@codedology/code-forge 0.5.1 → 0.6.1

package/src/cli/block.mjs

@@ -2,7 +2,7 @@
  * `code-forge block open|attempt|rebase|claim|close|stop` (plan §4.9). The skill calls
  * `block open` before every spawn in every engine; it prints the brief pointer (≤ 200 bytes).
  *
- *   block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file>
+ *   block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file>
  *              [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <forecast>] [--kind code|docs|contract]
  *   block attempt <id> --run <r>
  *   block rebase <id> --run <r> [--head <ref>]
@@ -33,6 +33,11 @@
  * FAILED: no review-file ticket id for <files>` (skipped under `--no-require-reviews`, the human's
  * way out). It runs after the review rows and reuses their file set (listed once).
  *
+ * B47: `block open` without `--level` takes the level `autopilot level` chose for the block (the
+ * latest `autopilot.level` row of the run for it whose MAC verifies, `autopilotLevel`); with
+ * neither it is a usage error (`no --level given and no autopilot level recorded for <id>`). An
+ * explicit `--level` always wins; a repeated or valueless `--level` is a usage error as before.
+ *
  * `--acceptance` is a YAML/JSON list of `{clause, tests: [test ids…]}`. `block close` runs B8's
  * rows of the gate (worker pin, MACs, orphans); the gate rows owned by later blocks join it
  * through `closeBlock`'s `extraChecks`.
@@ -41,13 +46,14 @@
 import { readFile, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { parse as parseYAML } from 'yaml';
+import { approvalCheckText, expiryChecks } from '../autopilot/limits.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { attemptBlock, claimPath, closeBlock, openBlock, rebaseBlock, stopBlock } from '../state/block.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { findOverlap } from '../state/registry.mjs';
 import { readRun, writeSigned } from '../state/run.mjs';
-import { loadKey } from '../state/signer.mjs';
+import { loadKey, verifyRow } from '../state/signer.mjs';
 import { blockFileSet, reviewGateCheck, waiveFinding } from '../review/gate-check.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
@@ -58,7 +64,7 @@ import { gitChildEnv } from '../worker/ticket.mjs';
 import { missingReviewTickets } from '../engines/sentinel.mjs';
 
 const USAGE =
-  'usage: code-forge block open <id> --run <r> --level L<n> --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code|docs|contract]\n' +
+  'usage: code-forge block open <id> --run <r> [--level L<n>] --owned <paths…> --acceptance <file> [--brief <file>] [--attempt <n>] [--base <sha>] [--lines <n>] [--kind code|docs|contract]\n' +
   '       code-forge block attempt|rebase <id> --run <r> · block close <id> --run <r> [--transcript <file>] [--report <file>] [--no-require-reviews] · block claim <id> <path> --run <r> · block stop <id> --run <r> --reason <text>\n' +
   '       code-forge block waive <id> <finding-id> --run <r> --file <path> --reason <text>\n';
 
@@ -67,7 +73,8 @@ const FLAG_VALUES = ['run', 'level', 'acceptance', 'brief', 'attempt', 'base', '
 
 /**
  * @param {string[]} args
- * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, probe?: import('../state/run.mjs').StartTimeProbe}} [deps]
+ * @param {{stdout?: {write: (s: string) => unknown}, stderr?: {write: (s: string) => unknown}, probe?: import('../state/run.mjs').StartTimeProbe, now?: () => Date}} [deps] -
+ *   `now` (B48): the clock of the autopilot expiry checks.
  * @returns {Promise<number>}
  */
 export async function runBlock(args, deps = {}) {
@@ -84,7 +91,7 @@ export async function runBlock(args, deps = {}) {
     const [id, extra] = positionals;
     const runId = typeof flags.run === 'string' ? flags.run : undefined;
     if (!id || !runId) throw new StateError('usage', 'a block id and --run are required');
-    if (sub === 'open' && (typeof flags.acceptance !== 'string' || !Array.isArray(flags.owned) || typeof flags.level !== 'string')) {
+    if (sub === 'open' && (typeof flags.acceptance !== 'string' || !Array.isArray(flags.owned) || (flags.level !== undefined && typeof flags.level !== 'string'))) {
       throw new StateError('usage', 'block open needs --level, --owned and --acceptance');
     }
     if (sub === 'claim' && (!extra || positionals.length !== 2)) throw new StateError('usage', 'block claim needs exactly one path');
@@ -93,8 +100,18 @@ export async function runBlock(args, deps = {}) {
     if (sub === 'waive' && typeof flags.file !== 'string') throw new StateError('usage', 'block waive needs --file <path> (a finding id is scoped to one file)');
     const record = await readRun(runId);
     const writeRow = (/** @type {Record<string, any>} */ row) => appendRow(row, { slug: record.project });
+    // B48: every block command runs the lazy autopilot checks (grant expiry, expired approvals);
+    // a failed check is a warning, never a reason to stop the block command
+    try {
+      err(approvalCheckText(await expiryChecks(runId, (deps.now ?? (() => new Date()))(), { writeRow })));
+    } catch (thrown) {
+      err(`autopilot: WARN the expiry check failed (${thrown?.message ?? String(thrown)})\n`);
+    }
 
     if (sub === 'open') {
+      // B47: no --level ⇒ the level autopilot chose for the block (a signed autopilot.level row)
+      const level = typeof flags.level === 'string' ? flags.level : await autopilotLevel(runId, id, record);
+      if (level === null) throw new StateError('usage', `no --level given and no autopilot level recorded for ${id}`);
       const acceptance = parseYAML(await readFile(/** @type {string} */ (flags.acceptance), 'utf8'), { prettyErrors: false });
       let brief;
       if (typeof flags.brief === 'string') {
@@ -106,7 +123,7 @@ export async function runBlock(args, deps = {}) {
       const { block, pointer } = await openBlock({
         runId,
         id,
-        level: /** @type {string} */ (flags.level),
+        level,
         owned: /** @type {string[]} */ (flags.owned),
         acceptance,
         attempt: intFlag(flags.attempt, 'attempt'),
@@ -117,8 +134,9 @@ export async function runBlock(args, deps = {}) {
         cfg: await openConfig(record.workspace),
         writeRow,
       });
-      const raised = block.level !== flags.level ? ` (${block.kind} floor, asked ${flags.level})` : '';
-      out(`block ${id} open · ${block.level}${raised} · ${block.kind} · attempt ${block.attempt} · base ${block.base_sha.slice(0, 12)}\n`);
+      const raised = block.level !== level ? ` (${block.kind} floor, asked ${level})` : '';
+      const chosen = typeof flags.level === 'string' ? '' : ' (autopilot level)';
+      out(`block ${id} open · ${block.level}${raised}${chosen} · ${block.kind} · attempt ${block.attempt} · base ${block.base_sha.slice(0, 12)}\n`);
       out(`${pointer ?? 'brief: none given (--brief <file>)'}\n`);
       return 0;
     }
@@ -204,6 +222,20 @@ export async function runBlock(args, deps = {}) {
   return 2;
 }
 
+/**
+ * B47: the level `autopilot level` chose for the block — the latest `autopilot.level` row of this
+ * run for it whose MAC verifies — or null when there is none.
+ * @param {string} runId @param {string} id @param {Record<string, any>} record
+ * @returns {Promise<string | null>}
+ */
+async function autopilotLevel(runId, id, record) {
+  const rows = (await readAllRows(record.project)).filter((r) => r?.event === 'autopilot.level' && r.run === runId && r.block === id && typeof r.level === 'string');
+  if (rows.length === 0) return null;
+  const key = await loadKey(runId);
+  const valid = rows.filter((r) => verifyRow(r, key).ok);
+  return valid.length === 0 ? null : valid[valid.length - 1].level;
+}
+
 /**
  * The project config for `block open`'s coder floor (B34): the loaded `.code-forge.yml`, or
  * undefined when there is none or it does not load — the floor then takes its default (L1), the

package/src/cli/facts.mjs

@@ -11,13 +11,12 @@
 
 import { accessSync, constants, statSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
+import { loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { buildFacts, FactsError } from '../session/facts.mjs';
 import { runRootFor, SessionError } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { redact, writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 import { exitCodeFor } from './spawn.mjs';
 
 /**
@@ -64,14 +63,16 @@ export async function runFactsVerb(args, deps = {}) {
       writeSafe(stderr, USAGE);
       return 2;
     }
-    const loaded = await loadProjectConfig(cwd);
+    // B50: the project root's config, slug, plans dir and snapshot, also from a subfolder (flag paths stay cwd-relative)
+    const root = projectRootFor(cwd);
+    const loaded = await loadProjectConfig(root);
     if (!loaded.ok) {
       writeSafe(stderr, `facts: ${loaded.message}\n`);
       return 2;
     }
     const cfg = /** @type {Record<string, any>} */ (loaded.config);
     const briefPath = path.resolve(cwd, flags.brief);
-    const plansDir = path.resolve(cwd, cfg.project?.plans_dir ?? 'plans');
+    const plansDir = path.resolve(root, cfg.project?.plans_dir ?? 'plans');
     const outPath = typeof flags.out === 'string' ? path.resolve(cwd, flags.out) : path.join(plansDir, `${path.basename(briefPath, path.extname(briefPath))}.facts.md`);
     const sources = Array.isArray(flags.sources) ? flags.sources.map((s) => path.resolve(cwd, s)) : [];
     // --brief must be a regular file; a --sources path may be a file or a directory
@@ -89,11 +90,11 @@ export async function runFactsVerb(args, deps = {}) {
     const run = typeof flags.run === 'string' ? flags.run : undefined;
     // pre-run argument checks: a bad --run id or an unusable project state is usage (exit 2)
     const runRoot = run ? runRootFor(run, cfg?.tmp?.root) : undefined;
-    const slug = slugFor(cfg, cwd);
+    const slug = slugFor(cfg, root);
     let result;
     try {
       result = await buildFacts(
-        { cfg, briefPath, sources, outPath, run, runRoot, slug, projectDir: cwd, timeoutMs: timeout === undefined ? undefined : timeout * 1000 },
+        { cfg, briefPath, sources, outPath, run, runRoot, slug, projectDir: root, timeoutMs: timeout === undefined ? undefined : timeout * 1000 },
         { ...deps, stderr },
       );
     } catch (err) {

package/src/cli/jev.mjs

@@ -16,8 +16,11 @@
  * or mistyped one is a usage error naming it, with nothing recorded. `system1.disable` still
  * applies. No key is resolved, no request is sent, and the row says `source: 'rules'`.
  * The ledger slug is `--slug`, else `project.slug`, else the directory-name slug `run` and
- * `author` use (`slugFor`; B36 — it used to fall back to `code-forge`). An unknown flag is a usage
- * error.
+ * `author` use (`slugFor`; B36 — it used to fall back to `code-forge`). B50: the config and the
+ * directory name are the PROJECT ROOT's (`projectRootFor`): inside git, the nearest regular-file
+ * `.code-forge.yml` from the cwd up to the git top level, else the git top level; outside git, the
+ * nearest one up to the home directory when the cwd is under it, else the cwd alone. A run from a
+ * subfolder thus writes to the project's ledger. An unknown flag is a usage error.
  *
  * Resolves the Jev key through B2's chain (`resolveKey`, earlier batch — the seam rule allows a
  * Wave 1 module to import a block in an earlier batch statically), asks Jev, runs the answer
@@ -31,7 +34,7 @@
 
 import { randomUUID } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
-import { loadConfigFile, DEFAULT_CONFIG_FILENAME } from '../config/load.mjs';
+import { loadConfigFile, DEFAULT_CONFIG_FILENAME, projectRootFor, slugFor } from '../config/load.mjs';
 import path from 'node:path';
 import { buildQuestionPayload, isKnownQuestion, isQuestionDisabled } from '../decide/questions.mjs';
 import { askJev as realAskJev } from '../decide/jev-client.mjs';
@@ -40,7 +43,6 @@ import { resolveDispatchQuestionsByRules } from '../decide/fallback-rules.mjs';
 import { createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
 import { appendRow as realAppendRow } from '../ledger/write.mjs';
 import { writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 
 const USAGE = 'usage: code-forge jev ask <question-id> --state <file> [--cwd <dir>] [--slug <slug>] [--key-ref <ref>] [--block <id>] [--plan <file>] [--rules]\n';
 
@@ -180,7 +182,9 @@ export async function runJev(args, deps = {}) {
     return 1;
   }
 
-  const configPath = path.join(cwd, DEFAULT_CONFIG_FILENAME);
+  // B50: the project's config and ledger, also from a subfolder of the project
+  const root = projectRootFor(cwd);
+  const configPath = path.join(root, DEFAULT_CONFIG_FILENAME);
   const loaded = await loadConfig(configPath);
   let cfg = {};
   if (loaded.ok) {
@@ -191,7 +195,7 @@ export async function runJev(args, deps = {}) {
   }
 
   // the same ledger as the rest of the tool: --slug, else project.slug, else the directory name
-  const slug = slugFlag.value ?? slugFor(cfg, cwd);
+  const slug = slugFlag.value ?? slugFor(cfg, root);
 
   if (isQuestionDisabled(id, cfg)) {
     err(`jev ask: question "${id}" is disabled by system1.disable\n`);

package/src/cli/logs.mjs

@@ -33,7 +33,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { accessSync, constants as fsConstants, readFileSync, statSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
@@ -43,7 +43,7 @@ import { NO_ERROR_LOG_ENV, capBytes, createScrubber, describeCounts, errorLogPat
 import { compareVersions, fixStatus, loadKnownFixes } from '../util/known-fixes.mjs';
 import { redact, writeSafe } from '../util/redact.mjs';
 import { currentRunRoot } from '../util/tmp.mjs';
-import { SECRET_LOOKING_PATTERNS } from '../config/secret-patterns.mjs';
+import { GH_TIMEOUT_MS, findReported, findSecret, ghWithBodyFile, pathLookup } from '../util/gh.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { AI_REPORT_MAX_BYTES, applyItems, describeAiCounts, runAiScrub } from '../session/scrub.mjs';
 
@@ -83,7 +83,8 @@ export const DISCLOSURE = disclosure();
 
 export const CONFIRM_MESSAGE = 'This will be public on GitHub. Send it?';
 
-const GH_TIMEOUT_MS = 60_000;
+// the secret check and the gh helpers live in `util/gh.mjs` (shared with B47's waiver issues)
+export { REPORT_SECRET_RULES, entropy, findSecret } from '../util/gh.mjs';
 const NPM_TIMEOUT_MS = 10_000;
 /** `code-forge doctor --json` for `--with-doctor` gets at most this long. */
 export const DOCTOR_TIMEOUT_MS = 60_000;
@@ -117,64 +118,6 @@ export const PACKAGE_NAME = '@codedology/code-forge';
  *   the editor on the terminal (default: argv only, stdio inherited, never a shell).
  */
 
-/**
- * Secret shapes the final report is checked for, after scrubbing. A hit stops the report.
- * @type {ReadonlyArray<{name: string, re: RegExp}>}
- */
-export const REPORT_SECRET_RULES = Object.freeze([
-  { name: 'API key (sk-)', re: /(?<![A-Za-z0-9_-])sk-[A-Za-z0-9_-]{10,}/ },
-  { name: 'GitHub token', re: /(?<![A-Za-z0-9_])(?:gh[opsur]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})/ },
-  { name: 'Slack token', re: /(?<![A-Za-z0-9_-])xox[abprs]-[A-Za-z0-9-]{10,}/ },
-  { name: 'AWS access key', re: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![0-9A-Z])/ },
-  { name: 'private key', re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/ },
-  { name: 'JWT', re: /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/ },
-  // copied without g/y: `.test()` must carry no `lastIndex` state between checks
-  ...SECRET_LOOKING_PATTERNS.map((re) => ({ name: 'secret-shaped token', re: new RegExp(re.source, re.flags.replace(/[gy]/g, '')) })),
-]);
-
-/** @param {string} s @returns {number} Shannon entropy in bits per character */
-export function entropy(s) {
-  /** @type {Map<string, number>} */
-  const freq = new Map();
-  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);
-  let bits = 0;
-  for (const n of freq.values()) {
-    const p = n / s.length;
-    bits -= p * Math.log2(p);
-  }
-  return bits;
-}
-
-/**
- * A 32+ character run of `[A-Za-z0-9+/_=-]` with at least two of upper/lower/digit and entropy of
- * at least 4 bits per character (a hex hash tops out at 4 and is not flagged; a random token is).
- * @param {string} line
- * @returns {boolean}
- */
-function hasHighEntropyRun(line) {
-  for (const m of line.matchAll(/[A-Za-z0-9+/_=-]{32,}/g)) {
-    const run = m[0];
-    const classes = [/[A-Z]/, /[a-z]/, /[0-9]/].filter((re) => re.test(run)).length;
-    if (classes >= 2 && entropy(run) >= 4) return true;
-  }
-  return false;
-}
-
-/**
- * The first secret-shaped text in `text` (rule name and 1-based line), or null. The matched text
- * itself is never returned.
- * @param {string} text
- * @returns {{rule: string, line: number}|null}
- */
-export function findSecret(text) {
-  const lines = text.split('\n');
-  for (let i = 0; i < lines.length; i += 1) {
-    for (const r of REPORT_SECRET_RULES) if (r.re.test(lines[i])) return { rule: r.name, line: i + 1 };
-    if (hasHighEntropyRun(lines[i])) return { rule: 'high-entropy string', line: i + 1 };
-  }
-  return null;
-}
-
 /**
  * `owner/repo` from package.json `bugs.url`, else `repository` (string or `{url}`).
  * @param {any} [pkg]
@@ -197,21 +140,6 @@ export function issueRepo(pkg) {
   return null;
 }
 
-/** @param {string} pathEnv @returns {(cmd: string) => boolean} */
-function pathLookup(pathEnv) {
-  return (cmd) =>
-    pathEnv.split(path.delimiter).some((dir) => {
-      if (!dir) return false;
-      try {
-        const f = path.join(dir, cmd);
-        accessSync(f, fsConstants.X_OK);
-        return statSync(f).isFile();
-      } catch {
-        return false;
-      }
-    });
-}
-
 /** @param {ErrorEntry} e */
 function command(e) {
   return e.sub ? `${e.verb} ${e.sub}` : e.verb;
@@ -895,72 +823,6 @@ async function editBody(body, env, deps, out) {
   }
 }
 
-/**
- * An earlier issue holding `fp` in its body (open or closed): `{hit}` (null when there is none),
- * or `{why}` when the search failed (`gh exit n`; never gh's output).
- * @param {typeof realExec} exec @param {NodeJS.ProcessEnv} env @param {string} repo @param {string} fp
- * @returns {Promise<{hit: {number: number, url: string, state: string}|null} | {why: string}>}
- */
-async function findReported(exec, env, repo, fp) {
-  const res = await ghRun(exec, ['gh', 'issue', 'list', '--repo', repo, '--state', 'all', '--search', `${fp} in:body`, '--json', 'number,url,state', '--limit', '5'], env);
-  if (res.result !== 'ok') return { why: res.code !== null ? `gh exit ${res.code}` : res.timedOut ? 'gh timed out' : 'gh did not finish' };
-  let list;
-  try {
-    list = JSON.parse(res.stdout);
-  } catch {
-    return { why: 'gh gave no list' };
-  }
-  if (!Array.isArray(list)) return { why: 'gh gave no list' };
-  const hit = list.find((i) => Number.isSafeInteger(i?.number) && typeof i?.url === 'string' && /^https:\/\//.test(i.url));
-  return { hit: hit ? { number: hit.number, url: hit.url, state: typeof hit.state === 'string' ? hit.state.toLowerCase() : 'unknown' } : null };
-}
-
-/**
- * Write `text` to a private temp file and run the first argv of `argvsFor(file)`; when it fails
- * over a label, run the next one (once).
- * @param {typeof realExec} exec @param {NodeJS.ProcessEnv} env @param {string} text
- * @param {(file: string) => string[][]} argvsFor
- * @param {(stdout: string) => void} [onOk]
- * @returns {Promise<string|null>} null when gh succeeded; else why (`exit n`, never its output).
- */
-async function ghWithBodyFile(exec, env, text, argvsFor, onOk) {
-  /** @type {string|null} */
-  let dir = null;
-  try {
-    let res;
-    try {
-      const root = currentRunRoot();
-      await mkdir(root, { recursive: true });
-      dir = await mkdtemp(path.join(root, 'report-'));
-      const bodyFile = path.join(dir, 'body.md');
-      await writeFile(bodyFile, text, { encoding: 'utf8', mode: 0o600 });
-      const [first, retry] = argvsFor(bodyFile);
-      res = await ghRun(exec, first, env);
-      // gh's stderr is matched to decide the retry, never printed
-      if (res.result !== 'ok' && retry && /label/i.test(res.stderr)) res = await ghRun(exec, retry, env);
-    } catch {
-      return 'could not write the report file';
-    }
-    if (res.result !== 'ok') return res.code !== null ? `exit ${res.code}` : res.timedOut ? 'timed out' : 'did not finish';
-    onOk?.(res.stdout);
-    return null;
-  } finally {
-    if (dir !== null) await rm(dir, { recursive: true, force: true }).catch(() => {});
-  }
-}
-
-/**
- * @param {typeof realExec} exec @param {string[]} argv @param {NodeJS.ProcessEnv} env
- * @returns {Promise<{result: string, code: number|null, timedOut: boolean, stdout: string, stderr: string}>}
- */
-async function ghRun(exec, argv, env) {
-  try {
-    return await exec(argv, { env, timeoutMs: GH_TIMEOUT_MS });
-  } catch {
-    return { result: 'failed', code: null, timedOut: false, stdout: '', stderr: '' };
-  }
-}
-
 /**
  * The prefilled issue-form link: the form's `details` field holds the whole body (GitHub fills an
  * issue form's fields from query parameters named by field id).

package/src/cli/plan.mjs

@@ -5,21 +5,21 @@
  * WARN lines (a required section found by its position under a near-miss heading) go to stderr and
  * never fail the check. Either way stdout ends with the lane recorded per block (B36):
  * `lanes: B1 L1 (jev) · B2 none` — read from the project's ledger (`--slug`, else `project.slug`,
- * else the directory-name slug `run`, `author` and `jev ask` use).
- * Limits come from `.code-forge.yml` when there is one (`caps.coders`, `budget.block_cases`,
+ * else the directory-name slug `run`, `author` and `jev ask` use — the project root's, B50).
+ * Limits come from the project root's `.code-forge.yml` when there is one (`caps.coders`, `budget.block_cases`,
  * `budget.block_lines`), else the plan defaults.
  */
 
 import { readFileSync } from 'node:fs';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
+import { loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { ledgerPath } from '../ledger/paths.mjs';
 import { readAllRows } from '../ledger/write.mjs';
+import { FactsError, readProjectBins } from '../session/facts.mjs';
 import { checkPlan } from '../session/plan-check.mjs';
 import { parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 
 const USAGE = 'usage: code-forge plan check <plan-file> [--facts <sheet>] [--slug <slug>]\n';
 
@@ -50,14 +50,16 @@ export async function runPlanVerb(args, deps = {}) {
     };
     const text = read(planPath, 'the plan file');
     const factsText = factsPath ? read(factsPath, '--facts') : undefined;
-    const loaded = await loadProjectConfig(cwd);
+    // B50: the project's config and ledger, also from a subfolder of the project
+    const root = projectRootFor(cwd);
+    const loaded = await loadProjectConfig(root);
     if (!loaded.ok && loaded.error !== 'not-found') {
       writeSafe(stderr, `plan: ${loaded.message}\n`);
       return 2;
     }
     const cfg = loaded.ok ? loaded.config : undefined;
     // the same ledger as the rest of the tool (and `jev ask`): --slug, else project.slug, else the directory name
-    const slug = typeof flags.slug === 'string' ? flags.slug : slugFor(cfg, cwd);
+    const slug = typeof flags.slug === 'string' ? flags.slug : slugFor(cfg, root);
     try {
       ledgerPath(slug);
     } catch {
@@ -65,7 +67,16 @@ export async function runPlanVerb(args, deps = {}) {
     }
     // a missing ledger is no rows (every block `none`); any other read error propagates as itself
     const decisions = await readAllRows(slug);
-    const result = checkPlan(text, { planPath, factsPath, factsText, cfg, decisions });
+    // package.json is read lazily: only a command claim that needs the bin prefix reads it, so a bad
+    // package.json fails only the plans that depend on it
+    let result;
+    try {
+      result = checkPlan(text, { planPath, factsPath, factsText, cfg, decisions, projectBins: () => readProjectBins(root) });
+    } catch (err) {
+      if (!(err instanceof FactsError)) throw err;
+      writeSafe(stderr, `plan: ${err.message}\n`);
+      return 2;
+    }
     for (const line of result.warnings) writeSafe(stderr, `${line}\n`);
     for (const line of result.errors) writeSafe(stderr, `${line}\n`);
     if (result.ok) writeSafe(stdout, `plan check: ok (${result.blocks} blocks)\n`);

package/src/cli/run.mjs

@@ -22,37 +22,18 @@
  * run record per ticket — no restart).
  */
 
-import { readdirSync } from 'node:fs';
 import path from 'node:path';
-import { DEFAULT_CONFIG_FILENAME, loadProjectConfig } from '../config/load.mjs';
-import { loadSeenInCache } from '../config/refresh.mjs';
-import { validateConfig } from '../config/validate.mjs';
+import { reloadFailureText, reloadWorkspace } from '../autopilot/limits.mjs';
+import { DEFAULT_CONFIG_FILENAME, loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { budgetUsdOf, runSpend } from '../ledger/spend.mjs';
 import { appendRow, readAllRows } from '../ledger/write.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
-import { endRun, processStartTime, readRun, reattachWorker, reloadRun, startRun, stopPinnedWorker } from '../state/run.mjs';
+import { endRun, processStartTime, readRun, reattachWorker, startRun, stopPinnedWorker } from '../state/run.mjs';
 import { writeSafe } from '../util/redact.mjs';
 import { sweepRoots, tmpBase } from '../util/tmp.mjs';
 import { launchWorker, repinWorker } from '../worker/loop.mjs';
-import { pendingTickets, queueDir } from '../worker/queue.mjs';
-import { repoRootOf, WorkerError } from '../worker/ticket.mjs';
-import { hasCliOnPath } from './validate.mjs';
-
-/**
- * `project.slug` from config, else the workspace directory name as a ledger slug. The configured
- * value is NOT trusted here: `startRun` refuses any slug outside `/^[a-z0-9][a-z0-9-]*$/`
- * (`bad-project`) before anything is written, so `../x` never reaches the ledger path. Run ids
- * are checked the same way by the state layer (`assertRunId`, `bad-run-id`).
- * @param {Record<string, any>} cfg @param {string} workspace
- * @returns {string}
- */
-export function slugFor(cfg, workspace) {
-  const configured = cfg?.project?.slug;
-  if (typeof configured === 'string' && configured.length > 0) return configured;
-  const derived = path.basename(workspace).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '');
-  return derived || 'project';
-}
+import { repoRootOf } from '../worker/ticket.mjs';
 
 /**
  * B33: the run's spend so far (estimated USD from its ledger rows, open blocks included) and its
@@ -137,7 +118,8 @@ export async function runRun(args, deps = {}) {
       return 0;
     }
     if (sub === 'start') {
-      const workspace = path.resolve(typeof flags.cwd === 'string' ? flags.cwd : process.cwd());
+      // B50: the run's workspace is the project root (its config and ledger slug), also from a subfolder
+      const workspace = projectRootFor(path.resolve(typeof flags.cwd === 'string' ? flags.cwd : process.cwd()));
       const loaded = await loadProjectConfig(workspace);
       if (!loaded.ok) {
         err(`run start: ${loaded.message}\n`);
@@ -190,52 +172,29 @@ export async function runRun(args, deps = {}) {
 
 /**
  * `run reload --run <id>`: load + validate the workspace config, pin the queue's pending tickets
- * to the old snapshot and store the new one (`reloadRun`). Exit 0 on a reload or no change, 1 on a
- * config that does not load or validate, or on a refused key.
+ * to the old snapshot and store the new one (`reloadWorkspace` → `reloadRun`). Exit 0 on a reload
+ * or no change, 1 on a config that does not load or validate, or on a refused key. B48: while an
+ * autopilot grant is active, a change to a limit key is refused (`autopilot-limit`): only the
+ * owner changes one, with `code-forge autopilot approve` (the verb never passes its internal allow).
  * @param {string} runId
  * @param {{out: (s: string) => void, err: (s: string) => void}} io
  * @returns {Promise<number>}
  */
 async function reloadVerb(runId, { out, err }) {
-  const { project, workspace, status } = await readRun(runId);
-  if (status !== 'active') throw new StateError('run-ended', `run ${runId} has ended`);
-  const loaded = await loadProjectConfig(workspace);
-  if (!loaded.ok || !loaded.config) {
-    // never the parser's message: it can quote a line of the file
-    if (loaded.error === 'not-found') err(`run reload: no ${DEFAULT_CONFIG_FILENAME} in the workspace — nothing changed\n`);
+  const { project } = await readRun(runId);
+  const reloaded = await reloadWorkspace({ runId, writeRow: ledgerWriter(project) });
+  if (!reloaded.ok) {
+    if (reloaded.error === 'not-found') err(`run reload: no ${DEFAULT_CONFIG_FILENAME} in the workspace — nothing changed\n`);
+    else if (reloaded.error === 'parse-error') err(`run reload: the config could not be parsed (${DEFAULT_CONFIG_FILENAME}${reloaded.line ? `:${reloaded.line}` : ''}) — nothing changed\n`);
+    else if (reloaded.error !== 'invalid') err(`run reload: ${reloadFailureText(reloaded)} — nothing changed\n`);
     else {
-      const line = loaded.error === 'parse-error' ? /\(line (\d+), column \d+\)$/.exec(loaded.message ?? '')?.[1] : undefined;
-      err(`run reload: the config could not be parsed (${DEFAULT_CONFIG_FILENAME}${line ? `:${line}` : ''}) — nothing changed\n`);
+      // rule ids and key paths only: a validator message may quote a value
+      const errors = reloaded.errors ?? [];
+      const lines = errors.map((e) => `  [${e.rule}]${e.path ? ` ${e.path}` : ''}\n`);
+      err(`run reload: ${DEFAULT_CONFIG_FILENAME} is invalid (${errors.length} error${errors.length === 1 ? '' : 's'}) — nothing changed; run code-forge validate\n${lines.join('')}`);
     }
     return 1;
   }
-  const result = validateConfig(loaded.config, { seenInCache: await loadSeenInCache(), hasCliOnPath });
-  if (!result.valid) {
-    // rule ids and key paths only: a validator message may quote a value
-    const lines = result.errors.map((e) => `  [${e.rule}]${typeof e.path === 'string' && e.path.length > 0 ? ` ${e.path}` : ''}\n`);
-    err(`run reload: ${DEFAULT_CONFIG_FILENAME} is invalid (${result.errors.length} error${result.errors.length === 1 ? '' : 's'}) — nothing changed; run code-forge validate\n${lines.join('')}`);
-    return 1;
-  }
-  /** @type {string | null} */
-  let repoRoot = null;
-  try {
-    repoRoot = await repoRootOf(workspace);
-  } catch (thrown) {
-    if (!(thrown instanceof WorkerError && thrown.code === 'no-repo')) throw thrown;
-    // no repository: there is no review queue to pin
-  }
-  const queueRoot = repoRoot;
-  const readPending = () => {
-    if (queueRoot === null) return [];
-    try {
-      readdirSync(queueDir(queueRoot));
-    } catch (thrown) {
-      if (thrown?.code === 'ENOENT') return [];
-      throw new StateError('queue-unreadable', 'cannot read the review queue; nothing changed');
-    }
-    return pendingTickets(queueRoot);
-  };
-  const reloaded = await reloadRun({ runId, config: loaded.config, readPending, effectiveSlug: slugFor(loaded.config, workspace), writeRow: ledgerWriter(project) });
   if (reloaded.changed !== null && reloaded.changed.length === 0) {
     out(`run ${runId}: no config change\n`);
     return 0;

package/src/cli/s2.mjs

@@ -8,13 +8,12 @@
 
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import { loadProjectConfig } from '../config/load.mjs';
+import { loadProjectConfig, projectRootFor, slugFor } from '../config/load.mjs';
 import { runS2 } from '../session/s2.mjs';
 import { runRootFor, SessionError } from '../session/spawn.mjs';
 import { intFlag, parseFlags } from '../state/cli-args.mjs';
 import { StateError } from '../state/paths.mjs';
 import { writeSafe } from '../util/redact.mjs';
-import { slugFor } from './run.mjs';
 import { exitCodeFor } from './spawn.mjs';
 
 /**
@@ -52,7 +51,9 @@ export async function runS2Verb(args, deps = {}) {
       writeSafe(stderr, USAGE);
       return 2;
     }
-    const loaded = await loadProjectConfig(process.cwd());
+    // B50: the project root's config and ledger slug, also from a subfolder
+    const root = projectRootFor(process.cwd());
+    const loaded = await loadProjectConfig(root);
     if (!loaded.ok) {
       writeSafe(stderr, `s2: ${loaded.message}\n`);
       return 2;
@@ -67,7 +68,7 @@ export async function runS2Verb(args, deps = {}) {
         run: typeof flags.run === 'string' ? flags.run : undefined,
         block: typeof flags.block === 'string' ? flags.block : undefined,
         runRoot: typeof flags.run === 'string' ? runRootFor(flags.run, cfg?.tmp?.root) : undefined,
-        slug: slugFor(cfg, process.cwd()),
+        slug: slugFor(cfg, root),
         timeoutMs: timeout === undefined ? undefined : timeout * 1000,
       },
       { ...deps, stderr },