@sjawhar/pi-legion-envoy 1.23.0 → 1.24.0

package/dist/legion.js

@@ -34715,6 +34715,112 @@ function isSingleLegionCommand(command) {
     return false;
   return trimmed.split(/\s+/, 1)[0] === "legion";
 }
+var JJ_LOG_REWRITE_WORDS = ["undo", "abandon"];
+var JJ_OP_WORDS = ["op", "operation"];
+var JJ_OP_LOG_REWRITE_WORDS = ["restore", "revert"];
+var JJ_MENTION = /\bjj\b/;
+var JJ_LOG_REWRITE_MENTION = /\b(?:undo|abandon)\b|\b(?:op|operation)\b\W+(?:restore|revert)\b/;
+function jjLogRewriteMention(text) {
+  if (!JJ_MENTION.test(text))
+    return;
+  const match = JJ_LOG_REWRITE_MENTION.exec(text);
+  return match === null ? undefined : match[0].replace(/\W+/g, " ");
+}
+function splitShellCommands(command) {
+  const commands = [];
+  let words = [];
+  let text = "";
+  let inWord = false;
+  let quote;
+  const endWord = () => {
+    if (inWord)
+      words.push(text);
+    text = "";
+    inWord = false;
+  };
+  const endCommand = () => {
+    endWord();
+    if (words.length > 0)
+      commands.push(words);
+    words = [];
+  };
+  for (let i = 0;i < command.length; i += 1) {
+    const char = command.charAt(i);
+    if (quote !== undefined) {
+      if (char === quote)
+        quote = undefined;
+      else if (quote === '"' && char === "\\" && command.charAt(i + 1) === `
+`)
+        i += 1;
+      else if (quote === '"' && char === "\\" && i + 1 < command.length) {
+        i += 1;
+        text += command.charAt(i);
+      } else
+        text += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      inWord = true;
+    } else if (char === "\\") {
+      if (command.charAt(i + 1) === `
+`)
+        i += 1;
+      else if (i + 1 < command.length) {
+        i += 1;
+        text += command.charAt(i);
+        inWord = true;
+      }
+    } else if (char === " " || char === "\t" || char === "<" || char === ">") {
+      endWord();
+    } else if (char === "&" && (command.charAt(i - 1) === ">" || command.charAt(i - 1) === "<" || command.charAt(i + 1) === ">")) {
+      endWord();
+    } else if (";&|\n()`".includes(char)) {
+      endCommand();
+    } else {
+      text += char;
+      inWord = true;
+    }
+  }
+  if (quote !== undefined)
+    return;
+  endCommand();
+  return commands;
+}
+function jjLogRewriteInvocation(command) {
+  const commands = splitShellCommands(command);
+  if (commands === undefined) {
+    return jjLogRewriteMention(command) === undefined ? undefined : command.trim();
+  }
+  for (const words of commands) {
+    const mentioned = words.find((word) => jjLogRewriteMention(word) !== undefined);
+    if (mentioned !== undefined)
+      return mentioned;
+    const jj = words.findIndex((word) => word === "jj" || word.endsWith("/jj"));
+    if (jj === -1)
+      continue;
+    const args = words.slice(jj + 1);
+    const rewritesLog = args.some((arg) => JJ_LOG_REWRITE_WORDS.includes(arg)) || args.some((arg) => JJ_OP_WORDS.includes(arg)) && args.some((arg) => JJ_OP_LOG_REWRITE_WORDS.includes(arg));
+    if (rewritesLog)
+      return words.slice(jj).join(" ");
+  }
+  return;
+}
+function jjLogRewriteAttempt(toolCall) {
+  const { toolName, input } = toolCall;
+  if (toolName === "bash") {
+    return typeof input.command === "string" ? jjLogRewriteInvocation(input.command) : undefined;
+  }
+  let text;
+  if (toolName === "eval" && typeof input.code === "string")
+    text = input.code;
+  else if (toolName === "hub") {
+    text = [input.application, ...Array.isArray(input.args) ? input.args : [], input.text].filter((part) => typeof part === "string").join(" ");
+  } else
+    return;
+  const mention = jjLogRewriteMention(text);
+  return mention === undefined ? undefined : `${toolName}: jj ${mention}`;
+}
 var LEGION_LOADED_MARKER = Symbol.for("legion.pi-envoy.legion-loaded");
 var CODE_MUTATION_TOOLS = ["edit", "write", "apply_patch"];
 var MERGER_BLOCKED_TOOLS = [...CODE_MUTATION_TOOLS, "task"];
@@ -34738,6 +34844,7 @@ function legionExtension(pi) {
     subagentSession ??= isSubagentSession(context);
     return subagentSession;
   };
+  let phaseWorkerPane;
   const roleDaemon = () => {
     return createLegionDaemonClient(requiredEnvironment(process.env, "LEGION_DAEMON_URL"), fetch, {
       recoveryToken: (sessionId) => {
@@ -35009,6 +35116,16 @@ function legionExtension(pi) {
       toolCallId: toolCall.toolCallId,
       toolName: toolCall.toolName
     });
+    phaseWorkerPane ??= classifySession(process.env).kind === "phase-worker";
+    if (phaseWorkerPane) {
+      const jjAttempt = jjLogRewriteAttempt(toolCall);
+      if (jjAttempt !== undefined) {
+        return {
+          block: true,
+          reason: `refused \`${jjAttempt}\`: jj undo, jj abandon, and jj op restore/revert/abandon/undo ` + "rewrite the jj operation log, which every Legion issue workspace shares (each is a jj " + "workspace of one clone), so they rewrite other trees' commits too. Recover forward with " + "a new commit or `jj restore <paths>` of files; anything else, stop and send the owning " + 'architect the `jj -R "$LEGION_WORKSPACE" log` evidence.'
+        };
+      }
+    }
     if (await checkSubagentSession(context))
       return;
     const sessionID = context.sessionManager.getSessionId();

package/dist/skills/legion-architect/SKILL.md

@@ -204,13 +204,13 @@ legion({
   op: "spawn_worker",
   issue: "LEGION-40",
   role: "implementer",
-  task: "Run the legion-retro skill now. Capture durable learnings and post the issue comment; do not create a .legion handoff file."
+  task: "Run the legion-retro skill now. Capture durable learnings and post the retro message on the Dispatch issue with dispatch_message; do not create a .legion handoff file."
 })
 ```
 
 Wait for the implementer to report its durable retro result. Retro output is
-`docs/solutions/` plus an issue comment; it must not create a `.legion` file or rewrite
-the reviewer-approved head after cleanup.
+`docs/solutions/` plus one `dispatch_message` on the issue; it must not create a `.legion`
+file or rewrite the reviewer-approved head after cleanup.
 
 ## 6. Architect sign-off and merge
 

package/dist/skills/legion-retro/SKILL.md

@@ -17,7 +17,8 @@ retrospective's durable output.
 1. Tester green and all code-review cycles finish.
 2. The implementer pushes the `.legion/` deletion at the reviewer's direction, and the reviewer
    approves that head.
-3. Run this retro: commit durable learnings to `docs/solutions/` and post the issue comment.
+3. Run this retro: commit durable learnings to `docs/solutions/` and post the retro message on
+   the Dispatch issue.
    Retro writes **no `.legion` file**, so it never re-dirties the cleaned handoff tree.
 4. The merger verifies the tip is the approved head plus commits that change only
    `docs/solutions/` — `jj diff --from <approved-sha> --to <tip-sha> --summary`, quoted in READY —
@@ -66,18 +67,22 @@ date: YYYY-MM-DD
 status: active
 module: affected-module
 related_issues:
-  - "owner/repo#123"
+  - "LEGION-123"      # the Dispatch issue
+  - "owner/repo#456"  # the pull request
 ---
 ```
 
 Commit the documentation on the existing issue branch, advance its existing bookmark, and push
-that branch. Do not create a replacement branch or bookmark. Then post an issue comment naming
-the documents and the one-to-three most useful takeaways. The comment must carry this revived
-implementer's structured attribution footer with `phase` set to `retro`:
+that branch. Do not create a replacement branch or bookmark. Then post one Dispatch message on
+the issue — `issue` is your `LEGION_ISSUE`; Legion issues live on Dispatch, never on a GitHub
+issue, and the `gh` shim refuses every GitHub-issue write — naming the documents and the
+one-to-three most useful takeaways. The message must carry this revived implementer's structured
+attribution footer with `phase` set to `retro`; the body is capped at 2,000 characters:
 
-```bash
-legion gh -- issue comment <issue-number> \
-  --body $'## Retro Complete
+```ts
+dispatch_message({
+  issue: "<KEY>",
+  body: `## Retro Complete
 
 **Learnings documented in:**
 - docs/solutions/<path>.md
@@ -85,11 +90,11 @@ legion gh -- issue comment <issue-number> \
 **Key takeaways:**
 - <reusable lesson>
 
-<!-- legion: {"session":"<session-id>","phase":"retro"} -->' \
-  --repo <owner>/<repo>
+<!-- legion: {"session":"<session-id>","phase":"retro"} -->`,
+})
 ```
 
-The issue comment and `docs/solutions/` commit are the only retro outputs. Never write a
+The Dispatch message and the `docs/solutions/` commit are the only retro outputs. Never write a
 handoff, phase artifact, local feedback log, or completion label; `.legion/` was deleted before
 retro and nothing recreates it. Report completion with `legion handoff complete` alone (its
 summary: two sentences for the architect) — no `legion handoff write`.
@@ -100,7 +105,7 @@ Before returning, verify all of the following:
 
 - The reviewer cleanup commit remains below the retro documentation commit, and the reviewer's
   approval of that cleanup head stands: the merger accepts the approved head plus this commit.
-- The learning documents and issue comment both exist.
+- The learning documents and the Dispatch message both exist.
 - No `.legion` file was created or modified by retro.
 - The fresh-eyes analysis was considered alongside the implementer's context.
 - The merger remains a subsequent step, not work performed by retro.

package/dist/skills/legion-worker/SKILL.md

@@ -120,10 +120,21 @@ transcript, the committed file wins: it is the copy that survived.
 - **Before pushing, check ancestry:** `jj -R "$LEGION_WORKSPACE" log -r 'ancestors(@, 5)'`
   — verify only your issue's commits are in the chain, not unrelated work.
 
-**Shared operation safety:** Never run `jj op restore` in a Legion workspace. It rewrites
-the shared operation log. If a mistake reaches that point, stop and send the owning
-architect the `jj -R "$LEGION_WORKSPACE" log` evidence; recover only through the approved,
-path-scoped workflow.
+**Shared operation safety:** Every Legion issue workspace is a `jj workspace` of one shared
+clone, so they all share one operation log: `jj undo`, `jj abandon`, and
+`jj op restore|revert|abandon|undo` rewrite it for every tree at once (on 2026-09-12 one
+worker's `jj undo` rewrote nine of another tree's commits). The extension refuses them in every
+phase-worker pane before they run — a `bash` command in any position of a pipeline or `&&`
+chain, with or without `-R`, judged on the whole argument list; `eval` code; and a `hub`
+process start — from your own tool calls and from any `task` subagent you spawn (it runs in
+your pane, against the same log), and a `bash` command whose quoted text merely mentions `jj`
+with one of those words (a heredoc, an echo, a commit message) is refused too: write such text
+with the `write` tool or say "operation-log rollback" instead. `jj restore <paths>`,
+`jj op log`, and `jj op show` stay allowed. Recover forward only: a new commit
+(`jj -R "$LEGION_WORKSPACE" new`) or `jj -R "$LEGION_WORKSPACE" restore <paths>` of files.
+Anything else, stop and send the owning architect the `jj -R "$LEGION_WORKSPACE" log`
+evidence; the architect decides, and an operator performs any operation-log restore with every
+other tree paused.
 
 ## Phase work
 
@@ -152,22 +163,29 @@ that execs `legion gh -- "$@"`, so `gh …` and `legion gh -- …` are the same
 redeems a fresh token from your session's grant — identity is supplied per call, never stored.
 Never run `gh auth login` or `gh auth setup-git`; there is no login state to create. The shim
 refuses `pr merge` (and a raw `gh api …/merge`): no worker role merges a pull request — the merge
-queue does, under its own authority. The credential reaches `legion` through the file
-`$LEGION_GRANT_FILE` names, written before each of your bash commands by the extension; never
-`cat`, `echo`, copy, or `export` it — `legion credential`, `legion gh`, `jj git push`, and
-`legion handoff complete` read it themselves. The file is the pane's, not the command's: a `task`
-subagent, an `eval` subprocess, or a background job in your pane reads the grant your last bash
-command minted, so its `legion gh` or `jj git push` succeeds only within 60 seconds of that call
-and 403s afterwards — a timing artifact, not a broken credential; run credentialed commands from
-your own bash calls.
+queue does, under its own authority. It also refuses every GitHub-issue write — the `issue`
+subcommand's `comment`, `create`, `edit`, `close`, `reopen`, `delete`, `pin`, `unpin`, `transfer`,
+`lock`, `unlock`, and `develop`, and any raw `gh api` call to an `/issues` path whose method is not
+GET (an explicit `-X`, or the POST that `-f`/`-F`/`--input` imply; pull-request conversation
+comments live on that path too, so edit them with `gh pr comment`) — printing
+`Legion issues live on Dispatch; use dispatch_message or dispatch_comment on <your LEGION_ISSUE>`:
+Legion never reads or writes a GitHub issue (LEGION-78). `pr comment`, `pr review`,
+`api …/pulls/…`, `api graphql`, and issue reads are unaffected. The credential reaches `legion`
+through the file `$LEGION_GRANT_FILE` names, written before each of your bash commands by the
+extension; never `cat`, `echo`, copy, or `export` it — `legion credential`, `legion gh`,
+`jj git push`, and `legion handoff complete` read it themselves. The file is the pane's, not the
+command's: a `task` subagent, an `eval` subprocess, or a background job in your pane reads the
+grant your last bash command minted, so its `legion gh` or `jj git push` succeeds only within 60
+seconds of that call and 403s afterwards — a timing artifact, not a broken credential; run
+credentialed commands from your own bash calls.
 
 ## GitHub PR comment attribution
 
 Append this exact structured footer to **every** pull-request comment and review that this
 phase posts on GitHub. It preserves session provenance on the artifact itself so work stays
 attributable to the session that produced it. Dispatch comments carry session provenance
-natively through their own `actor`/`origin` fields; this footer is only for GitHub PR
-artifacts:
+natively through their own `actor`/`origin` fields; this footer is for GitHub PR artifacts and
+for the retro's Dispatch message (`skills/legion-retro`):
 
 ```html
 <!-- legion: {"session":"<session-id>","phase":"<phase>"} -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "1.23.0",
+  "version": "1.24.0",
   "type": "module",
   "omp": {
     "extensions": [