@lamentis/naome 1.4.1 → 1.4.2

package/crates/naome-cli/src/task_commands/repair.rs

@@ -3,14 +3,20 @@ use std::path::Path;
 use naome_core::task_status_report;
 use serde_json::json;
 
-use super::common::{print_json, value_after};
+use super::common::{agent_session, print_json_with_session, value_after};
 
 pub(super) fn repair_preview(
     root: &Path,
     args: &[String],
 ) -> Result<(), Box<dyn std::error::Error>> {
-    if !args.iter().any(|arg| arg == "--dry-run") {
-        return Err("naome task repair requires --dry-run in v1.4.1".into());
+    let session = agent_session(args)?;
+    let dry_run = args.iter().any(|arg| arg == "--dry-run");
+    let execute_safe = args.iter().any(|arg| arg == "--execute-safe");
+    if dry_run && execute_safe {
+        return Err("naome task repair accepts only one of --dry-run or --execute-safe".into());
+    }
+    if !dry_run && !execute_safe {
+        return Err("naome task repair requires --dry-run or --execute-safe".into());
     }
     let plan_id = value_after(args, "--plan").ok_or("naome task repair requires --plan <id>")?;
     let status = task_status_report(root)?;
@@ -19,12 +25,53 @@ pub(super) fn repair_preview(
         .iter()
         .find(|item| item.id == plan_id)
         .cloned();
-    print_json(json!({
-        "schema": "naome.task.repair-preview.v1",
-        "planId": plan_id,
-        "found": plan.is_some(),
-        "wouldExecute": false,
-        "plan": plan,
-        "agentInstruction": "Review this dry-run output and execute only safe commands explicitly allowed by NAOME."
-    }))
+    let mut steps = Vec::new();
+    let mut executed = false;
+    let mut requires_user_approval = false;
+    if execute_safe {
+        if let Some(plan) = &plan {
+            if !can_execute_safe(plan) {
+                requires_user_approval = true;
+            } else {
+                match plan.kind.as_str() {
+                    "rerun_check" if plan.check_ids.len() == 1 => {
+                        steps.push(super::check_run::run_check_by_id(
+                            root,
+                            &plan.check_ids[0],
+                            false,
+                            session.as_deref(),
+                        )?);
+                        executed = true;
+                    }
+                    "record_proof" => {
+                        steps.push(super::record::record_proof_value(root, session.as_deref())?);
+                        executed = true;
+                    }
+                    _ => {
+                        requires_user_approval = true;
+                    }
+                }
+            }
+        }
+    }
+    print_json_with_session(
+        json!({
+            "schema": if dry_run { "naome.task.repair-preview.v1" } else { "naome.task.repair-execute.v1" },
+            "planId": plan_id,
+            "found": plan.is_some(),
+            "wouldExecute": dry_run && plan.as_ref().is_some_and(can_execute_safe),
+            "executed": executed,
+            "requiresUserApproval": requires_user_approval || plan.as_ref().is_some_and(|item| item.requires_user_approval),
+            "plan": plan,
+            "steps": steps,
+            "agentInstruction": if executed { "Executed only NAOME safe check/proof repair steps." } else { "Review this output; unsafe repair plans require human approval." }
+        }),
+        session.as_deref(),
+    )
+}
+
+fn can_execute_safe(item: &naome_core::RepairPlanItem) -> bool {
+    item.safe_to_execute
+        && !item.requires_user_approval
+        && matches!(item.kind.as_str(), "rerun_check" | "record_proof")
 }

package/crates/naome-cli/src/task_commands.rs

@@ -1,6 +1,10 @@
 use std::path::Path;
 
+mod can_edit;
+mod check_run;
 mod common;
+mod complete;
+mod loop_control;
 mod readiness;
 mod record;
 mod repair;
@@ -19,9 +23,13 @@ pub fn run_task_command(root: &Path, args: &[String]) -> Result<(), Box<dyn std:
         Some("migrate-ledger") => migrate_ledger(root, args),
         Some("status") => task_status(root, args),
         Some("proof-plan") => proof_plan(root, args),
+        Some("can-edit") => can_edit::can_edit(root, args),
+        Some("run-check") => check_run::run_check_command(root, args),
         Some("can-transition") => can_transition(root, args),
         Some("repair") => repair::repair_preview(root, args),
         Some("record-proof") => record::record_proof(root, args),
+        Some("complete") => complete::complete_task(root, args),
+        Some("loop") => loop_control::task_loop(root, args),
         Some("request-scope") => scope_request::request_scope(root, args),
         Some("can-commit") => readiness::can_commit(root, args),
         Some("timeline") => timeline::timeline(root, args),
@@ -31,9 +39,10 @@ pub fn run_task_command(root: &Path, args: &[String]) -> Result<(), Box<dyn std:
 }
 
 fn task_status(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let session = common::agent_session(args)?;
     let report = task_status_report(root)?;
     if args.iter().any(|arg| arg == "--json") {
-        println!("{}", serde_json::to_string_pretty(&report)?);
+        common::print_json_with_session(serde_json::to_value(&report)?, session.as_deref())?;
     } else {
         print!("{}", format_task_status(&report));
     }
@@ -42,9 +51,10 @@ fn task_status(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::E
 }
 
 fn proof_plan(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let session = common::agent_session(args)?;
     let report = task_proof_plan(root)?;
     if args.iter().any(|arg| arg == "--json") {
-        println!("{}", serde_json::to_string_pretty(&report)?);
+        common::print_json_with_session(serde_json::to_value(&report)?, session.as_deref())?;
     } else {
         print!("{}", format_task_proof_plan(&report));
     }
@@ -53,6 +63,7 @@ fn proof_plan(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Er
 }
 
 fn can_transition(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error::Error>> {
+    let session = common::agent_session(args)?;
     let Some(target) = args
         .windows(2)
         .find(|window| window[0] == "--to")
@@ -62,7 +73,7 @@ fn can_transition(root: &Path, args: &[String]) -> Result<(), Box<dyn std::error
     };
     let report = task_transition_readiness(root, target)?;
     if args.iter().any(|arg| arg == "--json") {
-        println!("{}", serde_json::to_string_pretty(&report)?);
+        common::print_json_with_session(serde_json::to_value(&report)?, session.as_deref())?;
     } else {
         println!(
             "NAOME task transition {target}: {}",

package/crates/naome-cli/tests/task_cli_agent_controls.rs

@@ -1,11 +1,10 @@
 use std::fs;
-use std::process::Command;
 
 use serde_json::{json, Value};
 
 mod task_cli_support;
 
-use task_cli_support::{fixture_root, init_git, task_state, write_fixture_file};
+use task_cli_support::{fixture_root, init_git, run_json, task_state, write_fixture_file};
 
 #[test]
 fn status_json_exposes_policy_hints_and_recovery_guidance() {
@@ -83,6 +82,14 @@ fn record_proof_from_plan_writes_compact_batch() {
     init_git(&root);
     write_fixture_file(&root, "README.md", "changed\n");
 
+    let check = run_json(
+        &root,
+        ["task", "run-check", "--check", "diff-check", "--json"],
+    );
+    assert_eq!(check["schema"], "naome.task.run-check.v1");
+    assert_eq!(check["executed"], true);
+    assert_eq!(check["recordedProof"], false);
+
     let recorded = run_json(
         &root,
         ["task", "record-proof", "--from-proof-plan", "--json"],
@@ -201,17 +208,3 @@ fn review_fix_mode_is_structured_not_inferred_from_prompt_text() {
         .unwrap()
         .contains("explicit allowedPaths"));
 }
-
-fn run_json<const N: usize>(root: &std::path::Path, args: [&str; N]) -> Value {
-    let output = Command::new(env!("CARGO_BIN_EXE_naome"))
-        .args(args)
-        .current_dir(root)
-        .output()
-        .unwrap();
-    assert!(
-        output.status.success(),
-        "{}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    serde_json::from_slice(&output.stdout).unwrap()
-}

package/crates/naome-cli/tests/task_cli_loop.rs

@@ -0,0 +1,383 @@
+use std::fs;
+use std::process::Command;
+
+use serde_json::{json, Value};
+
+mod task_cli_support;
+
+use task_cli_support::{
+    active_task, fixture_root, git, init_git, run_json, task_state, task_state_with_active_task,
+    write_fixture_file, write_verification_checks,
+};
+
+#[test]
+fn run_check_rejects_unknown_and_records_successful_safe_checks() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let unknown = run_json(&root, ["task", "run-check", "--check", "missing", "--json"]);
+    assert_eq!(unknown["schema"], "naome.task.run-check.v1");
+    assert_eq!(unknown["executed"], false);
+    assert_eq!(unknown["findings"][0]["id"], "task.check.unknown");
+
+    let result = run_json(
+        &root,
+        [
+            "task",
+            "run-check",
+            "--check",
+            "diff-check",
+            "--record-proof",
+            "--json",
+            "--agent-session",
+            "loop-a",
+        ],
+    );
+    assert_eq!(result["executed"], true);
+    assert_eq!(result["exitCode"], 0);
+    assert_eq!(result["recordedProof"], true);
+    assert_eq!(result["agentSession"], "loop-a");
+
+    let task_state: Value =
+        serde_json::from_str(&fs::read_to_string(root.join(".naome/task-state.json")).unwrap())
+            .unwrap();
+    assert_eq!(
+        task_state["activeTask"]["proofBatches"][0]["proofs"][0]["agentSession"],
+        "loop-a"
+    );
+    assert_eq!(
+        task_state["activeTask"]["proofBatches"][0]["proofs"][0]["command"],
+        "git diff --check"
+    );
+    assert_eq!(
+        task_state["activeTask"]["proofBatches"][0]["proofs"][0]["cwd"],
+        "."
+    );
+}
+
+#[test]
+fn record_proof_requires_recent_success_evidence() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let recorded = run_json(
+        &root,
+        ["task", "record-proof", "--from-proof-plan", "--json"],
+    );
+
+    assert_eq!(recorded["recorded"], false);
+    assert_eq!(
+        recorded["findings"][0]["id"],
+        "task.proof.no_recent_success"
+    );
+}
+
+#[test]
+fn record_proof_rejects_receipts_from_older_same_path_content() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let checked = run_json(
+        &root,
+        ["task", "run-check", "--check", "diff-check", "--json"],
+    );
+    assert_eq!(checked["executed"], true);
+    assert_eq!(checked["exitCode"], 0);
+
+    write_fixture_file(&root, "README.md", "changed with trailing whitespace \n");
+    let recorded = run_json(
+        &root,
+        ["task", "record-proof", "--from-proof-plan", "--json"],
+    );
+
+    assert_eq!(recorded["recorded"], false);
+    assert_eq!(
+        recorded["findings"][0]["id"],
+        "task.proof.no_recent_success"
+    );
+}
+
+#[test]
+fn record_proof_rejects_receipts_from_old_check_metadata() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let checked = run_json(
+        &root,
+        ["task", "run-check", "--check", "diff-check", "--json"],
+    );
+    assert_eq!(checked["executed"], true);
+    assert_eq!(checked["exitCode"], 0);
+
+    write_verification_checks(
+        &root,
+        json!([{
+            "id": "diff-check",
+            "command": "node .naome/bin/naome.js quality check --changed",
+            "cwd": ".",
+            "purpose": "Updated check command.",
+            "cost": "fast",
+            "source": "test",
+            "evidence": ["README.md"],
+            "lastVerified": null
+        }]),
+    );
+    git(&root, ["add", ".naome/verification.json"]);
+    git(&root, ["commit", "-m", "update verification metadata"]);
+
+    let recorded = run_json(
+        &root,
+        ["task", "record-proof", "--from-proof-plan", "--json"],
+    );
+
+    assert_eq!(recorded["recorded"], false);
+    assert_eq!(
+        recorded["findings"][0]["id"],
+        "task.proof.no_recent_success"
+    );
+}
+
+#[test]
+fn run_check_diff_check_covers_staged_diff() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "staged trailing whitespace \n");
+    git(&root, ["add", "README.md"]);
+
+    let result = run_json(
+        &root,
+        [
+            "task",
+            "run-check",
+            "--check",
+            "diff-check",
+            "--record-proof",
+            "--json",
+        ],
+    );
+
+    assert_eq!(result["executed"], true);
+    assert_ne!(result["exitCode"], 0);
+    assert_eq!(result["recordedProof"], false);
+    assert!(result["stdoutSummary"]
+        .as_str()
+        .is_some_and(|summary| summary.contains("trailing whitespace")));
+}
+
+#[test]
+fn repair_execute_safe_runs_checks_but_refuses_scope_repairs() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+    write_fixture_file(&root, "src/lib.rs", "outside\n");
+
+    let scope = run_json(
+        &root,
+        [
+            "task",
+            "repair",
+            "--plan",
+            "remove_out_of_scope_change_src_lib_rs",
+            "--execute-safe",
+            "--json",
+        ],
+    );
+    assert_eq!(scope["executed"], false);
+    assert_eq!(scope["requiresUserApproval"], true);
+
+    fs::remove_file(root.join("src/lib.rs")).unwrap();
+    let check = run_json(
+        &root,
+        [
+            "task",
+            "repair",
+            "--plan",
+            "rerun_diff-check",
+            "--execute-safe",
+            "--json",
+        ],
+    );
+    assert_eq!(check["executed"], true);
+    assert_eq!(check["steps"][0]["schema"], "naome.task.run-check.v1");
+}
+
+#[test]
+fn repair_execute_safe_rejects_dry_run_combo_and_unsafe_check_plans() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "requiredCheckIds": ["unsafe-check"],
+        "proofResults": []
+    }))));
+    write_verification_checks(
+        &root,
+        json!([{
+                "id": "unsafe-check",
+                "command": "sh -c 'echo unsafe'",
+                "cwd": ".",
+                "purpose": "Unsafe check for repair planning tests.",
+                "cost": "fast",
+                "source": "test",
+                "evidence": ["README.md"],
+                "lastVerified": null
+        }]),
+    );
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let combo = Command::new(env!("CARGO_BIN_EXE_naome"))
+        .args([
+            "task",
+            "repair",
+            "--plan",
+            "rerun_unsafe-check",
+            "--dry-run",
+            "--execute-safe",
+            "--json",
+        ])
+        .current_dir(&root)
+        .output()
+        .unwrap();
+    assert!(!combo.status.success());
+    assert!(String::from_utf8_lossy(&combo.stderr).contains("--dry-run"));
+
+    let unsafe_repair = run_json(
+        &root,
+        [
+            "task",
+            "repair",
+            "--plan",
+            "rerun_unsafe-check",
+            "--execute-safe",
+            "--json",
+        ],
+    );
+    assert_eq!(unsafe_repair["executed"], false);
+    assert_eq!(unsafe_repair["requiresUserApproval"], true);
+    assert!(unsafe_repair["steps"].as_array().unwrap().is_empty());
+}
+
+#[test]
+fn run_check_rejects_changed_npm_scripts_from_safe_execution() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "requiredCheckIds": ["task-state-tests"],
+        "allowedPaths": ["package.json"],
+        "proofResults": []
+    }))));
+    write_verification_checks(
+        &root,
+        json!([{
+            "id": "task-state-tests",
+            "command": "npm run test:task-state",
+            "cwd": ".",
+            "purpose": "Task-state regression tests.",
+            "cost": "medium",
+            "source": "test",
+            "evidence": ["package.json"],
+            "lastVerified": null
+        }]),
+    );
+    init_git(&root);
+    write_fixture_file(
+        &root,
+        "package.json",
+        r#"{"scripts":{"test:task-state":"node -e \"process.exit(0)\"}}"#,
+    );
+
+    let result = run_json(
+        &root,
+        ["task", "run-check", "--check", "task-state-tests", "--json"],
+    );
+
+    assert_eq!(result["executed"], false);
+    assert_eq!(result["findings"][0]["id"], "task.check.unsafe_command");
+}
+
+#[test]
+fn run_check_rejects_pack_dry_run_as_not_read_only() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "requiredCheckIds": ["package-dry-run"],
+        "proofResults": []
+    }))));
+    write_verification_checks(
+        &root,
+        json!([{
+            "id": "package-dry-run",
+            "command": "npm run pack:dry-run",
+            "cwd": ".",
+            "purpose": "Package dry run.",
+            "cost": "medium",
+            "source": "test",
+            "evidence": ["README.md"],
+            "lastVerified": null
+        }]),
+    );
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let result = run_json(
+        &root,
+        ["task", "run-check", "--check", "package-dry-run", "--json"],
+    );
+
+    assert_eq!(result["executed"], false);
+    assert_eq!(result["findings"][0]["id"], "task.check.unsafe_command");
+}
+
+#[test]
+fn task_loop_read_only_and_execute_safe_drive_proof_to_completion() {
+    let root = fixture_root(task_state());
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let read_only = run_json(&root, ["task", "loop", "--json"]);
+    assert_eq!(read_only["schema"], "naome.task.loop.v1");
+    assert_eq!(read_only["mode"], "read_only");
+    assert!(read_only["executedSteps"].as_array().unwrap().is_empty());
+    assert_eq!(
+        read_only["status"]["proof"]["missingChecks"],
+        json!(["diff-check"])
+    );
+
+    let executed = run_json(&root, ["task", "loop", "--execute-safe", "--json"]);
+    assert_eq!(executed["mode"], "execute_safe");
+    assert_eq!(
+        executed["executedSteps"][0]["schema"],
+        "naome.task.run-check.v1"
+    );
+    assert_eq!(executed["executedSteps"][0]["recordedProof"], true);
+
+    let completed = run_json(
+        &root,
+        ["task", "complete", "--from-can-transition", "--json"],
+    );
+    assert_eq!(completed["schema"], "naome.task.complete.v1");
+    assert_eq!(completed["completed"], true);
+
+    let state: Value =
+        serde_json::from_str(&fs::read_to_string(root.join(".naome/task-state.json")).unwrap())
+            .unwrap();
+    assert_eq!(state["status"], "complete");
+}
+
+#[test]
+fn complete_blocks_when_transition_is_not_allowed() {
+    let root = fixture_root(task_state_with_active_task(active_task(json!({
+        "proofResults": []
+    }))));
+    init_git(&root);
+    write_fixture_file(&root, "README.md", "changed\n");
+
+    let completed = run_json(
+        &root,
+        ["task", "complete", "--from-can-transition", "--json"],
+    );
+
+    assert_eq!(completed["completed"], false);
+    assert_eq!(
+        completed["blockingFindings"][0]["id"],
+        "task.proof.missing_check"
+    );
+}