@oisincoveney/pipeline 1.3.0 → 1.4.0

package/dist/index.js

@@ -27948,8 +27948,14 @@ var filesystemSchema = exports_external.object({
 var networkSchema = exports_external.object({
   mode: exports_external.enum(NETWORK_MODES)
 }).strict();
+var outputRepairSchema = exports_external.object({
+  enabled: exports_external.boolean().optional(),
+  max_attempts: exports_external.number().int().positive().optional(),
+  runner: exports_external.string().optional()
+}).strict();
 var outputSchema = exports_external.object({
   format: exports_external.enum(OUTPUT_FORMATS),
+  repair: outputRepairSchema.optional(),
   schema_path: exports_external.string().min(1).optional()
 }).strict();
 var artifactSchema = exports_external.object({
@@ -28184,6 +28190,16 @@ function validateProfile(profileId, profile, runner, config2, issues, projectRoo
       message: `profile '${profileId}' must declare output.schema_path for json_schema output`
     });
   }
+  const repairRunnerId = profile.output?.repair?.runner;
+  if (repairRunnerId && !config2.runners[repairRunnerId]) {
+    issues.push({
+      path: `profiles.${profileId}.output.repair.runner`,
+      message: `profile '${profileId}' references missing repair runner '${repairRunnerId}'`
+    });
+  }
+  if (repairRunnerId && config2.runners[repairRunnerId]) {
+    validateListCapability(`profiles.${profileId}.output.repair.runner`, ["text"], config2.runners[repairRunnerId].capabilities.output_formats, "repair output format", issues);
+  }
   validatePath(`profiles.${profileId}.output.schema_path`, profile.output?.schema_path, projectRoot, issues);
 }
 function validateActor(label, path, actor, runner, config2, issues, projectRoot) {
@@ -35809,17 +35825,17 @@ function harnessArgv(harness, prompt, worktreePath, contextFile, options2 = {})
       return [
         "exec",
         "--json",
+        "-C",
+        worktreePath,
         ...optionalModelArgs(harness, options2.runner, options2.actor),
         ...mcpArgs,
         ...skillArgs,
         "--sandbox",
-        "workspace-write",
+        codexSandboxFor(options2.actor),
         "--config",
         'approval_policy="never"',
         "--skip-git-repo-check",
-        prompt,
-        "-C",
-        worktreePath
+        prompt
       ];
     case "opencode":
       return contextFile ? [
@@ -35864,6 +35880,9 @@ function harnessArgv(harness, prompt, worktreePath, contextFile, options2 = {})
     }
   }
 }
+function codexSandboxFor(actor) {
+  return actor?.filesystem?.mode === "read-only" ? "read-only" : "workspace-write";
+}
 function createRunnerLaunchPlan(config2, input) {
   const profile = input.profileId ? config2.profiles[input.profileId] : undefined;
   if (input.profileId && !profile) {
@@ -36267,6 +36286,9 @@ profiles:
     output:
       format: json_schema
       schema_path: .pipeline/schemas/research.schema.json
+      repair:
+        enabled: true
+        max_attempts: 1
   pipeline-inspector:
     runner: codex
     description: Inspect the repository without modifying files.
@@ -36327,6 +36349,9 @@ profiles:
     output:
       format: json_schema
       schema_path: .pipeline/schemas/verify.schema.json
+      repair:
+        enabled: true
+        max_attempts: 1
   pipeline-learner:
     runner: codex
     description: Store durable lessons from the completed run.
@@ -36342,6 +36367,9 @@ profiles:
     output:
       format: json_schema
       schema_path: .pipeline/schemas/learn.schema.json
+      repair:
+        enabled: true
+        max_attempts: 1
 `;
 var RESEARCH_SCHEMA = JSON.stringify({
   additionalProperties: false,
@@ -36404,8 +36432,11 @@ var SCAFFOLD_FILES = {
 `),
   ".pipeline/prompts/inspector.md": [
     "You are the read-only inspection phase for the pipeline.",
-    "Inspect first-party source, tests, docs, and task context.",
-    "Report the repository structure, available checks, important files, and notable risks.",
+    "Use a bounded inspection: run at most 8 discovery commands and read at most 12 small, high-signal files.",
+    "Prefer `pwd`, `rg --files -g '!*node_modules*' -g '!dist/**' -g '!build/**' | head -200`, package/workspace manifests, mise/turbo config, and test config files.",
+    "When reading paths with shell metacharacters such as brackets, quote the whole path.",
+    "Do not recursively inspect route trees or generated output.",
+    "Report the app structure, available checks, important files, and notable risks from the sampled evidence.",
     "Do not modify files.",
     ""
   ].join(`
@@ -36932,17 +36963,29 @@ async function runPipelineFromConfig(options2) {
     plan,
     task: options2.task,
     workflowId,
-    worktreePath
+    worktreePath,
+    ...options2.reporter ? { reporter: options2.reporter } : {}
   };
   const nodes = [];
+  emit(context, {
+    nodeIds: plan.topologicalOrder.map((node) => node.id),
+    type: "workflow.start",
+    workflowId
+  });
   const startHook = await dispatchHooks(context, "workflow.start");
   if (startHook) {
-    return failedRuntimeResult(context, nodes, startHook);
+    const result2 = failedRuntimeResult(context, nodes, startHook);
+    emit(context, {
+      outcome: result2.outcome,
+      type: "workflow.finish",
+      workflowId
+    });
+    return result2;
   }
   for (const batch of plan.parallelBatches) {
     const results = await Promise.all(batch.map((node) => executeNode(node, context)));
     nodes.push(...results);
-    const failed = results.find((result) => result.status === "failed");
+    const failed = results.find((result2) => result2.status === "failed");
     if (failed) {
       const failure = {
         evidence: failed.evidence,
@@ -36952,16 +36995,28 @@ async function runPipelineFromConfig(options2) {
       };
       await dispatchHooks(context, "workflow.failure", failure);
       await dispatchHooks(context, "workflow.complete", failure);
-      return failedRuntimeResult(context, nodes, failure);
+      const result2 = failedRuntimeResult(context, nodes, failure);
+      emit(context, {
+        outcome: result2.outcome,
+        type: "workflow.finish",
+        workflowId
+      });
+      return result2;
     }
   }
   const successHook = await dispatchHooks(context, "workflow.success");
   const completeHook = await dispatchHooks(context, "workflow.complete");
   const hookFailure = successHook ?? completeHook;
   if (hookFailure) {
-    return failedRuntimeResult(context, nodes, hookFailure);
+    const result2 = failedRuntimeResult(context, nodes, hookFailure);
+    emit(context, {
+      outcome: result2.outcome,
+      type: "workflow.finish",
+      workflowId
+    });
+    return result2;
   }
-  return {
+  const result = {
     agentInvocations: context.agentInvocations,
     failureDetails: [],
     gates: context.gates,
@@ -36970,6 +37025,12 @@ async function runPipelineFromConfig(options2) {
     outcome: "PASS",
     plan
   };
+  emit(context, {
+    outcome: result.outcome,
+    type: "workflow.finish",
+    workflowId
+  });
+  return result;
 }
 function failedRuntimeResult(context, nodes, failure) {
   return {
@@ -36990,9 +37051,12 @@ async function executeNode(node, context) {
     output: ""
   };
   for (let attempt = 1;attempt <= maxAttempts; attempt += 1) {
+    emitNodeStart(context, node, attempt);
     const startHook = await dispatchHooks(context, "node.start", undefined, node);
     if (startHook) {
-      return nodeFailure(node.id, attempt, startHook.evidence, last.output);
+      const result2 = nodeFailure(node.id, attempt, startHook.evidence, last.output);
+      emitNodeFinish(context, result2);
+      return result2;
     }
     last = await executeNodeAttempt(node, context);
     context.lastOutputByNode.set(node.id, last.output);
@@ -37001,9 +37065,11 @@ async function executeNode(node, context) {
     if (!failedGate && last.exitCode === 0) {
       const successHook = await dispatchHooks(context, "node.success", undefined, node);
       if (successHook) {
-        return nodeFailure(node.id, attempt, successHook.evidence, last.output);
+        const result3 = nodeFailure(node.id, attempt, successHook.evidence, last.output);
+        emitNodeFinish(context, result3);
+        return result3;
       }
-      return {
+      const result2 = {
         attempts: attempt,
         evidence: last.evidence,
         exitCode: 0,
@@ -37011,8 +37077,10 @@ async function executeNode(node, context) {
         output: last.output,
         status: "passed"
       };
+      emitNodeFinish(context, result2);
+      return result2;
     }
-    const evidence = failedGate?.evidence ?? last.evidence.concat(`node exited with code ${last.exitCode}`);
+    const evidence = failedGate ? [...last.evidence, ...failedGate.evidence] : last.evidence.concat(`node exited with code ${last.exitCode}`);
     if (attempt === maxAttempts) {
       await dispatchHooks(context, "node.error", {
         evidence,
@@ -37020,10 +37088,14 @@ async function executeNode(node, context) {
         nodeId: node.id,
         reason: failedGate?.reason ?? `node exited with code ${last.exitCode}`
       }, node);
-      return nodeFailure(node.id, attempt, evidence, last.output);
+      const result2 = nodeFailure(node.id, attempt, evidence, last.output);
+      emitNodeFinish(context, result2);
+      return result2;
     }
   }
-  return nodeFailure(node.id, maxAttempts, last.evidence, last.output);
+  const result = nodeFailure(node.id, maxAttempts, last.evidence, last.output);
+  emitNodeFinish(context, result);
+  return result;
 }
 function nodeFailure(nodeId, attempts, evidence, output) {
   return {
@@ -37073,17 +37145,167 @@ async function executeAgentNode(node, context) {
   context.agentInvocations.push(plan);
   const result = await context.executor(plan);
   const normalized = normalizeAgentOutput(plan, result.stdout);
+  const finalized = await finalizeAgentOutput({
+    context,
+    node,
+    normalized,
+    result
+  });
   return {
     evidence: [
       `agent boundary node=${node.id} profile=${node.profile} runner=${plan.runnerId} strategy=${plan.strategy}`,
-      ...normalized.evidence,
+      ...finalized.evidence,
       ...result.stderr ? [`stderr: ${result.stderr}`] : [],
       ...result.timedOut ? ["agent timed out"] : []
     ],
     exitCode: result.exitCode,
-    output: normalized.output
+    output: finalized.output
+  };
+}
+async function finalizeAgentOutput(inputs) {
+  const { context, node, normalized, result } = inputs;
+  const repairContext = outputRepairContext(context, node, normalized, result);
+  if (!repairContext) {
+    return normalized;
+  }
+  return await runOutputRepair(context, node, normalized, repairContext);
+}
+function outputRepairContext(context, node, normalized, result) {
+  if (result.exitCode !== 0 || result.timedOut) {
+    return null;
+  }
+  const profile = node.profile ? context.config.profiles[node.profile] : undefined;
+  if (!profile) {
+    return null;
+  }
+  const output = profile?.output;
+  if (output?.format !== "json_schema" || !output.schema_path) {
+    return null;
+  }
+  const firstValidation = validateJsonSchemaSource(normalized.output, output.schema_path, context.worktreePath);
+  if (firstValidation.passed) {
+    return null;
+  }
+  const repair = outputRepairOptions(output);
+  if (!repair.enabled) {
+    return null;
+  }
+  return {
+    evidence: [
+      ...normalized.evidence,
+      "output repair triggered",
+      ...firstValidation.evidence.map((item) => `original output: ${item}`)
+    ],
+    maxAttempts: repair.maxAttempts,
+    runner: repair.runner ?? profile.runner,
+    schemaPath: output.schema_path,
+    validation: firstValidation
+  };
+}
+async function runOutputRepair(context, node, normalized, repairContext) {
+  let latest = normalized;
+  let latestValidation = repairContext.validation;
+  const evidence = [...repairContext.evidence];
+  for (let attempt = 1;attempt <= repairContext.maxAttempts; attempt += 1) {
+    const repairPlan = createOutputRepairPlan({
+      context,
+      node,
+      originalOutput: latest.output,
+      repairRunner: repairContext.runner,
+      schemaPath: repairContext.schemaPath,
+      validation: latestValidation
+    });
+    context.agentInvocations.push(repairPlan);
+    const repairResult = await context.executor(repairPlan);
+    const repaired = normalizeAgentOutput(repairPlan, repairResult.stdout);
+    const repairedValidation = validateJsonSchemaSource(repaired.output, repairContext.schemaPath, context.worktreePath);
+    latest = {
+      evidence: [
+        ...repaired.evidence,
+        ...repairResult.stderr ? [`repair stderr: ${repairResult.stderr}`] : [],
+        ...repairResult.timedOut ? ["output repair timed out"] : []
+      ],
+      output: repaired.output
+    };
+    latestValidation = repairedValidation;
+    const passed = repairResult.exitCode === 0 && repairedValidation.passed;
+    evidence.push(...repaired.evidence, passed ? `output repair passed for ${node.id} after attempt ${attempt}` : `output repair failed for ${node.id} after attempt ${attempt}`, ...repairedValidation.evidence.map((item) => `repaired output: ${item}`));
+    emit(context, {
+      attempt,
+      nodeId: node.id,
+      passed,
+      type: "output.repair",
+      ...passed ? {} : { reason: repairedValidation.reason ?? "repair failed" }
+    });
+    if (passed) {
+      return {
+        evidence,
+        output: repaired.output
+      };
+    }
+  }
+  return {
+    evidence,
+    output: latest.output
+  };
+}
+function outputRepairOptions(output) {
+  const repair = output.repair;
+  return {
+    enabled: repair?.enabled ?? true,
+    maxAttempts: repair?.max_attempts ?? 1,
+    ...repair?.runner ? { runner: repair.runner } : {}
   };
 }
+function createOutputRepairPlan(inputs) {
+  const {
+    context,
+    node,
+    originalOutput,
+    repairRunner,
+    schemaPath,
+    validation
+  } = inputs;
+  const schema = readFileSync7(join6(context.worktreePath, schemaPath), "utf8");
+  const repairProfileId = `${node.id}:output-repair`;
+  const repairConfig = {
+    ...context.config,
+    profiles: {
+      ...context.config.profiles,
+      [repairProfileId]: {
+        filesystem: { mode: "read-only" },
+        instructions: { inline: "Repair invalid structured output." },
+        network: { mode: "disabled" },
+        output: { format: "text" },
+        runner: repairRunner,
+        tools: []
+      }
+    }
+  };
+  const prompt = [
+    "You are an output finalizer for a pipeline agent.",
+    "Return only valid JSON matching the expected schema.",
+    "Do not use Markdown fences or add prose outside the JSON value.",
+    "Preserve facts from the original output. If required information is missing, use empty arrays or nulls only where the schema permits.",
+    "",
+    "Expected schema:",
+    schema,
+    "",
+    "Validation error:",
+    validation.evidence.join(`
+`),
+    "",
+    "Original output:",
+    originalOutput
+  ].join(`
+`);
+  return createRunnerLaunchPlan(repairConfig, {
+    nodeId: repairProfileId,
+    profileId: repairProfileId,
+    prompt,
+    worktreePath: context.worktreePath
+  });
+}
 function normalizeAgentOutput(plan, stdout) {
   if (plan.type === "codex") {
     const text = lastJsonLineValue(stdout, (value) => {
@@ -37301,6 +37523,13 @@ async function evaluateNodeGates(node, context, attempt) {
     const result = await evaluateGate(gate, node.id, context, attempt);
     context.gates.push(result);
     results.push(result);
+    emit(context, {
+      gateId: result.gateId,
+      nodeId: result.nodeId,
+      passed: result.passed,
+      type: "gate.finish",
+      ...result.reason ? { reason: result.reason } : {}
+    });
     if (!result.passed) {
       await dispatchHooks(context, "gate.failure", {
         evidence: result.evidence,
@@ -37315,6 +37544,28 @@ async function evaluateNodeGates(node, context, attempt) {
   }
   return results;
 }
+function emit(context, event) {
+  context.reporter?.(event);
+}
+function emitNodeStart(context, node, attempt) {
+  const profile = node.profile ? context.config.profiles[node.profile] : undefined;
+  emit(context, {
+    attempt,
+    nodeId: node.id,
+    type: "node.start",
+    ...node.profile ? { profile: node.profile } : {},
+    ...profile?.runner ? { runnerId: profile.runner } : {}
+  });
+}
+function emitNodeFinish(context, result) {
+  emit(context, {
+    attempt: result.attempts,
+    exitCode: result.exitCode,
+    nodeId: result.nodeId,
+    status: result.status,
+    type: "node.finish"
+  });
+}
 async function evaluateGate(gate, nodeId, context, attempt) {
   const gateId = gate.id ?? `${gate.kind}:${nodeId}`;
   if (gate.kind === "command") {
@@ -37369,24 +37620,29 @@ function evaluateJsonSchemaGate(gate, gateId, nodeId, context, attempt) {
       reason: `missing JSON artifact '${gate.path ?? ""}'`
     };
   }
+  const result = validateJsonSchemaSource(source, schemaPath, context.worktreePath);
+  return {
+    evidence: result.evidence,
+    gateId,
+    kind: gate.kind,
+    nodeId,
+    passed: result.passed,
+    reason: result.reason
+  };
+}
+function validateJsonSchemaSource(source, schemaPath, worktreePath) {
   try {
-    const schema = JSON.parse(readFileSync7(join6(context.worktreePath, schemaPath), "utf8"));
+    const schema = JSON.parse(readFileSync7(join6(worktreePath, schemaPath), "utf8"));
     const value = JSON.parse(source);
     const errors4 = validateJsonSchema(value, schema);
     return {
       evidence: errors4.length === 0 ? [`JSON schema passed: ${schemaPath}`] : errors4.map((error51) => `schema: ${error51}`),
-      gateId,
-      kind: gate.kind,
-      nodeId,
       passed: errors4.length === 0,
       reason: errors4.length === 0 ? undefined : "JSON schema validation failed"
     };
   } catch (err) {
     return {
       evidence: [err instanceof Error ? err.message : String(err)],
-      gateId,
-      kind: gate.kind,
-      nodeId,
       passed: false,
       reason: "JSON schema validation failed"
     };
@@ -37554,6 +37810,7 @@ function pipe2(description, options2 = {}) {
 async function runConfiguredPipeline(inputs) {
   const runner = inputs.pipelineRunner ?? runPipelineFromConfig;
   const result = await runner({
+    reporter: formatRuntimeProgress,
     task: inputs.task,
     workflowId: inputs.workflow,
     worktreePath: inputs.worktreePath
@@ -37563,13 +37820,52 @@ async function runConfiguredPipeline(inputs) {
     throw new Error(formatRuntimeFailure(result));
   }
 }
+function formatRuntimeProgress(event) {
+  switch (event.type) {
+    case "workflow.start":
+      console.error(`Pipeline starting: ${event.workflowId} (${event.nodeIds.join(" -> ")})`);
+      return;
+    case "node.start":
+      console.error([
+        `Node starting: ${event.nodeId}`,
+        event.runnerId ? `runner=${event.runnerId}` : "",
+        event.profile ? `profile=${event.profile}` : "",
+        `attempt=${event.attempt}`
+      ].filter(Boolean).join(" "));
+      return;
+    case "gate.finish":
+      console.error(`Gate ${event.passed ? "passed" : "failed"}: ${event.nodeId}/${event.gateId}${event.reason ? ` (${event.reason})` : ""}`);
+      return;
+    case "output.repair":
+      console.error(`Output repair ${event.passed ? "passed" : "failed"}: ${event.nodeId} attempt=${event.attempt}${event.reason ? ` (${event.reason})` : ""}`);
+      return;
+    case "node.finish":
+      console.error(`Node finished: ${event.nodeId} ${event.status} exit=${event.exitCode}`);
+      return;
+    case "workflow.finish":
+      console.error(`Pipeline finished: ${event.workflowId} ${event.outcome}`);
+      return;
+    default: {
+      const _exhaustive = event;
+      throw new Error(`Unhandled runtime event: ${String(_exhaustive)}`);
+    }
+  }
+}
 function formatRuntimeResult(result) {
-  return [
+  const lines = [
     `Pipeline complete: ${result.outcome}`,
     `Workflow: ${result.plan.workflowId}`,
     `Nodes: ${result.nodes.map((node) => `${node.nodeId}:${node.status}`).join(", ")}`,
     `Agent boundaries: ${result.agentInvocations.length}`
-  ].join(`
+  ];
+  const outputs = result.nodes.filter((node) => node.output.trim());
+  if (outputs.length > 0) {
+    lines.push("Node outputs:");
+    for (const node of outputs) {
+      appendIndentedSection(lines, node.nodeId, [node.output]);
+    }
+  }
+  return lines.join(`
 `);
 }
 function formatRuntimeFailure(result) {

package/dist/mastra/config.d.ts

@@ -76,6 +76,11 @@ declare const configSchema: z.ZodObject<{
                 jsonl: "jsonl";
                 json_schema: "json_schema";
             }>;
+            repair: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodOptional<z.ZodBoolean>;
+                max_attempts: z.ZodOptional<z.ZodNumber>;
+                runner: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
             schema_path: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
         rules: z.ZodOptional<z.ZodArray<z.ZodString>>;

package/dist/mastra/runner.js

@@ -7277,17 +7277,17 @@ function harnessArgv(harness, prompt, worktreePath, contextFile, options = {}) {
       return [
         "exec",
         "--json",
+        "-C",
+        worktreePath,
         ...optionalModelArgs(harness, options.runner, options.actor),
         ...mcpArgs,
         ...skillArgs,
         "--sandbox",
-        "workspace-write",
+        codexSandboxFor(options.actor),
         "--config",
         'approval_policy="never"',
         "--skip-git-repo-check",
-        prompt,
-        "-C",
-        worktreePath
+        prompt
       ];
     case "opencode":
       return contextFile ? [
@@ -7332,6 +7332,9 @@ function harnessArgv(harness, prompt, worktreePath, contextFile, options = {}) {
     }
   }
 }
+function codexSandboxFor(actor) {
+  return actor?.filesystem?.mode === "read-only" ? "read-only" : "workspace-write";
+}
 async function execaHarness(harness, prompt, contextFile, worktreePath) {
   if (harness === "pi") {
     return execaHarnessPi(prompt, contextFile, worktreePath);

package/dist/pipeline-runtime.d.ts

@@ -32,9 +32,43 @@ export interface PipelineRuntimeResult {
     outcome: "FAIL" | "PASS";
     plan: WorkflowExecutionPlan;
 }
+export type PipelineRuntimeEvent = {
+    nodeIds: string[];
+    type: "workflow.start";
+    workflowId: string;
+} | {
+    attempt: number;
+    nodeId: string;
+    profile?: string;
+    runnerId?: string;
+    type: "node.start";
+} | {
+    attempt: number;
+    exitCode: number;
+    nodeId: string;
+    status: RuntimeNodeResult["status"];
+    type: "node.finish";
+} | {
+    gateId: string;
+    nodeId: string;
+    passed: boolean;
+    reason?: string;
+    type: "gate.finish";
+} | {
+    attempt: number;
+    nodeId: string;
+    passed: boolean;
+    reason?: string;
+    type: "output.repair";
+} | {
+    outcome: PipelineRuntimeResult["outcome"];
+    type: "workflow.finish";
+    workflowId: string;
+};
 export interface PipelineRuntimeOptions {
     config?: PipelineConfig;
     executor?: (plan: RunnerLaunchPlan) => AgentResult | Promise<AgentResult>;
+    reporter?: (event: PipelineRuntimeEvent) => void;
     task: string;
     workflowId?: string;
     worktreePath?: string;

package/docs/config-architecture.md

@@ -109,6 +109,24 @@ receive explicit grants:
 - `network`: inherited or disabled.
 - `output`: text, JSON, JSONL, or JSON Schema output.
 
+JSON Schema outputs are hard contracts. The runtime validates normalized agent
+output before the node can pass. Schema outputs also get a bounded repair pass
+by default:
+
+```yaml
+output:
+  format: json_schema
+  schema_path: .pipeline/schemas/research.schema.json
+  repair:
+    enabled: true
+    max_attempts: 1
+```
+
+The repair pass receives only the schema, invalid output, and validation error.
+It uses a no-tools, read-only profile, then the runtime validates the repaired
+output again. If repair still fails, the node fails with both original and
+repair evidence.
+
 Hooks live in `pipeline.yaml` and can be attached to the orchestrator, workflow,
 or workflow nodes.
 

package/package.json

@@ -69,7 +69,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "",
   "main": "index.js",
   "keywords": [],