@kylecheng3146/agent-ops 0.1.7 → 0.1.8

package/README.md

@@ -265,10 +265,15 @@ the project configuration defines those workflows.
 
 `agent-ops review` can hand the review to another agent CLI, so the work is not
 judged by the agent that produced it. Enable it during `agent-ops init` (the
-default is off) and pick an ordered fallback chain of targets: `codex`, `agy`
-(Antigravity), and `claude`. Each is launched with its own read-only flag, and a
-target without one is skipped rather than run unsandboxed — which is why
-`opencode` is not a review target despite being a supported harness.
+default is off). Reviews require an attached task, current required
+verification evidence, and a deterministic worktree (or `--base`) scope. The
+native-schema detailed report is displayed but not persisted.
+
+Each attempt uses a fresh temporary cwd, a small allowlisted environment, and a
+target-native read-only/context-isolation mode. Currently only Claude safe mode
+meets the full isolation contract; configured Codex and Agy entries return
+`capability-unavailable` rather than run with a weaker boundary. `opencode` is
+not a review target.
 
 The first target that actually runs produces the verdict. A `FAIL` is final:
 the chain never retries elsewhere after a real verdict. `--yes` is still

package/dist/packages/cli/src/args.js

@@ -66,6 +66,7 @@ export function parseArgs(argv) {
     let targetVersion;
     let title;
     let sessionId;
+    let base;
     const profiles = [];
     const reviewTargets = [];
     const criteria = [];
@@ -179,6 +180,14 @@ export function parseArgs(argv) {
                 index += 1;
                 break;
             }
+            case "--base": {
+                if (base !== undefined) {
+                    duplicate(token);
+                }
+                base = readOptionValue(argv, index, token);
+                index += 1;
+                break;
+            }
             case "--check-auth":
                 if (checkAuth) {
                     duplicate(token);
@@ -273,6 +282,7 @@ export function parseArgs(argv) {
             evidence.length > 0 ||
             reviewTargets.length > 0 ||
             sessionId !== undefined ||
+            base !== undefined ||
             checkAuth ||
             dryRun ||
             yes) {
@@ -303,6 +313,9 @@ export function parseArgs(argv) {
     if (command !== "update" && targetVersion !== undefined) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--target-version may be used only with update.");
     }
+    if (base !== undefined && command !== "verify" && command !== "review") {
+        throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "--base may be used only with verify or review.");
+    }
     if (hookTargets.length > 0 &&
         command !== "init" &&
         command !== "update") {
@@ -355,6 +368,7 @@ export function parseArgs(argv) {
             evidence.length > 0 ||
             dryRun ||
             yes ||
+            base !== undefined ||
             (taskId !== undefined && sessionId !== undefined))) {
         throw new CliArgumentError("CLI_OPTION_NOT_ALLOWED", "Verify accepts only scope, task or session, and json options.");
     }
@@ -379,6 +393,7 @@ export function parseArgs(argv) {
         ...(criteria.length === 0 ? {} : { criteria }),
         ...(evidence.length === 0 ? {} : { evidence }),
         ...(sessionId === undefined ? {} : { sessionId }),
+        ...(base === undefined ? {} : { base }),
         ...(checkAuth ? { checkAuth } : {}),
         dryRun,
         json,

package/dist/packages/cli/src/bin.js

@@ -70,6 +70,29 @@ async function installedManifest(root) {
 async function installedHarness(root) {
     return (await installedManifest(root))?.harness ?? [...HARNESS_IDS];
 }
+function gitRunner(root) {
+    return {
+        run: async (gitArgs) => {
+            try {
+                return {
+                    exitCode: 0,
+                    stdout: execFileSync("git", [...gitArgs], {
+                        cwd: root,
+                        encoding: "buffer",
+                        stdio: ["ignore", "pipe", "ignore"]
+                    })
+                };
+            }
+            catch (error) {
+                const failure = error;
+                return {
+                    exitCode: failure.status ?? 1,
+                    stdout: failure.stdout ?? new Uint8Array()
+                };
+            }
+        }
+    };
+}
 async function confirmInit(plan) {
     writeBanner({
         isTTY: process.stdout.isTTY === true,
@@ -179,9 +202,13 @@ else {
                 const taskService = new TaskService(new FileTaskStore(join(root, ".agent-ops", "tasks", "state.json"), root));
                 if (args.command === "task") {
                     const sessionId = process.env.AGENT_OPS_SESSION_ID;
+                    const policyConfigHash = args.action === "create"
+                        ? calculateConfigHash((await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config)
+                        : undefined;
                     return await runTaskCommand({
                         args,
                         service: taskService,
+                        ...(policyConfigHash === undefined ? {} : { policyConfigHash }),
                         ...(sessionId === undefined ? {} : { sessionId })
                     });
                 }
@@ -199,6 +226,12 @@ else {
                         ...(reviewConfig.reviewRoles === undefined
                             ? {}
                             : { roles: reviewConfig.reviewRoles }),
+                        root,
+                        gitRunner: gitRunner(root),
+                        policyConfigHash: calculateConfigHash(reviewConfig),
+                        currentPolicyConfigHash: async () => calculateConfigHash((await loadEffectiveConfig(root, args.scope === "user" ? "user" : "project")).config),
+                        config: reviewConfig,
+                        evidenceStore: new FileEvidenceStore(root, root),
                         execute: createReviewExecutor({
                             targets: reviewRole?.targets ?? [],
                             cwd: root,
@@ -233,31 +266,12 @@ else {
                             root,
                             scope: args.scope === "user" ? "user" : "project",
                             config,
-                            gitRunner: {
-                                run: async (gitArgs) => {
-                                    try {
-                                        return {
-                                            exitCode: 0,
-                                            stdout: execFileSync("git", [...gitArgs], {
-                                                cwd: root,
-                                                encoding: "buffer",
-                                                stdio: ["ignore", "pipe", "ignore"]
-                                            })
-                                        };
-                                    }
-                                    catch (error) {
-                                        const failure = error;
-                                        return {
-                                            exitCode: failure.status ?? 1,
-                                            stdout: failure.stdout ?? new Uint8Array()
-                                        };
-                                    }
-                                }
-                            },
+                            gitRunner: gitRunner(root),
                             processRunner: new NodeVerificationProcessRunner(),
                             taskService,
                             evidenceStore: new FileEvidenceStore(root, root),
-                            trusted: trustStatus === "TRUSTED"
+                            trusted: trustStatus === "TRUSTED",
+                            ...(args.base === undefined ? {} : { base: args.base })
                         })
                     });
                 }

package/dist/packages/cli/src/cli.js

@@ -43,6 +43,7 @@ Options:
   --criterion <json>                    Repeatable
   --evidence <criterion-id=reference>   Repeatable
   --session <id>
+  --base <git-ref>                    Verify/review a clean committed range
   --dry-run
   --json
   --yes

package/dist/packages/cli/src/commands/review.js

@@ -1,6 +1,12 @@
 import { buildReviewPacket } from "../../../../runtime/src/review/packet.js";
 import { runIndependentReview } from "../../../../runtime/src/review/runner.js";
+import { renderReviewResult } from "../../../../runtime/src/review/render.js";
 import { resolveReviewRole } from "../../../../runtime/src/review/roles.js";
+import { AgentOpsError } from "../../../../runtime/src/fs/paths.js";
+import { assertSafeSupportingPaths, isReviewerPolicyPath, resolveReviewScope, reviewScopeSignature } from "../../../../runtime/src/review/scope.js";
+import { calculateSourceFingerprint } from "../../../../runtime/src/verify/source-fingerprint.js";
+import { calculateConfigHash, isPassingVerificationEvidence } from "../../../../runtime/src/verify/evidence.js";
+import { validateEvidence } from "../../../../runtime/src/schema/validate.js";
 import { okEnvelope } from "../output.js";
 /**
  * Review runs against one target. Argument parsing already rejects a
@@ -53,10 +59,129 @@ async function taskContext(options) {
     }
     return {
         taskId: record.task.id,
+        title: record.task.title,
         active: record.status === "active",
+        policyConfigHash: record.policyConfigHash,
+        evidence: record.evidence,
+        failureFingerprint: record.failureFingerprint,
         criteria
     };
 }
+function newestEvidence(values) {
+    return [...values].sort((left, right) => {
+        const leftTime = Date.parse(left.evidence.finishedAt);
+        const rightTime = Date.parse(right.evidence.finishedAt);
+        return rightTime - leftTime || left.reference.localeCompare(right.reference);
+    })[0];
+}
+async function currentEvidence(options, context, criterionId, commandId, configHash, sourceFingerprint) {
+    const current = [];
+    let hasReference = false;
+    let unreadable = false;
+    let stale = false;
+    for (const reference of context.evidence[criterionId] ?? []) {
+        if (reference.startsWith("review:")) {
+            continue;
+        }
+        hasReference = true;
+        let stored;
+        try {
+            stored = await options.evidenceStore?.load(reference) ?? null;
+        }
+        catch {
+            unreadable = true;
+            continue;
+        }
+        const validation = validateEvidence(stored);
+        if (!validation.ok) {
+            unreadable = true;
+            continue;
+        }
+        const evidence = validation.value;
+        if (evidence.schemaVersion !== 2 ||
+            evidence.taskId !== context.taskId ||
+            evidence.criterionId !== criterionId ||
+            evidence.commandId !== commandId ||
+            evidence.configHash !== configHash ||
+            evidence.sourceFingerprint !== sourceFingerprint) {
+            stale = true;
+            continue;
+        }
+        current.push({ reference, evidence });
+    }
+    return { current, hasReference, unreadable, stale };
+}
+async function preflightReview(options, context, scope) {
+    if (options.config === undefined ||
+        options.evidenceStore === undefined ||
+        options.root === undefined ||
+        options.gitRunner === undefined ||
+        context.failureFingerprint !== null) {
+        return { ok: false, reason: "stale-verification" };
+    }
+    const configHash = calculateConfigHash(options.config);
+    const sourceFingerprint = await calculateSourceFingerprint(options.root, scope, options.gitRunner);
+    const commands = [];
+    for (const criterion of context.criteria) {
+        for (const commandId of criterion.verifierIds ?? []) {
+            const command = options.config.verification.commands.find((candidate) => candidate.id === commandId);
+            if (command === undefined) {
+                return { ok: false, reason: "missing-verification-evidence" };
+            }
+            const found = await currentEvidence(options, context, criterion.id, commandId, configHash, sourceFingerprint);
+            const selected = newestEvidence(found.current);
+            if (command.required !== true) {
+                if (selected !== undefined) {
+                    commands.push({
+                        criterionId: criterion.id,
+                        commandId,
+                        required: false,
+                        status: selected.evidence.status,
+                        evidenceReference: selected.reference
+                    });
+                }
+                continue;
+            }
+            if (selected === undefined) {
+                return {
+                    ok: false,
+                    reason: found.unreadable
+                        ? "unreadable-verification-evidence"
+                        : found.stale
+                            ? "stale-verification"
+                            : found.hasReference
+                                ? "missing-verification-evidence"
+                                : "missing-verification-evidence"
+                };
+            }
+            if (!isPassingVerificationEvidence(command, selected.evidence)) {
+                return { ok: false, reason: "verification-not-passed" };
+            }
+            commands.push({
+                criterionId: criterion.id,
+                commandId,
+                required: true,
+                status: "PASS",
+                evidenceReference: selected.reference
+            });
+        }
+    }
+    return {
+        ok: true,
+        summary: { status: "PASS", sourceFingerprint, commands }
+    };
+}
+function scopeReason(error) {
+    if (!(error instanceof AgentOpsError)) {
+        return undefined;
+    }
+    return {
+        REVIEW_UNSAFE_PATH: "unsafe-review-path",
+        REVIEW_NO_CHANGE_SURFACE: "no-change-surface",
+        REVIEW_DIRTY_WORKTREE: "dirty-worktree",
+        REVIEW_INVALID_BASE: "invalid-base"
+    }[error.code];
+}
 function notRunEnvelope(result) {
     const message = "Independent review was not run.";
     return {
@@ -65,11 +190,28 @@ function notRunEnvelope(result) {
         data: {
             message,
             result,
-            text: [message, `Reason: ${result.reason ?? "unknown"}.`, ""].join("\n")
+            text: renderReviewResult(result)
         },
         errors: [{ code: "REVIEW_NOT_RUN", message }]
     };
 }
+function sourceChangedResult(result) {
+    return {
+        status: "NOT_RUN",
+        reason: "source-changed-during-review",
+        harness: result.harness,
+        model: result.model,
+        effort: result.effort,
+        prompt: result.prompt,
+        ...(result.scope === undefined ? {} : { scope: result.scope }),
+        ...(result.independence === undefined
+            ? {}
+            : { independence: result.independence }),
+        ...(result.verification === undefined
+            ? {}
+            : { verification: result.verification })
+    };
+}
 export async function runReviewCommand(options) {
     const role = resolveReviewRole(options.role ?? "independent-review", options.roles ?? []);
     const selectedHarness = harness(options.args.harness);
@@ -82,7 +224,7 @@ export async function runReviewCommand(options) {
             requirement: separator < 0 ? value : value.slice(separator + 1)
         };
     });
-    if (options.tasks !== undefined && context === undefined) {
+    if (context === undefined) {
         return notRunEnvelope({
             status: "NOT_RUN",
             reason: "no-task-context",
@@ -92,20 +234,105 @@ export async function runReviewCommand(options) {
             prompt: ""
         });
     }
-    const criteria = context?.criteria !== undefined
-        ? [...context.criteria]
-        : (options.args.criteria ?? []).map((id) => ({ id, description: id }));
+    let scope;
+    let verification;
+    if (options.root !== undefined && options.gitRunner !== undefined) {
+        try {
+            scope = await resolveReviewScope({
+                root: options.root,
+                runner: options.gitRunner,
+                ...(options.args.base === undefined ? {} : { base: options.args.base })
+            });
+        }
+        catch (error) {
+            const reason = scopeReason(error);
+            if (reason !== undefined) {
+                return notRunEnvelope({
+                    status: "NOT_RUN",
+                    reason,
+                    harness: target,
+                    model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured",
+                    prompt: ""
+                });
+            }
+            throw error;
+        }
+        if (scope.changedFiles.some(isReviewerPolicyPath)) {
+            return notRunEnvelope({
+                status: "NOT_RUN",
+                reason: "reviewer-policy-changed",
+                harness: target,
+                model: role?.model ?? options.model ?? "configured",
+                effort: role?.effort ?? options.effort ?? "configured",
+                prompt: "",
+                scope
+            });
+        }
+        if (options.policyConfigHash !== undefined) {
+            if (context.policyConfigHash === null) {
+                return notRunEnvelope({
+                    status: "NOT_RUN", reason: "reviewer-policy-baseline-missing",
+                    harness: target, model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured", prompt: "", scope
+                });
+            }
+            if (context.policyConfigHash !== options.policyConfigHash) {
+                return notRunEnvelope({
+                    status: "NOT_RUN", reason: "reviewer-policy-changed",
+                    harness: target, model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured", prompt: "", scope
+                });
+            }
+        }
+        const preflight = await preflightReview(options, context, scope);
+        if (!preflight.ok) {
+            return notRunEnvelope({
+                status: "NOT_RUN", reason: preflight.reason,
+                harness: target, model: role?.model ?? options.model ?? "configured",
+                effort: role?.effort ?? options.effort ?? "configured", prompt: "", scope
+            });
+        }
+        verification = preflight.summary;
+    }
+    const criteria = [...context.criteria];
+    let packet;
+    try {
+        packet = buildReviewPacket({
+            request: context.title,
+            criteria,
+            artifactRefs: scope?.changedFiles ?? [],
+            evidenceRequirements
+        });
+    }
+    catch (error) {
+        if (error instanceof AgentOpsError) {
+            const reason = error.code === "REVIEW_SENSITIVE_INPUT"
+                ? "sensitive-review-input"
+                : error.code === "REVIEW_SCOPE_TOO_LARGE"
+                    ? "scope-too-large"
+                    : undefined;
+            if (reason !== undefined) {
+                return notRunEnvelope({
+                    status: "NOT_RUN",
+                    reason,
+                    harness: target,
+                    model: role?.model ?? options.model ?? "configured",
+                    effort: role?.effort ?? options.effort ?? "configured",
+                    prompt: ""
+                });
+            }
+        }
+        throw error;
+    }
     const result = await runIndependentReview({
         invocation: {
             harness: target,
             model: role?.model ?? options.model ?? "configured",
             effort: role?.effort ?? options.effort ?? "configured",
-            packet: buildReviewPacket({
-                request: "Review the requested implementation.",
-                criteria,
-                artifactRefs: [],
-                evidenceRequirements
-            })
+            packet,
+            ...(scope === undefined ? {} : { scope }),
+            ...(verification === undefined ? {} : { verification })
         },
         authorized: options.authorized,
         execute: options.execute ?? (async () => ({
@@ -113,15 +340,60 @@ export async function runReviewCommand(options) {
             reason: "missing-cli"
         }))
     });
+    if (scope !== undefined && result.report !== undefined && options.root !== undefined) {
+        try {
+            if (result.report.changedFilesInspected.length !== scope.changedFiles.length ||
+                result.report.changedFilesInspected.some((path) => !scope?.changedFiles.includes(path))) {
+                return notRunEnvelope({
+                    ...result,
+                    status: "NOT_RUN",
+                    reason: "incomplete-scope"
+                });
+            }
+            try {
+                await assertSafeSupportingPaths(options.root, result.report.supportingFilesInspected);
+            }
+            catch (error) {
+                if (scopeReason(error) === "unsafe-review-path") {
+                    return notRunEnvelope({
+                        ...result,
+                        status: "NOT_RUN",
+                        reason: "unsafe-review-path"
+                    });
+                }
+                throw error;
+            }
+            const postflight = await resolveReviewScope({
+                root: options.root,
+                runner: options.gitRunner,
+                ...(options.args.base === undefined ? {} : { base: options.args.base })
+            });
+            const currentHash = options.currentPolicyConfigHash === undefined
+                ? options.policyConfigHash
+                : await options.currentPolicyConfigHash();
+            const postflightFingerprint = verification === undefined
+                ? undefined
+                : await calculateSourceFingerprint(options.root, postflight, options.gitRunner);
+            if (reviewScopeSignature(scope) !== reviewScopeSignature(postflight) ||
+                (options.policyConfigHash !== undefined && currentHash !== options.policyConfigHash) ||
+                (verification !== undefined &&
+                    postflightFingerprint !== verification.sourceFingerprint)) {
+                return notRunEnvelope(sourceChangedResult(result));
+            }
+        }
+        catch {
+            return notRunEnvelope(sourceChangedResult(result));
+        }
+    }
     // Evidence is only appended while the task is active: a completed record
     // must stay exactly as it was verified.
     if (options.tasks !== undefined &&
-        context !== undefined &&
+        result.status === "PASS" &&
         context.active &&
         result.results !== undefined) {
         await options.tasks.recordEvidence(context.taskId, Object.fromEntries(result.results.map((item) => [
             item.criterionId,
-            item.evidence.map((reference) => `review:${target}:${reference}`)
+            item.evidence.map((reference) => `review:${result.harness}:${reference}`)
         ])));
     }
     const message = result.status === "PASS"
@@ -132,22 +404,7 @@ export async function runReviewCommand(options) {
     const data = {
         message,
         result,
-        text: [
-            message,
-            `Status: ${result.status}`,
-            `Harness: ${result.harness}; model: ${result.model}; effort: ${result.effort}.`,
-            ...(result.reason === undefined ? [] : [`Reason: ${result.reason}.`]),
-            ...(result.status === "NOT_RUN"
-                ? [
-                    "Run: agent-ops doctor --check-auth to verify target authentication."
-                ]
-                : []),
-            ...(result.results === undefined
-                ? []
-                : result.results.map((item) => `${item.criterionId}: ${item.status} [${item.evidence.join(", ")}]`)),
-            result.prompt,
-            ""
-        ].join("\n")
+        text: renderReviewResult(result)
     };
     if (result.status === "PASS") {
         return okEnvelope("REVIEW_RESULT", data);

package/dist/packages/cli/src/commands/task.js

@@ -89,7 +89,10 @@ export async function runTaskCommand(options) {
             }
             const record = await options.service.create({
                 title: options.args.title,
-                criteria: (options.args.criteria ?? []).map(parseCriterion)
+                criteria: (options.args.criteria ?? []).map(parseCriterion),
+                ...(options.policyConfigHash === undefined
+                    ? {}
+                    : { policyConfigHash: options.policyConfigHash })
             });
             return taskEnvelope(action, "TASK_CREATED", `Created task ${record.task.id}.`, record);
         }

package/dist/packages/cli/src/commands/verify.js

@@ -41,7 +41,19 @@ function publicReport(report) {
             testCount: result.testCount,
             evidenceReferences: result.evidenceReferences.map(redactSecrets)
         })),
-        signal: report.signal
+        signal: report.signal,
+        reviewScope: report.reviewScope.mode === "base"
+            ? {
+                mode: "base",
+                baseRef: redactSecrets(report.reviewScope.baseRef),
+                resolvedBase: report.reviewScope.resolvedBase,
+                changedFiles: report.reviewScope.changedFiles.map(redactSecrets)
+            }
+            : {
+                mode: "worktree",
+                changedFiles: report.reviewScope.changedFiles.map(redactSecrets)
+            },
+        sourceFingerprint: report.sourceFingerprint
     };
 }
 function formatResult(result) {

package/dist/packages/cli/src/wizard.js

@@ -10,10 +10,10 @@ const REVIEW_TARGET_CHOICES = DEFAULT_REVIEW_TARGETS.map((id) => ({
     label: id,
     value: id,
     description: id === "codex"
-        ? "Runs with -s read-only; stdout is the bare final message."
+        ? "Retained for future isolation support; currently not auto-run."
         : id === "agy"
-            ? "Antigravity CLI; runs with --sandbox --mode plan."
-            : "Runs with --permission-mode plan; tried last when it is the host."
+            ? "Retained for future isolation support; currently not auto-run."
+            : "Runs in fresh safe mode with context isolation."
 }));
 function selectReviewTargets(raw) {
     const values = raw

package/dist/runtime/src/contracts.js

@@ -1,6 +1,6 @@
 export const CONFIG_SCHEMA_VERSION = 2;
 export const TASK_SCHEMA_VERSION = 1;
-export const EVIDENCE_SCHEMA_VERSION = 1;
+export const EVIDENCE_SCHEMA_VERSION = 2;
 /** @deprecated Use the document-specific schema version constants. */
 export const SCHEMA_VERSION = CONFIG_SCHEMA_VERSION;
 /**