@mmerterden/multi-agent-pipeline 20.33.0 → 20.35.0

package/pipeline/scripts/scope-check-gate.mjs

@@ -10,21 +10,38 @@
  * Usage:
  *   git diff --name-only <base>...HEAD | node scope-check-gate.mjs --check .pipeline/scope-check.json --diff-files -
  *   node scope-check-gate.mjs --check scope-check.json --diff-files files.txt [--advisory]
+ *       [--patch <unified diff> | --repo <dir> --patch-range <a>...<b>]
+ *       [--rejected <triage-output.json> --repo <dir> --rework-base <rev>]
  *
- * Output (stdout, JSON): {ok, justified, unjustified[], unlisted[], notDone}
+ * Output (stdout, JSON): {ok, justified, unjustified[], unlisted[], notDone, formatOnly[]}
  *   unjustified = in the diff, missing from files[] (or with an empty reason)
  *   unlisted    = in files[], not in the diff (stale entry; reported, never fatal)
+ *   formatOnly  = with --patch, hunks whose removed and added lines differ only
+ *                 in whitespace: a reformat of lines the task did not need to
+ *                 touch. Reported, never fatal. --patch-range reads that diff
+ *                 with git itself, its output format pinned, so a caller needs
+ *                 no file or process substitution for it.
+ *   rejectedTouched = with --rejected and --rework-base, findings triage
+ *                 rejected whose lines a rework hunk (rework base against the
+ *                 working tree) changed: Phase 2 acts on accepted findings
+ *                 only, so a rework that edits a rejected finding's lines is
+ *                 "fixing" a finding triage ruled out. Reported, never fatal.
  *
  * Exit codes: 0 every diff file justified (or --advisory), 1 otherwise or on
  * unreadable input, 64 usage.
  */
 
+import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 
 import { normalizeFile } from "./_fingerprint.mjs";
+import { parseUnifiedDiff } from "./_unified-diff.mjs";
 
 const USAGE =
-  "usage: scope-check-gate.mjs --check <scope-check.json> --diff-files <path|-> [--advisory]";
+  "usage: scope-check-gate.mjs --check <scope-check.json> --diff-files <path|-> [--advisory] [--patch <diff> | --repo <dir> --patch-range <a>...<b>] [--rejected <triage.json> --repo <dir> --rework-base <rev>]";
+
+const REV = /^[A-Za-z0-9_./~^@{}-]+$/;
+const NEAR = 2;
 
 function parseArgs(argv) {
   const opts = {};
@@ -33,15 +50,188 @@ function parseArgs(argv) {
     if (a === "--check") opts.check = argv[++i];
     else if (a === "--diff-files") opts.diffFiles = argv[++i];
     else if (a === "--advisory") opts.advisory = true;
+    else if (a === "--patch") opts.patch = argv[++i];
+    else if (a === "--patch-range") opts.patchRange = argv[++i];
+    else if (a === "--repo") opts.repo = argv[++i];
+    else if (a === "--rejected") opts.rejected = argv[++i];
+    else if (a === "--rework-base") opts.reworkBase = argv[++i];
     else return null;
   }
+  for (const rev of [opts.patchRange, opts.reworkBase]) {
+    if (rev !== undefined && (!REV.test(rev) || rev.startsWith("-"))) return null;
+  }
+  if (Boolean(opts.rejected) !== Boolean(opts.reworkBase)) return null;
   return opts.check && opts.diffFiles ? opts : null;
 }
 
+/** The diff of a revision range (or a revision against the working tree), in the one shape the hunk readers take. */
+function rangeDiff(repo, range, unified = []) {
+  return execFileSync(
+    "git",
+    [
+      "-C",
+      repo || ".",
+      "-c",
+      "core.quotePath=false",
+      "diff",
+      "--no-ext-diff",
+      "--no-color",
+      "--no-textconv",
+      "--src-prefix=a/",
+      "--dst-prefix=b/",
+      ...unified,
+      range,
+      "--",
+    ],
+    { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, timeout: 30_000 },
+  );
+}
+
 function readText(path) {
   return path === "-" ? readFileSync(0, "utf-8") : readFileSync(path, "utf-8");
 }
 
+const INDENT_SENSITIVE = /(\.(py|pyi|ya?ml|coffee|haml|slim|pug)|(^|\/)(GNU)?[Mm]akefile)$/;
+
+const LINE_COMMENT = /(\.(py|pyi|ya?ml|sh|bash|zsh|rb|toml|coffee)|(^|\/)(GNU)?[Mm]akefile)$/;
+// Languages where a space next to a bracket, comma, semicolon or colon never
+// carries meaning. YAML, shell, Makefile and CSS are left out on purpose.
+const TIGHT_LANGS =
+  /\.(js|jsx|mjs|cjs|ts|tsx|java|go|cs|swift|kt|kts|json|rs|dart|scala|py|pyi|c|h|cc|cpp|hpp|m|mm)$/;
+const LEADING_OPERATOR_LANGS = /\.(kt|kts|swift|go|scala)$/;
+const BREAK_KEEPERS = /\b(return|throw|yield|break|continue)$/;
+const LEADING_OPERATOR = /^[+\-*/%&|^.?]/;
+const TIGHT = /\s*([(){}[\],;:])\s*/g;
+
+/** One line with string literals and comments verbatim and every other whitespace run as one space. */
+function foldLine(line, hashComments) {
+  const out = [];
+  let quote = null;
+  let gap = false;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    if (quote) {
+      out.push(c);
+      if (c === "\\") out.push(line[++i] ?? "");
+      else if (c === quote) quote = null;
+      continue;
+    }
+    if (c === " " || c === "\t" || c === "\r") {
+      gap = true;
+      continue;
+    }
+    if (gap && out.length) out.push(" ");
+    gap = false;
+    if ((c === "/" && line[i + 1] === "/") || (hashComments && c === "#")) {
+      out.push(line.slice(i));
+      break;
+    }
+    if (c === '"' || c === "'" || c === "`") quote = c;
+    out.push(c);
+  }
+  return out.join("");
+}
+
+/**
+ * The layout-free form of some lines. Each line is folded on its own (linear
+ * in the hunk), then the lines are joined by a space, except that a break
+ * after return, throw, yield, break or continue, and in Kotlin, Swift, Go or
+ * Scala a break before a leading operator, stays a break. Space next to
+ * brackets, commas, semicolons and colons is dropped only in TIGHT_LANGS, and
+ * never in a hunk that holds a C preprocessor line.
+ */
+function outsideStrings(text, file = "") {
+  const hashComments = LINE_COMMENT.test(file);
+  const lines = text.split("\n").map((l) => foldLine(l, hashComments));
+  let joined = "";
+  lines.forEach((line, i) => {
+    if (i === 0) {
+      joined = line;
+      return;
+    }
+    const keepBreak =
+      BREAK_KEEPERS.test(lines[i - 1]) ||
+      (LEADING_OPERATOR_LANGS.test(file) && LEADING_OPERATOR.test(line));
+    joined += (keepBreak ? "\u23ce" : " ") + line;
+  });
+  const preprocessor = lines.some((l) => l.startsWith("#")) && !hashComments;
+  const tight = TIGHT_LANGS.test(file) && !preprocessor;
+  return (tight ? joined.replace(TIGHT, "$1") : joined).trim();
+}
+
+const indentOf = (line) => /^[ \t]*/.exec(line)[0];
+
+/** True when the removed and added lines differ only in layout. */
+function layoutOnly(file, removed, added) {
+  if (!removed.length || !added.length) return false;
+  if (INDENT_SENSITIVE.test(file)) {
+    if (removed.length !== added.length) return false;
+    return removed.every(
+      (r, i) =>
+        indentOf(r.text) === indentOf(added[i].text) &&
+        outsideStrings(r.text, file) === outsideStrings(added[i].text, file),
+    );
+  }
+  const joined = (lines) => outsideStrings(lines.map((d) => d.text).join("\n"), file);
+  return joined(removed) === joined(added);
+}
+
+/**
+ * Hunks of a unified diff whose change is layout only: whitespace outside
+ * string literals, and in indentation-sensitive files never a leading indent.
+ */
+export function formatOnlyHunks(patch) {
+  const found = [];
+  for (const [file, diff] of parseUnifiedDiff(patch)) {
+    for (const h of diff.hunks) {
+      if (!h.removed.length && !h.added.length) continue;
+      if (layoutOnly(file, h.removed, h.added)) {
+        found.push({ file: normalizeFile(file), hunk: h.header });
+      }
+    }
+  }
+  return found;
+}
+
+/**
+ * Rejected findings whose line a hunk of the rework diff changed. The diff
+ * runs from the reviewed tree, so a finding's line is read on the hunk's old
+ * side: a hunk that removes or rewrites lines within NEAR of it, or inserts
+ * next to it, touches it.
+ */
+export function rejectedTouched(triage, patch) {
+  const rejected = (Array.isArray(triage?.rejected) ? triage.rejected : [])
+    .map((r) => r?.finding)
+    .filter((f) => f && typeof f.file === "string" && Number.isInteger(f.line) && f.line > 0);
+  if (!rejected.length) return [];
+  const ranges = new Map();
+  for (const [file, diff] of parseUnifiedDiff(patch)) {
+    const list = [];
+    for (const h of diff.hunks) {
+      const m = /^@@ -(\d+)(?:,(\d+))?/.exec(h.header);
+      if (!m) continue;
+      const start = Number(m[1]);
+      const count = m[2] === undefined ? 1 : Number(m[2]);
+      list.push({ from: start - NEAR, to: start + Math.max(count, 1) - 1 + NEAR, hunk: h.header });
+    }
+    ranges.set(normalizeFile(file), list);
+  }
+  const out = [];
+  for (const f of rejected) {
+    const hit = (ranges.get(normalizeFile(f.file)) || []).find(
+      (r) => f.line >= r.from && f.line <= r.to,
+    );
+    if (hit)
+      out.push({
+        file: normalizeFile(f.file),
+        line: f.line,
+        issue: f.issue ?? null,
+        hunk: hit.hunk,
+      });
+  }
+  return out;
+}
+
 export function evaluate(check, diffFiles) {
   const files = Array.isArray(check?.files) ? check.files : [];
   const reasons = new Map();
@@ -81,6 +271,27 @@ function main() {
     return fail;
   }
   const result = evaluate(check, diffFiles);
+  if (opts.patch || opts.patchRange) {
+    try {
+      const patch = opts.patch ? readText(opts.patch) : rangeDiff(opts.repo, opts.patchRange);
+      result.formatOnly = formatOnlyHunks(patch);
+    } catch (err) {
+      result.formatOnly = [];
+      result.patchError = err.message;
+    }
+  }
+  if (opts.rejected) {
+    try {
+      const triage = JSON.parse(readText(opts.rejected));
+      result.rejectedTouched = rejectedTouched(
+        triage,
+        rangeDiff(opts.repo, opts.reworkBase, ["-U0"]),
+      );
+    } catch (err) {
+      result.rejectedTouched = [];
+      result.rejectedError = err.message;
+    }
+  }
   process.stdout.write(JSON.stringify(result) + "\n");
   return result.ok ? 0 : fail;
 }

package/pipeline/scripts/task-mirror.mjs

@@ -21,12 +21,21 @@
  *     is left alone.
  * The task goes under the phase in progress when it was created.
  *
- * Exits 0 on every path and prints nothing: a mirror, not a gate. A failure is
- * written to the hook failure log.
+ * Phase tiles: a TaskCreate of "Phase N ..." records its id as the phase's
+ * `tasklist_id` (what :resume rebuilds the widget from), replacing the id a
+ * previous session left. The widget renders tiles in creation order, so a
+ * tile created after a higher-numbered one in the same session shows out of
+ * order (tracker-contract.md, "TaskCreate ordering"); the hook says so to the
+ * model as additionalContext. Which tiles this session created is kept in
+ * `tile-session.json` beside the tracker and starts over with a new session,
+ * so tiles a resume recreates are not compared with the old session's.
+ *
+ * Exits 0 on every path, blocks nothing, and prints only that ordering note. A
+ * failure is written to the hook failure log.
  */
 
 import { spawnSync } from "node:child_process";
-import { readFileSync } from "node:fs";
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -37,6 +46,7 @@ const HOOK = "task-mirror";
 const SESSION_BOUND = new Set(["session", "host-session"]);
 const STATUSES = new Set(["pending", "in_progress", "completed"]);
 const TILE = /^Phase \d+\b/;
+const TILE_NO = /^Phase (\d+)\b/;
 const MAX_INPUT = 256 * 1024;
 const HERE = dirname(fileURLToPath(import.meta.url));
 
@@ -102,6 +112,43 @@ export function mirrorArgs(payload, tracker) {
   return null;
 }
 
+/**
+ * For a phase tile's TaskCreate: the phase it is, the id it got, and the
+ * higher-numbered phases whose tiles already exist. Null for anything else.
+ */
+export function tileOf(payload, tracker) {
+  if (payload?.tool_name !== "TaskCreate") return null;
+  const m = TILE_NO.exec(String(payload.tool_input?.subject ?? "").trim());
+  if (!m) return null;
+  const n = Number(m[1]);
+  const phases = Array.isArray(tracker?.phases) ? tracker.phases : [];
+  const phase = phases.find((p) => Number(p.id) === n) ?? null;
+  return {
+    phase,
+    id: createdId(payload.tool_response),
+    recorded: phase ? String(phase.meta?.tasklist_id ?? "") : "",
+  };
+}
+
+/**
+ * This session's tile record after creating phase `n`, and the phases whose
+ * tiles this session created before it with a higher number.
+ */
+export function sessionTiles(previous, sessionId, n) {
+  if (!sessionId) return { record: previous, after: [] };
+  const same =
+    previous &&
+    previous.session === sessionId &&
+    previous.tiles &&
+    typeof previous.tiles === "object";
+  const tiles = same ? { ...previous.tiles } : {};
+  const after = Object.keys(tiles)
+    .filter((p) => Number(p) > n)
+    .sort((a, b) => Number(a) - Number(b));
+  tiles[String(n)] = true;
+  return { record: { session: sessionId, tiles }, after };
+}
+
 export function mirror(payload, env = process.env) {
   if (!payload || !["TaskCreate", "TaskUpdate"].includes(payload.tool_name)) return null;
   const run = findActiveRun({
@@ -119,26 +166,70 @@ export function mirror(payload, env = process.env) {
   } catch {
     return null;
   }
+  const tracked = (args) => {
+    const r = spawnSync("bash", [join(HERE, "phase-tracker.sh"), ...args], {
+      env: {
+        ...env,
+        MULTI_AGENT_TASK_ID: run.state.taskId,
+        TRACKER_FILE: trackerPath,
+        TRACKER_QUIET: "1",
+      },
+      encoding: "utf8",
+      timeout: 8000,
+    });
+    if (r.status !== 0) logHookFailure(HOOK, `phase-tracker ${args[0]} exited ${r.status}`, env);
+  };
+  const tile = tileOf(payload, tracker);
+  if (tile) {
+    if (!tile.phase) return null;
+    if (tile.id && tile.recorded !== tile.id)
+      tracked(["meta", String(tile.phase.id), "tasklist_id", tile.id]);
+    const sidecar = join(runDirOf(run.statePath), "tile-session.json");
+    let previous;
+    try {
+      previous = JSON.parse(readFileSync(sidecar, "utf8"));
+    } catch {
+      previous = null;
+    }
+    const { record, after } = sessionTiles(
+      previous,
+      String(payload.session_id ?? ""),
+      Number(tile.phase.id),
+    );
+    if (record)
+      try {
+        const tmp = `${sidecar}.${process.pid}.tmp`;
+        writeFileSync(tmp, JSON.stringify(record));
+        renameSync(tmp, sidecar);
+      } catch (e) {
+        logHookFailure(HOOK, `tile record: ${String(e?.message || e).slice(0, 120)}`, env);
+      }
+    return after.length
+      ? {
+          note:
+            `Phase ${tile.phase.id}'s tile was created after the tiles of phase ${after.join(", ")}, ` +
+            "so the task widget shows it out of order. Tiles are created in phase-number order before any " +
+            'TaskUpdate (tracker-contract.md, "TaskCreate ordering").',
+        }
+      : null;
+  }
   const args = mirrorArgs(payload, tracker);
   if (!args) return null;
-  const r = spawnSync("bash", [join(HERE, "phase-tracker.sh"), ...args], {
-    env: {
-      ...env,
-      MULTI_AGENT_TASK_ID: run.state.taskId,
-      TRACKER_FILE: trackerPath,
-      TRACKER_QUIET: "1",
-    },
-    encoding: "utf8",
-    timeout: 8000,
-  });
-  if (r.status !== 0) logHookFailure(HOOK, `phase-tracker task exited ${r.status}`, env);
+  tracked(args);
   return args;
 }
 
 if (invokedDirectly(import.meta.url)) {
   try {
     const raw = readFileSync(0, "utf8").slice(0, MAX_INPUT);
-    mirror(JSON.parse(raw));
+    const out = mirror(JSON.parse(raw));
+    if (out?.note) {
+      process.stdout.write(
+        JSON.stringify({
+          hookSpecificOutput: { hookEventName: "PostToolUse", additionalContext: out.note },
+        }) + "\n",
+      );
+    }
   } catch (e) {
     try {
       logHookFailure(HOOK, String(e?.message || e).slice(0, 200));

package/pipeline/scripts/task-mirror.sh

@@ -6,8 +6,9 @@
 # logic is in task-mirror.mjs; this wrapper exists because every hook the
 # pipeline registers is a `bash "$HOME/.<host>/scripts/<name>"` command.
 #
-# Exits 0 on every path and prints nothing: a missing node or any internal
-# error means no mirror, never a blocked tool call.
+# Exits 0 on every path; its only output is a tile-ordering note for the
+# model. A missing node or any internal error means no mirror, never a blocked
+# tool call.
 
 set -u
 

package/pipeline/scripts/test-stability-gate.mjs

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+/**
+ * @file test-stability-gate.mjs  -  the repeated runs of the new and changed
+ * tests agree, or the result is not GREEN.
+ *
+ * Phase 2's stability rule runs each test added or changed in the diff
+ * `testStability.repeatCount` times and keeps every run as
+ * `.pipeline/repeat-<k>.junit.xml`. This gate reads those files and compares
+ * each test case's outcome across the runs: a case that passed in some runs
+ * and failed in others is a flake, however the last run ended.
+ *
+ * A case is keyed by classname and name. Outcomes are pass, fail (a failure
+ * or error element) and skip; a case missing from a run counts as not run.
+ *
+ * Usage:
+ *   test-stability-gate.mjs --dir <dir> --expect <N>
+ *
+ * Output (stdout, JSON): {ok, expected, runs, missingRuns[], cases, flaky[], failedEverywhere[]}
+ *   flaky             [{test, passed, failed, of}]  outcomes disagree across runs
+ *   failedEverywhere  tests that failed in every run (stable, but not GREEN)
+ *
+ * Exit: 0 every case passed in every run; 1 a flake, a run missing, a test
+ * that failed, or no test cases at all; 64 usage.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { invokedDirectly } from "../lib/invoked-directly.mjs";
+
+const attr = (tag, name) => {
+  const m = new RegExp(`\\b${name}="([^"]*)"`).exec(tag);
+  return m ? m[1] : "";
+};
+
+/** Test case key -> outcome for one JUnit XML document. */
+export function outcomes(xml) {
+  const out = new Map();
+  for (const m of String(xml).matchAll(/<testcase\b([^>]*?)(?:\/>|>([\s\S]*?)<\/testcase>)/g)) {
+    const key = `${attr(m[1], "classname")}::${attr(m[1], "name")}`;
+    const body = m[2] ?? "";
+    const outcome = /<(?:failure|error)\b/.test(body)
+      ? "fail"
+      : /<skipped\b/.test(body)
+        ? "skip"
+        : "pass";
+    const prev = out.get(key);
+    out.set(key, prev === "fail" || outcome === "fail" ? "fail" : outcome);
+  }
+  return out;
+}
+
+/** Compare the per-run outcome maps. */
+export function compare(runs) {
+  const keys = new Set();
+  for (const r of runs) for (const k of r.keys()) keys.add(k);
+  const flaky = [];
+  const failedEverywhere = [];
+  for (const k of [...keys].sort()) {
+    const seen = runs.map((r) => r.get(k) ?? "missing");
+    const passed = seen.filter((o) => o === "pass").length;
+    const failed = seen.filter((o) => o === "fail" || o === "missing").length;
+    if (seen.every((o) => o === "skip")) continue;
+    if (passed && failed) flaky.push({ test: k, passed, failed, of: runs.length });
+    else if (!passed && failed) failedEverywhere.push(k);
+  }
+  return { cases: keys.size, flaky, failedEverywhere };
+}
+
+export function evaluate(dir, expected) {
+  const runs = [];
+  const missingRuns = [];
+  for (let k = 1; k <= expected; k++) {
+    const p = join(dir, `repeat-${k}.junit.xml`);
+    if (!existsSync(p)) {
+      missingRuns.push(k);
+      continue;
+    }
+    runs.push(outcomes(readFileSync(p, "utf8")));
+  }
+  const c = compare(runs);
+  return {
+    ok:
+      missingRuns.length === 0 &&
+      c.cases > 0 &&
+      c.flaky.length === 0 &&
+      c.failedEverywhere.length === 0,
+    expected,
+    runs: runs.length,
+    missingRuns,
+    ...c,
+  };
+}
+
+function main() {
+  const argv = process.argv.slice(2);
+  const get = (f) => {
+    const i = argv.indexOf(f);
+    return i >= 0 ? argv[i + 1] : undefined;
+  };
+  const dir = get("--dir");
+  const expected = Number(get("--expect"));
+  if (argv.length !== 4 || !dir || !Number.isInteger(expected) || expected < 1 || expected > 50) {
+    console.error("usage: test-stability-gate.mjs --dir <dir> --expect <N>");
+    return 64;
+  }
+  const out = evaluate(dir, expected);
+  process.stdout.write(JSON.stringify(out) + "\n");
+  return out.ok ? 0 : 1;
+}
+
+if (invokedDirectly(import.meta.url)) process.exit(main());