@cspeach/cli 1.1.27 → 1.1.29

package/dist/commands/plan-batch-audit.js

@@ -0,0 +1,349 @@
+// cspeach-cli/src/commands/plan-batch-audit.ts
+//
+// 2026-10-04 (continuous run, spec §3.4) — the independent audit runs ONCE,
+// after the last step (or over the steps done when a run stops early). Each
+// step is judged against its own evidence window [attemptStartedAt,
+// attemptEndedAt). Quiet: one line, no token counters, no timers, retries
+// silent (they live inside runPhaseAudit). An audit that cannot run leaves the
+// step 'pending' — "not independently checked yet" — and the next resume runs it.
+import { readProjectFile } from '../projects/status.js';
+import { parsePlanContent } from '../projects/plan-schema.js';
+import { phaseDisplayTitle } from '../projects/plan-run.js';
+import { runPhaseAudit } from './plan-audit.js';
+import { applyAuditResult, applyPhaseResolution } from './plan-resume.js';
+import { getGlyphs } from '../renderer/glyphs.js';
+import { paint } from '../renderer/theme.js';
+import { clean } from '../renderer/tool-labels.js';
+import { sanitizeControlChars } from '../renderer/sanitize.js';
+import { appendCostLine, buildEntry } from '../cost/cost-log.js';
+import { turnStatusEmitter } from '../ui/turn-status-emitter.js';
+/** The one pending scan lives in plan-run.ts; re-exported for the batch callers. */
+export { pendingAuditPhaseIds } from '../projects/plan-run.js';
+/** Two consecutive failed verdicts on the same phase force status 'blocked'. */
+export const MAX_CONSECUTIVE_AUDIT_FAILURES = 2;
+function load(path) {
+    try {
+        const envelope = readProjectFile(path);
+        const pc = parsePlanContent(envelope.content);
+        return pc.ok ? { envelope, content: pc.content } : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** One line on screen; the status row carries the "(step i of n)" count. */
+function defaultProgress(log) {
+    let started = false;
+    return {
+        update(text) {
+            if (!started) {
+                log('', paint('dim', 'Checking the work independently…'));
+                turnStatusEmitter.start(text);
+                started = true;
+            }
+            else {
+                turnStatusEmitter.activity(text);
+            }
+        },
+        done() {
+            if (started)
+                turnStatusEmitter.stop();
+        },
+    };
+}
+function recordCost(sessionId, cost) {
+    try {
+        void appendCostLine(sessionId, {
+            ...buildEntry({ turn: 0, model: cost.model, tokens: cost.tokens, duration_ms: cost.durationMs }),
+            label: 'audit',
+        });
+    }
+    catch {
+        // observability only — never on screen (spec §3.4: no token counters)
+    }
+}
+/**
+ * The evidence window for one step. Both ends, or only the start (an older
+ * record with no save moment). An end WITHOUT a start passes no window at
+ * all: an until-only window would hide later rows yet still admit every
+ * earlier phase's evidence, so the whole session is the honest fallback.
+ */
+function windowOf(audit) {
+    if (!audit?.attemptStartedAt)
+        return {};
+    return {
+        sinceIso: audit.attemptStartedAt,
+        ...(audit.attemptEndedAt ? { untilIso: audit.attemptEndedAt } : {}),
+    };
+}
+/** The finding text without its auditor tag ("[B1] ", "[BLOCK] "). */
+function findingText(f) {
+    return clean(f).replace(/^\[[A-Z0-9_-]+\]\s*/, '');
+}
+/** F32 — the suggested fix names THIS step and what its own check found. */
+function suggestedFix(title, findings) {
+    if (findings.length === 0)
+        return `Suggested fix: run ${title} again; it is redone and checked again.`;
+    const first = findingText(findings[0]);
+    if (findings.length === 1)
+        return `Suggested fix: run ${title} again so it fixes this: ${first}`;
+    return `Suggested fix: run ${title} again so it fixes the ${findings.length} points above, starting with: ${first}`;
+}
+export async function runBatchAudit(args) {
+    const res = { path: args.savedPath, confirmed: [], failed: [], blocked: [], notChecked: [], rerun: false };
+    if (args.phaseIds.length === 0)
+        return res;
+    const auditFn = args.deps?.runPhaseAuditFn ?? runPhaseAudit;
+    const progress = args.deps?.progress ?? defaultProgress(args.log);
+    const total = args.phaseIds.length;
+    const findingsById = new Map();
+    const notesById = new Map();
+    try {
+        for (let i = 0; i < total; i++) {
+            const id = args.phaseIds[i];
+            const loaded = load(res.path);
+            if (!loaded) {
+                // The plan file cannot be read back: nothing more can be judged or
+                // written. The rest are not independently checked yet.
+                res.notChecked.push(...args.phaseIds.slice(i));
+                break;
+            }
+            const phase = loaded.content.phases.find((p) => p.id === id);
+            if (!phase)
+                continue;
+            const state = phase.audit?.state;
+            if (!args.force && state !== 'pending' && state !== 'failed')
+                continue;
+            progress.update(`Checking the work independently… (step ${i + 1} of ${total})`);
+            const verdict = await auditFn({
+                envelope: loaded.envelope,
+                phaseId: id,
+                sessionId: phase.audit?.sessionId ?? args.sessionId,
+                cwd: args.cwd,
+                ...windowOf(phase.audit),
+                onCost: (c) => recordCost(args.sessionId, c),
+            });
+            if (verdict.state === 'infra_failed') {
+                // The check could not run: write nothing. 'pending' stays on disk —
+                // "not independently checked yet" — and the next resume runs it.
+                res.notChecked.push(id);
+                continue;
+            }
+            // A persisted 'failed' (or an infra_failed that carries a failure
+            // count) re-judged here is the SAME failure — the step never re-ran —
+            // so the counter holds instead of climbing (plan-chain's rule).
+            const prior = phase.audit?.consecutiveFailures ?? 0;
+            const reconfirming = state === 'failed' || (state === 'infra_failed' && prior >= 1);
+            const counted = reconfirming ? Math.max(prior, 1) : prior + 1;
+            const forceBlock = verdict.state === 'failed' && counted >= MAX_CONSECUTIVE_AUDIT_FAILURES;
+            res.path = await applyAuditResult(res.path, id, { state: verdict.state, findings: verdict.findings }, {
+                ...(verdict.state === 'failed'
+                    ? { lastStop: { phaseId: id, reason: 'audit-failed', detail: (verdict.findings[0] ?? '').slice(0, 200), at: new Date().toISOString() } }
+                    : {}),
+                ...(forceBlock ? { statusOverride: 'blocked' } : {}),
+                ...(reconfirming ? { reconfirmedFailure: true } : {}),
+                log: args.log,
+            });
+            if (verdict.state === 'failed') {
+                (forceBlock ? res.blocked : res.failed).push(id);
+                findingsById.set(id, verdict.findings);
+            }
+            else {
+                res.confirmed.push(id);
+                if (verdict.state === 'warn')
+                    notesById.set(id, verdict.findings);
+            }
+        }
+    }
+    finally {
+        progress.done();
+    }
+    const after = load(res.path);
+    const phases = after?.content.phases ?? [];
+    const titleOf = (id) => {
+        const p = phases.find((q) => q.id === id);
+        // Never a raw phase id on screen: a plain fallback when the plan cannot be read.
+        return p ? sanitizeControlChars(phaseDisplayTitle(p, phases)) : 'a step';
+    };
+    const g = getGlyphs();
+    // F7 — the "all confirmed" line only when this pass really confirmed a step;
+    // a pass that checked nothing prints nothing.
+    const allClear = res.failed.length === 0 && res.blocked.length === 0 && res.notChecked.length === 0;
+    if (res.confirmed.length > 0) {
+        if (allClear) {
+            const n = res.confirmed.length;
+            args.log(paint('ok', `${g.done} Independent check: all ${n} step${n === 1 ? '' : 's'} confirmed.`));
+        }
+        else {
+            args.log(paint('ok', `${g.done} Independent check confirmed: ${res.confirmed.map(titleOf).join(', ')}.`));
+        }
+    }
+    for (const [id, notes] of notesById) {
+        args.log(paint('warn', `${g.attention} ${titleOf(id)} — notes from the check:`));
+        notes.forEach((n, i) => args.log(`  ${i + 1}. ${clean(n)}`));
+    }
+    if (res.notChecked.length > 0) {
+        args.log(paint('warn', `${g.attention} The independent check could not run for: ${res.notChecked.map(titleOf).join(', ')}. `
+            + 'The build is done; these steps are not independently checked yet — CSPeach checks them on the next resume.'));
+    }
+    /** What the check found for one step, then that step's own suggested fix. */
+    const showMissing = (id, title) => {
+        const findings = findingsById.get(id) ?? [];
+        args.log('', paint('bad', `${g.failed} ${title} — what is missing:`));
+        (findings.length > 0 ? findings : ['(the check gave no detail)']).forEach((f, i) => args.log(`  ${i + 1}. ${clean(f)}`));
+        args.log(paint('dim', `  ${suggestedFix(title, findings)}`));
+        return findings;
+    };
+    for (const id of res.blocked) {
+        const title = titleOf(id);
+        showMissing(id, title);
+        args.log(paint('bad', `${g.failed} ${title} failed its independent check twice in a row — marked blocked.`));
+    }
+    const select = args.deps?.selectFailureAction ?? defaultSelectFailureAction;
+    for (const id of res.failed) {
+        const title = titleOf(id);
+        const findings = showMissing(id, title);
+        const action = await select({ phaseId: id, title, findings });
+        if (action === 'rerun') {
+            res.path = await applyPhaseResolution(res.path, id, {
+                status: 'todo', summary: `audit ${id}: failed — user chose re-run (status → todo)`, log: args.log,
+            });
+            res.rerun = true;
+        }
+        else if (action === 'blocked') {
+            res.path = await applyPhaseResolution(res.path, id, {
+                status: 'blocked',
+                lastStop: { phaseId: id, reason: 'audit-failed', detail: 'user marked the phase blocked after a failed audit', at: new Date().toISOString() },
+                summary: `audit ${id}: failed — user marked phase blocked`, log: args.log,
+            });
+        }
+        else if (action === 'waive') {
+            const reasonRaw = (await args.prompt(`Why waive the check for ${title}? (one line): `)).trim();
+            const reason = reasonRaw.length > 0 ? reasonRaw : 'waived by user (no reason given)';
+            const category = await (args.deps?.selectWaiveCategory ?? defaultSelectWaiveCategory)({ phaseId: id, title });
+            res.path = await applyAuditResult(res.path, id, { state: 'waived', waivedReason: reason, waiveCategory: category }, { log: args.log });
+            args.log(paint('dim', `${g.info} Check waived for ${title} (${category}) — reason recorded in the plan file.`));
+        }
+        // 'none' (headless / cancelled): fail closed — the failure stays recorded;
+        // the next resume re-checks it and asks again.
+    }
+    return res;
+}
+/**
+ * Shared menu surface for the plan-run selects (audit resolution, and the
+ * failed-check stop card in plan-chain.ts). Mirrors safety-confirm.ts:
+ * headless → no decision ('none': fail-closed, nothing written); Ink →
+ * confirm card via askConfirm (piece 2 §5); classic → inquirer select.
+ */
+export async function selectPlanCardAction(args) {
+    const { isHeadless, shouldUseInk } = await import('../renderer/tty.js');
+    if (isHeadless())
+        return 'none';
+    if (shouldUseInk()) {
+        // D-C — this card opens in the POST-PHASE chain. A leaked keystroke used
+        // to auto-select choice 1 ("Re-run phase") and silently re-run the
+        // phase. The card slot claims input focus (spinner stopped, status row
+        // paused, restored after), digits only move the cursor, and typed-ahead
+        // keys are dropped — so no stray key can pick a choice.
+        const { askConfirm } = await import('../ui/confirm-request.js');
+        const res = await askConfirm({
+            id: args.id,
+            tag: args.tag ?? 'SAFETY CHECK',
+            title: args.question,
+            facts: args.facts,
+            choices: args.choices,
+            initial: 0,
+            footnote: args.footnote ?? 'Plan audit',
+        });
+        if (res.cancelled || res.value == null)
+            return 'none';
+        return coerceAction(res.value, args.choices);
+    }
+    const { select } = await import('@inquirer/prompts');
+    const { withInquirer } = await import('../repl/inquirer-guard.js');
+    const { inquirerTheme } = await import('../repl/inquirer-theme.js');
+    const picked = await withInquirer(() => select({
+        message: args.question,
+        theme: inquirerTheme,
+        choices: args.choices.map((c) => ({ value: c.value, name: c.label })),
+    }));
+    return coerceAction(picked, args.choices);
+}
+/**
+ * D-C — fail CLOSED on any answer that is not one of this menu's own choice
+ * values. `'' ?? 'none'` did NOT catch an empty-string answer (nullish
+ * coalescing only guards null/undefined), so a stray/blank answer used to fall
+ * through the runPostPhaseChain switch to a silent default. Anything the menu
+ * did not explicitly offer maps to 'none' (stop, no auto-action).
+ */
+function coerceAction(answer, choices) {
+    return choices.some((c) => c.value === answer) ? answer : 'none';
+}
+/** Production failed-verdict menu (see selectPlanCardAction for the surface).
+ *  The findings are already printed above by renderFindings; the card
+ *  repeats only the count and the first three. */
+export async function defaultSelectFailureAction(a) {
+    const n = a.findings.length;
+    const facts = [
+        `${n} ${n === 1 ? 'finding' : 'findings'}, listed above`,
+        // Findings are model text: display-clean them at the source (ANSI and
+        // control characters out, one line each), like the safety-card rows.
+        ...a.findings.slice(0, 3).map((f, i) => `${i + 1}. ${clean(f)}`),
+    ];
+    if (n > 3)
+        facts.push(`${getGlyphs().more} ${n - 3} more`);
+    return selectPlanCardAction({
+        id: 'plan-audit-failed',
+        question: `${a.title ?? a.phaseId} failed its independent check — what now?`,
+        facts,
+        choices: [
+            { value: 'rerun', label: 'Fix it now (CSPeach re-runs this step; it is checked again after)' },
+            { value: 'waive', label: 'Waive the check (record a one-line reason)' },
+            { value: 'blocked', label: 'Mark this step blocked' },
+        ],
+    });
+}
+/**
+ * §10 Q2 (audit-confidence redesign) — production waive-category menu. A LIGHT
+ * 2-choice shown right after the waive-reason prompt so the audit's real
+ * false-positive rate is measurable. Same surface as selectPlanCardAction, but
+ * headless / cancel / stray answer → 'accepted-risk' (the CONSERVATIVE default:
+ * a waive no human explicitly labelled a false-positive is recorded as
+ * accepted-risk, so the measured FP rate never over-counts). Never hangs.
+ */
+/** Exported for the piece-2 behaviour pins (plan-chain-focus-pin.test.ts). */
+export async function defaultSelectWaiveCategory(a) {
+    const { isHeadless, shouldUseInk } = await import('../renderer/tty.js');
+    if (isHeadless())
+        return 'accepted-risk';
+    const question = `Waiving the check for ${a.title ?? a.phaseId} — why? (measures how often the check is wrong)`;
+    const choices = [
+        { value: 'accepted-risk', label: 'Accepted risk — the finding is real, I accept it and proceed' },
+        { value: 'false-positive', label: 'False positive — the audit was wrong, the work is actually fine' },
+    ];
+    const coerce = (answer) => choices.some((c) => c.value === answer) ? answer : 'accepted-risk';
+    if (shouldUseInk()) {
+        // Same input-focus discipline as selectPlanCardAction (askConfirm).
+        const { askConfirm } = await import('../ui/confirm-request.js');
+        const res = await askConfirm({
+            id: 'plan-waive-category',
+            tag: 'QUESTION',
+            title: question,
+            choices,
+            initial: 0,
+            footnote: 'Plan audit',
+        });
+        if (res.cancelled || res.value == null)
+            return 'accepted-risk';
+        return coerce(res.value);
+    }
+    const { select } = await import('@inquirer/prompts');
+    const { withInquirer } = await import('../repl/inquirer-guard.js');
+    const { inquirerTheme } = await import('../repl/inquirer-theme.js');
+    const picked = await withInquirer(() => select({
+        message: question,
+        theme: inquirerTheme,
+        choices: choices.map((c) => ({ value: c.value, name: c.label })),
+    }));
+    return coerce(picked);
+}

package/dist/commands/plan-boundary.js

@@ -0,0 +1,88 @@
+import { saveSession } from '../session/store.js';
+import { formatInfo } from '../renderer/notice-shape.js';
+import { recordFullNotice } from '../renderer/notice-log.js';
+import { paint } from '../renderer/theme.js';
+import { backupBeforeCompact, buildSummarisationPrompt, serialiseForSummariser, } from './compact.js';
+import { maybeAutoCompact } from './auto-compact.js';
+import { summariseViaProvider } from '../agent/summarise-via-provider.js';
+import { resetContextForPlanResume } from './plan-resume.js';
+export function buildPhaseBoundaryPrompt() {
+    return [
+        buildSummarisationPrompt(),
+        '',
+        'THIS IS A PLAN STEP BOUNDARY. The next turn runs the next step of the same plan.',
+        'Also keep, word for word where short: every answer the developer gave (spec gaps, decisions),',
+        'the package and transport, the name of every SAP object created or changed and whether it is active,',
+        'and anything the developer asked to do differently. The plan file holds statuses; you hold the reasons.',
+    ].join('\n');
+}
+export function buildPhaseBoundaryMessage(summary) {
+    return {
+        role: 'user',
+        content: [
+            '[Summary of the earlier steps of this plan, written by CSPeach at a step boundary.',
+            'The plan state and the spec-gap answers in the next message are authoritative.]',
+            '',
+            summary.trim(),
+        ].join('\n'),
+    };
+}
+export async function compactAtPhaseBoundary(session, summarise) {
+    if (session.messages.length === 0)
+        return { performed: false };
+    // Summarise FIRST; the session is untouched until a usable summary exists.
+    const summary = await summarise(session.messages);
+    if (!summary || summary.trim().length === 0)
+        throw new Error('the summary came back empty');
+    const backupPath = await backupBeforeCompact(session);
+    session.messages = [buildPhaseBoundaryMessage(summary)];
+    delete session.last_context_tokens;
+    await saveSession(session);
+    return { performed: true, backupPath };
+}
+export async function beginPlanPhaseContext(a) {
+    if (a.session.messages.length === 0)
+        return 'empty';
+    try {
+        const r = await compactAtPhaseBoundary(a.session, a.summarise);
+        if (r.performed) {
+            a.log(formatInfo('Earlier steps summarised · your answers and decisions carry on').trimEnd());
+            return 'compacted';
+        }
+    }
+    catch (err) {
+        // Task 13 — a fixed plain line; the error detail goes to the session log only.
+        recordFullNotice('plan', `step-boundary summary failed: ${err instanceof Error ? err.message : String(err)}`);
+        a.log(paint('dim', 'Could not summarise the earlier steps. This step starts fresh; the plan file keeps everything.'));
+    }
+    resetContextForPlanResume(a.session);
+    return 'reset';
+}
+// Controller ruling F3 — every provider rebuilds the `system` prompt from the
+// skill named in X-CSForge-Skill (here: compact), so the client's `system`
+// never reaches the model. The `system` arg stays the same as the /compact
+// path; anything EXTRA the summary must keep travels in the USER content,
+// ahead of the serialised conversation.
+const COMPACT_CALL = {
+    maxTokens: 4000,
+    headers: { 'X-CSForge-Skill': 'compact', 'X-CSPeach-Model-Role': 'compact' },
+};
+export function makePhaseBoundarySummariser(provider, model) {
+    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), buildPhaseBoundaryPrompt() + '\n\n' + serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers } });
+}
+/** The standard /compact summarisation (the compact skill carries the instructions). */
+export function makeAutoCompactSummariser(provider, model) {
+    return (msgs) => summariseViaProvider(provider, buildSummarisationPrompt(), serialiseForSummariser(msgs), { model, maxTokens: COMPACT_CALL.maxTokens, headers: { ...COMPACT_CALL.headers } });
+}
+/** Auto-compact after a plan turn whose revision is already saved and that queued no next step. */
+export async function maybeAutoCompactAfterPlanTurn(a) {
+    if (a.queued)
+        return;
+    await maybeAutoCompact({
+        session: a.session,
+        config: a.config,
+        turnNumber: a.session.turn_seq ?? 0,
+        summarise: a.summarise,
+        emit: a.emit,
+    });
+}