@principles/pd-cli 1.132.0 → 1.134.0

package/src/commands/candidate.ts

@@ -27,6 +27,7 @@ import { loadLedger, getLedgerFilePathPublic } from '@principles/core/principle-
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
 import { createRemediationResult, remediationAction } from './remediation-output.js';
 import type { RemediationResult } from './remediation-output.js';
+import { checkAdmissionGate } from './admission-gate.js';
 
 // ── Interfaces ────────────────────────────────────────────────────────────────
 
@@ -353,6 +354,7 @@ export async function handleCandidateInternalize(opts: CandidateInternalizeOptio
     }
 
     const seed = buildDreamerSeedFromCandidate(candidate, { route: decision.route, ready: decision.ready, sourcePainId });
+    // eslint-disable-next-line no-restricted-syntax -- 'in' required for discriminated union narrowing (BridgeTaskSeed | BridgeDecision)
     if ('decision' in seed) {
       const decisionResult = seed as { decision: string; reason?: string; taskId?: string };
       const reason = decisionResult.decision === 'already_exists'
@@ -494,6 +496,13 @@ export async function handleCandidateShow(opts: CandidateShowOptions): Promise<v
     if (result.ledgerEntryId) {
       console.log(`  Ledger Entry: ${result.ledgerEntryId}`);
     }
+    // F10-1: surface dangling sourceRunId warning in text mode (rc-9).
+    if (result.warning) {
+      console.log(`  ⚠ WARNING:   ${result.warning}`);
+    }
+    if (result.nextAction) {
+      console.log(`  Next Action: ${result.nextAction}`);
+    }
     console.log('');
   } finally {
     await stateManager.close();
@@ -520,12 +529,37 @@ export async function handleCandidateIntake(opts: CandidateIntakeOptions): Promi
     const ledgerAdapter = new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') });
     const service = new CandidateIntakeService({ stateManager, ledgerAdapter });
 
-    if (opts.dryRun) {
-      const candidate = await stateManager.getCandidate(opts.candidateId);
-      if (!candidate) {
-        console.error(`Candidate not found: ${opts.candidateId}`);
-        process.exit(1);
+    // Fetch candidate once for admission gate check and downstream paths.
+    const candidate = await stateManager.getCandidate(opts.candidateId);
+    if (!candidate) {
+      console.error(`Candidate not found: ${opts.candidateId}`);
+      process.exit(1);
+      return;
+    }
+
+    // PRI-442 Stage 4: admission gate check — refuse non-admitted candidates
+    // to prevent CLI from bypassing the production admission gate.
+    const admissionBlock = checkAdmissionGate(candidate);
+    if (admissionBlock) {
+      const result = {
+        candidateId: opts.candidateId,
+        status: 'refused',
+        admissionDecision: admissionBlock.decision,
+        reason: admissionBlock.reason,
+        nextAction: admissionBlock.nextAction,
+      };
+      if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+      } else {
+        console.error(`Admission gate refused candidate ${opts.candidateId}: ${admissionBlock.decision}`);
+        console.error(`  Reason:      ${admissionBlock.reason}`);
+        console.error(`  Next Action: ${admissionBlock.nextAction}`);
       }
+      process.exit(1);
+      return;
+    }
+
+    if (opts.dryRun) {
       const artifact = await stateManager.getArtifact(candidate.artifactId);
       if (!artifact) {
         console.error(`Artifact not found for candidate: ${opts.candidateId}`);
@@ -564,7 +598,6 @@ export async function handleCandidateIntake(opts: CandidateIntakeOptions): Promi
     const entry = await service.intake(opts.candidateId);
 
     // Check if already consumed before this call
-    const candidate = await stateManager.getCandidate(opts.candidateId);
     if (candidate?.status === 'consumed') {
       const infoMessage = `Candidate ${opts.candidateId} was already consumed. Ledger entry: ${entry.id}`;
       if (opts.json) {
@@ -724,6 +757,30 @@ export async function handleCandidateRepair(opts: CandidateRepairOptions): Promi
       process.exit(1);
     }
 
+    // PRI-442 Stage 4: admission gate check — even for consumed candidates,
+    // re-verify admission before re-intaking to prevent bypassing the gate.
+    // A consumed candidate that would fail the gate indicates data corruption
+    // or a prior bypass; refuse and surface the reason.
+    const admissionBlock = checkAdmissionGate(candidate);
+    if (admissionBlock) {
+      const result = {
+        candidateId: opts.candidateId,
+        status: 'refused',
+        admissionDecision: admissionBlock.decision,
+        reason: admissionBlock.reason,
+        nextAction: admissionBlock.nextAction,
+      };
+      if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+      } else {
+        console.error(`Admission gate refused candidate ${opts.candidateId}: ${admissionBlock.decision}`);
+        console.error(`  Reason:      ${admissionBlock.reason}`);
+        console.error(`  Next Action: ${admissionBlock.nextAction}`);
+      }
+      process.exit(1);
+      return;
+    }
+
     const ledgerAdapter = new PrincipleTreeLedgerAdapter({ stateDir: path.join(workspaceDir, '.state') });
     const service = new CandidateIntakeService({ stateManager, ledgerAdapter });
 
@@ -931,6 +988,7 @@ export async function handleCandidateInternalizationBackfill(opts: CandidateBack
         continue;
       }
       const seed = buildDreamerSeedFromCandidate(candidate, { route: decision.route, ready: decision.ready, sourcePainId });
+      // eslint-disable-next-line no-restricted-syntax -- 'in' required for discriminated union narrowing (BridgeTaskSeed | BridgeDecision)
       if ('decision' in seed) {
         output.deferred++;
         const decisionResult = seed as { decision: string; reason?: string; taskId?: string };
@@ -998,6 +1056,15 @@ export async function handleCandidateInternalizationBackfill(opts: CandidateBack
         continue;
       }
 
+      // PRI-442 Stage 4: admission gate check — refuse non-admitted pending
+      // candidates to prevent backfill from bypassing the admission gate.
+      const admissionBlock = checkAdmissionGate(candidate);
+      if (admissionBlock) {
+        output.intakeFailed++;
+        output.results.push({ candidateId, route: 'unknown', status: 'intake_failed', reason: `Admission gate refused: ${admissionBlock.reason}`, statusBefore: 'pending', statusAfter: 'pending', intakeDecision: 'skipped', seedDecision: 'skipped', nextAction: admissionBlock.nextAction });
+        continue;
+      }
+
       const recommendation = resolveCandidateRecommendation(candidate, stateManager, candidateId);
       const decision = decideInternalizationRoute(recommendation as Parameters<typeof decideInternalizationRoute>[0]);
 
@@ -1010,6 +1077,7 @@ export async function handleCandidateInternalizationBackfill(opts: CandidateBack
         continue;
       }
       const seed = buildDreamerSeedFromCandidate(candidate, { route: decision.route, ready: decision.ready, sourcePainId });
+      // eslint-disable-next-line no-restricted-syntax -- 'in' required for discriminated union narrowing (BridgeTaskSeed | BridgeDecision)
       if ('decision' in seed) {
         output.deferred++;
         const decisionResult = seed as { decision: string; reason?: string; taskId?: string };

package/src/commands/console.ts

@@ -72,6 +72,20 @@ export async function handleConsole(opts: ConsoleOptions = {}): Promise<void> {
     return;
   }
 
+  // EP-06 regression guard (PR #1169): verify web UI bundle exists before launch.
+  // Without dist/web/index.html the server returns 404 "Run npm run build:ui first".
+  const webIndex = path.join(consoleDir, 'dist', 'web', 'index.html');
+  if (!fs.existsSync(webIndex)) {
+    const msg = `Console web UI not found at ${webIndex}. The console bundle is corrupted. Re-run installer.`;
+    if (opts.json) {
+      console.log(JSON.stringify({ success: false, reason: msg, nextAction: 'npx create-principles-disciple' }));
+    } else {
+      console.error(msg);
+    }
+    process.exit(1);
+    return;
+  }
+
   const port = opts.port || '3100';
   const host = '127.0.0.1';
   const args = [serverEntry, '--workspace', workspaceDir, '--port', port, '--host', host];
@@ -305,6 +319,32 @@ export async function handleConsoleOpen(opts: ConsoleOpenOptions = {}): Promise<
     return;
   }
 
+  // EP-06 regression guard (PR #1169): verify web UI bundle exists before launch.
+  // Without dist/web/index.html the server returns 404 "Run npm run build:ui first"
+  // — a fatal first-impression bug for new users.
+  const webIndex = path.join(consoleDir, 'dist', 'web', 'index.html');
+  if (!fs.existsSync(webIndex)) {
+    const result: ConsoleLaunchResult = {
+      status: 'failed',
+      url: '',
+      port: 0,
+      host: '127.0.0.1',
+      workspaceDir,
+      reused: false,
+      browserOpened: false,
+      reason: 'console_web_ui_missing',
+      nextAction: `Re-run installer: npx create-principles-disciple (expected ${webIndex})`,
+    };
+    if (opts.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.error(`error: ${result.reason}`);
+      console.error(`next:   ${result.nextAction}`);
+    }
+    process.exit(1);
+    return;
+  }
+
   // 4) Read auth token for health probes (PD_CONSOLE_TOKEN)
   const token = opts.token ?? process.env.PD_CONSOLE_TOKEN;
 

package/src/commands/demo-story-a.ts

@@ -183,8 +183,10 @@ export async function handleDemoStoryA(opts: DemoStoryAOptions): Promise<void> {
     }
 
     if (result.status !== 'passed') {
-      console.error('');
-      console.error(`FAIL: status=${result.status}`);
+      if (!opts.json) {
+        console.error('');
+        console.error(`FAIL: status=${result.status}`);
+      }
       process.exitCode = 1;
     }
   } finally {

package/src/commands/diagnose.ts

@@ -29,13 +29,23 @@ import {
   run as diagnoseRun,
   status as diagnoseStatus,
   PrincipleTreeLedgerAdapter,
+  buildDreamerSeedFromCandidate,
+  CANDIDATE_KIND_TO_ROUTE,
+  ROUTE_CHANNEL_MAP,
+  MVP_ENABLED_CHANNELS,
 } from '@principles/core/runtime-v2';
 import type { PDRuntimeAdapter, OutputLanguage } from '@principles/core/runtime-v2';
 import { resolveWorkspaceDir } from '../resolve-workspace.js';
 import { readOutputLanguageFromWorkspace } from '../config-reader.js';
 import { loadPdConfig, computeFlagsFromLoadResult } from '../services/pd-config-loader.js';
 import { isFeatureEnabled, SPLIT_PIPELINE_TOTAL_TIMEOUT_MS } from '@principles/core/runtime-v2';
+import { createHash } from 'node:crypto';
+/** Layer 0 content-hash (design §6.1); injected so diag writers can attach predecessorSummary hashes. */
+const contentHashFn = (input: string): string => createHash('sha256').update(input).digest('hex');
 import { resolveRuntimeAdapterFromConfig, ConfigResolutionError } from '../services/runtime-adapter-resolver.js';
+import { resolveRuntimeFromPdConfig } from '../services/resolve-runtime-from-pd-config.js';
+import { checkAdmissionGate } from './admission-gate.js';
+import { resolveSourcePainIdFromDiagnostician } from './candidate.js';
 import * as path from 'path';
 
 function validateStalledThreshold(val: unknown): number | undefined {
@@ -198,7 +208,38 @@ export async function handleDiagnoseRun(opts: DiagnoseRunOptions): Promise<void>
     return;
   }
 
-  const runtimeKind = opts.runtime ?? 'test-double';
+  // Resolve runtime kind. P1 fix (mirrors pain-retry.ts): pd diagnose run
+  // must NOT default to test-double. Without --runtime, the split pipeline
+  // would validate the test-double's stale DiagnosticianOutputV1-shaped
+  // payload against DiagRootCauseOutputV1Schema and fail with
+  // max_attempts_exceeded — silently producing failed/fake diagnostic data
+  // in a real workspace. Fall back to .pd/config.yaml first; refuse if
+  // nothing is bound. (rc-9-no-silent-fallback / ERR-002; EP-03, EP-04)
+  let runtimeKind = opts.runtime;
+  if (!runtimeKind) {
+    const resolved = resolveRuntimeFromPdConfig(workspaceDir);
+    if (!isRuntimeConfigError(resolved.result) && resolved.result.runtimeKind) {
+      ({ runtimeKind } = resolved.result);
+    }
+  }
+
+  if (!runtimeKind) {
+    const missingRuntime = {
+      ok: false,
+      reason: 'missing_runtime',
+      message:
+        'No --runtime specified and no .pd/config.yaml runtime binding found. pd diagnose run must not default to test-double to prevent fake data in real workspaces.',
+      nextAction: `Specify --runtime explicitly: pd diagnose run --task-id ${opts.taskId} --runtime pi-ai --provider <provider> --model <model> --apiKeyEnv <ENV>`,
+    };
+    if (opts.json) {
+      console.log(JSON.stringify(missingRuntime, null, 2));
+    } else {
+      console.error(`error: ${missingRuntime.message}`);
+      console.error(`Next action: ${missingRuntime.nextAction}`);
+    }
+    process.exit(1);
+    return;
+  }
 
   const stateManager = new RuntimeStateManager({ workspaceDir });
 
@@ -353,22 +394,37 @@ export async function handleDiagnoseRun(opts: DiagnoseRunOptions): Promise<void>
     const featureFlags = computeFlagsFromLoadResult(configLoadResult);
     const isSplitPipeline = isFeatureEnabled(featureFlags, 'diagnostician_split_pipeline');
     const pipelineTimeoutMs = isSplitPipeline ? SPLIT_PIPELINE_TOTAL_TIMEOUT_MS : 300_000;
+    // BUG-1 (PRI-442): extract effectiveConfig so ADR-0019 LLM rate-limit
+    // degradation (isDegradationEnabled in base-peer-runner) can read the
+    // diagnostician_llm_degradation feature flag. Without this, the runners
+    // receive no effectiveConfig and degradation silently never fires.
+    // CR-1 (CodeRabbit P2, rc-9): warn when config load failed so the
+    // fallback to defaults is observable — no silent degradation.
+    if (!configLoadResult.ok) {
+      const errSummary = configLoadResult.errors
+        .map((e) => `${e.path}: ${e.reason}`)
+        .join('; ');
+      console.warn(
+        `[pd diagnose] .pd/config.yaml at ${configLoadResult.configPath} is malformed — falling back to default feature flags. Errors: ${errSummary}. Next action: ${configLoadResult.errors[0]?.nextAction ?? 'fix config errors and retry'}`,
+      );
+    }
+    const effectiveConfig = configLoadResult.ok ? configLoadResult.effective : configLoadResult.defaults;
 
     let runner: DiagnosticianRunnerLike;
     if (isSplitPipeline) {
       const resolvedKind = typeof runtimeAdapter.kind === 'function' ? runtimeAdapter.kind() : runtimeKind;
       const perStageTimeoutMs = pipelineTimeoutMs / 3;
       const rootCauseRunner = new DiagRootCauseRunner(
-        { stateManager, runtimeAdapter, eventEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultDiagRootCauseValidator(), contextAssembler },
-        { owner: 'pd-cli-diagnose', runtimeKind: resolvedKind, outputLanguage, timeoutMs: perStageTimeoutMs },
+        { stateManager, runtimeAdapter, eventEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultDiagRootCauseValidator(), contextAssembler, contentHashFn },
+        { owner: 'pd-cli-diagnose', runtimeKind: resolvedKind, outputLanguage, timeoutMs: perStageTimeoutMs, effectiveConfig },
       );
       const distillerRunner = new DiagDistillerRunner(
-        { stateManager, runtimeAdapter, eventEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultDiagDistillerValidator() },
-        { owner: 'pd-cli-diagnose', runtimeKind: resolvedKind, outputLanguage, timeoutMs: perStageTimeoutMs },
+        { stateManager, runtimeAdapter, eventEmitter, artifactStore: stateManager.piArtifactStore, validator: new DefaultDiagDistillerValidator(), contentHashFn },
+        { owner: 'pd-cli-diagnose', runtimeKind: resolvedKind, outputLanguage, timeoutMs: perStageTimeoutMs, effectiveConfig },
       );
       const routerRunner = new DiagRouterRunner(
-        { stateManager, runtimeAdapter, eventEmitter, artifactStore: stateManager.piArtifactStore, committer },
-        { owner: 'pd-cli-diagnose', runtimeKind: resolvedKind, outputLanguage, timeoutMs: perStageTimeoutMs },
+        { stateManager, runtimeAdapter, eventEmitter, artifactStore: stateManager.piArtifactStore, committer, contentHashFn },
+        { owner: 'pd-cli-diagnose', runtimeKind: resolvedKind, outputLanguage, timeoutMs: perStageTimeoutMs, effectiveConfig },
       );
 
       runner = new SplitDiagnosticianRunner({
@@ -463,6 +519,23 @@ export async function handleDiagnoseRun(opts: DiagnoseRunOptions): Promise<void>
       const intakeService = new CandidateIntakeService({ stateManager, ledgerAdapter });
 
       for (const candidate of candidates) {
+        // PRI-503: admission gate check — refuse non-admitted candidates before
+        // intake, mirroring candidate.ts (intake/repair/backfill). Without this,
+        // `pd diagnose --intake` could bypass the gate and intake unreviewed
+        // candidates. cli-5-failure-no-mutation: refusal path does not call
+        // intake(), does not update candidate status, does not write ledger.
+        // cli-6-output-next-action: refusal result carries admissionBlock.nextAction.
+        const admissionBlock = checkAdmissionGate(candidate);
+        if (admissionBlock) {
+          intakeFailed = true;
+          intakeResults.push({
+            candidateId: candidate.candidateId,
+            status: 'intake_failed',
+            error: `Admission gate refused: ${admissionBlock.reason}`,
+            nextAction: admissionBlock.nextAction,
+          });
+          continue;
+        }
         try {
           const entry = await intakeService.intake(candidate.candidateId);
           if (candidate.status !== 'consumed') {
@@ -486,11 +559,79 @@ export async function handleDiagnoseRun(opts: DiagnoseRunOptions): Promise<void>
       }
     }
 
+    // Defect-004 fix: seed dreamer task for each consumed candidate whose
+    // recommendation_kind routes to an MVP-enabled internalization channel.
+    // Without this, the chain stops at 'consumed' and never reaches internalization
+    // (11 of 18 consumed candidates hit this in production). Mirrors the pattern
+    // in PainSignalBridge.onDiagnosisComplete (pain-signal-bridge.ts L310-338).
+    //
+    // DEFECT-005 (PRI-514): the dreamer seed loop is gated ONLY by `opts.intake`,
+    // NOT by a global `intakeFailed` flag. A single defer candidate whose intake
+    // is refused by the admission gate must NOT poison dreamer seed for sibling
+    // candidates that were successfully consumed (EP-03 / ERR-089 sibling-branch
+    // defect). Per-candidate eligibility is checked inside the loop via the
+    // intake result's status. `intakeFailed` is retained solely for the
+    // nextAction/exit-code signaling below (partial failure still exits non-zero).
+    if (opts.intake !== false) {
+      for (const candidate of candidates) {
+        const kind = candidate.recommendationKind;
+        if (kind === 'defer' || kind === 'implementation') continue;
+        const intakeResult = intakeResults.find((r) => r.candidateId === candidate.candidateId);
+        if (!intakeResult || intakeResult.status !== 'consumed') continue;
+        try {
+          const route = CANDIDATE_KIND_TO_ROUTE[kind ?? ''];
+          if (!route) continue;
+          const channel = ROUTE_CHANNEL_MAP[route];
+          const ready = !!channel && MVP_ENABLED_CHANNELS.has(channel);
+          // BUG-2 (PRI-442): resolve sourcePainId from the diagnostician task
+          // chain (rc-6 lineage consistency). The candidate itself doesn't carry
+          // sourcePainId; it must be resolved from the diagnostician task's
+          // diagnosticJson. ERR-004: never invent lineage.
+          const sourcePainId = await resolveSourcePainIdFromDiagnostician(stateManager, candidate);
+          const seed = buildDreamerSeedFromCandidate(candidate, { route, ready, sourcePainId: sourcePainId ?? undefined });
+          // eslint-disable-next-line no-restricted-syntax -- 'in' required for discriminated union narrowing (BridgeTaskSeed | BridgeDecision)
+          if ('decision' in seed) continue; // not_internalizable or invalid — skip
+          const existingTask = await stateManager.getTask(seed.taskId);
+          if (!existingTask) {
+            await stateManager.createTask({
+              taskId: seed.taskId,
+              taskKind: seed.taskKind,
+              inputRef: '',
+              status: seed.status,
+              attemptCount: seed.attemptCount,
+              maxAttempts: seed.maxAttempts,
+              diagnosticJson: seed.diagnosticJson,
+            });
+            intakeResults.push({
+              candidateId: candidate.candidateId,
+              status: 'dreamer_seeded',
+              nextAction: `pd task show ${seed.taskId} | pd dreamer run --task-id ${seed.taskId}`,
+            });
+          }
+        } catch (seedErr) {
+          intakeResults.push({
+            candidateId: candidate.candidateId,
+            status: 'dreamer_seed_failed',
+            error: seedErr instanceof Error ? seedErr.message : String(seedErr),
+            nextAction: `pd candidate internalize --candidate-id ${candidate.candidateId}`,
+          });
+        }
+      }
+    }
+
     if (opts.json) {
       const candidateIds = candidates.map((c) => c.candidateId);
-      const internalizeNextAction = candidateIds.length > 0
-        ? `Candidates generated but internalization has NOT started automatically. To begin internalization, run:\n  ${candidateIds.map((id) => `pd candidate internalize --candidate-id ${id} --workspace "${workspaceDir}"`).join('\n  ')}`
-        : 'No candidates were generated from this diagnosis.';
+      // CodeRabbit review fix: reflect dreamer seed status in nextAction so
+      // the owner knows whether internalization has already started or still
+      // needs manual candidate internalize. Previously the message always
+      // said "NOT started automatically" even when dreamer tasks were seeded.
+      const dreamerSeededCount = intakeResults.filter((r) => r.status === 'dreamer_seeded').length;
+      const dreamerSeedFailedCount = intakeResults.filter((r) => r.status === 'dreamer_seed_failed').length;
+      const internalizeNextAction = dreamerSeededCount > 0
+        ? `Dreamer tasks seeded automatically for ${dreamerSeededCount} candidate(s). To continue, run the dreamer tasks shown in intake.candidates[].${dreamerSeedFailedCount > 0 ? ` (${dreamerSeedFailedCount} candidate(s) failed seeding — see intake.candidates[] for retry guidance.)` : ''}`
+        : candidateIds.length > 0
+          ? `Candidates generated but internalization has NOT started automatically. To begin internalization, run:\n  ${candidateIds.map((id) => `pd candidate internalize --candidate-id ${id} --workspace "${workspaceDir}"`).join('\n  ')}`
+          : 'No candidates were generated from this diagnosis.';
       const jsonOutput = {
         ...result,
         intake: {
@@ -534,6 +675,13 @@ export async function handleDiagnoseRun(opts: DiagnoseRunOptions): Promise<void>
         } else if (ir.status === 'intake_failed') {
           console.log(`    ${ir.candidateId}: INTAKE FAILED — ${ir.error}`);
           console.log(`      Next action: pd candidate intake --candidate-id ${ir.candidateId} --workspace "${workspaceDir}"`);
+        } else if (ir.status === 'dreamer_seeded') {
+          // CodeRabbit review fix: surface dreamer seed success in TTY output
+          console.log(`    ${ir.candidateId}: dreamer seeded — ${ir.nextAction}`);
+        } else if (ir.status === 'dreamer_seed_failed') {
+          // CodeRabbit review fix: surface dreamer seed failure in TTY output
+          console.log(`    ${ir.candidateId}: DREAMER SEED FAILED — ${ir.error}`);
+          console.log(`      Next action: ${ir.nextAction}`);
         }
       }
     }