@goodandready/dsh-kanban 0.2.31 → 0.2.33

package/lib/verification.js

@@ -0,0 +1,242 @@
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * Run verification gate command for task before moving to review (#372).
+ *
+ * @param {object} options
+ * @param {object} options.task
+ * @param {object|Function} options.config
+ * @param {string} [options.worktreePath]
+ * @param {Function} [options.spawnRunner]
+ * @returns {Promise<{
+ *   passed: boolean,
+ *   skipped?: boolean,
+ *   skipReason?: string,
+ *   command: string,
+ *   exitCode: number,
+ *   stdout: string,
+ *   stderr: string,
+ *   logSnippet: string,
+ *   durationMs: number
+ * }>}
+ */
+export async function runVerificationGate({
+  task,
+  config,
+  worktreePath,
+  spawnRunner = spawn,
+}) {
+  const cfg = typeof config === 'function' ? config() : (config || {})
+  const enabled = cfg.verificationGateEnabled !== false
+  const customCmd = typeof task?.verificationCommand === 'string' && task.verificationCommand.trim() !== ''
+    ? task.verificationCommand.trim()
+    : ''
+  const defaultCmd = typeof cfg.verificationCommand === 'string' && cfg.verificationCommand.trim() !== ''
+    ? cfg.verificationCommand.trim()
+    : 'npm test'
+  const command = customCmd || defaultCmd
+  const timeoutMs = Number(task?.verificationTimeoutMs || cfg.verificationTimeoutMs) || 120000
+
+  const cwd = worktreePath || task?.worktree
+  if (!cwd || !existsSync(cwd)) {
+    return {
+      passed: true,
+      skipped: true,
+      skipReason: 'worktree-not-found',
+      command,
+      exitCode: 0,
+      stdout: '',
+      stderr: '',
+      logSnippet: '',
+      durationMs: 0,
+    }
+  }
+
+  // If gate is disabled and no task-specific command was configured, skip
+  if (!enabled && !customCmd) {
+    return {
+      passed: true,
+      skipped: true,
+      skipReason: 'gate-disabled',
+      command,
+      exitCode: 0,
+      stdout: '',
+      stderr: '',
+      logSnippet: '',
+      durationMs: 0,
+    }
+  }
+
+  // If using default 'npm test' but no package.json exists in worktree, skip safely
+  if (!customCmd && defaultCmd === 'npm test') {
+    const pkgPath = join(cwd, 'package.json')
+    if (!existsSync(pkgPath)) {
+      return {
+        passed: true,
+        skipped: true,
+        skipReason: 'no-package-json',
+        command,
+        exitCode: 0,
+        stdout: '',
+        stderr: '',
+        logSnippet: '',
+        durationMs: 0,
+      }
+    }
+  }
+
+  const start = Date.now()
+  return new Promise((resolve) => {
+    let stdout = ''
+    let stderr = ''
+    let timedOut = false
+    const MAX_OUTPUT = 64 * 1024
+
+    const proc = spawnRunner('bash', ['-lc', command], {
+      cwd,
+      timeout: timeoutMs,
+      env: {
+        ...process.env,
+        CI: 'true',
+        DEBIAN_FRONTEND: 'noninteractive',
+      },
+    })
+
+    const timer = setTimeout(() => {
+      timedOut = true
+      try { proc.kill('SIGTERM') } catch { /* ignore */ }
+    }, timeoutMs)
+
+    proc.stdout?.on('data', (chunk) => {
+      if (stdout.length < MAX_OUTPUT) {
+        stdout += chunk.toString('utf8')
+      }
+    })
+
+    proc.stderr?.on('data', (chunk) => {
+      if (stderr.length < MAX_OUTPUT) {
+        stderr += chunk.toString('utf8')
+      }
+    })
+
+    proc.on('error', (err) => {
+      clearTimeout(timer)
+      const durationMs = Date.now() - start
+      stderr += '\n' + (err.message || String(err))
+      resolve({
+        passed: false,
+        command,
+        exitCode: 1,
+        stdout,
+        stderr,
+        logSnippet: (stdout + '\n' + stderr).trim().slice(-4000),
+        durationMs,
+      })
+    })
+
+    proc.on('close', (code, signal) => {
+      clearTimeout(timer)
+      const durationMs = Date.now() - start
+      if (timedOut || signal === 'SIGTERM') {
+        stderr += `\n[Verification Gate] Execution timed out after ${timeoutMs}ms.`
+      }
+      const exitCode = typeof code === 'number' ? code : (timedOut ? 124 : 1)
+      const passed = exitCode === 0
+      const logSnippet = (stdout + '\n' + stderr).trim().slice(-4000)
+      resolve({
+        passed,
+        command,
+        exitCode,
+        stdout,
+        stderr,
+        logSnippet,
+        durationMs,
+      })
+    })
+  })
+}
+
+/**
+ * Send failure prompt to agent session if active.
+ */
+export function sendVerificationFailurePrompt({ agents, task, createMessage, command, exitCode, logSnippet }) {
+  const sessionId = typeof task?.sessionId === 'string' ? task.sessionId : ''
+  if (!sessionId || !agents) return false
+  let agent
+  try { agent = agents.get(sessionId) } catch { agent = undefined }
+  if (!agent || typeof agent.followup !== 'function') return false
+
+  const text = "Automated verification before Review failed (" + command + ", exit code " + exitCode + ").\nFix the test failures:\n\n```\n" + logSnippet + "\n```"
+  try {
+    const msg = typeof createMessage === 'function'
+      ? createMessage({
+          content: [{ type: 'text', text }],
+          source: { kind: 'dsh-kanban', plugin: 'dsh-kanban', form: 'verification-failure' },
+        })
+      : { content: [{ type: 'text', text }] }
+    agent.followup(msg)
+    return true
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Check and run verification gate before move to review, recording outcome.
+ *
+ * @returns {Promise<{ allowed: boolean, verification: object }>}
+ */
+export async function verifyAndRecordGate({
+  task,
+  config,
+  store,
+  agents,
+  createMessage,
+  spawnRunner,
+}) {
+  const vRes = await runVerificationGate({ task, config, spawnRunner })
+  if (vRes.skipped) {
+    return { allowed: true, verification: vRes }
+  }
+
+  const currentReport = typeof task.report === 'object' && task.report ? { ...task.report } : {}
+  currentReport.verification = {
+    status: vRes.passed ? 'passed' : 'failed',
+    command: vRes.command,
+    exitCode: vRes.exitCode,
+    durationMs: vRes.durationMs,
+    verifiedAt: Date.now(),
+    log: vRes.logSnippet,
+  }
+
+  if (store) {
+    store.setReport(task.id, currentReport)
+    store.updateTask(task.id, {
+      verificationStatus: vRes.passed ? 'passed' : 'failed',
+    })
+
+    if (!vRes.passed) {
+      store.addComment(task.id, {
+        author: 'system',
+        role: 'system',
+        text: `[Verification Gate Failed]: \`${vRes.command}\` exited with code ${vRes.exitCode}.\n\`\`\`\n${vRes.logSnippet.slice(-2000)}\n\`\`\``,
+      })
+    }
+  }
+
+  if (!vRes.passed) {
+    sendVerificationFailurePrompt({
+      agents,
+      task,
+      createMessage,
+      command: vRes.command,
+      exitCode: vRes.exitCode,
+      logSnippet: vRes.logSnippet,
+    })
+    return { allowed: false, verification: vRes }
+  }
+
+  return { allowed: true, verification: vRes }
+}

package/lib/worktree.js

@@ -13,7 +13,7 @@
 
 import { execFile } from 'node:child_process'
 import { promisify } from 'node:util'
-import { existsSync, readFileSync, readdirSync } from 'node:fs'
+import { existsSync, readFileSync, readdirSync, rmSync } from 'node:fs'
 import { basename, relative } from 'node:path'
 import { isAbsolute, join, resolve, sep } from 'node:path'
 
@@ -752,3 +752,164 @@ export async function prepareMultiRepoMirror({ task, workspacePath, gitRunner =
 
   return { mirrors, errors: errors.length > 0 ? errors : undefined }
 }
+
+
+/**
+ * Diff inspector returning structured files list with numstat counts (#371).
+ *
+ * @param {{worktreePath: string, baseRef?: string, gitRunner?: Function}} options
+ * @returns {Promise<{
+ *   worktree: boolean,
+ *   baseRef: string,
+ *   files: Array<{path: string, status: string, insertions: number, deletions: number}>,
+ *   diff: string,
+ *   truncated: boolean,
+ *   filesChanged: number
+ * }>}
+ */
+export async function getTaskDiffInspector({ worktreePath, baseRef, gitRunner = defaultGitRunner }) {
+  if (!worktreePath) return { worktree: false, files: [], diff: '', filesChanged: 0, truncated: false }
+  const isRepo = await isGitRepo(worktreePath, gitRunner)
+  if (!isRepo) return { worktree: false, files: [], diff: '', filesChanged: 0, truncated: false }
+
+  let base = baseRef
+  if (!base) {
+    base = await determineBaseRef(worktreePath, gitRunner)
+  }
+
+  // 1. Map files from status --porcelain=v1 -u
+  const statusRes = await gitRunner(['status', '--porcelain=v1', '-u'], worktreePath)
+  const statusLines = (statusRes?.stdout || '').trim().split('\n').filter(Boolean)
+  const filesMap = new Map()
+
+  for (const line of statusLines) {
+    const code = line.slice(0, 2)
+    let filePath = line.slice(3).trim()
+    if (filePath.includes(' -> ')) {
+      filePath = filePath.split(' -> ')[1].trim()
+    }
+    if (filePath.startsWith('"') && filePath.endsWith('"')) {
+      filePath = filePath.slice(1, -1)
+    }
+
+    let status = 'modified'
+    if (code === '??') status = 'untracked'
+    else if (code.includes('A')) status = 'added'
+    else if (code.includes('D')) status = 'deleted'
+    else if (code.includes('R')) status = 'renamed'
+    else if (code.includes('M')) status = 'modified'
+
+    filesMap.set(filePath, { path: filePath, status, insertions: 0, deletions: 0 })
+  }
+
+  // 2. Line counts from git diff --numstat
+  if (base) {
+    const numstatBase = await gitRunner(['diff', '--numstat', `${base}...HEAD`], worktreePath)
+    if ((numstatBase?.exitCode ?? numstatBase?.code ?? 0) === 0) {
+      for (const line of (numstatBase.stdout || '').trim().split('\n').filter(Boolean)) {
+        const parts = line.split('\t')
+        if (parts.length >= 3) {
+          const ins = parseInt(parts[0], 10) || 0
+          const del = parseInt(parts[1], 10) || 0
+          let p = parts[2].trim()
+          if (p.includes(' => ')) {
+            p = p.replace(/.*=>\s*/, '').replace(/[{}]/g, '').trim()
+          }
+          if (p.startsWith('"') && p.endsWith('"')) p = p.slice(1, -1)
+          const existing = filesMap.get(p)
+          if (existing) {
+            existing.insertions += ins
+            existing.deletions += del
+          } else {
+            filesMap.set(p, { path: p, status: 'modified', insertions: ins, deletions: del })
+          }
+        }
+      }
+    }
+  }
+
+  const numstatHead = await gitRunner(['diff', '--numstat', 'HEAD'], worktreePath)
+  if ((numstatHead?.exitCode ?? numstatHead?.code ?? 0) === 0) {
+    for (const line of (numstatHead.stdout || '').trim().split('\n').filter(Boolean)) {
+      const parts = line.split('\t')
+      if (parts.length >= 3) {
+        const ins = parseInt(parts[0], 10) || 0
+        const del = parseInt(parts[1], 10) || 0
+        let p = parts[2].trim()
+        if (p.includes(' => ')) {
+          p = p.replace(/.*=>\s*/, '').replace(/[{}]/g, '').trim()
+        }
+        if (p.startsWith('"') && p.endsWith('"')) p = p.slice(1, -1)
+        const existing = filesMap.get(p)
+        if (existing) {
+          existing.insertions += ins
+          existing.deletions += del
+        } else {
+          filesMap.set(p, { path: p, status: 'modified', insertions: ins, deletions: del })
+        }
+      }
+    }
+  }
+
+  // 3. Diff content (with 500 KB ceiling per #371)
+  const diffRes = await getTaskDiff({ worktreePath, baseRef: base, gitRunner })
+  const files = Array.from(filesMap.values())
+
+  return {
+    worktree: true,
+    baseRef: base || '',
+    files,
+    diff: diffRes.diff,
+    truncated: diffRes.truncated,
+    filesChanged: files.length > 0 ? files.length : diffRes.filesChanged,
+  }
+}
+
+/**
+ * Discard changes to a specific file in task worktree safely (#371).
+ *
+ * @param {{worktreePath: string, file: string, gitRunner?: Function}} options
+ * @returns {Promise<{success: boolean, file?: string, tracked?: boolean, error?: string}>}
+ */
+export async function discardTaskFile({ worktreePath, file, gitRunner = defaultGitRunner }) {
+  if (!worktreePath || !file || typeof file !== 'string') {
+    return { success: false, error: 'invalid-parameters' }
+  }
+
+  // Path fencing check: prevent directory traversal or outside deletion
+  if (isAbsolute(file) || file.includes('..')) {
+    return { success: false, error: 'path-traversal-detected' }
+  }
+
+  const fullPath = resolve(worktreePath, file)
+  const rootResolved = resolve(worktreePath)
+  if (!fullPath.startsWith(rootResolved + sep) && fullPath !== rootResolved) {
+    return { success: false, error: 'path-outside-worktree' }
+  }
+
+  // Check if file is tracked by git
+  let isTracked = false
+  try {
+    const lsRes = await gitRunner(['ls-files', '--error-unmatch', file], worktreePath)
+    isTracked = (lsRes?.exitCode ?? lsRes?.code ?? 0) === 0
+  } catch {
+    isTracked = false
+  }
+
+  if (isTracked) {
+    // Restore staged and unstaged
+    await gitRunner(['restore', '--staged', '--worktree', '--', file], worktreePath)
+    await gitRunner(['checkout', 'HEAD', '--', file], worktreePath)
+    return { success: true, file, tracked: true }
+  } else {
+    // Untracked file: remove safely
+    try {
+      if (existsSync(fullPath)) {
+        rmSync(fullPath, { recursive: true, force: true })
+      }
+      return { success: true, file, tracked: false }
+    } catch (e) {
+      return { success: false, error: e?.message || 'failed-to-delete-untracked-file' }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodandready/dsh-kanban",
-  "version": "0.2.31",
+  "version": "0.2.33",
   "description": "Visual Kanban board for DeepSeek Harness: Gitea and GitHub-backed tasks, workflow columns, and a dedicated agent session per task.",
   "type": "module",
   "main": "lib/index.js",