@slowcook-ai/cli 0.18.0-alpha.6 → 0.18.0

package/dist/commands/chef/drift-fix.js

@@ -0,0 +1,712 @@
+/**
+ * `slowcook chef-drift` — α.9 L1 drift-fixer (cli α.9).
+ *
+ * Sibling to the existing `slowcook chef --pr <n>` (PR-CI-failure
+ * handler). This module is the SURGICAL EDITOR variant: triggered by
+ * mock-isolation / recon / brew halt / navigator halt-class. Reads the
+ * failure + history-index + PR state, calls the chef LLM to get a
+ * ChefVerdict, applies edits surgically, validates, commits, posts an
+ * audit comment.
+ *
+ * Frozen surface (HARD): never edits tests/, vitest.config.*,
+ * .brewing/{auto-gen}/. If a fix requires test edits → escalates to PM
+ * via a two-option pm_comment (option B = `testgen --regenerate`).
+ *
+ * Ledger at .brewing/chef/<story-id>.json tracks moves + cost. Cycle
+ * detection + budget cap enforce convergence.
+ *
+ * Run from consumer repo root:
+ *   ANTHROPIC_API_KEY=... slowcook chef-drift \
+ *     --story 018 \
+ *     --trigger mock_isolation_check_failed \
+ *     --trigger-detail "Relative import resolves to a non-existent file..."
+ */
+import { execSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { AnthropicClient, CHEF_SYSTEM, buildChefPrompt, } from "@slowcook-ai/llm-anthropic";
+const FROZEN_PATH_PATTERNS = [
+    /^tests\//,
+    /^vitest\.config\.(ts|mjs|js)$/,
+    /^\.brewing\/code-map\.(json|md|target\.md)$/,
+    /^\.brewing\/recon-result\.json$/,
+    /^\.brewing\/history-index\.json$/,
+    /^\.brewing\/auto-gen\//,
+];
+function isFrozenPath(path) {
+    return FROZEN_PATH_PATTERNS.some((re) => re.test(path));
+}
+function parseArgs(argv) {
+    const args = {
+        storyId: "",
+        repoRoot: process.cwd(),
+        triggerKind: "mock_isolation_check_failed",
+        triggerDetail: "",
+        triggerRawPath: null,
+        navigatorHistoryPath: null,
+        model: "claude-sonnet-4-5-20250929",
+        budgetUsd: 1.0,
+        dryRun: false,
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        if (a === "--story" && next) {
+            args.storyId = next;
+            i++;
+        }
+        else if (a === "--cwd" && next) {
+            args.repoRoot = next;
+            i++;
+        }
+        else if (a === "--trigger" && next) {
+            args.triggerKind = next;
+            i++;
+        }
+        else if (a === "--trigger-detail" && next) {
+            args.triggerDetail = next;
+            i++;
+        }
+        else if (a === "--trigger-raw" && next) {
+            args.triggerRawPath = next;
+            i++;
+        }
+        else if (a === "--navigator-history" && next) {
+            args.navigatorHistoryPath = next;
+            i++;
+        }
+        else if (a === "--model" && next) {
+            args.model = next;
+            i++;
+        }
+        else if (a === "--budget-usd" && next) {
+            args.budgetUsd = parseFloat(next);
+            i++;
+        }
+        else if (a === "--dry-run") {
+            args.dryRun = true;
+        }
+        else if (a === "--help" || a === "-h") {
+            printHelp();
+            process.exit(0);
+        }
+    }
+    if (!args.storyId) {
+        console.error("--story <id> is required");
+        printHelp();
+        process.exit(64);
+    }
+    return args;
+}
+function printHelp() {
+    console.log(`
+slowcook chef-drift — surgical drift-fixer (cli α.9 L1)
+
+Sibling to \`slowcook chef --pr <n>\` (PR-CI-failure handler). This
+variant: triggered by mock-isolation / recon / brew halt / navigator
+halt-class; makes surgical edits across spec + mock + prod (NEVER tests
+or vitest config); commits + posts audit comment + optionally dispatches
+the next pipeline step.
+
+Usage:
+  slowcook chef-drift --story <id> --trigger <kind> [options]
+
+Options:
+  --cwd <path>             Repo root (default: cwd).
+  --trigger <kind>         mock_isolation_check_failed | recon_escalation |
+                           brew_halt_class | navigator_halt_class
+  --trigger-detail <text>  One-line summary of the failure.
+  --trigger-raw <path>     Path to JSON file with full trigger detail.
+  --navigator-history <path>  Path to navigator-history JSON (when applicable).
+  --model <id>             Anthropic model id.
+  --budget-usd <n>         Per-episode budget cap (default: 1.00).
+  --dry-run                Print verdict; do not apply edits.
+
+Requires: ANTHROPIC_API_KEY in env. Run from consumer repo root.
+Frozen surface: tests/, vitest.config.*, .brewing/{auto-gen}/ — never edited.
+`);
+}
+function loadHistoryIndex(repoRoot) {
+    const path = join(repoRoot, ".brewing/history-index.json");
+    if (!existsSync(path))
+        return {};
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+function loadSpec(repoRoot, storyId) {
+    const path = `specs/story-${storyId}.yaml`;
+    const abs = join(repoRoot, path);
+    if (!existsSync(abs))
+        return { specPath: path, specYaml: "" };
+    return { specPath: path, specYaml: readFileSync(abs, "utf8") };
+}
+function loadOpenPrs(repoRoot, storyId) {
+    const out = [];
+    try {
+        const repoSlug = execSync(`git -C "${repoRoot}" remote get-url origin | sed -E 's|^.*github\\.com[:/]||; s|\\.git$||'`, { encoding: "utf8" }).trim();
+        const json = execSync(`gh pr list --repo "${repoSlug}" --search "story-${storyId}" --state open --json number,headRefName,headRefOid,title --limit 10`, { encoding: "utf8" });
+        const prs = JSON.parse(json);
+        for (const pr of prs) {
+            const branch = pr.headRefName;
+            let kind;
+            if (branch.includes("/spec/"))
+                kind = "spec";
+            else if (branch.includes("/mockup/"))
+                kind = "mockup";
+            else if (branch.includes("/tests/") || branch.includes("/recipe/"))
+                kind = "tests";
+            else if (branch.includes("/brew/"))
+                kind = "brew";
+            else
+                continue;
+            out.push({ kind, number: pr.number, branch, headSha: pr.headRefOid });
+        }
+    }
+    catch (e) {
+        console.warn(`  warn: could not list open PRs (${e.message.slice(0, 100)})`);
+    }
+    return out;
+}
+function loadLedger(repoRoot, storyId) {
+    const path = join(repoRoot, `.brewing/chef/story-${storyId}.json`);
+    if (!existsSync(path)) {
+        return { story_id: storyId, episode: 1, moves: [], cumulative_cost_usd: 0, halt_reason: null };
+    }
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+function saveLedger(repoRoot, ledger) {
+    const path = join(repoRoot, `.brewing/chef/story-${ledger.story_id}.json`);
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, JSON.stringify(ledger, null, 2), "utf8");
+}
+function detectCycle(ledger, plannedEdits) {
+    for (const prior of ledger.moves) {
+        for (const priorEdit of prior.edits) {
+            if (priorEdit.operation !== "rename" || !priorEdit.to)
+                continue;
+            const matches = plannedEdits.find((e) => e.operation === "rename" && e.file === priorEdit.to && e.to === priorEdit.file);
+            if (matches)
+                return true;
+        }
+    }
+    return false;
+}
+function applyEdit(repoRoot, edit) {
+    const abs = join(repoRoot, edit.file);
+    switch (edit.operation) {
+        case "rename": {
+            if (!edit.to)
+                throw new Error(`rename edit missing 'to' field for ${edit.file}`);
+            const toAbs = join(repoRoot, edit.to);
+            mkdirSync(dirname(toAbs), { recursive: true });
+            execSync(`git -C "${repoRoot}" mv "${edit.file}" "${edit.to}"`, { stdio: "ignore" });
+            // Heuristic: if file basename changed, rename default-export inside the file
+            const oldName = edit.file.split("/").pop().replace(/\.tsx?$/, "");
+            const newName = edit.to.split("/").pop().replace(/\.tsx?$/, "");
+            if (oldName !== newName && existsSync(toAbs)) {
+                let content = readFileSync(toAbs, "utf8");
+                content = content.replace(new RegExp(`(export default function )${oldName}\\b`, "g"), `$1${newName}`);
+                writeFileSync(toAbs, content, "utf8");
+            }
+            break;
+        }
+        case "create": {
+            if (!edit.patch)
+                throw new Error(`create edit missing 'patch' for ${edit.file}`);
+            mkdirSync(dirname(abs), { recursive: true });
+            writeFileSync(abs, edit.patch, "utf8");
+            break;
+        }
+        // Legacy 'edit' operation removed — chef must use 'search_replace'
+        // for content changes. The default branch below catches it via
+        // exhaustive-switch enforcement.
+        case "search_replace": {
+            const sr = edit.search_replace;
+            if (!sr || !Array.isArray(sr) || sr.length === 0) {
+                throw new Error(`search_replace edit missing 'search_replace' array for ${edit.file}`);
+            }
+            if (!existsSync(abs)) {
+                throw new Error(`search_replace target file does not exist: ${edit.file}`);
+            }
+            let content = readFileSync(abs, "utf8");
+            for (const pair of sr) {
+                if (!pair.find || pair.replace === undefined) {
+                    throw new Error(`search_replace pair missing find or replace for ${edit.file}`);
+                }
+                // Require find to appear exactly once — guards against ambiguous matches
+                const occurrences = content.split(pair.find).length - 1;
+                if (occurrences === 0) {
+                    throw new Error(`search_replace 'find' string not found in ${edit.file}: ${JSON.stringify(pair.find).slice(0, 120)}`);
+                }
+                if (occurrences > 1) {
+                    throw new Error(`search_replace 'find' string matches ${occurrences}x in ${edit.file} (must be unique): ${JSON.stringify(pair.find).slice(0, 120)}`);
+                }
+                content = content.replace(pair.find, pair.replace);
+            }
+            writeFileSync(abs, content, "utf8");
+            break;
+        }
+        case "delete": {
+            execSync(`rm -f "${abs}"`);
+            break;
+        }
+        default: {
+            throw new Error(`unsupported edit operation '${edit.operation}' for ${edit.file} — use rename / search_replace / create / delete only.`);
+        }
+    }
+}
+function runValidation(repoRoot, command) {
+    // Chef may produce commands prefixed with `slowcook ...` (matches the
+    // documented prompt examples). On runners where slowcook isn't on
+    // PATH, we route through the same node binary that's running chef.
+    let resolved = command.trim();
+    if (resolved.startsWith("slowcook ")) {
+        const cliJs = process.argv[1] || "";
+        if (cliJs && existsSync(cliJs)) {
+            resolved = `node "${cliJs}" ${resolved.slice("slowcook ".length)}`;
+        }
+    }
+    try {
+        const output = execSync(resolved, { cwd: repoRoot, encoding: "utf8", maxBuffer: 4 * 1024 * 1024 });
+        return { passed: true, output };
+    }
+    catch (e) {
+        const err = e;
+        const out = err.stdout || err.stderr || err.message || "";
+        return { passed: false, output: out };
+    }
+}
+/**
+ * Compare pre-move + post-move validation outputs to decide whether
+ * chef's iteration made progress.
+ *
+ * Returns 'progress' when post-set ⊆ pre-set AND post-set has fewer
+ * unique failure-lines than pre-set (i.e., chef removed at least one
+ * failure + introduced none).
+ *
+ * Returns 'no-change' when post-set === pre-set.
+ *
+ * Returns 'regression' when post-set has any line not in pre-set
+ * (chef introduced a new failure).
+ */
+function compareValidationOutputs(pre, post) {
+    // Heuristic: extract lines that look like file:line refs (typical
+    // failure-marker shape). Compare as sets.
+    const extractFailureLines = (s) => {
+        const out = new Set();
+        for (const line of s.split("\n")) {
+            const m = line.match(/^\s*([\w./[\]()-]+\.(?:ts|tsx|js|jsx|yaml|yml|sql|md|json)):(\d+)/);
+            if (m)
+                out.add(`${m[1]}:${m[2]}`);
+        }
+        return out;
+    };
+    const preSet = extractFailureLines(pre);
+    const postSet = extractFailureLines(post);
+    const newFailures = [...postSet].filter((x) => !preSet.has(x));
+    if (newFailures.length > 0)
+        return "regression";
+    if (postSet.size < preSet.size)
+        return "progress";
+    return "no-change";
+}
+function postIssueComment(repoRoot, issueNumber, body) {
+    const repoSlug = execSync(`git -C "${repoRoot}" remote get-url origin | sed -E 's|^.*github\\.com[:/]||; s|\\.git$||'`, { encoding: "utf8" }).trim();
+    // Try gh CLI first; fall back to curl + GITHUB_TOKEN. Runners often
+    // have one but not the other.
+    const tmp = "/tmp/chef-drift-comment.md";
+    writeFileSync(tmp, body, "utf8");
+    try {
+        execSync(`gh issue comment ${issueNumber} --repo "${repoSlug}" --body-file ${tmp}`, { stdio: "inherit" });
+        return;
+    }
+    catch {
+        // fall through to curl
+    }
+    const token = process.env["GITHUB_TOKEN"];
+    if (!token) {
+        console.warn(`  warn: gh not installed + GITHUB_TOKEN not set; skipping audit comment on issue #${issueNumber}`);
+        return;
+    }
+    const payload = JSON.stringify({ body });
+    const payloadFile = "/tmp/chef-drift-payload.json";
+    writeFileSync(payloadFile, payload, "utf8");
+    try {
+        execSync(`curl -sS -f -X POST -H "Authorization: token ${token}" -H "Accept: application/vnd.github+json" --data @${payloadFile} "https://api.github.com/repos/${repoSlug}/issues/${issueNumber}/comments" >/dev/null`, { stdio: "inherit" });
+        console.log(`  posted audit comment on issue #${issueNumber} (via curl)`);
+    }
+    catch (e) {
+        console.warn(`  warn: failed to post audit comment via curl: ${e.message.slice(0, 200)}`);
+    }
+}
+function commitChefEdits(repoRoot, summary, edits) {
+    // Stage ONLY the files chef edited (never `git add -A` — that
+    // accidentally captures workflow-side clones like `_slowcook/` etc.
+    // that live in the consumer repo's working tree). For renames, stage
+    // both the old + new path so git records the rename.
+    try {
+        const pathsToAdd = new Set();
+        for (const e of edits) {
+            pathsToAdd.add(e.file);
+            if (e.to)
+                pathsToAdd.add(e.to);
+        }
+        if (pathsToAdd.size === 0)
+            return { sha: null, pushed: false };
+        for (const p of pathsToAdd) {
+            try {
+                execSync(`git -C "${repoRoot}" add "${p}"`, { stdio: "ignore" });
+            }
+            catch { /* file may have been renamed away — ignore */ }
+        }
+        // Also stage the chef ledger so it's part of the commit
+        try {
+            execSync(`git -C "${repoRoot}" add ".brewing/chef/"`, { stdio: "ignore" });
+        }
+        catch { /* ledger dir may not exist if first move ran into early error */ }
+        // Empty commit guard: if nothing staged, skip.
+        const status = execSync(`git -C "${repoRoot}" status --porcelain --cached`, { encoding: "utf8" }).trim();
+        if (!status)
+            return { sha: null, pushed: false };
+        // Write commit message to file (handle quotes cleanly).
+        const msgFile = "/tmp/chef-drift-commit-msg.txt";
+        writeFileSync(msgFile, `[chef] ${summary}\n\nCo-Authored-By: slowcook-chef[bot] <slowcook-chef@users.noreply.github.com>\n`, "utf8");
+        execSync(`git -C "${repoRoot}" -c user.name="slowcook-chef[bot]" -c user.email="slowcook-chef@users.noreply.github.com" commit -F ${msgFile}`, { stdio: "inherit" });
+        const sha = execSync(`git -C "${repoRoot}" rev-parse HEAD`, { encoding: "utf8" }).trim();
+        return { sha, pushed: false };
+    }
+    catch (e) {
+        console.warn(`  warn: chef commit failed: ${e.message.slice(0, 200)}`);
+        return { sha: null, pushed: false };
+    }
+}
+function buildAuditCommentBody(args) {
+    const { move, verdict } = args;
+    const lines = [];
+    lines.push(`### [chef-drift] Move ${move.n} on story-${args.ledger.story_id}`);
+    lines.push("");
+    lines.push(`**Trigger:** \`${move.trigger_kind}\``);
+    lines.push("");
+    lines.push(`**Decision:** ${move.decision}`);
+    lines.push("");
+    lines.push(`**Rationale:** ${verdict.rationale}`);
+    lines.push("");
+    if (move.edits.length > 0) {
+        lines.push(`**Files touched:**`);
+        for (const e of move.edits) {
+            lines.push(`- \`${e.file}\` (${e.operation}${e.to ? ` → \`${e.to}\`` : ""})`);
+        }
+        lines.push("");
+    }
+    if (move.validation_command) {
+        lines.push(`**Validation:** \`${move.validation_command}\` → ${move.validation_result}`);
+        lines.push("");
+    }
+    if (move.next_dispatch) {
+        lines.push(`**Next:** dispatched \`${move.next_dispatch}\``);
+        lines.push("");
+    }
+    lines.push(`**Cost:** $${move.cost_usd.toFixed(2)} (cumulative: $${args.ledger.cumulative_cost_usd.toFixed(2)})`);
+    return lines.join("\n");
+}
+export async function chefDrift(argv, _cliVersion) {
+    const args = parseArgs(argv);
+    const apiKey = process.env["ANTHROPIC_API_KEY"];
+    if (!apiKey) {
+        console.error("ANTHROPIC_API_KEY env var is required.");
+        process.exit(2);
+    }
+    console.log(`slowcook chef-drift · story-${args.storyId} · trigger=${args.triggerKind}`);
+    const ledger = loadLedger(args.repoRoot, args.storyId);
+    if (ledger.cumulative_cost_usd >= args.budgetUsd) {
+        console.error(`  episode budget exceeded ($${ledger.cumulative_cost_usd.toFixed(2)} >= $${args.budgetUsd}). Halting.`);
+        process.exit(1);
+    }
+    let triggerRaw = {};
+    if (args.triggerRawPath && existsSync(args.triggerRawPath)) {
+        try {
+            triggerRaw = JSON.parse(readFileSync(args.triggerRawPath, "utf8"));
+        }
+        catch { /* ignore */ }
+    }
+    // Enrich trigger.raw with context the chef LLM doesn't have read-tools to gather.
+    // For mock_isolation failures: grep ALL importers of the missing symbol so chef
+    // can plan a coordinated rename (not just the one file the trigger detail named).
+    if (args.triggerKind === "mock_isolation_check_failed") {
+        const importerMatch = args.triggerDetail.match(/['"]\.\/(\w+)['"]/);
+        if (importerMatch && importerMatch[1]) {
+            const symbol = importerMatch[1];
+            const grepImportsBySymbol = (root, sym) => {
+                try {
+                    const out = execSync(`grep -rnE "from\\s+[\\\"']\\.[/.][^\\\"']*${sym}[\\\"']" "${root}" 2>/dev/null || true`, { encoding: "utf8", maxBuffer: 1024 * 1024 });
+                    return out
+                        .split("\n")
+                        .filter(Boolean)
+                        .map((line) => {
+                        const m = line.match(/^([^:]+):(\d+):(.*)$/);
+                        if (!m)
+                            return null;
+                        return { file: m[1].replace(args.repoRoot + "/", ""), line: parseInt(m[2], 10), text: m[3].trim() };
+                    })
+                        .filter((x) => x !== null);
+                }
+                catch {
+                    return [];
+                }
+            };
+            // Step 1: find existing files in same dir with names similar to the missing symbol.
+            // These are the rename candidates — the file that chef likely needs to rename forward.
+            const candidateExisting = [];
+            const symbolLower = symbol.toLowerCase();
+            const importerFile = args.triggerDetail.match(/^([^\s]+):/)?.[1];
+            const stem = symbolLower.replace(/strip|page|header|badge|card|list|row|item/g, "").trim();
+            if (importerFile) {
+                const dir = dirname(join(args.repoRoot, importerFile));
+                if (existsSync(dir)) {
+                    try {
+                        const files = readdirSync(dir);
+                        for (const f of files) {
+                            const fLow = f.toLowerCase().replace(/\.tsx?$/, "");
+                            if (!/\.tsx?$/.test(f))
+                                continue;
+                            if (fLow === symbolLower)
+                                continue; // skip exact match (it'd already exist)
+                            // Match if file name shares a meaningful stem with the symbol
+                            if ((stem.length > 3 && fLow.includes(stem)) ||
+                                fLow.includes(symbolLower.slice(0, 6)) ||
+                                symbolLower.includes(fLow)) {
+                                candidateExisting.push(`${dir.replace(args.repoRoot + "/", "")}/${f}`);
+                            }
+                        }
+                    }
+                    catch { /* ignore */ }
+                }
+            }
+            // Step 2: for the broken symbol AND every candidate-existing file's basename,
+            // grep all importers across mock/src + src.
+            const symbolsToGrep = new Set([symbol]);
+            for (const c of candidateExisting) {
+                const base = c.split("/").pop().replace(/\.tsx?$/, "");
+                symbolsToGrep.add(base);
+            }
+            const mockImporters = {};
+            const srcImporters = {};
+            for (const sym of symbolsToGrep) {
+                mockImporters[sym] = grepImportsBySymbol(join(args.repoRoot, "mock/src"), sym);
+                srcImporters[sym] = grepImportsBySymbol(join(args.repoRoot, "src"), sym);
+            }
+            // Read content of every importer file so chef can craft accurate
+            // search_replace pairs without inventing or omitting code.
+            const importerContents = {};
+            const allImporterFiles = new Set();
+            for (const sym of symbolsToGrep) {
+                for (const imp of mockImporters[sym] ?? [])
+                    allImporterFiles.add(imp.file);
+                for (const imp of srcImporters[sym] ?? [])
+                    allImporterFiles.add(imp.file);
+            }
+            for (const candidate of candidateExisting)
+                allImporterFiles.add(candidate);
+            for (const f of allImporterFiles) {
+                const abs = join(args.repoRoot, f);
+                if (existsSync(abs)) {
+                    const content = readFileSync(abs, "utf8");
+                    importerContents[f] = content.length > 6000 ? content.slice(0, 6000) + "\n// ... truncated" : content;
+                }
+            }
+            triggerRaw = {
+                ...triggerRaw,
+                symbol,
+                candidate_existing_files: candidateExisting,
+                importers_per_symbol: {
+                    mock: mockImporters,
+                    src: srcImporters,
+                },
+                existing_content: importerContents,
+                enrichment_note: "cli-precomputed (chef has no grep/read tools): importers_per_symbol shows EVERY file that imports each candidate. existing_content gives you the FULL TEXT of each importer + candidate file so you can craft accurate search_replace pairs. ALWAYS use search_replace operation for content edits — never full-content rewrites.",
+            };
+            const totalMockImps = Object.values(mockImporters).reduce((n, arr) => n + arr.length, 0);
+            const totalSrcImps = Object.values(srcImporters).reduce((n, arr) => n + arr.length, 0);
+            console.log(`  enriched trigger: ${candidateExisting.length} candidate file(s), ${symbolsToGrep.size} symbol(s) checked, ${totalMockImps} mock importer(s), ${totalSrcImps} src importer(s) total`);
+        }
+    }
+    let navigatorHistory = null;
+    if (args.navigatorHistoryPath && existsSync(args.navigatorHistoryPath)) {
+        try {
+            navigatorHistory = JSON.parse(readFileSync(args.navigatorHistoryPath, "utf8"));
+        }
+        catch { /* ignore */ }
+    }
+    const { specPath, specYaml } = loadSpec(args.repoRoot, args.storyId);
+    const openPrs = loadOpenPrs(args.repoRoot, args.storyId);
+    const historyIndex = loadHistoryIndex(args.repoRoot);
+    const issueMatch = specYaml.match(/source_issue:\s*"#?(\d+)"/);
+    const issueNumber = issueMatch ? parseInt(issueMatch[1], 10) : 0;
+    const prompt = buildChefPrompt({
+        storyId: args.storyId,
+        trigger: { kind: args.triggerKind, detail: args.triggerDetail, raw: triggerRaw },
+        storyState: { issueNumber, specPath, specYaml, openPrs },
+        historyIndex,
+        navigatorHistory: navigatorHistory,
+        priorChefMoves: ledger.moves.map((m) => ({
+            n: m.n,
+            triggerKind: m.trigger_kind,
+            decision: m.decision,
+            postState: m.post_state,
+        })),
+    });
+    console.log(`  prompt: ${prompt.length} chars · calling chef LLM (${args.model})`);
+    const client = new AnthropicClient(apiKey);
+    const resp = await client.complete({
+        model: args.model,
+        system: CHEF_SYSTEM,
+        messages: [{ role: "user", content: prompt }],
+        maxTokens: 8192,
+    });
+    console.log(`  chef LLM: ${resp.usage.inputTokens}→${resp.usage.outputTokens} tok · $${resp.costUsd.toFixed(4)}`);
+    let verdict;
+    try {
+        const text = resp.text.trim();
+        const fence = text.match(/```json\s*([\s\S]*?)```/);
+        verdict = JSON.parse(fence ? fence[1] : text);
+    }
+    catch (e) {
+        console.error(`  ! chef JSON parse failed: ${e.message}`);
+        console.error(`  raw: ${resp.text.slice(0, 500)}`);
+        process.exit(1);
+    }
+    console.log(`  chef verdict: ${verdict.kind.toUpperCase()}`);
+    console.log(`  rationale: ${verdict.rationale}`);
+    // Frozen-surface guard
+    for (const e of verdict.edits) {
+        if (isFrozenPath(e.file) || (e.to && isFrozenPath(e.to))) {
+            console.error(`  ! chef proposed an edit to frozen path: ${e.file} → ${e.to ?? ""}. Halting + escalating.`);
+            verdict.kind = "halt";
+            verdict.edits = [];
+        }
+    }
+    // Cycle guard
+    if (verdict.kind === "autonomous_fix" && detectCycle(ledger, verdict.edits)) {
+        console.error(`  ! cycle detected: chef's planned edit is the inverse of an earlier move. Halting.`);
+        verdict.kind = "halt";
+        verdict.edits = [];
+    }
+    const moveN = ledger.moves.length + 1;
+    const moveEntry = {
+        n: moveN,
+        trigger_kind: args.triggerKind,
+        drift_signature: args.triggerDetail.slice(0, 200),
+        rationale: verdict.rationale,
+        decision: verdict.kind,
+        edits: verdict.edits,
+        validation_command: verdict.validation?.command ?? null,
+        validation_result: null,
+        next_dispatch: verdict.next_dispatch,
+        cost_usd: resp.costUsd,
+        post_state: "escalated",
+        timestamp: new Date().toISOString(),
+    };
+    if (verdict.kind === "autonomous_fix" && verdict.edits.length > 0) {
+        if (args.dryRun) {
+            console.log(`\n  [dry-run] would apply ${verdict.edits.length} edit(s); skipping`);
+            moveEntry.post_state = "escalated"; // dry-run: state is unknown without applying
+        }
+        else {
+            console.log(`\n  applying ${verdict.edits.length} edit(s)...`);
+            try {
+                // Capture PRE-move validation output as baseline. Pre-existing
+                // failures aren't chef's responsibility — only new ones are.
+                let preBaseline = null;
+                if (verdict.validation) {
+                    console.log(`  baseline (pre-edit): ${verdict.validation.command}`);
+                    preBaseline = runValidation(args.repoRoot, verdict.validation.command);
+                    console.log(`    pre passed=${preBaseline.passed}`);
+                }
+                for (const e of verdict.edits)
+                    applyEdit(args.repoRoot, e);
+                if (verdict.validation && preBaseline) {
+                    console.log(`  validating: ${verdict.validation.command}`);
+                    const post = runValidation(args.repoRoot, verdict.validation.command);
+                    const diff = compareValidationOutputs(preBaseline.output, post.output);
+                    console.log(`    post passed=${post.passed} · diff=${diff}`);
+                    if (post.passed) {
+                        moveEntry.validation_result = "passed";
+                        moveEntry.post_state = "clean";
+                        console.log(`  ✓ validation cleanly passed`);
+                    }
+                    else if (diff === "progress") {
+                        moveEntry.validation_result = "passed"; // partial — pre-existing unrelated failures remain
+                        moveEntry.post_state = "clean";
+                        console.log(`  ✓ progress: chef removed failures + introduced none. Pre-existing unrelated failures remain (not chef's responsibility).`);
+                    }
+                    else if (diff === "no-change" && verdict.validation.must_exit_zero) {
+                        console.error(`  ! validation NO-CHANGE. Chef's edits didn't help. Reverting.`);
+                        execSync(`git -C "${args.repoRoot}" checkout HEAD -- .`);
+                        execSync(`git -C "${args.repoRoot}" clean -fd`);
+                        moveEntry.validation_result = "failed";
+                        moveEntry.post_state = "still-broken";
+                    }
+                    else if (diff === "regression") {
+                        console.error(`  ! validation REGRESSION: chef introduced new failures. Reverting.`);
+                        execSync(`git -C "${args.repoRoot}" checkout HEAD -- .`);
+                        execSync(`git -C "${args.repoRoot}" clean -fd`);
+                        moveEntry.validation_result = "failed";
+                        moveEntry.post_state = "still-broken";
+                    }
+                    else {
+                        moveEntry.validation_result = "passed";
+                        moveEntry.post_state = "clean";
+                    }
+                }
+                else {
+                    moveEntry.validation_result = "not-run";
+                    moveEntry.post_state = "clean";
+                }
+            }
+            catch (e) {
+                console.error(`  ! edit-application failed: ${e.message}. Reverting.`);
+                try {
+                    execSync(`git -C "${args.repoRoot}" checkout HEAD -- .`);
+                }
+                catch { /* */ }
+                try {
+                    execSync(`git -C "${args.repoRoot}" clean -fd`);
+                }
+                catch { /* */ }
+                moveEntry.post_state = "still-broken";
+            }
+        }
+    }
+    else if (verdict.kind === "pm_question" && verdict.pm_comment && !args.dryRun) {
+        console.log(`\n  posting PM question to issue #${verdict.pm_comment.issue_number}`);
+        postIssueComment(args.repoRoot, verdict.pm_comment.issue_number, verdict.pm_comment.body);
+    }
+    // Commit chef's edits locally (workflow handles the push) when validation passed.
+    if (verdict.kind === "autonomous_fix" && moveEntry.post_state === "clean" && !args.dryRun) {
+        const summary = `move ${moveN} on story-${args.storyId} — ${args.triggerKind}: ${verdict.rationale.slice(0, 120)}`;
+        const result = commitChefEdits(args.repoRoot, summary, verdict.edits);
+        if (result.sha)
+            console.log(`  committed: ${result.sha.slice(0, 7)}`);
+    }
+    ledger.moves.push(moveEntry);
+    ledger.cumulative_cost_usd += resp.costUsd;
+    if (!args.dryRun)
+        saveLedger(args.repoRoot, ledger);
+    if (verdict.kind === "autonomous_fix" && moveEntry.post_state === "clean" && issueNumber > 0 && !args.dryRun) {
+        const body = buildAuditCommentBody({ ledger, move: moveEntry, verdict });
+        try {
+            postIssueComment(args.repoRoot, issueNumber, body);
+        }
+        catch (e) {
+            console.warn(`  warn: audit comment failed (non-fatal): ${e.message.slice(0, 200)}`);
+        }
+    }
+    console.log(`\n  done · post_state=${moveEntry.post_state} · move=${moveN} · cum-cost=$${ledger.cumulative_cost_usd.toFixed(4)}`);
+    if (verdict.kind === "halt" || moveEntry.post_state === "still-broken")
+        process.exit(1);
+}
+//# sourceMappingURL=drift-fix.js.map