@rafinery/cli 0.6.0 → 0.7.1

package/lib/distill.mjs

@@ -17,7 +17,13 @@
 // Fallback chain when this can't run (no key, no CI): the dev-session flow —
 // /rafa distill <branch> in Claude Code (the bootstrap digest offers it).
 
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -35,27 +41,35 @@ const die = (m) => {
 // A brain-relative path from the platform must stay inside .rafa/ — a row that
 // would escape is refused loudly (never written, never guessed).
 const safeRel = (p) => {
-  if (p.startsWith("/") || p.split("/").includes("..")) die(`unsafe working-set path: ${p}`);
+  if (p.startsWith("/") || p.split("/").includes(".."))
+    die(`unsafe working-set path: ${p}`);
   return p;
 };
 
 // The Agent SDK is deliberately NOT a dependency of this CLI (it is heavy and
-// only CI distillation needs it). Resolution order: normal import → the host
-// repo's node_modules (the workflow installs it with `npm i --no-save`).
+// only CI distillation needs it). Resolution order: $RAFA_AGENT_SDK_DIR (the
+// workflow's ISOLATED install — `npm i` inside the client checkout breaks on
+// pnpm workspaces, "workspace:*" is not an npm protocol) → normal import →
+// the host repo's node_modules.
 async function loadAgentSdk(cwd) {
-  try {
-    return await import("@anthropic-ai/claude-agent-sdk");
-  } catch {
+  const roots = [process.env.RAFA_AGENT_SDK_DIR, null, cwd];
+  for (const root of roots) {
     try {
-      const req = createRequire(join(cwd, "package.json"));
-      return await import(pathToFileURL(req.resolve("@anthropic-ai/claude-agent-sdk")).href);
-    } catch {
-      die(
-        "@anthropic-ai/claude-agent-sdk is not installed — the reconcile workflow runs\n" +
-          "  `npm i --no-save @anthropic-ai/claude-agent-sdk` before this command (see rafa ci-setup).",
+      if (root === null) return await import("@anthropic-ai/claude-agent-sdk");
+      if (!root) continue;
+      const req = createRequire(join(root, "package.json"));
+      return await import(
+        pathToFileURL(req.resolve("@anthropic-ai/claude-agent-sdk")).href
       );
+    } catch {
+      // try the next root
     }
   }
+  die(
+    "@anthropic-ai/claude-agent-sdk is not installed — the reconcile workflow installs it\n" +
+      "  into an isolated dir and points RAFA_AGENT_SDK_DIR at it (see rafa ci-setup;\n" +
+      "  re-run `npx @rafinery/cli ci-setup --overwrite` if your workflow predates this).",
+  );
 }
 
 const VERDICTS = ["distilled", "refuted", "needs-adjudication"];
@@ -76,7 +90,8 @@ export default async function distill(args = []) {
     die(
       "ANTHROPIC_API_KEY is not set — CI distillation runs on the ORG'S OWN LLM key from CI\n" +
         "  secrets (never stored on the rafinery platform). Add the secret (rafa ci-setup names\n" +
-        "  it), or fall back to the dev session: /rafa distill " + branch,
+        "  it), or fall back to the dev session: /rafa distill " +
+        branch,
     );
 
   const ROOT = process.cwd();
@@ -90,10 +105,16 @@ export default async function distill(args = []) {
   console.log(`• collecting working set for ${branch} …`);
   let active, flagged;
   try {
-    active = (await callTool(ROOT, "get_working_set", { branch, status: "active" })).files ?? [];
-    flagged =
-      (await callTool(ROOT, "get_working_set", { branch, status: "needs-adjudication" }))
+    active =
+      (await callTool(ROOT, "get_working_set", { branch, status: "active" }))
         .files ?? [];
+    flagged =
+      (
+        await callTool(ROOT, "get_working_set", {
+          branch,
+          status: "needs-adjudication",
+        })
+      ).files ?? [];
   } catch (e) {
     die(e instanceof Error ? e.message : String(e));
   }
@@ -131,7 +152,9 @@ export default async function distill(args = []) {
 
   // 4 · the judgment pass (org's own key; gates stay deterministic below).
   const sdk = await loadAgentSdk(ROOT);
-  const fileList = active.map((f) => `- ${f.path} (author: ${f.lastAuthor})`).join("\n");
+  const fileList = active
+    .map((f) => `- ${f.path} (author: ${f.lastAuthor})`)
+    .join("\n");
   const prompt = `You are running rafa's CI DISTILLATION — merge-time reconciliation of branch "${branch}"'s
 working set into the org brain. The checked-out repo IS merged main (the ground truth).
 The current org brain is mirrored at .rafa/brain/. The incoming candidate-grade files are
@@ -162,7 +185,9 @@ with EXACTLY one entry per staged file listed below. Do not modify anything outs
 Staged files:
 ${fileList}`;
 
-  console.log("• running the distillation agent (org's own ANTHROPIC_API_KEY) …");
+  console.log(
+    "• running the distillation agent (org's own ANTHROPIC_API_KEY) …",
+  );
   const tAgent = Date.now();
   const run = sdk.query({
     prompt,
@@ -179,7 +204,10 @@ ${fileList}`;
   let lastLine = "";
   let agentModel = "unreported";
   for await (const message of run) {
-    if (message.type === "assistant" && typeof message.message?.model === "string")
+    if (
+      message.type === "assistant" &&
+      typeof message.message?.model === "string"
+    )
       agentModel = message.message.model;
     if (message.type === "assistant") {
       const blocks = message.message?.content ?? [];
@@ -194,7 +222,9 @@ ${fileList}`;
     }
     if (message.type === "result") {
       if (message.subtype !== "success")
-        die(`distillation agent did not complete (${message.subtype}) — nothing resolved, nothing pushed`);
+        die(
+          `distillation agent did not complete (${message.subtype}) — nothing resolved, nothing pushed`,
+        );
       console.log(
         `  ⏱ agent: ${secs(tAgent)}s (${message.num_turns ?? "?"} turns · ` +
           `$${(message.total_cost_usd ?? 0).toFixed(4)} on the org's key)`,
@@ -206,32 +236,46 @@ ${fileList}`;
           model: agentModel,
           inputTokens: message.usage?.input_tokens ?? 0,
           outputTokens: message.usage?.output_tokens ?? 0,
-          ...(typeof message.total_cost_usd === "number" ? { costUsd: message.total_cost_usd } : {}),
+          ...(typeof message.total_cost_usd === "number"
+            ? { costUsd: message.total_cost_usd }
+            : {}),
           purpose: "distill",
           runner: "ci",
         });
       } catch (e) {
-        console.log(`  ! usage not reported: ${e instanceof Error ? e.message : e}`);
+        console.log(
+          `  ! usage not reported: ${e instanceof Error ? e.message : e}`,
+        );
       }
     }
   }
 
   // 5 · verdicts must be complete — a missing entry is a hard stop, never a guess.
   if (!existsSync(verdictsPath))
-    die("agent produced no .rafa/distill-verdicts.json — nothing resolved, nothing pushed; working set left intact");
+    die(
+      "agent produced no .rafa/distill-verdicts.json — nothing resolved, nothing pushed; working set left intact",
+    );
   let verdicts;
   try {
     verdicts = JSON.parse(readFileSync(verdictsPath, "utf8")).verdicts;
   } catch {
-    die("distill-verdicts.json is not valid JSON — nothing resolved, nothing pushed");
+    die(
+      "distill-verdicts.json is not valid JSON — nothing resolved, nothing pushed",
+    );
   }
-  if (!Array.isArray(verdicts)) die("distill-verdicts.json has no verdicts[] — aborting");
+  if (!Array.isArray(verdicts))
+    die("distill-verdicts.json has no verdicts[] — aborting");
   const byPath = new Map(verdicts.map((v) => [v.path, v]));
   for (const f of active) {
     const v = byPath.get(f.path);
     if (!v || !VERDICTS.includes(v.verdict))
-      die(`no valid verdict for ${f.path} — nothing resolved, nothing pushed; working set left intact`);
-    if (v.verdict !== "distilled" && (typeof v.note !== "string" || v.note.trim() === ""))
+      die(
+        `no valid verdict for ${f.path} — nothing resolved, nothing pushed; working set left intact`,
+      );
+    if (
+      v.verdict !== "distilled" &&
+      (typeof v.note !== "string" || v.note.trim() === "")
+    )
       die(`${f.path}: verdict "${v.verdict}" requires a cited note — aborting`);
   }
 
@@ -239,14 +283,20 @@ ${fileList}`;
   console.log("• re-running the gates (trust-but-verify) …");
   const tGates = Date.now();
   if (runVerifyCitations([]) !== 0)
-    die("citation checker failed on the authored brain — nothing resolved, nothing pushed");
+    die(
+      "citation checker failed on the authored brain — nothing resolved, nothing pushed",
+    );
   if (runCompile([]) !== 0)
-    die("compile gate failed on the authored brain — nothing resolved, nothing pushed");
+    die(
+      "compile gate failed on the authored brain — nothing resolved, nothing pushed",
+    );
   console.log(`  ⏱ gates: ${secs(tGates)}s`);
 
   // 7 · ship: brain repo push (webhook → ingest), staging cleaned first.
   rmSync(stagingRoot, { recursive: true, force: true });
-  const distilledCount = active.filter((f) => byPath.get(f.path).verdict === "distilled").length;
+  const distilledCount = active.filter(
+    (f) => byPath.get(f.path).verdict === "distilled",
+  ).length;
   if (distilledCount > 0) {
     await push([]);
   } else {
@@ -268,9 +318,13 @@ ${fileList}`;
         actorMeta: { agent: "rafa-distill", runner: "ci", model: agentModel },
         ...(v.note ? { note: v.note } : {}),
       });
-      console.log(`  ${v.verdict === "distilled" ? "✓" : "!"} ${f.path} → ${v.verdict}${v.note ? ` (${v.note})` : ""}`);
+      console.log(
+        `  ${v.verdict === "distilled" ? "✓" : "!"} ${f.path} → ${v.verdict}${v.note ? ` (${v.note})` : ""}`,
+      );
     } catch (e) {
-      console.log(`  ✗ ${f.path} — resolve failed: ${e instanceof Error ? e.message : e}`);
+      console.log(
+        `  ✗ ${f.path} — resolve failed: ${e instanceof Error ? e.message : e}`,
+      );
     }
   }
   rmSync(verdictsPath, { force: true });