@webpresso/agent-kit 3.1.26 → 3.1.30

package/dist/esm/blueprint/lifecycle/review-provenance.js

@@ -1,9 +1,9 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import path from "node:path";
-import { readReviewAuthorityAtRef } from "#review/authority.js";
-import { parseReviewEventLog } from "#review/events.js";
-import { normalizePlanSubjectContent } from "#review/subject.js";
+import { readReviewAuthorityAtRef, readWorkingReviewEvents } from "#review/authority.js";
+import { evaluateReviewEvents, parseReviewEventLog } from "#review/events.js";
+import { createPlanSubjectDigestForContent, normalizePlanSubjectContent } from "#review/subject.js";
 import { isPolicyApprovalVerdict } from "#review/verdict.js";
 const REVIEW_ENTRY_MARKER = "<!-- wp:review-entry ";
 function normalizePath(file) {
@@ -52,6 +52,53 @@ function stableSlugForBlueprintFile(file) {
     }
     return path.basename(path.dirname(file));
 }
+/**
+ * Read `_overview.md` for a blueprint at `ref`. Prefer the working-tree path;
+ * if missing (lifecycle move draft→planned before the promote commit), resolve
+ * by stable slug under any lifecycle directory at that ref.
+ */
+export function readBlueprintOverviewAtRef(repoRoot, ref, file) {
+    const relative = normalizePath(path.relative(repoRoot, file));
+    if (relative.startsWith("..") || path.isAbsolute(relative))
+        return null;
+    try {
+        return execFileSync("git", ["show", `${ref}:${relative}`], {
+            cwd: repoRoot,
+            encoding: "buffer",
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 5_000,
+        });
+    }
+    catch {
+        // Path may have moved across lifecycle dirs (draft→planned) while the
+        // promote commit is still uncommitted. Stable slug is the authority key.
+        const slug = stableSlugForBlueprintFile(file);
+        if (!slug || slug.includes(".."))
+            return null;
+        try {
+            const names = execFileSync("git", ["ls-tree", "-r", "--name-only", ref], {
+                cwd: repoRoot,
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "pipe"],
+                timeout: 5_000,
+            });
+            const escaped = slug.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+            const pattern = new RegExp(`(?:^|/)(?:draft|planned|parked|in-progress|completed|archived)/${escaped}/_overview\\.md$`, "u");
+            const hits = names.split("\n").filter((name) => pattern.test(normalizePath(name)));
+            if (hits.length !== 1)
+                return null;
+            return execFileSync("git", ["show", `${ref}:${hits[0]}`], {
+                cwd: repoRoot,
+                encoding: "buffer",
+                stdio: ["ignore", "pipe", "pipe"],
+                timeout: 5_000,
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+}
 function workingContentMatchesRef(repoRoot, file, purpose, ref) {
     const relative = path.relative(repoRoot, file);
     if (relative.startsWith("..") || path.isAbsolute(relative))
@@ -63,12 +110,11 @@ function workingContentMatchesRef(repoRoot, file, purpose, ref) {
             // in the working tree before the promotion commit exists, and that
             // window must not strip a legitimately promoted blueprint of its plan
             // authority. Substantive edits still differ after normalization.
-            const atRef = execFileSync("git", ["show", `${ref}:${normalizePath(relative)}`], {
-                cwd: repoRoot,
-                encoding: "buffer",
-                stdio: ["ignore", "pipe", "pipe"],
-                timeout: 5_000,
-            });
+            // Also resolve by stable slug when the lifecycle path changed (draft→planned)
+            // so pre-commit on a rename does not falsely drop plan authority.
+            const atRef = readBlueprintOverviewAtRef(repoRoot, ref, file);
+            if (!atRef)
+                return false;
             const working = readFileSync(file);
             return normalizePlanSubjectContent(working).equals(normalizePlanSubjectContent(atRef));
         }
@@ -84,27 +130,62 @@ function workingContentMatchesRef(repoRoot, file, purpose, ref) {
         return false;
     }
 }
+// Working-ledger acceptance: pre-commit validates a blueprint whose new review
+// events are staged alongside it and therefore not yet at any git ref. An
+// event still counts only when its subjectDigest matches the digest of the
+// exact working bytes being committed and its artifact hash-verifies on disk —
+// content-addressing keeps this sound before the commit exists.
+function collectWorkingV2ReviewProvenance(file, issues) {
+    try {
+        const slug = stableSlugForBlueprintFile(file);
+        const working = readWorkingReviewEvents(file, slug);
+        if (working.events.length === 0)
+            return [];
+        issues?.push(...working.issues);
+        const digest = createPlanSubjectDigestForContent(slug, readFileSync(file));
+        const evaluation = evaluateReviewEvents(working.events, {
+            purpose: "plan",
+            blueprintSlug: slug,
+            subjectScheme: "wp-blueprint-v1",
+            subjectDigest: digest,
+        }, working.compromisedIds);
+        return evaluation.approvals
+            .filter((event) => event.artifactPath)
+            .map((event) => ({
+            reviewer: event.reviewer,
+            artifact: event.artifactPath,
+            targetHash: event.subjectDigest,
+        }));
+    }
+    catch (error) {
+        issues?.push(`Working review authority unavailable for ${file}: ${error instanceof Error ? error.message : String(error)}`);
+        return [];
+    }
+}
 export function collectV2ReviewProvenance(file, purpose, ref = "HEAD", issues) {
     const repoRoot = findGitRoot(file);
     if (!repoRoot)
         return [];
+    const workingApprovals = purpose === "plan" ? collectWorkingV2ReviewProvenance(file, issues) : [];
     if (!workingContentMatchesRef(repoRoot, file, purpose, ref))
-        return [];
+        return workingApprovals;
     try {
         const authority = readReviewAuthorityAtRef(repoRoot, ref, stableSlugForBlueprintFile(file), purpose);
         issues?.push(...authority.issues);
-        return authority.approvals.map((event) => ({
+        const refApprovals = authority.approvals.map((event) => ({
             reviewer: event.reviewer,
             artifact: event.artifactPath,
             targetHash: event.subjectDigest,
         }));
+        const seen = new Set(refApprovals.map((approval) => approval.reviewer));
+        return [...refApprovals, ...workingApprovals.filter((entry) => !seen.has(entry.reviewer))];
     }
     catch (error) {
         // Container-level failure (unparseable ledger, duplicate ids, cross-slug
         // events, unresolved commit): fail closed for the whole file, but surface
         // the reason instead of silently reporting zero authority.
         issues?.push(`Review authority unavailable for ${file}: ${error instanceof Error ? error.message : String(error)}`);
-        return [];
+        return workingApprovals;
     }
 }
 function reviewEventLogsAtRef(cwd, ref) {

package/dist/esm/blueprint/markdown/helpers.js

@@ -67,10 +67,14 @@ export function updateBlockedReason(content, taskId, reason) {
         const trimmedReason = reason.trim();
         const blockedPattern = /\n?\*\*Blocked:\*\*\s*.*(?:\n+)?/i;
         if (!trimmedReason) {
-            return section
+            // Preserve the section's trailing whitespace: trimEnd on the whole
+            // section would also delete the blank line separating this task from the
+            // next heading, changing bytes the writer does not own.
+            const trailingWhitespace = section.slice(section.trimEnd().length);
+            return (section
                 .replace(blockedPattern, "\n")
                 .replace(/\n{3,}/g, "\n\n")
-                .trimEnd();
+                .trimEnd() + trailingWhitespace);
         }
         const blockedLine = `**Blocked:** ${trimmedReason}`;
         if (/\*\*Blocked:\*\*/i.test(section)) {

package/dist/esm/ci/act-replay.js

@@ -31,8 +31,105 @@ export function buildReplayWorkflowSource(sourceYaml, options) {
         : basename(options.workflowPath);
     workflow.name = `replay: ${originalName}`;
     workflow.on = normalizeWorkflowOnSection(workflow.on, options.eventName);
+    workflow.jobs = rewriteReplayJobs(workflow.jobs, options.eventName);
     return stringify(workflow);
 }
+function rewriteReplayJobs(jobs, eventName) {
+    if (typeof jobs !== "object" || jobs === null || Array.isArray(jobs)) {
+        return jobs;
+    }
+    return Object.fromEntries(Object.entries(jobs).map(([jobId, job]) => [
+        jobId,
+        rewriteReplayJob(job, eventName),
+    ]));
+}
+function rewriteReplayJob(job, eventName) {
+    if (typeof job !== "object" || job === null || Array.isArray(job)) {
+        return job;
+    }
+    const jobRecord = { ...job };
+    if (Array.isArray(jobRecord.steps)) {
+        jobRecord.steps = jobRecord.steps.map((step) => rewriteReplayStep(step, eventName));
+    }
+    return jobRecord;
+}
+function rewriteReplayStep(step, eventName) {
+    if (!isRecord(step) || !isSameRepoCheckoutStep(step, eventName)) {
+        return step;
+    }
+    const rewritten = {
+        name: typeof step.name === "string" ? step.name : "Use prepared local replay workspace",
+        run: [
+            'echo "wp ci act replay: using prepared local workspace instead of actions/checkout"',
+            "test -d .git",
+            "git rev-parse --is-inside-work-tree",
+            "git rev-parse --verify HEAD",
+        ].join("\n"),
+        "working-directory": "${{ github.workspace }}",
+    };
+    copyOptionalStepField(step, rewritten, "id");
+    copyOptionalStepField(step, rewritten, "if");
+    copyOptionalStepField(step, rewritten, "timeout-minutes");
+    copyOptionalStepField(step, rewritten, "continue-on-error");
+    return rewritten;
+}
+function isSameRepoCheckoutStep(step, eventName) {
+    if (typeof step.uses !== "string" || !/^actions\/checkout(?:@|$)/u.test(step.uses)) {
+        return false;
+    }
+    if (step.env !== undefined && step.env !== null) {
+        return false;
+    }
+    const withConfig = step.with;
+    if (withConfig === undefined || withConfig === null) {
+        return true;
+    }
+    if (!isRecord(withConfig)) {
+        return false;
+    }
+    if (hasAnyCheckoutInputExcept(withConfig, ["ref"])) {
+        return false;
+    }
+    return isCurrentReplayRef(withConfig.ref, eventName);
+}
+function isCurrentReplayRef(value, eventName) {
+    if (value === undefined || value === null || String(value).trim().length === 0) {
+        return true;
+    }
+    const normalized = normalizeGithubExpression(String(value));
+    if (normalized === null)
+        return false;
+    if (normalized === "github.sha") {
+        return true;
+    }
+    if (normalized ===
+        "github.event_name=='pull_request'&&github.event.pull_request.base.sha||github.sha") {
+        return eventName !== "pull_request";
+    }
+    return false;
+}
+function normalizeGithubExpression(value) {
+    const match = /^\$\{\{\s*([\s\S]*?)\s*\}\}$/u.exec(value.trim());
+    if (!match?.[1])
+        return null;
+    return match[1].replace(/"/gu, "'").replace(/\s+/gu, "");
+}
+function hasAnyCheckoutInputExcept(withConfig, allowedKeys) {
+    const allowed = new Set(allowedKeys);
+    return Object.entries(withConfig).some(([key, value]) => {
+        if (allowed.has(key))
+            return false;
+        return value !== undefined && value !== null && String(value).trim().length > 0;
+    });
+}
+function copyOptionalStepField(source, target, field) {
+    if (source[field] !== undefined) {
+        target[field] = source[field];
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 export function createReplayWorkflow(options) {
     const sourcePath = resolve(options.cwd, options.workflowPath);
     const sourceYaml = readFileSync(sourcePath, "utf8");
@@ -42,11 +139,17 @@ export function createReplayWorkflow(options) {
     });
     const dir = mkdtempSync(join(tmpdir(), "wp-ci-act-replay-"));
     const workflowPath = join(dir, "workflow.yml");
-    writeFileSync(workflowPath, generatedYaml, "utf8");
-    return {
-        workflowPath,
-        cleanup() {
-            rmSync(dir, { recursive: true, force: true });
-        },
-    };
+    try {
+        writeFileSync(workflowPath, generatedYaml, "utf8");
+        return {
+            workflowPath,
+            cleanup() {
+                rmSync(dir, { recursive: true, force: true });
+            },
+        };
+    }
+    catch (error) {
+        rmSync(dir, { recursive: true, force: true });
+        throw error;
+    }
 }

package/dist/esm/ci/act-runner.d.ts

@@ -6,6 +6,7 @@ export interface PublicCiActOptions {
     readonly workflow?: string;
     readonly workflowPath?: string;
     readonly job?: string;
+    readonly matrix?: readonly string[];
     readonly eventName?: CiActEventName;
     readonly eventPath?: string;
     readonly envProfile?: string;
@@ -22,6 +23,7 @@ export interface PublicCiActCommand {
     readonly actArgs: readonly string[];
 }
 export interface PreparedPublicCiActExecution {
+    readonly cwd: string;
     readonly command: PublicCiActCommand;
     readonly mode: CiActExecutionMode;
     readonly nonSecurityEquivalent: boolean;
@@ -36,5 +38,7 @@ export declare function buildPublicCiActArgs(options?: PublicCiActOptions, workf
 export declare function buildPublicCiActCommand(options?: PublicCiActOptions): PublicCiActCommand;
 export declare function preparePublicCiActExecution(options?: PublicCiActOptions): PreparedPublicCiActExecution;
 export declare function resolveCiActSecretEnvProfile(options?: PublicCiActOptions): string | undefined;
+export declare function shouldForceCiActSecretGate(envProfile: string | undefined): boolean;
 export declare function sanitizePublicCiActArgv(command: PublicCiActCommand): PublicCiActCommand;
 export declare function assertNoForbiddenCiActArgs(args: readonly string[]): void;
+export declare function normalizeCiActMatrixSelectors(selectors: readonly string[] | undefined): readonly string[];

package/dist/esm/ci/act-runner.js

@@ -2,6 +2,7 @@ import { resolve } from "node:path";
 import { buildSecretGateCommand } from "#secret-gate/runner.js";
 import { resolveSecretsConfigProfileEnvironment } from "#runtime/secrets-config.js";
 import { createReplayWorkflow, GENERATED_REPLAY_WORKFLOW_PLACEHOLDER, } from "./act-replay.js";
+import { prepareActGitWorkspace } from "./act-worktree-git.js";
 export { GENERATED_REPLAY_WORKFLOW_PLACEHOLDER } from "./act-replay.js";
 const DEFAULT_WORKFLOW = "ci-e2e";
 export const DEFAULT_PLATFORM_IMAGE = "ghcr.io/catthehacker/ubuntu:full-latest";
@@ -43,6 +44,7 @@ export function buildPublicCiActArgs(options = {}, workflowPathOverride) {
         "--rm",
     ];
     pushOption(args, "-j", options.job);
+    pushRepeatableOption(args, "--matrix", normalizeCiActMatrixSelectors(options.matrix));
     pushOption(args, "-e", options.eventPath ? resolve(cwd, options.eventPath) : undefined);
     pushOption(args, "--container-architecture", containerArchitecture);
     return args;
@@ -57,7 +59,7 @@ export function buildPublicCiActCommand(options = {}) {
         sink: "act",
         profile: secretEnvProfile,
         envProfile: options.envProfile ?? "secrets-only",
-        forceSecretGate: true,
+        forceSecretGate: shouldForceCiActSecretGate(options.envProfile),
         command: "act",
         args: actArgs,
     });
@@ -65,32 +67,63 @@ export function buildPublicCiActCommand(options = {}) {
 }
 export function preparePublicCiActExecution(options = {}) {
     const cwd = options.cwd ?? process.cwd();
-    const mode = resolveCiActExecutionMode(options);
-    const replay = mode === "replay"
-        ? createReplayWorkflow({
-            cwd,
-            workflowPath: resolveCiActWorkflowPath(options),
-            eventName: options.eventName ?? "pull_request",
-        })
-        : null;
-    const actArgs = buildPublicCiActArgs({ ...options, cwd }, replay ? replay.workflowPath : undefined);
-    const secretEnvProfile = resolveCiActSecretEnvProfile({ ...options, cwd }) ?? "preview";
-    const wrapped = buildSecretGateCommand({
-        sink: "act",
-        profile: secretEnvProfile,
-        envProfile: options.envProfile ?? "secrets-only",
-        forceSecretGate: true,
-        command: "act",
-        args: actArgs,
-    });
-    return {
-        command: { command: wrapped.command, args: wrapped.args, actArgs },
-        mode,
-        nonSecurityEquivalent: mode === "replay",
-        cleanup() {
+    let gitWorkspace = null;
+    let replay = null;
+    try {
+        gitWorkspace = prepareActGitWorkspace(cwd);
+        const executionCwd = gitWorkspace.cwd;
+        const mode = resolveCiActExecutionMode(options);
+        const sourceWorkflowPath = resolve(cwd, resolveCiActWorkflowPath(options));
+        replay =
+            mode === "replay"
+                ? createReplayWorkflow({
+                    cwd,
+                    workflowPath: sourceWorkflowPath,
+                    eventName: options.eventName ?? "pull_request",
+                })
+                : null;
+        const executionOptions = {
+            ...options,
+            cwd: executionCwd,
+            eventPath: options.eventPath ? resolve(cwd, options.eventPath) : undefined,
+        };
+        const actArgs = buildPublicCiActArgs(executionOptions, replay ? replay.workflowPath : sourceWorkflowPath);
+        if (gitWorkspace.prepared) {
+            actArgs.push("--bind");
+        }
+        const secretEnvProfile = resolveCiActSecretEnvProfile({ ...options, cwd }) ?? "preview";
+        const wrapped = buildSecretGateCommand({
+            sink: "act",
+            profile: secretEnvProfile,
+            envProfile: options.envProfile ?? "secrets-only",
+            forceSecretGate: shouldForceCiActSecretGate(options.envProfile),
+            command: "act",
+            args: actArgs,
+        });
+        return {
+            cwd: executionCwd,
+            command: { command: wrapped.command, args: wrapped.args, actArgs },
+            mode,
+            nonSecurityEquivalent: mode === "replay",
+            cleanup() {
+                try {
+                    replay?.cleanup();
+                }
+                finally {
+                    gitWorkspace?.cleanup();
+                }
+            },
+        };
+    }
+    catch (error) {
+        try {
             replay?.cleanup();
-        },
-    };
+        }
+        finally {
+            gitWorkspace?.cleanup();
+        }
+        throw error;
+    }
 }
 export function resolveCiActSecretEnvProfile(options = {}) {
     const secretEnvProfile = options.secretEnvProfile?.trim();
@@ -103,6 +136,9 @@ export function resolveCiActSecretEnvProfile(options = {}) {
     }
     return undefined;
 }
+export function shouldForceCiActSecretGate(envProfile) {
+    return envProfile !== "none" && envProfile !== "public";
+}
 export function sanitizePublicCiActArgv(command) {
     return {
         command: command.command,
@@ -126,11 +162,34 @@ export function assertNoForbiddenCiActArgs(args) {
     if (found)
         throw new Error(`Unsupported unsafe ci act argument: ${found}`);
 }
+export function normalizeCiActMatrixSelectors(selectors) {
+    if (!selectors)
+        return [];
+    return selectors.map((selector) => normalizeCiActMatrixSelector(selector));
+}
 function pushOption(args, flag, value) {
     if (value === undefined || value === "")
         return;
     args.push(flag, String(value));
 }
+function pushRepeatableOption(args, flag, values) {
+    for (const value of values) {
+        args.push(flag, value);
+    }
+}
+function normalizeCiActMatrixSelector(selector) {
+    const trimmed = selector.trim();
+    const delimiter = trimmed.indexOf(":");
+    if (trimmed.length === 0 || delimiter <= 0) {
+        throw new Error(`Invalid ci act matrix selector "${selector}". Use key:value with non-empty key and value.`);
+    }
+    const key = trimmed.slice(0, delimiter).trim();
+    const value = trimmed.slice(delimiter + 1).trim();
+    if (key.length === 0 || value.length === 0) {
+        throw new Error(`Invalid ci act matrix selector "${selector}". Use key:value with non-empty key and value.`);
+    }
+    return `${key}:${value}`;
+}
 function sanitizeArg(value) {
     if (/wp-ci-act-[^/\\]+[/\\]secrets\.env$/u.test(value))
         return "[INTERNAL_SECRET_FILE]";

package/dist/esm/ci/act-worktree-git.d.ts

@@ -0,0 +1,11 @@
+export interface PreparedActGitWorkspace {
+    readonly cwd: string;
+    readonly prepared: boolean;
+    cleanup(): void;
+}
+interface LinkedWorktreeGitMetadata {
+    readonly gitDir: string;
+}
+export declare function prepareActGitWorkspace(cwd: string): PreparedActGitWorkspace;
+export declare function readLinkedWorktreeGitMetadata(cwd: string): LinkedWorktreeGitMetadata | null;
+export {};