@dev-loops/core 1.0.2 → 1.0.4-pre.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dev-loops/core",
-  "version": "1.0.2",
+  "version": "1.0.4-pre.0",
   "type": "module",
   "engines": {
     "node": ">=24"
@@ -28,19 +28,25 @@
     "./github/ownership-helpers": "./src/github/ownership-helpers.mjs",
     "./github/repo-slug": "./src/github/repo-slug.mjs",
     "./github/review-threads": "./src/github/review-threads.mjs",
+    "./github/test-mode-write-guard": "./src/github/test-mode-write-guard.mjs",
     "./loop/async-start-contract": "./src/loop/async-start-contract.mjs",
     "./loop/agent-stall": "./src/loop/agent-stall.mjs",
     "./loop/bash-command-classify": "./src/loop/bash-command-classify.mjs",
+    "./loop/child-launch-bound": "./src/loop/child-launch-bound.mjs",
+    "./loop/reviewer-unit-bound": "./src/loop/reviewer-unit-bound.mjs",
     "./loop/conductor-routing": "./src/loop/conductor-routing.mjs",
     "./loop/copilot-ci-status": "./src/loop/copilot-ci-status.mjs",
     "./loop/copilot-loop-iterations": "./src/loop/copilot-loop-iterations.mjs",
     "./loop/copilot-loop-state": "./src/loop/copilot-loop-state.mjs",
+    "./loop/finding-cluster": "./src/loop/finding-cluster.mjs",
+    "./loop/fixer-disposition": "./src/loop/fixer-disposition.mjs",
     "./loop/gate-carry-forward": "./src/loop/gate-carry-forward.mjs",
     "./loop/gate-evidence-reconcile": "./src/loop/gate-evidence-reconcile.mjs",
     "./loop/gate-fanin": "./src/loop/gate-fanin.mjs",
     "./loop/handoff-envelope": "./src/loop/handoff-envelope.mjs",
     "./loop/lifecycle-state": "./src/loop/lifecycle-state.mjs",
     "./loop/markdown-sections": "./src/loop/markdown-sections.mjs",
+    "./loop/merge-approval": "./src/loop/merge-approval.mjs",
     "./loop/issue-refinement-artifact": "./src/loop/issue-refinement-artifact.mjs",
     "./loop/phase-files": "./src/loop/phase-files.mjs",
     "./loop/policy-constants": "./src/loop/policy-constants.mjs",
@@ -63,9 +69,11 @@
     "./loop/queue-state": "./src/loop/queue-state.mjs",
     "./loop/size-budget-merge-gate": "./src/loop/size-budget-merge-gate.mjs",
     "./loop/cache-telemetry-evidence": "./src/loop/cache-telemetry-evidence.mjs",
+    "./loop/execution-record": "./src/loop/execution-record.mjs",
     "./loop/primer-evidence": "./src/loop/primer-evidence.mjs",
     "./loop/review-dispatch-plan": "./src/loop/review-dispatch-plan.mjs",
     "./loop/reviewer-loop-state": "./src/loop/reviewer-loop-state.mjs",
+    "./loop/role-budget-bound": "./src/loop/role-budget-bound.mjs",
     "./loop/run-context": "./src/loop/run-context.mjs",
     "./loop/run-inspection": "./src/loop/run-inspection.mjs",
     "./loop/run-post-merge-actions": "./src/loop/run-post-merge-actions.mjs",
@@ -75,6 +83,7 @@
     "./loop/steering": "./src/loop/steering.mjs",
     "./loop/timeout-policy": "./src/loop/timeout-policy.mjs",
     "./loop/tracker-pr-state": "./src/loop/tracker-pr-state.mjs",
+    "./loop/watcher-exclusivity": "./src/loop/watcher-exclusivity.mjs",
     "./loop/ui-e2e-scoping": "./src/loop/ui-e2e-scoping.mjs",
     "./loop/ui-review-provision": "./src/loop/ui-review-provision.mjs",
     "./loop/ui-review-drive": "./src/loop/ui-review-drive.mjs",

package/src/analysis/change-classifier.mjs

@@ -117,6 +117,13 @@ export const ALWAYS_INCLUDE = new Set(["gate-evidence", "renderer-security", "pr
  * When `anglePool` is omitted, additive mode is off and `addedAngles` is
  * always empty.
  *
+ * A configured angle that is NOT in CATEGORY_ANGLE_MAP (a consumer-defined
+ * angle) can still be recommended BY change category or file kind when it
+ * declares `categories`/`kinds` via `angleDeclarations`. This is purely
+ * additive: it can only SELECT such an angle when the diff intersects its
+ * declaration; it never drops any angle the catalog map, ALWAYS_INCLUDE, or the
+ * fallback-to-all path would otherwise recommend.
+ *
  * @param {object} options
  * @param {string[]} options.configuredAngles — all angles configured for this gate
  * @param {string[]} options.changeCategories — from diff analysis
@@ -124,6 +131,11 @@ export const ALWAYS_INCLUDE = new Set(["gate-evidence", "renderer-security", "pr
  * @param {string[]} [options.anglePool] — catalog of angles eligible for additive
  *   selection (caller pre-filters this against excludeAngles); when undefined,
  *   additive selection is disabled
+ * @param {Record<string, {categories?: string[], kinds?: string[]}>} [options.angleDeclarations]
+ *   — per-angle category/file-kind bindings for consumer angles absent from
+ *   CATEGORY_ANGLE_MAP; a match recommends the angle deterministically
+ * @param {string[]} [options.fileKinds] — file kinds present in the diff
+ *   (classifyFile output), used to honor an angle's `kinds` declaration
  * @returns {DynamicAngleResult}
  */
 export function resolveDynamicAngles({
@@ -131,6 +143,8 @@ export function resolveDynamicAngles({
   changeCategories,
   ambiguous = false,
   anglePool,
+  angleDeclarations = {},
+  fileKinds = [],
 }) {
   // Fallback: ambiguous diff → all angles
   if (ambiguous) {
@@ -177,6 +191,27 @@ export function resolveDynamicAngles({
     }
   }
 
+  // Consumer angles bound by declaration: a configured angle absent from
+  // CATEGORY_ANGLE_MAP can name the change-categories / file-kinds that select
+  // it. Recommend it when the diff intersects that declaration, so it need not
+  // be forced `mandatory` to survive dynamic pruning. Additive only: never
+  // removes an angle already recommended above.
+  const changeCatSet = new Set(changeCategories);
+  const fileKindSet = new Set(fileKinds);
+  for (const angle of configuredAngles) {
+    if (recommended.has(angle)) continue;
+    const decl = angleDeclarations[angle];
+    if (!decl) continue;
+    const catHit = (decl.categories ?? []).some((c) => changeCatSet.has(c));
+    const kindHit = (decl.kinds ?? []).some((k) => fileKindSet.has(k));
+    if (catHit || kindHit) {
+      recommended.add(angle);
+      if (!triggers.has(angle)) {
+        triggers.set(angle, catHit ? "declared-category" : "declared-kind");
+      }
+    }
+  }
+
   // Filter to only angles that are configured
   const recommendedAngles = configuredAngles.filter((a) => recommended.has(a));
   const skippedAngles = configuredAngles.filter((a) => !recommended.has(a));

package/src/analysis/diff-analyzer.mjs

@@ -16,6 +16,57 @@
 // closed to a full re-review.
 const DOTFILE_CONFIG_BASENAMES = new Set([".devloops"]);
 
+// Generic classifier tables. Files are classified by principle (broad extension
+// tables + directory/basename conventions), not by a bespoke per-language rule.
+// A new mainstream language is covered by adding its extension here, not by a new
+// branch. Deliberate fail-closed exceptions (`.ruby-version`, `.nvmrc`,
+// stylesheets) are simply absent from every table, so they fall through to
+// "unknown".
+
+// Source extensions across the common languages. A file with one of these is
+// executable/product logic → "code".
+const CODE_EXTENSIONS = new Set([
+  // JS/TS
+  ".mjs", ".cjs", ".js", ".jsx", ".ts", ".mts", ".cts", ".tsx",
+  // Ruby (source + Rails view templates, which embed control flow / XSS surface)
+  ".rb", ".rake", ".erb", ".haml", ".slim", ".jbuilder",
+  // Python
+  ".py", ".pyi",
+  // Go
+  ".go",
+  // Rust
+  ".rs",
+  // Java / Kotlin / Scala
+  ".java", ".kt", ".kts", ".scala", ".sc",
+  // C / C++ / C#
+  ".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hh", ".hxx", ".cs",
+  // PHP / Swift / Elixir / Lua / Dart
+  ".php", ".swift", ".ex", ".exs", ".lua", ".dart",
+  // Shell
+  ".sh", ".bash", ".zsh", ".fish",
+]);
+// Basename-only source files (no discriminating extension).
+const CODE_BASENAMES = new Set(["Rakefile"]);
+
+// Data/config/manifest extensions. `.ru` (rackup) and `.gemspec` are Ruby
+// packaging surface. `.lock` covers every lockfile (Gemfile.lock, Cargo.lock,
+// poetry.lock, yarn.lock, …).
+const CONFIG_EXTENSIONS = new Set([
+  ".yml", ".yaml", ".json", ".toml", ".ini", ".cfg", ".lock", ".ru", ".gemspec",
+]);
+// Manifest basenames without a config extension.
+const CONFIG_BASENAMES = new Set([
+  "Gemfile", "go.mod", "go.sum", "requirements.txt", "pom.xml", "Dockerfile", "Makefile",
+]);
+
+// Prose/documentation extensions.
+const DOCS_EXTENSIONS = new Set([".md", ".markdown", ".rst", ".adoc", ".txt"]);
+
+// Test conventions. A directory segment named any of these, or a basename token
+// (`*_test.*`, `*_spec.*`, `test_*`, `*.test.*`, `*.spec.*`), marks a test file.
+const TEST_DIR_SEGMENTS = new Set(["test", "tests", "spec", "specs", "__tests__"]);
+const TEST_BASENAME_RE = /(\.test\.|\.spec\.|_test\.|_spec\.|^test_)/;
+
 // Prose surface that arms the required `deslop` gate angle.
 // skills/docs/** is excluded via SKILLS_DOCS_EXEMPT_RE: those are normative
 // contracts, not prose.
@@ -135,34 +186,56 @@ export function analyzeT0(nameStatusOutput) {
  */
 export function classifyFile(filePath) {
   const fp = normalizeSep(filePath);
+  const base = fp.split("/").pop();
+  // Extension excludes a leading-dot dotfile (`.nvmrc` → "", not ".nvmrc"), so
+  // runtime-version dotfiles never match an extension table and fall through to
+  // "unknown".
+  const dot = base.lastIndexOf(".");
+  const ext = dot > 0 ? base.slice(dot).toLowerCase() : "";
+
   if (fp.startsWith(".github/")) {
     return "ci";
   }
-  // A known code/config/test extension wins over the docs/ directory-prefix
-  // fallback: a code/config/test file hosted under docs/ is still that surface,
-  // not prose. Extension checks run before the prefix fallbacks below.
+  // Config wins over every later surface: a manifest/data file (even one hosted
+  // under docs/, or a build.gradle.kts that also has a code extension) is config,
+  // not prose or code. `.ruby-version`/`.nvmrc` are absent from all tables and so
+  // stay "unknown" — a runtime bump must re-run ci-guard/determinism, not carry a
+  // stale clean verdict.
   if (
-    fp.endsWith(".yml") || fp.endsWith(".yaml") ||
-    fp.endsWith(".json") || fp === "package.json"
+    CONFIG_EXTENSIONS.has(ext) ||
+    CONFIG_BASENAMES.has(base) ||
+    DOTFILE_CONFIG_BASENAMES.has(base) ||
+    base.startsWith("build.gradle")
   ) {
     return "config";
   }
-  if (DOTFILE_CONFIG_BASENAMES.has(fp.split("/").pop())) {
-    return "config";
+  // Generic test convention, part 1: a basename carrying a test/spec token
+  // (`*_test.*`, `*_spec.*`, `test_*`, `*.test.*`, `*.spec.*`) is a test wherever
+  // it lives — a strong per-file signal that subsumes the old `.test.` and Ruby
+  // `*_spec.rb`/`*_test.rb` rules and wins even under `docs/`.
+  if (TEST_BASENAME_RE.test(base)) {
+    return "test";
   }
-  if (fp.includes(".test.") || fp.startsWith("test/")) {
+  // Generic test convention, part 2: a `test`/`tests`/`spec`/`specs`/`__tests__`
+  // path segment at any depth. Subsumes the old root-anchored `test/`/`spec/`
+  // rules and broadens them to nested suites (`packages/core/test/foo.mjs`).
+  // Excluded under `docs/`: the old rule anchored test dirs at the ROOT, so a
+  // docs-tree prose file (`docs/specs/queue-mode/SPEC.md`) was never a test — the
+  // widened any-depth scan must not reclassify it. This only skips the
+  // DIRECTORY-based classification; a code/config file or a test-token basename
+  // under docs/ is still classified by the extension/basename rules above and
+  // below (`docs/example.mjs` → code, `docs/x.test.mjs` → test).
+  const dirs = fp.split("/").slice(0, -1);
+  if (!fp.startsWith("docs/") && dirs.some((seg) => TEST_DIR_SEGMENTS.has(seg))) {
     return "test";
   }
-  if (
-    fp.endsWith(".mjs") || fp.endsWith(".js") ||
-    fp.endsWith(".ts") || fp.endsWith(".mts")
-  ) {
+  // Broad source table: a file in any covered language is code, not prose, even
+  // under docs/. Stylesheets (`.scss`/`.sass`) are deliberately absent — a
+  // style/asset kind is out of scope.
+  if (CODE_EXTENSIONS.has(ext) || CODE_BASENAMES.has(base)) {
     return "code";
   }
-  if (
-    fp.startsWith("docs/") || fp.endsWith(".md") || fp.endsWith(".markdown") ||
-    fp === "README.md"
-  ) {
+  if (fp.startsWith("docs/") || DOCS_EXTENSIONS.has(ext)) {
     return "docs";
   }
   return "unknown";

package/src/claude/asset-generation.mjs

@@ -114,6 +114,67 @@ export function rewriteGeneratedRepoDocLinks(body) {
   return String(body).replace(/(\]\(<?)(\.\.\/docs\/)/g, "$1../$2");
 }
 
+/**
+ * Name of the resolver launcher committed at `.claude/bin/dev-loops-run`. It self-locates a
+ * source checkout by walking up from `process.cwd()` (unconditional priority), else by walking
+ * up from the launcher's own real binary location, else falls back to the plugin's auto-installed
+ * `dev-loops` package, and hard-stops (never falls back to raw `gh`) when none resolve.
+ */
+export const WRAPPER_LAUNCHER = "dev-loops-run";
+
+/**
+ * CLI namespaces the routed `dev-loops <ns> <sub>` form recognizes — the real top-level keys of
+ * `SUBCOMMAND_ROUTES` in `cli/index.mjs` (locked by
+ * `test/contracts/claude-no-bare-invocation.test.mjs`'s recurrence guard, which reads those keys
+ * directly). `release` and `security` are NOT CLI namespaces (no such routes exist); `issue` and
+ * `inspect` are and were previously missing here, which left e.g. `dev-loops issue edit …` bare
+ * and unrouted in the generated tree.
+ */
+export const WRAPPER_NS = "gate|loop|pr|issue|queue|project|inspect|refine";
+
+/**
+ * Regex source (no flags) matching a bare `node scripts/<dir>/…/<file>.mjs` invocation, at ANY
+ * subdirectory depth (one-or-more `dir/` segments), not just one subdirectory level, so a
+ * nested wrapper is caught too. The `node`→`scripts/` gap matches ANY whitespace (`\s+`),
+ * including a source line-wrap (`node` at a line end, `scripts/…mjs` beginning the next), so a
+ * prose-wrapped invocation is routed and the guard test that shares this source catches it too —
+ * a single-space-only pattern silently left wrapped invocations bare and passed the guard falsely.
+ * The `.mjs` path anchor keeps false positives impossible. Capture group 1 is the matched
+ * `scripts/…mjs` path. Exported so the no-bare-invocation guard test can build the identical regex
+ * rather than re-deriving it (single source of truth).
+ */
+export const BARE_NODE_SCRIPTS_SOURCE = String.raw`\bnode\s+(scripts\/(?:[a-z0-9-]+\/)+[A-Za-z0-9._-]+\.mjs)`;
+
+/**
+ * Regex source (no flags) matching a bare, unrouted `dev-loops <namespace> <sub>` invocation.
+ * Requires an immediate lowercase-starting subcommand (lookahead) so prose (`dev-loops gate.`,
+ * `dev-loops gate — …`, `` `dev-loops queue` ``) and the already-pinned `npx dev-loops@<version>`
+ * CLI form never match. Exported so the no-bare-invocation guard test can build the identical
+ * regex from the same `WRAPPER_NS` rather than re-deriving it (single source of truth).
+ */
+export const BARE_DEV_LOOPS_NS_SOURCE = String.raw`\bdev-loops (${WRAPPER_NS}) (?=[a-z])`;
+
+/**
+ * Route real wrapper invocations in a generated body through the resolver launcher so a
+ * plugin-only install (no `scripts/`, no `node_modules`) still resolves every wrapper.
+ * Two disjoint forms; args are preserved byte-for-byte:
+ *   node scripts/<dir>/<file>.mjs …  → <launcher> scripts/<dir>/<file>.mjs …
+ *   dev-loops <namespace> <sub> …    → <launcher> cli/index.mjs <namespace> <sub> …
+ * The namespace form requires an immediate lowercase-starting subcommand (lookahead), so prose
+ * (`dev-loops gate.`, `dev-loops gate — …`, `` `dev-loops queue` ``) and the already-pinned
+ * `npx dev-loops@<version>` CLI form are never touched. Idempotent: the rewritten output never
+ * re-matches (the launcher name is followed by a path/`cli/index.mjs`, not `scripts/` or a bare
+ * namespace token).
+ * @param {string} body
+ * @param {string} [launcher]
+ * @returns {string}
+ */
+export function rewriteWrapperInvocation(body, launcher = WRAPPER_LAUNCHER) {
+  return String(body)
+    .replace(new RegExp(BARE_NODE_SCRIPTS_SOURCE, "g"), `${launcher} $1`)
+    .replace(new RegExp(BARE_DEV_LOOPS_NS_SOURCE, "g"), `${launcher} cli/index.mjs $1 `);
+}
+
 /**
  * Map a single Pi tool name to its Claude tool name(s).
  * @param {string} name
@@ -184,7 +245,7 @@ function normalizeToolList(value) {
  */
 export function transformAgent({ source, raw, version = "latest", config = {} }) {
   const { frontmatter, body: rawBody } = splitFrontmatter(raw, source);
-  const body = rewriteGeneratedRepoDocLinks(rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version));
+  const body = rewriteWrapperInvocation(rewriteGeneratedRepoDocLinks(rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version)));
   const tools = mapTools(normalizeToolList(frontmatter.tools));
   const model = resolveRoleModel(config, { role: String(frontmatter.name ?? ""), harness: "claude" });
 
@@ -219,7 +280,7 @@ export function transformAgent({ source, raw, version = "latest", config = {} })
  */
 export function transformCommand({ source, raw, version = "latest" }) {
   const { frontmatter, body: rawBody } = splitFrontmatter(raw, source);
-  const body = rewriteGeneratedRepoDocLinks(rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version));
+  const body = rewriteWrapperInvocation(rewriteGeneratedRepoDocLinks(rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version)));
 
   const lines = ["---"];
   if (frontmatter.description != null) {
@@ -241,7 +302,7 @@ export function transformCommand({ source, raw, version = "latest" }) {
  */
 export function transformSkill({ source, raw, version = "latest" }) {
   const { frontmatter, body: rawBody } = splitFrontmatter(raw, source);
-  const body = rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version);
+  const body = rewriteWrapperInvocation(rewriteCliInvocation(stripPiOnlyBlocks(rawBody), version));
   const tools = mapTools(normalizeToolList(frontmatter["allowed-tools"]));
 
   const lines = ["---"];