@wichayutdew/pi-workflows 1.0.0 → 1.0.1

package/README.md

@@ -398,6 +398,8 @@ Supported sources are:
 | `verification-worker`   | `repositories[].worker[].command`                                     |
 | `verification-reviewer` | `repositories[].reviewer[].command`                                   |
 | `remote-actions`        | `actions[]` where `toolName` is `bash` and `input.command` is present |
+| `remote-push`           | Exact approved non-force `git push` command                           |
+| `remote-drafts`         | Parent-synthesized author-private review drafts                       |
 
 The JSON must be the whole reviewed artifact or appear in a fenced `json`
 block. The harness copies only exact strings into the correlated step policy.

package/dist/index.js

@@ -29,7 +29,8 @@ function bashWithinCeiling(requested, ceiling) {
     return false;
   const allowedRules = new Set(ceiling.allow.map(ruleKey));
   const allowedSources = new Set(ceiling.approvedSources ?? []);
-  return requested.allow.every((rule) => allowedRules.has(ruleKey(rule))) && (requested.approvedSources ?? []).every((source) => allowedSources.has(source));
+  const allowedHandoffSources = new Set(ceiling.handoffSources ?? []);
+  return requested.allow.every((rule) => allowedRules.has(ruleKey(rule))) && (requested.approvedSources ?? []).every((source) => allowedSources.has(source)) && (requested.handoffSources ?? []).every((source) => allowedHandoffSources.has(source));
 }
 function turnBudgetErrors(subagent, ceiling, path) {
   if (!subagent.turnBudget) {
@@ -135,6 +136,8 @@ var PROMPT_VARIABLES = new Set([
   "step.id",
   "step.title",
   "last.summary",
+  "reviewed.artifact",
+  "reviewed.feedback",
   "gate.feedback"
 ]);
 function validatePromptText(text, path) {
@@ -150,7 +153,7 @@ var TOOL_PATTERN = /^[A-Za-z0-9_.:-]+$/;
 var RESOURCE_SELECTOR_PATTERN = /^[A-Za-z0-9_@./:+-]+$/;
 var MCP_SELECTOR_PATTERN = /^[A-Za-z0-9_.:-]+(?:\/[A-Za-z0-9_.:-]+)?$/;
 var EXECUTABLE_PATTERN = /^[A-Za-z0-9_./+-]+$/;
-var BASH_APPROVAL_SOURCE_PATTERN = /^(verification-worker|verification-reviewer|remote-actions)$/;
+var BASH_APPROVAL_SOURCE_PATTERN = /^(verification-worker|verification-reviewer|remote-actions|remote-push|remote-drafts)$/;
 function isJsonObject(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -215,7 +218,9 @@ function readStringList(value, path, errors, pattern) {
 var BASH_APPROVAL_SOURCES = [
   "verification-worker",
   "verification-reviewer",
-  "remote-actions"
+  "remote-actions",
+  "remote-push",
+  "remote-drafts"
 ];
 function isBashApprovalSource(value) {
   return BASH_APPROVAL_SOURCES.some((source) => source === value);
@@ -282,7 +287,7 @@ function parseBashPermission(value, path, errors) {
     errors.push(`${path}: expected an object`);
     return { ...EMPTY_PERMISSIONS.bash, allow: [] };
   }
-  rejectUnknownKeys(value, ["mode", "allow", "approvedSources"], path, errors);
+  rejectUnknownKeys(value, ["mode", "allow", "approvedSources", "handoffSources"], path, errors);
   const mode = readString(value.mode, `${path}.mode`, errors);
   const isValidMode = mode === "deny" || mode === "read-only" || mode === "allow-list" || mode === "unrestricted";
   if (!isValidMode) {
@@ -293,6 +298,7 @@ function parseBashPermission(value, path, errors) {
     errors.push(`${path}.allow: expected an array`);
   }
   const approvedSources = (value.approvedSources === undefined ? [] : readStringList(value.approvedSources, `${path}.approvedSources`, errors, BASH_APPROVAL_SOURCE_PATTERN)).filter(isBashApprovalSource);
+  const handoffSources = value.handoffSources === undefined ? [] : readStringList(value.handoffSources, `${path}.handoffSources`, errors, /^(verification-worker|verification-reviewer)$/);
   const normalizedMode = isValidMode ? mode : "deny";
   if (normalizedMode !== "allow-list" && allow.length > 0) {
     errors.push(`${path}.allow: only valid when mode is "allow-list"`);
@@ -303,10 +309,14 @@ function parseBashPermission(value, path, errors) {
   if (normalizedMode !== "allow-list" && approvedSources.length > 0) {
     errors.push(`${path}.approvedSources: only valid when mode is "allow-list"`);
   }
+  if (normalizedMode !== "allow-list" && handoffSources.length > 0) {
+    errors.push(`${path}.handoffSources: only valid when mode is "allow-list"`);
+  }
   return {
     mode: normalizedMode,
     allow,
-    ...approvedSources.length > 0 ? { approvedSources } : {}
+    ...approvedSources.length > 0 ? { approvedSources } : {},
+    ...handoffSources.length > 0 ? { handoffSources } : {}
   };
 }
 function parsePermissions(value, path, errors) {
@@ -2212,9 +2222,10 @@ var isStepPermissions = (value) => {
   const bashRules = Array.isArray(bash.allow) ? bash.allow : undefined;
   const isValidMode = bash.mode === "deny" || bash.mode === "read-only" || bash.mode === "allow-list" || bash.mode === "unrestricted";
   const hasValidRules = bashRules !== undefined && bashRules.every((rule) => isRecord(rule) && typeof rule.executable === "string" && isStringArray(rule.argsPrefix));
-  const hasValidApprovedSources = bash.approvedSources === undefined || isStringArray(bash.approvedSources) && new Set(bash.approvedSources).size === bash.approvedSources.length && bash.approvedSources.every((source) => source === "verification-worker" || source === "verification-reviewer" || source === "remote-actions");
+  const hasValidApprovedSources = bash.approvedSources === undefined || isStringArray(bash.approvedSources) && new Set(bash.approvedSources).size === bash.approvedSources.length && bash.approvedSources.every((source) => source === "verification-worker" || source === "verification-reviewer" || source === "remote-actions" || source === "remote-push" || source === "remote-drafts");
+  const hasValidHandoffSources = bash.handoffSources === undefined || isStringArray(bash.handoffSources) && new Set(bash.handoffSources).size === bash.handoffSources.length && bash.handoffSources.every((source) => source === "verification-worker" || source === "verification-reviewer");
   const hasValidApprovalShape = bash.mode === "allow-list" ? (bashRules?.length ?? 0) > 0 || Array.isArray(bash.approvedSources) && bash.approvedSources.length > 0 : bash.approvedSources === undefined;
-  return isStringArray(value.tools) && isStringArray(value.mcp) && isStringArray(value.extensions) && isStringArray(value.skills) && isValidMode && hasValidRules && hasValidApprovedSources && hasValidApprovalShape;
+  return isStringArray(value.tools) && isStringArray(value.mcp) && isStringArray(value.extensions) && isStringArray(value.skills) && isValidMode && hasValidRules && hasValidApprovedSources && hasValidHandoffSources && hasValidApprovalShape;
 };
 var parsePermissions2 = (value) => {
   if (!isStepPermissions(value.permissions)) {
@@ -4238,6 +4249,7 @@ var createRun = (workflow, input, baselineTools, runId, now) => {
     startedAt: now,
     updatedAt: now,
     reviewedArtifact: "",
+    reviewedFeedback: "",
     stepHandoff: "",
     lastSummary: "",
     gateFeedback: ""
@@ -4260,7 +4272,7 @@ var isWorkflowRun = (value) => {
   const hasValidRequiredFields = value.stateVersion === RUN_STATE_VERSION && typeof value.runId === "string" && typeof value.workflowId === "string" && typeof value.workflowDigest === "string" && typeof value.input === "string" && isWorkflowRunStatus(value.status) && typeof value.currentStepId === "string" && typeof value.currentStepDigest === "string" && Array.isArray(value.baselineTools) && value.baselineTools.every((tool) => typeof tool === "string") && Array.isArray(value.history) && value.history.every(isStepHistoryEntry) && isVisitCounts(value.visits) && typeof value.startedAt === "number" && typeof value.updatedAt === "number" && typeof value.lastSummary === "string" && typeof value.gateFeedback === "string";
   if (!hasValidRequiredFields)
     return false;
-  const hasValidOptionalFields = isOptionalString(value.reviewedArtifact) && isOptionalString(value.stepHandoff) && isOptionalString(value.pauseReason) && isOptionalString(value.failedStepId) && (value.pausedFrom === undefined || value.pausedFrom === "running" || value.pausedFrom === "awaiting-gate");
+  const hasValidOptionalFields = isOptionalString(value.reviewedArtifact) && isOptionalString(value.reviewedFeedback) && isOptionalString(value.stepHandoff) && isOptionalString(value.pauseReason) && isOptionalString(value.failedStepId) && (value.pausedFrom === undefined || value.pausedFrom === "running" || value.pausedFrom === "awaiting-gate");
   if (!hasValidOptionalFields)
     return false;
   const pendingGate = value.pendingGate;
@@ -4426,7 +4438,7 @@ var advanceRun = (workflow, run, outcome, summary, now) => {
     stepHandoff: summary,
     lastSummary: summary,
     gateFeedback: "",
-    ...nextStep.gate ? { reviewedArtifact: "" } : {}
+    ...nextStep.gate ? { reviewedArtifact: "", reviewedFeedback: "" } : {}
   }, now);
 };
 
@@ -4489,7 +4501,10 @@ var resolveGate = (workflow, run, resolution, now) => {
   const runnableRun = withRunUpdate(run, {
     status: "running",
     pendingGate: undefined,
-    ...resolution.approved ? { reviewedArtifact: pendingGate.artifact } : {},
+    ...resolution.approved ? {
+      reviewedArtifact: pendingGate.artifact,
+      reviewedFeedback: resolution.feedback
+    } : {},
     pausedFrom: undefined,
     pauseReason: undefined,
     gateFeedback: resolution.feedback
@@ -5029,6 +5044,8 @@ function createTemplateValues({
     "step.id": run.currentStepId,
     "step.title": step.title,
     "last.summary": currentStepHandoff(run),
+    "reviewed.artifact": run.reviewedArtifact ?? "",
+    "reviewed.feedback": run.reviewedFeedback ?? "",
     "gate.feedback": run.gateFeedback
   };
 }

package/examples/mr-comments.workflow.yaml

@@ -85,6 +85,7 @@ steps:
       skills: [superpowers:test-driven-development]
     transitions:
       ready: verify
+      retry: implement
       blocked: $pause
   verify:
     title: Verify the result
@@ -112,4 +113,5 @@ steps:
     transitions:
       passed: $done
       failed: implement
+      retry: verify
       blocked: $pause

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wichayutdew/pi-workflows",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "A declarative, pauseable workflow harness for Pi",
   "license": "MIT",
   "repository": {

package/schemas/workflow.schema.json

@@ -223,9 +223,18 @@
             "enum": [
               "verification-worker",
               "verification-reviewer",
-              "remote-actions"
+              "remote-actions",
+              "remote-push",
+              "remote-drafts"
             ]
           }
+        },
+        "handoffSources": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "enum": ["verification-worker", "verification-reviewer"]
+          }
         }
       }
     },

package/src/config/ceiling.ts

@@ -33,10 +33,14 @@ function bashWithinCeiling(
 
   const allowedRules = new Set(ceiling.allow.map(ruleKey));
   const allowedSources = new Set(ceiling.approvedSources ?? []);
+  const allowedHandoffSources = new Set(ceiling.handoffSources ?? []);
   return (
     requested.allow.every((rule) => allowedRules.has(ruleKey(rule))) &&
     (requested.approvedSources ?? []).every((source) =>
       allowedSources.has(source),
+    ) &&
+    (requested.handoffSources ?? []).every((source) =>
+      allowedHandoffSources.has(source),
     )
   );
 }

package/src/config/types.ts

@@ -11,7 +11,11 @@ export type StepTarget = string;
 
 export type BashMode = 'deny' | 'read-only' | 'allow-list' | 'unrestricted';
 export type BashApprovalSource =
-  'verification-worker' | 'verification-reviewer' | 'remote-actions';
+  | 'verification-worker'
+  | 'verification-reviewer'
+  | 'remote-actions'
+  | 'remote-push'
+  | 'remote-drafts';
 
 export type BashRule = {
   readonly executable: string;
@@ -26,6 +30,13 @@ export type BashPermission = {
    * They supplement `allow` only inside the correlated step execution.
    */
   readonly approvedSources?: ReadonlyArray<BashApprovalSource>;
+  /**
+   * Sources whose command-only retry handoffs may refine an already approved
+   * command. The original reviewed identity and safety envelope remain fixed.
+   */
+  readonly handoffSources?: ReadonlyArray<
+    'verification-worker' | 'verification-reviewer'
+  >;
 };
 
 export type StepPermissions = {

package/src/config/validation/permissions.ts

@@ -24,6 +24,8 @@ const BASH_APPROVAL_SOURCES = [
   'verification-worker',
   'verification-reviewer',
   'remote-actions',
+  'remote-push',
+  'remote-drafts',
 ] as const satisfies ReadonlyArray<BashApprovalSource>;
 
 function isBashApprovalSource(value: string): value is BashApprovalSource {
@@ -129,7 +131,12 @@ function parseBashPermission(
     errors.push(`${path}: expected an object`);
     return { ...EMPTY_PERMISSIONS.bash, allow: [] };
   }
-  rejectUnknownKeys(value, ['mode', 'allow', 'approvedSources'], path, errors);
+  rejectUnknownKeys(
+    value,
+    ['mode', 'allow', 'approvedSources', 'handoffSources'],
+    path,
+    errors,
+  );
 
   const mode = readString(value.mode, `${path}.mode`, errors);
   const isValidMode =
@@ -162,6 +169,16 @@ function parseBashPermission(
           BASH_APPROVAL_SOURCE_PATTERN,
         )
   ).filter(isBashApprovalSource);
+  const handoffSources = (
+    value.handoffSources === undefined
+      ? []
+      : readStringList(
+          value.handoffSources,
+          `${path}.handoffSources`,
+          errors,
+          /^(verification-worker|verification-reviewer)$/,
+        )
+  ) as Array<'verification-worker' | 'verification-reviewer'>;
 
   const normalizedMode: BashMode = isValidMode ? mode : 'deny';
   if (normalizedMode !== 'allow-list' && allow.length > 0) {
@@ -181,11 +198,15 @@ function parseBashPermission(
       `${path}.approvedSources: only valid when mode is "allow-list"`,
     );
   }
+  if (normalizedMode !== 'allow-list' && handoffSources.length > 0) {
+    errors.push(`${path}.handoffSources: only valid when mode is "allow-list"`);
+  }
 
   return {
     mode: normalizedMode,
     allow,
     ...(approvedSources.length > 0 ? { approvedSources } : {}),
+    ...(handoffSources.length > 0 ? { handoffSources } : {}),
   };
 }
 

package/src/config/validation/prompt.ts

@@ -5,6 +5,8 @@ const PROMPT_VARIABLES = new Set([
   'step.id',
   'step.title',
   'last.summary',
+  'reviewed.artifact',
+  'reviewed.feedback',
   'gate.feedback',
 ]);
 

package/src/config/validation/shared.ts

@@ -13,7 +13,7 @@ export const RESOURCE_SELECTOR_PATTERN = /^[A-Za-z0-9_@./:+-]+$/;
 export const MCP_SELECTOR_PATTERN = /^[A-Za-z0-9_.:-]+(?:\/[A-Za-z0-9_.:-]+)?$/;
 export const EXECUTABLE_PATTERN = /^[A-Za-z0-9_./+-]+$/;
 export const BASH_APPROVAL_SOURCE_PATTERN =
-  /^(verification-worker|verification-reviewer|remote-actions)$/;
+  /^(verification-worker|verification-reviewer|remote-actions|remote-push|remote-drafts)$/;
 
 type StringOptions = {
   readonly pattern?: RegExp;

package/src/engine/create-run.ts

@@ -35,6 +35,7 @@ export const createRun = (
     startedAt: now,
     updatedAt: now,
     reviewedArtifact: '',
+    reviewedFeedback: '',
     stepHandoff: '',
     lastSummary: '',
     gateFeedback: '',

package/src/engine/gate-transitions.ts

@@ -169,7 +169,10 @@ export const resolveGate = (
       status: 'running',
       pendingGate: undefined,
       ...(resolution.approved
-        ? { reviewedArtifact: pendingGate.artifact }
+        ? {
+            reviewedArtifact: pendingGate.artifact,
+            reviewedFeedback: resolution.feedback,
+          }
         : {}),
       pausedFrom: undefined,
       pauseReason: undefined,

package/src/engine/run-advance.ts

@@ -115,7 +115,7 @@ export const advanceRun = (
       stepHandoff: summary,
       lastSummary: summary,
       gateFeedback: '',
-      ...(nextStep.gate ? { reviewedArtifact: '' } : {}),
+      ...(nextStep.gate ? { reviewedArtifact: '', reviewedFeedback: '' } : {}),
     },
     now,
   );

package/src/engine/run-validation.ts

@@ -109,6 +109,7 @@ export const isWorkflowRun = (value: unknown): value is WorkflowRun => {
 
   const hasValidOptionalFields =
     isOptionalString(value.reviewedArtifact) &&
+    isOptionalString(value.reviewedFeedback) &&
     isOptionalString(value.stepHandoff) &&
     isOptionalString(value.pauseReason) &&
     isOptionalString(value.failedStepId) &&

package/src/engine/state-types.ts

@@ -49,6 +49,8 @@ export type WorkflowRun = {
    * source from which reviewed Bash capabilities may be derived.
    */
   readonly reviewedArtifact?: string | undefined;
+  /** Final feedback paired with the immutable approved artifact. */
+  readonly reviewedFeedback?: string | undefined;
   /**
    * Input inherited from the previous completed step. Unlike `lastSummary`,
    * this survives a paused attempt of the current step.

package/src/integrations/subagents/child-policy-sections.ts

@@ -46,7 +46,18 @@ const isStepPermissions = (value: unknown): value is StepPermissions => {
         (source) =>
           source === 'verification-worker' ||
           source === 'verification-reviewer' ||
-          source === 'remote-actions',
+          source === 'remote-actions' ||
+          source === 'remote-push' ||
+          source === 'remote-drafts',
+      ));
+  const hasValidHandoffSources =
+    bash.handoffSources === undefined ||
+    (isStringArray(bash.handoffSources) &&
+      new Set(bash.handoffSources).size === bash.handoffSources.length &&
+      bash.handoffSources.every(
+        (source) =>
+          source === 'verification-worker' ||
+          source === 'verification-reviewer',
       ));
   const hasValidApprovalShape =
     bash.mode === 'allow-list'
@@ -62,6 +73,7 @@ const isStepPermissions = (value: unknown): value is StepPermissions => {
     isValidMode &&
     hasValidRules &&
     hasValidApprovedSources &&
+    hasValidHandoffSources &&
     hasValidApprovalShape
   );
 };

package/src/prompt/template.ts

@@ -76,6 +76,8 @@ export function createTemplateValues({
     'step.id': run.currentStepId,
     'step.title': step.title,
     'last.summary': currentStepHandoff(run),
+    'reviewed.artifact': run.reviewedArtifact ?? '',
+    'reviewed.feedback': run.reviewedFeedback ?? '',
     'gate.feedback': run.gateFeedback,
   };
 }