@lchase/kiln 0.4.0 → 0.6.0

package/dist/serve-page.js

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { scheduledRetry } from "./attention.js";
 import { readBoardFiles, stageOf, stagesFor } from "./board.js";
+import { feedbackRoundLabel } from "./feedback.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
 import { packageRoot } from "./paths.js";
 const REVIEWERS = [
@@ -126,6 +127,7 @@ function card(item, stage) {
 <div class="branch repo">${escapeHtml(job.repo)}</div>
 <p class="title">${escapeHtml(job.title || job.jobId)}</p>
 ${branch ? `<div class="branch">${escapeHtml(branch)}</div>` : ""}
+${sandboxHtml(job)}
 ${prLink(job)}
 ${roundsHtml(job, stage)}
 ${attemptHtml(job, stage)}
@@ -145,6 +147,7 @@ function sheet(item) {
 <div class="num">${escapeHtml(num)}</div>
 <h3>${escapeHtml(job.title || job.jobId)}</h3>
 ${branch ? `<div class="branch">${escapeHtml(branch)}</div>` : ""}
+${sandboxHtml(job)}
 ${prLink(job)}
 ${actionsHtml(item)}
 <button type="button" class="close" data-close aria-label="Close">×</button>
@@ -197,11 +200,21 @@ function actionsHtml(item) {
         return "";
     return `<div class="d-actions">${forms.join("")}</div>`;
 }
+function sandboxHtml(job) {
+    if (!job.sandboxed)
+        return "";
+    return `<div class="meta">sandbox · docker</div>`;
+}
 function roundsHtml(job, stage) {
     const rounds = job.rounds ?? [];
     const last = rounds[rounds.length - 1]?.n;
     const rows = rounds.map((round) => roundRow(round, stage === "review" && job.state === "running" && round.n === last));
-    if (job.state === "in-review" || (job.state === "done" && safeUrl(job.prUrl))) {
+    for (const round of job.feedbackRounds ?? []) {
+        const tone = round.outcome ? " PASS" : " CHANGES";
+        rows.push(`<div class="round"><span class="r">R${round.round}</span><span class="chip${tone}" style="grid-column: 2 / -1">${escapeHtml(feedbackRoundLabel(round))}</span></div>`);
+    }
+    const inReview = job.state === "in-review" || (job.state === "done" && safeUrl(job.prUrl));
+    if (inReview && (job.feedbackRounds?.length ?? 0) === 0) {
         const n = (last ?? 0) + 1;
         const tone = job.state === "done" ? " PASS" : "";
         rows.push(`<div class="round"><span class="r">R${n}</span><span class="chip${tone}" style="grid-column: 2 / -1">PR review</span></div>`);

package/dist/serve.js

@@ -5,6 +5,7 @@ import { answerJob, readStatus, retryJob, runTick, startupRecovery } from "./dri
 import { defaultHost } from "./host.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
 import { packageRoot } from "./paths.js";
+import { SANDBOX_PREFLIGHT_PREFIX } from "./sandbox.js";
 import { renderConsole, renderMessagePage, renderTextPage } from "./serve-page.js";
 const BODY_LIMIT = 65_536;
 const TEXT_LIMIT = 100_000;
@@ -71,7 +72,12 @@ export function loadServeCss() {
 }
 function safeTick(config, secrets, startup) {
     try {
-        runTick(config, defaultHost(), { startup });
+        const report = runTick(config, defaultHost(), { startup });
+        if (report.startsWith(SANDBOX_PREFLIGHT_PREFIX)) {
+            const tickAt = report.indexOf("\ntick ");
+            const head = tickAt === -1 ? report : report.slice(0, tickAt);
+            process.stderr.write(`${redact(head.trimEnd(), secrets)}\n`);
+        }
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/dist/workflow.js

@@ -6,10 +6,12 @@ const FACTORY_DIRECTIVE = /^<!--\s*factory:\s*(prompts\/factory\/[a-z0-9-]+\.md)
 const WORKFLOW_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const FEATURE_PROMPTS = 7;
 const INVESTIGATION_PROMPTS = 1;
+const FIX_PROMPTS = 1;
 /** Prompt files Kiln rewrites before launch. A mismatch refuses the launch. */
 const PROMPT_COUNTS = {
     feature: FEATURE_PROMPTS,
     investigation: INVESTIGATION_PROMPTS,
+    fix: FIX_PROMPTS,
 };
 /**
  * Values Kiln can pass into a workflow. A workflow's inputSchema lists the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lchase/kiln",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Run a workflow on any registered repo. A markdown spec is the input.",
   "type": "module",
   "bin": {

package/prompts/kiln/fix.md

@@ -0,0 +1,17 @@
+<!-- factory: prompts/factory/builder.md -->
+
+Kiln runs this factory agent inside yak to answer pull request feedback. The working directory is the worktree (there is no separate worktree path). There is no `.factory/` job folder and no `.factory/repo.md`; read the repo for conventions. `.factory/lessons.md` applies only when that file is really present.
+
+`<main branch>` is the base SHA `{{input.baseRef}}` (the pull request head this worktree was branched from, via yak `--from`). Use that SHA wherever the factory instructions say `<main branch>`. Do not guess `main`.
+
+Your branch is whatever `git branch --show-current` prints. It is `yak/<run-id>`. That is the branch name in this prompt. Do not BLOCK because it is not `factory/...` or `main`.
+
+Commit on that branch. Do not push. Do not force-push. Do not open a pull request. Do not approve one. Do not comment on one. Kiln fast-forwards the existing pull request branch after this run.
+
+Do not write `build.md`. Return JSON: `status` is `READY` or `BLOCKED`, `summary` is what you changed. The original spec and the feedback items are the task text below, not files.
+
+Task: {{input.title}}
+
+{{input.description}}
+
+The factory agent instructions follow. Their frontmatter is the original definition; follow the prose, and return the JSON above instead of writing the file they name.

package/workflows/feature.yaml

@@ -1,5 +1,10 @@
 # One Kiln job, run by yak (@lchase/yak).
 #
+# Sandbox (kiln config `sandbox.mode: docker`, off by default): tick injects
+# `sandbox: docker` under each agent step (spec, build, security, ux, ui,
+# code, approver). verify, the approve gate, and land stay on the host.
+# Pull request open and `gh pr view` run in the kiln process.
+#
 # Faithful to Lawrence Chase's factory plugin v0.7.0 (MIT):
 # https://github.com/lchase/coding-agent-plugins/tree/4c84a2ce7fbde5ac298c0de9f0b90141eac4ed98/plugins/factory
 #   skills/factory/SKILL.md          (the loop: spec, build, 4 reviews, approver)

package/workflows/fix.yaml

@@ -0,0 +1,48 @@
+# One pull-request fix, run by yak (@lchase/yak).
+#
+# Sandbox (kiln config `sandbox.mode: docker`, off by default): tick injects
+# `sandbox: docker` under the build agent. land stays on the host, and Kiln
+# fast-forwards the pull request branch from the host.
+#
+# The same builder as workflows/feature.yaml (factory builder, opus). Kiln
+# launches it with `yak run --isolation worktree --from <pull request head>`
+# on a job whose pull request is already open. Yak cuts a worktree branch
+# `yak/<run-id>` from that commit. The agent commits there. Kiln fast-forwards
+# the open pull request branch. This workflow does not open, approve, merge,
+# or comment on a pull request, and it does not force-push.
+name: kiln-fix
+version: "1"
+inputSchema:
+  inline:
+    type: object
+    additionalProperties: false
+    properties:
+      title: { type: string }
+      description: { type: string }
+      acceptance: { type: string }
+      runNonce: { type: string }
+      baseRef: { type: string }
+    required: [title, description, acceptance, runNonce, baseRef]
+steps:
+  - id: build
+    needs: [input]
+    agent:
+      model: opus
+      prompt:
+        file: prompts/kiln/fix.md
+      schema:
+        inline:
+          type: object
+          additionalProperties: false
+          properties:
+            summary: { type: string }
+            status: { type: string, enum: [READY, BLOCKED] }
+          required: [summary, status]
+      tools: [Read, Grep, Glob, Bash, Write, Edit, Skill]
+    produces: build
+
+  - id: land
+    needs: [input, build]
+    skipIf: 'build.status != "READY"'
+    command:
+      run: 'git add -A && git diff --cached --quiet || git commit -m "kiln: $KILN_TASK_TITLE"'

package/workflows/investigation.yaml

@@ -1,5 +1,8 @@
 # One Kiln investigation, run by yak (@lchase/yak).
 #
+# Sandbox (kiln config `sandbox.mode: docker`, off by default): tick injects
+# `sandbox: docker` under the explore agent. The approve gate stays on the host.
+#
 # A spike, probe, or research ticket. The agent explores the worktree and
 # returns a findings document. A person approves or rejects it. There is no
 # build, review, verify, or land step, and Kiln does not open a pull request