@kylecheng3146/agent-ops 0.1.17 → 0.1.19

package/dist/runtime/src/fs/managed-block.js

@@ -2,6 +2,13 @@ import { AgentOpsError } from "./paths.js";
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+export function normalizeToLF(source) {
+    return source.replace(/\r\n/g, "\n");
+}
+/** Newline sequence to use for newly rendered content, inferred from the file. */
+function detectNewline(source) {
+    return source.includes("\r\n") ? "\r\n" : "\n";
+}
 function assertBlockId(id) {
     if (!/^[a-z][a-z0-9-]{0,127}$/.test(id)) {
         throw new AgentOpsError("INVALID_BLOCK_ID", `Invalid block ID: ${id}`);
@@ -70,25 +77,30 @@ function locateMarkers(source, id, version, markerStyle = "html") {
     }
     return { start, end, startIndex, endIndex };
 }
-function renderBlock(options) {
+function renderBlock(options, nl) {
     if (/(?:<!--|#)\s*agent-ops:/.test(options.content)) {
         throw new AgentOpsError("AMBIGUOUS_MANAGED_CONTENT", "Managed content must not contain agent-ops marker boundaries.");
     }
     const { start, end } = managedBlockMarkers(options.id, options.version, options.markerStyle);
-    const content = options.content.replace(/\r\n/g, "\n").replace(/\n+$/g, "");
-    return `${start}\n${content}\n${end}`;
+    const content = normalizeToLF(options.content)
+        .replace(/\n+$/g, "")
+        .split("\n")
+        .join(nl);
+    return `${start}${nl}${content}${nl}${end}`;
 }
 export function applyManagedBlock(source, options) {
-    const block = renderBlock(options);
+    const nl = detectNewline(source);
+    const block = renderBlock(options, nl);
     const located = locateMarkers(source, options.id, options.version, options.markerStyle);
     if (located === null) {
         if (source.length === 0) {
-            return `${block}\n`;
+            return `${block}${nl}`;
         }
-        return `${source.replace(/\n*$/, "\n\n")}${block}\n`;
+        return `${source.replace(/(?:\r\n|\n)*$/, `${nl}${nl}`)}${block}${nl}`;
     }
     return `${source.slice(0, located.startIndex)}${block}${source.slice(located.endIndex + located.end.length)}`;
 }
+const NEWLINE_STYLES = ["\r\n", "\n"];
 export function removeManagedBlock(source, id, markerStyle = "html") {
     const located = locateMarkers(source, id, undefined, markerStyle);
     if (located === null) {
@@ -96,12 +108,13 @@ export function removeManagedBlock(source, id, markerStyle = "html") {
     }
     let before = source.slice(0, located.startIndex);
     let after = source.slice(located.endIndex + located.end.length);
-    if (before.length === 0 && after === "\n") {
+    if (before.length === 0 && NEWLINE_STYLES.some((nl) => after === nl)) {
         return "";
     }
-    if (before.endsWith("\n\n") && after.startsWith("\n")) {
-        before = before.slice(0, -1);
-        after = after.slice(1);
+    const collapseNl = NEWLINE_STYLES.find((nl) => before.endsWith(`${nl}${nl}`) && after.startsWith(nl));
+    if (collapseNl !== undefined) {
+        before = before.slice(0, -collapseNl.length);
+        after = after.slice(collapseNl.length);
     }
     return `${before}${after}`;
 }

package/dist/runtime/src/install/ownership.js

@@ -1,4 +1,4 @@
-import { applyManagedBlock, managedBlockMarkers } from "../fs/managed-block.js";
+import { applyManagedBlock, managedBlockMarkers, normalizeToLF } from "../fs/managed-block.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { harnessDescriptor, harnessHookPath, routingBlockId, selectHarnessHookSurface, rulesArtifactId } from "./harness.js";
 import { isOpencodePluginPath } from "../adapters/opencode/config.js";
@@ -211,18 +211,18 @@ export function assertExpectedManagedBlock(source, marker, expected) {
         startIndex >= endIndex) {
         throw new AgentOpsError("MANAGED_BLOCK_CHANGED", `Managed block boundaries changed after installation: ${marker.path}`);
     }
-    const currentBlock = source.slice(startIndex, endIndex + marker.endMarker.length);
+    const currentBlock = normalizeToLF(source.slice(startIndex, endIndex + marker.endMarker.length));
     const candidates = [
         ["desired", expected.content],
         ...expected.legacyContent.map((content) => ["legacy", content])
     ];
     for (const [kind, content] of candidates) {
-        const expectedBlock = applyManagedBlock("", {
+        const expectedBlock = normalizeToLF(applyManagedBlock("", {
             id: expected.id,
             version: 1,
             content,
             markerStyle: expected.markerStyle
-        }).replace(/\n$/u, "");
+        }).replace(/\n$/u, ""));
         if (currentBlock === expectedBlock) {
             return kind;
         }

package/dist/runtime/src/review/execute.js

@@ -103,6 +103,17 @@ function firstComplaint(...streams) {
     }
     return undefined;
 }
+function rejectedCallReason(output) {
+    if (/\b(?:quota|rate limit|usage limit|too many requests)\b/iu.test(output)) {
+        return "quota-exhausted";
+    }
+    if (/\b(?:not logged in|login required|log in to|authentication required|unauthenticated|unauthorized)\b/iu.test(output) ||
+        /\b(?:invalid|expired)\s+(?:api key|token|credential)/iu.test(output) ||
+        /\b401\b/u.test(output)) {
+        return "login-required";
+    }
+    return "capability-unavailable";
+}
 async function snapshotRepository(request, destination, options) {
     const cloned = await runVerificationCommand({
         id: `review-snapshot-${request.label}`,
@@ -256,11 +267,8 @@ async function attemptTarget(request, options) {
             return skip("output-too-large", `${spawned.stdoutTruncated ? "stdout" : "stderr"} exceeded the capture limit`);
         }
         if (spawned.failureClass === "nonzero-exit") {
-            // A rejected call is usually missing authentication, but a stale flag
-            // shape exits non-zero too, and reporting only "login-required" sends
-            // the reader to `doctor --check-auth` for a problem it cannot see. The
-            // target's own first line of complaint distinguishes the two.
-            return skip("login-required", firstComplaint(spawned.stderr, spawned.stdout) ??
+            const output = `${spawned.stderr}\n${spawned.stdout}`;
+            return skip(rejectedCallReason(output), firstComplaint(spawned.stderr, spawned.stdout) ??
                 `the call was rejected with exit ${spawned.exitCode ?? "unknown"} and no output`);
         }
         const payload = extractReviewObject(target, spawned.stdout);

package/dist/runtime/src/review/render.js

@@ -40,7 +40,10 @@ export function renderReviewResult(result) {
         for (const error of result.validationErrors ?? []) {
             lines.push(`- ${safe(error.path)}: ${safe(error.code)} — ${safe(error.message)}`);
         }
-        lines.push("Run: agent-ops doctor --check-auth to verify target authentication.");
+        if (result.reason === "login-required" ||
+            result.attempts?.some((attempt) => attempt.reason === "login-required")) {
+            lines.push("Run: agent-ops doctor --check-auth to verify target authentication.");
+        }
         return `${lines.join("\n")}\n`;
     }
     const report = result.report;

package/docs/en/guides/configuration.md

@@ -94,8 +94,11 @@ human-readable report is transient. Completed tasks are never rewritten.
 `--yes` is still required for every review run: init selection decides which
 targets are permitted, `--yes` decides whether to spend money now.
 
-Because target authentication is not sniffed from stderr, an unauthenticated
-CLI surfaces as one review failure. Diagnose it with:
+Reviewer failures are classified conservatively from their output: recognizable
+authentication messages become `login-required`, quota messages become
+`quota-exhausted`, and other non-zero exits become `capability-unavailable`.
+The review suggests `doctor --check-auth` only when an authentication failure
+was detected. Confirm target authentication with:
 
 ```bash
 agent-ops doctor              # presence only: no tokens, no network

package/docs/zh-TW/guides/configuration.md

@@ -82,8 +82,10 @@ policy 設定仍相同的 task；`--criterion` 用來篩選 id。請先執行
 每次執行 review 仍需 `--yes`：init 的勾選決定「允許哪些目標」，
 `--yes` 決定「現在是否要花錢」。
 
-因為不從 stderr 嗅探認證狀態，未登入的 CLI 會表現為一次 review 失敗。
-用以下指令診斷：
+Reviewer 失敗會依輸出採保守分類：可辨識的認證訊息為 `login-required`，
+quota 訊息為 `quota-exhausted`，其他非零退出則為 `capability-unavailable`。
+只有偵測到認證失敗時，review 才會建議執行 `doctor --check-auth`。
+可用以下指令確認目標的認證狀態：
 
 ```bash
 agent-ops doctor              # 只驗執行檔存在：零 token、零網路

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kylecheng3146/agent-ops",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Evidence-driven development loops for Codex, Claude Code, and opencode",
   "type": "module",
   "license": "MIT",