@sjawhar/pi-legion-envoy 5.16.6 → 5.16.8

package/dist/envoy.js

@@ -30600,6 +30600,7 @@ function controllerToken(project) {
 
 // ../contracts/src/legion-daemon-api.ts
 var nonEmptyString = exports_external.string().min(1);
+var appLogin = exports_external.string().regex(/^[^[\]]+\[bot\]$/);
 var legionRole = exports_external.enum(LEGION_ROLES);
 var requiredUnknown = exports_external.unknown().refine((value) => value !== undefined, {
   message: "Required"
@@ -30853,7 +30854,11 @@ var LegionDaemonApi = {
   },
   GitHubToken: {
     request: exports_external.strictObject({ grantId: nonEmptyString }),
-    response: exports_external.object({ token: nonEmptyString, appLogin: exports_external.string().endsWith("[bot]") })
+    response: exports_external.object({
+      token: nonEmptyString,
+      appLogin: exports_external.string().endsWith("[bot]"),
+      legionAppLogins: exports_external.object({ implement: appLogin, review: appLogin }).optional()
+    })
   },
   GitCredential: {
     request: exports_external.strictObject({ grantId: nonEmptyString })

package/dist/legion.js

@@ -30769,6 +30769,7 @@ function controllerToken(project) {
 
 // ../contracts/src/legion-daemon-api.ts
 var nonEmptyString = exports_external.string().min(1);
+var appLogin = exports_external.string().regex(/^[^[\]]+\[bot\]$/);
 var legionRole = exports_external.enum(LEGION_ROLES);
 var requiredUnknown = exports_external.unknown().refine((value) => value !== undefined, {
   message: "Required"
@@ -31022,7 +31023,11 @@ var LegionDaemonApi = {
   },
   GitHubToken: {
     request: exports_external.strictObject({ grantId: nonEmptyString }),
-    response: exports_external.object({ token: nonEmptyString, appLogin: exports_external.string().endsWith("[bot]") })
+    response: exports_external.object({
+      token: nonEmptyString,
+      appLogin: exports_external.string().endsWith("[bot]"),
+      legionAppLogins: exports_external.object({ implement: appLogin, review: appLogin }).optional()
+    })
   },
   GitCredential: {
     request: exports_external.strictObject({ grantId: nonEmptyString })
@@ -33415,7 +33420,7 @@ import { logger } from "@oh-my-pi/pi-utils";
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion-envoy",
-  version: "5.16.6",
+  version: "5.16.8",
   type: "module",
   omp: {
     extensions: [
@@ -33428,7 +33433,7 @@ var package_default = {
   },
   legion: {
     daemonApiVersion: 9,
-    goDaemonApiVersion: 10
+    goDaemonApiVersion: 11
   },
   repository: {
     type: "git",
@@ -33990,9 +33995,11 @@ var LegionGoGrantResponse = exports_external.strictObject({
   grantId: nonEmptyString2,
   expiresAt: timestamp
 });
+var appLogin2 = exports_external.string().regex(/^[^[\]]+\[bot\]$/);
 var LegionGoGitHubTokenResponse = exports_external.strictObject({
   token: nonEmptyString2,
-  appLogin: exports_external.string().endsWith("[bot]")
+  appLogin: exports_external.string().endsWith("[bot]"),
+  legionAppLogins: exports_external.strictObject({ implement: appLogin2, review: appLogin2 }).optional()
 });
 var LegionGoGitCredentialResponse = exports_external.strictObject({
   username: exports_external.literal("x-access-token"),
@@ -41227,6 +41234,15 @@ function scanIpythonShell(source, sinks) {
 }
 
 // src/legion/pane-guard.ts
+var definitions = new WeakMap;
+function trapSignal(operand) {
+  const name = operand.toUpperCase();
+  if (name === "0")
+    return "EXIT";
+  return name.startsWith("SIG") && name !== "SIGEXIT" ? name.slice(3) : name;
+}
+var UNREADABLE_CONDITION = "an unreadable condition";
+
 class Refusal extends Error {
   snippet;
   line;
@@ -41252,7 +41268,7 @@ function wrapRefusal(error48, site, label) {
   throw new Refusal(site.snippet, site.line, `line ${error48.line} of ${source}, \`${error48.snippet}\`: ${error48.detail}`);
 }
 var MAX_DEPTH = 8;
-var MAX_WALK_STEPS = 1e4;
+var MAX_WALK_STEPS = 1e5;
 var MAX_ALTERNATIVES = 64;
 var MAX_SCRIPT_BYTES = 1024 * 1024;
 var FRESH_TEMP_NAME = "tmp.XXXXXXXXXX";
@@ -41570,12 +41586,22 @@ function substitution(script, text, st, ctx) {
   }
   const only = script?.commands.length === 1 ? script.commands[0]?.command : undefined;
   const invocation = substitutionInvocation(only, st, ctx);
-  const definition = invocation === undefined ? undefined : st.functions.get(invocation.base);
-  if (definition !== undefined && invocation !== undefined) {
-    const output = functionOutput(invocation.base, definition, invocation.rest, st, ctx);
-    if (output !== undefined)
-      return output.map((value) => [...value]);
+  const callee = invocation === undefined ? undefined : st.functions.get(invocation.base);
+  if (callee !== undefined && invocation !== undefined) {
+    const alternatives = [];
+    let external2 = false;
+    for (const definition of callee) {
+      const output = definition === undefined ? undefined : functionOutput(invocation.base, definition, invocation.rest, st, ctx);
+      if (output !== undefined)
+        alternatives.push(...output.map((value) => [...value]));
+      else
+        external2 = true;
+    }
+    return external2 ? [...alternatives, ...commandOutput(only, invocation, text, st, ctx)] : alternatives;
   }
+  return commandOutput(only, invocation, text, st, ctx);
+}
+function commandOutput(only, invocation, text, st, ctx) {
   if (invocation !== undefined) {
     if (invocation.base === "pwd" && invocation.rest.length === 0 && st.cwd !== undefined) {
       return [[literal2(st.cwd)]];
@@ -41813,7 +41839,7 @@ function walkSubstitution(script, inner, text, st, ctx) {
     throw new Refusal(text, 1, `the guard could not read the command in \`${text}\``);
   }
   const source = parsed.source ?? (script === undefined ? inner ?? "" : st.source);
-  walkScript(parsed, { ...clone2(st), source }, ctx);
+  walkScript(parsed, subshell(st, { source }), ctx);
 }
 function clone2(st) {
   return {
@@ -41856,6 +41882,8 @@ function merge2(target, branches) {
       target.arrays.set(name, new Map([[UNKNOWN_ARRAY_INDEX, unknownElement]]));
     }
   }
+  const positionals = branches.map((branch) => JSON.stringify(branch.positional ?? null));
+  target.positional = positionals.every((value) => value === positionals[0]) ? branches[0]?.positional : undefined;
   const cwds = new Set(branches.map((branch) => branch.cwd));
   if (cwds.size > 1) {
     target.cwd = undefined;
@@ -41869,6 +41897,46 @@ function merge2(target, branches) {
       target.exported.add(name);
     target.backgroundStarted ||= branch.backgroundStarted;
   }
+  const functionNames = new Set;
+  for (const branch of branches)
+    for (const name of branch.functions.keys())
+      functionNames.add(name);
+  const functions = new Map;
+  for (const name of functionNames) {
+    const callees = branches.map((branch) => branch.functions.get(name));
+    const first = callees[0];
+    if (first !== undefined && callees.every((callee) => callee === first)) {
+      functions.set(name, first);
+      continue;
+    }
+    const candidates = new Set;
+    for (const callee of callees)
+      for (const definition of callee ?? [undefined])
+        candidates.add(definition);
+    functions.set(name, [...candidates]);
+  }
+  target.functions = functions;
+  const lifted = [];
+  let merged;
+  for (const branch of branches) {
+    for (const trap of branch.traps) {
+      if (target.traps.includes(trap))
+        continue;
+      merged ??= new Map(target.vars);
+      lifted.push({ ...trap, vars: handlerVars(trap, branch.vars), merged });
+    }
+  }
+  target.traps = [...target.traps, ...lifted];
+}
+function handlerVars(trap, vars) {
+  const { vars: branch, merged } = trap;
+  if (branch === undefined || merged === undefined)
+    return vars;
+  const out = new Map(vars);
+  for (const [name, value] of branch)
+    if (vars.get(name) === merged.get(name))
+      out.set(name, value);
+  return out;
 }
 function lineOf(source, pos) {
   let line = 1;
@@ -41894,13 +41962,19 @@ function walkScript(script, st, ctx, runTraps = true) {
   }
   for (const statement of script.commands)
     walkNode(statement, st, ctx, false);
-  if (!runTraps)
-    return;
+  if (runTraps)
+    runSetTraps(st, ctx);
+}
+function subshell(st, patch) {
+  return { ...clone2(st), traps: [], ...patch };
+}
+function runSetTraps(st, ctx) {
   for (const trap of st.traps) {
+    const vars = new Map([...handlerVars(trap, st.vars), ...trap.pids ?? []]);
     try {
-      runText(trap.text, "the EXIT trap", { ...clone2(st), source: trap.file, traps: [] }, ctx, trap.site);
-    } catch (error49) {
-      locateRefusal(error49, trap.file);
+      runText(trap.text, "the EXIT trap", subshell(st, { source: trap.file, vars }), ctx, trap.site);
+    } catch (error48) {
+      locateRefusal(error48, trap.file);
     }
   }
 }
@@ -41919,20 +41993,34 @@ function walkNode(node, st, ctx, pipeIn) {
   switch (node.type) {
     case "Statement": {
       checkRedirects(node.redirects, undefined, siteOf(node, st), st, ctx);
-      walkNode(node.command, st, ctx, pipeIn);
-      if (node.background)
+      if (node.background) {
+        const before = st.output;
+        const child = subshell(st);
+        walkNode(node.command, child, ctx, pipeIn);
+        runSetTraps(child, ctx);
+        if (outputChanged(before, child.output))
+          st.output = undefined;
         st.backgroundStarted = true;
+        return;
+      }
+      walkNode(node.command, st, ctx, pipeIn);
       return;
     }
     case "Command":
       handleCommand(node, st, ctx, pipeIn);
       return;
     case "Pipeline": {
+      if (node.commands.length === 1) {
+        for (const command of node.commands)
+          walkNode(command, st, ctx, pipeIn);
+        return;
+      }
       const before = st.output;
       const parts = [];
       for (const [index, command] of node.commands.entries()) {
-        const part = clone2(st);
+        const part = subshell(st);
         walkNode(command, part, ctx, index > 0);
+        runSetTraps(part, ctx);
         parts.push(part);
       }
       if (parts.some((part) => outputChanged(before, part.output)))
@@ -41951,8 +42039,9 @@ function walkNode(node, st, ctx, pipeIn) {
       return;
     case "Subshell": {
       const before = st.output;
-      const child = clone2(st);
+      const child = subshell(st);
       walkList(node.body.commands, child, ctx);
+      runSetTraps(child, ctx);
       if (outputChanged(before, child.output))
         st.output = undefined;
       return;
@@ -42041,14 +42130,21 @@ function walkNode(node, st, ctx, pipeIn) {
         st.output = undefined;
       return;
     }
-    case "Function":
-      st.functions.set(node.name.value, { body: node.body, source: st.source, file: st.script });
+    case "Function": {
+      let callee = definitions.get(node);
+      if (callee === undefined) {
+        callee = [{ body: node.body, source: st.source, file: st.script }];
+        definitions.set(node, callee);
+      }
+      st.functions.set(node.name.value, callee);
       checkRedirects(node.redirects, undefined, siteOf(node, st), st, ctx);
       return;
+    }
     case "Coproc": {
       const before = st.output;
-      const child = clone2(st);
+      const child = subshell(st);
       walkNode(node.body, child, ctx, false);
+      runSetTraps(child, ctx);
       if (outputChanged(before, child.output))
         st.output = undefined;
       checkRedirects(node.redirects, undefined, siteOf(node, st), st, ctx);
@@ -42359,9 +42455,24 @@ function dispatch(invocation, outer, ctx) {
   const base = path4.basename(name);
   const rest = argv.slice(1);
   const site = invocation.site;
-  const functionDefinition = outer.functions.get(base);
-  if (functionDefinition !== undefined) {
-    runFunction(base, functionDefinition, rest, outer, ctx);
+  const callee = outer.functions.get(base);
+  if (callee !== undefined) {
+    const [only] = callee;
+    if (callee.length === 1 && only !== undefined) {
+      runFunction(base, only, rest, outer, ctx);
+      return;
+    }
+    const runs = callee.map((definition) => {
+      const run = clone2(outer);
+      if (definition !== undefined)
+        runFunction(base, definition, rest, run, ctx);
+      else {
+        run.functions.delete(base);
+        dispatch(invocation, run, ctx);
+      }
+      return run;
+    });
+    merge2(outer, runs);
     return;
   }
   const stdoutRedirected = invocation.redirects.some((redirect) => (redirect.fileDescriptor === undefined || redirect.fileDescriptor === 1) && [">", ">>", ">|", "&>", "&>>", ">&"].includes(redirect.operator));
@@ -42453,11 +42564,34 @@ function dispatch(invocation, outer, ctx) {
       return;
     }
     case "trap": {
-      const text = literalText(operands(rest, "").operands[0]?.exp);
+      const [handler, ...conditions] = operands(rest, "").operands;
+      if (handler === undefined)
+        return;
+      const text = literalText(handler.exp);
+      const readable = conditions.map((arg) => literalText(arg.exp));
+      const signals = readable.map((condition) => condition === undefined ? UNREADABLE_CONDITION : trapSignal(condition));
+      const handled = signals.length === 0 ? ["EXIT"] : signals;
+      const file2 = outer.script ?? outer.source;
       if (text === "-") {
-        outer.traps = [];
-      } else if (text !== undefined && !text.startsWith("-")) {
-        outer.traps = [...outer.traps, { text, site, file: outer.script ?? outer.source }];
+        const named = readable.flatMap((condition) => condition === undefined ? [] : [trapSignal(condition)]);
+        outer.traps = outer.traps.flatMap((trap) => {
+          const signals2 = trap.signals.filter((signal) => !named.includes(signal));
+          return signals2.length === 0 ? [] : [{ ...trap, signals: signals2 }];
+        });
+      } else if (text === undefined && handler.exp.every((piece) => piece.kind === "literal" || piece.descendantPid)) {
+        const pids = new Map;
+        const handlerText = handler.exp.map((piece) => {
+          if (piece.kind === "literal")
+            return piece.text;
+          const name2 = `__legion_guard_trap_pid_${pids.size}`;
+          pids.set(name2, [piece]);
+          return `\${${name2}}`;
+        }).join("");
+        outer.traps = [...outer.traps, { text: handlerText, site, signals: handled, file: file2, pids }];
+      } else if (text === undefined) {
+        throw new Refusal(site.snippet, site.line, `the guard cannot read the handler this \`trap\` sets, \`${handler.text}\` (${handler.exp.find((piece) => piece.kind !== "literal")?.why ?? "a value the guard cannot know"}), so it cannot check what runs when this shell exits; write the handler out, or put it in a function`);
+      } else if (!text.startsWith("-")) {
+        outer.traps = [...outer.traps, { text, site, signals: handled, file: file2 }];
       }
       return;
     }
@@ -43139,9 +43273,11 @@ function runFile(file2, positional, st, ctx, site, kind, source = false) {
         throw new Refusal(site.snippet, site.line, "the guard stops following scripts this deep; run the inner script directly");
       }
       const child = { ...clone2(st), source: content, script: abs, depth: st.depth + 1 };
-      child.positional = positional.map((arg) => arg.exp);
+      const operands2 = positional.map((arg) => arg.exp);
+      child.positional = source && operands2.length === 0 ? st.positional : operands2;
       walkScript(parse5(content), child, ctx, !source);
       if (source) {
+        st.positional = operands2.length === 0 ? child.positional : child.positional === operands2 ? st.positional : undefined;
         st.vars = child.vars;
         st.exported = child.exported;
         st.arrays.clear();

package/dist/skills/legion-worker/SKILL.md

@@ -285,9 +285,11 @@ later phase keeps it current rather than replacing it:
 - Thread <id>: fixed in <commit-sha> — <one line>.
 - Thread <id>: not a defect — <reason>.
 `legion threads resolve --pr <n> --repo <owner>/<repo>` at <head-sha>:
-resolved <thread URL>
+resolved <thread URL> — its opener's acceptance
+resolved <thread URL> — the Legion reviewer's acceptance of a bot's thread
 left open <thread URL> — newest reply by <login> is not an acceptance
 left open <thread URL> — newest reply by <login> is an unsubmitted draft in a pending review
+left open <thread URL> — newest reply by <login> is not its opener's or the Legion reviewer's acceptance
 
 **Thermo:** `ce-simplify-code` once at <head-sha>: <0 applied | applied → new head <sha>>; thermonuclear pair at the final head <sha>:
 <verdict>. (omitted entirely on a docs-only PR — there is no code for either pass, so neither runs)
@@ -329,7 +331,8 @@ this proof.
 
 - **Threads are dispositioned individually, never resolved in bulk.** Every open review
   thread gets its own line naming the fixing commit or the reason it isn't a defect. The
-  reviewer answers each thread it opened with exactly one of `Accepted: fixed in <commit> — <one line>`,
+  reviewer answers each thread it opened, and each thread a bot opened that is none of Legion's
+  role Apps, with exactly one of `Accepted: fixed in <commit> — <one line>`,
   `Accepted: not a defect — <reason>`, or `Still open: <what remains>`; nothing else is an
   acceptance, and nobody replies after an `Accepted:` (any later reply that is not itself an
   `Accepted:` — the opener's own follow-up included — leaves the thread open, because resolution
@@ -341,9 +344,16 @@ this proof.
   In a Legion pane, the **implementer** runs the command before every push that answers a review
   (the corrective push and the final `.legion/` deletion push) and pastes its output into the
   `Threads` section. The command resolves each unresolved thread whose newest submitted comment is
-  the opener's own `Accepted:` reply, one `resolveReviewThread` per thread, prints `resolved <url>`
-  or `left open <url> — newest reply by <login> is not an acceptance`, and exits 1 naming the
-  thread's URL and GitHub's message when GitHub refuses one.
+  the opener's own `Accepted:` reply. On a thread a bot account opened that is none of Legion's
+  role Apps (the daemon names them, keyed by App role), the Legion reviewer's `Accepted:` also
+  closes it. GitHub cannot tell a CI bot, which never accepts, from a person whose `gh` is routed
+  to an App, so the reviewer adjudicates such a finding, and it may accept one an App-routed person
+  raised. The subject of a finding never closes it: the implementer's `Fixed in <commit>: …` or
+  `Declined: …` answers a thread and closes none. A thread either Legion App opened, a reviewer's
+  finding included, still needs its opener's `Accepted:`. It makes one `resolveReviewThread` per
+  thread, prints `resolved <url> — <whose acceptance>` (its opener's, or the Legion reviewer's on a
+  bot's thread, so the ledger shows which) or `left open <url> — newest reply by <login> is …`
+  naming why, and exits 1 naming the thread's URL and GitHub's message when GitHub refuses one.
 
   Without a grant, page through `reviewThreads`, skip `isResolved: true`, and compare the opener
   with the newest comment. Query shape, inside `repository { pullRequest { … } }`:
@@ -353,15 +363,18 @@ this proof.
     pageInfo { hasNextPage endCursor }
     nodes {
       id isResolved
-      opener: comments(first: 1) { nodes { author { login } } }
-      newest: comments(last: 1) { nodes { author { login } body state } }
+      opener: comments(first: 1) { nodes { author { __typename login } } }
+      newest: comments(last: 1) { nodes { author { __typename login } body state } }
     }
   }
   ```
 
-  Resolve only when the newest comment is submitted, its `author { login }` equals the opener's,
-  and its `body`, after removing leading spaces, tabs, CR, and LF, begins `Accepted:`. For each
-  such thread:
+  Resolve only when the newest comment is submitted, its `author` is the opener's account (the same
+  `__typename` and `login`: a login alone is a string anyone may register), and its `body`, after
+  removing leading spaces, tabs, CR, and LF, begins `Accepted:`. Without a
+  grant nothing names Legion's own App logins, so this route closes a bot's thread only on its
+  opener's `Accepted:`: leave one the Legion reviewer accepted for the implementer's or merger's
+  run in a pane, or report it. For each thread to resolve:
 
   ```graphql
   mutation($threadId: ID!) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion-envoy",
-  "version": "5.16.6",
+  "version": "5.16.8",
   "type": "module",
   "omp": {
     "extensions": [
@@ -13,7 +13,7 @@
   },
   "legion": {
     "daemonApiVersion": 9,
-    "goDaemonApiVersion": 10
+    "goDaemonApiVersion": 11
   },
   "repository": {
     "type": "git",