@nodii/dev 0.6.35 → 0.6.37

package/dist/runs.js

@@ -1,4 +1,6 @@
 import { spawn as nodeSpawn } from "node:child_process";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
 import { basename } from "node:path";
 import { CliError, devRequest, encode } from "./core.js";
 
@@ -36,7 +38,7 @@ function writeSafe(write, value) {
   }
 }
 
-function currentRunId(runId = process.env[RUN_ID_ENV]) {
+export function currentRunId(runId = process.env[RUN_ID_ENV]) {
   if (runId === undefined || runId === "") return null;
   if (!UUID.test(runId))
     throw new CliError(
@@ -113,7 +115,7 @@ function commandLabel(command) {
   return basename(command[0] ?? "command").slice(0, 240) || "command";
 }
 
-function runKind(value) {
+export function runKind(value) {
   const kind = value ?? "build";
   if (!RUN_KINDS.has(kind))
     throw new CliError(
@@ -138,7 +140,7 @@ function runEvidence(command, exitCode, signal, tail) {
   return evidence;
 }
 
-async function endRun(request, runId, body, attempts = 3) {
+export async function endRun(request, runId, body, attempts = 3) {
   let error;
   for (let attempt = 0; attempt < attempts; attempt++) {
     try {
@@ -152,6 +154,25 @@ async function endRun(request, runId, body, attempts = 3) {
   throw error;
 }
 
+// The Result artifact contract (AGENT-HARNESS-41): a run that succeeds can
+// attach one text artifact (e.g. a benchmark table as JSON). It rides in the
+// Result as an `artifact` evidence item, delivered whole to the waiter: the
+// note is the content, the ref names it with its size and sha256. Dev holds at
+// most 10,000 characters in a note, so a larger artifact fails the run rather
+// than arriving cut.
+export const ARTIFACT_MAX_CHARS = 10_000;
+
+export function artifactEvidence(name, content) {
+  const text = redactRunText(content);
+  if (!text.trim()) throw new CliError("ARTIFACT_EMPTY", `Artifact ${basename(name)} is empty.`, 1);
+  if (text.length > ARTIFACT_MAX_CHARS)
+    throw new CliError("ARTIFACT_TOO_LARGE", `Artifact ${basename(name)} is ${text.length} characters; a Result carries at most ${ARTIFACT_MAX_CHARS}.`, 1);
+  const sha256 = createHash("sha256").update(text).digest("hex");
+  return { kind: "artifact", ref: `${basename(name)} · ${Buffer.byteLength(text)} bytes · sha256:${sha256}`, note: text };
+}
+
+const artifactFailure = (error) => `Artifact not attached: ${redactRunText(error?.code === "ENOENT" ? "the file does not exist" : error?.message ?? error)}`;
+
 export async function superviseRun({
   command,
   waiterRunId = process.env[RUN_ID_ENV],
@@ -160,6 +181,8 @@ export async function superviseRun({
   expectedHeartbeatSeconds = 60,
   heartbeatIntervalMs = DEFAULT_HEARTBEAT_MS,
   tailBytes = DEFAULT_TAIL_BYTES,
+  artifact,
+  readArtifact = (path) => readFile(path, "utf8"),
   request = devRequest,
   spawn = nodeSpawn,
   stdoutWrite = (value) => process.stdout.write(value),
@@ -268,12 +291,21 @@ export async function superviseRun({
       outcome.signal,
       tail,
     );
-    const succeeded = outcome.exitCode === 0 && !outcome.signal && !spawnError;
-    const reason = spawnError
+    let succeeded = outcome.exitCode === 0 && !outcome.signal && !spawnError;
+    let artifactError = null;
+    if (succeeded && artifact) {
+      try {
+        evidence.push(artifactEvidence(artifact, await readArtifact(artifact)));
+      } catch (error) {
+        succeeded = false;
+        artifactError = artifactFailure(error);
+      }
+    }
+    const reason = artifactError ?? (spawnError
       ? `Command could not start: ${redactRunText(spawnError.code ?? spawnError.message)}`
       : outcome.signal
         ? `Command ended by signal ${outcome.signal}`
-        : `Command exited with code ${outcome.exitCode ?? -1}`;
+        : `Command exited with code ${outcome.exitCode ?? -1}`);
     await endRun(
       request,
       runId,
@@ -283,7 +315,7 @@ export async function superviseRun({
     );
     return {
       runId,
-      exitCode: succeeded ? 0 : (outcome.exitCode ?? 1),
+      exitCode: succeeded ? 0 : (outcome.exitCode || 1),
       signal: outcome.signal,
       tail: redactRunText(tail.toString("utf8")),
     };
@@ -302,6 +334,7 @@ export async function launchRunSupervisor(
     env = process.env,
     kind,
     name,
+    artifact,
   } = {},
 ) {
   if (!entrypoint)
@@ -309,6 +342,7 @@ export async function launchRunSupervisor(
   const args = [entrypoint, "__run-supervisor"];
   if (kind) args.push("--kind", kind);
   if (name) args.push("--name", name);
+  if (artifact) args.push("--artifact", artifact);
   args.push("--", ...command);
   const supervisor = spawn(process.execPath, args, {
     detached: true,

package/dist/safety.js

@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import { appendFile, mkdir, readFile, realpath, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { promisify } from "node:util";
 import { CliError, configPath, devRequest, encode, readConfig } from "./core.js";
@@ -109,7 +110,103 @@ function createsBranch(after) {
   return after.some((item) => ["-b", "-B", "-c", "-C", "--orphan", "--create", "--force-create"].includes(item));
 }
 
-const usesNoVerify = (command) => gitInvocations(words(command)).some((x) => x.args.includes("--no-verify"));
+// A hook bypass by another name is still --no-verify: lefthook's and husky's
+// off switches, and pointing Git's hooks somewhere else.
+const HOOK_BYPASS = /(?:^|[\s;&|(])(?:export\s+|env\s+)?(?:LEFTHOOK\s*=\s*["']?(?:0|false|off)\b|HUSKY\s*=\s*["']?0\b)|\bcore\.hooks[Pp]ath\b/;
+const usesNoVerify = (command) => gitInvocations(words(command)).some((x) => x.args.includes("--no-verify")) || HOOK_BYPASS.test(command);
+
+// Operator, 29 Oct: a pattern kill on macOS once killed every agent on the
+// machine. Only a PID the caller started (and saved) may be killed.
+const AT_COMMAND = String.raw`(?:^|[;&|(\x60{\n]|\$\()\s*(?:(?:sudo|exec|nohup|time|command)(?:\s+-\S+)*\s+)*`;
+const PATTERN_KILLS = [
+  new RegExp(`${AT_COMMAND}(?:\\S*/)?(?:pkill|killall)\\b`),
+  /(?:^|[;&|(\s])kill\b[^;&|\n]*(?:\$\(|`)\s*(?:\S*\/)?(?:pgrep|pidof|ps|lsof|jobs)\b/,
+  /\b(?:pgrep|pidof|ps|lsof)\b[^;&\n]*\|(?:[^;&\n]*\|)?\s*xargs\b[^;&|\n]*\bkill\b/,
+  /(?:^|[;&|(\s])kill\s+(?:-(?:\d+|[A-Z]+|s\s+\S+)\s+)*(?:--\s+)?-1\b/,
+];
+
+/** Blocks that hold for every caller, in a lane or not, and before any lane discovery. */
+export function machineViolations(command) {
+  if (PATTERN_KILLS.some((pattern) => pattern.test(command)))
+    return [{ code: "SAFETY_PATTERN_KILL", message: "Pattern kills (pkill, killall, kill $(pgrep ...), ps | xargs kill, kill -1) can kill every agent on this machine. Kill only a PID you started and saved to a .pid file." }];
+  return [];
+}
+
+function forcePush(invocation) {
+  if (invocation.verb !== "push") return false;
+  return invocation.args.some((arg) => ["-f", "--force", "--force-if-includes", "--mirror"].includes(arg) || arg.startsWith("--force-with-lease") || /^-[a-zA-Z]*f[a-zA-Z]*$/.test(arg) || /^\+[^\s]/.test(arg));
+}
+
+// Writes a lane may make outside its worktree: temporary and scratch space.
+const WRITABLE_ELSEWHERE = () => [tmpdir(), "/tmp", "/private/tmp", "/var/folders", "/private/var/folders", "/dev/null", "/dev/stdout", "/dev/stderr", "/dev/fd", "/dev/tty"];
+const WRITE_COMMANDS = new Map([["cp", "last"], ["mv", "last"], ["ln", "last"], ["install", "last"], ["rsync", "last"], ["rm", "all"], ["rmdir", "all"], ["touch", "all"], ["mkdir", "all"], ["truncate", "all"], ["chmod", "rest"], ["chown", "rest"], ["tee", "all"]]);
+const READ_ONLY_GIT = new Set(["status", "diff", "log", "show", "rev-parse", "rev-list", "branch", "ls-files", "ls-tree", "cat-file", "describe", "blame", "grep", "merge-base", "config", "remote", "fetch", "worktree", "for-each-ref", "symbolic-ref", "shortlog", "reflog", "name-rev", "check-ignore", "var", "help", "version"]);
+
+/** Shell words with their quoting kept, split on control operators, for write detection. */
+function segments(command) {
+  const out = [[]];
+  const re = /"((?:[^"\\]|\\.)*)"|'([^']*)'|(&&|\|\||[;|\n])|([^\s"';|&]+(?:&(?![&])[^\s"';|&]*)*)|(&)/g;
+  for (const match of command.matchAll(re)) {
+    if (match[3] || match[5]) out.push([]);
+    else out.at(-1).push({ text: match[1] ?? match[2] ?? match[4], quoted: match[4] === undefined });
+  }
+  return out.filter((x) => x.length);
+}
+
+function writeTargets(command) {
+  const targets = [];
+  for (const segment of segments(command)) {
+    for (let i = 0; i < segment.length; i += 1) {
+      const { text, quoted } = segment[i];
+      if (quoted) continue;
+      const redirect = /^(?:\d*|&)>{1,2}\|?(.*)$/.exec(text);
+      if (redirect) {
+        const target = redirect[1] || segment[i + 1]?.text;
+        if (target && !target.startsWith("&")) targets.push(target);
+      }
+    }
+    const words = segment.filter((x, i) => !(i === 0 && /^[A-Z_][A-Z0-9_]*=/.test(x.text)));
+    const at = words.findIndex((x) => !["sudo", "command", "exec", "nohup"].includes(x.text));
+    const name = basename(words[at]?.text ?? "");
+    const mode = WRITE_COMMANDS.get(name);
+    if (!mode) continue;
+    const args = words.slice(at + 1).map((x) => x.text).filter((x) => !x.startsWith("-") && !/^\d*>/.test(x));
+    if (mode === "last") targets.push(...args.slice(-1));
+    else if (mode === "rest") targets.push(...args.slice(1));
+    else targets.push(...args);
+  }
+  return targets;
+}
+
+function outsideWorktree(target, context, relativeKnown) {
+  let path = target;
+  if (path === "~" || path.startsWith("~/")) path = join(homedir(), path.slice(1));
+  else if (/^\$\{?HOME\}?(?:\/|$)/.test(path)) path = join(homedir(), path.replace(/^\$\{?HOME\}?/, ""));
+  if (path.includes("$") || path.includes("`")) return false;
+  if (!isAbsolute(path)) {
+    if (!relativeKnown) return false;
+    path = resolve(context.cwd, path);
+  }
+  const inside = (root) => { const rel = relative(root, path); return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel)); };
+  return !inside(context.root) && !WRITABLE_ELSEWHERE().some(inside);
+}
+
+function gitOutsideWorktree(tokens, context) {
+  for (let at = 0; at < tokens.length; at += 1) {
+    if (tokens[at] !== "git" && !tokens[at].endsWith("/git")) continue;
+    let cursor = at + 1;
+    let target = null;
+    while (cursor < tokens.length && tokens[cursor].startsWith("-")) {
+      const option = tokens[cursor];
+      if (["-C", "--git-dir", "--work-tree"].includes(option)) target = tokens[cursor + 1] ?? null;
+      else if (/^--(?:git-dir|work-tree)=/.test(option)) target = option.slice(option.indexOf("=") + 1);
+      cursor += ["-C", "-c", "--git-dir", "--work-tree", "--namespace", "--exec-path"].includes(option) ? 2 : 1;
+    }
+    const verb = tokens[cursor];
+    if (target && verb && !READ_ONLY_GIT.has(verb) && outsideWorktree(target, context, true)) return { target, verb };
+  }
+  return null;
+}
 
 function deployCommand(tokens, command) {
   if (commandHas(tokens, "tofu", "apply")) return true;
@@ -189,6 +286,16 @@ export function commandViolations(command, context) {
   }
   if (gitCommands.some((x) => x.verb === "worktree" && x.args[0] === "remove" && x.args.some((arg) => arg === "-f" || arg === "--force")))
     block("SAFETY_WORKTREE_FORCE", "git worktree remove --force is forbidden; the coordinator removes a proven-safe worktree without --force.");
+  if (gitCommands.some(forcePush))
+    block("SAFETY_FORCE_PUSH", "A force push rewrites history others may hold; a lane pushes fast-forward only. Ask the coordinator.");
+  if (context.root) {
+    const other = gitOutsideWorktree(tokens, context);
+    if (other) block("SAFETY_OTHER_WORKTREE", `git ${other.verb} in ${other.target} touches a checkout outside this lane's worktree ${context.root}.`);
+    const relativeKnown = !/(?:^|[;&|(\s])(?:cd|pushd)\s/.test(command);
+    const outside = writeTargets(command).filter((target) => outsideWorktree(target, context, relativeKnown));
+    if (outside.length)
+      block("SAFETY_WRITE_OUTSIDE_WORKTREE", `Write blocked outside the lane worktree ${context.root}: ${[...new Set(outside)].join(", ")}. Use the worktree or a temp/scratch directory.`);
+  }
 
   if (usesNoVerify(command)) {
     if (lane) block("SAFETY_NO_VERIFY", "--no-verify is forbidden in a lane or subagent.");
@@ -387,6 +494,10 @@ function blocked(violation) {
 export async function safetyPreHook(payload, contextOrResolver = safetyContext) {
   const tool = payload.tool_name ?? "";
   if (!SHELL_TOOLS.has(tool) && !EDIT_TOOLS.has(tool)) return { allowed: true, ignored: true };
+  if (SHELL_TOOLS.has(tool)) {
+    const machine = machineViolations(String(payload.tool_input?.command ?? ""))[0];
+    if (machine) blocked(machine);
+  }
   const cwd = payload.cwd ?? process.cwd();
   const context = typeof contextOrResolver === "function" ? await contextOrResolver(cwd) : contextOrResolver;
   context.cwd = await realpath(cwd).catch(() => resolve(cwd));

package/dist/starting.js

@@ -5,7 +5,7 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { promisify } from "node:util";
 import { CliError, configPath, devRequest, encode, query, readConfig, requireFlag } from "./core.js";
 import { assertKnownSets, checkComponentSetKey, checkFileKey, loadDsCatalog, mergeScopes, scopesFromRoutes } from "./figma-scope.js";
-import { GATHER_TIMEOUT_MS } from "./gather.js";
+import { GATHER_TIMEOUT_MS, gatherDeadline } from "./gather.js";
 import { laneCommand, nextCommand } from "./lanes.js";
 
 const execFile = promisify(execFileCallback);
@@ -346,6 +346,19 @@ export async function launchLaneCommand(key, flags, {
   } catch (error) {
     throw new CliError(error?.code ?? "LANE_REGISTER_FAILED", `${error?.message ?? error}. Worktrees were created and were not removed; reconcile them before retrying.`, 1);
   }
+  // An agent is dispatched only onto a lane whose start Dev recorded: building,
+  // with its first steps current (LANE-RECORD-GAP-APPLY-VERDICTS-1).
+  const status = payload.data?.lane?.status;
+  if (status !== "building") {
+    const reason = `Dev registered lane ${key} as ${status ?? "unknown"}, not started (no lane start recorded)`;
+    let reported = "Dev recorded it for lane resume";
+    try {
+      await request("POST", `/api/v1/lanes/${encode(payload.data.lane.id)}/resume/${encode(payload.data.run.id)}/launch-failed`, { reason, ...via });
+    } catch (reportError) {
+      reported = `Dev could not record the launch failure (${reportError.message})`;
+    }
+    throw new CliError("LANE_NOT_STARTED", `${reason}, so its agent was not dispatched; ${reported}. Worktrees were created and were not removed.`, 1);
+  }
   await markers(repositories, { laneKey: key, laneId: payload.data.lane.id, runId: payload.data.run.id });
   try {
     await launcher({
@@ -415,31 +428,31 @@ export async function amendmentGuard(argv, { request = devRequest, marker = curr
 // Gather's human output is a renderer of its payload; Delta gather prints the
 // Clause map too, never only "Gather complete.".
 
-const runGather = (key, flags, { request, signal }) => laneCommand("gather", [key], flags, { request, gatherSignal: signal });
+const runGather = (key, flags, { request, deadline }) => laneCommand("gather", [key], flags, { request, deadline });
 
 // Gather's human text is its Clause map (a function of the payload).
 const gatheredText = (gathered) => typeof gathered.human === "function" ? gathered.human(gathered.payload) : gathered.human ?? "Gather complete.";
 
 export async function gatherLaneCommand(key, flags, { request = devRequest, marker = currentMarker, gather = runGather, acknowledge = nextCommand, gatherTimeoutMs = GATHER_TIMEOUT_MS } = {}) {
-  const controller = new AbortController();
-  const deadline = setTimeout(() => controller.abort(), gatherTimeoutMs);
-  const signal = controller.signal;
+  // The lane's local pick holds this deadline while it runs on its own budget.
+  const deadline = gatherDeadline(gatherTimeoutMs);
+  const signal = deadline.signal;
   const timedRequest = (method, path, body, options = {}) => withSignal(request(method, path, body, { ...options, signal }), signal);
   try {
     const lane = await withSignal(marker(), signal);
     key ??= lane?.laneKey;
     if (!key) throw new CliError("USAGE", "lane gather needs <key> outside a launched lane worktree.", 2);
-    if (!flags.delta) return await withSignal(gather(key, flags, { request: timedRequest, signal }), signal);
+    if (!flags.delta) return await withSignal(gather(key, flags, { request: timedRequest, deadline }), signal);
     if (lane && lane.laneKey !== key) throw new CliError("LANE_RUN_REQUIRED", "Delta gather for another lane cannot run inside this lane's registered worktree.", 1);
-    if (!lane) return await withSignal(gather(key, flags, { request: timedRequest, signal }), signal);
+    if (!lane) return await withSignal(gather(key, flags, { request: timedRequest, deadline }), signal);
     const pending = await timedRequest("GET", `/api/v1/lanes/${encode(key)}/amendments${query({ runId: lane.runId })}`);
     if (!pending.data.length) {
-      const gathered = await withSignal(gather(key, flags, { request: timedRequest, signal }), signal);
+      const gathered = await withSignal(gather(key, flags, { request: timedRequest, deadline }), signal);
       if (gathered.payload?.data?.recorded === false) return gathered;
       return { ...gathered, human: `${gatheredText(gathered)}\nNo pending amendments.` };
     }
     const version = Math.max(...pending.data.map((item) => item.version));
-    const gathered = await withSignal(gather(key, flags, { request: timedRequest, signal }), signal);
+    const gathered = await withSignal(gather(key, flags, { request: timedRequest, deadline }), signal);
     // An agent picker's shortlist step records nothing, so it acknowledges nothing.
     if (gathered.payload?.data?.recorded === false) return gathered;
     const acknowledgement = await withSignal(acknowledge(key, {
@@ -454,9 +467,9 @@ export async function gatherLaneCommand(key, flags, { request = devRequest, mark
       human: `${pending.data.map((item) => `v${item.version} ${item.reason}: ${JSON.stringify(item.change)}`).join("\n")}\n${gatheredText(gathered)}\nAcknowledged amendment version ${version}.`,
     };
   } catch (error) {
-    if (signal.aborted) throw new CliError("GATHER_TIMEOUT", `Gather exceeded its ${Math.round(gatherTimeoutMs / 1000)}-second deadline; nothing was retried.`, 1);
+    if (signal.aborted) throw new CliError("GATHER_TIMEOUT", `Gather's Dev requests exceeded their ${Math.round(gatherTimeoutMs / 1000)}-second deadline (the local pick runs on its own budget); nothing was retried.`, 1);
     throw error;
   } finally {
-    clearTimeout(deadline);
+    deadline.clear();
   }
 }

package/dist/stdout.js

@@ -0,0 +1,26 @@
+import { format } from "node:util";
+
+// Dev issue 37: on Bun, once any module imports from `node:process`,
+// console.log to a pipe stops at 65,536 bytes and the rest is lost at exit, so
+// a large `--json` reached `jq` cut off. process.stdout.write delivers it all.
+// The executable routes console.log through it and waits for the stream to
+// drain before it returns. A reader that closes early (`| head -c`) is not an
+// error.
+let installed = false;
+
+export function routeStdout(stream = process.stdout) {
+  if (installed) return;
+  installed = true;
+  stream.on("error", (error) => {
+    if (error?.code !== "EPIPE") throw error;
+    stream.destroy();
+  });
+  console.log = (...values) => {
+    if (!stream.destroyed) stream.write(`${format(...values)}\n`);
+  };
+}
+
+export function drainStdout(stream = process.stdout) {
+  if (stream.destroyed || !stream.writable) return Promise.resolve();
+  return new Promise((resolve) => stream.write("", () => resolve()));
+}

package/dist/upload.js

@@ -169,9 +169,12 @@ const uploadBody = (docs, cls, flags, decision) => ({
     ...(flags["meaning-unchanged"] && cls === "editorial" ? { meaningUnchangedReason: String(flags["meaning-unchanged"]) } : {}),
   })),
   ...(decision ? { decision } : {}),
-  ...(flags.pending ? { pending: true } : {}),
 });
 
+// Dev locks a ruling's decision as its change lands (DEV-DEC-AS-COMMIT-1,
+// hub #406); there is no pending decision to draft any more.
+export const PENDING_NO_OP = "--pending does nothing now: decisions lock on upload.";
+
 export async function docsCommand(action, args, flags, { request = devRequest, log = console.error, cwd = process.cwd(), waitInterval } = {}) {
   const json = Boolean(flags.json);
   if (action === "check") {
@@ -193,6 +196,7 @@ export async function docsCommand(action, args, flags, { request = devRequest, l
       throw new CliError("USAGE", "--pending is valid only with docs upload.", 2);
     if (flags.pending && cls !== "ruling")
       throw new CliError("USAGE", "--pending requires --class ruling and --decision FILE.", 2);
+    if (flags.pending) log(PENDING_NO_OP);
     const decision = await readJsonFile(flags.decision, "decision");
     if (cls === "ruling" && !decision) throw new CliError("RULING_NEEDS_DECISION", "A ruling write needs its decision: --decision DECISION.json (title, context, options, ruling, consequences, provenance, amends).", 2);
     if (cls !== "ruling" && decision) throw new CliError("DECISION_NEEDS_RULING", "--decision goes with --class ruling only.", 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/dev",
-  "version": "0.6.35",
+  "version": "0.6.37",
   "description": "Agent CLI for Nodii Dev, reached through the platform edge",
   "type": "module",
   "bin": {