@lchase/kiln 0.6.0 → 0.7.0

package/dist/settings.js

@@ -0,0 +1,204 @@
+import { createHash } from "node:crypto";
+import { readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { assertBranchName, assertCheckoutDirectory } from "./config.js";
+import { DEFAULT_BRANCH_TEMPLATE, DEFAULT_PR_TITLE } from "./pr-names.js";
+import { DEFAULT_MAX_ATTEMPTS, DEFAULT_MAX_FIX_ROUNDS, DEFAULT_STALL_TIMEOUT_MS, KilnConfigFileSchema, SettingsWriteSchema, } from "./schemas.js";
+const DEFAULTS = {
+    deliver: "local",
+    prTitle: DEFAULT_PR_TITLE,
+    branch: DEFAULT_BRANCH_TEMPLATE,
+    maxAttempts: DEFAULT_MAX_ATTEMPTS,
+    stallTimeoutMs: DEFAULT_STALL_TIMEOUT_MS,
+    maxFixRounds: DEFAULT_MAX_FIX_ROUNDS,
+    sandboxMode: "off",
+};
+export function readSettings(configPath) {
+    const read = readConfigFile(configPath);
+    if ("error" in read)
+        return fail(409, read.error);
+    const parsed = KilnConfigFileSchema.safeParse(read.raw);
+    if (!parsed.success)
+        return fail(409, `Kiln config ${configPath} is invalid.`);
+    return { ok: true, document: project(configPath, read.revision, parsed.data) };
+}
+/**
+ * Validate `body`, merge it into the file, and write atomically.
+ * Unknown keys already in the file stay. A revision that does not match the
+ * bytes on disk is a 409 and writes nothing.
+ */
+export function saveSettings(configPath, body, home = homedir()) {
+    if (!isRecord(body))
+        return fail(400, "Request body must be a JSON object.");
+    const read = readConfigFile(configPath);
+    if ("error" in read)
+        return fail(409, "The settings file changed on disk. Reload and try again.");
+    const claimed = body.revision;
+    if (typeof claimed !== "string" || claimed.length === 0) {
+        return fail(400, "Settings are invalid.", { revision: "Reload settings and try again." });
+    }
+    if (claimed !== read.revision) {
+        return fail(409, "The settings file changed on disk. Reload and try again.");
+    }
+    const parsed = SettingsWriteSchema.safeParse(body);
+    if (!parsed.success)
+        return fail(400, "Settings are invalid.", fieldErrors(parsed.error));
+    const { revision: _revision, ...editable } = parsed.data;
+    const fields = checkoutFields(dirname(configPath), editable, home);
+    if (Object.keys(fields).length > 0)
+        return fail(400, "Settings are invalid.", fields);
+    const next = mergeSettings(read.raw, editable);
+    const file = KilnConfigFileSchema.safeParse(next);
+    if (!file.success)
+        return fail(400, "Settings are invalid.", fieldErrors(file.error));
+    const again = readConfigFile(configPath);
+    if ("error" in again || again.revision !== read.revision) {
+        return fail(409, "The settings file changed on disk. Reload and try again.");
+    }
+    const contents = `${JSON.stringify(next, null, 2)}\n`;
+    writeAtomic(configPath, contents);
+    return { ok: true, document: project(configPath, hashContents(contents), file.data) };
+}
+function project(path, revision, file) {
+    const sandbox = editableSandbox(file.sandbox);
+    return {
+        path,
+        revision,
+        repos: file.repos,
+        ...(file.stallTimeoutMs !== undefined ? { stallTimeoutMs: file.stallTimeoutMs } : {}),
+        ...(file.maxAttempts !== undefined ? { maxAttempts: file.maxAttempts } : {}),
+        ...(file.maxFixRounds !== undefined ? { maxFixRounds: file.maxFixRounds } : {}),
+        ...(sandbox ? { sandbox } : {}),
+        defaults: DEFAULTS,
+    };
+}
+function editableSandbox(sandbox) {
+    if (!sandbox)
+        return undefined;
+    const mode = sandbox.mode;
+    const allowDomains = sandbox.allowDomains;
+    if (mode === undefined && allowDomains === undefined)
+        return undefined;
+    return {
+        ...(mode !== undefined ? { mode } : {}),
+        ...(allowDomains !== undefined ? { allowDomains } : {}),
+    };
+}
+function mergeSettings(raw, settings) {
+    const next = { ...raw };
+    const previousRepos = isRecord(raw.repos) ? raw.repos : {};
+    const repos = {};
+    for (const [name, entry] of Object.entries(settings.repos)) {
+        const prior = isRecord(previousRepos[name]) ? { ...previousRepos[name] } : {};
+        prior.path = entry.path;
+        setOptional(prior, "test", entry.test);
+        setOptional(prior, "deliver", entry.deliver);
+        setOptional(prior, "base", entry.base);
+        setOptional(prior, "prTitle", entry.prTitle);
+        setOptional(prior, "branch", entry.branch);
+        repos[name] = prior;
+    }
+    next.repos = repos;
+    setOptional(next, "stallTimeoutMs", settings.stallTimeoutMs);
+    setOptional(next, "maxAttempts", settings.maxAttempts);
+    setOptional(next, "maxFixRounds", settings.maxFixRounds);
+    if (settings.sandbox) {
+        const prior = isRecord(raw.sandbox) ? { ...raw.sandbox } : {};
+        setOptional(prior, "mode", settings.sandbox.mode);
+        setOptional(prior, "allowDomains", settings.sandbox.allowDomains);
+        if (Object.keys(prior).length === 0)
+            delete next.sandbox;
+        else
+            next.sandbox = prior;
+    }
+    return next;
+}
+function checkoutFields(configDir, settings, home) {
+    const fields = {};
+    for (const [name, entry] of Object.entries(settings.repos)) {
+        try {
+            assertCheckoutDirectory(name, configDir, entry.path, home);
+        }
+        catch (error) {
+            fields[`repos.${name}.path`] = error instanceof Error ? error.message : String(error);
+        }
+        if (entry.base === undefined)
+            continue;
+        try {
+            assertBranchName(entry.base);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            fields[`repos.${name}.base`] = message.replace(/^--base\s+\S+\s+/, "Base ");
+        }
+    }
+    return fields;
+}
+function fieldErrors(error) {
+    const fields = {};
+    for (const issue of error.issues) {
+        if (issue.code === "unrecognized_keys") {
+            const prefix = issue.path.length ? `${issue.path.map(String).join(".")}.` : "";
+            for (const key of issue.keys) {
+                const field = `${prefix}${key}`;
+                if (!fields[field])
+                    fields[field] = "Unknown field.";
+            }
+            continue;
+        }
+        const key = issue.path.length ? issue.path.map(String).join(".") : "body";
+        if (!fields[key])
+            fields[key] = issue.message;
+    }
+    return fields;
+}
+function setOptional(target, key, value) {
+    if (value === undefined)
+        delete target[key];
+    else
+        target[key] = value;
+}
+function readConfigFile(configPath) {
+    let text;
+    try {
+        text = readFileSync(configPath, "utf8");
+    }
+    catch {
+        return { error: "The settings file changed on disk. Reload and try again." };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return { error: `Kiln config ${configPath} is invalid.` };
+    }
+    if (!isRecord(parsed))
+        return { error: `Kiln config ${configPath} must be a JSON object.` };
+    return { revision: hashContents(text), raw: parsed };
+}
+function hashContents(contents) {
+    return createHash("sha256").update(contents).digest("hex");
+}
+function writeAtomic(configPath, contents) {
+    const tmp = join(dirname(configPath), `.${basename(configPath)}.${process.pid}.tmp`);
+    try {
+        writeFileSync(tmp, contents, { mode: 0o600 });
+        renameSync(tmp, configPath);
+    }
+    catch (error) {
+        rmSync(tmp, { force: true });
+        throw error;
+    }
+}
+function fail(status, error, fields) {
+    return {
+        ok: false,
+        status,
+        body: fields && Object.keys(fields).length > 0 ? { error, fields } : { error },
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/workflow.js

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, join, sep } from "node:path";
 import { jobBasename, packageRoot } from "./paths.js";
 const FACTORY_DIRECTIVE = /^<!--\s*factory:\s*(prompts\/factory\/[a-z0-9-]+\.md)\s*-->/;
@@ -26,6 +26,22 @@ const INPUT_VALUES = {
     description: (input) => input.specText,
     acceptance: (input) => input.specText,
 };
+/** Workflow names from `workflows/*.yaml`, sorted. */
+export function listWorkflowNames() {
+    const dir = join(packageRoot(), "workflows");
+    let names = [];
+    try {
+        names = readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    return names
+        .filter((name) => name.endsWith(".yaml") && !name.startsWith("."))
+        .map((name) => name.slice(0, -".yaml".length))
+        .filter((name) => WORKFLOW_NAME.test(name))
+        .sort();
+}
 export function assertWorkflowName(name) {
     if (!WORKFLOW_NAME.test(name)) {
         throw new Error(`Workflow name ${JSON.stringify(name)} must start with a letter or digit and contain only letters, digits, dots, underscores, and hyphens.`);

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@lchase/kiln",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Run a workflow on any registered repo. A markdown spec is the input.",
+  "license": "MIT",
   "type": "module",
   "bin": {
     "kiln": "./dist/cli.js"
@@ -33,7 +34,7 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@lchase/yak": "0.7.1",
+    "@lchase/yak": "0.8.0",
     "zod": "^4.6.7"
   },
   "devDependencies": {

package/workflows/feature.yaml

@@ -125,10 +125,13 @@ steps:
 
         # Build and verify stay in order. These four do not need each other,
         # so concurrency 4 starts them together. They have no Write or Edit.
-        # Bash stays, because the factory prompts diff with git. Yak warns
-        # that concurrent Bash steps share one cwd. The preambles forbid
-        # re-running tests, builds, and any other write; git and file reads
-        # stay. input is inherited for baseRef; it is not in needs.
+        # Bash stays: the factory prompts run `git diff <main>...HEAD`. The
+        # kiln preambles allow read-only git and forbid re-running tests,
+        # builds, and writes. Yak 0.8.0 counts Bash as write-capable
+        # (WRITE_CAPABLE_TOOLS in src/ir/validate.ts) and has no read-only
+        # exemption, so tick prints a concurrency warning. Do not drop Bash
+        # or set concurrency to 1 to silence it. That needs a yak change.
+        # input is inherited for baseRef; it is not in needs.
         - id: security
           needs: [spec, build, verify]
           agent: