@webpresso/agent-kit 3.3.3 → 3.3.4

package/dist/esm/status/snapshot.d.ts

@@ -51,6 +51,10 @@ export declare const wpStatusSnapshotSchema: z.ZodObject<{
             path: z.ZodString;
             lifecycle: z.ZodString;
             approvalsSatisfied: z.ZodBoolean;
+            approvalsSatisfiedBy: z.ZodOptional<z.ZodEnum<{
+                delivery: "delivery";
+                plan: "plan";
+            }>>;
         }, z.core.$strip>>;
         ultragoal: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         reviews: z.ZodOptional<z.ZodObject<{
@@ -127,6 +131,7 @@ export interface PrReadinessEvidence {
         readonly path: string;
         readonly lifecycle: string;
         readonly approvalsSatisfied: boolean;
+        readonly approvalsSatisfiedBy?: "plan" | "delivery";
     };
 }
 interface ReadinessEvaluation {

package/dist/esm/status/snapshot.js

@@ -42,6 +42,9 @@ const statusContextSchema = z.object({
         path: z.string(),
         lifecycle: z.string(),
         approvalsSatisfied: z.boolean(),
+        // Which review purpose carried the satisfying approval ("plan" or
+        // "delivery"), so a satisfied/unsatisfied result is attributable.
+        approvalsSatisfiedBy: z.enum(["plan", "delivery"]).optional(),
     })
         .optional(),
     ultragoal: z.record(z.string(), z.unknown()).optional(),
@@ -319,6 +322,20 @@ function selectBlueprintFile(projectRoot, pr) {
     const priority = (file) => file.changeType === "ADDED" ? 0 : file.changeType === "RENAMED" ? 1 : 2;
     return candidates.toSorted((left, right) => priority(left) - priority(right))[0];
 }
+// The authoritative CI gate (`validateApprovalGate` -> `provenanceBackedApprovalReviewers`)
+// accepts an approval recorded for EITHER purpose: it defaults to
+// `["plan", "delivery"]` when no purpose is pinned. This advisory snapshot used to
+// query `"delivery"` only, so a blueprint approved at the plan boundary reported
+// `review-provenance` unsatisfied while CI passed on the same commit — an advisory
+// blocker stricter than the gate it advises about, which reads as a real problem.
+// Union both purposes here so the two agree.
+//
+// Deliberately NOT reusing `provenanceBackedApprovalReviewers` directly: that helper
+// resolves v2 provenance at `HEAD`, whereas this snapshot must answer for the PR's
+// exact target commit. Matching its purpose set while keeping `targetHash` is the
+// smallest change that makes the two evaluators agree without loosening exact-SHA
+// semantics.
+const APPROVAL_PURPOSES = ["plan", "delivery"];
 function resolveBlueprintEvidence(projectRoot, pr, targetHash) {
     const blueprintFile = selectBlueprintFile(projectRoot, pr);
     if (!blueprintFile || !targetHash)
@@ -327,12 +344,20 @@ function resolveBlueprintEvidence(projectRoot, pr, targetHash) {
         const authority = readReviewAuthorityAtRef(projectRoot, targetHash, blueprintFile.stableSlug, "delivery");
         if (authority.blueprintPath !== blueprintFile.path)
             return undefined;
-        const approvals = collectV2ReviewProvenance(path.resolve(projectRoot, blueprintFile.path), "delivery", targetHash);
+        const blueprintPath = path.resolve(projectRoot, blueprintFile.path);
+        const perPurpose = APPROVAL_PURPOSES.map((purpose) => ({
+            purpose,
+            reviewers: collectV2ReviewProvenance(blueprintPath, purpose, targetHash).map((approval) => approval.reviewer),
+        }));
+        const satisfiedPurpose = perPurpose.find((entry) => evaluateApprovalReviewers(entry.reviewers).satisfied);
         return {
             path: blueprintFile.path,
             lifecycle: authority.lifecycle,
-            approvalsSatisfied: evaluateApprovalReviewers(approvals.map((approval) => approval.reviewer))
+            approvalsSatisfied: evaluateApprovalReviewers(perPurpose.flatMap((entry) => entry.reviewers))
                 .satisfied,
+            // Which purpose carried the approval, so a red/green flip is attributable
+            // instead of opaque.
+            approvalsSatisfiedBy: satisfiedPurpose?.purpose,
         };
     }
     catch {

package/dist/esm/test/shard-durations.json

@@ -560,7 +560,6 @@
             "src/audit/no-legacy-cli-bin.test.ts": 56.865957999999864,
             "src/mcp/tools/session-elision.test.ts": 4564.6535,
             "src/hooks/pretool-guard/validators/ux-quality.test.ts": 105.19341700000041,
-            "src/config/oxlint/monorepo-paths.test.ts": 11.33191700000043,
             "src/cli/commands/init/source-repo-hook-policy.test.ts": 65.89804200000003,
             "src/secrets/config/schema.test.ts": 190.3588749999999,
             "scripts/bench/scenarios/_schema.test.ts": 53.78470799999968,

package/dist/esm/test-helpers/global-setup.js

@@ -40,13 +40,38 @@ async function withDistBuildLock(fn) {
 // idempotent, re-checked-under-lock build; every other process blocks until that release, then finds
 // the sentinels already satisfied and returns immediately. In the steady state (dist/ already built)
 // this is a single existsSync check with no lock contention at all.
+const AGENT_CORE_SENTINEL = join(REPO_ROOT, "packages/agent-core/dist/esm/repo-root/index.js");
+const AGENT_CONFIG_OXLINT_SENTINEL = join(REPO_ROOT, "packages/agent-config/dist/esm/oxlint/import-hygiene.js");
+function buildWorkspacePackage(filter) {
+    execFileSync("pnpm", ["--filter", filter, "run", "build"], {
+        cwd: REPO_ROOT,
+        encoding: "utf8",
+        env: { ...process.env, HUSKY: "0" },
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+}
+const VENDORED_OXLINT_PLUGIN = join(REPO_ROOT, "dist/esm/config/oxlint/import-hygiene.js");
+/** agent-config oxlint SSOT is imported at build/test time (rules map + vendor source). */
+function ensureAgentConfigBuiltSync() {
+    if (!existsSync(AGENT_CORE_SENTINEL)) {
+        buildWorkspacePackage("@webpresso/agent-core");
+    }
+    if (!existsSync(AGENT_CONFIG_OXLINT_SENTINEL)) {
+        buildWorkspacePackage("@webpresso/agent-config");
+    }
+}
 async function ensureDistPrepared() {
-    // Fast path: nothing to build. Only pay the lock when a build artifact is actually missing.
-    if (existsSync(DIST_SENTINEL) && existsSync(MIGRATION_SENTINEL))
+    // Fast path: agent-kit dist + migration assets + vendored inject plugins.
+    if (existsSync(DIST_SENTINEL) &&
+        existsSync(MIGRATION_SENTINEL) &&
+        existsSync(VENDORED_OXLINT_PLUGIN) &&
+        existsSync(AGENT_CONFIG_OXLINT_SENTINEL)) {
         return;
+    }
     await withDistBuildLock(async () => {
         let builtDist = false;
         // Re-check under the lock: another run may have completed the build while we waited.
+        ensureAgentConfigBuiltSync();
         if (!existsSync(DIST_SENTINEL)) {
             execFileSync("./node_modules/.bin/tshy", [], {
                 cwd: REPO_ROOT,
@@ -73,7 +98,17 @@ async function ensureDistPrepared() {
                 env: { ...process.env, HUSKY: "0" },
             });
         }
-        if (builtDist) {
+        if (builtDist || !existsSync(VENDORED_OXLINT_PLUGIN)) {
+            execFileSync("bun", ["src/build/generate-oxlintrc.ts"], {
+                cwd: REPO_ROOT,
+                encoding: "utf8",
+                env: { ...process.env, HUSKY: "0" },
+            });
+            execFileSync("bun", ["src/build/vendor-oxlint-plugins.ts"], {
+                cwd: REPO_ROOT,
+                encoding: "utf8",
+                env: { ...process.env, HUSKY: "0" },
+            });
             execFileSync("bun", ["src/build/normalize-tsconfig-json-exports.ts"], {
                 cwd: REPO_ROOT,
                 encoding: "utf8",

package/dist/esm/tool-runtime/managed-rtk.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Managed RTK binary — single ownership for install + resolve + capability probe.
+ *
+ * Consumers never brew/cargo install rtk. Setup downloads a pinned upstream
+ * release into the Webpresso cache and every call site uses that absolute path.
+ * Filters stay upstream (Apache-2.0); we only own packaging + path resolution.
+ */
+/** Pinned upstream token-killer release (https://github.com/rtk-ai/rtk). */
+export declare const RTK_MANAGED_VERSION = "0.43.0";
+export type ManagedRtkEnsureResult = {
+    readonly ok: true;
+    readonly path: string;
+    readonly installed: boolean;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+export type ManagedRtkDownloader = (url: string, destFile: string) => void;
+/** Test seam. */
+export declare function resetManagedRtkCacheForTests(): void;
+export declare function managedRtkAssetName(platform?: NodeJS.Platform, arch?: string): string | null;
+export declare function managedRtkDownloadUrl(version?: string): string | null;
+/** Cache dir: `envPaths("webpresso").cache/tools/rtk/<version>/`. */
+export declare function managedRtkInstallDir(version?: string): string;
+export declare function managedRtkExecutablePath(version?: string): string;
+/**
+ * Resolve the managed executable if present on disk (no network, no probe).
+ * Prefers explicit WP_RTK_BIN, then managed cache install.
+ */
+export declare function resolveManagedRtkExecutable(): string | null;
+/** Capability probe against a concrete binary (or managed path). Fail-open. */
+export declare function probeRtkCapabilityAt(executable: string): boolean;
+/** Process-cached: managed binary exists and passes capability probe. */
+export declare function isManagedRtkAvailable(): boolean;
+/**
+ * Ensure the pinned managed rtk binary is on disk. Downloads once into the
+ * Webpresso cache. No brew/cargo. Idempotent.
+ */
+export declare function ensureManagedRtk(options?: {
+    readonly downloader?: ManagedRtkDownloader;
+    readonly version?: string;
+}): ManagedRtkEnsureResult;
+/** Write a tiny marker file for diagnostics (optional). */
+export declare function writeManagedRtkVersionMarker(path: string, version: string): void;

package/dist/esm/tool-runtime/managed-rtk.js

@@ -0,0 +1,275 @@
+/**
+ * Managed RTK binary — single ownership for install + resolve + capability probe.
+ *
+ * Consumers never brew/cargo install rtk. Setup downloads a pinned upstream
+ * release into the Webpresso cache and every call site uses that absolute path.
+ * Filters stay upstream (Apache-2.0); we only own packaging + path resolution.
+ */
+import { spawnSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { chmodSync, existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import envPaths from "env-paths";
+/** Pinned upstream token-killer release (https://github.com/rtk-ai/rtk). */
+export const RTK_MANAGED_VERSION = "0.43.0";
+const RTK_PROBE_TIMEOUT_MS = 3000;
+const RTK_CAPABILITY_ARGS = ["gain", "--help"];
+const BINARY_NAME = process.platform === "win32" ? "rtk.exe" : "rtk";
+let cachedExecutable;
+let cachedCapability;
+/** Test seam. */
+export function resetManagedRtkCacheForTests() {
+    cachedExecutable = undefined;
+    cachedCapability = undefined;
+}
+export function managedRtkAssetName(platform = process.platform, arch = process.arch) {
+    if (platform === "darwin" && arch === "arm64")
+        return "rtk-aarch64-apple-darwin.tar.gz";
+    if (platform === "darwin" && arch === "x64")
+        return "rtk-x86_64-apple-darwin.tar.gz";
+    if (platform === "linux" && arch === "arm64")
+        return "rtk-aarch64-unknown-linux-gnu.tar.gz";
+    if (platform === "linux" && arch === "x64")
+        return "rtk-x86_64-unknown-linux-musl.tar.gz";
+    if (platform === "win32" && arch === "x64")
+        return "rtk-x86_64-pc-windows-msvc.zip";
+    return null;
+}
+export function managedRtkDownloadUrl(version = RTK_MANAGED_VERSION) {
+    const asset = managedRtkAssetName();
+    if (!asset)
+        return null;
+    return `https://github.com/rtk-ai/rtk/releases/download/v${version}/${asset}`;
+}
+/** Cache dir: `envPaths("webpresso").cache/tools/rtk/<version>/`. */
+export function managedRtkInstallDir(version = RTK_MANAGED_VERSION) {
+    const cacheRoot = process.env.WP_RTK_CACHE_ROOT ?? envPaths("webpresso", { suffix: "" }).cache;
+    return join(cacheRoot, "tools", "rtk", version);
+}
+export function managedRtkExecutablePath(version = RTK_MANAGED_VERSION) {
+    return join(managedRtkInstallDir(version), BINARY_NAME);
+}
+/**
+ * Resolve the managed executable if present on disk (no network, no probe).
+ * Prefers explicit WP_RTK_BIN, then managed cache install.
+ */
+export function resolveManagedRtkExecutable() {
+    // Skip is process-env policy for this call — do not poison the path cache.
+    if (process.env.WP_SKIP_RTK === "1")
+        return null;
+    if (cachedExecutable !== undefined)
+        return cachedExecutable;
+    const override = process.env.WP_RTK_BIN?.trim();
+    if (override && existsSync(override)) {
+        cachedExecutable = override;
+        return cachedExecutable;
+    }
+    const managed = managedRtkExecutablePath();
+    if (existsSync(managed)) {
+        cachedExecutable = managed;
+        return cachedExecutable;
+    }
+    cachedExecutable = null;
+    return null;
+}
+/** Capability probe against a concrete binary (or managed path). Fail-open. */
+export function probeRtkCapabilityAt(executable) {
+    try {
+        const result = spawnSync(executable, [...RTK_CAPABILITY_ARGS], {
+            encoding: "utf8",
+            timeout: RTK_PROBE_TIMEOUT_MS,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return result.error == null && result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Process-cached: managed binary exists and passes capability probe. */
+export function isManagedRtkAvailable() {
+    if (cachedCapability !== undefined)
+        return cachedCapability;
+    if (process.env.WP_SKIP_RTK === "1") {
+        cachedCapability = false;
+        return false;
+    }
+    const path = resolveManagedRtkExecutable();
+    if (!path) {
+        cachedCapability = false;
+        return false;
+    }
+    cachedCapability = probeRtkCapabilityAt(path);
+    return cachedCapability;
+}
+function defaultDownloader(url, destFile) {
+    // Prefer curl when present (HTTP/2, redirects); fall back to node fetch via spawn node -e is avoided.
+    const curl = spawnSync("curl", ["-fsSL", "--retry", "2", "--retry-delay", "1", "-o", destFile, url], { encoding: "utf8", timeout: 120_000 });
+    if (curl.error || curl.status !== 0) {
+        throw new Error(`download failed (${curl.status ?? "error"}): ${String(curl.stderr ?? curl.error ?? "").trim() || url}`);
+    }
+}
+function isRegularFile(path) {
+    try {
+        return lstatSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+/** Prefer a real file named rtk / rtk.exe — ignore directories of the same name. */
+function findExtractedBinary(root) {
+    const stack = [root];
+    while (stack.length > 0) {
+        const dir = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            continue;
+        }
+        for (const name of entries) {
+            const full = join(dir, name);
+            if ((name === BINARY_NAME || name === "rtk") && isRegularFile(full)) {
+                return full;
+            }
+            try {
+                // shallow walk only one extra level for nested release layouts
+                const nested = readdirSync(full);
+                for (const child of nested) {
+                    const nestedFull = join(full, child);
+                    if ((child === BINARY_NAME || child === "rtk") && isRegularFile(nestedFull)) {
+                        return nestedFull;
+                    }
+                }
+            }
+            catch {
+                // not a dir
+            }
+        }
+    }
+    return null;
+}
+function extractArchive(archivePath, extractDir) {
+    mkdirSync(extractDir, { recursive: true });
+    if (archivePath.endsWith(".zip")) {
+        const unzip = spawnSync("unzip", ["-qo", archivePath, "-d", extractDir], {
+            encoding: "utf8",
+            timeout: 60_000,
+        });
+        if (unzip.status !== 0) {
+            throw new Error(`unzip failed: ${String(unzip.stderr ?? "").trim()}`);
+        }
+        return;
+    }
+    const tar = spawnSync("tar", ["-xzf", archivePath, "-C", extractDir], {
+        encoding: "utf8",
+        timeout: 60_000,
+    });
+    if (tar.status !== 0) {
+        throw new Error(`tar extract failed: ${String(tar.stderr ?? "").trim()}`);
+    }
+}
+/**
+ * Ensure the pinned managed rtk binary is on disk. Downloads once into the
+ * Webpresso cache. No brew/cargo. Idempotent.
+ */
+export function ensureManagedRtk(options = {}) {
+    if (process.env.WP_SKIP_RTK === "1") {
+        return { ok: false, error: "WP_SKIP_RTK=1" };
+    }
+    const version = options.version ?? RTK_MANAGED_VERSION;
+    const dest = managedRtkExecutablePath(version);
+    if (existsSync(dest) && probeRtkCapabilityAt(dest)) {
+        resetManagedRtkCacheForTests();
+        cachedExecutable = dest;
+        cachedCapability = true;
+        return { ok: true, path: dest, installed: false };
+    }
+    const url = managedRtkDownloadUrl(version);
+    if (!url) {
+        return {
+            ok: false,
+            error: `no managed rtk asset for ${process.platform}/${process.arch}`,
+        };
+    }
+    const installDir = managedRtkInstallDir(version);
+    mkdirSync(installDir, { recursive: true });
+    const work = mkdtempSync(join(tmpdir(), "wp-rtk-"));
+    try {
+        const archiveName = basename(url);
+        const archivePath = join(work, archiveName);
+        const download = options.downloader ?? defaultDownloader;
+        download(url, archivePath);
+        const extractDir = join(work, "extract");
+        extractArchive(archivePath, extractDir);
+        const found = findExtractedBinary(extractDir);
+        if (!found) {
+            return { ok: false, error: `archive did not contain ${BINARY_NAME}` };
+        }
+        mkdirSync(dirname(dest), { recursive: true });
+        // Stage under a unique name so concurrent setup never clobbers a live dest
+        // mid-probe, and we only delete our own staged file on failure.
+        const staged = join(installDir, `.rtk-staging-${process.pid}-${Date.now()}-${randomBytes(6).toString("hex")}`);
+        try {
+            try {
+                renameSync(found, staged);
+            }
+            catch {
+                const cp = spawnSync("cp", [found, staged], { encoding: "utf8" });
+                if (cp.status !== 0) {
+                    return { ok: false, error: `failed to stage managed rtk at ${staged}` };
+                }
+            }
+            if (process.platform !== "win32") {
+                chmodSync(staged, 0o755);
+            }
+            if (!probeRtkCapabilityAt(staged)) {
+                return { ok: false, error: "downloaded rtk failed capability probe (rtk gain --help)" };
+            }
+            try {
+                renameSync(staged, dest);
+            }
+            catch {
+                // Cross-device rename: replace dest via copy then drop stage.
+                const cp = spawnSync("cp", [staged, dest], { encoding: "utf8" });
+                if (cp.status !== 0) {
+                    return { ok: false, error: `failed to place managed rtk at ${dest}` };
+                }
+                if (process.platform !== "win32") {
+                    chmodSync(dest, 0o755);
+                }
+            }
+        }
+        finally {
+            try {
+                rmSync(staged, { force: true });
+            }
+            catch {
+                // ignore
+            }
+        }
+        resetManagedRtkCacheForTests();
+        cachedExecutable = dest;
+        cachedCapability = true;
+        return { ok: true, path: dest, installed: true };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { ok: false, error: message };
+    }
+    finally {
+        try {
+            rmSync(work, { recursive: true, force: true });
+        }
+        catch {
+            // ignore
+        }
+    }
+}
+/** Write a tiny marker file for diagnostics (optional). */
+export function writeManagedRtkVersionMarker(path, version) {
+    writeFileSync(`${path}.version`, `${version}\n`, "utf8");
+}