@fro.bot/systematic 3.12.3 → 3.13.0

package/ATTRIBUTIONS.md

@@ -272,7 +272,7 @@ The following is the full Apache License, Version 2.0 text, reproduced here in c
 ## vercel-labs/agent-browser — Apache-2.0
 
 **Source repository:** [`vercel-labs/agent-browser`](https://github.com/vercel-labs/agent-browser)
-**Pinned version:** `v0.33.1` (npm `agent-browser@0.33.1`)
+**Pinned version:** `v0.34.0` (npm `agent-browser@0.34.0`)
 **License:** Apache-2.0
 **Copyright:** Copyright 2025 Vercel Inc.
 
@@ -296,7 +296,7 @@ This is fully automated — no human adaptation pass is required, in contrast to
 
 ### Upstream Apache-2.0 license text
 
-The following is the full Apache License, Version 2.0 text from `agent-browser@0.33.1`, reproduced here in compliance with the license's notice requirements:
+The following is the full Apache License, Version 2.0 text from `agent-browser@0.34.0`, reproduced here in compliance with the license's notice requirements:
 
 ```
                                  Apache License

package/dist/cli.d.ts

@@ -17,4 +17,11 @@ interface CapabilityCliOptions {
     readonly errorSink?: (message: string) => void;
 }
 export declare function runCapabilitiesCli(options: CapabilityCliOptions): number;
+interface ValidateReviewArtifactCliOptions {
+    readonly argv: readonly string[];
+    readonly cwd?: string;
+    readonly outputSink?: (message: string) => void;
+    readonly errorSink?: (message: string) => void;
+}
+export declare function runValidateReviewArtifactCli(options: ValidateReviewArtifactCliOptions): number;
 export {};

package/dist/cli.js

@@ -3,6 +3,7 @@
 import {
   applyEdits,
   discoverSkills,
+  exports_external,
   extractString,
   findAgentsInDir,
   findCommandsInDir,
@@ -13,7 +14,7 @@ import {
   parse,
   parseFrontmatter,
   parseTree
-} from "./index-h26p98ny.js";
+} from "./index-0stf3ag0.js";
 
 // src/cli.ts
 import fs5 from "fs";
@@ -1977,6 +1978,162 @@ function cleanup(agentsRoot, configOptions) {
   return { status: "ok" };
 }
 
+// src/lib/review-artifact-schema.ts
+var MAX_REVIEWER_LENGTH = 64;
+var MAX_RUN_ID_LENGTH = 64;
+var MAX_INPUT_ID_LENGTH = 128;
+var MAX_REASON_LENGTH = 2048;
+var MAX_FINDINGS = 32;
+var MAX_PERSONAS = 64;
+var REVIEW_ARTIFACT_CUSTOM_MESSAGES = [
+  "severity count must match rejected finding count",
+  "filtered findings require a validation reason"
+];
+var boundedText = (maxLength) => exports_external.string().min(1).max(maxLength).regex(/\S/);
+var DispatchOutcomeSchema = exports_external.enum([
+  "findings",
+  "empty",
+  "malformed",
+  "never_returned"
+]);
+var DispositionSchema = exports_external.enum([
+  "surviving",
+  "merged",
+  "suppressed",
+  "filtered",
+  "rejected"
+]);
+var AdmittedDispositionSchema = DispositionSchema.exclude(["rejected"]);
+var HarnessSchema = exports_external.enum(["opencode", "pi", "claude-code"]);
+var RepoRelativePathSchema = boundedText(256).regex(/^(?!\/)(?![A-Za-z]:[\\/])(?!\\).+/);
+var ReviewerSchema = boundedText(MAX_REVIEWER_LENGTH);
+var ReasonSchema = boundedText(MAX_REASON_LENGTH);
+var FindingTitleSchema = boundedText(256);
+var SeveritySchema = exports_external.enum(["P0", "P1", "P2", "P3", "unknown"]);
+var FindingSeveritySchema = SeveritySchema.exclude(["unknown"]);
+var AutofixClassSchema = exports_external.enum([
+  "safe_auto",
+  "gated_auto",
+  "manual",
+  "advisory"
+]);
+var OwnerSchema = exports_external.enum([
+  "review-fixer",
+  "downstream-resolver",
+  "human",
+  "release"
+]);
+var BoundedEvidenceStringSchema = boundedText(500).regex(/^(?!\/)(?![A-Za-z]:[\\/])(?!\\).+/);
+var OverflowEvidenceSchema = exports_external.object({
+  overflow: exports_external.literal(true),
+  excerpt: BoundedEvidenceStringSchema
+}).strict();
+var EvidenceSchema = exports_external.array(exports_external.union([BoundedEvidenceStringSchema, OverflowEvidenceSchema])).min(1).max(5);
+var AdmittedInputFindingSchema = exports_external.object({
+  record_type: exports_external.literal("admitted"),
+  input_id: boundedText(MAX_INPUT_ID_LENGTH),
+  reviewer: ReviewerSchema,
+  confidence: exports_external.number().min(0).max(1),
+  disposition: AdmittedDispositionSchema,
+  reason: ReasonSchema
+}).strict();
+var RejectedInputFindingSchema = exports_external.object({
+  record_type: exports_external.literal("rejected_summary"),
+  reviewer: ReviewerSchema,
+  dispatch_outcome: DispatchOutcomeSchema,
+  rejected_finding_count: exports_external.number().int().positive().max(MAX_FINDINGS),
+  rejected_severities: exports_external.array(SeveritySchema).max(MAX_FINDINGS),
+  disposition: DispositionSchema.extract(["rejected"]),
+  reason: ReasonSchema
+}).strict().superRefine((row, ctx) => {
+  if (row.rejected_severities.length !== row.rejected_finding_count) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["rejected_severities"],
+      message: REVIEW_ARTIFACT_CUSTOM_MESSAGES[0]
+    });
+  }
+});
+var InputFindingSchema = exports_external.discriminatedUnion("record_type", [
+  AdmittedInputFindingSchema,
+  RejectedInputFindingSchema
+]);
+var ProvenanceSchema = exports_external.object({
+  fingerprint: boundedText(512),
+  submitters: exports_external.array(ReviewerSchema).max(MAX_PERSONAS),
+  agreement_credit: exports_external.array(ReviewerSchema).max(MAX_PERSONAS)
+}).strict();
+var SynthesizedFindingFieldsSchema = exports_external.object({
+  title: FindingTitleSchema,
+  severity: FindingSeveritySchema,
+  file: RepoRelativePathSchema,
+  line: exports_external.number().int().positive(),
+  why_it_matters: boundedText(2048),
+  autofix_class: AutofixClassSchema,
+  owner: OwnerSchema,
+  requires_verification: exports_external.boolean(),
+  confidence: exports_external.number().min(0).max(1),
+  evidence: EvidenceSchema,
+  pre_existing: exports_external.boolean(),
+  suggested_fix: exports_external.string().max(2048).nullable().optional(),
+  validated: exports_external.boolean().optional(),
+  validation_reason: ReasonSchema.optional(),
+  input_finding_ids: exports_external.array(boundedText(MAX_INPUT_ID_LENGTH)).min(1).max(MAX_FINDINGS),
+  provenance: ProvenanceSchema
+}).strict();
+var SynthesizedFindingSchema = SynthesizedFindingFieldsSchema.superRefine((finding, ctx) => {
+  if (finding.validated === false && finding.validation_reason === undefined) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["validation_reason"],
+      message: REVIEW_ARTIFACT_CUSTOM_MESSAGES[1]
+    });
+  }
+});
+var DispatchSchema = exports_external.object({
+  persona: ReviewerSchema,
+  dispatch_outcome: DispatchOutcomeSchema,
+  input_finding_count: exports_external.number().int().nonnegative().max(MAX_FINDINGS),
+  rejection_reason: ReasonSchema.optional()
+}).strict();
+var DispositionCountsSchema = exports_external.object({
+  surviving: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
+  merged: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
+  suppressed: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
+  filtered: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS),
+  rejected: exports_external.number().int().nonnegative().max(MAX_FINDINGS * MAX_PERSONAS)
+}).strict();
+var CoverageSchema = exports_external.object({
+  reviewers: exports_external.number().int().nonnegative().max(MAX_PERSONAS).optional(),
+  validators: exports_external.number().int().nonnegative().max(MAX_PERSONAS).optional(),
+  residual_risks: exports_external.array(ReasonSchema).max(MAX_PERSONAS),
+  testing_gaps: exports_external.array(ReasonSchema).max(MAX_PERSONAS),
+  failed_reviewers: exports_external.array(ReviewerSchema).max(MAX_PERSONAS),
+  validator_failures: exports_external.array(ReasonSchema).max(MAX_PERSONAS),
+  intent_uncertainty: exports_external.array(ReasonSchema).max(MAX_PERSONAS)
+}).strict();
+var ReviewArtifactSchema = exports_external.object({
+  schema_version: exports_external.literal(1),
+  run_id: boundedText(MAX_RUN_ID_LENGTH),
+  mode: exports_external.enum(["interactive", "autofix", "headless"]),
+  harness: HarnessSchema,
+  run_status: exports_external.enum([
+    "in_progress",
+    "completed",
+    "degraded",
+    "abnormal"
+  ]),
+  verdict: boundedText(256),
+  dispatches: exports_external.array(DispatchSchema).max(MAX_PERSONAS),
+  input_findings: exports_external.array(InputFindingSchema).max(MAX_FINDINGS * MAX_PERSONAS),
+  findings: exports_external.array(SynthesizedFindingSchema).max(MAX_FINDINGS),
+  disposition_counts: DispositionCountsSchema,
+  applied_fixes: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
+  residual_actionable_work: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
+  advisory_outputs: exports_external.array(ReasonSchema).max(MAX_FINDINGS),
+  coverage: CoverageSchema
+}).strict();
+
 // src/lib/setup.ts
 import fs4 from "fs";
 import path3 from "path";
@@ -2304,6 +2461,11 @@ Usage:
 Commands:
   list [type]                  List available skills, agents, or commands
   capabilities                 Read-only standalone-CLI observation; not a host-runtime or canonical-registry view
+  validate-review-artifact <path>
+                               Validate a ce:review run artifact
+                               The <path> argument is required by design; no artifact discovery is performed.
+                               Exit statuses: 0 valid artifact, 1 validation failure,
+                               2 operational failure, 3 legacy artifact with no schema_version
   config [subcommand]          Configuration management
     show                       Show configuration
     path                       Print config file locations
@@ -2321,6 +2483,7 @@ Options:
 Examples:
   systematic list skills
   systematic capabilities
+  systematic validate-review-artifact .context/systematic/ce-review/review-summary.json
   systematic list agents
   systematic config show
   systematic setup --harness opencode
@@ -2343,6 +2506,8 @@ Scope:
   project   <cwd>/.pi/agents (default)
   global    $PI_CODING_AGENT_DIR/agents or ~/.pi/agent/agents
 `;
+var VALIDATE_REVIEW_ARTIFACT_USAGE = "Usage: systematic validate-review-artifact <path>";
+var REVIEW_ARTIFACT_SCHEMA_RELATIVE_PATH = "skills/ce-review/references/review-summary-schema.json";
 function defaultCapabilityRoots() {
   const configDir = process.env.XDG_CONFIG_HOME ? path4.join(process.env.XDG_CONFIG_HOME, "opencode") : path4.join(os2.homedir(), ".config/opencode");
   return {
@@ -2498,6 +2663,151 @@ function runCapabilities(options) {
 function runCapabilitiesCli(options) {
   return runCapabilities(options);
 }
+function hasParentDirectoryTraversal(input) {
+  return input.split(/[\\/]+/).some((segment) => segment === "..");
+}
+function pathContainsSymlink(candidate) {
+  let current = path4.parse(candidate).root;
+  const relative2 = path4.relative(current, candidate);
+  for (const segment of relative2.split(path4.sep)) {
+    if (!segment)
+      continue;
+    current = path4.join(current, segment);
+    try {
+      if (fs5.lstatSync(current).isSymbolicLink())
+        return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function isWithinDirectory(candidate, directory) {
+  const relative2 = path4.relative(directory, candidate);
+  return relative2 !== "" && relative2 !== ".." && !relative2.startsWith(`..${path4.sep}`) && !path4.isAbsolute(relative2);
+}
+function resolveReviewArtifactPath(input, cwd) {
+  if (hasParentDirectoryTraversal(input)) {
+    return {
+      message: "Review artifact path must not contain parent-directory traversal",
+      ok: false
+    };
+  }
+  const artifactRoot = path4.resolve(cwd, ".context", "systematic", "ce-review");
+  let canonicalRoot;
+  try {
+    canonicalRoot = fs5.realpathSync(artifactRoot);
+    if (!fs5.statSync(canonicalRoot).isDirectory()) {
+      return {
+        message: "Review artifact directory is not a directory",
+        ok: false
+      };
+    }
+  } catch {
+    return { message: "Review artifact directory is unavailable", ok: false };
+  }
+  const candidate = path4.resolve(cwd, input);
+  if (pathContainsSymlink(candidate)) {
+    return {
+      message: "Review artifact path must not contain symlinks",
+      ok: false
+    };
+  }
+  let canonicalTarget;
+  try {
+    canonicalTarget = fs5.realpathSync(candidate);
+  } catch {
+    return { message: "Review artifact file was not found", ok: false };
+  }
+  if (!isWithinDirectory(canonicalTarget, canonicalRoot)) {
+    return {
+      message: "Review artifact path must remain inside .context/systematic/ce-review",
+      ok: false
+    };
+  }
+  try {
+    if (!fs5.lstatSync(canonicalTarget).isFile()) {
+      return {
+        message: "Review artifact target is not a regular file",
+        ok: false
+      };
+    }
+  } catch {
+    return { message: "Review artifact file was not found", ok: false };
+  }
+  return { ok: true, path: canonicalTarget };
+}
+function formatReviewArtifactIssuePath(issuePath) {
+  if (issuePath.length === 0)
+    return "$";
+  return issuePath.map((segment) => typeof segment === "number" ? String(segment) : segment).join(".");
+}
+function validateReviewArtifactArgument(argv) {
+  const commandIndex = argv[0] === "systematic" ? 1 : 0;
+  if (argv[commandIndex] !== "validate-review-artifact")
+    return;
+  if (argv.length !== commandIndex + 2)
+    return;
+  return argv[commandIndex + 1];
+}
+function readReviewArtifact(filePath) {
+  let content;
+  try {
+    content = fs5.readFileSync(filePath, "utf8");
+  } catch {
+    return { message: "Review artifact file could not be read", ok: false };
+  }
+  try {
+    return { ok: true, value: JSON.parse(content) };
+  } catch (error) {
+    return {
+      message: error instanceof SyntaxError ? "Review artifact contains malformed JSON" : "Review artifact file could not be read",
+      ok: false
+    };
+  }
+}
+function isLegacyReviewArtifact(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && !Object.hasOwn(value, "schema_version");
+}
+function runValidateReviewArtifact(options) {
+  const outputSink = options.outputSink ?? ((message) => console.log(message));
+  const errorSink = options.errorSink ?? ((message) => console.error(message));
+  const input = validateReviewArtifactArgument(options.argv);
+  if (input === undefined) {
+    errorSink(VALIDATE_REVIEW_ARTIFACT_USAGE);
+    return 2;
+  }
+  const resolved = resolveReviewArtifactPath(input, options.cwd ?? process.cwd());
+  if (!resolved.ok) {
+    errorSink(resolved.message);
+    return 2;
+  }
+  const artifact = readReviewArtifact(resolved.path);
+  if (!artifact.ok) {
+    errorSink(artifact.message);
+    return 2;
+  }
+  if (isLegacyReviewArtifact(artifact.value)) {
+    errorSink("Legacy review artifact: no schema_version field");
+    return 3;
+  }
+  const result = ReviewArtifactSchema.safeParse(artifact.value);
+  if (!result.success) {
+    for (const issue of result.error.issues) {
+      const issuePath = formatReviewArtifactIssuePath(issue.path);
+      const authoredMessage = issue.code === "custom" ? `: ${issue.message}` : "";
+      errorSink(`${issuePath} ${issue.code}${authoredMessage}`);
+    }
+    errorSink(`Schema: ${REVIEW_ARTIFACT_SCHEMA_RELATIVE_PATH}`);
+    errorSink(`Review artifact validation failed: ${result.error.issues.length} issue(s)`);
+    return 1;
+  }
+  outputSink("Review artifact is valid");
+  return 0;
+}
+function runValidateReviewArtifactCli(options) {
+  return runValidateReviewArtifact(options);
+}
 function isHarness(value) {
   return value === "opencode" || value === "pi";
 }
@@ -2750,6 +3060,17 @@ function runLegacyCli(args) {
         process.exit(status);
       break;
     }
+    case "validate-review-artifact": {
+      const status = runValidateReviewArtifactCli({
+        argv: ["systematic", ...args],
+        cwd: process.cwd(),
+        errorSink: console.error,
+        outputSink: console.log
+      });
+      if (status !== 0)
+        process.exit(status);
+      break;
+    }
     case "setup":
       setupCommand(args.slice(1));
       break;
@@ -2792,5 +3113,6 @@ if (import.meta.main) {
   runLegacyCli(process.argv.slice(2));
 }
 export {
-  runCapabilitiesCli
+  runCapabilitiesCli,
+  runValidateReviewArtifactCli
 };