@rsaglobaltech/specgate 0.27.5 → 0.27.8

package/dist/scripts/cli/commands/harness/RunCommand.js

@@ -58,6 +58,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RunCommand = exports.RUNS_DIR = void 0;
+exports.promptInFlight = promptInFlight;
 exports.setJsonMode = setJsonMode;
 exports.error = error;
 exports.parseArgs = parseArgs;
@@ -78,6 +79,7 @@ const node_child_process_1 = require("node:child_process");
 const command_1 = require("../../../lib/command");
 const project_root_1 = require("../../../lib/project-root");
 const prompt_1 = require("../../../harness/prompt");
+const agent_permission_1 = require("../../../lib/agent-permission");
 const init_1 = require("../../../harness/init");
 const in_flight_1 = require("../../../lib/in-flight");
 const harness_events_1 = require("../../../lib/harness-events");
@@ -101,6 +103,17 @@ function judged(dir, read) {
             view.cleanup();
     }
 }
+/**
+ * A prompt built from the project as the harness judges it (REQ-268).
+ *
+ * The implementer's prompt was; the reviewer's and the adversary's read the
+ * worktree as written, where a reviewed draft's requirement has no text, and
+ * the reviewer was told to stop and report that REQ-002 did not exist
+ * (truck-flote, S53).
+ */
+function promptInFlight(req, dir, opts = {}) {
+    return judged(dir, (judgedDir) => (0, prompt_1.buildPrompt)(req, judgedDir, opts));
+}
 const GherkinQuality_1 = require("../../../../packages/core/src/domain/GherkinQuality");
 const HarnessConfigFile_1 = require("../../../../packages/core/src/infrastructure/HarnessConfigFile");
 const agent_1 = require("../../../lib/agent");
@@ -492,6 +505,41 @@ function baselineProblem(projectDir, running) {
         "test. Write those tests or move those requirements back to Draft (`specgate check` shows " +
         "it whole), or pass --skip-baseline.");
 }
+/** "0.4 s", "12 s", "3m 05s": how long a gate step took. */
+function stepTime(ms) {
+    if (ms < 10_000)
+        return `${(ms / 1000).toFixed(1)} s`;
+    const secs = Math.round(ms / 1000);
+    if (secs < 60)
+        return `${secs} s`;
+    return `${Math.floor(secs / 60)}m ${String(secs % 60).padStart(2, "0")}s`;
+}
+/**
+ * REQ-273: a gate step is an event when it starts and when it ends, and a line
+ * of the run's output each time. A check that hung for 15 minutes printed
+ * nothing and showed nothing in `/live` until it ended (truck-flote, S54).
+ */
+function gateReporter(eventsFile, requirement, attempt, prefix = "") {
+    return (stage, result, extra) => {
+        const named = `${prefix}${stage}`;
+        // The line names the test step, not its command: what the command prints
+        // stays off a green run's output unless `--verbose` asks for it.
+        const shown = named.replace(/^((?:post-merge )?test command): [\s\S]*$/, "$1");
+        if (result === "start") {
+            (0, harness_events_1.appendEvent)(eventsFile, { type: "gate-start", stage: named, ...(extra || {}) }, requirement, attempt);
+            const where = extra && extra.image
+                ? ` (${extra.runner} ${extra.image})`
+                : extra && extra.runner
+                    ? ` (${extra.runner})`
+                    : "";
+            info(`${requirement}: started ${shown}${where}`);
+            return;
+        }
+        (0, harness_events_1.appendEvent)(eventsFile, { type: "gate", stage: named, result, ...(extra || {}) }, requirement, attempt);
+        const ms = extra && typeof extra.ms === "number" ? ` in ${stepTime(extra.ms)}` : "";
+        info(`${requirement}: ${result === "pass" ? "passed" : "failed"} ${shown}${ms}`);
+    };
+}
 function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, report = () => { }) {
     // `--delivering`: the requirement is still Draft while its gate runs, and a
     // Draft row owes no files. Without it the gate would skip the one
@@ -500,6 +548,8 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
     // the gate judges the attempt, not the matrix as it was before it.
     (0, MatrixCommand_1.refreshDerivedMatrix)(worktreeDir);
     let passHint = "";
+    report("validate --strict", "start");
+    const validateStart = Date.now();
     const validate = judged(worktreeDir, (dir, toProject) => {
         const validateArgs = [VALIDATE_SCRIPT, dir, "--strict"];
         if (req.requirement)
@@ -512,7 +562,9 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
         // The agent is told about its worktree, not about the copy it was judged in.
         return { ...run, stdout: toProject(run.stdout || ""), stderr: toProject(run.stderr || "") };
     });
-    report("validate --strict", validate.status === 0 ? "pass" : "fail");
+    report("validate --strict", validate.status === 0 ? "pass" : "fail", {
+        ms: Date.now() - validateStart,
+    });
     if (validate.status !== 0) {
         return {
             ok: false,
@@ -524,8 +576,10 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
     // REQ-199: a requirement used on a screen needs an end-to-end test that
     // names it, when the project says where those live.
     if (settings.e2eDir && req.requirement && (0, screen_requirements_1.onScreen)(worktreeDir, req.requirement)) {
+        report("e2e test", "start");
+        const e2eStart = Date.now();
         const named = (0, screen_requirements_1.e2eTestsNaming)(worktreeDir, settings.e2eDir, req.requirement);
-        report("e2e test", named.length ? "pass" : "fail");
+        report("e2e test", named.length ? "pass" : "fail", { ms: Date.now() - e2eStart });
         if (named.length === 0) {
             return {
                 ok: false,
@@ -540,6 +594,8 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
     // and its failure goes back to the agent like any other gate failure.
     const archCmd = String(settings.archCmd || "").trim();
     if (archCmd) {
+        report(`architecture check: ${archCmd}`, "start");
+        const archStart = Date.now();
         // REQ-231: with arch_sarif, only a violation this attempt adds fails it.
         const arch = settings.archSarif
             ? (0, quality_run_1.archRun)(worktreeDir, archCmd, settings.archSarif, "", req.requirement || "")
@@ -550,7 +606,9 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
                 timeout: timeoutMs,
                 maxBuffer: SUBPROCESS_MAX_BUFFER,
             });
-        report(`architecture check: ${archCmd}`, arch.status === 0 ? "pass" : "fail");
+        report(`architecture check: ${archCmd}`, arch.status === 0 ? "pass" : "fail", {
+            ms: Date.now() - archStart,
+        });
         if (arch.status !== 0) {
             return {
                 ok: false,
@@ -587,6 +645,8 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
         // Stderr rather than inherited stdout, because `--format json` promises one
         // parseable document on stdout. Letting the test command write there is
         // precisely H18: prose and JSON sharing a stream.
+        report(`test command: ${(0, HarnessEvents_1.maskCommand)(resolved)}`, "start");
+        const testStart = Date.now();
         const test = (0, node_child_process_1.spawnSync)((0, shell_command_1.forShell)(resolved), {
             shell: true,
             cwd: worktreeDir,
@@ -595,7 +655,10 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
             maxBuffer: SUBPROCESS_MAX_BUFFER,
             stdio: settings.verbose ? ["ignore", 2, 2] : undefined,
         });
-        report(`test command: ${(0, HarnessEvents_1.maskCommand)(resolved)}`, test.status === 0 ? "pass" : "fail", (0, HarnessEvents_1.testCounts)(`${test.stdout || ""}${test.stderr || ""}`));
+        report(`test command: ${(0, HarnessEvents_1.maskCommand)(resolved)}`, test.status === 0 ? "pass" : "fail", {
+            ...(0, HarnessEvents_1.testCounts)(`${test.stdout || ""}${test.stderr || ""}`),
+            ms: Date.now() - testStart,
+        });
         if (test.status !== 0) {
             // Name the command. A gate that silently does the wrong thing — running
             // the whole suite because a filter did not apply, say — produces a
@@ -642,8 +705,14 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
         const ctx = (0, quality_run_1.gateContext)(worktreeDir, req.requirement || "", "");
         const outcomes = [];
         for (const stage of ["attempt", "end"]) {
-            for (const o of (0, quality_run_1.runStages)(worktreeDir, quality, [stage], ctx, undefined, agentChecks(worktreeDir, req, settings, timeoutMs, testCmd))) {
-                outcomes.push(o);
+            // REQ-273: each check is reported as it starts and as it ends — the
+            // stage used to run every check before the first was reported.
+            const asItRuns = (check, run) => {
+                report(`quality: ${check.name}`, "start", {
+                    runner: check.runner,
+                    ...(check.image ? { image: check.image } : {}),
+                });
+                const o = run();
                 // REQ-229: the step says what was measured, so /live shows it as it happens.
                 const said = o.skipped
                     ? " (not run)"
@@ -657,6 +726,20 @@ function runGate(worktreeDir, testCmd, timeoutMs, req = {}, settings = {}, repor
                     ...(o.skipped ? { skipped: o.skipped } : {}),
                     ...(o.measure ? { value: o.measure.value } : {}),
                 });
+                return o;
+            };
+            for (const o of (0, quality_run_1.runStages)(worktreeDir, quality, [stage], ctx, asItRuns, agentChecks(worktreeDir, req, settings, timeoutMs, testCmd))) {
+                outcomes.push(o);
+                // REQ-267: a check that could not run is not the agent's to fix.
+                if (o.gate && !o.ok && !o.skipped && o.couldNotRun) {
+                    return {
+                        ok: false,
+                        stage: `quality check: ${o.name}`,
+                        output: o.output,
+                        couldNotRun: `the quality check ${o.name} could not run: it ${o.couldNotRun}`,
+                        checks: outcomes,
+                    };
+                }
                 if (o.gate && !o.ok && !o.skipped) {
                     return {
                         ok: false,
@@ -790,7 +873,7 @@ function agentChecks(worktreeDir, req, settings, timeoutMs, testCmd) {
             return settings.agent || "";
         }
     };
-    const promptFor = (instruction) => (0, prompt_1.buildPrompt)(req, worktreeDir, {
+    const promptFor = (instruction) => promptInFlight(req, worktreeDir, {
         promptPrefix: settings.promptPrefix,
         hint: instruction,
         withPrecedents: settings.promptPrecedents === true,
@@ -1189,6 +1272,7 @@ function attemptRequirement(req, ctx) {
                 totalMs: Date.now() - attemptStart,
                 profiles: [...profilesUsed],
             });
+            ledgerAttempts(attemptLog);
         };
         // An attempt is a sequence of agent invocations, all bound to this one
         // requirement. Attempt 1 is a single implementing step; a retry may run an
@@ -1330,17 +1414,21 @@ function attemptRequirement(req, ctx) {
         }
         // Before the gate: an agent that wrote nothing cannot have implemented
         // anything, and the gate would approve it. See `producedNothing` (H19).
+        // REQ-264: the same command writes nothing the next time either — three
+        // attempts and 7 min 40 s said so in truck-flote (S50) — so it ends here.
         if (producedNothing(worktreeDir)) {
             previousFailure =
                 `You produced no files. Nothing in the worktree changed, so there is ` +
                     `nothing implementing ${req.requirement}.\n\n` +
                     `If you could not write, that is the problem to report — a non-interactive ` +
                     `agent without tool permissions reads the prompt and cannot act on it. ` +
-                    `See docs/automation.md.`;
+                    `See docs/agent-setup.md, § Tool allowances.`;
             warn(`${req.requirement}: the agent produced no files — nothing to gate`);
-            warn(`  fix: check the agent's write permissions (see docs/automation.md)`);
+            warn(`  fix: give the agent write permission and the tools it needs (docs/agent-setup.md, § Tool allowances)`);
+            warn(`  not retrying: the same command would write nothing again`);
             record("no-op");
-            continue;
+            stopRetrying = true;
+            break;
         }
         // Before the gate: a scenario the agent has just loosened cannot fail, so a
         // green gate proves nothing. See `checkWriteScopeInWorktree`.
@@ -1365,7 +1453,19 @@ function attemptRequirement(req, ctx) {
         }
         // `verbose` is a run flag, not a project setting, so it travels on the
         // context rather than in `harness.config.yaml`.
-        const gate = runGate(worktreeDir, settings.testCmd, timeoutMs, req, { ...settings, verbose: ctx.verbose }, (stage, result, extra) => event({ type: "gate", stage, result, ...(extra || {}) }));
+        const gate = runGate(worktreeDir, settings.testCmd, timeoutMs, req, { ...settings, verbose: ctx.verbose }, gateReporter(eventsFile, req.requirement, attempt));
+        if (!gate.ok && gate.couldNotRun) {
+            // REQ-267: nothing in the code can fix the tool's own setup, and another
+            // attempt would meet it again (truck-flote S52: 15 minutes each).
+            previousFailure = `Gate stopped at: ${gate.stage}\n\n${gate.couldNotRun}\n\n${gate.output}`;
+            warn(`${req.requirement}: ${gate.couldNotRun}`);
+            for (const line of gate.output.trim().split("\n").slice(-5))
+                warn(`  ${line}`);
+            warn(`  not retrying: fix the check (harness.config.yaml) and run it again`);
+            record("check");
+            stopRetrying = true;
+            break;
+        }
         if (!gate.ok) {
             previousFailure =
                 `Gate failed at: ${gate.stage}\n\n` + (gate.hint ? `⚠ ${gate.hint}\n\n` : "") + gate.output;
@@ -1444,7 +1544,7 @@ function attemptRequirement(req, ctx) {
             alreadyProbed: probe.ran,
         })) {
             info(`${req.requirement}: probing with '${settings.adversaryProfile}'`);
-            probe = runAdversarialProbe(worktreeDir, req, settings, timeoutMs, (instruction) => (0, prompt_1.buildPrompt)(req, worktreeDir, {
+            probe = runAdversarialProbe(worktreeDir, req, settings, timeoutMs, (instruction) => promptInFlight(req, worktreeDir, {
                 promptPrefix: settings.promptPrefix,
                 hint: instruction,
                 withPrecedents: settings.promptPrecedents === true,
@@ -1540,6 +1640,28 @@ function recordQuestions(projectDir, results) {
 }
 /** Where a run's record lands. Local to the machine — see `writeRunRecord`. */
 exports.RUNS_DIR = path.join(".harness", "runs");
+/**
+ * The run's record, written as it goes (REQ-269).
+ *
+ * It used to be written once, at the end, so a run stopped by hand — the
+ * 27 minutes truck-flote spent on semgrep hanging (S52) — left no trace, and
+ * `harness report` priced the requirement without them. Now it is written when
+ * each requirement starts and each attempt ends; a killed run leaves a record
+ * whose `running` says where it stopped.
+ */
+let ledger = null;
+function ledgerWrite() {
+    if (!ledger)
+        return;
+    ledger.record.updatedAt = new Date().toISOString();
+    writeRunRecord(ledger.projectDir, ledger.record);
+}
+function ledgerAttempts(attemptLog) {
+    if (!ledger || !ledger.record.running)
+        return;
+    ledger.record.running.attemptLog = [...attemptLog];
+    ledgerWrite();
+}
 /**
  * Write what a run did, so the next question about it has an answer.
  *
@@ -1922,6 +2044,23 @@ function gitIdentityProblem(projectDir) {
         `Fix: git config user.name "Your Name" && git config user.email "you@example.com"`);
 }
 function processRequirement(req, ctx) {
+    if (ledger) {
+        ledger.record.running = {
+            requirement: req.requirement,
+            startedAt: new Date().toISOString(),
+            attemptLog: [],
+        };
+        ledgerWrite();
+    }
+    const result = processOneRequirement(req, ctx);
+    if (ledger) {
+        ledger.record.results.push(result);
+        delete ledger.record.running;
+        ledgerWrite();
+    }
+    return result;
+}
+function processOneRequirement(req, ctx) {
     const { projectDir, baseRef, keepWorktrees, force } = ctx;
     const branch = `harness/${req.requirement}`;
     // D1: which profile this requirement matches, resolved once. The bounded
@@ -2049,8 +2188,13 @@ function processRequirement(req, ctx) {
     try {
         const setupCmd = String((ctx.settings && ctx.settings.setupCmd) || "").trim();
         if (setupCmd && !survivor) {
-            info(`${req.requirement}: setup — ${setupCmd}`);
+            const report = gateReporter((0, harness_events_1.eventsFileFor)(ctx.projectDir || dir, req.requirement), req.requirement, undefined);
+            report(`setup: ${setupCmd}`, "start");
+            const setupStart = Date.now();
             const setup = (0, node_child_process_1.spawnSync)((0, shell_command_1.forShell)(setupCmd), { cwd: dir, shell: true, encoding: "utf8" });
+            report(`setup: ${setupCmd}`, setup.status === 0 ? "pass" : "fail", {
+                ms: Date.now() - setupStart,
+            });
             if (setup.status !== 0) {
                 return {
                     requirement: req.requirement,
@@ -2382,7 +2526,7 @@ async function runChain(pending, ctx, hintByReq) {
         (0, harness_events_1.appendEvent)(eventsFile, { type: "merge", into: "HEAD", branch }, req.requirement, attempt);
         const gate = runGate(projectDir, ctx.settings.testCmd, ctx.timeoutMs, req, 
         // The checks judged the branch already; the post-merge gate is the suite's.
-        { ...ctx.settings, quality: undefined }, (stage, res, extra) => (0, harness_events_1.appendEvent)(eventsFile, { type: "gate", stage: `post-merge ${stage}`, result: res, ...(extra || {}) }, req.requirement, attempt));
+        { ...ctx.settings, quality: undefined }, gateReporter(eventsFile, req.requirement, attempt, "post-merge "));
         if (!gate.ok) {
             git(projectDir, ["reset", "-q", "--hard", "HEAD~1"]);
             Object.assign(result, {
@@ -2724,6 +2868,24 @@ class RunCommand extends command_1.BaseCommand {
                     }
                 }
             }
+            // REQ-264: Claude Code in print mode writes nothing without permission.
+            let permitted = false;
+            const permit = (command) => {
+                const p = (0, agent_permission_1.withAgentPermission)(command);
+                permitted = permitted || p.added;
+                return p.command;
+            };
+            if (settings.agent)
+                settings.agent = permit(settings.agent);
+            for (const name of Object.keys(settings.profileAgents || {})) {
+                settings.profileAgents[name] = permit(settings.profileAgents[name]);
+            }
+            if (permitted) {
+                info("Claude Code runs with --permission-mode acceptEdits: in print mode it cannot write " +
+                    "without it, and the harness's worktree confines what it writes.");
+            }
+            // REQ-271: an agent given on the command line is forgotten after the run.
+            const unkept = Boolean(args.agent) && !(fileConfig && fileConfig.agent);
             // A ladder of per-attempt profiles configures agents just as much as a
             // single `agent:` does, so a project that declares one is configured.
             const hasAgent = Boolean(settings.agent) || settings.attemptProfiles.length > 0;
@@ -2868,6 +3030,23 @@ class RunCommand extends command_1.BaseCommand {
                 (0, harness_events_1.writeQueue)(projectDir, pending.map((r) => r.requirement));
             }
             const startedAt = new Date().toISOString();
+            const runRecordBase = {
+                schemaVersion: 1,
+                startedAt,
+                baseRef,
+                concurrency: settings.concurrency,
+                maxAttempts: settings.maxAttempts,
+                // Whether this run had a ceiling at all. Reading the ledger later,
+                // a short run is a different thing depending on the answer.
+                bounded: (0, RunBudget_1.hasBudget)({
+                    budgetSeconds: args.budgetSeconds,
+                    maxRequirements: args.maxRequirements,
+                }),
+            };
+            if (!process.env.SPECGATE_HARNESS_WORKER) {
+                ledger = { projectDir, record: { ...runRecordBase, finishedAt: "", results: [] } };
+                ledgerWrite();
+            }
             const results = args.chain
                 ? await runChain(pending, ctx, hintByReq)
                 : await runLevels(pending, ctx, {
@@ -2885,21 +3064,17 @@ class RunCommand extends command_1.BaseCommand {
             const recordPath = process.env.SPECGATE_HARNESS_WORKER
                 ? null
                 : writeRunRecord(projectDir, {
-                    schemaVersion: 1,
-                    startedAt,
+                    ...runRecordBase,
                     finishedAt: new Date().toISOString(),
-                    baseRef,
-                    concurrency: settings.concurrency,
-                    maxAttempts: settings.maxAttempts,
-                    // Whether this run had a ceiling at all. Reading the ledger later,
-                    // a short run is a different thing depending on the answer.
-                    bounded: (0, RunBudget_1.hasBudget)({
-                        budgetSeconds: args.budgetSeconds,
-                        maxRequirements: args.maxRequirements,
-                    }),
                     results,
                 });
+            ledger = null;
             printReport(results, args.format, recordPath ? path.relative(projectDir, recordPath) : undefined);
+            // REQ-271: the studio's Build reads the agent from harness.config.yaml.
+            if (unkept && !jsonMode && !process.env.SPECGATE_HARNESS_WORKER) {
+                process.stdout.write(`  ${ui.muted("Keep this agent for the next run and the studio's Build:")}\n` +
+                    `    specgate config set agent "${args.agent.replace(/"/g, '\\"')}"\n\n`);
+            }
             // A blocked requirement was never attempted, so it is not a pass — but it
             // is also not evidence that anything is broken beyond the failure that
             // caused it. It still fails the run, because work was left undone.