@cleocode/core 2026.10.18 → 2026.10.19

package/dist/tasks/evidence.js

@@ -34,9 +34,9 @@ import { getEffectiveHead } from '../worktree/effective-head.js';
 import { loadRecordedProjectRoots, rebaseLegacyEvidencePath } from './evidence-paths.js';
 import { HEAVY_HEAP_ENV, HEAVY_WORKERS_ENV, isHeavyTool } from './heavy-tool-env.js';
 import { DISABLE_ENV, describeMemoryLimit } from './heavy-tool-limit.js';
-import { qaRunUnionGapReason } from './qa-run-binding.js';
+import { qaRunUnionGapReason, typecheckCoverageGap } from './qa-run-binding.js';
 import { computeCommitRevalidationKey, readCommitRevalidationEntry, writeCommitRevalidationEntry, } from './revalidation-cache.js';
-import { bindTestRunReport, coveredTestFiles, TEST_RUN_MAX_RECORDED_FILES, } from './test-run-binding.js';
+import { bindTestRunReport, configSchemaCompositionGap, coveredTestFiles, TEST_RUN_MAX_RECORDED_FILES, } from './test-run-binding.js';
 import { captureHead, captureTree, resolveSpawnTimeoutMs, runToolCached, } from './tool-cache.js';
 import { CANONICAL_TOOLS, canonicalToolName, listValidToolNames, resolveToolCommand, } from './tool-resolver.js';
 import { detectStaticVacuity, probeTscFileCount, VACUOUS_TOOL_FIX } from './tool-vacuity.js';
@@ -213,7 +213,7 @@ siblingCommitSha, context) {
         case 'qa-run':
             return validateQaRun(parsed.path, roots, taskId ?? context?.task.id);
         case 'tool':
-            return validateTool(parsed.tool, roots, context);
+            return validateTool(parsed.tool, roots, context, siblingCommitSha);
         case 'url':
             return validateUrl(parsed.url);
         case 'note':
@@ -1371,6 +1371,7 @@ async function runAffectedTests(tool, run, roots, taskId) {
             affectedPackages: run.packages,
             affectedProjects: run.projects,
             ...(run.testFiles ? { affectedTestFiles: run.testFiles } : {}),
+            ...(run.configPaths ? { configPaths: run.configPaths } : {}),
             ...(run.untested.length > 0 ? { untestedPackages: run.untested } : {}),
             ...toolRunAtomFields(result),
         },
@@ -1663,12 +1664,16 @@ async function validateTestRun(path, roots, taskId) {
     const identity = treeHash && headSha ? { treeHash, headSha } : null;
     let untestedPackages = [];
     let runHeadSha;
+    let configPaths = [];
+    let typecheckDirs = [];
     if (identity) {
         const binding = bindTestRunReport(parsed, abs, bindRoot, testFiles);
         if (!binding.ok)
             return { ok: false, reason: binding.reason, codeName: binding.codeName };
         untestedPackages = binding.untestedPackages;
         runHeadSha = binding.runHeadSha;
+        configPaths = binding.configPaths ?? [];
+        typecheckDirs = binding.typecheckDirs ?? [];
     }
     return {
         ok: true,
@@ -1692,6 +1697,8 @@ async function validateTestRun(path, roots, taskId) {
                 }
                 : {}),
             ...(untestedPackages.length > 0 ? { untestedPackages } : {}),
+            ...(configPaths.length > 0 ? { configPaths } : {}),
+            ...(typecheckDirs.length > 0 ? { typecheckDirs } : {}),
             ...(capture.runtimeExcluded.length > 0
                 ? { runtimeExcluded: [...capture.runtimeExcluded] }
                 : {}),
@@ -1784,6 +1791,7 @@ async function validateQaRun(path, roots, taskId) {
                 ? { uncoveredPackages: gaps.uncoveredPackages }
                 : {}),
             ...(gaps?.nonCodeChange ? { nonCodeChange: true } : {}),
+            ...(gaps?.configPaths ? { configPaths: gaps.configPaths } : {}),
         },
     };
 }
@@ -1814,31 +1822,107 @@ async function typedGateInputs(storeRoot, taskId, bindRoot) {
         return [];
     }
 }
+/** Run git in `cwd`, returning trimmed stdout, or null on failure. */
+function gitOutput(cwd, args) {
+    try {
+        return execFileSync('git', args, {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The task's own merged change at `sha` (T13781, review of #2302): `sha` must
+ * be the merge commit of a `pr:` atom, or one of the `commit:` atoms, recorded
+ * on the task's `implemented` gate. A PR's change is its changed paths, read at
+ * its merge; the commits' change is the union of their own diffs, read at the
+ * newest. Any other commit is refused, however its diff looks.
+ */
+function taskOwnChange(root, context, sha) {
+    const implemented = context?.task.verification?.evidence?.implemented?.atoms ?? [];
+    const pr = implemented.find((a) => a.kind === 'pr' && a.mergeCommitSha === sha && (a.changedPaths?.length ?? 0) > 0);
+    if (pr)
+        return { ok: true, files: [...(pr.changedPaths ?? [])].sort(), read: sha };
+    const commits = implemented.flatMap((a) => (a.kind === 'commit' ? [a.sha] : []));
+    if (!commits.includes(sha))
+        return {
+            ok: false,
+            reason: `tool:config-schema judges a merged change only at the task's own commit: ${sha.slice(0, 12)} ` +
+                "is neither a commit: nor a pr: merge recorded on this task's implemented gate. Record " +
+                'implemented first, then name one of its commit:/pr: atoms with tool:config-schema.',
+        };
+    const files = new Set();
+    for (const commit of commits) {
+        const diff = gitOutput(root, ['diff', '--name-only', '--no-renames', `${commit}^1`, commit]);
+        if (diff === null)
+            return {
+                ok: false,
+                reason: `tool:config-schema cannot read the change of ${commit.slice(0, 12)} in ${root}.`,
+            };
+        for (const path of diff.split('\n').filter(Boolean))
+            files.add(path);
+    }
+    const newest = gitOutput(root, ['rev-list', '-1', '--date-order', ...commits]);
+    if (!newest)
+        return { ok: false, reason: `tool:config-schema cannot order the task's commits in ${root}.` };
+    return { ok: true, files: [...files].sort(), read: newest };
+}
 /**
  * `tool:config-schema` (T13758): CLEO validates each changed CLEO-owned config
- * file against its CLEO schema. It speaks only for a change made of those
- * files alone, and is pinned to the tree like a qa-run receipt.
+ * file against its CLEO schema, pinned to the tree like a qa-run receipt.
+ *
+ * On a change that also touches other paths (T13778) it validates the config
+ * files and records the rest as `otherPaths`; the gate then requires another
+ * result for them (`checkTaskEvidenceContext`). With no change against the
+ * default branch (already merged, T13781) it judges the merge commit(s) of the
+ * write's `pr:` atoms, else its `commit:` atom, reading each file at that
+ * commit, and records `configSchemaCommit` instead of a tree pin.
  */
-async function validateConfigSchema(roots, context) {
-    const { cleoConfigSchemaFor, isCleoConfigOnlyChange, scopedChangedPaths } = await import('./affected-packages.js');
+async function validateConfigSchema(roots, context, siblingCommitSha) {
+    const { cleoConfigSchemaFor, scopedChangedPaths } = await import('./affected-packages.js');
     const root = context?.task.id
         ? (await import('./change-set.js')).resolveChangeSetRoot(roots.storeRoot, context.task.id).root
         : roots.executionRoot;
-    const changed = scopedChangedPaths(root)?.paths ?? [];
-    if (!isCleoConfigOnlyChange(changed)) {
-        const other = changed.filter((p) => cleoConfigSchemaFor(p) === null);
+    let changed = scopedChangedPaths(root)?.paths ?? [];
+    // T13781: a merged change is judged at the commit(s) the write names, and
+    // only when they are the task's OWN change (review of #2302): the change is
+    // what the task merged, never an arbitrary commit's diff.
+    const prs = (context?.artifactPrs ?? []).filter((p) => (p.changedPaths?.length ?? 0) > 0);
+    let anchors = [];
+    let commitOf = (_path) => undefined;
+    if (changed.length === 0 && prs.length > 0) {
+        // pr: atoms of this write: the gate refuses one not linked to the task.
+        anchors = prs.map((p) => p.mergeCommitSha);
+        changed = [...new Set(prs.flatMap((p) => p.changedPaths ?? []))].sort();
+        commitOf = (path) => prMergeCommitForPath(prs, path);
+    }
+    else if (changed.length === 0 && siblingCommitSha) {
+        const own = taskOwnChange(root, context, siblingCommitSha);
+        if (!own.ok)
+            return { ok: false, codeName: 'E_EVIDENCE_INSUFFICIENT', reason: own.reason };
+        anchors = [own.read];
+        changed = own.files;
+        commitOf = () => own.read;
+    }
+    const config = changed.filter((p) => cleoConfigSchemaFor(p) !== null);
+    if (config.length === 0) {
         return {
             ok: false,
             codeName: 'E_EVIDENCE_INSUFFICIENT',
             reason: changed.length === 0
-                ? 'tool:config-schema needs a change to judge: no change against the default branch was found.'
-                : `tool:config-schema speaks only for a change made of CLEO config alone (.cleo/project-context.json, .cleo/config.json); this change also touches ${other.slice(0, 5).join(', ')}.`,
+                ? 'tool:config-schema needs a change to judge: no change against the default branch was found. ' +
+                    'For an already-merged change, name it in the same write: --evidence "commit:<sha>;tool:config-schema" or "pr:<n>;tool:config-schema".'
+                : `tool:config-schema validates CLEO config (.cleo/project-context.json, .cleo/config.json); this change touches none (${changed.slice(0, 5).join(', ')}).`,
         };
     }
     const { resolveSchemaPath } = await import('../schema-management.js');
     const { checkSchema } = await import('../json-schema-validator.js');
     const failures = [];
-    for (const path of changed) {
+    for (const path of config) {
         const schemaName = cleoConfigSchemaFor(path);
         const schemaPath = resolveSchemaPath(schemaName);
         if (!schemaPath)
@@ -1849,7 +1933,15 @@ async function validateConfigSchema(roots, context) {
             };
         let data;
         try {
-            data = JSON.parse(await readFile(resolvePath(root, path), 'utf-8'));
+            const at = anchors.length > 0 ? commitOf(path) : undefined;
+            const text = at
+                ? gitOutput(root, ['show', `${at}:${path}`])
+                : await readFile(resolvePath(root, path), 'utf-8');
+            if (text === null) {
+                failures.push(`${path}: not readable at ${at?.slice(0, 12)}`);
+                continue;
+            }
+            data = JSON.parse(text);
         }
         catch (err) {
             failures.push(`${path}: ${err instanceof Error ? err.message : String(err)}`);
@@ -1865,6 +1957,20 @@ async function validateConfigSchema(roots, context) {
             codeName: 'E_EVIDENCE_TOOL_FAILED',
             reason: `tool:config-schema: CLEO's schema check failed:\n  - ${failures.join('\n  - ')}`,
         };
+    const otherPaths = changed.filter((p) => cleoConfigSchemaFor(p) === null);
+    const rest = otherPaths.length > 0 ? { otherPaths } : {};
+    if (anchors.length > 0)
+        return {
+            ok: true,
+            atom: {
+                kind: 'tool',
+                tool: 'config-schema',
+                exitCode: 0,
+                configSchema: config,
+                configSchemaCommit: anchors.at(-1),
+                ...rest,
+            },
+        };
     const treeHash = (await captureTree(root)).tree;
     if (!treeHash)
         return {
@@ -1874,12 +1980,19 @@ async function validateConfigSchema(roots, context) {
         };
     return {
         ok: true,
-        atom: { kind: 'tool', tool: 'config-schema', exitCode: 0, configSchema: changed, treeHash },
+        atom: {
+            kind: 'tool',
+            tool: 'config-schema',
+            exitCode: 0,
+            configSchema: config,
+            treeHash,
+            ...rest,
+        },
     };
 }
-async function validateTool(tool, roots, context) {
+async function validateTool(tool, roots, context, siblingCommitSha) {
     if (tool === 'config-schema')
-        return validateConfigSchema(roots, context);
+        return validateConfigSchema(roots, context, siblingCommitSha);
     // T13745: no test reads a non-code-only change (docs, editor settings), so
     // the gate is satisfied by absence, recorded with the paths, never by a
     // suite. Pinned to the tree like a test-run: once the tree moves (code
@@ -1944,7 +2057,12 @@ async function validateTool(tool, roots, context) {
     const { storeRoot: projectRoot, executionRoot } = roots;
     // T12633: project-context lives in the store; package.json scripts and
     // tsconfig describe the code under test, so they are read where it runs.
-    const resolution = resolveToolCommand(tool, projectRoot, { executionRoot });
+    // T13779: a change that edits project-context.json is judged by the default branch's commands.
+    const { evidenceProjectContext } = await import('./affected-packages.js');
+    const resolution = resolveToolCommand(tool, projectRoot, {
+        executionRoot,
+        projectContext: evidenceProjectContext(projectRoot, executionRoot),
+    });
     // T12083: the project has no such toolchain. This is a fact about the
     // project, not a failure of the work — a plain JavaScript project cannot
     // typecheck, and demanding it means no task in that project can ever be
@@ -2761,6 +2879,19 @@ export function checkTaskEvidenceContext(context, gate, atoms) {
             (atom.kind === 'tool' && (!atom.notApplicable || atom.nonCodeChange === true)))) {
         return `Code task ${context.task.id} requires an actual verification result for ${gate}; absence of a toolchain is not a passing result.`;
     }
+    // T13778: CLEO config and the rest of a change are each covered by their own result.
+    if (gate === 'testsPassed' || gate === 'qaPassed') {
+        const gap = configSchemaCompositionGap(atoms);
+        if (gap !== null)
+            return gap;
+    }
+    // T13783: generated-client dependents a test-run left to a typecheck need one.
+    if (gate === 'testsPassed' && !atoms.some((atom) => atom.kind === 'ci')) {
+        const dirs = atoms.flatMap((atom) => atom.kind === 'test-run' ? (atom.typecheckDirs ?? []) : []);
+        const gap = typecheckCoverageGap(atoms, dirs);
+        if (gap !== null)
+            return gap;
+    }
     // T13427: qa-run receipts stand for qaPassed only as a pair — a typecheck
     // and a lint, each by receipt or by a tool: atom (a not-applicable tool:
     // records a toolchain the project lacks). Merged CI stands alone.