@amistio/cli 0.1.27 → 0.1.29

package/README.md

@@ -38,7 +38,7 @@ amistio run --watch --background --tool opencode
 amistio runner status
 ```
 
-Provider-backed model preferences use sanitized catalog fields: `--provider`, `--model-id`, optional `--model-variant`, and `--reasoning-effort` (`auto`, `low`, `medium`, `high`, or `xhigh`). Provider credentials, API keys, and local secret paths stay in the local tool configuration; they are not stored in Amistio preferences or runner heartbeats.
+Provider-backed model preferences use sanitized catalog fields: `--provider`, `--model-id`, optional `--model-variant`, and `--reasoning-effort` (`auto`, `low`, `medium`, `high`, or `xhigh`). Opencode catalog metadata is synthesized by Amistio or derived from readable local OpenCode JSON config until opencode exposes a native catalog. Provider credentials, API keys, and local secret paths stay in the local tool configuration; they are not stored in Amistio preferences or runner heartbeats.
 
 When `--tool copilot` uses the GitHub Copilot SDK, Amistio approves read-only permission requests by default and denies mutating, network, MCP, hook, memory, and shell requests. Set `AMISTIO_COPILOT_APPROVE_ALL=1` only on a local machine where broad Copilot SDK approval is intentional.
 
@@ -46,7 +46,7 @@ When `--tool codex` uses the Codex SDK, intermediate progress can be quiet until
 
 `amistio runner status` reports local background runner state, latest heartbeat, and bounded resource usage when available. Resource usage is latest-sample runner process memory/CPU plus safe aggregate system memory/load signals; it does not include source files, environment variables, command lines, process lists, credentials, or arbitrary local paths.
 
-The runner advertises its supported work kinds in heartbeats. Current runners can claim read-only `projectContextRefresh` jobs from the workspace Context panel and create due runner-driven refreshes when no fresh approved map exists. Context refreshes inspect the paired checkout locally without modifying files and submit only bounded summaries, slices, entities, relations, safe citations, confidence, freshness, and repo-relative paths. If a submitted context refresh contains unsafe evidence, unsafe paths, or a map too large to store safely, Amistio marks the refresh failed with a safe reason instead of storing the rejected raw result. Approved maps are reused as context packs for source-aware assistant and impact-preview work. Current runners can also claim read-only issue diagnosis jobs from the web Issues panel, generate root-cause analysis and a proposed fix, and submit that result without modifying source. They can claim manual read-only `appEvaluationScan` jobs from the workspace Evaluate panel and create at most one due hourly evaluation during normal watch/background polling when app evaluation is enabled for the repository link. Evaluation results contain bounded summaries, safe evidence, suggested actions, lifecycle proposals, and repo-relative paths only. Current runners can also claim manual read-only `securityPostureScan` jobs from the workspace Security panel and create due daily posture checks during normal watch/background polling. Security scan results contain bounded summaries, standard references, safe evidence, and repo-relative paths only. Current runners can claim manual read-only `testQualityScan` jobs from the workspace Test panel and create one due daily Test scan per repository when Test quality is enabled. Test scans run only existing lint, typecheck, test, coverage, build, or verify commands and submit bounded command summaries, coverage summaries, safe findings, blocked reasons, warnings, and repo-relative paths. Missing tests, missing coverage, low coverage, failing checks, flaky tests, and test gaps create reviewable plan-backed findings in the app. Current runners also claim `implementationTestGate` jobs before implementation completion, PR handoff, or runner-managed push; a passing gate is required unless the web Test panel records an audited override. Current runners can claim read-only `implementationVerification` jobs from Tasks to prove whether completed implementation work actually landed; verification submits bounded acceptance-criteria evidence, checks, gaps, outcome, and recommendation without mutating source. Source, secrets, environment variables, command lines, process lists, credentials, provider sessions, and arbitrary local paths stay local. Implementation or cleanup is queued separately only after the user approves an issue analysis, app evaluation finding, security remediation plan, or Test quality plan in the app.
+The runner advertises its supported work kinds in heartbeats. Current runners can claim read-only `projectContextRefresh` jobs from the workspace Context panel and create due runner-driven refreshes when no fresh approved map exists. Context refreshes inspect the paired checkout locally without modifying files and submit only bounded summaries, slices, entities, relations, safe citations, confidence, freshness, and repo-relative paths. If a submitted context refresh contains unsafe evidence, unsafe paths, or a map too large to store safely, Amistio marks the refresh failed with a safe reason instead of storing the rejected raw result. Approved maps are reused as context packs for source-aware assistant and impact-preview work. Current runners can also claim read-only issue diagnosis jobs from the web Issues panel, generate root-cause analysis and a proposed fix, and submit that result without modifying source. They can claim manual read-only `appEvaluationScan` jobs from the workspace Evaluate panel and create at most one due hourly evaluation during normal watch/background polling when app evaluation is enabled for the repository link. Evaluation results contain bounded summaries, safe evidence, suggested actions, lifecycle proposals, and repo-relative paths only. Current runners can also claim manual read-only `securityPostureScan` jobs from the workspace Security panel and create due daily posture checks during normal watch/background polling. Security scan results contain bounded summaries, standard references, safe evidence, and repo-relative paths only. Current runners can claim manual read-only `testQualityScan` jobs from the workspace Test panel and create one due daily Test scan per repository when Test quality is enabled. Test scans run only existing lint, typecheck, test, coverage, build, or verify commands and submit bounded command summaries, coverage summaries, safe findings, blocked reasons, warnings, and repo-relative paths. Missing tests, missing coverage, low coverage, failing checks, flaky tests, and test gaps create reviewable plan-backed findings in the app. Current runners also claim `implementationTestGate` jobs before implementation completion, PR handoff, or runner-managed push; a passing gate is required unless the web Test panel records an audited override. Blocked implementation Test gates submit structured Test findings, such as `blockedEnvironment`, with safe evidence, a suggested action, and a verification plan. Current runners can claim read-only `implementationVerification` jobs from Tasks to prove whether completed implementation work actually landed; verification submits bounded acceptance-criteria evidence, checks, gaps, outcome, and recommendation without mutating source. Source, secrets, environment variables, command lines, process lists, credentials, provider sessions, and arbitrary local paths stay local. Implementation or cleanup is queued separately only after the user approves an issue analysis, app evaluation finding, security remediation plan, or Test quality plan in the app.
 
 Approved implementation work uses Git as the handoff boundary. During worktree preflight, the runner locally copies eligible ignored root dotenv files such as `.env.local` or `.env.test.local` from the paired checkout into the implementation worktree when the target is missing and ignored, so local tests can use the same machine configuration. Dotenv values, variable names, file contents, and local paths are not uploaded to Amistio, and copied dotenv files stay ignored so PR handoff does not commit them. After the local tool completes successfully, the runner materializes approved Markdown, MDX, and HTML project-brain artifacts for the same work scope into the isolated worktree before final Git status. It then commits all source and artifact changes, fetches and rebases from the linked remote's default branch, pushes an `amistio/work/...` branch, opens or reuses a pull request with the locally authenticated `gh` CLI, reports only safe PR and artifact-inclusion metadata to Amistio, and removes the local worktree after the PR URL is durable. Artifact-only materialization changes still create or reuse a PR; no-change completion requires no source changes and no approved artifact changes. Prepare the runner machine with Git commit identity, fetch/push permission to the linked remote, and `gh auth status`. If artifact materialization, commit, fetch/rebase, push, or PR creation fails, the work item is blocked and the branch/worktree stay on disk for manual recovery; source files and patches are not uploaded to Amistio.
 
@@ -60,6 +60,8 @@ Watch mode prints a completed-work success once per work item, keeps fresh compl
 
 Known validation failures such as `unsafe_context_path` are printed with attention-needed next steps. For project-context refresh path-safety failures, deploy the latest web/API fix, update and restart the runner when applicable, retry the refresh, and capture only bounded non-secret output if it repeats.
 
+App-evaluation result finalization rejections print safe validation paths and preserve the local finalization evidence without exposing raw source or secrets. If a structured app-evaluation result is rejected, update and restart the runner, confirm the web/API deployment is current, and retry the evaluation before acting on cleanup or implementation recommendations.
+
 When brain generation or plan revision output is parsed but the Amistio API is temporarily unavailable during finalization, the runner keeps a safe pending result envelope in user-level Amistio config and replays it before claiming more work. The envelope uses a stable idempotency key and does not store raw tool stdout, provider sessions, credentials, or arbitrary local paths.
 
 For headless startup after login on supported user-level service managers:

package/dist/index.js

@@ -2222,9 +2222,11 @@ function computeProjectNextAction(input) {
   if (failedPlanRevision) {
     return failedWorkAction(failedPlanRevision, "planRevisionFailed", "Plan revision failed", failedPlanRevision.lastStatusMessage ?? "Review the conversation and request another revision if needed.");
   }
-  const blockedWork = latestWorkItem(input.workItems.filter((item) => item.status === "blocked" || item.status === "changesRequested"));
+  const blockedWorkItems = input.workItems.filter((item) => item.status === "blocked" || item.status === "changesRequested");
+  const blockedWork = latestWorkItem(blockedWorkItems);
   if (blockedWork) {
-    return workAction(blockedWork, "workBlocked", "user", "danger", "Work is blocked", blockedWork.lastStatusMessage ?? "Review the blocked work item before the runner can continue.");
+    const message = workStatusReason(blockedWork, "Review the blocked work item before the runner can continue.");
+    return workAction(blockedWork, "workBlocked", "user", "danger", "Work is blocked", blockedWorkItems.length > 1 ? `Latest blocked work ${blockedWork.workItemId}: ${message}` : message);
   }
   const failedWork = latestWorkItem(input.workItems.filter((item) => item.status === "failed"));
   if (failedWork) {
@@ -2337,6 +2339,9 @@ function failedWorkAction(workItem, kind, fallbackTitle, fallbackMessage) {
   }
   return workAction(workItem, kind, "user", "danger", fallbackTitle, fallbackMessage);
 }
+function workStatusReason(workItem, fallbackMessage) {
+  return workItem.blockerReason ?? workItem.sourceFailureSummary ?? workItem.lastStatusMessage ?? fallbackMessage;
+}
 function workAction(workItem, kind, actor, tone, title, message, detail) {
   return {
     kind,
@@ -3605,7 +3610,7 @@ async function detectLocalTools() {
     localToolAdapters.map(async (adapter) => {
       const sdkAvailable = await isSdkAvailable(adapter);
       const commandAvailable = adapter.executable ? await commandExists(adapter.executable) : false;
-      const providerCatalog = await detectProviderCatalog(adapter);
+      const providerCatalog = await detectRunnerProviderCatalog(adapter);
       return {
         name: adapter.name,
         description: adapter.description,
@@ -3847,16 +3852,18 @@ async function commandExists(command) {
     lookup.on("close", (exitCode) => resolve(exitCode === 0));
   });
 }
-async function detectProviderCatalog(adapter) {
-  const opencodeCatalog = adapter.name === "opencode" ? await loadOpencodeProviderCatalog() : void 0;
-  return mergeProviderCatalogs(adapter.providerCatalog, opencodeCatalog);
+async function detectRunnerProviderCatalog(adapter) {
+  const localOpencodeConfigCatalog = adapter.name === "opencode" ? await loadLocalOpencodeProviderConfigCatalog() : void 0;
+  return mergeProviderCatalogs(adapter.providerCatalog, localOpencodeConfigCatalog);
 }
-async function loadOpencodeProviderCatalog() {
-  const configPaths = [
+function localOpencodeProviderConfigPaths() {
+  return [
     path6.join(os3.homedir(), ".config", "opencode", "opencode.json"),
     path6.join(os3.homedir(), ".config", "opencode", "config.json"),
     path6.join(process.cwd(), "opencode.json")
   ];
+}
+async function loadLocalOpencodeProviderConfigCatalog(configPaths = localOpencodeProviderConfigPaths()) {
   for (const configPath of configPaths) {
     try {
       const parsed = JSON.parse(await readFile4(configPath, "utf8"));
@@ -5658,11 +5665,20 @@ function createImplementationTestGatePrompt(workItem) {
     "## Output Contract",
     "",
     "Print exactly one JSON object between the markers below. The CLI will submit only this structured gate result back to Amistio.",
-    "Accepted outcome values: passed, failed, blocked, overridden.",
+    "Accepted outcome values: passed, failed, blocked, missingTests, belowThreshold, overridden.",
+    "Accepted command kind values: verify, test, coverage, lint, typecheck, build, focused.",
+    "Accepted command status values: passed, failed, skipped, missing, blocked.",
+    "Prefer repository-documented verification commands or approved test profile commands over ad hoc package-script inference.",
+    "For this Amistio monorepo, if plain Corepack pnpm fails before scripts with spawnSync pnpm ENOENT, retry the documented command corepack pnpm --config.verify-deps-before-run=false verify before declaring whole-app verification blocked.",
+    "Accepted finding categories: missingTests, missingCoverage, missingCommand, lowCoverage, failingTests, failingQuality, failingQualityCheck, staleScan, blockedEnvironment, weakTests, flakyTests, unverifiedImplementation, testGap, other.",
+    "Accepted finding severity values: info, low, medium, high, critical.",
+    "Accepted finding confidence values: low, medium, high.",
+    "Every finding must include title, category, severity, summary, suggestedAction, and a non-empty verificationPlan.",
+    "Finding optional fields may include confidence, affectedSurfaces, evidence, safePaths, proposedPlanTitle, proposedPlanRepoPath, proposedPlanContent, and dedupeKey.",
     "Omit optional fields when unavailable; do not emit null for optional command summary fields such as exitCode, durationMs, outputExcerpt, commandId, or safePaths.",
     "",
     implementationTestGateStart,
-    '{"outcome":"passed","summary":"Focused checks and whole-app verification passed.","commandSummaries":[{"commandId":"verify","kind":"verify","label":"Whole-app verification","status":"passed","exitCode":0,"summary":"The repository verification script completed successfully.","safePaths":["package.json"]}],"coverage":{"status":"unknown","thresholds":{},"summary":"No coverage threshold was configured for this gate."},"findings":[],"blockedReasons":[],"redactionState":{"status":"clean","redactedFields":[]},"verificationPlan":["Record this gate result before marking implementation complete"],"warnings":[]}',
+    '{"outcome":"blocked","summary":"Whole-app verification could not run because the local package-manager wrapper failed before repository checks started.","commandSummaries":[{"commandId":"verify","kind":"verify","label":"Whole-app verification","status":"blocked","summary":"Corepack could not spawn pnpm before repository verification started.","safePaths":["package.json"]}],"coverage":{"status":"unknown","thresholds":{},"summary":"Coverage was not produced because verification did not run."},"findings":[{"title":"Local verification toolchain is blocked","category":"blockedEnvironment","severity":"medium","confidence":"high","summary":"The implementation test gate could not start the repository verification command because the local package-manager toolchain failed before checks ran.","affectedSurfaces":["Local runner verification"],"evidence":["The verification command failed before repository checks started."],"safePaths":["package.json"],"suggestedAction":"Restore the local package-manager toolchain or run the repository-documented verification command, then rerun the implementation test gate.","verificationPlan":["Run the documented whole-app verification command","Rerun the implementation test gate"],"dedupeKey":"blocked-environment-package-manager"}],"blockedReasons":["The local package-manager toolchain could not start verification."],"redactionState":{"status":"clean","redactedFields":[]},"verificationPlan":["Restore local verification tooling","Rerun the implementation test gate before marking implementation complete"],"warnings":[]}',
     implementationTestGateEnd,
     "",
     "Do not put Markdown fences around the markers."
@@ -5927,6 +5943,8 @@ function createAppEvaluationScanPrompt(workItem, context) {
     "- When lifecycle metadata disagrees across indexes, frontmatter, feature specs, ADRs, and implementation evidence, cite the conflict and propose a metadata correction or verification step instead of archival/removal.",
     "- Check missing memory or workflow updates when repeated lessons or operational rules are visible.",
     "- Check release readiness, UX, accessibility, performance, reliability, and security-posture follow-through at a summary level.",
+    "- Prefer repository-documented verification commands over ad hoc package-script inference.",
+    "- For this Amistio monorepo, if plain Corepack pnpm fails before scripts with spawnSync pnpm ENOENT, retry the documented command corepack pnpm --config.verify-deps-before-run=false verify before declaring whole-app verification blocked.",
     "",
     "## Data Safety",
     "",
@@ -9143,7 +9161,7 @@ function startWorkLeaseRenewal({ apiClient, projectId, repositoryLinkId, runnerI
 }
 async function recordFinalizationFailure({ apiClient, durationMs, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName, workItem }) {
   const detail = truncateLogExcerpt(errorDetail(error));
-  const message = `${toolName} completed, but Amistio could not finalize the result.`;
+  const message = `${toolName} completed, but Amistio could not finalize the result. ${safeFinalizationFailureSummary(error)}`;
   const settlements = await Promise.allSettled([
     apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig)),
     markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage3(error)),
@@ -9183,6 +9201,12 @@ async function recordFinalizationFailure({ apiClient, durationMs, error, isolati
   console.error(detail);
   return { status: "failed", exitCode: 1, message };
 }
+function safeFinalizationFailureSummary(error) {
+  if (error instanceof AmistioApiError) {
+    return truncateLogExcerpt(error.message);
+  }
+  return "Review the runner log for the finalization error.";
+}
 function workItemIsolationTelemetry(workItem, isolation) {
   const implementationScopeId = isolation?.implementationScopeId ?? workItem.implementationScopeId;
   const executionBranch = isolation?.branch ?? workItem.executionBranch;