@sjawhar/pi-legion 8.3.0 → 8.4.0

package/README.md

@@ -17,8 +17,9 @@ pi-envoy").
 
 The Legion daemon's boot gate (`packages/daemon/internal/daemon/bootgate.go`) refuses to start
 unless the Oh My Pi a pane will run loads this plugin at the daemon's contract
-(`legion.daemonApiVersion` in `package.json`, currently 14) and loads `@sjawhar/pi-envoy` with it,
-so both go into the Oh My Pi profile the daemon's panes use:
+(`legion.daemonApiVersion` in this package's `package.json`, equal to `DaemonAPIVersion` in
+`packages/daemon/internal/api/version.go`) and loads `@sjawhar/pi-envoy` with it, so both go into
+the Oh My Pi profile the daemon's panes use:
 
 ```sh
 omp plugin install @sjawhar/pi-envoy && omp plugin install @sjawhar/pi-legion

package/dist/legion.js

@@ -15193,7 +15193,7 @@ function onEnvoyRoleRegained(listener) {
 // package.json
 var package_default = {
   name: "@sjawhar/pi-legion",
-  version: "8.3.0",
+  version: "8.4.0",
   license: "Apache-2.0",
   type: "module",
   omp: {
@@ -15205,7 +15205,7 @@ var package_default = {
     ]
   },
   legion: {
-    daemonApiVersion: 15
+    daemonApiVersion: 16
   },
   repository: {
     type: "git",
@@ -15412,13 +15412,21 @@ var legionAgentSecretsLoginView = exports_external.strictObject({
   state: exports_external.string(),
   code: exports_external.string()
 });
+var legionCapabilityState = exports_external.strictObject({
+  name: nonEmptyString,
+  status: exports_external.enum(["present", "installed", "unchecked", "live", "withheld", "decided", "open"]),
+  detail: nonEmptyString,
+  decision: nonEmptyString.optional(),
+  configLine: nonEmptyString.optional()
+});
 var LegionStateResponse = exports_external.strictObject({
   daemon: daemonInfo,
   admission: legionAdmission,
   issues: exports_external.record(exports_external.string(), legionIssue),
   pendingStatusWrites: exports_external.array(legionPendingStatusWrite),
   controllerLocator: legionControllerLocator.optional(),
-  agentSecretsLogin: legionAgentSecretsLoginView.optional()
+  agentSecretsLogin: legionAgentSecretsLoginView.optional(),
+  capabilities: exports_external.array(legionCapabilityState)
 });
 var LegionRegisterResponse = exports_external.strictObject({
   claimToken: nonEmptyString,
@@ -16404,31 +16412,6 @@ async function persistedTranscript(context) {
     throw new Error("Legion session transcript has no agent id");
   return { sessionFile, agentId };
 }
-function isSingleLegionCommand(command) {
-  if (typeof command !== "string")
-    return false;
-  const trimmed = command.trim();
-  if (trimmed.length === 0)
-    return false;
-  let quote;
-  for (const char of trimmed) {
-    if (quote !== undefined) {
-      if (char === quote)
-        quote = undefined;
-      continue;
-    }
-    if (char === '"' || char === "'") {
-      quote = char;
-      continue;
-    }
-    if (char === `
-` || char === ";" || char === "&" || char === "|")
-      return false;
-  }
-  if (quote !== undefined)
-    return false;
-  return trimmed.split(/\s+/, 1)[0] === "legion";
-}
 var JJ_LOG_REWRITE_WORDS = ["undo", "abandon"];
 var JJ_OP_WORDS = ["op", "operation"];
 var JJ_OP_LOG_REWRITE_WORDS = ["restore", "revert"];
@@ -16530,16 +16513,7 @@ var JJ_LOG_REWRITE = {
   invocation: jjLogRewriteInvocation,
   refusal: (attempt) => `refused \`${attempt}\`: jj undo, jj abandon, and jj op restore/revert/abandon/undo ` + "rewrite the jj operation log, which every Legion issue workspace shares (each is a jj " + "workspace of one clone), so they rewrite other trees' commits too. Recover forward with " + "a new commit or `jj restore <paths>` of files; anything else, stop and send the owning " + 'architect the `jj -R "$LEGION_WORKSPACE" log` evidence.'
 };
-var LEGION_HANDOFF_COMPLETE_MENTION = /\blegion[\s"'`,[\]]+handoff[\s"'`,[\]]+complete\b/;
-var LEGION_HANDOFF_COMPLETE = {
-  mention: (text) => LEGION_HANDOFF_COMPLETE_MENTION.test(text) ? "legion handoff complete" : undefined,
-  invocation: (words) => {
-    const legion = commandMatch(words, "legion", ["handoff", "complete"]);
-    return legion === -1 ? undefined : words.slice(legion).join(" ");
-  },
-  refusal: (attempt) => `refused \`${attempt}\`: a phase is completed with the \`legion\` tool's ` + "`handoff_complete`, never a shell command: the tool call is what records the phase " + "complete. A root architect or a `task` subagent has no handoff actions: it leaves the " + "completion to the worker. Text that only names the command (a commit message, a PR body) " + "reads as the command: pass it in a file."
-};
-var TREE_PANE_RULES = [JJ_LOG_REWRITE, LEGION_HANDOFF_COMPLETE];
+var TREE_PANE_RULES = [JJ_LOG_REWRITE];
 var PANE_RULES = {
   "phase-worker": TREE_PANE_RULES,
   "root-architect": TREE_PANE_RULES
@@ -16572,14 +16546,12 @@ function unwrapReadHeader(path6) {
     return path6;
   return target;
 }
-function writeTarget(path6) {
-  const unwrapped = unwrapReadHeader(path6);
-  return PREFIXED_CONFLICT_URL.exec(unwrapped)?.[2] ?? unwrapped;
-}
 function nonFileWriteScheme(toolCall) {
   if (toolCall.toolName !== "write" || typeof toolCall.input.path !== "string")
     return;
-  return NON_FILE_WRITE_URL.exec(writeTarget(toolCall.input.path))?.[1]?.toLowerCase();
+  const unwrapped = unwrapReadHeader(toolCall.input.path);
+  const target = PREFIXED_CONFLICT_URL.exec(unwrapped)?.[2] ?? unwrapped;
+  return NON_FILE_WRITE_URL.exec(target)?.[1]?.toLowerCase();
 }
 function paneRuleRefusal(toolCall, rules, commands) {
   if (rules.length === 0)
@@ -16625,12 +16597,6 @@ function envoyPluginRefusal() {
       return `Legion plugin at ${import.meta.url} needs @sjawhar/pi-envoy at interface version ${reading.expected}, found version ${reading.found} from ${reading.from}; install the @sjawhar/pi-envoy released with this @sjawhar/pi-legion`;
   }
 }
-var CODE_MUTATION_TOOLS = ["edit", "write", "apply_patch"];
-var CODE_TOOL_REFUSAL = {
-  architect: "the architect delegates all code work to phase workers",
-  reviewer: "the reviewer edits no code; its only commits are its review handoffs, made via bash",
-  merger: "the merger only verifies and reports"
-};
 function legionExtension(pi) {
   const instance = randomUUID2().slice(0, 8);
   logger3.debug("extension instance loaded", { extension: import.meta.url, instance });
@@ -16720,11 +16686,6 @@ function legionExtension(pi) {
       return;
     const sessionID = context.sessionManager.getSessionId();
     const active = claimSession.capability(sessionID);
-    const codeToolRefusal = active === undefined ? undefined : CODE_TOOL_REFUSAL[active.role];
-    const mutatesCode = CODE_MUTATION_TOOLS.includes(toolCall.toolName) || active?.role === "architect" && toolCall.toolName === "bash" && !isSingleLegionCommand(toolCall.input.command);
-    if (codeToolRefusal !== undefined && mutatesCode && nonFileWriteScheme(toolCall) === undefined) {
-      return { block: true, reason: codeToolRefusal };
-    }
     if (!needsGrant(toolCall))
       return;
     if (active === undefined) {
@@ -16821,6 +16782,5 @@ function legionExtension(pi) {
 }
 export {
   setLegionBootstrapExitForTests,
-  legionExtension as default,
-  CODE_TOOL_REFUSAL
+  legionExtension as default
 };

package/dist/skills/legion-controller/SKILL.md

@@ -171,7 +171,13 @@ unsent:
 - `tick on <PROJECT>`: the daemon's periodic wake, a minute after it starts and then every
   `controller_wake_interval_seconds` (an hour by default), whatever the slots. An earlier walk
   that found nothing, a day with no event, and [a tree waiting on a root
-  claim](#trees-waiting-on-a-root-claim-go-daemon) all get a turn from it.
+  claim](#trees-waiting-on-a-root-claim-go-daemon) all get a turn from it. Its payload's
+  `openCapabilities`, when present, names the deployment capabilities (the secrets broker, model
+  fallback, every role's CPU and memory limits) the deployment's own configuration leaves open with
+  no decision recorded. `legion state --json` lists every row under `capabilities`, each open one
+  with its `detail` and the `configLine` to write into `legion.yaml`
+  (`capabilities.decided.<name>: "<reason>"`); name them in the day's report. A gap is the
+  operator's to close or to decide, never yours, and it never stops the walk.
 
 **Scope first.** The scope the deployment instructions state decides which issues are candidates
 at all, before anything below. When they say you hand Legion no issue yourself, or that Legion
@@ -291,6 +297,10 @@ every pull request by its URL.
 - **The slots and the walk.** The free slots, as **How many** counts them, then this turn's walk
   when it made one: what it took, and how many candidates each row of the table skipped, so a
   reader can see why a free slot stays empty.
+- **Open capabilities.** Each row of `capabilities` in `legion state --json` whose `status` is
+  `open` (the `tick` payload's `openCapabilities`): its name, its `detail`, and its `configLine`,
+  the `legion.yaml` line that records a decision. The operator closes or decides it; you only
+  report it, and a report with none says nothing of them.
 
 A day with nothing finished says so in one sentence. When the lists do not fit, keep the counts
 and the highest-priority issues.
@@ -328,7 +338,7 @@ priority first, then board rank ([Keeping the slots full](#keeping-the-slots-ful
 | New issue created in the Dispatch project, status `triage`: `triage on <KEY>` (payload `{kind: "triage"}`) on the controller topic, for an unrecorded root carrying the `legion` label only ("Issues handed to Legion" above); the start procedure above catches one sent while no controller ran | issue key + triage context (incl. pre-existing children) | Triage: `legion status <KEY> todo` to admit, or set `backlog`/`icebox` to park |
 | `slot-free on <KEY>` from the Go daemon (payload `{kind: "slot-free"}`) | the root whose slot the daemon released with no waiting root to take it | Verify a free slot in `legion state --json`, then fill it ([Keeping the slots full](#keeping-the-slots-full-go-daemon)) |
 | `todo on <KEY>` from the Go daemon (payload `{kind: "todo"}`) | an issue not handed to Legion that changed while in `todo` and a slot stood free, sent half a minute later | Verify a free slot, then walk the whole `todo` list ([Keeping the slots full](#keeping-the-slots-full-go-daemon)) |
-| `tick on <PROJECT>` from the Go daemon (payload `{kind: "tick"}`) | the project key; the daemon's periodic wake, whatever the slots | Recheck the trees waiting on a claim, then walk if a slot is free; post the day's report if this is the day's first turn |
+| `tick on <PROJECT>` from the Go daemon (payload `{kind: "tick", openCapabilities?: [<name>, …]}`) | the project key; the daemon's periodic wake, whatever the slots; `openCapabilities` names the deployment capabilities with no decision, each with its detail and `capabilities.decided.<name>` line under `capabilities` in `legion state --json` | Recheck the trees waiting on a claim, then walk if a slot is free — a gap never stops the walk; post the day's report if this is the day's first turn, naming each open capability in it (the operator closes or decides it) |
 | Architect escalation (controller-actionable only: re-file a child as a root issue, capacity, cross-tree conflicts) | request + context | Judge and act; the owning architect writes an issue-design decision as a decision block and opens `dispatch_ask` only for a human to-do |
 | Mention | Slack/GitHub PR @mention text | Answer, or route to the owning issue's architect role |
 | `held on <KEY>` from the Go daemon (payload `{kind: "held", phase, role?, reason?}`) | the held issue, the phase it left, and the role whose claim failed, or `reason: "escalated"` | Verify the hold in `legion state` (the issue's phase is `held`). Without `reason`, a phase worker's launches or prompts ran out and the tree's architect decides retry or escalate: no action. With `reason: "escalated"` (on the record, `issues.<KEY>.holdReason` is `escalated`), the architect sent it to you: handle it as an architect escalation below. Parking the tree is `legion status <root> backlog`; setting the root back to `todo` later re-admits it as a new generation, which starts again from its architect |

package/dist/skills/legion-worker/SKILL.md

@@ -424,9 +424,12 @@ report with `handoff_complete` alone (below).
 ## Completion: report to the architect, then stay
 
 Report completion to the architect: call the `legion` tool with `op: "handoff_complete"` and
-`summary`: two sentences for the architect. A worker never runs `legion handoff complete` from
-bash, where the extension refuses it: the tool call is what the extension records, and a turn that
-ends with the phase still open gets one reminder.
+`summary`: two sentences for the architect. Report it through that tool call, never the shell
+command `legion handoff complete`: the tool call is what the extension's phase stall records, and
+a turn that ends with the phase still open gets one reminder. A completion run from the shell is
+recorded by the daemon all the same, but the stall does not see it and sends its one reminder; do
+not complete again on that reminder — the first completion stands, and a second is refused
+because the issue has already left your phase.
 
 This publishes your phase's completion to the architect's role and clears the daemon's
 record of this issue's active phase. Do not add pipeline labels, run a controller loop, or

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sjawhar/pi-legion",
-  "version": "8.3.0",
+  "version": "8.4.0",
   "license": "Apache-2.0",
   "type": "module",
   "omp": {
@@ -12,7 +12,7 @@
     ]
   },
   "legion": {
-    "daemonApiVersion": 15
+    "daemonApiVersion": 16
   },
   "repository": {
     "type": "git",