@kylecheng3146/agent-ops 0.1.6 → 0.1.8

package/dist/packages/cli/src/commands/review.js

@@ -1,20 +1,222 @@
 import { buildReviewPacket } from "../../../../runtime/src/review/packet.js";
 import { runIndependentReview } from "../../../../runtime/src/review/runner.js";
+import { renderReviewResult } from "../../../../runtime/src/review/render.js";
 import { resolveReviewRole } from "../../../../runtime/src/review/roles.js";
+import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
+import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, reviewScopeSignature } from "../../../../runtime/src/review/scope.js";
+import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
+import { calculateConfigHash, isPassingVerificationEvidence } from "../../../../runtime/src/verify/evidence.js";
+import { validateEvidence } from "../../../../runtime/src/schema/validate.js";
 import { okEnvelope } from "../output.js";
 /**
- * Review runs against one harness. Argument parsing already rejects a
+ * Review runs against one target. Argument parsing already rejects a
  * multi-harness selection here, so the first entry is the whole selection.
+ * `opencode` is not a review target — it has no read-only flag — so selecting
+ * it leaves the target unresolved and the configured chain decides.
  */
 function harness(value) {
-    return value?.[0] ?? "codex";
+    const selected = value?.[0];
+    return selected === undefined || selected === "opencode"
+        ? undefined
+        : selected;
 }
-export async function runReviewCommand(options) {
-    const ids = options.args.criteria ?? [];
-    const criteria = ids.map((id) => ({
-        id,
-        description: id
+/**
+ * Criterion descriptions come from the task store, never from the id. A
+ * reviewer handed `criterion: tests` cannot review anything, so a review with
+ * no task context is reported as not run rather than run meaninglessly.
+ */
+async function taskContext(options) {
+    const tasks = options.tasks;
+    if (tasks === undefined) {
+        return undefined;
+    }
+    const query = options.taskId !== undefined
+        ? { taskId: options.taskId }
+        : options.sessionId === undefined
+            ? undefined
+            : { sessionId: options.sessionId };
+    if (query === undefined) {
+        return undefined;
+    }
+    let record;
+    try {
+        record = await tasks.status(query);
+    }
+    catch {
+        return undefined;
+    }
+    const requested = options.args.criteria ?? [];
+    const criteria = record.task.criteria
+        .filter((criterion) => requested.length === 0 || requested.includes(criterion.id))
+        .map((criterion) => ({
+        id: criterion.id,
+        description: criterion.description,
+        verifierIds: [...criterion.verifierIds]
     }));
+    if (criteria.length === 0 ||
+        (requested.length > 0 && criteria.length !== requested.length)) {
+        return undefined;
+    }
+    return {
+        taskId: record.task.id,
+        title: record.task.title,
+        active: record.status === "active",
+        policyConfigHash: record.policyConfigHash,
+        evidence: record.evidence,
+        failureFingerprint: record.failureFingerprint,
+        criteria
+    };
+}
+function newestEvidence(values) {
+    return [...values].sort((left, right) => {
+        const leftTime = Date.parse(left.evidence.finishedAt);
+        const rightTime = Date.parse(right.evidence.finishedAt);
+        return rightTime - leftTime || left.reference.localeCompare(right.reference);
+    })[0];
+}
+async function currentEvidence(options, context, criterionId, commandId, configHash, sourceFingerprint) {
+    const current = [];
+    let hasReference = false;
+    let unreadable = false;
+    let stale = false;
+    for (const reference of context.evidence[criterionId] ?? []) {
+        if (reference.startsWith("review:")) {
+            continue;
+        }
+        hasReference = true;
+        let stored;
+        try {
+            stored = await options.evidenceStore?.load(reference) ?? null;
+        }
+        catch {
+            unreadable = true;
+            continue;
+        }
+        const validation = validateEvidence(stored);
+        if (!validation.ok) {
+            unreadable = true;
+            continue;
+        }
+        const evidence = validation.value;
+        if (evidence.schemaVersion !== 2 ||
+            evidence.taskId !== context.taskId ||
+            evidence.criterionId !== criterionId ||
+            evidence.commandId !== commandId ||
+            evidence.configHash !== configHash ||
+            evidence.sourceFingerprint !== sourceFingerprint) {
+            stale = true;
+            continue;
+        }
+        current.push({ reference, evidence });
+    }
+    return { current, hasReference, unreadable, stale };
+}
+async function preflightReview(options, context, scope) {
+    if (options.config === undefined ||
+        options.evidenceStore === undefined ||
+        options.root === undefined ||
+        options.gitRunner === undefined ||
+        context.failureFingerprint !== null) {
+        return { ok: false, reason: "stale-verification" };
+    }
+    const configHash = calculateConfigHash(options.config);
+    const sourceFingerprint = await calculateSourceFingerprint(options.root, scope, options.gitRunner);
+    const commands = [];
+    for (const criterion of context.criteria) {
+        for (const commandId of criterion.verifierIds ?? []) {
+            const command = options.config.verification.commands.find((candidate) => candidate.id === commandId);
+            if (command === undefined) {
+                return { ok: false, reason: "missing-verification-evidence" };
+            }
+            const found = await currentEvidence(options, context, criterion.id, commandId, configHash, sourceFingerprint);
+            const selected = newestEvidence(found.current);
+            if (command.required !== true) {
+                if (selected !== undefined) {
+                    commands.push({
+                        criterionId: criterion.id,
+                        commandId,
+                        required: false,
+                        status: selected.evidence.status,
+                        evidenceReference: selected.reference
+                    });
+                }
+                continue;
+            }
+            if (selected === undefined) {
+                return {
+                    ok: false,
+                    reason: found.unreadable
+                        ? "unreadable-verification-evidence"
+                        : found.stale
+                            ? "stale-verification"
+                            : found.hasReference
+                                ? "missing-verification-evidence"
+                                : "missing-verification-evidence"
+                };
+            }
+            if (!isPassingVerificationEvidence(command, selected.evidence)) {
+                return { ok: false, reason: "verification-not-passed" };
+            }
+            commands.push({
+                criterionId: criterion.id,
+                commandId,
+                required: true,
+                status: "PASS",
+                evidenceReference: selected.reference
+            });
+        }
+    }
+    return {
+        ok: true,
+        summary: { status: "PASS", sourceFingerprint, commands }
+    };
+}
+function scopeReason(error) {
+    if (!(error instanceof AgentOpsError)) {
+        return undefined;
+    }
+    return {
+        REVIEW_UNSAFE_PATH: "unsafe-review-path",
+        REVIEW_NO_CHANGE_SURFACE: "no-change-surface",
+        REVIEW_DIRTY_WORKTREE: "dirty-worktree",
+        REVIEW_INVALID_BASE: "invalid-base"
+    }[error.code];
+}
+function notRunEnvelope(result) {
+    const message = "Independent review was not run.";
+    return {
+        code: "REVIEW_NOT_RUN",
+        status: "error",
+        data: {
+            message,
+            result,
+            text: renderReviewResult(result)
+        },
+        errors: [{ code: "REVIEW_NOT_RUN", message }]
+    };
+}
+function sourceChangedResult(result) {
+    return {
+        status: "NOT_RUN",
+        reason: "source-changed-during-review",
+        harness: result.harness,
+        model: result.model,
+        effort: result.effort,
+        prompt: result.prompt,
+        ...(result.scope === undefined ? {} : { scope: result.scope }),
+        ...(result.independence === undefined
+            ? {}
+            : { independence: result.independence }),
+        ...(result.verification === undefined
+            ? {}
+            : { verification: result.verification })
+    };
+}
+export async function runReviewCommand(options) {
+    const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
+    const selectedHarness = harness(options.args.harness);
+    const target = role?.targets[0] ?? selectedHarness ?? "codex";
+    const context = await taskContext(options);
     const evidenceRequirements = (options.args.evidence ?? []).map((value) => {
         const separator = value.indexOf("=");
         return {
@@ -22,19 +224,115 @@ export async function runReviewCommand(options) {
             requirement: separator < 0 ? value : value.slice(separator + 1)
         };
     });
-    const selectedHarness = harness(options.args.harness);
-    const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
+    if (context === undefined) {
+        return notRunEnvelope({
+            status: "NOT_RUN",
+            reason: "no-task-context",
+            harness: target,
+            model: role?.model ?? options.model ?? "configured",
+            effort: role?.effort ?? options.effort ?? "configured",
+            prompt: ""
+        });
+    }
+    let scope;
+    let verification;
+    if (options.root !== undefined && options.gitRunner !== undefined) {
+        try {
+            scope = await resolveReviewScope({
+                root: options.root,
+                runner: options.gitRunner,
+                ...(options.args.base === undefined ? {} : { base: options.args.base })
+            });
+        }
+        catch (error) {
+            const reason = scopeReason(error);
+            if (reason !== undefined) {
+                return notRunEnvelope({
+                    status: "NOT_RUN",
+                    reason,
+                    harness: target,
+                    model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured",
+                    prompt: ""
+                });
+            }
+            throw error;
+        }
+        if (scope.changedFiles.some(isReviewerPolicyPath)) {
+            return notRunEnvelope({
+                status: "NOT_RUN",
+                reason: "reviewer-policy-changed",
+                harness: target,
+                model: role?.model ?? options.model ?? "configured",
+                effort: role?.effort ?? options.effort ?? "configured",
+                prompt: "",
+                scope
+            });
+        }
+        if (options.policyConfigHash !== undefined) {
+            if (context.policyConfigHash === null) {
+                return notRunEnvelope({
+                    status: "NOT_RUN", reason: "reviewer-policy-baseline-missing",
+                    harness: target, model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured", prompt: "", scope
+                });
+            }
+            if (context.policyConfigHash !== options.policyConfigHash) {
+                return notRunEnvelope({
+                    status: "NOT_RUN", reason: "reviewer-policy-changed",
+                    harness: target, model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured", prompt: "", scope
+                });
+            }
+        }
+        const preflight = await preflightReview(options, context, scope);
+        if (!preflight.ok) {
+            return notRunEnvelope({
+                status: "NOT_RUN", reason: preflight.reason,
+                harness: target, model: role?.model ?? options.model ?? "configured",
+                effort: role?.effort ?? options.effort ?? "configured", prompt: "", scope
+            });
+        }
+        verification = preflight.summary;
+    }
+    const criteria = [...context.criteria];
+    let packet;
+    try {
+        packet = buildReviewPacket({
+            request: context.title,
+            criteria,
+            artifactRefs: scope?.changedFiles ?? [],
+            evidenceRequirements
+        });
+    }
+    catch (error) {
+        if (error instanceof AgentOpsError) {
+            const reason = error.code === "REVIEW_SENSITIVE_INPUT"
+                ? "sensitive-review-input"
+                : error.code === "REVIEW_SCOPE_TOO_LARGE"
+                    ? "scope-too-large"
+                    : undefined;
+            if (reason !== undefined) {
+                return notRunEnvelope({
+                    status: "NOT_RUN",
+                    reason,
+                    harness: target,
+                    model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured",
+                    prompt: ""
+                });
+            }
+        }
+        throw error;
+    }
     const result = await runIndependentReview({
         invocation: {
-            harness: role?.harness ?? selectedHarness,
+            harness: target,
             model: role?.model ?? options.model ?? "configured",
             effort: role?.effort ?? options.effort ?? "configured",
-            packet: buildReviewPacket({
-                request: "Review the requested implementation.",
-                criteria,
-                artifactRefs: [],
-                evidenceRequirements
-            })
+            packet,
+            ...(scope === undefined ? {} : { scope }),
+            ...(verification === undefined ? {} : { verification })
         },
         authorized: options.authorized,
         execute: options.execute ?? (async () => ({
@@ -42,6 +340,62 @@ export async function runReviewCommand(options) {
             reason: "missing-cli"
         }))
     });
+    if (scope !== undefined && result.report !== undefined && options.root !== undefined) {
+        try {
+            if (result.report.changedFilesInspected.length !== scope.changedFiles.length ||
+                result.report.changedFilesInspected.some((path) => !scope?.changedFiles.includes(path))) {
+                return notRunEnvelope({
+                    ...result,
+                    status: "NOT_RUN",
+                    reason: "incomplete-scope"
+                });
+            }
+            try {
+                await assertSafeSupportingPaths(options.root, result.report.supportingFilesInspected);
+            }
+            catch (error) {
+                if (scopeReason(error) === "unsafe-review-path") {
+                    return notRunEnvelope({
+                        ...result,
+                        status: "NOT_RUN",
+                        reason: "unsafe-review-path"
+                    });
+                }
+                throw error;
+            }
+            const postflight = await resolveReviewScope({
+                root: options.root,
+                runner: options.gitRunner,
+                ...(options.args.base === undefined ? {} : { base: options.args.base })
+            });
+            const currentHash = options.currentPolicyConfigHash === undefined
+                ? options.policyConfigHash
+                : await options.currentPolicyConfigHash();
+            const postflightFingerprint = verification === undefined
+                ? undefined
+                : await calculateSourceFingerprint(options.root, postflight, options.gitRunner);
+            if (reviewScopeSignature(scope) !== reviewScopeSignature(postflight) ||
+                (options.policyConfigHash !== undefined && currentHash !== options.policyConfigHash) ||
+                (verification !== undefined &&
+                    postflightFingerprint !== verification.sourceFingerprint)) {
+                return notRunEnvelope(sourceChangedResult(result));
+            }
+        }
+        catch {
+            return notRunEnvelope(sourceChangedResult(result));
+        }
+    }
+    // Evidence is only appended while the task is active: a completed record
+    // must stay exactly as it was verified.
+    if (options.tasks !== undefined &&
+        result.status === "PASS" &&
+        context.active &&
+        result.results !== undefined) {
+        await options.tasks.recordEvidence(context.taskId, Object.fromEntries(result.results.map((item) => [
+            item.criterionId,
+            item.evidence.map((reference) => `review:${result.harness}:${reference}`)
+        ])));
+    }
     const message = result.status === "PASS"
         ? "Independent review passed."
         : result.status === "FAIL"
@@ -50,17 +404,7 @@ export async function runReviewCommand(options) {
     const data = {
         message,
         result,
-        text: [
-            message,
-            `Status: ${result.status}`,
-            `Harness: ${result.harness}; model: ${result.model}; effort: ${result.effort}.`,
-            ...(result.reason === undefined ? [] : [`Reason: ${result.reason}.`]),
-            ...(result.results === undefined
-                ? []
-                : result.results.map((item) => `${item.criterionId}: ${item.status} [${item.evidence.join(", ")}]`)),
-            result.prompt,
-            ""
-        ].join("\n")
+        text: renderReviewResult(result)
     };
     if (result.status === "PASS") {
         return okEnvelope("REVIEW_RESULT", data);

package/dist/packages/cli/src/commands/task.js

@@ -89,7 +89,10 @@ export async function runTaskCommand(options) {
             }
             const record = await options.service.create({
                 title: options.args.title,
-                criteria: (options.args.criteria ?? []).map(parseCriterion)
+                criteria: (options.args.criteria ?? []).map(parseCriterion),
+                ...(options.policyConfigHash === undefined
+                    ? {}
+                    : { policyConfigHash: options.policyConfigHash })
             });
             return taskEnvelope(action, "TASK_CREATED", `Created task ${record.task.id}.`, record);
         }

package/dist/packages/cli/src/commands/verify.js

@@ -41,7 +41,19 @@ function publicReport(report) {
             testCount: result.testCount,
             evidenceReferences: result.evidenceReferences.map(redactSecrets)
         })),
-        signal: report.signal
+        signal: report.signal,
+        reviewScope: report.reviewScope.mode === "base"
+            ? {
+                mode: "base",
+                baseRef: redactSecrets(report.reviewScope.baseRef),
+                resolvedBase: report.reviewScope.resolvedBase,
+                changedFiles: report.reviewScope.changedFiles.map(redactSecrets)
+            }
+            : {
+                mode: "worktree",
+                changedFiles: report.reviewScope.changedFiles.map(redactSecrets)
+            },
+        sourceFingerprint: report.sourceFingerprint
     };
 }
 function formatResult(result) {

package/dist/packages/cli/src/version.js

@@ -1,3 +1,3 @@
 // Single source of the published CLI version. Release preparation updates
 // this constant; bin.ts and the hook entry both read it from here.
-export const CLI_VERSION = "0.1.6";
+export const CLI_VERSION = "0.1.7";

package/dist/packages/cli/src/wizard.js

@@ -1,9 +1,49 @@
 import { CliArgumentError } from "./args.js";
+import { DEFAULT_REVIEW_TARGETS } from "../../../runtime/src/review/roles.js";
 import { HARNESS_IDS, resolveHarnessSelection } from "../../../runtime/src/install/harness.js";
 import { selectOption, selectOptions } from "./ui.js";
 const SCOPES = new Set(["project", "user"]);
 const PROFILES = new Set(["advisory", "core", "guardrails", "loop"]);
 const DEFAULT_HARNESS = [];
+const REVIEW_TARGET_SET = new Set(DEFAULT_REVIEW_TARGETS);
+const REVIEW_TARGET_CHOICES = DEFAULT_REVIEW_TARGETS.map((id) => ({
+    label: id,
+    value: id,
+    description: id === "codex"
+        ? "Retained for future isolation support; currently not auto-run."
+        : id === "agy"
+            ? "Retained for future isolation support; currently not auto-run."
+            : "Runs in fresh safe mode with context isolation."
+}));
+function selectReviewTargets(raw) {
+    const values = raw
+        .split(",")
+        .map((value) => value.trim())
+        .filter((value) => value.length > 0);
+    for (const value of values) {
+        if (!REVIEW_TARGET_SET.has(value)) {
+            throw new CliArgumentError("CLI_INVALID_VALUE", `Invalid review target: ${value}`, "--review-target");
+        }
+    }
+    // Declared order wins: the chain order is the option list, not click order.
+    return DEFAULT_REVIEW_TARGETS.filter((target) => values.includes(target));
+}
+function affirmative(raw) {
+    return /^(y|yes)$/i.test(raw.trim());
+}
+async function probeReviewTargets(targets, setup) {
+    const probe = setup.probeReviewTarget;
+    if (probe === undefined) {
+        return;
+    }
+    for (const target of targets) {
+        if (!(await probe(target))) {
+            setup.warn?.(`${target} is not usable yet (missing or unauthenticated). ` +
+                `Install it or run: ${target} login, ` +
+                "then: agent-ops doctor --check-auth");
+        }
+    }
+}
 const SCOPE_CHOICES = [
     { label: "project", value: "project" },
     { label: "user", value: "user" }
@@ -83,7 +123,7 @@ function selectProfiles(raw) {
     }
     return values;
 }
-export async function completeInitChoices(args, io) {
+export async function completeInitChoices(args, io, setup = {}) {
     if (args.command !== "init" ||
         (args.scope !== undefined &&
             args.harness !== undefined &&
@@ -117,11 +157,25 @@ export async function completeInitChoices(args, io) {
                 selectAllLabel: "Select all",
                 selectAllDescription: "Enable core, advisory, guardrails, and loop together."
             });
+        const enabled = args.reviewTargets !== undefined ||
+            (await selectOption("External review: call another agent CLI to review your work?", [
+                { label: "no", value: false, description: "Default. Nothing is spawned." },
+                {
+                    label: "yes",
+                    value: true,
+                    description: "Pick target CLIs; each is probed for authentication."
+                }
+            ], selectorIo));
+        const reviewTargets = args.reviewTargets ?? (enabled
+            ? await selectOptions("Review targets (multi-select: tried in listed order)", REVIEW_TARGET_CHOICES, selectorIo, [])
+            : []);
+        await probeReviewTargets(reviewTargets, setup);
         return {
             ...args,
             scope,
             harness,
-            profiles
+            profiles,
+            ...(reviewTargets.length === 0 ? {} : { reviewTargets })
         };
     }
     const session = await createPromptSession(io);
@@ -133,11 +187,16 @@ export async function completeInitChoices(args, io) {
         const profiles = args.profiles.length > 0
             ? args.profiles
             : selectProfiles(await session.question("Profiles (core,advisory,guardrails,loop) [core]: "));
+        const reviewTargets = args.reviewTargets ?? (affirmative(await session.question("Enable external review by another agent CLI? [y/N]: "))
+            ? selectReviewTargets(await session.question(`Review targets (${DEFAULT_REVIEW_TARGETS.join(",")}): `))
+            : []);
+        await probeReviewTargets(reviewTargets, setup);
         return {
             ...args,
             scope,
             harness,
-            profiles
+            profiles,
+            ...(reviewTargets.length === 0 ? {} : { reviewTargets })
         };
     }
     finally {

package/dist/runtime/src/config/merge.js

@@ -107,6 +107,7 @@ export function mergeConfigLayers(inputLayers) {
     const commands = new Map();
     const mappings = new Map();
     const exceptions = new Map();
+    const reviewRoles = new Map();
     let schemaVersion;
     let features;
     for (const layer of layers) {
@@ -128,6 +129,12 @@ export function mergeConfigLayers(inputLayers) {
             }
             mappings.set(key, effective(mapping, layer));
         }
+        // Keyed by role so a project can override one role without inheriting the
+        // rest. Review targets are a capability choice, not a guardrail, so no
+        // monotonic restriction applies.
+        for (const reviewRole of layer.config.reviewRoles ?? []) {
+            reviewRoles.set(reviewRole.role, effective(reviewRole, layer));
+        }
         for (const securityException of layer.config.securityExceptions) {
             const key = exceptionKey(securityException);
             const existing = exceptions.get(key);
@@ -150,7 +157,8 @@ export function mergeConfigLayers(inputLayers) {
         profiles: [...profiles.values()],
         verificationCommands: [...commands.values()],
         pathMappings: [...mappings.values()],
-        securityExceptions: [...exceptions.values()]
+        securityExceptions: [...exceptions.values()],
+        reviewRoles: [...reviewRoles.values()]
     };
     const config = {
         schemaVersion: schemaVersion.value,
@@ -160,7 +168,14 @@ export function mergeConfigLayers(inputLayers) {
         },
         features: provenance.features.value,
         pathMappings: provenance.pathMappings.map(({ value }) => value),
-        securityExceptions: provenance.securityExceptions.map(({ value }) => value)
+        securityExceptions: provenance.securityExceptions.map(({ value }) => value),
+        // Absent, not empty: an empty array would read as "configured with no
+        // targets" rather than "external review disabled".
+        ...(provenance.reviewRoles.length === 0
+            ? {}
+            : {
+                reviewRoles: provenance.reviewRoles.map(({ value }) => value)
+            })
     };
     const validation = validateConfig(config);
     if (!validation.ok) {

package/dist/runtime/src/contracts.js

@@ -1,6 +1,6 @@
 export const CONFIG_SCHEMA_VERSION = 2;
 export const TASK_SCHEMA_VERSION = 1;
-export const EVIDENCE_SCHEMA_VERSION = 1;
+export const EVIDENCE_SCHEMA_VERSION = 2;
 /** @deprecated Use the document-specific schema version constants. */
 export const SCHEMA_VERSION = CONFIG_SCHEMA_VERSION;
 /**