@seanyao/roll 2.602.1 → 2.602.2

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## v2.602.2
+
+### 自动化流水线
+
+- **自家 PR 跑红了会自动后台修(US-LOOP-062a)** — loop 开的 PR 一旦 CI 变红,会在后台 checkout 交给 agent 修(有次数上限、不重复触发),修不好或关了自愈才告警,不再烂成没人管的僵尸 PR
+- **你批准过的绿 PR 会被自动合并(US-LOOP-062b)** — 你 review 通过、CI 又绿的 PR,loop 直接帮你合并删分支,不用再等仓库级 auto-merge、也不用手点
+
+### 可见性
+
+- **kimi / deepseek 成本按人民币 ¥ 显示(FIX-162)** — 之前 kimi 的成本被误标成美元 $,现在和 deepseek 一样按 ¥ 显示,成本总账不再混币种
+
+### 稳定性
+
+- **升级提示不再反向叫你装回旧版本(FIX-163)** — 换上更短的新版本号后,`roll loop on` 等命令一度提示"升级"回旧的年份版本号;现在按 GitHub 最新发布判断,装的是最新就不再误报,发版遇到新号比线上"看起来小"也不再卡住
+
+### 工程和测试
+
+- **roll-design 中等复杂度也过一道 peer(US-SKILL-018)** — 以前只有大改或跨边界的设计才自动触发 peer 评审,现在中等复杂度也会过一道,方向隐患能在拆故事前被独立挑一次;10 秒内可跳过
+
 ## v2.602.1
 
 ### 新功能

package/bin/roll

@@ -4,7 +4,7 @@ set -euo pipefail
 # Roll — AI Agent Convention Manager
 # Single source of truth for how all AI coding agents behave.
 
-VERSION="2.602.1"
+VERSION="2.602.2"
 ROLL_HOME="${ROLL_HOME:-${HOME}/.roll}"
 ROLL_CONFIG="${ROLL_HOME}/config.yaml"
 ROLL_GLOBAL="${ROLL_HOME}/conventions/global"
@@ -11295,6 +11295,142 @@ _loop_heal_dir() {
   printf '%s\n' "${ROLL_LOOP_DIR:-${HOME}/.shared/roll/loop}/heal"
 }
 
+# US-LOOP-062a: deduped [TYPE:loop-pr-ci-red] ALERT for a red loop/* PR. One
+# line per PR until the alert file is consumed — never silently drops.
+_loop_pr_ci_red_alert() {
+  local num="$1" head_ref="$2" msg="${3:-own loop PR CI red — needs heal}"
+  local alert="${_LOOP_ALERT}"
+  [ -n "$alert" ] || return 0
+  mkdir -p "$(dirname "$alert")" 2>/dev/null || true
+  grep -qF "[TYPE:loop-pr-ci-red] PR #${num} " "$alert" 2>/dev/null && return 0
+  printf '[%s] [error] [TYPE:loop-pr-ci-red] PR #%s %s: %s\n' \
+    "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$num" "$head_ref" "$msg" >> "$alert"
+}
+
+# US-LOOP-062a: upsert "key: value" in the per-slug loop state file (same flat
+# format the HEAD-CI heal counter uses).
+_loop_state_set() {
+  local key="$1" val="$2" state="${_LOOP_STATE}"
+  [ -n "$state" ] || return 0
+  mkdir -p "$(dirname "$state")" 2>/dev/null || true
+  if [ -f "$state" ] && grep -q "^${key}:" "$state" 2>/dev/null; then
+    local _tmp; _tmp=$(mktemp)
+    grep -v "^${key}:" "$state" > "$_tmp" 2>/dev/null || true
+    printf '%s: %s\n' "$key" "$val" >> "$_tmp"
+    mv "$_tmp" "$state"
+  else
+    printf '%s: %s\n' "$key" "$val" >> "$state"
+  fi
+}
+
+# US-LOOP-062a: background-heal a red loop/* PR (loop_self_ci_red verdict).
+# Bounded by heal_count.pr:<num> (max ROLL_LOOP_HEAL_MAX, default 2);
+# ROLL_LOOP_NO_HEAL=1 disables. A per-PR lock (pid marker) prevents duplicate
+# concurrent heals; a stale lock from a dead pid is reclaimed. On disabled /
+# budget-exhausted / nothing-to-do → a deduped ALERT (never silent). The heal
+# agent is chosen via _project_agent() (no bare `claude -p`). Non-blocking: the
+# actual checkout→fix→push runs in a background subshell so the PR tick returns
+# immediately.
+_loop_pr_heal_self() {
+  local num="$1" head_ref="$2" slug="${3:-}"
+  [ -n "$num" ] || return 0
+
+  local heal_max="${ROLL_LOOP_HEAL_MAX:-2}"
+  if [ "${ROLL_LOOP_NO_HEAL:-}" = "1" ] || [ "${heal_max:-0}" -le 0 ]; then
+    _loop_pr_ci_red_alert "$num" "$head_ref" "auto-heal off (ROLL_LOOP_NO_HEAL) — fix manually"
+    return 0
+  fi
+
+  local heal_dir; heal_dir="$(_loop_heal_dir)"
+  mkdir -p "$heal_dir" 2>/dev/null || true
+  local lock="${heal_dir}/pr-${num}.lock"
+  if [ -f "$lock" ]; then
+    local lpid; lpid=$(cat "$lock" 2>/dev/null || echo "")
+    if [ -n "$lpid" ] && kill -0 "$lpid" 2>/dev/null; then
+      return 0                       # heal already in flight for this PR
+    fi
+    rm -f "$lock"                     # stale lock (dead pid) — reclaim
+  fi
+
+  local key="heal_count.pr:${num}"
+  local count=0
+  [ -f "${_LOOP_STATE}" ] && count=$(grep "^${key}:" "${_LOOP_STATE}" 2>/dev/null | awk '{print $2}' | head -1)
+  count=$(( ${count:-0} + 0 ))
+  if [ "$count" -ge "$heal_max" ]; then
+    _loop_pr_ci_red_alert "$num" "$head_ref" "auto-heal budget exhausted (${count}/${heal_max}) — fix manually"
+    return 0
+  fi
+  _loop_state_set "$key" "$(( count + 1 ))"
+
+  local agent; agent="$(_project_agent 2>/dev/null)"; agent="${agent:-claude}"
+
+  ( echo "$BASHPID" > "$lock"
+    _loop_pr_do_heal "$num" "$head_ref" "$slug" "$agent" >/dev/null 2>&1
+    rm -f "$lock"
+  ) &
+  disown 2>/dev/null || true
+  info "PR #${num}: background heal $(( count + 1 ))/${heal_max} dispatched (agent=${agent})"
+  return 0
+}
+
+# US-LOOP-062a: the actual heal work (runs in the background subshell). Gathers
+# the failing-CI context, checks out the PR branch in a throwaway worktree, hands
+# the fix to the dynamically-selected agent via _agent_argv (no bare claude -p),
+# and pushes back to the SAME PR branch. Best-effort: any failure leaves the PR
+# untouched for the next tick (the heal budget caps retries). Overridable in
+# tests.
+_loop_pr_do_heal() {
+  local num="$1" head_ref="$2" slug="${3:-}" agent="${4:-claude}"
+  [ -n "$num" ] && [ -n "$head_ref" ] || return 1
+  command -v gh >/dev/null 2>&1 || return 1
+  [ -n "$slug" ] || _gh_resolve slug || return 1
+
+  # Capture failing-run context for the fix prompt.
+  local ctx="/tmp/roll-heal-pr-${num}.log"
+  {
+    printf '=== CI heal context: PR #%s (%s) ===\n\n' "$num" "$head_ref"
+    gh -R "$slug" pr checks "$num" 2>/dev/null || true
+    local _run
+    _run=$(gh -R "$slug" pr checks "$num" --json link --jq '.[]|select(.state=="FAILURE")|.link' 2>/dev/null \
+             | grep -oE 'runs/[0-9]+' | head -1 | cut -d/ -f2)
+    if [ -n "$_run" ]; then
+      printf '\n--- failing run log (tail) ---\n'
+      gh -R "$slug" run view "$_run" --log-failed 2>/dev/null | tail -200 || true
+    fi
+  } > "$ctx" 2>&1
+
+  # Isolated worktree on the PR branch.
+  local wt; wt="$(mktemp -d)/pr-${num}"
+  git fetch origin "$head_ref" >/dev/null 2>&1 || return 1
+  git worktree add "$wt" "origin/${head_ref}" >/dev/null 2>&1 || { rm -rf "$(dirname "$wt")"; return 1; }
+
+  local prompt="[roll PR 自愈] PR #${num} (${head_ref}) 的 CI 红了。失败上下文见 ${ctx}。请只修使 CI 转绿所需的最小改动,保持 TCR 微提交节奏,改完直接 commit。不要改无关代码,不要反问。"
+  _agent_argv "$agent" text "$prompt"
+  ( cd "$wt" && "${_AGENT_ARGV[@]}" ) >/dev/null 2>&1 || true
+
+  # Push back to the same PR branch if the agent produced commits.
+  if [ -n "$(cd "$wt" && git rev-list "origin/${head_ref}..HEAD" 2>/dev/null)" ]; then
+    ( cd "$wt" && git push origin "HEAD:${head_ref}" ) >/dev/null 2>&1 || true
+  fi
+  git worktree remove --force "$wt" >/dev/null 2>&1 || true
+  rm -rf "$(dirname "$wt")" 2>/dev/null || true
+}
+
+# US-LOOP-062b: merge a human-approved PR directly when CI is green and the PR
+# is conflict-free, instead of waiting for repo-level auto-merge (which may be
+# disabled). Mirrors the bot-approved eager-merge. Merge failure is NON-fatal:
+# the PR is left open and the next PR-loop tick retries.
+_loop_pr_merge_approved() {
+  local num="$1" ci_state="$2" mergeable="$3" slug="$4"
+  [ -n "$num" ] && [ -n "$slug" ] || return 0
+  [ "$ci_state" = "success" ] && [ "$mergeable" = "MERGEABLE" ] || return 0
+  if gh -R "$slug" pr merge "$num" --squash --delete-branch >/dev/null 2>&1; then
+    info "PR #${num}: human-approved + CI green — merged"
+  else
+    warn "PR #${num}: merge failed (human-approved + CI green) — left open, will retry"
+  fi
+}
+
 # REFACTOR-030: removed `_loop_self_heal_ci` and `_loop_clear_heal_state`.
 # REFACTOR-023 merged the CI self-heal counter into the main state.yaml flow,
 # but the two helpers themselves were left behind as dead code. Their job
@@ -11717,22 +11853,19 @@ _loop_pr_inbox() {
         _loop_pr_merge_self_eager "$num" "$ci_state" "$mergeable" "$slug"
         ;;
       loop_self_ci_red)
-        # FIX-158: _loop_pr_classify (US-LOOP-049) labels a red loop/* PR
-        # loop_self_ci_red, but US-LOOP-050's heal handler was lost in
-        # REFACTOR-030 — this verdict had no branch, so a red self-PR fell
-        # through silently: GitHub auto-merge can't merge it (CI red) and
-        # nothing healed it, leaving a permanent zombie PR. Until the full
-        # checkout→fix→push auto-heal is re-wired, surface a deduped ALERT so
-        # the red self-PR is visible instead of dropped (full fix: FIX-158).
-        local _ci_red_alert="$_LOOP_ALERT"
-        mkdir -p "$(dirname "$_ci_red_alert")" 2>/dev/null || true
-        if ! grep -qF "[TYPE:loop-pr-ci-red] PR #${num} " "$_ci_red_alert" 2>/dev/null; then
-          printf '[%s] [error] [TYPE:loop-pr-ci-red] PR #%s %s: own loop PR CI red — needs heal (FIX-158)\n' \
-            "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$num" "$head_ref" >> "$_ci_red_alert"
-        fi
+        # US-LOOP-062a: a red loop/* PR (classified by US-LOOP-049) is now
+        # background-healed: bounded retries via heal budget + dynamic agent,
+        # falling back to the deduped [TYPE:loop-pr-ci-red] ALERT (FIX-158's
+        # surfacing) when heal is disabled/exhausted. Re-wires US-LOOP-050.
+        _loop_pr_heal_self "$num" "$head_ref" "$slug" || true
+        ;;
+      blocked_human_request_changes)
+        : # skip — last human review requested changes; wait for the author
         ;;
-      blocked_human_request_changes|blocked_human_approved)
-        : # skip — explained by verdict; nothing to do this cycle
+      blocked_human_approved)
+        # US-LOOP-062b: human approved — merge directly when green + mergeable
+        # (don't wait for repo auto-merge, which may be off).
+        _loop_pr_merge_approved "$num" "$ci_state" "$mergeable" "$slug" || true
         ;;
       stale)
         _loop_pr_rebase_circuit "$num" || true
@@ -15440,12 +15573,13 @@ _notify_update() {
   [[ -f "$cache" ]] || return 0
   local latest; latest=$(awk '{print $2}' "$cache" 2>/dev/null || true)
   [[ -z "$latest" || "$latest" == "$VERSION" ]] && return
-  local newer; newer=$(printf '%s\n%s\n' "$VERSION" "$latest" | sort -V | tail -1)
-  if [[ "$newer" == "$VERSION" ]]; then
-    # Running version is newer than cached — stale cache, clear it
-    rm -f "$cache"
-    return
-  fi
+  # FIX-163: the cached `latest` is GitHub's releases/latest — the newest
+  # release by created_at, NOT by semver. Under the MAJOR.MMDD scheme a plain
+  # `sort -V` mis-ranks versions across the year-based→MAJOR.MMDD transition
+  # (2026.601.4 > 2.602.1) and the Jan-1 MMDD wrap (2.1231.N > 2.101.1), which
+  # previously (a) reverse-nagged users to "upgrade" to an older release and
+  # (b) silently suppressed real updates after the wrap. Trust GitHub's
+  # chronological latest: if it differs from what's running, surface it.
   echo ""
   warn "$(msg update.available "$latest")"
 }

package/lib/model_prices.py

@@ -152,12 +152,20 @@ def _resolve_name(model: Optional[str],
     return fallback
 
 
+_NO_CURRENCY_MATCH = "\x00__no_currency_match__\x00"
+
+
 def currency_for(model: Optional[str]) -> str:
     """Return the native currency code (USD/CNY) for a model.
 
-    Falls back to 'USD' when the model isn't in any snapshot.
+    Falls back to 'USD' when the model isn't in any snapshot. FIX-162: resolve
+    with a sentinel default so a *genuinely unknown* model returns USD instead
+    of inheriting the global DEFAULT model's currency (which is a CNY kimi
+    entry — that would mislabel unrelated unknown models as CNY).
     """
-    name = _resolve_name(model)
+    name = _resolve_name(model, default=_NO_CURRENCY_MATCH)
+    if name == _NO_CURRENCY_MATCH:
+        return "USD"
     return _CURRENCY.get(name, "USD")
 
 

package/lib/prices/snapshot-2026-05-23-kimi.json

@@ -3,12 +3,13 @@
   "effective_at": "2026-05-23",
   "source_url": "https://platform.kimi.com/docs/pricing/chat",
   "vendor": "kimi",
-  "currency": "USD",
+  "currency": "CNY",
   "default_model": "kimi-k2.5",
-  "notes": "Rates per million tokens (USD). cache_create estimated at 1.25x input. Prices from public Kimi API platform docs — verify with `roll prices refresh` if page layout changes. Model names: kimi-k2 (prior gen), kimi-k2.5 (current), kimi-k2.6 (latest).",
+  "notes": "Rates per million tokens (CNY). cache_create estimated at 1.25x input. Prices from public Kimi API platform docs — verify with `roll prices refresh` if page layout changes. Model names: kimi-k2 (prior gen), kimi-k2.5 (current), kimi-k2.6 (latest). kimi-for-coding is the kimi-code CLI's model id (alias of the current K2 line) — FIX-162 so usage events tagged `kimi-code/kimi-for-coding` resolve to a real CNY entry instead of falling back to USD.",
   "prices": {
     "kimi-k2":   {"in": 1.00, "out": 4.00, "cache_create": 1.25, "cache_read": 0.25},
     "kimi-k2.5": {"in": 1.00, "out": 4.00, "cache_create": 1.25, "cache_read": 0.25},
-    "kimi-k2.6": {"in": 1.00, "out": 4.00, "cache_create": 1.25, "cache_read": 0.25}
+    "kimi-k2.6": {"in": 1.00, "out": 4.00, "cache_create": 1.25, "cache_read": 0.25},
+    "kimi-for-coding": {"in": 1.00, "out": 4.00, "cache_create": 1.25, "cache_read": 0.25}
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seanyao/roll",
-  "version": "2.602.1",
+  "version": "2.602.2",
   "description": "Roll — Roll out features with AI agents",
   "scripts": {
     "test": "bash tests/run.sh"

package/skills/roll-design/SKILL.md

@@ -227,7 +227,7 @@ User Input
               │ Approach confirmed
               ▼
 ┌─────────────────────────────┐
-│ [peer] Direction Review     │  ← if complexity=large or cross-context; 10s opt-out
+│ [peer] Direction Review     │  ← if complexity=medium/large or cross-context; 10s opt-out
 │    Skill("roll-peer",       │
 │      tag="architecture")    │
 └─────────────┬───────────────┘
@@ -298,7 +298,7 @@ User Input
                                  │
                                  ▼
               ┌─────────────────────────────────────────┐
-              │ [peer] Plan Review                       │  ← if complexity=large; 10s opt-out
+              │ [peer] Plan Review                       │  ← if complexity=medium/large; 10s opt-out
               │    Skill("roll-peer", tag="architecture")│
               └──────────────────┬──────────────────────┘
                                  │ AGREE / skipped
@@ -840,13 +840,19 @@ Two checkpoints, both with 10s opt-out:
 ```
 1. After Discuss — Direction Review
    Approach confirmed → [peer, tag=architecture] → challenge the direction before DDD
-   Trigger: complexity=large OR requirement touches multiple Bounded Contexts
+   Trigger: complexity=medium OR complexity=large OR requirement touches multiple Bounded Contexts
 
 2. After Solution Design — Plan Review
    Plan written → [peer, tag=architecture] → full plan review before story split
-   Trigger: complexity=large (greenfield always qualifies)
+   Trigger: complexity=medium OR complexity=large (greenfield always qualifies)
 ```
 
+Rationale (US-SKILL-018): medium-complexity designs also routinely carry
+direction/plan risks worth one independent challenge before story split — the
+cost of one bounded peer pass is small next to reworking a misaimed design after
+it ships. So peer now triggers at medium as well as large; the 10s opt-out
+stays, so you can always skip when you're confident.
+
 On AGREE or user skip → continue to the next step normally.
 On REFINE/OBJECT → incorporate feedback, regenerate the relevant output, re-trigger peer.
 On ESCALATE → present both proposals to user for final call.

package/skills/roll-loop/SKILL.md

@@ -157,9 +157,10 @@ Call `_loop_pr_inbox` after the pre-run CI check passes. It walks
 
 | Classification | Action |
 |---|---|
-| `loop_self` (head ref starts with `loop/`) | Skip — let GitHub auto-merge handle it; never AI-review your own commit |
+| `loop_self` (head ref starts with `loop/`, CI not red) | Skip — let GitHub auto-merge handle it; never AI-review your own commit |
+| `loop_self_ci_red` (loop/* PR whose CI went red) | **US-LOOP-062a**: `_loop_pr_heal_self` — background-heal (per-PR lock + heal budget `ROLL_LOOP_HEAL_MAX`, default 2, via `_project_agent`); on `ROLL_LOOP_NO_HEAL=1` / budget exhausted → deduped `[TYPE:loop-pr-ci-red]` ALERT (never silently dropped) |
 | `blocked_human_request_changes` | Skip — last human review requested changes; wait for the author to push fixes |
-| `blocked_human_approved` | Skip — let GitHub auto-merge after CI is green |
+| `blocked_human_approved` | **US-LOOP-062b**: `_loop_pr_merge_approved` — merge directly (`gh pr merge --squash`) when CI green + mergeable, instead of relying on repo auto-merge (which may be off); merge failure is non-fatal (retried next tick) |
 | `stale` (CI failed or branch behind/conflicting) | Try `_loop_pr_rebase_stale` after the circuit breaker allows it |
 | `eligible` (clean external PR, no blocking review) | Invoke `_loop_pr_review_external` — the actual decision is provided by US-AUTO-035's GitHub Action |