@quikit/quikpilot-runner 8.2.7 → 8.2.8

package/dist/index.js

@@ -73,10 +73,11 @@ async function describeQuikTrackFailure(res) {
 
 // src/callback.ts
 async function reportBack(params) {
-  const { callbackUrl, runToken, status, branch, warnings, targeting, baselineFindings } = params;
+  const { callbackUrl, runToken, status, branch, warnings, targeting, baselineFindings, unresolved } = params;
   const body = { status };
   if (branch) body.branch = branch;
   if (warnings && warnings.length > 0) body.warnings = warnings;
+  if (unresolved && unresolved.length > 0) body.unresolved = unresolved;
   if (targeting) body.targeting = targeting;
   if (baselineFindings) body.baselineFindings = baselineFindings;
   const res = await fetch(callbackUrl, {
@@ -250,6 +251,16 @@ function findDeniedContextPath(contextPaths, patterns) {
   return null;
 }
 
+// src/runtimeReplyError.ts
+var RuntimeReplyError = class extends Error {
+  summary;
+  constructor(message, summary) {
+    super(message);
+    this.name = "RuntimeReplyError";
+    this.summary = summary;
+  }
+};
+
 // src/envelope.ts
 var HARD_FAILURE_CODES = /* @__PURE__ */ new Set(["SEMANTIC_MISMATCH", "CONTRACT_REJECTED"]);
 function checkHardFailure(envelope, useCase, target) {
@@ -257,17 +268,25 @@ function checkHardFailure(envelope, useCase, target) {
   if (typeof code === "string" && HARD_FAILURE_CODES.has(code)) {
     const detail = envelope.error ?? envelope.normalizedText ?? "no detail";
     const where = target ? ` for ${target}` : "";
-    throw new Error(`${useCase} failed${where} (${code}, not retried): ${detail}`);
+    throw new RuntimeReplyError(
+      `${useCase} failed${where} (${code}, not retried): ${detail}`,
+      `${useCase} failed${where} (${code}, not retried)`
+    );
   }
 }
 function unwrapExecute(envelope, useCase) {
   if (envelope?.success === false) {
-    throw new Error(
-      `${useCase} failed: ${envelope.errorCode ?? "UNKNOWN"} \u2014 ${envelope.error ?? envelope.normalizedText ?? "no message"}`
+    const code = envelope.errorCode ?? "UNKNOWN";
+    throw new RuntimeReplyError(
+      `${useCase} failed: ${code} \u2014 ${envelope.error ?? envelope.normalizedText ?? "no message"}`,
+      `${useCase} failed: ${code}`
     );
   }
   if (!envelope?.structuredJson || typeof envelope.structuredJson !== "object") {
-    throw new Error(`${useCase} returned no structuredJson: ${JSON.stringify(envelope)}`);
+    throw new RuntimeReplyError(
+      `${useCase} returned no structuredJson: ${JSON.stringify(envelope)}`,
+      `${useCase} returned no structuredJson`
+    );
   }
   return envelope.structuredJson;
 }
@@ -419,7 +438,7 @@ function narrowJudgedByForTarget(pool, targets, codeTargetPath) {
 function toWireJudgedBy(pool) {
   return pool.map(({ automationId: _automationId, ...rest }) => rest);
 }
-async function runCodegen(gateway, targets, workspaceListing, requiredTests, deniedPaths, judgedByPool, warnings, contextLog) {
+async function runCodegen(gateway, targets, workspaceListing, requiredTests, deniedPaths, judgedByPool, warnings, contextLog, outOfScope = []) {
   const results = [];
   const listing = new Set(workspaceListing);
   for (const target of targets) {
@@ -468,6 +487,9 @@ async function runCodegen(gateway, targets, workspaceListing, requiredTests, den
     if (deniedPaths.length > 0) {
       contextData.deniedPaths = deniedPaths;
     }
+    if (outOfScope.length > 0) {
+      contextData.outOfScope = outOfScope;
+    }
     if (target.automationIds && target.automationIds.length > 0) {
       const wanted = new Set(target.automationIds);
       contextData.requiredTests = requiredTests.filter((tc) => wanted.has(tc.automationId));
@@ -521,16 +543,23 @@ async function runCodegen(gateway, targets, workspaceListing, requiredTests, den
     }
     if (typeof envelope?.errorCode === "string" && NOT_RETRIED_CODES.has(envelope.errorCode)) {
       const detail = envelope.error ? `: ${envelope.error}` : "";
-      throw new Error(`Codegen refused ${target.path}: ${envelope.errorCode} (not retried)${detail}`);
+      throw new RuntimeReplyError(
+        `Codegen refused ${target.path}: ${envelope.errorCode} (not retried)${detail}`,
+        `Codegen refused ${target.path}: ${envelope.errorCode} (not retried)`
+      );
     }
     if (envelope?.errorCode === JUDGED_BY_TOO_LARGE_CODE) {
       const detail = envelope.error ? `: ${envelope.error}` : "";
-      throw new Error(`Codegen refused ${target.path}: ${envelope.errorCode} (after narrowing)${detail}`);
+      throw new RuntimeReplyError(
+        `Codegen refused ${target.path}: ${envelope.errorCode} (after narrowing)${detail}`,
+        `Codegen refused ${target.path}: ${envelope.errorCode} (after narrowing)`
+      );
     }
     const body = unwrapExecute(envelope, "pilot.codegen");
     if (body.outcome !== "GENERATED" || typeof body.newContent !== "string") {
-      throw new Error(
-        `Codegen refused ${target.path}${body.refusalReason ? `: ${body.refusalReason}` : ""}`
+      throw new RuntimeReplyError(
+        `Codegen refused ${target.path}${body.refusalReason ? `: ${body.refusalReason}` : ""}`,
+        `Codegen refused ${target.path}`
       );
     }
     if (!isNewFile) {
@@ -1360,6 +1389,36 @@ async function runBaselineCheck(params) {
   }
 }
 
+// src/failureReason.ts
+var MAX_FAILURE_REASON = 1e3;
+var MIN_SECRET_LENGTH = 8;
+var CREDENTIAL_PATTERNS = [
+  /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+  /x-access-token:[^@\s'"]+/gi,
+  // Only the header form ("Authorization: basic <token>"), or a bearer value that contains a digit: a bare
+  // "basic authentication" or "bearer of the news" is prose, not a credential.
+  /\bauthorization:\s*(?:basic|bearer|token)\s+[^\s'"]{8,}/gi,
+  /\bbearer\s+(?=[A-Za-z0-9._~+/=-]*\d)[A-Za-z0-9._~+/=-]{12,}/gi,
+  // A signed JWT is three dot-separated segments; QuikPilot's own run token is an encrypted JWT (alg dir) of five, the
+  // second one empty. The run token is also matched by exact value, but one that has expired or rotated is not the
+  // current value, so its shape has to catch it.
+  /\beyJ[A-Za-z0-9_-]{8,}(?:\.[A-Za-z0-9_-]*){2,4}/g
+];
+function failureSummary(err) {
+  if (err instanceof RuntimeReplyError) return err.summary;
+  return err instanceof Error ? err.message : String(err);
+}
+function describeFailureReason(message, secrets = []) {
+  let text = message;
+  for (const secret of secrets) {
+    if (secret.length >= MIN_SECRET_LENGTH) text = text.split(secret).join("***");
+  }
+  for (const pattern of CREDENTIAL_PATTERNS) text = text.replace(pattern, "***");
+  text = text.replace(/\s*\n\s*/g, " | ").trim();
+  return text.length > MAX_FAILURE_REASON ? `${text.slice(0, MAX_FAILURE_REASON)}\u2026` : text;
+}
+
 // src/scopeCheck.ts
 var import_node_fs7 = require("node:fs");
 var ROUTE_METHOD_RE = /\b(GET|POST|PUT|PATCH|DELETE)\b/i;
@@ -1474,7 +1533,7 @@ function validateTarget(target, workspaceRoot, workspaceListing, deniedPaths) {
     );
   }
 }
-async function runTargeting(gateway, design, workspaceRoot, workspaceListing, requiredTests, deniedPaths, testDiscovery) {
+async function runTargeting(gateway, design, workspaceRoot, workspaceListing, requiredTests, deniedPaths, testDiscovery, outOfScope = []) {
   const contextData = {
     // NESTED, NOT FLATTENED — a second vocabulary for the design shape is exactly what
     // QUIKTR-1034 cost.
@@ -1489,6 +1548,9 @@ async function runTargeting(gateway, design, workspaceRoot, workspaceListing, re
   if (deniedPaths.length > 0) {
     contextData.deniedPaths = deniedPaths;
   }
+  if (outOfScope.length > 0) {
+    contextData.outOfScope = outOfScope;
+  }
   contextData.testDiscovery = testDiscovery;
   const res = await fetchWithRetry(`${gateway.baseUrl}/ai/execute`, {
     method: "POST",
@@ -1511,7 +1573,10 @@ async function runTargeting(gateway, design, workspaceRoot, workspaceListing, re
     return { outcome: "NO_TARGET", reason: body.noTargetReason ?? null };
   }
   if (body.outcome !== "TARGETED" || !Array.isArray(body.targets)) {
-    throw new Error(`pilot.targeting returned an unexpected shape: ${JSON.stringify(body)}`);
+    throw new RuntimeReplyError(
+      `pilot.targeting returned an unexpected shape: ${JSON.stringify(body)}`,
+      "pilot.targeting returned an unexpected shape"
+    );
   }
   const listing = new Set(workspaceListing);
   for (const target of body.targets) {
@@ -1690,6 +1755,13 @@ async function run(env2) {
   let branch;
   let runToken;
   const warnings = [];
+  const failureReasons = [];
+  const recordFailure = (err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    console.error(message);
+    const reason = describeFailureReason(failureSummary(err), runToken ? [runToken] : []);
+    if (reason) failureReasons.push(reason);
+  };
   let targeted = false;
   let generatedFilePaths = [];
   let targetingResult;
@@ -1700,6 +1772,7 @@ async function run(env2) {
     packet = await fetchPacket(env2.packetUrl, runToken, env2.githubRunId);
     checkoutTargetBranch(packet.targetBranch);
     const workspaceListing = listWorkspaceFiles(packet.workspaceRoot);
+    const outOfScope = (packet.outOfScope ?? []).map((entry) => entry.trim()).filter((entry) => entry.length > 0);
     const targeting = await runTargeting(
       packet.gateway,
       packet.design,
@@ -1707,7 +1780,8 @@ async function run(env2) {
       workspaceListing,
       packet.requiredTests,
       packet.guardrails.deniedPaths,
-      packet.testDiscovery
+      packet.testDiscovery,
+      outOfScope
     );
     targetingResult = targeting;
     if (targeting.outcome === "NO_TARGET") {
@@ -1755,7 +1829,8 @@ async function run(env2) {
           packet.guardrails.deniedPaths,
           judgedByPool,
           warnings,
-          contextLog
+          contextLog,
+          outOfScope
         )
       ]);
       const depCheck = checkImportDependencies(
@@ -1818,7 +1893,7 @@ async function run(env2) {
     }
   } catch (err) {
     hardFailure = true;
-    console.error(err instanceof Error ? err.message : String(err));
+    recordFailure(err);
   }
   if (!runToken) {
     console.error("No run token \u2014 the OIDC exchange failed before QuikTrack could be reached.");
@@ -1855,7 +1930,7 @@ async function run(env2) {
       branch = result.branch;
     } catch (err) {
       hardFailure = true;
-      console.error(err instanceof Error ? err.message : String(err));
+      recordFailure(err);
     }
   }
   await reportBack({
@@ -1866,7 +1941,8 @@ async function run(env2) {
     warnings,
     // Omitted when targeting itself never produced a result (nothing exists to record).
     targeting: targetingResult ? buildTargetingRecord(targetingResult, contextLog) : void 0,
-    baselineFindings
+    baselineFindings,
+    unresolved: failureReasons.length > 0 ? failureReasons : void 0
   });
   return { hardFailure };
 }