@sayknow-cli/coding-agent 0.3.7 → 0.3.9

package/src/skc-runtime/workflow-manifest.generated.json

@@ -1435,6 +1435,13 @@
         "name": "skc-goal-mode",
         "type": "enum"
       },
+      {
+        "appliesToVerbs": [
+          "create-goals"
+        ],
+        "name": "validation-batch-json",
+        "type": "string"
+      },
       {
         "appliesToVerbs": [
           "complete-goals"
@@ -1473,12 +1480,93 @@
           "checkpoint",
           "record-review-blockers",
           "steer",
-          "classify-blocker"
+          "classify-blocker",
+          "rebaseline-pipeline-overlap"
         ],
         "name": "evidence",
         "required": true,
         "type": "string"
       },
+      {
+        "appliesToVerbs": [
+          "create-goals"
+        ],
+        "name": "goal-metadata-json",
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "start-pipeline-overlap"
+        ],
+        "name": "prior-goal-id",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "start-pipeline-overlap"
+        ],
+        "name": "next-goal-id",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "start-pipeline-overlap"
+        ],
+        "name": "review-handles-json",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "start-pipeline-overlap"
+        ],
+        "name": "qa-handles-json",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "start-pipeline-overlap"
+        ],
+        "name": "implementation-handle-json",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "join-pipeline-overlap",
+          "rebaseline-pipeline-overlap"
+        ],
+        "name": "overlap-id",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "join-pipeline-overlap"
+        ],
+        "name": "review-result-json",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "join-pipeline-overlap"
+        ],
+        "name": "qa-result-json",
+        "required": true,
+        "type": "string"
+      },
+      {
+        "appliesToVerbs": [
+          "rebaseline-pipeline-overlap"
+        ],
+        "name": "target-state-json",
+        "required": true,
+        "type": "string"
+      },
       {
         "appliesToVerbs": [
           "checkpoint"
@@ -1500,6 +1588,14 @@
         "name": "goal-id",
         "type": "string"
       },
+      {
+        "appliesToVerbs": [
+          "rebaseline-pipeline-overlap"
+        ],
+        "name": "goal-id",
+        "required": true,
+        "type": "string"
+      },
       {
         "appliesToVerbs": [
           "classify-blocker"
@@ -1612,7 +1708,10 @@
           "checkpoint",
           "record-review-blockers",
           "steer",
-          "classify-blocker"
+          "classify-blocker",
+          "start-pipeline-overlap",
+          "join-pipeline-overlap",
+          "rebaseline-pipeline-overlap"
         ],
         "name": "json",
         "type": "boolean"
@@ -1697,6 +1796,18 @@
         "name": "classify-blocker",
         "surface": "command-positional"
       },
+      {
+        "name": "start-pipeline-overlap",
+        "surface": "command-positional"
+      },
+      {
+        "name": "join-pipeline-overlap",
+        "surface": "command-positional"
+      },
+      {
+        "name": "rebaseline-pipeline-overlap",
+        "surface": "command-positional"
+      },
       {
         "name": "graph",
         "planned": true,

package/src/skc-runtime/workflow-manifest.ts

@@ -243,6 +243,9 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 				"record-review-blockers",
 				"steer",
 				"classify-blocker",
+				"start-pipeline-overlap",
+				"join-pipeline-overlap",
+				"rebaseline-pipeline-overlap",
 			]),
 			...plannedVerbs(PLANNED_ADMIN_VERBS),
 		],
@@ -256,6 +259,7 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 				enumValues: ["aggregate", "per-story"],
 				appliesToVerbs: ["create-goals"],
 			},
+			{ name: "validation-batch-json", type: "string", appliesToVerbs: ["create-goals"] },
 			{ name: "retry-failed", type: "boolean", appliesToVerbs: ["complete-goals"] },
 			{ name: "goal-id", type: "string", required: true, appliesToVerbs: ["checkpoint", "record-review-blockers"] },
 			{
@@ -269,11 +273,77 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 				name: "evidence",
 				type: "string",
 				required: true,
-				appliesToVerbs: ["checkpoint", "record-review-blockers", "steer", "classify-blocker"],
+				appliesToVerbs: [
+					"checkpoint",
+					"record-review-blockers",
+					"steer",
+					"classify-blocker",
+					"rebaseline-pipeline-overlap",
+				],
+			},
+			{
+				name: "goal-metadata-json",
+				type: "string",
+				appliesToVerbs: ["create-goals"],
+			},
+			{
+				name: "prior-goal-id",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["start-pipeline-overlap"],
+			},
+			{
+				name: "next-goal-id",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["start-pipeline-overlap"],
+			},
+			{
+				name: "review-handles-json",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["start-pipeline-overlap"],
+			},
+			{
+				name: "qa-handles-json",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["start-pipeline-overlap"],
+			},
+			{
+				name: "implementation-handle-json",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["start-pipeline-overlap"],
+			},
+			{
+				name: "overlap-id",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["join-pipeline-overlap", "rebaseline-pipeline-overlap"],
+			},
+			{
+				name: "review-result-json",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["join-pipeline-overlap"],
+			},
+			{
+				name: "qa-result-json",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["join-pipeline-overlap"],
+			},
+			{
+				name: "target-state-json",
+				type: "string",
+				required: true,
+				appliesToVerbs: ["rebaseline-pipeline-overlap"],
 			},
 			{ name: "quality-gate-json", type: "string", appliesToVerbs: ["checkpoint"] },
 			{ name: "goal-id", type: "string", appliesToVerbs: ["steer"] },
 			{ name: "goal-id", type: "string", appliesToVerbs: ["classify-blocker"] },
+			{ name: "goal-id", type: "string", required: true, appliesToVerbs: ["rebaseline-pipeline-overlap"] },
 			{
 				name: "classification",
 				type: "enum",
@@ -321,6 +391,9 @@ export const WORKFLOW_MANIFEST: Record<CanonicalSkcWorkflowSkill, SkillManifest>
 					"record-review-blockers",
 					"steer",
 					"classify-blocker",
+					"start-pipeline-overlap",
+					"join-pipeline-overlap",
+					"rebaseline-pipeline-overlap",
 				],
 			},
 			{ name: "directive-json", type: "string", appliesToVerbs: ["steer"], planned: true },

package/src/skill-state/active-state.ts

@@ -1,11 +1,19 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
 import * as logger from "@sayknow-cli/utils/logger";
-import { activeSnapshotPath, assertNonEmptySkcSessionId, modeStatePath } from "../skc-runtime/session-layout";
+import {
+	activeSnapshotPath,
+	activeStateDir,
+	assertNonEmptySkcSessionId,
+	modeStatePath,
+} from "../skc-runtime/session-layout";
 import { resolveSkcSessionForRead, SessionResolutionError } from "../skc-runtime/session-resolution";
 import {
 	type ActiveSessionScope,
 	readActiveEntries,
 	rebuildActiveSnapshot,
 	removeActiveEntry,
+	setActiveStateCacheInvalidator,
 	writeActiveEntry,
 } from "../skc-runtime/state-writer";
 import { CANONICAL_SKC_WORKFLOW_SKILLS, type CanonicalSkcWorkflowSkill } from "./canonical-skills";
@@ -614,14 +622,108 @@ async function mergeVisibleEntries(
 	return collapsePlanningPipeline(visibleEntries).toSorted(comparePipelineEntry);
 }
 
-export async function readVisibleSkillActiveState(cwd: string, sessionId?: string): Promise<SkillActiveState | null> {
-	let resolvedSessionId: string;
+export type VisibleSkillActiveStateCacheTier = "security" | "hud";
+export interface ReadVisibleSkillActiveStateOptions {
+	tier?: VisibleSkillActiveStateCacheTier;
+}
+
+interface ActiveStateStatSignature {
+	path: string;
+	mtimeMs: number;
+	size: number;
+}
+
+interface ActiveStateSignature {
+	sessionPath: ActiveStateStatSignature | null;
+	activeDir: ActiveStateStatSignature | null;
+	activeEntries: ActiveStateStatSignature[];
+	ralplanModeState: ActiveStateStatSignature | null;
+}
+
+interface VisibleSkillActiveStateCacheEntry {
+	signature: ActiveStateSignature;
+	value: SkillActiveState | null;
+	cachedAtMs: number;
+}
+
+const HUD_VISIBLE_STATE_TTL_MS = 500;
+const SECURITY_VISIBLE_STATE_TTL_MS = 30_000;
+const visibleSkillActiveStateCache = new Map<string, VisibleSkillActiveStateCacheEntry>();
+
+async function statSignature(filePath: string): Promise<ActiveStateStatSignature | null> {
 	try {
-		resolvedSessionId = await resolveBoundarySessionId(cwd, sessionId);
+		const stat = await fs.stat(filePath);
+		return { path: filePath, mtimeMs: stat.mtimeMs, size: stat.size };
 	} catch (error) {
-		if (error instanceof SessionResolutionError && error.code === "no_session") return null;
+		if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
 		throw error;
 	}
+}
+
+function signaturesEqual(a: ActiveStateSignature, b: ActiveStateSignature): boolean {
+	const statEqual = (left: ActiveStateStatSignature | null, right: ActiveStateStatSignature | null): boolean =>
+		left === right ||
+		(Boolean(left) &&
+			Boolean(right) &&
+			left?.path === right?.path &&
+			left?.mtimeMs === right?.mtimeMs &&
+			left?.size === right?.size);
+	if (!statEqual(a.sessionPath, b.sessionPath)) return false;
+	if (!statEqual(a.activeDir, b.activeDir)) return false;
+	if (!statEqual(a.ralplanModeState, b.ralplanModeState)) return false;
+	if (a.activeEntries.length !== b.activeEntries.length) return false;
+	return a.activeEntries.every((entry, index) => statEqual(entry, b.activeEntries[index] ?? null));
+}
+
+export async function computeActiveStateSignature(cwd: string, sessionId: string): Promise<ActiveStateSignature> {
+	const resolvedCwd = path.resolve(cwd);
+	const { sessionPath } = getSkillActiveStatePaths(resolvedCwd, sessionId);
+	const activeDirPath = activeStateDir(resolvedCwd, sessionId);
+	const activeDir = await statSignature(activeDirPath);
+	let activeEntries: ActiveStateStatSignature[] = [];
+	try {
+		const names = await fs.readdir(activeDirPath);
+		activeEntries = (
+			await Promise.all(
+				names
+					.filter(name => name.endsWith(".json"))
+					.sort()
+					.map(name => statSignature(path.join(activeDirPath, name))),
+			)
+		).filter((entry): entry is ActiveStateStatSignature => entry !== null);
+	} catch (error) {
+		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+	}
+	return {
+		sessionPath: await statSignature(sessionPath),
+		activeDir,
+		activeEntries,
+		ralplanModeState: await statSignature(modeStatePath(resolvedCwd, sessionId, "ralplan")),
+	};
+}
+
+function visibleActiveStateCacheKey(cwd: string, sessionId: string): string {
+	return `${path.resolve(cwd)}\0${sessionId}`;
+}
+
+export function invalidateVisibleSkillActiveStateCache(cwd?: string, sessionId?: string): void {
+	if (!cwd && !sessionId) {
+		visibleSkillActiveStateCache.clear();
+		return;
+	}
+	const resolvedCwd = cwd ? path.resolve(cwd) : undefined;
+	const suffix = sessionId ? `\0${sessionId}` : undefined;
+	for (const key of [...visibleSkillActiveStateCache.keys()]) {
+		if (resolvedCwd && !key.startsWith(`${resolvedCwd}\0`)) continue;
+		if (suffix && !key.endsWith(suffix)) continue;
+		visibleSkillActiveStateCache.delete(key);
+	}
+}
+
+async function readVisibleSkillActiveStateUncached(
+	cwd: string,
+	resolvedSessionId: string,
+): Promise<SkillActiveState | null> {
 	const { sessionPath } = getSkillActiveStatePaths(cwd, resolvedSessionId);
 	const sessionState = await readRawActiveStateForHandoff(sessionPath, false);
 	const activeSkills = await mergeVisibleEntries(cwd, sessionState, resolvedSessionId);
@@ -639,6 +741,40 @@ export async function readVisibleSkillActiveState(cwd: string, sessionId?: strin
 	};
 }
 
+setActiveStateCacheInvalidator(invalidateVisibleSkillActiveStateCache);
+
+export async function readVisibleSkillActiveState(
+	cwd: string,
+	sessionId?: string,
+	opts?: ReadVisibleSkillActiveStateOptions,
+): Promise<SkillActiveState | null> {
+	let resolvedSessionId: string;
+	try {
+		resolvedSessionId = await resolveBoundarySessionId(cwd, sessionId);
+	} catch (error) {
+		if (error instanceof SessionResolutionError && error.code === "no_session") return null;
+		throw error;
+	}
+	const resolvedCwd = path.resolve(cwd);
+	const cacheKey = visibleActiveStateCacheKey(resolvedCwd, resolvedSessionId);
+	const tier = opts?.tier ?? "security";
+	const now = Date.now();
+	const cached = visibleSkillActiveStateCache.get(cacheKey);
+	if (tier === "hud" && cached && now - cached.cachedAtMs < HUD_VISIBLE_STATE_TTL_MS) return cached.value;
+
+	const signature = await computeActiveStateSignature(resolvedCwd, resolvedSessionId);
+	if (
+		cached &&
+		signaturesEqual(cached.signature, signature) &&
+		(tier === "hud" || now - cached.cachedAtMs < SECURITY_VISIBLE_STATE_TTL_MS)
+	) {
+		return cached.value;
+	}
+	const value = await readVisibleSkillActiveStateUncached(resolvedCwd, resolvedSessionId);
+	visibleSkillActiveStateCache.set(cacheKey, { signature, value, cachedAtMs: now });
+	return value;
+}
+
 function activeStateWriterAudit(verb: string, sessionScope?: ActiveSessionScope | string) {
 	const sessionId = typeof sessionScope === "string" ? sessionScope : sessionScope?.sessionId;
 	return { category: "state" as const, verb, owner: "skc-runtime" as const, ...(sessionId ? { sessionId } : {}) };

package/src/skill-state/deep-interview-mutation-guard.ts

@@ -33,10 +33,18 @@ function planningPhaseBlockMessage(skill: CanonicalSkcWorkflowSkill): string {
 	return DEEP_INTERVIEW_MUTATION_BLOCK_MESSAGE;
 }
 
-const BLOCKED_TOOL_NAMES = new Set(["edit", "write", "ast_edit"]);
+const BLOCKED_TOOL_NAMES = new Set(["edit", "write", "ast_edit", "bash"]);
 const ARCHIVE_OR_SQLITE_BASE_RE = /^(.+?\.(?:tar\.gz|sqlite3|sqlite|db3|zip|tgz|tar|db))(?:$|:)/i;
 const INTERNAL_SCHEME_RE = /^[a-z][a-z0-9+.-]*:\/\//i;
 const VIM_FILE_SWITCH_RE = /^\s*:(?:e|e!|edit|edit!)(?:\s+([^<\r\n]+))?(?:<CR>|\r|\n|$)/i;
+const BASH_MUTATION_COMMAND_RE =
+	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:tee|touch|rm|mkdir|cp|mv|install|truncate)\b([^;&|\n]*)|(?:^|[^<>])(?:>>?|\d>>?)\s*([^\s;&|]+)/gi;
+const BASH_IN_PLACE_MUTATION_COMMAND_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:sed|perl)\b([^;&|\n]*)/gi;
+const BASH_OPAQUE_INTERPRETER_WRITE_RE =
+	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:python3?|node|ruby)\b[^;&|\n]*(?:-c|-e)\b[^;&|\n]*(?:open\s*\(|writeFile(?:Sync)?\s*\(|\.write\s*\()/i;
+const BASH_HEREDOC_OPAQUE_INTERPRETER_WRITE_RE =
+	/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(?:python3?|node|ruby)\b[^;&|\n]*(?:<<[-]?\s*['"]?\w+['"]?)[\s\S]*(?:open\s*\(|writeFile(?:Sync)?\s*\(|\.write\s*\()/i;
+const BASH_DD_OUTPUT_RE = /(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?dd\b([^;&|\n]*)/gi;
 
 type ToolWithEditMode = AgentTool & {
 	mode?: unknown;
@@ -214,7 +222,7 @@ async function getActivePlanningSkill(
 ): Promise<ActivePlanningSkill | null> {
 	const resolvedSessionId = await resolveBoundarySessionId(cwd, sessionId);
 	if (!resolvedSessionId) return null;
-	const skillState = await readVisibleSkillActiveState(cwd, resolvedSessionId);
+	const skillState = await readVisibleSkillActiveState(cwd, resolvedSessionId, { tier: "security" });
 	if (!skillState) return null;
 	const activeEntries = listActiveSkills(skillState).filter(entry =>
 		entryMatchesContext(entry, resolvedSessionId, threadId),
@@ -329,11 +337,66 @@ function extractEditTargets(args: unknown, tool: ToolWithEditMode): ExtractedTar
 	if (targets.paths.length === 0) targets.unknown = true;
 	return targets;
 }
+function shellWords(argsText: string): string[] {
+	return argsText.match(/(?:[^\s'"\\]+|'[^']*'|"[^"]*")+/g) ?? [];
+}
+
+function cleanShellWord(value: string): string {
+	return value.replace(/^['"]|['"]$/g, "");
+}
 
+function extractBashTargets(args: unknown): ExtractedTargets {
+	const record = getRecord(args);
+	const command = safeString(record?.command);
+	const targets: ExtractedTargets = { paths: [], unknown: false };
+	if (!command.trim()) {
+		targets.unknown = true;
+		return targets;
+	}
+	if (BASH_OPAQUE_INTERPRETER_WRITE_RE.test(command) || BASH_HEREDOC_OPAQUE_INTERPRETER_WRITE_RE.test(command)) {
+		targets.unknown = true;
+	}
+	for (const match of command.matchAll(BASH_DD_OUTPUT_RE)) {
+		const parts = shellWords(match[1] ?? "").map(cleanShellWord);
+		const output = parts.find(part => part.startsWith("of="));
+		if (output) addPath(targets, output.slice(3));
+		else targets.unknown = true;
+	}
+	for (const match of command.matchAll(BASH_IN_PLACE_MUTATION_COMMAND_RE)) {
+		const parts = shellWords(match[1] ?? "").map(cleanShellWord);
+		const hasInPlaceFlag = parts.some(part => /^-.*i/.test(part));
+		if (!hasInPlaceFlag) continue;
+		const target = [...parts].reverse().find(part => part && !part.startsWith("-"));
+		if (target) addPath(targets, target);
+		else targets.unknown = true;
+	}
+	for (const match of command.matchAll(BASH_MUTATION_COMMAND_RE)) {
+		const redirected = match[2]?.trim();
+		if (redirected) {
+			addPath(targets, cleanShellWord(redirected));
+			continue;
+		}
+		const parts = shellWords(match[1] ?? "");
+		const commandName = match[0]
+			?.match(/(?:^|[;&|\n])\s*(?:\w+=[^\s]+\s+)*(?:sudo\s+)?(tee|touch|rm|mkdir|cp|mv|install|truncate)\b/i)?.[1]
+			?.toLowerCase();
+		const targetParts =
+			commandName === "cp" || commandName === "mv" || commandName === "install" || commandName === "truncate"
+				? parts.slice(-1)
+				: parts;
+		for (const part of targetParts) {
+			const cleaned = cleanShellWord(part);
+			if (!cleaned || cleaned.startsWith("-")) continue;
+			addPath(targets, cleaned);
+		}
+	}
+	return targets;
+}
 function extractTargets(tool: ToolWithEditMode, args: unknown): ExtractedTargets {
 	if (tool.name === "write") return extractWriteTargets(args);
 	if (tool.name === "ast_edit") return extractAstEditTargets(args);
 	if (tool.name === "edit") return extractEditTargets(args, tool);
+	if (tool.name === "bash") return extractBashTargets(args);
 	return { paths: [], unknown: true };
 }
 
@@ -490,6 +553,7 @@ async function isNeutralTempPath(cwd: string, rawPath: string): Promise<boolean>
 async function planningBlockedTargets(cwd: string, targets: ExtractedTargets): Promise<string[]> {
 	const blocked: string[] = [];
 	for (const rawPath of targets.paths) {
+		if (isAllowlistedPath(cwd, rawPath)) continue;
 		if (!(await isNeutralTempPath(cwd, rawPath))) blocked.push(rawPath);
 	}
 	return blocked;
@@ -523,7 +587,7 @@ export async function getDeepInterviewMutationDecision(
 ): Promise<DeepInterviewMutationDecision> {
 	if (!BLOCKED_TOOL_NAMES.has(input.tool.name)) return { blocked: false, targets: [] };
 	const targets = extractTargets(input.tool, input.args);
-	if (input.enforceWorkflowState !== false && hasBlockedSkcTarget(input.cwd, targets)) {
+	if (input.tool.name !== "bash" && input.enforceWorkflowState !== false && hasBlockedSkcTarget(input.cwd, targets)) {
 		const stateSkill = firstBlockedWorkflowStateSkill(input.cwd, targets);
 		const command = stateSkill ? sanctionedWorkflowStateCommand(stateSkill) : "skc <workflow-command>";
 		return {