@deftai/directive-core 0.79.0 → 0.79.2

package/dist/lifecycle/event.d.ts

@@ -0,0 +1,15 @@
+interface ParsedEmitInvocation {
+    readonly name: string;
+    readonly payload: Record<string, unknown>;
+    readonly log?: string;
+}
+/** Parse `emit <event> ...` argv for lifecycle:event approval recording. */
+export declare function parseEmitInvocation(args: readonly string[]): ParsedEmitInvocation;
+/** CLI entry for `lifecycle:event` / review-cycle approval recorder (#2631). */
+export declare function runLifecycleEvent(argv: readonly string[], options?: {
+    projectRoot?: string;
+}): number;
+/** Process entrypoint mirroring other lifecycle CLI modules. */
+export declare function main(argv?: readonly string[]): number;
+export {};
+//# sourceMappingURL=event.d.ts.map

package/dist/lifecycle/event.js

@@ -0,0 +1,163 @@
+import { resolve } from "node:path";
+import { emit, main as eventsMain, readEvents } from "./events.js";
+const APPROVAL_PHRASES = new Set(["yes", "confirmed", "approve", "other"]);
+function parseBooleanFlag(value) {
+    return ["1", "true", "yes"].includes(value.toLowerCase());
+}
+function repositoryFromPlanRef(planRef) {
+    const match = /^https?:\/\/github\.com\/([^/]+\/[^/]+)\/pull\/\d+/i.exec(planRef.trim());
+    return match?.[1];
+}
+function dedupeKey(payload) {
+    const planRef = payload.plan_ref;
+    const approver = payload.approver;
+    if (typeof planRef !== "string" || typeof approver !== "string") {
+        return null;
+    }
+    const parts = [planRef, approver];
+    if (typeof payload.pr_number === "number") {
+        parts.push(String(payload.pr_number));
+    }
+    if (typeof payload.head_sha === "string" && payload.head_sha.length > 0) {
+        parts.push(payload.head_sha);
+    }
+    return parts.join("|");
+}
+function findExistingPlanApproved(key, logPath) {
+    for (const record of readEvents(logPath)) {
+        if (record.event !== "plan:approved") {
+            continue;
+        }
+        if (dedupeKey(record.payload) === key) {
+            return record;
+        }
+    }
+    return null;
+}
+function validatePlanApprovedPayload(payload) {
+    const phrase = payload.approval_phrase;
+    if (phrase === undefined) {
+        return;
+    }
+    if (typeof phrase !== "string") {
+        throw new Error("approval_phrase must be a string");
+    }
+    const normalized = phrase.toLowerCase();
+    if (!APPROVAL_PHRASES.has(normalized)) {
+        throw new Error(`invalid approval_phrase '${phrase}'; expected one of yes, confirmed, approve, other`);
+    }
+}
+/** Parse `emit <event> ...` argv for lifecycle:event approval recording. */
+export function parseEmitInvocation(args) {
+    const payload = {};
+    let name;
+    let log;
+    let i = 0;
+    if (args.length > 0 && !args[0]?.startsWith("--")) {
+        name = args[0];
+        i = 1;
+    }
+    if (name === undefined) {
+        throw new Error("event name required");
+    }
+    while (i < args.length) {
+        const arg = args[i];
+        if (arg === "--payload") {
+            const raw = args[i + 1];
+            if (raw === undefined) {
+                throw new Error("--payload requires a value");
+            }
+            const data = JSON.parse(raw);
+            if (typeof data !== "object" || data === null || Array.isArray(data)) {
+                throw new Error("--payload must be a JSON object");
+            }
+            Object.assign(payload, data);
+            i += 2;
+            continue;
+        }
+        if (arg === "--log") {
+            log = args[i + 1];
+            i += 2;
+            continue;
+        }
+        const flagMap = {
+            "--plan-ref": "plan_ref",
+            "--approver": "approver",
+            "--approval-phrase": "approval_phrase",
+            "--head-sha": "head_sha",
+        };
+        if (arg === "--pr-number") {
+            payload.pr_number = Number.parseInt(args[i + 1] ?? "", 10);
+            i += 2;
+            continue;
+        }
+        const field = flagMap[arg ?? ""];
+        if (field !== undefined) {
+            payload[field] = args[i + 1];
+            i += 2;
+            continue;
+        }
+        if (arg === "--inline") {
+            payload.inline = parseBooleanFlag(args[i + 1] ?? "");
+            i += 2;
+            continue;
+        }
+        throw new Error(`unrecognized arguments: ${arg}`);
+    }
+    return { name, payload, log };
+}
+function enrichPlanApprovedPayload(payload) {
+    const next = { ...payload };
+    if (typeof next.plan_ref === "string" && next.repository === undefined) {
+        const repository = repositoryFromPlanRef(next.plan_ref);
+        if (repository !== undefined) {
+            next.repository = repository;
+        }
+    }
+    return next;
+}
+function emitPlanApprovedIdempotent(payload, options = {}) {
+    const enriched = enrichPlanApprovedPayload(payload);
+    validatePlanApprovedPayload(enriched);
+    const key = dedupeKey(enriched);
+    if (key !== null) {
+        const existing = findExistingPlanApproved(key, options.logPath ?? null);
+        if (existing !== null) {
+            return existing;
+        }
+    }
+    return emit("plan:approved", enriched, options);
+}
+/** CLI entry for `lifecycle:event` / review-cycle approval recorder (#2631). */
+export function runLifecycleEvent(argv, options = {}) {
+    if (options.projectRoot !== undefined) {
+        process.chdir(resolve(options.projectRoot));
+    }
+    if (argv.length === 0 || argv[0] === "-h" || argv[0] === "--help" || argv[0] === "help") {
+        process.stderr.write("usage: lifecycle:event emit plan:approved --plan-ref <url> --approver <login> " +
+            "[--approval-phrase yes|confirmed|approve] [--pr-number N] [--head-sha SHA]\n");
+        return argv.length === 0 ? 2 : 0;
+    }
+    if (argv[0] !== "emit") {
+        return eventsMain(argv);
+    }
+    if (argv[1] !== "plan:approved") {
+        return eventsMain(argv);
+    }
+    try {
+        const parsed = parseEmitInvocation(argv.slice(1));
+        const record = emitPlanApprovedIdempotent(parsed.payload, { logPath: parsed.log ?? null });
+        process.stdout.write(`${JSON.stringify(record)}\n`);
+        return 0;
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`lifecycle:event failed: ${message}\n`);
+        return 2;
+    }
+}
+/** Process entrypoint mirroring other lifecycle CLI modules. */
+export function main(argv = process.argv.slice(2)) {
+    return runLifecycleEvent(argv);
+}
+//# sourceMappingURL=event.js.map

package/dist/lifecycle/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./event.js";
 export * as eventDetect from "./event-detect.js";
 export * as events from "./events.js";
 export * as lifecycleHygiene from "./lifecycle-hygiene.js";

package/dist/lifecycle/index.js

@@ -1,3 +1,4 @@
+export * from "./event.js";
 export * as eventDetect from "./event-detect.js";
 export * as events from "./events.js";
 export * as lifecycleHygiene from "./lifecycle-hygiene.js";

package/dist/orchestration/verify-judgment-gates.js

@@ -3,8 +3,9 @@
  */
 import { execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { appendFileSync, existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
+import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { assertProjectionContained, assertWriteTargetSafe, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { resolveAuditDir } from "../layout/resolve.js";
 import { resolveJudgmentGates } from "./judgment-policy.js";
 import { matchAny } from "./pathspec.js";
@@ -163,7 +164,22 @@ export function readClearances(projectRoot, logPath) {
 }
 export function recordClearance(projectRoot, options) {
     const path = options.log_path ?? clearanceLogPath(projectRoot);
-    mkdirSync(resolveAuditDir(projectRoot), { recursive: true });
+    const auditDir = resolveAuditDir(projectRoot);
+    assertProjectionContained(projectRoot, auditDir);
+    assertWriteTargetSafe(projectRoot, path);
+    try {
+        const info = lstatSync(auditDir);
+        if (info.isSymbolicLink()) {
+            throw new ProjectionContainmentError(`projection write refused: audit directory ${auditDir} must not be a symlink`, { projectDir: resolve(projectRoot), targetPath: auditDir, offendingPath: auditDir });
+        }
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            throw err;
+        }
+        // Audit dir does not exist yet; mkdirSync below will create it under containment.
+    }
+    mkdirSync(auditDir, { recursive: true });
     const entry = {
         clearance_id: randomUUID(),
         timestamp: utcNowIso(options.now),

package/dist/pr-merge-readiness/compute.d.ts

@@ -1,9 +1,10 @@
 import type { CiGateOptions } from "./ci-gate.js";
 import { isMergeReady } from "./evaluate.js";
+import { type InlineGreptileFindings } from "./greptile-inline.js";
 import { type MergeabilitySignal } from "./mergeability.js";
 import type { SlizardGateOptions } from "./slizard-gate.js";
 import type { GateResult, RunGhFn } from "./types.js";
-declare function buildGateResult(prNumber: number, repo: string | null, headSha: string | null, body: string, via: string, partialData?: Record<string, unknown>, error?: string | null): GateResult;
+declare function buildGateResult(prNumber: number, repo: string | null, headSha: string | null, body: string, via: string, partialData?: Record<string, unknown>, error?: string | null, inline?: InlineGreptileFindings | null): GateResult;
 /** Injectable GitHub-mergeability read seam (#2260) — keeps unit tests hermetic. */
 export type FetchMergeabilityFn = (prNumber: number, repo: string, runGh: RunGhFn) => MergeabilitySignal;
 export interface ComputeGateOptions extends CiGateOptions, SlizardGateOptions {

package/dist/pr-merge-readiness/compute.js

@@ -2,12 +2,13 @@ import { buildCiSummaryLine, evaluateCiGate } from "./ci-gate.js";
 import { FALLBACK2_NOT_CLEAN_MSG, VIA_ERROR, VIA_FALLBACK1, VIA_FALLBACK2, VIA_PRIMARY, } from "./constants.js";
 import { evaluateGates, isMergeReady } from "./evaluate.js";
 import { fetchCheckRunsRest, fetchGreptileBodyRest, fetchGreptileCommentBody, fetchPrHeadSha, fetchPrHeadShaRest, resolveRepo, } from "./gh.js";
+import { fetchUnresolvedGreptileInlineFindings, inlineFindingsToDict, } from "./greptile-inline.js";
 import { fetchMergeability, isGithubMergeableClean, mergeabilityToDict, verdictBlockIsSoftOnly, verdictShaIsStale, } from "./mergeability.js";
 import { emptyVerdict, parseGreptileBody } from "./parse.js";
 import { evaluateSlizardGate, isSlizardCheck } from "./slizard-gate.js";
-function buildGateResult(prNumber, repo, headSha, body, via, partialData = {}, error = null) {
+function buildGateResult(prNumber, repo, headSha, body, via, partialData = {}, error = null, inline = null) {
     const verdict = parseGreptileBody(body);
-    const failures = evaluateGates(prNumber, headSha, verdict);
+    const failures = evaluateGates(prNumber, headSha, verdict, inline);
     return {
         prNumber,
         repo,
@@ -92,10 +93,24 @@ function applyCiGateForHead(repo, headSha, runGh, options) {
  * is only soft-blocked -- absent or stale for the current head) reconcile
  * against GitHub's own mergeability (#2260). Shared by primary + fallback1.
  */
+function loadInlineGreptileFindings(prNumber, repo, headSha, runGh) {
+    const resolved = resolveRepo(repo, runGh);
+    if (resolved.repo === null) {
+        return {
+            p0Count: 0,
+            p1Count: 0,
+            unresolvedThreadCount: 0,
+            error: resolved.error || "repo unresolved for inline reviewThreads lookup; pass --repo OWNER/REPO",
+        };
+    }
+    return fetchUnresolvedGreptileInlineFindings(prNumber, resolved.repo, headSha, runGh);
+}
 function finalizeVerdictGate(prNumber, repo, headSha, verdict, runGh, options) {
-    const failures = evaluateGates(prNumber, headSha, verdict);
     const partialData = {};
     const resolved = resolveRepo(repo, runGh);
+    const inline = loadInlineGreptileFindings(prNumber, repo, headSha, runGh);
+    partialData.greptile_inline = inlineFindingsToDict(inline);
+    const failures = evaluateGates(prNumber, headSha, verdict, inline);
     if (failures.length === 0) {
         const ci = applyCiGateForHead(resolved.repo, headSha, runGh, options);
         failures.push(...ci.failures);
@@ -108,7 +123,7 @@ function finalizeVerdictGate(prNumber, repo, headSha, verdict, runGh, options) {
     // blocking. Only reconcile a SOFT block (verdict absent / stale head SHA).
     if (options.disableMergeabilityReconcile === true ||
         resolved.repo === null ||
-        !verdictBlockIsSoftOnly(verdict, headSha)) {
+        !verdictBlockIsSoftOnly(verdict, headSha, inline)) {
         return { failures, partialData };
     }
     const ci = applyCiGateForHead(resolved.repo, headSha, runGh, options);
@@ -143,17 +158,19 @@ function computePrimary(prNumber, repo, runGh, options) {
         return { result: null, partial };
     }
     partial.head_sha = headSha;
+    const resolved = resolveRepo(repo, runGh);
+    const effectiveRepo = resolved.repo ?? repo;
     const body = fetchGreptileCommentBody(prNumber, repo, runGh);
     if (body === null) {
         partial.primary_error = "gh api /issues/<N>/comments --jq returned non-zero";
         return { result: null, partial };
     }
     const verdict = parseGreptileBody(body);
-    const { failures, partialData } = finalizeVerdictGate(prNumber, repo, headSha, verdict, runGh, options);
+    const { failures, partialData } = finalizeVerdictGate(prNumber, effectiveRepo, headSha, verdict, runGh, options);
     return {
         result: {
             prNumber,
-            repo,
+            repo: effectiveRepo,
             headSha,
             verdict,
             failures,

package/dist/pr-merge-readiness/evaluate.d.ts

@@ -1,5 +1,6 @@
+import type { InlineGreptileFindings } from "./greptile-inline.js";
 import type { GreptileVerdict } from "./types.js";
 /** Return failure messages (empty list == merge-ready). */
-export declare function evaluateGates(_prNumber: number, headSha: string | null, verdict: GreptileVerdict): string[];
+export declare function evaluateGates(_prNumber: number, headSha: string | null, verdict: GreptileVerdict, inline?: InlineGreptileFindings | null): string[];
 export declare function isMergeReady(failures: readonly string[]): boolean;
 //# sourceMappingURL=evaluate.d.ts.map

package/dist/pr-merge-readiness/evaluate.js

@@ -1,6 +1,6 @@
 import { INFORMAL_CLEAN_DIAGNOSTIC } from "./constants.js";
 /** Return failure messages (empty list == merge-ready). */
-export function evaluateGates(_prNumber, headSha, verdict) {
+export function evaluateGates(_prNumber, headSha, verdict, inline = null) {
     const failures = [];
     if (!verdict.found) {
         failures.push("No Greptile rolling-summary comment found on the PR. " +
@@ -8,40 +8,55 @@ export function evaluateGates(_prNumber, headSha, verdict) {
             "Wait for the review to land before merging (see #796 late-bot-review re-check).");
         return failures;
     }
-    if (verdict.excludedAuthor) {
-        return failures;
-    }
-    if (verdict.errored) {
-        failures.push("Greptile review is in the ERRORED state on the current HEAD (#526). " +
-            "Retry via @greptileai or escalate per " +
-            "skills/deft-directive-swarm/SKILL.md Phase 6 Step 1.");
+    if (!verdict.excludedAuthor) {
+        if (verdict.errored) {
+            failures.push("Greptile review is in the ERRORED state on the current HEAD (#526). " +
+                "Retry via @greptileai or escalate per " +
+                "skills/deft-directive-swarm/SKILL.md Phase 6 Step 1.");
+        }
+        if (verdict.informalClean) {
+            failures.push(INFORMAL_CLEAN_DIAGNOSTIC);
+            return appendInlineFailures(failures, inline);
+        }
+        if (verdict.lastReviewedSha === null) {
+            failures.push("Could not parse `Last reviewed commit:` from Greptile body. " +
+                "The comment may be malformed or Greptile may still be writing it -- re-fetch.");
+        }
+        else if (headSha &&
+            !(headSha.startsWith(verdict.lastReviewedSha) || verdict.lastReviewedSha.startsWith(headSha))) {
+            failures.push(`Greptile last reviewed ${verdict.lastReviewedSha} but PR HEAD is ${headSha}. ` +
+                "Review is stale -- wait for Greptile to re-review the latest commit.");
+        }
+        if (verdict.confidence === null) {
+            failures.push("Could not parse `Confidence Score: X/5` from Greptile body. " +
+                "Confidence is a required exit-condition input per " +
+                "skills/deft-directive-review-cycle/SKILL.md Phase 2 Step 6.");
+        }
+        else if (verdict.confidence <= 3) {
+            failures.push(`Greptile confidence is ${verdict.confidence}/5; exit condition requires > 3. ` +
+                "Address remaining findings or push clarifying changes.");
+        }
+        if (verdict.p0Count > 0 || verdict.p1Count > 0) {
+            failures.push(`Greptile reports ${verdict.p0Count} P0 and ${verdict.p1Count} P1 findings ` +
+                "on the current HEAD. All P0 / P1 findings MUST be addressed before merge " +
+                "(P2 findings are non-blocking).");
+        }
     }
-    if (verdict.informalClean) {
-        failures.push(INFORMAL_CLEAN_DIAGNOSTIC);
+    return appendInlineFailures(failures, inline);
+}
+function appendInlineFailures(failures, inline) {
+    if (inline === null) {
         return failures;
     }
-    if (verdict.lastReviewedSha === null) {
-        failures.push("Could not parse `Last reviewed commit:` from Greptile body. " +
-            "The comment may be malformed or Greptile may still be writing it -- re-fetch.");
-    }
-    else if (headSha &&
-        !(headSha.startsWith(verdict.lastReviewedSha) || verdict.lastReviewedSha.startsWith(headSha))) {
-        failures.push(`Greptile last reviewed ${verdict.lastReviewedSha} but PR HEAD is ${headSha}. ` +
-            "Review is stale -- wait for Greptile to re-review the latest commit.");
-    }
-    if (verdict.confidence === null) {
-        failures.push("Could not parse `Confidence Score: X/5` from Greptile body. " +
-            "Confidence is a required exit-condition input per " +
-            "skills/deft-directive-review-cycle/SKILL.md Phase 2 Step 6.");
-    }
-    else if (verdict.confidence <= 3) {
-        failures.push(`Greptile confidence is ${verdict.confidence}/5; exit condition requires > 3. ` +
-            "Address remaining findings or push clarifying changes.");
+    if (inline.error !== null) {
+        failures.push("Could not verify Greptile inline review comments on the current HEAD (#2620). " +
+            `Root cause: ${inline.error}`);
     }
-    if (verdict.p0Count > 0 || verdict.p1Count > 0) {
-        failures.push(`Greptile reports ${verdict.p0Count} P0 and ${verdict.p1Count} P1 findings ` +
-            "on the current HEAD. All P0 / P1 findings MUST be addressed before merge " +
-            "(P2 findings are non-blocking).");
+    else if (inline.p0Count > 0 || inline.p1Count > 0) {
+        failures.push(`Greptile has ${inline.p0Count} unresolved inline P0 and ${inline.p1Count} unresolved inline P1 ` +
+            `review comment(s) on the current HEAD across ${inline.unresolvedThreadCount} open thread(s). ` +
+            "Resolve or address all blocking inline threads before merge -- rolling-summary badge counts alone " +
+            "are insufficient (#2620).");
     }
     return failures;
 }

package/dist/pr-merge-readiness/greptile-inline.d.ts

@@ -0,0 +1,27 @@
+import type { RunGhFn } from "./types.js";
+/** Unresolved Greptile inline P0/P1 on the current PR HEAD (#2620). */
+export interface InlineGreptileFindings {
+    readonly p0Count: number;
+    readonly p1Count: number;
+    readonly unresolvedThreadCount: number;
+    readonly error: string | null;
+}
+export interface InlineReviewComment {
+    readonly authorLogin: string;
+    readonly body: string;
+    readonly path: string | null;
+    readonly commitOid: string | null;
+}
+export interface InlineReviewThread {
+    readonly isResolved: boolean;
+    readonly isOutdated: boolean;
+    readonly comments: readonly InlineReviewComment[];
+}
+/** True when a review comment commit SHA matches the current PR head (#2620 AC-2). */
+export declare function headShaMatches(commentSha: string, headSha: string): boolean;
+export declare function inlineFindingsToDict(findings: InlineGreptileFindings): Record<string, unknown>;
+/** Score unresolved Greptile inline P0/P1 threads pinned to the current HEAD (#2620). */
+export declare function evaluateInlineReviewThreads(threads: readonly InlineReviewThread[], headSha: string): InlineGreptileFindings;
+/** Fetch unresolved Greptile inline P0/P1 on the current HEAD via reviewThreads GraphQL (#2620). */
+export declare function fetchUnresolvedGreptileInlineFindings(prNumber: number, repo: string, headSha: string, runGh: RunGhFn): InlineGreptileFindings;
+//# sourceMappingURL=greptile-inline.d.ts.map