+    // Notification templates
+    const notifTemplates = config.pipeline?.spec.notifications?.templates;
+    // Create default tracker when needed (lazy to avoid resolving secrets in test environments).
+    // In production (no _prComments injected), the tracker is always available.
+    let _tracker = options.tracker;
+    function getTracker() {
+        if (!_tracker) {
+            const { org, repo } = getGitHubConfig(options.secretStore);
+            const ghConfig = { org, repo, token: { secretRef: 'github-token' } };
+            _tracker = createGitHubIssueTracker(ghConfig);
+        }
+        return _tracker;
+    }
+    // Tracker is available if injected directly or if we're not in test mode
+    const trackerAvailable = !!options.tracker || options._prComments === undefined;
+    // Create cycle detector (marker generated after all guard conditions pass)
+    const cycleDetector = createCycleDetectorFromConfig(config.pipeline?.spec ?? {});
+    // 2. Count retry attempts (via injected comments or IssueTracker)
+    log.stage('check-retries');
+    let comments;
+    if (options._prComments !== undefined) {
+        comments = options._prComments;
+    }
+    else {
+        const issueComments = await getTracker().getComments(String(prNumber));
+        comments = issueComments.map((c) => c.body);
+    }
+    const attempts = countRetryAttempts(comments);
+    log.info(`Fix-review attempt ${attempts + 1} of ${maxFixAttempts}`);
+    log.stageEnd('check-retries');
+    // Helper to add a comment via tracker (uses default tracker in production)
+    const addComment = async (body) => {
+        if (trackerAvailable) {
+            await getTracker().addComment(String(prNumber), body);
+        }
+    };
+    if (attempts >= maxFixAttempts) {
+        log.info(`Fix-review retry limit reached (${maxFixAttempts}). Commenting and stopping.`);
+        auditLog.record({
+            actor: 'system',
+            action: 'evaluate',
+            resource: `pr#${prNumber}`,
+            decision: 'denied',
+            details: { reason: 'retry-limit-reached', attempts, max: maxFixAttempts },
+        });
+        const limitTpl = notifTemplates?.['fix-review-limit'];
+        const limitComment = limitTpl
+            ? renderTemplate(limitTpl, {
+                attempts: String(attempts),
+                max: String(maxFixAttempts),
+            })
+            : {
+                title: NOTIFICATION_TITLES.fixReviewRetryLimit,
+                body: `This PR has reached the maximum number of automated review-fix attempts (${maxFixAttempts}). Manual intervention is needed.`,
+            };
+        await addComment(`## ${limitComment.title}\n\n${limitComment.body}`);
+        return;
+    }
+    // Check for pipeline-level cycles AFTER retry counting
+    if (trackerAvailable) {
+        const cycleCheck = await checkAndHandleCycle({
+            issueOrPrId: String(prNumber),
+            stage: 'fix-review',
+            tracker: getTracker(),
+            detector: cycleDetector,
+        });
+        if (cycleCheck.cycleDetected) {
+            log.info('Pipeline cycle detected. Halting fix-review execution.');
+            auditLog.record({
+                actor: 'system',
+                action: 'evaluate',
+                resource: `pr#${prNumber}`,
+                decision: 'denied',
+                details: { reason: 'pipeline-cycle-detected' },
+            });
+            return;
+        }
+    }
+    // Generate cycle marker AFTER all guard conditions pass
+    const cycleMarker = cycleDetector.recordInvocation('fix-review');
+    // 3. Fetch review findings
+    log.stage('fetch-findings');
+    const reviewFindings = await fetchReviewFindings(prNumber, options._reviewFindings, options.secretStore);
+    log.stageEnd('fetch-findings');
+    // Check if review findings are actionable (not a generic "no findings" message)
+    const isActionable = reviewFindings &&
+        !reviewFindings.startsWith('No review findings') &&
+        reviewFindings.trim().length > 0;
+    if (!isActionable) {
+        log.info('No actionable review findings. Skipping fix-review execution.');
+        auditLog.record({
+            actor: 'system',
+            action: 'evaluate',
+            resource: `pr#${prNumber}`,
+            decision: 'allowed',
+            details: { reason: 'no-actionable-findings', reviewFindings },
+        });
+        return;
+    }
+    // 4. Determine branch and issue number
+    const { stdout: branchStdout } = await execFileAsync('git', ['branch', '--show-current'], {
+        cwd: workDir,
+    });
+    const currentBranch = sanitizeBranchName(branchStdout.trim());
+    const issueId = extractIssueId(currentBranch);
+    if (issueId === null) {
+        throw new Error(`Branch "${currentBranch}" does not match ai-sdlc/issue-<id> pattern`);
+    }
+    const issueNumber = issueIdToNumber(issueId);
+    // 5. Resolve autonomy level and constraints
+    const currentLevel = resolveAutonomyLevel(autonomyPolicy);
+    const resolved = resolveConstraints(agentRole.spec.constraints, currentLevel);
+    // 6. Fetch issue data (via tracker when available)
+    let issueTitle = `Issue ${issueId}`;
+    let issueBody = '';
+    if (trackerAvailable) {
+        const issueData = await getTracker().getIssue(issueId);
+        issueTitle = issueData.title;
+        issueBody = issueData.description ?? '';
+    }
+    // Store issue context in working memory
+    if (options.memory) {
+        options.memory.working.set('currentIssue', { prNumber, issueId, currentBranch });
+    }
+    // Query episodic memory for previous fix-review attempts
+    if (options.memory) {
+        const previousAttempts = options.memory.episodic.search('fix-review-execution');
+        if (previousAttempts.length > 0) {
+            log.info(`Found ${previousAttempts.length} previous fix-review episodes in memory`);
+        }
+    }
+    const meter = getMeter();
+    // Wrap agent+validation+push in try/catch for failure episodes
+    try {
+        // 7. Invoke agent with review findings (with sandbox + JIT credential lifecycle)
+        log.stage('agent');
+        const runner = options.runner ?? new ClaudeCodeRunner();
+        // Sandbox isolation around agent execution
+        let sandboxId;
+        let result;
+        try {
+            if (options.security) {
+                const timeoutMs = reviewStage?.timeout ? parseDuration(reviewStage.timeout) : undefined;
+                sandboxId = await options.security.sandbox.isolate(`issue-${issueId}`, defaultSandboxConstraints(workDir, timeoutMs));
+            }
+            // Issue JIT credentials before agent execution
+            const jitCred = options.security
+                ? await issueAgentCredentials(options.security, agentRole.metadata.name)
+                : undefined;
+            try {
+                result = await withSpan(SPAN_NAMES.AGENT_TASK, {
+                    [ATTRIBUTE_KEYS.AGENT]: agentRole.metadata.name,
+                    [ATTRIBUTE_KEYS.RESOURCE_NAME]: `pr#${prNumber}`,
+                }, async () => {
+                    const r = await runner.run({
+                        issueId,
+                        issueNumber: issueNumber ?? undefined,
+                        issueTitle,
+                        issueBody,
+                        workDir,
+                        branch: currentBranch,
+                        constraints: {
+                            maxFilesPerChange: resolved.maxFiles,
+                            requireTests: resolved.requireTests,
+                            blockedPaths: resolved.blockedPaths,
+                        },
+                        reviewFindings,
+                    });
+                    if (!r.success) {
+                        log.stageEnd('agent');
+                        auditLog.record({
+                            actor: 'system',
+                            action: 'execute',
+                            resource: `agent/${agentRole.metadata.name}`,
+                            decision: 'denied',
+                            details: { error: r.error },
+                        });
+                        meter.createCounter(METRIC_NAMES.TASK_FAILURE_TOTAL).add(1);
+                        recordMetric(metricStore, METRIC_NAMES.TASK_FAILURE_TOTAL, 1);
+                        // Evaluate demotion on agent failure
+                        const agentMetrics = {
+                            name: agentRole.metadata.name,
+                            currentLevel: currentLevel.level,
+                            totalTasksCompleted: 0,
+                            metrics: {},
+                            approvals: [],
+                        };
+                        const demotion = evaluateDemotion(autonomyPolicy, agentMetrics, 'failed-test');
+                        log.info(`Demotion evaluation: ${demotion.demoted ? `demoted from ${demotion.fromLevel} to ${demotion.toLevel}` : 'no demotion'}`);
+                        auditLog.record({
+                            actor: 'system',
+                            action: 'evaluate',
+                            resource: `agent/${agentRole.metadata.name}`,
+                            policy: 'demotion',
+                            decision: demotion.demoted ? 'denied' : 'allowed',
+                            details: {
+                                trigger: demotion.trigger,
+                                fromLevel: demotion.fromLevel,
+                                toLevel: demotion.toLevel,
+                            },
+                        });
+                        const agentFailTpl = notifTemplates?.['agent-failure'];
+                        const errorDetail = r.error ?? 'Unknown error';
+                        const agentFailComment = agentFailTpl
+                            ? renderTemplate(agentFailTpl, { stageName: 'fix-review', details: errorDetail })
+                            : { title: NOTIFICATION_TITLES.fixReviewAgentFailed, body: errorDetail };
+                        // Use pre-created marker (one per execution, prevents double-counting)
+                        await addComment(`## ${agentFailComment.title}\n\n${agentFailComment.body}\n\n${RETRY_MARKER}\n${cycleMarker}`);
+                        throw new Error(`Fix-review agent failed on PR #${prNumber}: ${r.error}`);
+                    }
+                    log.stageEnd('agent');
+                    auditLog.record({
+                        actor: 'system',
+                        action: 'execute',
+                        resource: `agent/${agentRole.metadata.name}`,
+                        decision: 'allowed',
+                        details: { filesChanged: r.filesChanged.length },
+                    });
+                    meter.createCounter(METRIC_NAMES.TASK_SUCCESS_TOTAL).add(1);
+                    recordMetric(metricStore, METRIC_NAMES.TASK_SUCCESS_TOTAL, 1);
+                    return r;
+                });
+            }
+            finally {
+                // Revoke JIT credentials after agent execution (success or failure)
+                if (jitCred && options.security) {
+                    await revokeAgentCredentials(options.security, jitCred.id);
+                }
+            }
+        }
+        finally {
+            // Destroy sandbox after agent execution
+            if (sandboxId && options.security) {
+                await options.security.sandbox.destroy(sandboxId);
+            }
+        }
+        // 8. ABAC authorization check (if write permissions are defined)
+        if (currentLevel.permissions.write.length > 0) {
+            authorizeFilesChanged(result.filesChanged, currentLevel.permissions, agentRole.spec.constraints, auditLog, agentRole.metadata.name);
+        }
+        // 9. Validate agent output against guardrails
+        await withSpan(SPAN_NAMES.PIPELINE_STAGE, {
+            [ATTRIBUTE_KEYS.STAGE]: 'validate-output',
+        }, async () => {
+            await validateAndAuditOutput({
+                filesChanged: result.filesChanged,
+                workDir,
+                constraints: {
+                    maxFilesPerChange: resolved.maxFiles,
+                    requireTests: resolved.requireTests,
+                    blockedPaths: resolved.blockedPaths,
+                },
+                guardrails: { maxLinesPerPR: currentLevel.guardrails.maxLinesPerPR },
+                auditLog,
+                log,
+                onViolation: async (violationList) => {
+                    await addComment(`## ${NOTIFICATION_TITLES.fixReviewGuardrailViolations}\n\n${violationList}\n\n${RETRY_MARKER}\n${cycleMarker}`);
+                },
+            });
+        });
+        // 10. Push to the same branch (review agents re-run automatically via pull_request.synchronize)
+        log.stage('push');
+        await execFileAsync('git', ['push', 'origin', currentBranch], { cwd: workDir });
+        log.stageEnd('push');
+        auditLog.record({
+            actor: 'system',
+            action: 'create',
+            resource: `push/${currentBranch}`,
+            decision: 'allowed',
+            details: { prNumber, attempt: attempts + 1 },
+        });
+        // 11. Comment on PR with success details
+        const successTpl = notifTemplates?.['fix-review-success'];
+        const successComment = successTpl
+            ? renderTemplate(successTpl, {
+                attempt: String(attempts + 1),
+                max: String(maxFixAttempts),
+                branch: currentBranch,
+            })
+            : {
+                title: NOTIFICATION_TITLES.fixReviewApplied,
+                body: `Attempt ${attempts + 1} of ${maxFixAttempts} — pushed review fixes to \`${currentBranch}\`.`,
+            };
+        await addComment([
+            `## ${successComment.title}`,
+            '',
+            successComment.body,
+            '',
+            '### Changes',
+            result.filesChanged.map((f) => `- \`${f}\``).join('\n'),
+            '',
+            RETRY_MARKER,
+            cycleMarker,
+        ].join('\n'));
+        // 12. Record episodic memory (success)
+        if (options.memory) {
+            options.memory.episodic.append({
+                key: 'fix-review-execution',
+                value: {
+                    prNumber,
+                    issueId,
+                    filesChanged: result.filesChanged.length,
+                    outcome: 'success',
+                },
+                metadata: { summary: `Fix-review for PR #${prNumber} (attempt ${attempts + 1})` },
+            });
+            options.memory.working.clear();
+        }
+    }
+    catch (err) {
+        // Record failure episode before rethrowing
+        if (options.memory) {
+            options.memory.episodic.append({
+                key: 'fix-review-execution',
+                value: {
+                    prNumber,
+                    issueId,
+                    outcome: 'failure',
+                    error: err instanceof Error ? err.message : String(err),
+                },
+                metadata: { summary: `Failed fix-review for PR #${prNumber}` },
+            });
+            options.memory.working.clear();
+        }
+        throw err;
+    }
+    log.summary();
+}
+//# sourceMappingURL=fix-review.js.map

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { validateAgentOutput, type ValidationContext, type ValidationResult, typ
 export { createLogger, type Logger } from './logger.js';
 export { validateConfigFiles, type FileValidationResult } from './validate-config.js';
 export { executeFixCI, countRetryAttempts, fetchCILogs, type FixCIOptions } from './fix-ci.js';
+export { executeFixReview, countRetryAttempts as countReviewRetryAttempts, fetchReviewFindings, type FixReviewOptions, } from './fix-review.js';
 export { executeTriage, type TriageOptions, type TriageResult } from './triage.js';
 export { getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, mergeBlockedPaths, isAutonomousStrategy, recordMetric, validateAndAuditOutput, createPipelineMemory, evaluatePipelineCompliance, authorizeFilesChanged, extractIssueNumber, extractIssueId, issueIdToNumber, formatIssueRef, BRANCH_PATTERN, createAbacPermissionHook, createBlockedPathsHook, createAuditLoggingHook, createPipelineAuthorizationChain, type GitHubEnvConfig, type ValidateAndAuditParams, } from './shared.js';
 export { DEFAULT_MODEL, DEFAULT_GITHUB_ORG, DEFAULT_GITHUB_REPO, DEFAULT_GITHUB_REPOSITORY, DEFAULT_CONFIG_DIR_NAME, DEFAULT_SANDBOX_MEMORY_MB, DEFAULT_SANDBOX_CPU_PERCENT, DEFAULT_SANDBOX_NETWORK_POLICY, DEFAULT_SANDBOX_TIMEOUT_MS, defaultSandboxConstraints, DEFAULT_RUNNER_TIMEOUT_MS, DEFAULT_ALLOWED_TOOLS, DEFAULT_MAX_FILES_PER_CHANGE, DEFAULT_REQUIRE_TESTS, DEFAULT_BLOCKED_PATHS, DEFAULT_MAX_FIX_ATTEMPTS, DEFAULT_MAX_LOG_LINES, DEFAULT_GH_CLI_TIMEOUT_MS, DEFAULT_JIT_TTL_MS, DEFAULT_JIT_SCOPE, DEFAULT_BRANCH_TEMPLATE, DEFAULT_BRANCH_PATTERN, DEFAULT_PR_TITLE_TEMPLATE, DEFAULT_PR_FOOTER, DEFAULT_COMPLEXITY_THRESHOLDS, DEFAULT_MAX_LINES_PER_PR, DEFAULT_ANALYSIS_INCLUDE, DEFAULT_ANALYSIS_EXCLUDE, DEFAULT_GIT_HISTORY_DAYS, DEFAULT_HOTSPOT_THRESHOLD, NOTIFICATION_TITLES, DEFAULT_MODEL_COSTS, DEFAULT_COST_BUDGET_USD, DEFAULT_DASHBOARD_REFRESH_MS, PROGRESSIVE_GATE_PROFILES, DEFAULT_LINT_COMMAND, DEFAULT_FORMAT_COMMAND, DEFAULT_COMMIT_MESSAGE_TEMPLATE, DEFAULT_COMMIT_CO_AUTHOR, DEFAULT_OPENAI_API_URL, DEFAULT_OPENAI_MODEL, DEFAULT_ANTHROPIC_API_URL, DEFAULT_ANTHROPIC_MODEL, DEFAULT_GENERIC_LLM_MODEL, DEFAULT_LLM_TIMEOUT_MS, DEFAULT_LLM_MAX_TOKENS, DEFAULT_LLM_SYSTEM_PROMPT, DEFAULT_DOCKER_IMAGE, DEFAULT_WORKFLOW_FILE, DEFAULT_LABEL_TO_SKILL_MAP, DEFAULT_ANALYSIS_CACHE_TTL_MS, } from './defaults.js';
@@ -18,6 +19,9 @@ export { createPipelineDiscovery, findMatchingAgent, resolveAgentForIssue, match
 export { createStructuredConsoleLogger, createStructuredBufferLogger, } from './structured-logger.js';
 export { startWatch, type WatchOptions, type WatchHandle } from './watch.js';
 export { computePriority, rankWorkItems, type PriorityScore, type PriorityInput, type PriorityConfig, } from './priority.js';
+export { checkAction, enforceAction, DEFAULT_BLOCKED_ACTIONS, type ActionEnforcementResult, } from './action-enforcement.js';
+export { scoreIssueForAdmission, mapIssueToPriorityInput, type AdmissionInput, type AdmissionThresholds, type IssueAdmissionResult, type AuthorAssociation, } from './admission-score.js';
+export { executeReview, type ReviewContext, type ReviewOptions } from './review.js';
 export { createPipelineOrchestration, executePipelineOrchestration, validatePipelineHandoffs, sequential, parallel, hybrid, hierarchical, swarm, validateHandoff, simpleSchemaValidate, } from './orchestration.js';
 export { createPipelineRegoEvaluator, createPipelineCELEvaluator, createPipelineABACHook, createPipelineExpressionEvaluator, createPipelineLLMEvaluator, evaluatePipelineGate, scorePipelineComplexity, evaluatePipelineComplexityRouting, } from './policy-evaluators.js';
 export { createPipelineAdapterRegistry, createPipelineWebhookBridge, resolveAdapterFromGit, resolveInfrastructure, resolveIssueTrackerFromConfig, scanPipelineAdapters, } from './adapters.js';
@@ -25,12 +29,14 @@ export { createPipelineReconciler, createGateReconciler, createAutonomyReconcile
 export { createFileAuditLog, verifyAuditIntegrity, loadAuditEntries, rotateAuditLog, computeAuditHash, } from './audit-extended.js';
 export { checkFrameworkCompliance, getControlCatalog, getFrameworkMappings, listSupportedFrameworks, } from './compliance-extended.js';
 export { createSilentLogger, withPipelineSpanSync, getPipelineTracer, validateResourceSchema, } from './telemetry-extended.js';
-export { ClaudeCodeRunner, ClaudeCodeRunner as GitHubActionsRunner, GenericLLMRunner, CopilotRunner, CursorRunner, CodexRunner, RunnerRegistry, createRunnerRegistry, SecurityTriageRunner, type AgentRunner, type AgentContext, type AgentResult, type GenericLLMConfig, type RegisteredRunner, type SecurityTriageConfig, type TriageVerdict, } from './runners/index.js';
+export { ClaudeCodeRunner, ClaudeCodeRunner as GitHubActionsRunner, GenericLLMRunner, CopilotRunner, CursorRunner, CodexRunner, RunnerRegistry, createRunnerRegistry, SecurityTriageRunner, ReviewAgentRunner, REVIEW_PROMPTS, type AgentRunner, type AgentContext, type AgentResult, type AgentProgressEvent, type GenericLLMConfig, type RegisteredRunner, type SecurityTriageConfig, type TriageVerdict, type ReviewAgentConfig, type ReviewType, type ReviewFinding, type ReviewVerdict, } from './runners/index.js';
 export type { TokenUsage } from './runners/index.js';
 export { SlackMessenger, TeamsMessenger, NotificationRouter } from './notifications/index.js';
 export type { SlackConfig, TeamsConfig, PipelineEvent, PipelineEventType, NotificationRoute, NotificationTemplate, } from './notifications/index.js';
 export { StateStore } from './state/index.js';
-export type { HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, AutonomyEventType, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, PriorityCalibrationSample, } from './state/index.js';
+export type { HotspotRecord, RoutingDecision, CostLedgerEntry, GateThresholdOverride, AutonomyEvent, AutonomyEventType, HandoffEvent, DeploymentRecord, DeploymentRecordState, RolloutStepRecord, AuditEntryRecord, PriorityCalibrationSample, ToolSequenceEvent, WorkflowPattern, PatternProposal, } from './state/index.js';
+export { readToolSequenceJSONL, readSessionMetaFiles, sessionMetaToEvents, categorizeAction, DEFAULT_DETECTION_OPTIONS, } from './workflow-patterns/index.js';
+export type { CanonicalStep, NGram, DetectedPattern, DetectionOptions, RawToolSequenceEntry, SessionMeta, } from './workflow-patterns/index.js';
 export { createKubernetesTarget, createVercelTarget, createFlyioTarget, createHttpMetricsCollector, createStubMetricsCollector, RolloutController, } from './deploy/index.js';
 export type { DeploymentTargetConfig, HealthCheckConfig, DeploymentState, DeploymentResult, DeploymentTarget, ExecFn, FetchFn, KubernetesConfig, VercelConfig, FlyioConfig, CanaryStep, CanaryConfig, BlueGreenConfig, RollingConfig, RolloutStrategy, RolloutPhase, RolloutStatus, RolloutMetrics, MetricsSource, RolloutControllerConfig, HttpMetricsConfig, } from './deploy/index.js';
 export { getComplexityBand, getGateProfile, adjustEnforcement, adjustGateForComplexity, adjustGatesForComplexity, computeGateAdjustments, } from './progressive-gates.js';
@@ -69,5 +75,7 @@ export type { ArchiveManifest, ArchivalOptions } from './audit-archival.js';
 export { Orchestrator, type OrchestratorConfig, type WebhookConfig } from './orchestrator.js';
 export type { OrchestratorPlugin, PluginContext, BeforeRunEvent, AfterRunEvent, RunErrorEvent, } from './plugin.js';
 export { CostGovernancePlugin } from './cost-governance.js';
+export { PipelineCycleDetector, createStageMarker, parseStageInvocations, DEFAULT_CYCLE_LIMITS, type PipelineStage, type CycleConfig, type CycleDetectionResult, } from './pipeline-cycle-detector.js';
+export { checkAndHandleCycle, createCycleDetectorFromConfig, type CycleHandlerOptions, type CycleCheckResult, } from './cycle-utils.js';
 export type { ApiVersion, Metadata, Condition, SecretRef, MetricCondition, Duration, Resource, TriggerFilter, Trigger, Provider, RoutingStrategy, ComplexityThreshold, Routing, Stage, PipelineSpec, PipelinePhase, PipelineStatus, Pipeline, AgentConstraints, HandoffContractRef, Handoff, SkillExample, Skill, AgentCard, AgentRoleSpec, AgentRoleStatus, AgentRole, GateScope, MetricRule, ToolRule, ReviewerRule, DocumentationRule, ProvenanceRule, ExpressionRule, GateRule, EnforcementLevel, Override, RetryPolicy, Evaluation, Gate, QualityGateSpec, QualityGateStatus, QualityGate, Permissions, ApprovalRequirement, Guardrails, MonitoringLevel, AutonomyLevel, PromotionCriteria, DemotionTrigger, AgentAutonomyStatus, AutonomyPolicySpec, AutonomyPolicyStatus, AutonomyPolicy, AdapterInterface, HealthCheck, AdapterBindingSpec, AdapterBindingStatus, AdapterBinding, AnyResource, ResourceKind, ValidationError, GateVerdict, DemotionResult, ComplexityFactor, AuthorizationContext, AuthorizationResult, AuthIdentity, AuthenticationResult, Authenticator, MutatingGateContext, ExpressionEvaluator, ExpressionVerdict, LLMEvaluationDimension, LLMEvaluationResult, LLMGateVerdict, AgentExecutionState, HandoffValidationError, SchemaResolver, SchemaValidationError, MemoryTier, MemoryEntry, WorkingMemory, ShortTermMemory, LongTermMemory, SharedMemory, EpisodicMemory, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -6,6 +6,7 @@ export { validateAgentOutput, } from './validate-agent-output.js';
 export { createLogger } from './logger.js';
 export { validateConfigFiles } from './validate-config.js';
 export { executeFixCI, countRetryAttempts, fetchCILogs } from './fix-ci.js';
+export { executeFixReview, countRetryAttempts as countReviewRetryAttempts, fetchReviewFindings, } from './fix-review.js';
 export { executeTriage } from './triage.js';
 // Shared utilities
 export { getGitHubConfig, resolveRepoRoot, createDefaultAuditLog, resolveAutonomyLevel, resolveConstraints, mergeBlockedPaths, isAutonomousStrategy, recordMetric, validateAndAuditOutput, createPipelineMemory, evaluatePipelineCompliance, authorizeFilesChanged, extractIssueNumber, extractIssueId, issueIdToNumber, formatIssueRef, BRANCH_PATTERN, createAbacPermissionHook, createBlockedPathsHook, createAuditLoggingHook, createPipelineAuthorizationChain, } from './shared.js';
@@ -29,6 +30,12 @@ export { createStructuredConsoleLogger, createStructuredBufferLogger, } from './
 export { startWatch } from './watch.js';
 // Priority scoring (PPA)
 export { computePriority, rankWorkItems, } from './priority.js';
+// Action enforcement
+export { checkAction, enforceAction, DEFAULT_BLOCKED_ACTIONS, } from './action-enforcement.js';
+// Issue admission scoring
+export { scoreIssueForAdmission, mapIssueToPriorityInput, } from './admission-score.js';
+// PR review orchestration
+export { executeReview } from './review.js';
 // Agent orchestration
 export { createPipelineOrchestration, executePipelineOrchestration, validatePipelineHandoffs, sequential, parallel, hybrid, hierarchical, swarm, validateHandoff, simpleSchemaValidate, } from './orchestration.js';
 // Policy evaluators
@@ -44,11 +51,13 @@ export { checkFrameworkCompliance, getControlCatalog, getFrameworkMappings, list
 // Extended telemetry
 export { createSilentLogger, withPipelineSpanSync, getPipelineTracer, validateResourceSchema, } from './telemetry-extended.js';
 // Runners
-export { ClaudeCodeRunner, ClaudeCodeRunner as GitHubActionsRunner, GenericLLMRunner, CopilotRunner, CursorRunner, CodexRunner, RunnerRegistry, createRunnerRegistry, SecurityTriageRunner, } from './runners/index.js';
+export { ClaudeCodeRunner, ClaudeCodeRunner as GitHubActionsRunner, GenericLLMRunner, CopilotRunner, CursorRunner, CodexRunner, RunnerRegistry, createRunnerRegistry, SecurityTriageRunner, ReviewAgentRunner, REVIEW_PROMPTS, } from './runners/index.js';
 // Notifications
 export { SlackMessenger, TeamsMessenger, NotificationRouter } from './notifications/index.js';
 // State store
 export { StateStore } from './state/index.js';
+// Workflow pattern detection
+export { readToolSequenceJSONL, readSessionMetaFiles, sessionMetaToEvents, categorizeAction, DEFAULT_DETECTION_OPTIONS, } from './workflow-patterns/index.js';
 // Deployment targets
 export { createKubernetesTarget, createVercelTarget, createFlyioTarget, createHttpMetricsCollector, createStubMetricsCollector, RolloutController, } from './deploy/index.js';
 // Progressive gates
@@ -88,4 +97,7 @@ export { archiveEntries, loadArchivedEntries, verifyArchiveContinuity } from './
 export { Orchestrator } from './orchestrator.js';
 // Cost governance plugin
 export { CostGovernancePlugin } from './cost-governance.js';
+// Pipeline cycle detection
+export { PipelineCycleDetector, createStageMarker, parseStageInvocations, DEFAULT_CYCLE_LIMITS, } from './pipeline-cycle-detector.js';
+export { checkAndHandleCycle, createCycleDetectorFromConfig, } from './cycle-utils.js';
 //# sourceMappingURL=index.js.map

package/dist/pipeline-cycle-detector.d.ts

@@ -0,0 +1,70 @@
+/**
+ * PipelineCycleDetector — tracks stage invocations per issue/PR across
+ * all workflow runs to detect infinite orchestration loops.
+ *
+ * Uses GitHub issue/PR comments as shared state (hidden HTML markers)
+ * to work across workflow boundaries.
+ */
+import type { IssueTracker } from '@ai-sdlc/reference';
+export type PipelineStage = 'admission' | 'triage' | 'agent' | 'review' | 'fix-ci' | 'fix-review';
+export interface CycleConfig {
+    /** Max invocations per stage (default: 3 for agent stages, 2 for fix stages). */
+    maxInvocations: Record<PipelineStage, number>;
+}
+export interface CycleDetectionResult {
+    cycleDetected: boolean;
+    loopingStages: Array<{
+        stage: PipelineStage;
+        count: number;
+        max: number;
+    }>;
+    totalInvocations: number;
+}
+/**
+ * Default max invocations per stage.
+ * These must be HIGHER than the per-stage retry limits (which are the
+ * primary guard). The cycle detector is a safety net for cross-stage
+ * loops, not a replacement for retry counting.
+ *
+ * Per-stage retry limits: fix-ci=2, fix-review=2
+ * Cycle limits: set to retry_limit + 2 to allow retries + headroom
+ */
+export declare const DEFAULT_CYCLE_LIMITS: Record<PipelineStage, number>;
+/**
+ * Generate HTML comment marker for a stage invocation.
+ * Format: <!-- ai-sdlc-cycle:{stage}:{timestamp} -->
+ */
+export declare function createStageMarker(stage: PipelineStage): string;
+/**
+ * Parse stage invocation markers from comment bodies.
+ * Returns a map of stage -> invocation count.
+ */
+export declare function parseStageInvocations(comments: string[]): Map<PipelineStage, number>;
+export declare class PipelineCycleDetector {
+    private config;
+    constructor(config?: Partial<CycleConfig>);
+    /**
+     * Check if a cycle exists for the given issue/PR by analyzing comment history.
+     * @param pendingStage — if set, adds +1 to this stage's count to account for the upcoming invocation
+     */
+    detectCycle(tracker: IssueTracker, issueOrPrId: string, pendingStage?: PipelineStage): Promise<CycleDetectionResult>;
+    /**
+     * Detect cycle from comment bodies (for testing without IssueTracker).
+     * @param pendingStage — if set, adds +1 to this stage's count for the pending invocation
+     */
+    detectCycleFromComments(comments: string[], pendingStage?: PipelineStage): CycleDetectionResult;
+    /**
+     * Record a stage invocation by creating a marker.
+     * The caller should append this to their comment.
+     */
+    recordInvocation(stage: PipelineStage): string;
+    /**
+     * Get the max invocation limit for a stage.
+     */
+    getMaxInvocations(stage: PipelineStage): number;
+    /**
+     * Update max invocations for specific stages.
+     */
+    updateMaxInvocations(overrides: Partial<Record<PipelineStage, number>>): void;
+}
+//# sourceMappingURL=pipeline-cycle-detector.d.ts.map