@oisincoveney/pipeline 2.8.1 → 2.8.2

package/dist/config/schemas.d.ts

@@ -226,8 +226,8 @@ declare const configSchema: z.ZodObject<{
     policy: z.ZodOptional<z.ZodObject<{
       commands: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
-        "trusted-only": "trusted-only";
         deny: "deny";
+        "trusted-only": "trusted-only";
       }>>;
       modules: z.ZodOptional<z.ZodEnum<{
         allow: "allow";
@@ -255,8 +255,8 @@ declare const configSchema: z.ZodObject<{
       global: "global";
     }>>;
     mode: z.ZodEnum<{
-      hosted: "hosted";
       local: "local";
+      hosted: "hosted";
     }>;
     provider: z.ZodLiteral<"toolhive">;
     authorization_env: z.ZodDefault<z.ZodString>;
@@ -299,10 +299,10 @@ declare const configSchema: z.ZodObject<{
     }, z.core.$strict>>;
     output: z.ZodOptional<z.ZodObject<{
       format: z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>;
       repair: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -371,10 +371,10 @@ declare const configSchema: z.ZodObject<{
         disabled: "disabled";
       }>>>;
       output_formats: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        json_schema: "json_schema";
         text: "text";
         json: "json";
         jsonl: "jsonl";
-        json_schema: "json_schema";
       }>>>;
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;

package/dist/gates.js

@@ -1,231 +1,12 @@
-import { parseJson } from "./safe-json.js";
-import { existsSync, readFileSync, renameSync } from "node:fs";
+import "./safe-json.js";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { execa } from "execa";
-import { resolveCommand } from "package-manager-detector/commands";
-import { detect } from "package-manager-detector/detect";
+import "execa";
+import "package-manager-detector/commands";
+import "package-manager-detector/detect";
 //#region src/gates.ts
-const FAILING_TEST_RE = /^[✗×✕●]\s+(.+)$/;
-function parseFailingTests(output) {
-	return output.split("\n").flatMap((line) => {
-		const m = FAILING_TEST_RE.exec(line);
-		return m ? [m[1].trim()] : [];
-	});
-}
-function displayCommand(command) {
-	return [command.command, ...command.args].join(" ");
-}
-function readPackageScripts(worktreePath) {
-	try {
-		return parseJson(readFileSync(join(worktreePath, "package.json"), "utf-8"), "package.json").scripts ?? {};
-	} catch {
-		return {};
-	}
-}
-function envCommand(envName) {
-	const raw = process.env[envName]?.trim();
-	if (!raw) return null;
-	return {
-		command: raw,
-		args: [],
-		shell: true
-	};
-}
-async function resolvePackageScript(worktreePath, scriptName) {
-	if (!readPackageScripts(worktreePath)[scriptName]) return null;
-	const resolved = resolveCommand(await detectPackageManagerAgent(worktreePath), "run", [scriptName]);
-	if (!resolved) return null;
-	return {
-		command: resolved.command,
-		args: resolved.args
-	};
-}
-async function detectPackageManagerAgent(worktreePath) {
-	return (await detect({
-		cwd: worktreePath,
-		stopDir: worktreePath
-	}))?.agent ?? "npm";
-}
-async function resolvePackageBinaryCommand(worktreePath, binary, args) {
-	if (!existsSync(join(worktreePath, "package.json"))) return null;
-	switch (await detectPackageManagerAgent(worktreePath)) {
-		case "bun": return {
-			command: "bun",
-			args: [
-				"x",
-				binary,
-				...args
-			]
-		};
-		case "pnpm": return {
-			command: "pnpm",
-			args: [
-				"exec",
-				binary,
-				...args
-			]
-		};
-		case "yarn": return {
-			command: "yarn",
-			args: [
-				"exec",
-				binary,
-				...args
-			]
-		};
-		default: return {
-			command: "npx",
-			args: [
-				"--yes",
-				binary,
-				...args
-			]
-		};
-	}
-}
-async function runTests(worktreePath, signal) {
-	const projectCommand = envCommand("PIPELINE_TEST_COMMAND") ?? await resolvePackageScript(worktreePath, "test");
-	if (!projectCommand) return {
-		exitCode: 1,
-		failingTests: [],
-		output: "No test command found. Set PIPELINE_TEST_COMMAND or define a package test script."
-	};
-	const result = await runProjectCommand(projectCommand, worktreePath, signal);
-	return {
-		...result,
-		failingTests: result.exitCode === 0 ? [] : parseFailingTests(result.output)
-	};
-}
-async function runTypecheck(worktreePath, signal) {
-	const projectCommand = envCommand("PIPELINE_TYPECHECK_COMMAND") ?? await resolvePackageScript(worktreePath, "typecheck");
-	if (!projectCommand) return {
-		exitCode: 0,
-		output: "skipped"
-	};
-	return await runProjectCommand(projectCommand, worktreePath, signal);
-}
-async function runLint(worktreePath, signal) {
-	const projectCommand = envCommand("PIPELINE_LINT_COMMAND") ?? await resolvePackageScript(worktreePath, "lint");
-	if (!projectCommand) return {
-		exitCode: 0,
-		output: "skipped"
-	};
-	return await runProjectCommand(projectCommand, worktreePath, signal, { hidePipelineRuns: true });
-}
-async function runFallow(worktreePath, signal) {
-	return runProjectCommand(envCommand("PIPELINE_FALLOW_COMMAND") ?? await resolvePackageScript(worktreePath, "fallow") ?? await resolvePackageBinaryCommand(worktreePath, "fallow", ["audit"]) ?? {
-		args: ["audit"],
-		command: "fallow"
-	}, worktreePath, signal, { hidePipelineRuns: true });
-}
-async function runProjectCommand(projectCommand, worktreePath, signal, options) {
-	const hiddenRuns = options?.hidePipelineRuns ? hidePipelineRunsDirectory(worktreePath) : null;
-	try {
-		const result = await execa(projectCommand.command, projectCommand.args, {
-			cancelSignal: signal,
-			cwd: worktreePath,
-			shell: projectCommand.shell
-		});
-		const output = [result.stdout, result.stderr].filter(Boolean).join("\n");
-		return {
-			command: displayCommand(projectCommand),
-			exitCode: result.exitCode ?? 0,
-			output
-		};
-	} catch (err) {
-		const e = commandError(err);
-		return {
-			command: displayCommand(projectCommand),
-			exitCode: e.exitCode ?? 1,
-			output: commandErrorOutput(e)
-		};
-	} finally {
-		hiddenRuns?.restore();
-	}
-}
-function hidePipelineRunsDirectory(worktreePath) {
-	const pipelineDir = join(worktreePath, ".pipeline");
-	const runsDir = join(pipelineDir, "runs");
-	if (!existsSync(runsDir)) return null;
-	const hiddenRunsDir = join(pipelineDir, `.runs-hidden-${process.pid}-${Date.now()}`);
-	renameSync(runsDir, hiddenRunsDir);
-	return { restore: () => {
-		if (!existsSync(hiddenRunsDir)) return;
-		renameSync(hiddenRunsDir, runsDir);
-	} };
-}
-function commandError(err) {
-	return err;
-}
-function commandErrorOutput(err) {
-	return [err.stdout, err.stderr].filter(Boolean).join("\n") || [err.shortMessage, err.message].filter(Boolean).join("\n");
-}
-async function runSemgrep(worktreePath, signal, changedFiles) {
-	const overrideCommand = envCommand("PIPELINE_SEMGREP_COMMAND");
-	const targets = changedFiles ? [...new Set(changedFiles)].filter((file) => existsSync(join(worktreePath, file))) : void 0;
-	if (!overrideCommand && targets && targets.length === 0) return {
-		command: "uvx semgrep scan --config=p/ci --error",
-		exitCode: 0,
-		output: "skipped: no changed files to scan"
-	};
-	return await runProjectCommand(overrideCommand ?? {
-		args: [
-			"semgrep",
-			"scan",
-			"--config=p/ci",
-			"--error",
-			...targets ? ["--", ...targets] : ["."]
-		],
-		command: "uvx"
-	}, worktreePath, signal);
-}
 function artifactExists(worktreePath, filename) {
 	return existsSync(join(worktreePath, filename));
 }
-const JSCPD_DEFAULT_IGNORES = [
-	"**/node_modules/**",
-	"**/.git/**",
-	"**/dist/**",
-	"**/coverage/**",
-	"**/.next/**",
-	"**/.turbo/**",
-	"**/.cache/**",
-	"**/.serena/**",
-	"**/.opencode/**",
-	"**/.pipeline/host-resources/**",
-	"**/.pipeline/skills/**",
-	"**/.agents/skills/**"
-];
-function parseJscpdOutput(output) {
-	try {
-		return { violations: (parseJson(output, "jscpd output")?.duplicates ?? []).map((dup) => ({
-			file: dup?.firstFile?.name ?? "unknown",
-			line: dup?.firstFile?.start,
-			message: `Duplicate code block detected between ${dup?.firstFile?.name} and ${dup?.secondFile?.name}`
-		})) };
-	} catch {
-		return { violations: [] };
-	}
-}
-async function runJscpd(worktreePath, signal) {
-	try {
-		return parseJscpdOutput((await execa("bunx", [
-			"jscpd",
-			"--min-tokens",
-			"50",
-			"--reporters",
-			"json",
-			"--gitignore",
-			"--ignore",
-			JSCPD_DEFAULT_IGNORES.join(","),
-			"."
-		], {
-			cancelSignal: signal,
-			cwd: worktreePath
-		})).stdout ?? "");
-	} catch (err) {
-		return parseJscpdOutput(err.stdout ?? "");
-	}
-}
 //#endregion
-export { artifactExists, runFallow, runJscpd, runLint, runSemgrep, runTests, runTypecheck };
+export { artifactExists };

package/dist/moka-submit.d.ts

@@ -5,13 +5,13 @@ import { z } from "zod";
 //#region src/moka-submit.d.ts
 declare const mokaSubmitDirectHooksSchema: z.ZodRecord<z.ZodEnum<{
   "workflow.start": "workflow.start";
+  "node.finish": "node.finish";
+  "node.start": "node.start";
   "workflow.success": "workflow.success";
   "workflow.failure": "workflow.failure";
   "workflow.complete": "workflow.complete";
-  "node.start": "node.start";
   "node.success": "node.success";
   "node.error": "node.error";
-  "node.finish": "node.finish";
   "gate.failure": "gate.failure";
 }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
   failure: z.ZodDefault<z.ZodEnum<{
@@ -94,13 +94,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
-    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
-    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{
@@ -206,13 +206,13 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   }, z.core.$strict>>;
   hooks: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
     "workflow.start": "workflow.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
     "workflow.success": "workflow.success";
     "workflow.failure": "workflow.failure";
     "workflow.complete": "workflow.complete";
-    "node.start": "node.start";
     "node.success": "node.success";
     "node.error": "node.error";
-    "node.finish": "node.finish";
     "gate.failure": "gate.failure";
   }> & z.core.$partial, z.ZodDiscriminatedUnion<[z.ZodObject<{
     failure: z.ZodDefault<z.ZodEnum<{

package/dist/runner-event-schema.d.ts

@@ -10,8 +10,8 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
   sequence: z.ZodNumber;
   type: z.ZodEnum<{
-    "workflow.start": "workflow.start";
     "workflow.planned": "workflow.planned";
+    "workflow.start": "workflow.start";
   }>;
   workflowPlan: z.ZodObject<{
     edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -55,10 +55,10 @@ declare const runnerEventRecordSchema: z.ZodUnion<readonly [z.ZodObject<{
     }>;
   }, z.core.$strip>;
   type: z.ZodEnum<{
-    "node.start": "node.start";
-    "node.finish": "node.finish";
     "agent.finish": "agent.finish";
     "agent.start": "agent.start";
+    "node.finish": "node.finish";
+    "node.start": "node.start";
   }>;
 }, z.core.$strip>, z.ZodObject<{
   at: z.ZodOptional<z.ZodString>;
@@ -180,8 +180,8 @@ declare const runnerEventBatchSchema: z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;
     sequence: z.ZodNumber;
     type: z.ZodEnum<{
-      "workflow.start": "workflow.start";
       "workflow.planned": "workflow.planned";
+      "workflow.start": "workflow.start";
     }>;
     workflowPlan: z.ZodObject<{
       edges: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -225,10 +225,10 @@ declare const runnerEventBatchSchema: z.ZodObject<{
       }>;
     }, z.core.$strip>;
     type: z.ZodEnum<{
-      "node.start": "node.start";
-      "node.finish": "node.finish";
       "agent.finish": "agent.finish";
       "agent.start": "agent.start";
+      "node.finish": "node.finish";
+      "node.start": "node.start";
     }>;
   }, z.core.$strip>, z.ZodObject<{
     at: z.ZodOptional<z.ZodString>;

package/dist/runtime/agent-node/agent-node.js

@@ -121,7 +121,7 @@ function runHandoffFinalizerEffect(context, node, rawOutput, attempt) {
 		const result = yield* (yield* AgentNodeRuntimeService).executeRunner(context.executor, plan, { signal: context.signal });
 		emitAgentFinish(context, plan, attempt, result);
 		return parseHandoff(normalizeAgentOutput(plan, result.stdout).output) ?? synthesizeMinimalHandoff(rawOutput);
-	});
+	}).pipe(Effect.catchAll(() => Effect.succeed(synthesizeMinimalHandoff(rawOutput))));
 }
 function createHandoffFinalizerPlan(context, node, runner, rawOutput) {
 	const finalizerProfileId = `${node.id}:handoff`;

package/dist/runtime/builtins/builtins.js

@@ -1,70 +1,357 @@
-import { runFallow, runJscpd, runLint, runSemgrep, runTests, runTypecheck } from "../../gates.js";
+import { parseJson } from "../../safe-json.js";
+import { CommandExecutor, CommandExecutorLive } from "../services/command-executor-service.js";
 import { executeDrainMergeBuiltin } from "../drain-merge/drain-merge.js";
 import "../drain-merge/index.js";
 import { executeSelectCandidateBuiltin } from "../select-candidate/select-candidate.js";
+import { Effect } from "effect";
+import { existsSync, readFileSync, renameSync } from "node:fs";
+import { join } from "node:path";
+import { resolveCommand } from "package-manager-detector/commands";
+import { detect } from "package-manager-detector/detect";
 //#region src/runtime/builtins/builtins.ts
-async function executeBuiltin(builtin, context, node) {
-	switch (builtin) {
-		case "drain-merge": return executeDrainMergeBuiltin(context, node);
-		case "select-candidate": return executeSelectCandidateBuiltin(context, node);
-		case "test": {
-			const result = await runTests(context.worktreePath, context.signal);
-			return {
-				evidence: [...builtinCommandEvidence("test", result), ...result.failingTests],
-				exitCode: result.exitCode,
-				output: result.output
-			};
-		}
-		case "typecheck": {
-			const result = await runTypecheck(context.worktreePath, context.signal);
-			return {
-				evidence: builtinCommandEvidence("typecheck", result),
-				exitCode: result.exitCode,
-				output: result.output
-			};
-		}
-		case "lint": {
-			const result = await runLint(context.worktreePath, context.signal);
-			return {
-				evidence: builtinCommandEvidence("lint", result),
-				exitCode: result.exitCode,
-				output: result.output
-			};
-		}
-		case "fallow": {
-			const result = await runFallow(context.worktreePath, context.signal);
-			return {
-				evidence: builtinCommandEvidence("fallow", result),
-				exitCode: result.exitCode,
-				output: result.output
-			};
-		}
-		case "duplication": {
-			const result = await runJscpd(context.worktreePath, context.signal);
-			return {
-				evidence: result.violations.map((violation) => violation.message),
-				exitCode: result.violations.length === 0 ? 0 : 1,
-				output: JSON.stringify(result.violations)
-			};
-		}
-		case "semgrep": {
-			const result = await runSemgrep(context.worktreePath, context.signal, runtimeChangedFiles(context));
-			return {
-				evidence: builtinCommandEvidence("semgrep", result),
-				exitCode: result.exitCode,
-				output: result.output
-			};
-		}
-		default: return {
-			evidence: [`unsupported builtin '${builtin}'`],
-			exitCode: 1,
-			output: ""
+const JSCPD_DEFAULT_IGNORES = [
+	"**/node_modules/**",
+	"**/.git/**",
+	"**/dist/**",
+	"**/coverage/**",
+	"**/.next/**",
+	"**/.turbo/**",
+	"**/.cache/**",
+	"**/.serena/**",
+	"**/.opencode/**",
+	"**/.pipeline/host-resources/**",
+	"**/.pipeline/skills/**",
+	"**/.agents/skills/**"
+];
+const WHITESPACE_RE = /\s/;
+const BUILTIN_HANDLERS = {
+	"drain-merge": (context, node) => Effect.tryPromise(() => executeDrainMergeBuiltin(context, node)),
+	duplication: (context) => executeDuplicationBuiltinEffect(context),
+	fallow: (context) => executeFallowBuiltinEffect(context),
+	lint: (context) => executeScriptBuiltinEffect(context, "lint"),
+	"select-candidate": (context, node) => Effect.tryPromise(() => executeSelectCandidateBuiltin(context, node)),
+	semgrep: (context) => executeSemgrepBuiltinEffect(context),
+	test: (context) => executeTestBuiltinEffect(context),
+	typecheck: (context) => executeScriptBuiltinEffect(context, "typecheck")
+};
+function executeBuiltin(builtin, context, node) {
+	const program = executeBuiltinEffect(builtin, context, node);
+	return Effect.runPromise(Effect.provide(program, CommandExecutorLive));
+}
+function executeBuiltinEffect(builtin, context, node) {
+	const handler = BUILTIN_HANDLERS[builtin];
+	return handler ? handler(context, node) : Effect.succeed(unsupportedBuiltin(builtin));
+}
+function unsupportedBuiltin(builtin) {
+	return {
+		evidence: [`unsupported builtin '${builtin}'`],
+		exitCode: 1,
+		output: ""
+	};
+}
+function executeTestBuiltinEffect(context) {
+	return Effect.gen(function* () {
+		const command = yield* resolveRequiredScriptCommand(context.worktreePath, "PIPELINE_TEST_COMMAND", "test");
+		if (!command) return missingTestCommandResult();
+		const result = yield* executeProjectCommand(command, context);
+		return commandBuiltinResult("test", result, result.exitCode === 0 ? [] : parseFailingTests(result.output));
+	});
+}
+function executeScriptBuiltinEffect(context, builtin) {
+	return Effect.gen(function* () {
+		const command = yield* resolveRequiredScriptCommand(context.worktreePath, builtinEnvName(builtin), builtin);
+		return command ? yield* executeScriptCommandBuiltin(builtin, command, context) : skippedBuiltinResult(builtin);
+	});
+}
+function executeScriptCommandBuiltin(builtin, command, context) {
+	return executeProjectCommand(command, context, builtin === "lint").pipe(Effect.map((result) => commandBuiltinResult(builtin, result)));
+}
+function executeFallowBuiltinEffect(context) {
+	return Effect.gen(function* () {
+		return commandBuiltinResult("fallow", yield* executeProjectCommand(yield* resolveFallowCommand(context.worktreePath), context, true));
+	});
+}
+function executeSemgrepBuiltinEffect(context) {
+	return Effect.gen(function* () {
+		const command = yield* resolveSemgrepCommand(context);
+		if (!command) return semgrepNoChangedFilesResult();
+		return commandBuiltinResult("semgrep", yield* executeProjectCommand(command, context));
+	});
+}
+function executeDuplicationBuiltinEffect(context) {
+	return Effect.gen(function* () {
+		return duplicationBuiltinResult(parseJscpdOutput((yield* executeProjectCommand(jscpdCommand(), context)).output));
+	});
+}
+function executeProjectCommand(command, context, hidePipelineRuns = false) {
+	const run = executeVisibleProjectCommand(command, context);
+	return hidePipelineRuns ? withHiddenPipelineRuns(context.worktreePath, run) : run;
+}
+function executeVisibleProjectCommand(command, context) {
+	return Effect.gen(function* () {
+		const result = yield* (yield* CommandExecutor).execute(projectCommandArray(command), context);
+		return {
+			command: displayCommand(command),
+			...result
 		};
+	});
+}
+function withHiddenPipelineRuns(worktreePath, effect) {
+	return Effect.acquireUseRelease(Effect.sync(() => hidePipelineRunsDirectory(worktreePath)), () => effect, (hiddenRuns) => Effect.sync(() => hiddenRuns?.restore()));
+}
+function resolveRequiredScriptCommand(worktreePath, envName, scriptName) {
+	return Effect.gen(function* () {
+		return envCommand(envName) ?? (yield* resolvePackageScript(worktreePath, scriptName));
+	});
+}
+function resolveFallowCommand(worktreePath) {
+	return Effect.gen(function* () {
+		const script = yield* resolvePackageScript(worktreePath, "fallow");
+		const binary = yield* resolvePackageBinaryCommand(worktreePath, "fallow", ["audit"]);
+		return envCommand("PIPELINE_FALLOW_COMMAND") ?? script ?? binary ?? fallowCommand();
+	});
+}
+function resolveSemgrepCommand(context) {
+	return Effect.sync(() => {
+		const override = envCommand("PIPELINE_SEMGREP_COMMAND");
+		const targets = semgrepTargets(context);
+		return override ?? semgrepScanCommand(targets);
+	});
+}
+function resolvePackageScript(worktreePath, scriptName) {
+	return Effect.gen(function* () {
+		if (!readPackageScripts(worktreePath)[scriptName]) return null;
+		return packageManagerCommand(yield* detectPackageManagerAgent(worktreePath), [scriptName]);
+	});
+}
+function resolvePackageBinaryCommand(worktreePath, binary, args) {
+	return Effect.gen(function* () {
+		if (!existsSync(join(worktreePath, "package.json"))) return null;
+		return packageBinaryCommand(yield* detectPackageManagerAgent(worktreePath), binary, args);
+	});
+}
+function detectPackageManagerAgent(worktreePath) {
+	return Effect.tryPromise(async () => {
+		return (await detect({
+			cwd: worktreePath,
+			stopDir: worktreePath
+		}))?.agent ?? "npm";
+	});
+}
+function packageManagerCommand(agent, args) {
+	const resolved = resolveCommand(agent, "run", args);
+	return resolved ? {
+		args: resolved.args,
+		command: resolved.command
+	} : null;
+}
+function packageBinaryCommand(agent, binary, args) {
+	return {
+		bun: {
+			args: [
+				"x",
+				binary,
+				...args
+			],
+			command: "bun"
+		},
+		pnpm: {
+			args: [
+				"exec",
+				binary,
+				...args
+			],
+			command: "pnpm"
+		},
+		yarn: {
+			args: [
+				"exec",
+				binary,
+				...args
+			],
+			command: "yarn"
+		}
+	}[String(agent)] ?? {
+		args: [
+			"--yes",
+			binary,
+			...args
+		],
+		command: "npx"
+	};
+}
+function envCommand(envName) {
+	const raw = process.env[envName]?.trim();
+	return raw ? envProjectCommand(raw) : null;
+}
+function envProjectCommand(raw) {
+	return WHITESPACE_RE.test(raw) ? shellProjectCommand(raw) : executableProjectCommand(raw);
+}
+function executableProjectCommand(command) {
+	return {
+		args: [],
+		command
+	};
+}
+function shellProjectCommand(command) {
+	return {
+		args: ["-c", command],
+		command: "sh",
+		display: command
+	};
+}
+function readPackageScripts(worktreePath) {
+	const text = readPackageJsonText(worktreePath);
+	return text ? packageScriptsFromJson(text) : {};
+}
+function readPackageJsonText(worktreePath) {
+	try {
+		return readFileSync(join(worktreePath, "package.json"), "utf-8");
+	} catch {
+		return null;
 	}
 }
+function packageScriptsFromJson(text) {
+	return parseJson(text, "package.json").scripts ?? {};
+}
 function runtimeChangedFiles(context) {
 	return [...new Set(context.nodeStateStore.changedFilesForAllNodes())].sort();
 }
+function semgrepTargets(context) {
+	const targets = runtimeChangedFiles(context).filter((file) => existsSync(join(context.worktreePath, file)));
+	return targets.length === 0 ? void 0 : targets;
+}
+function semgrepScanCommand(targets) {
+	if (!targets) return null;
+	return {
+		args: [
+			"semgrep",
+			"scan",
+			"--config=p/ci",
+			"--error",
+			"--",
+			...targets
+		],
+		command: "uvx"
+	};
+}
+function jscpdCommand() {
+	return {
+		args: [
+			"jscpd",
+			"--min-tokens",
+			"50",
+			"--reporters",
+			"json",
+			"--gitignore",
+			"--ignore",
+			JSCPD_DEFAULT_IGNORES.join(","),
+			"."
+		],
+		command: "bunx"
+	};
+}
+function fallowCommand() {
+	return {
+		args: ["audit"],
+		command: "fallow"
+	};
+}
+function projectCommandArray(command) {
+	return [command.command, ...command.args];
+}
+function displayCommand(command) {
+	return command.display ?? projectCommandArray(command).join(" ");
+}
+function builtinEnvName(builtin) {
+	return `PIPELINE_${builtin.toUpperCase()}_COMMAND`;
+}
+function missingTestCommandResult() {
+	return {
+		evidence: ["No test command found. Set PIPELINE_TEST_COMMAND or define a package test script."],
+		exitCode: 1,
+		output: "No test command found. Set PIPELINE_TEST_COMMAND or define a package test script."
+	};
+}
+function skippedBuiltinResult(builtin) {
+	return {
+		evidence: builtinCommandEvidence(builtin, {
+			exitCode: 0,
+			output: "skipped"
+		}),
+		exitCode: 0,
+		output: "skipped"
+	};
+}
+function semgrepNoChangedFilesResult() {
+	return commandBuiltinResult("semgrep", {
+		command: "uvx semgrep scan --config=p/ci --error",
+		exitCode: 0,
+		output: "skipped: no changed files to scan"
+	});
+}
+function duplicationBuiltinResult(violations) {
+	return {
+		evidence: violations.map((violation) => violation.message),
+		exitCode: violations.length === 0 ? 0 : 1,
+		output: JSON.stringify(violations)
+	};
+}
+function commandBuiltinResult(builtin, result, extraEvidence = []) {
+	return {
+		evidence: [...builtinCommandEvidence(builtin, result), ...extraEvidence],
+		exitCode: result.exitCode,
+		output: result.output
+	};
+}
+function hidePipelineRunsDirectory(worktreePath) {
+	const paths = pipelineRunsPaths(worktreePath);
+	if (!existsSync(paths.runs)) return null;
+	renameSync(paths.runs, paths.hidden);
+	return { restore: () => restoreHiddenRuns(paths) };
+}
+function pipelineRunsPaths(worktreePath) {
+	const pipelineDir = join(worktreePath, ".pipeline");
+	return {
+		hidden: join(pipelineDir, `.runs-hidden-${process.pid}-${Date.now()}`),
+		runs: join(pipelineDir, "runs")
+	};
+}
+function restoreHiddenRuns(paths) {
+	if (existsSync(paths.hidden)) renameSync(paths.hidden, paths.runs);
+}
+const FAILING_TEST_RE = /^[✗×✕●]\s+(.+)$/;
+function parseFailingTests(output) {
+	return output.split("\n").flatMap(parseFailingTestLine);
+}
+function parseFailingTestLine(line) {
+	const match = FAILING_TEST_RE.exec(line);
+	return match ? [match[1].trim()] : [];
+}
+function parseJscpdOutput(output) {
+	try {
+		return (parseJson(output, "jscpd output").duplicates ?? []).map(jscpdDuplicateViolation);
+	} catch {
+		return [];
+	}
+}
+function jscpdDuplicateViolation(dup) {
+	const firstFile = jscpdFirstFileName(dup);
+	return {
+		file: firstFile ?? "unknown",
+		line: jscpdFirstFileStart(dup),
+		message: `Duplicate code block detected between ${firstFile} and ${jscpdSecondFileName(dup)}`
+	};
+}
+function jscpdFirstFileName(dup) {
+	return dup.firstFile?.name;
+}
+function jscpdFirstFileStart(dup) {
+	return dup.firstFile?.start;
+}
+function jscpdSecondFileName(dup) {
+	return dup.secondFile?.name;
+}
 function builtinCommandEvidence(builtin, result) {
 	const command = result.command ? `: ${result.command}` : "";
 	return [`builtin '${builtin}' exited ${result.exitCode}${command}`, result.output || `builtin '${builtin}' produced no output`];

package/dist/runtime/gates/gates.js

@@ -5,9 +5,9 @@ import "../json-validation/index.js";
 import { emitGateFinish, emitGateStart, runtimeSystemId } from "../events/events.js";
 import "../events/index.js";
 import { CommandExecutor, CommandExecutorLive } from "../services/command-executor-service.js";
-import { artifactExists } from "../../gates.js";
 import { executeBuiltin } from "../builtins/builtins.js";
 import "../builtins/index.js";
+import { artifactExists } from "../../gates.js";
 import { Effect } from "effect";
 import { join } from "node:path";
 import micromatch from "micromatch";

package/package.json

@@ -126,7 +126,7 @@
     "prepack": "bun run build:cli"
   },
   "type": "module",
-  "version": "2.8.1",
+  "version": "2.8.2",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",