@f-o-h/cli 0.1.12 → 0.1.14

package/README.md

@@ -4,7 +4,7 @@ AI-operator provisioning CLI for Front Of House.
 
 Public mirror: https://github.com/iiko38/front-of-house-cli
 
-Current published baseline: `@f-o-h/cli@0.1.12`
+Current published baseline: `@f-o-h/cli@0.1.14`
 
 This mirror is a generated release artifact. The private product monorepo is not
 published here, and no open-source license is granted unless stated separately.
@@ -85,67 +85,67 @@ The CLI defaults to the production API at `https://api.frontofhouse.okii.uk`.
 
 ## External-Agent Eval Capture
 
-Use this when testing whether a clean coding agent can start from public docs
-and the public npm package without private repo context:
-
-```bash
-foh eval external-agent batch \
-  --models openai/codex,anthropic/claude,cursor/agent \
-  --prompt-version blank-setup.v1 \
-  --json
-```
-
-Run each returned launch command in a clean agent terminal:
-
-```bash
-foh eval external-agent run \
+Use this when testing whether a clean coding agent can start from public docs
+and the public npm package without private repo context:
+
+```bash
+foh eval external-agent batch \
+  --models openai/codex,anthropic/claude,cursor/agent \
+  --prompt-version blank-setup.v1 \
+  --json
+```
+
+Run each returned launch command in a clean agent terminal:
+
+```bash
+foh eval external-agent run \
   --model-provider openai \
   --model-name codex \
   --prompt-version blank-setup.v1
 ```
 
-The command writes a versioned prompt, launches an instrumented shell, captures
-FOH CLI commands into `commands.ndjson`, and finalizes `run.json` as an
-`external_agent_run.v1` artifact when the shell exits.
-
-For guarded programmable-runner planning:
-
-```bash
-foh eval external-agent execute \
-  --runner codex \
-  --batch test-results/external-agent-runs/<batch>/batch.json \
-  --dry-run \
-  --json
-```
-
-This writes `executor-plan.json`, creates intentionally empty clean workspaces
-outside the private repo, validates the local Codex binary/help flags, and
-prints exact `codex exec` commands without executing them.
-
-Before promoting run artifacts, scan and redact them:
-
-```bash
-foh eval external-agent scan-artifacts \
-  --run-dir test-results/external-agent-runs/<batch>/<run-id> \
-  --private-repo-root <private-repo-root> \
-  --write-redacted \
-  --json
-```
-
-After dry-run review, one controlled Codex run can be launched explicitly with
-`--live`. Live mode is intentionally limited to one run per batch and finalizes
-`run.json` even on timeout or non-zero exit:
-
-```bash
-foh eval external-agent execute \
-  --runner codex \
-  --batch test-results/external-agent-runs/<one-model-batch>/batch.json \
-  --timeout-minutes 30 \
-  --live \
-  --json
-```
-
-## Local Scenario Suites
+The command writes a versioned prompt, launches an instrumented shell, captures
+FOH CLI commands into `commands.ndjson`, and finalizes `run.json` as an
+`external_agent_run.v1` artifact when the shell exits.
+
+For guarded programmable-runner planning:
+
+```bash
+foh eval external-agent execute \
+  --runner codex \
+  --batch test-results/external-agent-runs/<batch>/batch.json \
+  --dry-run \
+  --json
+```
+
+This writes `executor-plan.json`, creates intentionally empty clean workspaces
+outside the private repo, validates the local Codex binary/help flags, and
+prints exact `codex exec` commands without executing them.
+
+Before promoting run artifacts, scan and redact them:
+
+```bash
+foh eval external-agent scan-artifacts \
+  --run-dir test-results/external-agent-runs/<batch>/<run-id> \
+  --private-repo-root <private-repo-root> \
+  --write-redacted \
+  --json
+```
+
+After dry-run review, one controlled Codex run can be launched explicitly with
+`--live`. Live mode is intentionally limited to one run per batch and finalizes
+`run.json` even on timeout or non-zero exit:
+
+```bash
+foh eval external-agent execute \
+  --runner codex \
+  --batch test-results/external-agent-runs/<one-model-batch>/batch.json \
+  --timeout-minutes 30 \
+  --live \
+  --json
+```
+
+## Local Scenario Suites
 
 `foh test run --suite <file>` runs deterministic widget-runtime checks for a
 specific agent. The suite format supports reply text checks plus structured

package/dist/foh.js

@@ -32640,7 +32640,7 @@ var StdioServerTransport = class {
 };
 
 // src/lib/cli-version.ts
-var CLI_VERSION = "0.1.12";
+var CLI_VERSION = "0.1.14";
 
 // src/commands/mcp-serve.ts
 var DEFAULT_TIMEOUT_MS = 12e4;
@@ -36437,8 +36437,13 @@ function inferReasonCode(artifact) {
   }
   return nonEmpty2(getPath2(artifact, "status"));
 }
-function inferPromotionDecision(sourceType) {
-  if (sourceType === "external_agent_run") return "fix_docs";
+function inferPromotionDecision(sourceType, reasonCode) {
+  const reason = String(reasonCode || "").toLowerCase();
+  if (sourceType === "external_agent_run") {
+    if (reason.includes("exec_policy") || reason.includes("policy_blocked") || reason.includes("auth") || reason.includes("config")) return "fix_config";
+    if (reason.includes("cli") || reason.includes("command") || reason.includes("flag")) return "fix_cli";
+    return "fix_docs";
+  }
   if (sourceType === "knowledge_miss") return "fix_docs";
   if (sourceType === "setup_failure" || sourceType === "proof_failure" || sourceType === "live_proof_failure") return "fix_config";
   if (sourceType === "replay_failure" || sourceType === "runtime_miss") return "add_test";
@@ -36526,7 +36531,6 @@ function readSourceArtifact(path2) {
 function buildImprovementPacket(input) {
   const artifact = input.sourceArtifact ?? null;
   const sourceType = parseEnum(input.sourceType, IMPROVEMENT_SOURCE_TYPES, "--source-type") ?? inferSourceType(artifact);
-  const promotionDecision = parseEnum(input.promotionDecision, IMPROVEMENT_DECISIONS, "--recommendation") ?? inferPromotionDecision(sourceType);
   const ids = collectIds(artifact, input.ids);
   assertOrgBoundary(artifact, input.ids?.org_id);
   const reasonCode = nonEmpty2(input.reasonCode) ?? inferReasonCode(artifact);
@@ -36538,6 +36542,7 @@ function buildImprovementPacket(input) {
       statusCode: 400
     });
   }
+  const promotionDecision = parseEnum(input.promotionDecision, IMPROVEMENT_DECISIONS, "--recommendation") ?? inferPromotionDecision(sourceType, reasonCode);
   const evidenceSummary = redactString(
     nonEmpty2(input.evidenceSummary) ?? nonEmpty2(getPath2(artifact, "summary")) ?? `Improvement candidate generated from ${sourceType} with reason ${reasonCode}.`
   );
@@ -38739,6 +38744,9 @@ function proofArtifactPasses(runDir) {
 function readIfExists(path2) {
   return (0, import_fs14.existsSync)(path2) ? (0, import_fs14.readFileSync)(path2, "utf8") : "";
 }
+function relativeArtifactName(path2) {
+  return (0, import_path12.basename)(path2);
+}
 function classifyRun(input) {
   if (input.timedOut) return { status: "hold", reasonCode: "codex_runner_timeout" };
   if (!input.artifactSafetyOk) return { status: "fail", reasonCode: "external_agent_artifact_safety_blocked" };
@@ -38749,6 +38757,9 @@ ${stderr}`;
   if (/need[^.\n]*(?:private|source)[^.\n]*repo|cannot[^.\n]*without[^.\n]*(?:private|source)[^.\n]*repo|clone[^.\n]*(?:private|source)[^.\n]*repo/i.test(combined)) {
     return { status: "fail", reasonCode: "private_repo_assumption_detected" };
   }
+  if (/(?:blocked|rejected|declined) by policy|EXEC_POLICY_BLOCKED|command execution was rejected|shell commands were rejected/i.test(combined)) {
+    return { status: "hold", reasonCode: "codex_exec_policy_blocked" };
+  }
   if (/browser|approve|approval|login|auth|sign in/i.test(combined) && !proofArtifactPasses(input.run.run_dir)) {
     return { status: "hold", reasonCode: "auth_browser_approval_required" };
   }
@@ -38791,21 +38802,21 @@ function buildExecutedRunArtifact(input) {
     commands_run: commands.map((command) => command.command),
     docs_pages_used: [],
     artifacts: {
-      terminal_transcript: input.run.outputs.jsonl,
+      terminal_transcript: relativeArtifactName(input.run.outputs.jsonl),
       command_log: (0, import_fs14.existsSync)((0, import_path12.join)(input.run.run_dir, "commands.ndjson")) ? "commands.ndjson" : null,
       proof_bundle: (0, import_fs14.existsSync)((0, import_path12.join)(input.run.run_dir, "proof.json")) ? "proof.json" : null,
       replay_packet: (0, import_fs14.existsSync)((0, import_path12.join)(input.run.run_dir, "replay.json")) ? "replay.json" : null,
       knowledge_packet: (0, import_fs14.existsSync)((0, import_path12.join)(input.run.run_dir, "knowledge.json")) ? "knowledge.json" : null,
       improvement_packet: input.status === "pass" ? null : "improvement-packet.json",
       notes: (0, import_fs14.existsSync)((0, import_path12.join)(input.run.run_dir, "notes.md")) ? "notes.md" : null,
-      codex_last_message: input.run.outputs.last_message,
-      codex_stderr: input.run.outputs.stderr,
-      artifact_safety: input.run.outputs.artifact_safety
+      codex_last_message: relativeArtifactName(input.run.outputs.last_message),
+      codex_stderr: relativeArtifactName(input.run.outputs.stderr),
+      artifact_safety: relativeArtifactName(input.run.outputs.artifact_safety)
     },
     summary: input.status === "pass" ? "Controlled Codex external-agent run produced passing proof evidence." : `Controlled Codex external-agent run ended as ${input.status} with reason ${input.reasonCode}.`,
     next_commands: input.status === "pass" ? ["corepack pnpm eval:external-agent:runs:summary"] : [
-      `foh eval external-agent scan-artifacts --run-dir ${input.run.run_dir} --private-repo-root <private_repo_root> --write-redacted --json`,
-      `foh bug improve --from external-agent-run --file ${input.run.outputs.run} --out ${(0, import_path12.join)(input.run.run_dir, "improvement-packet.json")} --json`,
+      "foh eval external-agent scan-artifacts --run-dir <run_dir> --private-repo-root <private_repo_root> --write-redacted --json",
+      "foh bug improve --from external-agent-run --file <run_dir>/run.json --out <run_dir>/improvement-packet.json --json",
       "corepack pnpm eval:external-agent:runs:summary"
     ]
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@f-o-h/cli",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "FOH CLI - AI-operator provisioning tool for Front Of House",
   "license": "UNLICENSED",
   "bin": {