@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.1

package/src/sweeps.js

@@ -0,0 +1,241 @@
+import { repoRoot } from "./git.js";
+import {
+  alertsError,
+  isPlainPath,
+  LIST_CAP,
+  listCodeScanningAlerts,
+  listDependabotAlerts,
+  listDependabotPrs,
+  listOpenIssues,
+  listSecretScanningAlerts,
+  severityRank
+} from "./github.js";
+const NOT_A_FIX = /^(question|wontfix|won't fix|duplicate|invalid|discussion|needs[- ]info)$/i;
+async function listSweep(repo, kind, runs) {
+  const list = kind === "issues" ? await issueItems(repo) : kind === "dependabot" ? await dependabotItems(repo) : await alertItems(repo);
+  const root = await repoRoot(repo).catch(() => repo);
+  for (const item of list.items) {
+    const covering = item.source ? coveringRun(runs, root, item.source) : void 0;
+    if (covering) {
+      item.existingRun = covering.id;
+      item.selected = false;
+      item.note = covering.status === "running" ? "A run is working on it" : "Already has a run";
+    }
+  }
+  return list;
+}
+const cutShort = (what, cap) => `Only the first ${cap} ${what} are listed; sweep again once these are done`;
+async function issueItems(repo) {
+  const issues = await listOpenIssues(repo);
+  return {
+    kind: "issues",
+    notices: issues.truncated ? [cutShort("open issues", LIST_CAP)] : [],
+    items: issues.items.map((i) => {
+      const skip = i.labels.find((l) => NOT_A_FIX.test(l));
+      return {
+        key: `issue#${i.number}`,
+        ref: `#${i.number}`,
+        title: i.title,
+        detail: i.labels.join(" \xB7 "),
+        labels: i.labels,
+        url: i.url,
+        selected: !skip,
+        note: skip ? `Labelled \u201C${skip}\u201D` : void 0,
+        // Not the title: whoever opened the issue wrote it, and the task is read as instructions.
+        // The run gets the title with the issue's text, fenced as information.
+        task: `Fix issue #${i.number}. Add a test that fails without the fix.`,
+        source: { kind: "issue", number: i.number }
+      };
+    })
+  };
+}
+const CI_NOTE = { pass: "CI passes \u2014 ready for you to merge", pending: "CI is still running", none: "No CI checks reported" };
+async function dependabotItems(repo) {
+  const prs = await listDependabotPrs(repo);
+  return {
+    kind: "dependabot",
+    notices: prs.truncated ? [cutShort("Dependabot pull requests", prs.items.length)] : [],
+    items: prs.items.map((pr) => ({
+      key: `pr#${pr.number}`,
+      ref: `#${pr.number}`,
+      title: pr.title,
+      detail: `${pr.ci === "fail" ? "CI failing" : pr.ci === "pass" ? "CI green" : pr.ci === "pending" ? "CI running" : "no CI"} \xB7 ${pr.headRefName}`,
+      url: pr.url,
+      // Only a failing PR needs an agent; code-flow never merges the green ones for you.
+      selected: pr.ci === "fail",
+      note: pr.ci === "fail" ? void 0 : CI_NOTE[pr.ci],
+      // The PR's title stays out of the task: package names and versions come from upstream.
+      task: `Make CI pass on Dependabot's pull request #${pr.number}. The failing checks and their logs are below. Fix the cause by adapting the code to the new version; don't pin it back, and don't disable, skip or weaken tests.`,
+      source: { kind: "pr", number: pr.number, ciLogs: true }
+    }))
+  };
+}
+async function alertItems(repo) {
+  const [dependabot, codeScanning, secrets, prs] = await Promise.allSettled([
+    listDependabotAlerts(repo),
+    listCodeScanningAlerts(repo),
+    listSecretScanningAlerts(repo),
+    listDependabotPrs(repo)
+  ]);
+  const notices = [];
+  const items = [];
+  const openPrs = prs.status === "fulfilled" ? prs.value.items : [];
+  const note = (what, list) => list.truncated && notices.push(cutShort(what, list.items.length));
+  if (dependabot.status === "fulfilled") {
+    items.push(...dependabotAlertItems(dependabot.value.items, openPrs));
+    note("Dependabot alerts", dependabot.value);
+  } else notices.push(alertsError("Dependabot alerts", dependabot.reason));
+  if (codeScanning.status === "fulfilled") {
+    note("code scanning alerts", codeScanning.value);
+    for (const a of codeScanning.value.items) {
+      const rule = a.rule ?? {};
+      const where = a.most_recent_instance?.location ?? {};
+      const severity = String(rule.security_severity_level ?? rule.severity ?? "unknown");
+      const serious = severityRank(severity) <= severityRank("medium");
+      const title = rule.description || rule.name || rule.id;
+      const at = where.path ? `${where.path}${where.start_line ? `:${where.start_line}` : ""}` : "";
+      items.push({
+        key: `code-scanning#${a.number}`,
+        ref: `#${a.number}`,
+        title,
+        detail: [at, a.tool?.name].filter(Boolean).join(" \xB7 "),
+        url: a.html_url,
+        severity,
+        selected: serious,
+        note: serious ? void 0 : "Low severity",
+        // The path is the code's: one that carries words stays out of the task (the run's prompt
+        // has it in the alert's fence).
+        task: `Fix code scanning alert #${a.number}: ${title}${at && isPlainPath(at) ? ` in ${at}` : ""}. Fix the cause rather than suppressing the alert, and add a test where it makes sense.`,
+        source: { kind: "alert", tool: "code-scanning", number: a.number }
+      });
+    }
+  } else notices.push(alertsError("Code scanning alerts", codeScanning.reason));
+  if (secrets.status === "fulfilled") {
+    note("leaked secrets", secrets.value);
+    for (const a of secrets.value.items) {
+      items.push({
+        key: `secret#${a.number}`,
+        ref: `#${a.number}`,
+        title: a.secret_type_display_name || a.secret_type || "Leaked secret",
+        detail: "Leaked secret \u2014 revoke and rotate it, then close the alert",
+        url: a.html_url,
+        severity: "critical",
+        selected: false,
+        manual: true,
+        note: "Needs you: agents never get secrets"
+      });
+    }
+  } else notices.push(alertsError("Secret scanning alerts", secrets.reason));
+  items.sort((a, b) => severityRank(a.severity) - severityRank(b.severity) || a.key.localeCompare(b.key));
+  return { kind: "alerts", items, notices };
+}
+function dependabotAlertItems(alerts, prs) {
+  const byPackage = /* @__PURE__ */ new Map();
+  for (const a of alerts) {
+    const pkg = a.dependency?.package ?? a.security_vulnerability?.package ?? {};
+    const key = `${pkg.ecosystem}/${pkg.name}`;
+    byPackage.set(key, [...byPackage.get(key) ?? [], a]);
+  }
+  return [...byPackage.entries()].map(([key, group]) => {
+    group.sort((a, b) => severityRank(a.security_advisory?.severity) - severityRank(b.security_advisory?.severity));
+    const worst = group[0];
+    const pkg = worst.dependency?.package ?? worst.security_vulnerability?.package ?? {};
+    const numbers = group.map((a) => a.number).sort((a, b) => a - b);
+    const severity = String(worst.security_advisory?.severity ?? "unknown");
+    const patched = group.map((a) => a.security_vulnerability?.first_patched_version?.identifier).filter((v) => !!v).sort((a, b) => a.localeCompare(b, void 0, { numeric: true })).at(-1);
+    const covered = prs.find((pr) => upgrades(pr, pkg.name));
+    const manifest = worst.dependency?.manifest_path;
+    const count = numbers.length > 1 ? `${numbers.length} Dependabot alerts` : `Dependabot alert #${numbers[0]}`;
+    return {
+      key: `dependabot#${numbers[0]}`,
+      legacyKey: `dependabot:${key}`,
+      ref: numbers.length > 1 ? `${numbers.length} alerts` : `#${numbers[0]}`,
+      title: `${pkg.name} (${pkg.ecosystem})`,
+      detail: [`${worst.security_vulnerability?.vulnerable_version_range ?? "?"} \u2192 ${patched ?? "no fix yet"}`, worst.security_advisory?.summary].filter(Boolean).join(" \xB7 "),
+      url: worst.html_url,
+      severity,
+      selected: !covered && !!patched,
+      note: covered ? `Dependabot PR #${covered.number} already upgrades it` : patched ? void 0 : "No patched version yet",
+      task: patched ? `Fix ${count} in ${pkg.name} (${pkg.ecosystem}): upgrade it to ${patched} or later${manifest ? ` in ${manifest}` : ""}. Update anything the upgrade breaks and keep the tests passing.` : `Mitigate ${count} in ${pkg.name} (${pkg.ecosystem}): no patched version exists yet. Avoid the vulnerable code path or replace the package, and explain what you did.`,
+      source: { kind: "alert", tool: "dependabot", number: numbers[0], numbers }
+    };
+  });
+}
+function upgrades(pr, name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\bbump ${escaped} from\\b`, "i").test(pr.title) || new RegExp(`/${escaped.replace(/\//g, "\\/")}-\\d`).test(pr.headRefName);
+}
+function coveringRun(runs, repo, source) {
+  const standing = runs.filter(
+    (r) => r.repo === repo && !r.archived && r.triage?.state !== "rejected" && r.status !== "failed" && r.status !== "cancelled" && r.source?.kind === source.kind
+  );
+  if (source.kind !== "alert") return standing.find((r) => r.source.number === source.number);
+  const numbers = source.numbers?.length ? source.numbers : [source.number];
+  const covers = numbers.map((n) => standing.find((r) => r.source.alert?.tool === source.tool && (r.source.alert?.numbers ?? [r.source.number]).includes(n)));
+  return covers.every(Boolean) ? covers[0] : void 0;
+}
+function sourceKeys(source) {
+  if (source.kind !== "alert") return [`${source.kind}#${source.number}`];
+  const numbers = source.numbers?.length ? source.numbers : [source.number];
+  return numbers.map((n) => `${source.tool ?? "alert"}#${n}`);
+}
+const SWEEP_SOURCE = { issues: "issue", dependabot: "pr", alerts: "alert" };
+const sweepTakes = (kind, source) => SWEEP_SOURCE[kind] === source.kind;
+function findSweepItem(list, source) {
+  return list.items.find((i) => {
+    const s = i.source;
+    if (!s || s.kind !== source.kind) return false;
+    if (s.kind !== "alert") return s.number === source.number;
+    return s.tool === source.tool && (s.numbers ?? [s.number]).includes(source.number);
+  });
+}
+function upgradeLegacyKeys(list, handled) {
+  let changed = false;
+  for (const item of list.items) {
+    if (!item.legacyKey || !item.source || !handled.has(item.legacyKey)) continue;
+    handled.delete(item.legacyKey);
+    for (const key of sourceKeys(item.source)) handled.add(key);
+    changed = true;
+  }
+  return changed;
+}
+async function runSweep(input) {
+  const outcome = { started: [], skipped: [], failed: [] };
+  const root = await repoRoot(input.repo).catch(() => input.repo);
+  const queue = [...input.items];
+  const seen = /* @__PURE__ */ new Set();
+  const worker = async () => {
+    for (let item = queue.shift(); item; item = queue.shift()) {
+      if (seen.has(item.key)) continue;
+      seen.add(item.key);
+      const covering = coveringRun(input.runs, root, item.source);
+      if (covering) {
+        outcome.skipped.push({ key: item.key, why: `already has run ${covering.id}` });
+        continue;
+      }
+      try {
+        const run = await input.start(item);
+        outcome.started.push({ key: item.key, id: run.id });
+      } catch (err) {
+        outcome.failed.push({ key: item.key, error: err.message });
+      }
+    }
+  };
+  await Promise.all(Array.from({ length: Math.max(1, input.concurrency ?? 2) }, worker));
+  const order = new Map(input.items.map((item, i) => [item.key, i]));
+  for (const list of [outcome.started, outcome.skipped, outcome.failed]) list.sort((a, b) => order.get(a.key) - order.get(b.key));
+  return outcome;
+}
+function nextSweepItems(list, handled, max) {
+  return list.items.filter((i) => i.selected && !i.manual && i.source && i.task && !sourceKeys(i.source).every((k) => handled.has(k))).slice(0, max).map((i) => ({ key: i.key, task: i.task, source: i.source }));
+}
+export {
+  coveringRun,
+  findSweepItem,
+  listSweep,
+  nextSweepItems,
+  runSweep,
+  sourceKeys,
+  sweepTakes,
+  upgradeLegacyKeys
+};

package/src/tailscale.js

@@ -0,0 +1,101 @@
+import { execFile } from "node:child_process";
+import { isIPv4 } from "node:net";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { certificateHostname, validateRemoteCertificate } from "./remote-tls.js";
+import { childEnv } from "./env.js";
+function isTailscaleIPv4(address) {
+  if (!isIPv4(address)) return false;
+  const [a, b] = address.split(".").map(Number);
+  return a === 100 && b >= 64 && b <= 127;
+}
+function parseTailscaleStatus(output) {
+  const raw = JSON.parse(output);
+  if (!raw || typeof raw !== "object") throw new Error("Invalid Tailscale status");
+  switch (raw.BackendState) {
+    case "NeedsLogin":
+      return { state: "needs-login", message: "Sign in to Tailscale on this computer, then refresh." };
+    case "NeedsMachineAuth":
+      return { state: "needs-approval", message: "Ask your tailnet administrator to approve this computer, then refresh." };
+    case "Stopped":
+      return { state: "stopped", message: "Turn on Tailscale on this computer, then refresh." };
+    case "Starting":
+      return { state: "starting", message: "Tailscale is connecting. Codeflow will check again automatically." };
+    case "Running":
+      break;
+    default:
+      return { state: "unavailable", message: "Tailscale is not ready. Open Tailscale on this computer and check its connection." };
+  }
+  if (raw.TUN === false) return { state: "unavailable", message: "Direct access needs Tailscale's network interface. Userspace networking is not supported." };
+  if (raw.Self?.Online === false) return { state: "unavailable", message: "Tailscale reports this computer offline. Reconnect Tailscale, then refresh." };
+  const ip = Array.isArray(raw.TailscaleIPs) ? raw.TailscaleIPs.find((value) => typeof value === "string" && isTailscaleIPv4(value)) : void 0;
+  if (!ip) return { state: "unavailable", message: "Tailscale has no usable IPv4 address. Reconnect Tailscale, then refresh." };
+  const dns = typeof raw.Self?.DNSName === "string" ? raw.Self.DNSName.replace(/\.$/, "").toLowerCase() : "";
+  const dnsName = dns.length <= 253 && /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?\.ts\.net$/.test(dns) ? dns : void 0;
+  return { state: "connected", message: "Tailscale is connected.", ip, ...dnsName ? { dnsName } : {} };
+}
+const run = promisify(execFile);
+function commands() {
+  const names = ["tailscale"];
+  if (process.platform === "darwin") names.push("/Applications/Tailscale.app/Contents/MacOS/Tailscale");
+  if (process.platform === "win32") names.push(join(process.env.ProgramFiles || "C:\\Program Files", "Tailscale", "tailscale.exe"));
+  return names;
+}
+async function detectTailscale(candidates = commands()) {
+  for (const command of candidates) {
+    try {
+      const { stdout } = await run(command, ["status", "--json", "--peers=false"], {
+        env: childEnv({ TAILSCALE_BE_CLI: "1" }),
+        timeout: 4e3,
+        maxBuffer: 1024 * 1024,
+        windowsHide: true
+      });
+      return parseTailscaleStatus(stdout);
+    } catch (error) {
+      if (error.code === "ENOENT") continue;
+      const stdout = error.stdout;
+      if (stdout) {
+        try {
+          return parseTailscaleStatus(stdout);
+        } catch {
+        }
+      }
+      return { state: "unavailable", message: "Could not read Tailscale status. Open Tailscale and check that its service is running, then refresh." };
+    }
+  }
+  return { state: "not-installed", message: "Install Tailscale on this computer and your remote device, sign in to the same tailnet, then refresh." };
+}
+async function requestTailscaleCertificate(hostname, candidates = commands()) {
+  const host = certificateHostname(hostname);
+  if (!host.endsWith(".ts.net")) throw new Error("Connect Tailscale with a valid tailnet DNS name first");
+  const directory = await mkdtemp(join(tmpdir(), "codeflow-tls-"));
+  try {
+    for (const command of candidates) {
+      try {
+        await run(command, ["cert", `--cert-file=${join(directory, "cert.pem")}`, `--key-file=${join(directory, "key.pem")}`, "--min-validity=720h", host], {
+          env: childEnv({ TAILSCALE_BE_CLI: "1" }),
+          timeout: 6e4,
+          maxBuffer: 64 * 1024,
+          windowsHide: true
+        });
+        const value = { hostname: host, source: "tailscale", cert: await readFile(join(directory, "cert.pem"), "utf8"), key: await readFile(join(directory, "key.pem"), "utf8") };
+        validateRemoteCertificate(value);
+        return value;
+      } catch (error) {
+        if (error.code === "ENOENT") continue;
+        throw new Error("Tailscale could not issue the certificate. Enable HTTPS certificates in your tailnet DNS settings, check that this user can run tailscale cert, and use a current Tailscale version. Then retry or import certificate files.");
+      }
+    }
+    throw new Error("Tailscale CLI was not found. Install Tailscale or import certificate files.");
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}
+export {
+  detectTailscale,
+  isTailscaleIPv4,
+  parseTailscaleStatus,
+  requestTailscaleCertificate
+};

package/src/task-draft.js

@@ -0,0 +1,23 @@
+const TASK_DRAFT_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["title", "goal", "acceptance"],
+  properties: {
+    title: { type: "string", minLength: 1, maxLength: 200 },
+    goal: { type: "string", minLength: 1, maxLength: 16384 },
+    acceptance: { type: "string", minLength: 1, maxLength: 8192 }
+  }
+};
+function taskDraftProblem(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return "Expected a task draft object";
+  const draft = value;
+  if (Object.keys(draft).some((key) => !["title", "goal", "acceptance"].includes(key))) return "Unexpected task draft field";
+  for (const [key, limit] of [["title", 200], ["goal", 16384], ["acceptance", 8192]]) {
+    const text = draft[key];
+    if (typeof text !== "string" || !text.trim() || text.length > limit || text.includes("\0")) return `Draft ${key} must contain 1\u2013${limit} characters`;
+  }
+}
+export {
+  TASK_DRAFT_SCHEMA,
+  taskDraftProblem
+};

package/src/team-evaluation.js

@@ -0,0 +1,242 @@
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, open, readFile, readdir, rename, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { CODEFLOW_HOME } from "./config.js";
+const finite = (n) => typeof n === "number" && Number.isFinite(n) && n >= 0;
+const interval = (start, end) => finite(start) && finite(end) && end >= start ? [[start, end]] : [];
+function intervalDuration(intervals) {
+  let total = 0, start = -1, end = -1;
+  for (const [a, b] of [...intervals].sort((a2, b2) => a2[0] - b2[0])) {
+    if (a > end) {
+      if (start >= 0) total += end - start;
+      start = a;
+      end = b;
+    } else end = Math.max(end, b);
+  }
+  return total + (start < 0 ? 0 : end - start);
+}
+function buildTeamEvaluation(run, options = {}) {
+  const team = run.team;
+  const turns = run.steps.filter((step) => step.kind === "agent");
+  const coordinator = (step) => step.coordination === true || !team && step.role === "supervisor";
+  const workers = turns.filter((step) => {
+    if (!team) return step.role === "workers" || step.role === "worker";
+    const member = team.members.find((item) => item.id === step.memberId);
+    if (member) return member.role === "worker" && !coordinator(step);
+    return !!step.taskId && !coordinator(step) && step.role !== "coordinator" && step.role !== "reviewer";
+  });
+  const invocations = team?.metrics.invocations ?? turns.reduce((sum, step) => sum + (step.invocations ?? 1), 0);
+  const coordination = team?.metrics.coordinatorInvocations ?? turns.filter(coordinator).reduce((sum, step) => sum + (step.invocations ?? 1), 0);
+  const peer = (team?.messages ?? []).filter((message) => message.kind === "question" && message.recipient !== "user" && message.originalRecipient !== "user");
+  const peerIntervals = peer.flatMap((message) => interval(message.createdAt, message.answeredAt));
+  const barriers = [];
+  for (const message of peer) {
+    if (!finite(message.answeredAt)) continue;
+    const task = team?.tasks.find((item) => item.id === message.taskId);
+    if (!task || !task.dependsOn.every((id) => {
+      const dependency = team?.tasks.find((item) => item.id === id);
+      return finite(dependency?.finishedAt) && dependency.finishedAt <= message.answeredAt;
+    })) continue;
+    const next = workers.filter((step) => step.taskId === task.id && step.startedAt >= message.answeredAt).sort((a, b) => a.startedAt - b.startedAt)[0];
+    if (next) barriers.push([message.answeredAt, next.startedAt]);
+  }
+  const usage = turns.filter((step) => step.usage);
+  const integrityFlags = Object.values(run.integrity ?? {}).reduce((sum, issues) => sum + issues.length, 0);
+  const check = team?.verification?.check === "not_required" ? "not_required" : run.verdict === "passed" ? "passed" : run.verdict === "failing" ? "failed" : "unknown";
+  const approved = team ? !!team.verification?.reviewed && !!team.verification.approved : run.facts?.approved === true;
+  const requirements = team?.requirements.length ?? 0;
+  const covered = team?.requirements.filter((requirement) => {
+    const tasks = team.tasks.filter((task) => task.requirements.includes(requirement.id));
+    return tasks.length > 0 && tasks.every((task) => task.status === "completed" && !task.evidenceStale && (!task.retainedBaseline || approved));
+  }).length ?? 0;
+  const gaps = team?.gaps.length ?? 0;
+  const unchangedRerun = !!run.teamRerun && run.facts?.proofNotRequired === "unchanged-rerun" && check === "passed" && approved;
+  const verified = run.status === "done" && approved && (check === "passed" || check === "not_required") && !gaps && !integrityFlags && (!team || team.status === "completed" && covered === requirements) && (run.prove === false || check === "not_required" || run.facts?.proof === "proven" || unchangedRerun);
+  const mode = options.mode ?? "unknown";
+  const approvalAnswers = options.journal ? [...options.journal].filter(([key]) => key.startsWith("approval:")).map(([, value]) => value) : void 0;
+  const rated = options.memoryEntries?.flatMap((entry) => entry.feedback?.filter((feedback) => feedback.runId === run.id && run.memoryManifest?.included.some((ref) => ref.id === entry.id && ref.revision === feedback.revision)) ?? []);
+  return {
+    version: 1,
+    id: `evaluation-${run.id}`,
+    runId: run.id,
+    at: run.endedAt ?? Date.now(),
+    mode,
+    caseId: options.caseId ?? "unspecified",
+    pairId: options.pairId ?? run.group?.id,
+    taskHash: createHash("sha256").update(run.task).digest("hex"),
+    baseRef: run.baseRef,
+    pattern: run.pattern,
+    cliVersions: { ...options.cliVersions },
+    status: run.status,
+    verified,
+    reproducibility: {
+      nodeVersion: process.version,
+      platform: `${process.platform}/${process.arch}`,
+      ...options.reproducibility,
+      requestedSettings: Object.fromEntries(Object.entries(run.agentSettings ?? {}).filter((entry) => entry[1] !== void 0).map(([id, settings]) => [id, structuredClone(settings)])),
+      stepSettings: [...new Map(turns.filter((step) => step.agent).map((step) => {
+        const settings = { provider: step.agent, model: step.settings?.model, effort: step.settings?.effort };
+        return [JSON.stringify(settings), settings];
+      })).values()]
+    },
+    verification: { checks: check, review: approved ? "approved" : run.facts?.approved === false || team?.verification?.reviewed ? "rejected" : "unknown", proof: run.facts?.proof, gaps, requirements, covered, integrityFlags, ...run.teamRerun ? { proofNotRequired: run.facts?.proofNotRequired, retainedTasks: team?.tasks.filter((task) => task.retainedBaseline).length ?? 0, newlyExecutedTasks: team?.tasks.filter((task) => !task.retainedBaseline && (task.attempts ?? 0) > 0).length ?? 0, requirementsUsingBaseline: team?.requirements.filter((requirement) => team.tasks.some((task) => task.retainedBaseline && task.requirements.includes(requirement.id))).length ?? 0 } : {} },
+    metrics: {
+      invocations,
+      coordinatorInvocations: coordination,
+      coordinatorFraction: invocations ? coordination / invocations : null,
+      workerTurns: workers.length,
+      multiWorker: new Set(workers.map((step) => team ? step.memberId ?? step.agent : step.worktree ?? step.agent)).size > 1,
+      elapsedMs: run.endedAt === void 0 ? void 0 : Math.max(0, run.endedAt - run.createdAt),
+      activeWorkMs: intervalDuration(run.steps.flatMap((step) => interval(step.startedAt, step.endedAt))),
+      coordinatorMs: turns.some(coordinator) ? turns.filter(coordinator).reduce((sum, step) => sum + (finite(step.endedAt) ? Math.max(0, step.endedAt - step.startedAt) : 0), 0) : void 0,
+      reportedTokens: usage.length ? usage.reduce((sum, step) => sum + step.usage.inputTokens + (step.usage.cacheReadTokens ?? 0) + step.usage.outputTokens, 0) : void 0,
+      reportedApiCostUsd: usage.some((step) => step.usage.costUsd > 0) ? usage.reduce((sum, step) => sum + step.usage.costUsd, 0) : void 0,
+      tokenReportingTurns: usage.length,
+      questions: team?.metrics.questionCount ?? 0,
+      peerQuestions: peer.length,
+      blockedTurns: team?.metrics.blockedTurns ?? 0,
+      peerYieldRate: workers.length ? new Set(peer.filter((message) => message.blocking).map((message) => `${message.sender}:${message.taskId}:${message.sourceAttempt ?? message.sourceStepId ?? message.id}`)).size / workers.length : null,
+      peerWaitingMs: peerIntervals.length ? peerIntervals.reduce((sum, [a, b]) => sum + b - a, 0) : peer.length ? void 0 : 0,
+      peerWaitingWallMs: peerIntervals.length ? intervalDuration(peerIntervals) : peer.length ? void 0 : 0,
+      avoidableBarrierEstimateMs: barriers.length ? intervalDuration(barriers) : peer.length ? void 0 : 0,
+      timedPeerQuestions: peerIntervals.length,
+      repairTurns: turns.filter((step) => !step.taskId && /repair|fix/i.test(step.title)).length,
+      // engine-titled repair/fix steps, never model-titled task names
+      selectedMemories: run.memoryManifest?.included.length ?? 0,
+      omittedMemories: run.memoryManifest?.omitted.length ?? 0,
+      coordinatorRevisions: team?.metrics.revisions ?? 0,
+      approvals: approvalAnswers ? { approved: approvalAnswers.filter((answer) => answer.decision === "approve").length, revised: approvalAnswers.filter((answer) => answer.decision === "revise").length, rejected: approvalAnswers.filter((answer) => answer.decision === "reject").length, withReason: approvalAnswers.filter((answer) => !!answer.note?.trim()).length } : void 0,
+      memoryFeedback: rated ? { useful: rated.filter((item) => item.rating === "useful").length, irrelevant: rated.filter((item) => item.rating === "irrelevant").length, stale: rated.filter((item) => item.rating === "stale").length, incorrect: rated.filter((item) => item.rating === "incorrect").length } : void 0,
+      replay: options.replay
+    },
+    limitations: [
+      ...mode !== "real" ? [mode === "fake" ? "Deterministic fake CLIs validate orchestration, not model quality or subscription savings." : "Execution provenance is unknown; excluded from real-run rollout evidence."] : [],
+      "API-equivalent cost is not a subscription charge; unreported values remain unknown.",
+      "Model identities record requested CLI settings. A provider default or alias is not an immutable model snapshot and may change between trials.",
+      "Avoidable barrier time is a counterfactual upper-bound estimate after answered peer questions; it does not prove spare process capacity or an asynchronous speedup.",
+      "Active work is the union of observed step intervals; it excludes gaps and is not a full run-clock measurement.",
+      ...run.teamRerun ? ["Selective reruns retain explicitly pinned source task inputs. Baseline task counts are not newly executed work; final review still covers every original requirement."] : [],
+      ...!team ? ["Supervisor coordination includes its planning, integration and repair turns; legacy requirements have no structured coverage manifest."] : []
+    ]
+  };
+}
+function assessTeamRollout(reports) {
+  const real = reports.filter((report) => report.mode === "real" && report.status !== "running");
+  const auto = real.filter((report) => report.pattern === "auto-team");
+  const pairs = /* @__PURE__ */ new Map();
+  for (const report of real) if (report.pairId) {
+    const key = `${report.pairId}:${report.caseId}:${report.taskHash}:${report.baseRef}`;
+    pairs.set(key, [...pairs.get(key) ?? [], report]);
+  }
+  const matched = [...pairs.values()].filter((items) => items.some((item) => item.pattern === "auto-team") && items.some((item) => item.pattern === "supervisor"));
+  const verifiedMatch = matched.some((items) => items.some((item) => item.pattern === "auto-team" && item.verified));
+  const pairedQuality = matched.every((items) => !items.some((item) => item.pattern === "supervisor" && item.verified) || items.some((item) => item.pattern === "auto-team" && item.verified));
+  const multi = auto.filter((report) => report.metrics.multiWorker);
+  const denominator = multi.reduce((sum, report) => sum + report.metrics.invocations, 0);
+  const overhead = denominator ? multi.reduce((sum, report) => sum + report.metrics.coordinatorInvocations, 0) / denominator : null;
+  const workerTurns = auto.reduce((sum, report) => sum + report.metrics.workerTurns, 0);
+  const peerYields = auto.reduce((sum, report) => sum + (report.metrics.peerYieldRate ?? 0) * report.metrics.workerTurns, 0);
+  const blockers = [];
+  if (auto.length < 20) blockers.push(`Need 20 real Auto runs; recorded ${auto.length}.`);
+  if (workerTurns < 100) blockers.push(`Need 100 real worker turns; recorded ${workerTurns}.`);
+  if (matched.length < 20) blockers.push(`Need 20 matched Auto/Supervisor comparisons; recorded ${matched.length}.`);
+  if (!pairedQuality) blockers.push("Auto verification regressed against a matched Supervisor result.");
+  if (auto.some((report) => !report.verified)) blockers.push("Some real Auto results are incomplete or unverified.");
+  if (overhead === null || overhead > 0.25) blockers.push(overhead === null ? "No multi-worker coordinator overhead sample." : "Observed multi-worker coordinator calls exceed 25% of invocations.");
+  if (real.some((report) => !Object.keys(report.cliVersions).length)) blockers.push("Some real results have no recorded CLI versions.");
+  return { realRuns: real.length, realAutoRuns: auto.length, realWorkerTurns: workerTurns, matchedPairs: matched.length, verifiedAutoRuns: auto.filter((report) => report.verified).length, overheadFraction: overhead, peerYieldRate: workerTurns ? peerYields / workerTurns : null, eligibleBeta: verifiedMatch && pairedQuality && real.every((report) => Object.keys(report.cliVersions).length > 0), eligibleDefault: blockers.length === 0, blockers };
+}
+class TeamEvaluationStore {
+  constructor(directory = join(CODEFLOW_HOME, "team-evaluations")) {
+    this.directory = directory;
+  }
+  queue = Promise.resolve();
+  async write(file, value) {
+    await mkdir(this.directory, { recursive: true });
+    const temporary = join(this.directory, `.${file}.${randomBytes(8).toString("hex")}.tmp`);
+    try {
+      const handle = await open(temporary, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify(value, null, 2) + "\n");
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      await rename(temporary, join(this.directory, file));
+      if (process.platform !== "win32") {
+        const dir = await open(this.directory, "r");
+        try {
+          await dir.sync();
+        } finally {
+          await dir.close();
+        }
+      }
+    } finally {
+      await rm(temporary, { force: true });
+    }
+  }
+  async list() {
+    const names = await readdir(this.directory).catch((error) => {
+      if (error.code === "ENOENT") return [];
+      throw error;
+    });
+    const reports = await Promise.all(names.filter((name) => /^evaluation-[\w-]+\.json$/.test(name)).map(async (name) => {
+      const value = JSON.parse(await readFile(join(this.directory, name), "utf8"));
+      if (value.version !== 1 || value.id + ".json" !== name) throw new Error(`Unsupported or damaged evaluation ${name}`);
+      return value;
+    }));
+    return reports.sort((a, b) => b.at - a.at || a.id.localeCompare(b.id));
+  }
+  async record(report) {
+    if (report.version !== 1 || !/^evaluation-[\w-]+$/.test(report.id) || !["fake", "real", "unknown"].includes(report.mode)) throw new Error("Invalid evaluation report");
+    const operation = this.queue.then(async () => {
+      const previous = await readFile(join(this.directory, `${report.id}.json`), "utf8").catch((error) => {
+        if (error.code === "ENOENT") return void 0;
+        throw error;
+      });
+      if (previous) {
+        if (JSON.stringify(JSON.parse(previous)) !== JSON.stringify(report)) throw new Error("An evaluation is immutable; use a new run for another trial");
+        return report;
+      }
+      await this.write(`${report.id}.json`, report);
+      return report;
+    });
+    this.queue = operation.catch(() => void 0);
+    return operation;
+  }
+  async rollout(enabled = true) {
+    const decision = await readFile(join(this.directory, "rollout.json"), "utf8").then((text) => JSON.parse(text), (error) => {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    });
+    if (decision && (!["experimental", "beta", "default"].includes(decision.stage) || !Array.isArray(decision.evaluationIds))) throw new Error("Damaged team rollout decision");
+    return { enabled, stage: decision?.stage ?? "experimental", reason: enabled ? decision?.rationale ?? "No evaluation promotion decision has been recorded. The application default is configured separately." : "New Auto teams are disabled. Existing teams can still be viewed and resumed.", decision };
+  }
+  async decide(input) {
+    if (!["experimental", "beta", "default"].includes(input.stage) || typeof input.rationale !== "string" || !input.rationale.trim() || input.rationale.length > 4e3 || !Array.isArray(input.evaluationIds)) throw new Error("Choose a stage, evaluation reports and a written rationale");
+    const operation = this.queue.then(async () => {
+      const all = await this.list();
+      const ids = [...new Set(input.evaluationIds)];
+      if (ids.some((id) => !all.some((report) => report.id === id))) throw new Error("Unknown evaluation report");
+      const selected = all.filter((report) => ids.includes(report.id));
+      const assessment = assessTeamRollout(all);
+      if (input.stage === "beta" && !assessment.eligibleBeta) throw new Error("Beta needs a verified real Auto result and a matched Supervisor comparison with CLI versions and no verification regression");
+      if (input.stage === "default" && !assessment.eligibleDefault) throw new Error(`Default rollout is not supported: ${assessment.blockers.join(" ")}`);
+      if (input.stage !== "experimental" && !selected.length) throw new Error("Cite the evaluation reports the decision rests on");
+      const decision = { at: Date.now(), stage: input.stage, rationale: input.rationale.trim(), evaluationIds: ids };
+      await this.write(`decision-${decision.at}-${randomBytes(4).toString("hex")}.json`, decision);
+      await this.write("rollout.json", decision);
+      return this.rollout();
+    });
+    this.queue = operation.catch(() => void 0);
+    return operation;
+  }
+}
+const teamEvaluationStore = new TeamEvaluationStore();
+export {
+  TeamEvaluationStore,
+  assessTeamRollout,
+  buildTeamEvaluation,
+  intervalDuration,
+  teamEvaluationStore
+};