@dev-loops/core 0.9.0 → 1.0.0-rc.2

package/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@dev-loops/core",
-  "version": "0.9.0",
+  "version": "1.0.0-rc.2",
   "type": "module",
   "engines": {
     "node": ">=24"
   },
   "description": "Shared deterministic support package for dev-loop skills, repo-local scripts, and GitHub automation.",
   "exports": {
+    "./analysis/diff-analyzer": "./src/analysis/diff-analyzer.mjs",
     "./bash-exit-one": "./src/bash-exit-one.mjs",
     "./cli/helpers": "./src/cli/helpers.mjs",
     "./cli/primitives": "./src/cli/primitives.mjs",
@@ -28,6 +29,7 @@
     "./loop/copilot-ci-status": "./src/loop/copilot-ci-status.mjs",
     "./loop/copilot-loop-iterations": "./src/loop/copilot-loop-iterations.mjs",
     "./loop/copilot-loop-state": "./src/loop/copilot-loop-state.mjs",
+    "./loop/gate-carry-forward": "./src/loop/gate-carry-forward.mjs",
     "./loop/gate-fanin": "./src/loop/gate-fanin.mjs",
     "./loop/handoff-envelope": "./src/loop/handoff-envelope.mjs",
     "./loop/lifecycle-state": "./src/loop/lifecycle-state.mjs",

package/src/analysis/change-classifier.mjs

@@ -18,6 +18,10 @@ export const ChangeCategory = Object.freeze({
   CI_ONLY: "CI_ONLY",
   COMMENT_ONLY: "COMMENT_ONLY",
   LOGIC_CHANGE: "LOGIC_CHANGE",
+  // #1336: the diff touches a security-sensitive seam (browser automation,
+  // child_process/shell exec, untrusted network fetch, destructive filesystem
+  // ops / local-file upload). Triggers an up-front adversarial threat-model angle.
+  SECURITY_SENSITIVE_SEAM: "SECURITY_SENSITIVE_SEAM",
 });
 
 // ---------------------------------------------------------------------------
@@ -32,7 +36,7 @@ export const ChangeCategory = Object.freeze({
  *
  * @type {Record<string, string[]>}
  */
-const CATEGORY_ANGLE_MAP = {
+export const CATEGORY_ANGLE_MAP = {
   [ChangeCategory.RENAME_ONLY]: [
     "scope", "correctness", "contract-surface", "docs", "link-check",
   ],
@@ -54,8 +58,16 @@ const CATEGORY_ANGLE_MAP = {
   // Core review subset for any non-trivial code change. Peripheral lenses
   // (ci-guard, link-check, packaging-runtime, config-drift, etc.) are pulled in
   // only when the diff's other categories implicate them, not by logic alone.
+  // input-validation is included (#1336): it was pool-only and never auto-
+  // recommended, so entrypoint/input drift went unreviewed unless hand-picked.
   [ChangeCategory.LOGIC_CHANGE]: [
-    "scope", "correctness", "coverage", "determinism", "contract-surface",
+    "scope", "correctness", "coverage", "determinism", "contract-surface", "input-validation",
+  ],
+  // #1336: security-sensitive seam → up-front adversarial threat-model, plus
+  // input-validation and the core correctness/scope lenses. threat-model is
+  // never dropped for such a diff (a seam is dangerous regardless of size).
+  [ChangeCategory.SECURITY_SENSITIVE_SEAM]: [
+    "threat-model", "input-validation", "scope", "correctness",
   ],
 };
 
@@ -64,7 +76,7 @@ const CATEGORY_ANGLE_MAP = {
  *
  * @type {Set<string>}
  */
-const ALWAYS_INCLUDE = new Set(["gate-evidence", "renderer-security", "pr-description"]);
+export const ALWAYS_INCLUDE = new Set(["gate-evidence", "renderer-security", "pr-description"]);
 
 // ---------------------------------------------------------------------------
 // Resolution

package/src/analysis/diff-analyzer.mjs

@@ -68,9 +68,10 @@ export function analyzeT0(nameStatusOutput) {
   }
 
   const renameOnly = lines.length > 0 && renameCount === lines.length;
-  const allDocs = lines.length > 0 && files.every(
-    (f) => normalizeSep(f).startsWith("docs/") || f.endsWith(".md") || f === "README.md",
-  );
+  // Derive from the shared classifier so this predicate can't drift from it: a
+  // code/config/test file hosted under docs/ is not prose, so a mixed diff that
+  // includes one is not docs-only (it still gets the code-review surface).
+  const allDocs = lines.length > 0 && files.every((f) => classifyFile(f) === "docs");
 
   return {
     files,
@@ -96,9 +97,9 @@ export function classifyFile(filePath) {
   if (fp.startsWith(".github/")) {
     return "ci";
   }
-  if (fp.startsWith("docs/") || fp.endsWith(".md") || fp === "README.md") {
-    return "docs";
-  }
+  // A known code/config/test extension wins over the docs/ directory-prefix
+  // fallback: a code/config/test file hosted under docs/ is still that surface,
+  // not prose. Extension checks run before the prefix fallbacks below.
   if (
     fp.endsWith(".yml") || fp.endsWith(".yaml") ||
     fp.endsWith(".json") || fp === "package.json"
@@ -114,6 +115,9 @@ export function classifyFile(filePath) {
   ) {
     return "code";
   }
+  if (fp.startsWith("docs/") || fp.endsWith(".md") || fp === "README.md") {
+    return "docs";
+  }
   return "unknown";
 }
 // ---------------------------------------------------------------------------
@@ -142,6 +146,97 @@ function isNonLogicLine(content) {
   return false;
 }
 
+// Security-sensitive seams (#1336): touching these primitives on caller-/plan-
+// influenced input is where trust-boundary bugs concentrate (drove #1335's 8
+// serial Copilot rounds). A changed line matching any of these triggers the
+// SECURITY_SENSITIVE_SEAM category so an up-front adversarial threat-model angle
+// is selected. Fail-safe by design — over-selection just adds one review lens.
+// Plain readFile/writeFile are deliberately excluded (ubiquitous JSON I/O would
+// flag nearly every script diff); the browser/process/network/destructive-fs/
+// upload seams below cover the genuinely dangerous surface, including #1335's
+// Playwright driver.
+const SECURITY_SEAM_PATTERNS = [
+  // Browser automation (driving a real browser over semi-trusted navigation)
+  /\b(playwright|webkit|chromium|puppeteer)\b/i,
+  /\bpage\.(goto|click|fill|evaluate|type|press|selectOption|setInputFiles|route|addInitScript)\b/,
+  /\.newPage\s*\(/,
+  /\bbrowser\.newContext\b/,
+  // Child-process / shell execution
+  /\bchild_process\b/,
+  /\b(exec|execSync|execFile|execFileSync|spawn|spawnSync)\s*\(/,
+  /\bshell\s*:\s*true\b/,
+  // Untrusted network fetch
+  /\bfetch\s*\(/,
+  /\bhttps?\.(get|request)\s*\(/,
+  /\b(axios|node-fetch|undici)\b/,
+  // Destructive filesystem ops + local-file upload (caller-path removal/read)
+  /\b(rm|rmSync|unlink|unlinkSync|rmdir|rmdirSync)\s*\(/,
+  /\bsetInputFiles\s*\(/,
+];
+
+/**
+ * Whether a changed diff line (content, prefix stripped) touches a
+ * security-sensitive seam (#1336).
+ *
+ * @param {string} content — trimmed line content (without + / - prefix)
+ * @returns {boolean}
+ */
+function isSecuritySensitiveSeamLine(content) {
+  return SECURITY_SEAM_PATTERNS.some((re) => re.test(content));
+}
+
+/**
+ * Scan a unified diff for a security-sensitive seam (#1336) on any added/removed
+ * LOGIC line of a CODE file. Two gates keep it precise: (1) file-gate — only a
+ * file that `classifyFile()` calls `code` is scanned, so a yaml/markdown/json
+ * line that merely names a primitive (e.g. `shell: true` in a persona prompt, or
+ * `child_process` in a doc) never triggers; (2) `!isNonLogicLine` — within a code
+ * file, a comment/blank line that names a primitive (e.g. `// spawn( a child`)
+ * does not trigger either. Runs independently of the T0/T1 category path so it
+ * also covers a pure-code diff (all files classify as `code`), which is the MOST
+ * concentrated seam case (e.g. editing a Playwright/child_process driver) and the
+ * one #1336 targets.
+ *
+ * @param {string} diffOutput — raw unified diff output
+ * @returns {boolean}
+ */
+export function diffHasSecuritySeam(diffOutput) {
+  if (!diffOutput) return false;
+  let inHunk = false;
+  // Only CODE files can carry an executable seam — a YAML/markdown/JSON line that
+  // merely names a primitive (e.g. `shell: true` in a persona prompt) is not a
+  // seam. Track the current file from the unified-diff `--- a/`/`+++ b/` headers
+  // and gate the scan on `classifyFile(...) === "code"`. Bare-hunk input (no file
+  // header — used in tests / direct hunk analysis) defaults to code so it still
+  // scans; a real `git diff` always carries headers, so it is gated per file.
+  let currentFileIsCode = true;
+  let fromPath = null;
+  for (const line of diffOutput.split("\n")) {
+    if (line.startsWith("--- ")) {
+      const p = line.slice(4).trim().replace(/^a\//, "");
+      fromPath = p === "/dev/null" ? null : p;
+      inHunk = false;
+      continue;
+    }
+    if (line.startsWith("+++ ")) {
+      const p = line.slice(4).trim().replace(/^b\//, "");
+      const effective = p === "/dev/null" ? fromPath : p;
+      currentFileIsCode = effective != null && classifyFile(effective) === "code";
+      inHunk = false;
+      continue;
+    }
+    if (line.startsWith("@@")) { inHunk = true; continue; }
+    if (!inHunk || !currentFileIsCode) continue;
+    const isAdd = line.startsWith("+") && !line.startsWith("+++");
+    const isDel = line.startsWith("-") && !line.startsWith("---");
+    if (!isAdd && !isDel) continue;
+    const content = line.slice(1).trim();
+    if (isNonLogicLine(content)) continue;
+    if (isSecuritySensitiveSeamLine(content)) return true;
+  }
+  return false;
+}
+
 /**
  * Analyze unified diff hunks to classify change types.
  *
@@ -202,6 +297,9 @@ export function analyzeT1(diffOutput, t0) {
   // Build categories from T0 (shared with inferCategoriesFromT0) + hunk analysis.
   for (const c of t0FileCategories(t0)) categories.add(c);
   if (hasLogicChange) categories.add("LOGIC_CHANGE");
+  // #1336: a diff touching a security-sensitive seam gets an up-front adversarial
+  // threat-model angle, batched at draft time instead of drip-fed via Copilot.
+  if (diffHasSecuritySeam(diffOutput)) categories.add("SECURITY_SENSITIVE_SEAM");
   // Mixed diffs never satisfy the exclusive `_ONLY` checks above (some files are
   // code), so their peripheral surfaces would be dropped. In this hunk-level path
   // (only reached for genuinely mixed diffs), also union each surface by PRESENCE
@@ -328,6 +426,14 @@ export function analyzeDiff({ nameStatusOutput, diffOutput }) {
     };
   }
 
+  // #1336: seam detection runs on the raw diff regardless of the T0/T1 path, so a
+  // pure-code diff (single `code` category, T1 skipped) editing a browser/exec/
+  // fetch/fs-mutation driver still triggers the up-front threat-model angle — the
+  // most concentrated seam case, and the one this feature targets.
+  if (!t1.changeCategories.includes("SECURITY_SENSITIVE_SEAM") && diffHasSecuritySeam(diffOutput)) {
+    t1.changeCategories.push("SECURITY_SENSITIVE_SEAM");
+  }
+
   // `ambiguous` flags one specific case: a diff T0 could not classify (mixed file
   // categories, so t0Ambiguous) AND whose hunk analysis still produced no
   // category. It is NOT the only fallback trigger — resolveDynamicAngles also

package/src/claude/asset-generation.mjs

@@ -26,6 +26,8 @@
 
 import { parse as parseYaml } from "yaml";
 
+import { resolveRoleModel } from "../config/config.mjs";
+
 /** Pi→Claude tool-name map. A Pi name may expand to multiple Claude tools (search→Grep,Glob). */
 export const TOOL_NAME_MAP = Object.freeze({
   read: ["Read"],
@@ -89,24 +91,26 @@ export function rewriteCliInvocation(body, version) {
 }
 
 /**
- * Rewrite repo-root `../docs/…` *inline* markdown links `](../docs/…)` in a generated *command*
- * body so they resolve from the generated file's deeper location. Only the inline `](…)` link form
- * is rewritten (reference-style `[label]: …` and HTML `<a href>` links are left as-is) — command
- * bodies only use inline links, so that is the sole form that occurs. Source commands live at
- * `commands/<name>.command.md`, so `../docs/x` resolves to repo-root `docs/x`; the generated
- * wrapper lives one level deeper at `.claude/commands/<name>.md`, where `../docs/x` would wrongly
- * resolve to `.claude/docs/x` (there is no such dir). Repo-root `docs/` is NOT mirrored into
- * `.claude/`, so the link must gain one `../` to reach repo-root: `../docs/x` → `../../docs/x`.
+ * Rewrite repo-root `../docs/…` *inline* markdown links `](../docs/…)` in a generated *command* or
+ * *agent* body so they resolve from the generated file's deeper location. Only the inline `](…)`
+ * link form is rewritten (reference-style `[label]: …` and HTML `<a href>` links are left as-is) —
+ * command/agent bodies only use inline links, so that is the sole form that occurs. Source
+ * commands/agents live at `commands/<name>.command.md` / `agents/<name>.agent.md`, so `../docs/x`
+ * resolves to repo-root `docs/x`; the generated wrapper lives one level deeper at
+ * `.claude/commands/<name>.md` / `.claude/agents/<name>.md`, where `../docs/x` would wrongly resolve
+ * to `.claude/docs/x` (there is no such dir). Repo-root `docs/` is NOT mirrored into `.claude/`, so
+ * the link must gain one `../` to reach repo-root: `../docs/x` → `../../docs/x`. Both trees sit one
+ * level under `.claude/`, so the same single-level shift applies to each.
  *
- * Scoped to `../docs/` on purpose. Other `../…` command links point at subtrees the generator
- * mirrors under `.claude/` (e.g. `../skills/docs/x` → the bundled `.claude/skills/docs/x`), whose
- * relative depth is preserved verbatim — shifting those would break them. Skills need no rewrite
- * at all for the same reason (their `../docs/x` targets the bundled `.claude/skills/docs/x`).
+ * Scoped to `../docs/` on purpose. Other `../…` links point at subtrees the generator mirrors under
+ * `.claude/` (e.g. `../skills/docs/x` → the bundled `.claude/skills/docs/x`), whose relative depth
+ * is preserved verbatim — shifting those would break them. Skills need no rewrite at all for the
+ * same reason (their `../docs/x` targets the bundled `.claude/skills/docs/x`).
  *
  * @param {string} body
  * @returns {string}
  */
-export function rewriteCommandRepoLinks(body) {
+export function rewriteGeneratedRepoDocLinks(body) {
   return String(body).replace(/(\]\(<?)(\.\.\/docs\/)/g, "$1../$2");
 }
 
@@ -169,13 +173,20 @@ function normalizeToolList(value) {
 
 /**
  * Transform a canonical `agents/*.agent.md` into a Claude `.claude/agents/*.md` document.
- * @param {{ source: string, raw: string, version?: string }} input
+ *
+ * Stamps the model-tier policy into `model:` frontmatter: the agent's role (its
+ * `name`) is resolved via `resolveRoleModel(config, { role, harness: "claude" })`;
+ * a concrete model is written, `inherit`/null omits the field. `config` defaults
+ * to `{}` so the committed tree bakes the zero-config built-in policy; pass a
+ * loaded config to tune the generated tree per repo.
+ * @param {{ source: string, raw: string, version?: string, config?: object }} input
  * @returns {string} Full generated file content.
  */
-export function transformAgent({ source, raw, version = "latest" }) {
+export function transformAgent({ source, raw, version = "latest", config = {} }) {
   const { frontmatter, body: rawBody } = splitFrontmatter(raw, source);
-  const body = rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version);
+  const body = rewriteGeneratedRepoDocLinks(rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version));
   const tools = mapTools(normalizeToolList(frontmatter.tools));
+  const model = resolveRoleModel(config, { role: String(frontmatter.name ?? ""), harness: "claude" });
 
   const lines = ["---"];
   lines.push(`name: ${JSON.stringify(String(frontmatter.name ?? ""))}`);
@@ -185,6 +196,12 @@ export function transformAgent({ source, raw, version = "latest" }) {
   if (tools.length > 0) {
     lines.push(`tools: ${tools.join(", ")}`);
   }
+  if (model != null) {
+    // Quote the stamped model id: resolveRoleModel can return any operator-provided
+    // id, and a value with YAML-significant chars would break frontmatter parsing.
+    // JSON string literals are valid YAML double-quoted scalars.
+    lines.push(`model: ${JSON.stringify(model)}`);
+  }
   lines.push("---");
   lines.push(GENERATED_NOTE(source));
   lines.push("");
@@ -202,7 +219,7 @@ export function transformAgent({ source, raw, version = "latest" }) {
  */
 export function transformCommand({ source, raw, version = "latest" }) {
   const { frontmatter, body: rawBody } = splitFrontmatter(raw, source);
-  const body = rewriteCommandRepoLinks(rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version));
+  const body = rewriteGeneratedRepoDocLinks(rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version));
 
   const lines = ["---"];
   if (frontmatter.description != null) {