@rtrentjones/greenlight 0.2.22 → 0.2.23

package/dist/{agent-web-I4LXW4SR.js → agent-web-3FTO2TLJ.js}

@@ -1,6 +1,6 @@
 import {
   verifyAgentWeb
-} from "./chunk-UXHHLEYO.js";
+} from "./chunk-KVOI4UL2.js";
 import "./chunk-QFKE5JKC.js";
 export {
   verifyAgentWeb

package/dist/bin.js

@@ -5,12 +5,12 @@ import {
   loadConfig,
   resolveUrl,
   verifyAll
-} from "./chunk-GO2RVNOP.js";
+} from "./chunk-TFWXR7PP.js";
 import "./chunk-HX7VA25D.js";
 import "./chunk-N3IKUCSF.js";
 import "./chunk-KP3Y6WRU.js";
-import "./chunk-UXHHLEYO.js";
-import "./chunk-6N7MD6FR.js";
+import "./chunk-KVOI4UL2.js";
+import "./chunk-XWTOJHLV.js";
 import "./chunk-QFKE5JKC.js";
 
 // src/commands/add.ts
@@ -443,7 +443,7 @@ function tokensForTool(tool) {
 }
 
 // src/version.ts
-var MODULE_REF = "v0.2.22";
+var MODULE_REF = "v0.2.23";
 var MODULE_SOURCE_BASE = "git::https://github.com/RTrentJones/greenlight.git//infra/modules";
 function moduleSource(module, ref = MODULE_REF) {
   return `${MODULE_SOURCE_BASE}/${module}?ref=${ref}`;
@@ -1991,7 +1991,8 @@ async function deployCommand(args) {
 }
 
 // src/commands/doctor.ts
-import { existsSync as existsSync7 } from "fs";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync7, readFileSync as readFileSync5, readdirSync as readdirSync2 } from "fs";
 import { join as join4 } from "path";
 function dirCheck(label, dir) {
   return existsSync7(dir) ? { name: `${label}: directory`, status: "ok" } : { name: `${label}: directory`, status: "fail", detail: `missing ${dir}` };
@@ -2030,6 +2031,61 @@ function conformanceChecks(t, root) {
   }
   return out;
 }
+function versionDriftCheck(root) {
+  const name = "framework version drift";
+  let installed;
+  try {
+    const pkg = JSON.parse(
+      readFileSync5(join4(root, "node_modules/@rtrentjones/greenlight/package.json"), "utf8")
+    );
+    installed = pkg.version;
+  } catch {
+  }
+  const refs = /* @__PURE__ */ new Set();
+  try {
+    for (const f of readdirSync2(join4(root, "infra")).filter((f2) => f2.endsWith(".tf"))) {
+      const body = readFileSync5(join4(root, "infra", f), "utf8");
+      for (const m of body.matchAll(/greenlight\.git\/\/infra\/modules\/[^?"]+\?ref=(v[0-9.]+)/g)) {
+        if (m[1]) refs.add(m[1]);
+      }
+    }
+  } catch {
+  }
+  if (!installed && refs.size === 0) {
+    return {
+      name,
+      status: "skip",
+      detail: "no installed @rtrentjones/greenlight or infra pins here"
+    };
+  }
+  const refList = [...refs];
+  if (installed) {
+    const want = `v${installed}`;
+    const bad = refList.filter((r) => r !== want);
+    return bad.length === 0 ? { name, status: "ok", detail: `infra pins == installed ${want}` } : {
+      name,
+      status: "warn",
+      detail: `installed ${want}, but infra pins ${bad.join(", ")} \u2014 bump ?ref to ${want}`
+    };
+  }
+  return refList.length <= 1 ? { name, status: "ok", detail: `infra pins uniform (${refList[0] ?? "none"})` } : { name, status: "warn", detail: `infra ?ref pins not uniform: ${refList.join(", ")}` };
+}
+function submoduleDriftCheck(root) {
+  const name = "submodule drift";
+  let out;
+  try {
+    out = execFileSync4("git", ["submodule", "status"], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return { name, status: "skip", detail: "no git / not a repo" };
+  }
+  if (!out) return { name, status: "skip", detail: "no submodules" };
+  const dirty = out.split("\n").filter((l) => /^[+\-U]/.test(l));
+  return dirty.length === 0 ? { name, status: "ok", detail: "all submodules match their recorded commit" } : { name, status: "warn", detail: dirty.map((l) => l.trim()).join("; ") };
+}
 function runDoctor(config, root) {
   const checks = [];
   if (config.blog) checks.push(dirCheck("blog", join4(root, "apps/blog")));
@@ -2042,6 +2098,15 @@ function runDoctor(config, root) {
         mcp: t.lane === "mcp"
       });
       checks.push({ name: `${t.name}: external (registry)`, status: "ok", detail: url });
+      if (t.dir) {
+        checks.push(
+          existsSync7(join4(root, t.dir)) ? { name: `${t.name}: dir present`, status: "ok", detail: t.dir } : {
+            name: `${t.name}: dir present`,
+            status: "warn",
+            detail: `declared dir "${t.dir}" missing \u2014 run \`git submodule update --init\``
+          }
+        );
+      }
     } else {
       checks.push(dirCheck(t.name, join4(root, t.dir ?? join4("tools", t.name))));
     }
@@ -2053,13 +2118,14 @@ function runDoctor(config, root) {
     status: needsKeepalive.length > 0 ? "ok" : "skip",
     detail: needsKeepalive.length > 0 ? needsKeepalive.map((t) => `${t.name} (${t.data === "supabase" ? "supabase" : "oci"})`).join(", ") : "no data:supabase / target:oci tools"
   });
+  checks.push(versionDriftCheck(root));
+  checks.push(submoduleDriftCheck(root));
   for (const name of [
     "DNS propagation",
     "terraform drift",
     "Vercel cap headroom",
     "keepalive health (live)",
-    "OCI PAYG status",
-    "framework version drift"
+    "OCI PAYG status"
   ]) {
     checks.push({ name, status: "skip", detail: "needs provider creds / packages (Phase 5/7/8)" });
   }
@@ -2091,7 +2157,7 @@ import { resolve as resolve8 } from "path";
 import { createInterface as createInterface3 } from "readline/promises";
 
 // src/tokens.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
 import { resolve as resolve7 } from "path";
 import { createInterface as createInterface2 } from "readline/promises";
 var SECRETS_DIR = ".greenlight";
@@ -2100,7 +2166,7 @@ function presentEnv(cwd) {
   const out = {};
   const p = resolve7(cwd, SECRETS_DIR, SECRETS_FILE);
   if (existsSync8(p)) {
-    for (const { key, value } of parseSecretsEnv(readFileSync5(p, "utf8"))) out[key] = value;
+    for (const { key, value } of parseSecretsEnv(readFileSync6(p, "utf8"))) out[key] = value;
   }
   for (const [k, v] of Object.entries(process.env)) {
     if (v !== void 0 && !(k in out)) out[k] = v;
@@ -2111,7 +2177,7 @@ function upsertSecret(cwd, key, value) {
   const dir = resolve7(cwd, SECRETS_DIR);
   mkdirSync4(dir, { recursive: true });
   const p = resolve7(dir, SECRETS_FILE);
-  const lines = existsSync8(p) ? readFileSync5(p, "utf8").split("\n") : [];
+  const lines = existsSync8(p) ? readFileSync6(p, "utf8").split("\n") : [];
   const idx = lines.findIndex((l) => l.startsWith(`${key}=`));
   if (idx >= 0) lines[idx] = `${key}=${value}`;
   else {
@@ -2338,7 +2404,7 @@ Next:
 }
 
 // src/commands/preview.ts
-import { execFileSync as execFileSync4, spawn } from "child_process";
+import { execFileSync as execFileSync5, spawn } from "child_process";
 import { resolve as resolve10 } from "path";
 import { setTimeout as sleep } from "timers/promises";
 
@@ -2377,6 +2443,15 @@ ${report.logs}
   }
 }
 var LOG_TAIL_LINES = 50;
+function redactSecrets(text, env = process.env) {
+  let out = text;
+  for (const [k, v] of Object.entries(env)) {
+    if (!v || v.length < 6) continue;
+    if (!/TOKEN|KEY|SECRET|PASSWORD|PWD/i.test(k)) continue;
+    out = out.split(v).join("***");
+  }
+  return out;
+}
 function attachFailureLogs(reports, specs, toolDir) {
   reports.forEach((report, i) => {
     if (report.pass) return;
@@ -2395,7 +2470,7 @@ function attachFailureLogs(reports, specs, toolDir) {
         // Let the command target the exact failing URL without hard-coding it.
         env: { ...process.env, GREENLIGHT_VERIFY_URL: report.url }
       });
-      const out = `${res.stdout ?? ""}${res.stderr ?? ""}`.trimEnd();
+      const out = redactSecrets(`${res.stdout ?? ""}${res.stderr ?? ""}`.trimEnd());
       const tail = out.split("\n").slice(-LOG_TAIL_LINES).join("\n");
       report.logs = tail || `(logsOnFailure produced no output${res.error ? `: ${res.error.message}` : ""})`;
     } catch (e) {
@@ -2528,7 +2603,7 @@ async function previewViaDescriptor(entry, name, portOverride) {
   } finally {
     if (pv.teardown) {
       try {
-        execFileSync4(pv.teardown, { cwd: toolDir, shell: true, stdio: "inherit" });
+        execFileSync5(pv.teardown, { cwd: toolDir, shell: true, stdio: "inherit" });
       } catch {
       }
     }
@@ -2545,7 +2620,7 @@ async function previewViaBuiltIn(entry, name, portOverride) {
   const plan = servePlan(entry.lane, portOverride);
   if (plan.build) {
     console.log(`build ${name} (${entry.dir})`);
-    execFileSync4("pnpm", ["-C", entry.dir, "run", "build"], { stdio: "inherit" });
+    execFileSync5("pnpm", ["-C", entry.dir, "run", "build"], { stdio: "inherit" });
   }
   console.log(`serve ${name} on :${plan.port}`);
   const runArgs = ["-C", entry.dir, "run", plan.script];
@@ -2600,12 +2675,12 @@ async function previewCommand(args) {
 }
 
 // ../packages/loop/src/promote.ts
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 function git(repoDir, args) {
-  execFileSync5("git", args, { cwd: repoDir, stdio: "ignore" });
+  execFileSync6("git", args, { cwd: repoDir, stdio: "ignore" });
 }
 function gitOut(repoDir, args) {
-  return execFileSync5("git", args, { cwd: repoDir, encoding: "utf8" }).trim();
+  return execFileSync6("git", args, { cwd: repoDir, encoding: "utf8" }).trim();
 }
 function tryRev(repoDir, ref) {
   try {
@@ -2615,9 +2690,16 @@ function tryRev(repoDir, ref) {
   }
 }
 function fetchRefs(repoDir, branches) {
+  try {
+    git(repoDir, ["remote", "get-url", "origin"]);
+  } catch {
+    return { ok: false, hasOrigin: false };
+  }
   try {
     git(repoDir, ["fetch", "--no-tags", "origin", ...branches]);
+    return { ok: true, hasOrigin: true };
   } catch {
+    return { ok: false, hasOrigin: true };
   }
 }
 function resolveRef(repoDir, branch) {
@@ -2644,13 +2726,23 @@ function staleLocalWarnings(repoDir, branches) {
   return warnings;
 }
 function canPromote(repoDir, from = "develop", to = "main") {
-  fetchRefs(repoDir, [from, to]);
+  const warnings = [];
+  const fetched = fetchRefs(repoDir, [from, to]);
+  if (fetched.hasOrigin && !fetched.ok) {
+    warnings.push(
+      "could not `git fetch origin` \u2014 eligibility may be based on stale remote-tracking refs (offline / auth?). Re-run after a successful fetch."
+    );
+  }
   const fromRef = resolveRef(repoDir, from);
   const toRef = resolveRef(repoDir, to);
   if (!fromRef || !toRef) {
-    return { canPromote: false, reason: `branch "${from}" or "${to}" not found in ${repoDir}` };
+    return {
+      canPromote: false,
+      reason: `branch "${from}" or "${to}" not found in ${repoDir}`,
+      warnings: warnings.length ? warnings : void 0
+    };
   }
-  const warnings = staleLocalWarnings(repoDir, [from, to]);
+  warnings.push(...staleLocalWarnings(repoDir, [from, to]));
   try {
     git(repoDir, ["merge-base", "--is-ancestor", toRef, fromRef]);
     return { canPromote: true, reason: `"${to}" can fast-forward to "${from}"`, warnings };
@@ -2716,10 +2808,10 @@ async function promoteCommand(args) {
 }
 
 // src/commands/status.ts
-import { execFileSync as execFileSync6 } from "child_process";
+import { execFileSync as execFileSync7 } from "child_process";
 function repoSlug(dir) {
   try {
-    const url = execFileSync6("git", ["-C", dir, "remote", "get-url", "origin"], {
+    const url = execFileSync7("git", ["-C", dir, "remote", "get-url", "origin"], {
       encoding: "utf8"
     }).trim();
     const m = url.match(/[:/]([^/]+\/[^/]+?)(?:\.git)?$/);
@@ -2752,7 +2844,7 @@ function workflowsFor(entry, name, wrapper, toolRepo) {
 }
 function lastRun(repo, workflow) {
   try {
-    const out = execFileSync6(
+    const out = execFileSync7(
       "gh",
       [
         "run",

package/dist/{chunk-UXHHLEYO.js → chunk-KVOI4UL2.js}

@@ -195,7 +195,11 @@ async function verifyAgentWeb(baseUrl, spec) {
       { name: "@anthropic-ai/sdk available", pass: false, detail: "pnpm add @anthropic-ai/sdk" }
     ]);
   }
-  const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
+  const client = new Anthropic({
+    apiKey: process.env.ANTHROPIC_API_KEY,
+    timeout: 6e4,
+    maxRetries: 1
+  });
   let browser;
   try {
     browser = await chromium.launch({ headless: !spec.headed });

package/dist/{chunk-GO2RVNOP.js → chunk-TFWXR7PP.js}

@@ -136,10 +136,15 @@ import { setTimeout as sleep } from "timers/promises";
 
 // ../packages/verify/src/api.ts
 var trimSlash = (s) => s.replace(/\/+$/, "");
-async function checkRoute(base, c) {
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_MAX_LINKS = 50;
+function timedFetch(url, timeoutMs, init) {
+  return fetch(url, { redirect: "manual", ...init, signal: AbortSignal.timeout(timeoutMs) });
+}
+async function checkRoute(base, c, timeoutMs) {
   const name = `GET ${c.path}`;
   try {
-    const res = await fetch(base + c.path, { redirect: "manual", headers: c.requestHeaders });
+    const res = await timedFetch(base + c.path, timeoutMs, { headers: c.requestHeaders });
     const reasons = [];
     if (c.status !== void 0 && res.status !== c.status) {
       reasons.push(`status ${res.status} != ${c.status}`);
@@ -160,10 +165,10 @@ async function checkRoute(base, c) {
     return { name, pass: false, detail: msg(e) };
   }
 }
-async function checkXml(base, candidates, label, marker) {
+async function checkXml(base, candidates, label, marker, timeoutMs) {
   for (const path of candidates) {
     try {
-      const res = await fetch(base + path, { redirect: "manual" });
+      const res = await timedFetch(base + path, timeoutMs);
       if (res.status === 200) {
         const body = await res.text();
         const ok = marker.test(body);
@@ -178,65 +183,97 @@ async function checkXml(base, candidates, label, marker) {
   }
   return { name: label, pass: false, detail: `none of ${candidates.join(", ")} returned 200` };
 }
-async function checkInternalLinks(base, max = 25) {
+async function checkInternalLinks(base, timeoutMs, max = DEFAULT_MAX_LINKS) {
   try {
-    const res = await fetch(`${base}/`, { redirect: "manual" });
+    const res = await timedFetch(`${base}/`, timeoutMs);
     const html = await res.text();
     const hrefs = /* @__PURE__ */ new Set();
+    let capped = false;
     for (const m of html.matchAll(/href="(\/[^"#?]*)"/g)) {
       const href = m[1];
       if (href && !href.startsWith("//")) hrefs.add(href);
-      if (hrefs.size >= max) break;
+      if (hrefs.size >= max) {
+        capped = true;
+        break;
+      }
+    }
+    if (hrefs.size === 0) {
+      return {
+        name: "no broken internal links",
+        pass: false,
+        detail: `no internal links found on ${base}/ (status ${res.status}) \u2014 page empty or unparseable`
+      };
     }
     const broken = [];
     for (const href of hrefs) {
       try {
-        const r = await fetch(base + href, { redirect: "manual" });
+        const r = await timedFetch(base + href, timeoutMs);
         if (r.status >= 400) broken.push(`${href} (${r.status})`);
       } catch {
         broken.push(`${href} (unreachable)`);
       }
     }
+    const capNote = capped ? `; capped at first ${max} \u2014 raise maxLinks to check more` : "";
     return {
-      name: `no broken internal links (${hrefs.size} checked)`,
+      name: `no broken internal links (${hrefs.size} checked${capped ? `, capped at ${max}` : ""})`,
       pass: broken.length === 0,
-      detail: broken.length ? `broken: ${broken.join(", ")}` : void 0
+      detail: broken.length ? `broken: ${broken.join(", ")}${capNote}` : capNote || void 0
     };
   } catch (e) {
     return { name: "no broken internal links", pass: false, detail: msg(e) };
   }
 }
-async function runChecks(base, spec) {
-  const checks = [];
-  for (const c of spec.checks ?? []) checks.push(await checkRoute(base, c));
+function buildTasks(base, spec) {
+  const timeoutMs = spec.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const tasks = [];
+  for (const c of spec.checks ?? []) tasks.push(() => checkRoute(base, c, timeoutMs));
   if (spec.rssValid) {
-    checks.push(
-      await checkXml(base, ["/rss.xml", "/feed.xml", "/index.xml"], "rss", /<(rss|feed)[\s>]/i)
+    tasks.push(
+      () => checkXml(
+        base,
+        ["/rss.xml", "/feed.xml", "/index.xml"],
+        "rss",
+        /<(rss|feed)[\s>]/i,
+        timeoutMs
+      )
     );
   }
   if (spec.sitemapValid) {
-    checks.push(
-      await checkXml(
+    tasks.push(
+      () => checkXml(
         base,
         ["/sitemap.xml", "/sitemap-index.xml"],
         "sitemap",
-        /<(urlset|sitemapindex)[\s>]/i
+        /<(urlset|sitemapindex)[\s>]/i,
+        timeoutMs
       )
     );
   }
-  if (spec.noBrokenInternalLinks) checks.push(await checkInternalLinks(base));
-  return checks;
+  if (spec.noBrokenInternalLinks) {
+    tasks.push(() => checkInternalLinks(base, timeoutMs, spec.maxLinks));
+  }
+  return tasks;
 }
 async function verifyApi(baseUrl, spec) {
   const base = trimSlash(baseUrl);
   const retries = Math.max(0, spec.settleRetries ?? 0);
   const delayMs = spec.settleMs ?? 5e3;
-  let checks = await runChecks(base, spec);
-  for (let i = 0; i < retries && !checks.every((c) => c.pass); i++) {
+  const state = await Promise.all(
+    buildTasks(base, spec).map(async (task) => ({ task, check: await task() }))
+  );
+  for (let i = 0; i < retries && !state.every((s) => s.check.pass); i++) {
     if (delayMs > 0) await new Promise((resolve) => setTimeout(resolve, delayMs));
-    checks = await runChecks(base, spec);
+    await Promise.all(
+      state.filter((s) => !s.check.pass).map(async (s) => {
+        s.check = await s.task();
+      })
+    );
   }
-  return report("api", baseUrl, checks);
+  return report(
+    "api",
+    baseUrl,
+    state.map((s) => s.check)
+  );
 }
 
 // ../packages/verify/src/index.ts
@@ -274,11 +311,11 @@ async function verify(baseUrl, spec, opts) {
       return verifyTest2(spec, opts?.toolDir ?? process.cwd());
     }
     case "agent-web": {
-      const { verifyAgentWeb: verifyAgentWeb2 } = await import("./agent-web-I4LXW4SR.js");
+      const { verifyAgentWeb: verifyAgentWeb2 } = await import("./agent-web-3FTO2TLJ.js");
       return verifyAgentWeb2(baseUrl, spec);
     }
     case "eval": {
-      const { verifyEval: verifyEval2 } = await import("./eval-LLQPOEQX.js");
+      const { verifyEval: verifyEval2 } = await import("./eval-44S2BATV.js");
       return verifyEval2(baseUrl, spec);
     }
   }

package/dist/{chunk-6N7MD6FR.js → chunk-XWTOJHLV.js}

@@ -19,7 +19,11 @@ function llmJudge(model) {
     if (!process.env.ANTHROPIC_API_KEY) throw new Error("ANTHROPIC_API_KEY not set");
     const sdkName = "@anthropic-ai/sdk";
     const Anthropic = (await import(sdkName)).default;
-    const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
+    const client = new Anthropic({
+      apiKey: process.env.ANTHROPIC_API_KEY,
+      timeout: 6e4,
+      maxRetries: 1
+    });
     const resp = await client.messages.create({
       model,
       max_tokens: 512,

package/dist/{eval-LLQPOEQX.js → eval-44S2BATV.js}

@@ -1,7 +1,7 @@
 import {
   llmJudge,
   verifyEval
-} from "./chunk-6N7MD6FR.js";
+} from "./chunk-XWTOJHLV.js";
 import "./chunk-QFKE5JKC.js";
 export {
   llmJudge,

package/dist/index.js

@@ -2,12 +2,12 @@ import {
   defineConfig,
   defineVerify,
   loadConfig
-} from "./chunk-GO2RVNOP.js";
+} from "./chunk-TFWXR7PP.js";
 import "./chunk-HX7VA25D.js";
 import "./chunk-N3IKUCSF.js";
 import "./chunk-KP3Y6WRU.js";
-import "./chunk-UXHHLEYO.js";
-import "./chunk-6N7MD6FR.js";
+import "./chunk-KVOI4UL2.js";
+import "./chunk-XWTOJHLV.js";
 import "./chunk-QFKE5JKC.js";
 export {
   defineConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rtrentjones/greenlight",
-  "version": "0.2.22",
+  "version": "0.2.23",
   "description": "Greenlight CLI — setup and lifecycle for the harness.",
   "license": "MIT",
   "repository": {
@@ -31,10 +31,10 @@
     "@anthropic-ai/sdk": "^0.69.0"
   },
   "devDependencies": {
-    "@rtrentjones/greenlight-adapters": "0.2.22",
-    "@rtrentjones/greenlight-verify": "0.2.22",
-    "@rtrentjones/greenlight-loop": "0.2.22",
-    "@rtrentjones/greenlight-shared": "0.2.22"
+    "@rtrentjones/greenlight-loop": "0.2.23",
+    "@rtrentjones/greenlight-shared": "0.2.23",
+    "@rtrentjones/greenlight-adapters": "0.2.23",
+    "@rtrentjones/greenlight-verify": "0.2.23"
   },
   "scripts": {
     "build": "node scripts/copy-assets.mjs && tsup",