@wichayutdew/pi-workflows 1.0.0 → 2.0.0

package/src/workflow-status/view.ts

@@ -15,8 +15,17 @@ import {
 } from './formatting.ts';
 import { padAnsi } from './layout.ts';
 import { renderBoard, renderEmptyBoard } from './render-board.ts';
+import { buildPathEntries } from './render-path.ts';
+import {
+  renderStepDetail,
+  selectedStepDetail,
+  stepTranscriptCacheKey,
+  type StepTranscriptViewState,
+} from './render-step-detail.ts';
+import { readStepTranscript } from './transcript-reader.ts';
 import type {
   SnapshotProvider,
+  StepTranscriptLoader,
   StatusViewTui,
   WorkflowStatusTheme,
 } from './types.ts';
@@ -31,10 +40,13 @@ export type WorkflowStatusViewDependencies = {
     intervalMilliseconds: number,
   ) => RefreshTimer;
   readonly cancelRefresh: (timer: RefreshTimer) => void;
+  readonly loadStepTranscript: StepTranscriptLoader;
 };
 
 type ViewportState = {
   readonly isClosed: boolean;
+  readonly mode: 'board' | 'detail';
+  readonly selectedIndex: number;
   readonly scrollOffset: number;
   readonly viewportRows: number;
   readonly contentRows: number;
@@ -51,11 +63,20 @@ const DEFAULT_VIEW_DEPENDENCIES = {
   cancelRefresh: (timer) => {
     clearInterval(timer);
   },
+  loadStepTranscript: async (attempt) =>
+    attempt.transcript
+      ? readStepTranscript(attempt.transcript)
+      : {
+          status: 'unavailable',
+          reason: 'No trusted child transcript reference was recorded.',
+        },
 } as const satisfies WorkflowStatusViewDependencies;
 
 function initialViewportState(): ViewportState {
   return {
     isClosed: false,
+    mode: 'board',
+    selectedIndex: -1,
     scrollOffset: 0,
     viewportRows: 0,
     contentRows: 0,
@@ -69,6 +90,7 @@ function paginateBoard(
   terminalRows: number | undefined,
   statusShortcutLabel: string,
   theme: WorkflowStatusTheme,
+  controls: string,
 ): PaginatedBoard {
   const maximumRows =
     terminalRows === undefined
@@ -82,8 +104,8 @@ function paginateBoard(
   const last = Math.min(lines.length, scrollOffset + contentHeight);
   const hint =
     maximumOffset > 0
-      ? `↑/↓ PgUp/PgDn Home/End · rows ${first}-${last}/${lines.length} · ${statusShortcutLabel} / q / Esc hide`
-      : `${statusShortcutLabel} / q / Esc hide · live refresh`;
+      ? `${controls} · rows ${first}-${last}/${lines.length} · ${statusShortcutLabel} / q hide`
+      : `${controls} · ${statusShortcutLabel} / q hide · live refresh`;
   return {
     state: {
       ...state,
@@ -114,6 +136,8 @@ export class WorkflowStatusView implements Component {
   private timer: RefreshTimer | undefined;
   private state = initialViewportState();
   private readonly statusShortcutLabel: string;
+  private readonly dependencies: WorkflowStatusViewDependencies;
+  private readonly transcriptCache = new Map<string, StepTranscriptViewState>();
 
   /**
    * Creates the stateful adapter around the pure status renderer.
@@ -131,9 +155,10 @@ export class WorkflowStatusView implements Component {
     private readonly theme: WorkflowStatusTheme,
     private readonly done: () => void,
     private readonly statusShortcut: KeyId = DEFAULT_STATUS_SHORTCUT,
-    private readonly dependencies: WorkflowStatusViewDependencies = DEFAULT_VIEW_DEPENDENCIES,
+    dependencies: Partial<WorkflowStatusViewDependencies> = {},
   ) {
     this.statusShortcutLabel = formatShortcutLabel(statusShortcut);
+    this.dependencies = { ...DEFAULT_VIEW_DEPENDENCIES, ...dependencies };
   }
 
   /** Start periodic live-refresh requests. */
@@ -158,7 +183,6 @@ export class WorkflowStatusView implements Component {
     if (
       data === 'q' ||
       data === 'Q' ||
-      matchesKey(data, 'escape') ||
       matchesKey(data, 'ctrl+c') ||
       matchesKey(data, 'ctrl+d') ||
       matchesKey(data, this.statusShortcut)
@@ -166,11 +190,43 @@ export class WorkflowStatusView implements Component {
       this.close();
       return;
     }
+    if (matchesKey(data, 'escape')) {
+      if (this.state.mode === 'detail') {
+        this.showBoard();
+      } else {
+        this.close();
+      }
+      return;
+    }
     const pageSize = Math.max(1, this.state.viewportRows - 2);
+    if (this.state.mode === 'detail') {
+      if (matchesKey(data, Key.left) || data === 'h') {
+        this.showBoard();
+      } else if (matchesKey(data, Key.down) || data === 'j') {
+        this.setScrollOffset(this.state.scrollOffset + 1);
+      } else if (matchesKey(data, Key.up) || data === 'k') {
+        this.setScrollOffset(this.state.scrollOffset - 1);
+      } else if (matchesKey(data, Key.pageDown)) {
+        this.setScrollOffset(this.state.scrollOffset + pageSize);
+      } else if (matchesKey(data, Key.pageUp)) {
+        this.setScrollOffset(this.state.scrollOffset - pageSize);
+      } else if (matchesKey(data, Key.home)) {
+        this.setScrollOffset(0);
+      } else if (matchesKey(data, Key.end)) {
+        this.setScrollOffset(Number.MAX_SAFE_INTEGER);
+      }
+      return;
+    }
     if (matchesKey(data, Key.down) || data === 'j') {
-      this.setScrollOffset(this.state.scrollOffset + 1);
+      this.moveSelection(1);
     } else if (matchesKey(data, Key.up) || data === 'k') {
-      this.setScrollOffset(this.state.scrollOffset - 1);
+      this.moveSelection(-1);
+    } else if (
+      matchesKey(data, Key.enter) ||
+      matchesKey(data, Key.right) ||
+      data === 'l'
+    ) {
+      this.openDetail();
     } else if (matchesKey(data, Key.pageDown)) {
       this.setScrollOffset(this.state.scrollOffset + pageSize);
     } else if (matchesKey(data, Key.pageUp)) {
@@ -198,15 +254,28 @@ export class WorkflowStatusView implements Component {
     }
 
     const contentWidth = viewportWidth - 2;
+    if (snapshot) this.normalizeSelection(snapshot);
     const lines = snapshot
-      ? renderBoard(
-          this.theme,
-          snapshot,
-          contentWidth,
-          false,
-          this.statusShortcutLabel,
-        )
+      ? this.state.mode === 'detail'
+        ? renderStepDetail(
+            this.theme,
+            snapshot,
+            this.state.selectedIndex,
+            this.transcriptCache,
+            contentWidth,
+          )
+        : renderBoard(
+            this.theme,
+            snapshot,
+            contentWidth,
+            false,
+            this.statusShortcutLabel,
+            this.state.selectedIndex,
+          )
       : renderEmptyBoard(this.theme, contentWidth);
+    if (snapshot && this.state.mode === 'detail') {
+      this.ensureSelectedTranscripts(snapshot);
+    }
     const rendered = lines.map((line) =>
       padAnsi(truncateToWidth(line, contentWidth, '…'), viewportWidth),
     );
@@ -217,6 +286,9 @@ export class WorkflowStatusView implements Component {
       this.tui.terminal?.rows,
       this.statusShortcutLabel,
       this.theme,
+      this.state.mode === 'detail'
+        ? '↑/↓ or j/k scroll · PgUp/PgDn · ←/h/Esc back'
+        : '↑/↓ or j/k select · Enter/→/l inspect · PgUp/PgDn',
     );
     this.state = page.state;
     return page.lines;
@@ -229,6 +301,81 @@ export class WorkflowStatusView implements Component {
     this.tui.requestRender(true);
   }
 
+  private normalizeSelection(
+    snapshot: NonNullable<ReturnType<SnapshotProvider>>,
+  ): void {
+    const entries = buildPathEntries(snapshot);
+    const selectedIndex =
+      entries.length === 0
+        ? -1
+        : this.state.selectedIndex < 0
+          ? entries.length - 1
+          : Math.min(this.state.selectedIndex, entries.length - 1);
+    if (selectedIndex !== this.state.selectedIndex) {
+      this.state = { ...this.state, selectedIndex };
+    }
+    if (entries.length === 0 && this.state.mode === 'detail') {
+      this.state = { ...this.state, mode: 'board', scrollOffset: 0 };
+    }
+  }
+
+  private moveSelection(delta: number): void {
+    const snapshot = this.getSnapshot();
+    if (!snapshot) return;
+    this.normalizeSelection(snapshot);
+    const entries = buildPathEntries(snapshot);
+    if (entries.length === 0) return;
+    const selectedIndex = Math.max(
+      0,
+      Math.min(this.state.selectedIndex + delta, entries.length - 1),
+    );
+    if (selectedIndex === this.state.selectedIndex) return;
+    this.state = { ...this.state, selectedIndex };
+    this.tui.requestRender(true);
+  }
+
+  private openDetail(): void {
+    const snapshot = this.getSnapshot();
+    if (!snapshot) return;
+    this.normalizeSelection(snapshot);
+    if (!selectedStepDetail(snapshot, this.state.selectedIndex)) return;
+    this.state = { ...this.state, mode: 'detail', scrollOffset: 0 };
+    this.ensureSelectedTranscripts(snapshot);
+    this.tui.requestRender(true);
+  }
+
+  private showBoard(): void {
+    if (this.state.mode === 'board') return;
+    this.state = { ...this.state, mode: 'board', scrollOffset: 0 };
+    this.tui.requestRender(true);
+  }
+
+  private ensureSelectedTranscripts(
+    snapshot: NonNullable<ReturnType<SnapshotProvider>>,
+  ): void {
+    const detail = selectedStepDetail(snapshot, this.state.selectedIndex);
+    if (!detail) return;
+    for (const attempt of detail.attempts) {
+      if (attempt.kind !== 'subagent' || !attempt.transcript) continue;
+      const key = stepTranscriptCacheKey(snapshot.run.runId, attempt);
+      if (this.transcriptCache.has(key)) continue;
+      this.transcriptCache.set(key, { status: 'loading' });
+      void this.dependencies.loadStepTranscript(attempt).then(
+        (result) => {
+          this.transcriptCache.set(key, result);
+          if (!this.state.isClosed) this.tui.requestRender(true);
+        },
+        () => {
+          this.transcriptCache.set(key, {
+            status: 'unavailable',
+            reason: 'The child transcript could not be loaded safely.',
+          });
+          if (!this.state.isClosed) this.tui.requestRender(true);
+        },
+      );
+    }
+  }
+
   private close(): void {
     if (this.state.isClosed) return;
     this.state = { ...this.state, isClosed: true };
@@ -243,7 +390,7 @@ export async function showWorkflowStatus(
   ctx: ExtensionContext,
   getSnapshot: SnapshotProvider,
   statusShortcut: KeyId = DEFAULT_STATUS_SHORTCUT,
-  dependencies: WorkflowStatusViewDependencies = DEFAULT_VIEW_DEPENDENCIES,
+  dependencies: Partial<WorkflowStatusViewDependencies> = {},
 ): Promise<void> {
   await ctx.ui.custom<undefined>(
     (tui, theme, _keybindings, done) => {

package/src/workflow-status.ts

@@ -1,4 +1,5 @@
 export {
+  formatWorkflowProgressStatus,
   formatWorkflowStatusBoard,
   formatWorkflowStatusText,
 } from './workflow-status/format-status.ts';
@@ -14,7 +15,12 @@ export {
 export type {
   SnapshotProvider,
   StatusViewTui,
+  StepTranscriptLoader,
   WorkflowStatusExecution,
   WorkflowStatusSnapshot,
   WorkflowStatusTheme,
 } from './workflow-status/types.ts';
+export {
+  readStepTranscript,
+  type StepTranscriptLog,
+} from './workflow-status/transcript-reader.ts';

package/src/policy/approved-command-extraction.ts

@@ -1,71 +0,0 @@
-import type { BashApprovalSource } from '../config/types.ts';
-import {
-  parseJsonDocuments,
-  remoteActionCommands,
-  verificationCommands,
-} from './reviewed-artifact.ts';
-import {
-  isSafeRemoteActionCommand,
-  isSafeVerificationCommand,
-} from './reviewed-command-safety.ts';
-
-const commandsFromSource = (
-  document: unknown,
-  source: BashApprovalSource,
-): Array<string> => {
-  if (source === 'verification-worker') {
-    return verificationCommands(document, 'worker').filter(
-      isSafeVerificationCommand,
-    );
-  }
-  if (source === 'verification-reviewer') {
-    return verificationCommands(document, 'reviewer').filter(
-      isSafeVerificationCommand,
-    );
-  }
-  return remoteActionCommands(document).filter(isSafeRemoteActionCommand);
-};
-
-/**
- * Extracts exact Bash capabilities from human-approved, machine-readable JSON.
- *
- * @param artifact - Artifact displayed by the review gate.
- * @param sources - Approved artifact sections to inspect.
- * @returns Unique safe commands in source order.
- */
-export const extractApprovedBashCommands = (
-  artifact: string,
-  sources: ReadonlyArray<BashApprovalSource>,
-): Array<string> => {
-  if (!artifact.trim() || sources.length === 0) return [];
-
-  const commands = parseJsonDocuments(artifact).flatMap((document) =>
-    sources.flatMap((source) => commandsFromSource(document, source)),
-  );
-  return [...new Set(commands)];
-};
-
-/**
- * Narrows reviewed commands to those retained by the latest step handoff.
- *
- * A child can remove reviewed authority, but its unreviewed output can never
- * introduce a new Bash capability.
- *
- * @param artifact - Original human-approved artifact.
- * @param handoff - Latest completed-step handoff.
- * @param sources - Approved artifact sections to inspect.
- * @returns Commands present in both artifacts.
- */
-export const narrowApprovedBashCommands = (
-  artifact: string,
-  handoff: string,
-  sources: ReadonlyArray<BashApprovalSource>,
-): Array<string> => {
-  const approvedCommands = extractApprovedBashCommands(artifact, sources);
-  if (approvedCommands.length === 0) return [];
-
-  const retainedCommands = new Set(
-    extractApprovedBashCommands(handoff, sources),
-  );
-  return approvedCommands.filter((command) => retainedCommands.has(command));
-};

package/src/policy/approved-commands.ts

@@ -1,15 +0,0 @@
-export {
-  extractApprovedBashCommands,
-  narrowApprovedBashCommands,
-} from './approved-command-extraction.ts';
-export { reviewedCommandShapeError } from './reviewed-command-shape.ts';
-export {
-  createReviewedRepositoryCwdResolver,
-  resolveReviewedRepositoryCwd,
-} from './reviewed-repository-cwd.ts';
-export type {
-  DirectoryState,
-  ResolveReviewedRepositoryCwd,
-  ReviewedRepositoryCwdDependencies,
-  ReviewedRepositoryCwdResolution,
-} from './reviewed-repository-cwd.ts';

package/src/policy/bash-read-only.ts

@@ -1,161 +0,0 @@
-import { basename } from 'node:path';
-import type { BashAuthorization } from './bash-types.ts';
-import { parseRestrictedGitCommand } from './restricted-git.ts';
-
-const READ_ONLY_EXECUTABLES: ReadonlySet<string> = new Set([
-  'grep',
-  'head',
-  'ls',
-  'pwd',
-  'rg',
-  'stat',
-  'tail',
-  'wc',
-]);
-const READ_ONLY_GIT_SUBCOMMANDS: ReadonlySet<string> = new Set([
-  'diff',
-  'grep',
-  'log',
-  'ls-files',
-  'rev-parse',
-  'show',
-  'status',
-]);
-const DANGEROUS_GIT_OPTIONS = [
-  '--config-env',
-  '--exec',
-  '--ext-diff',
-  '--open-files-in-pager',
-  '--output',
-  '--textconv',
-] as const;
-const DANGEROUS_GIT_SHORT_OPTIONS = [
-  // `git grep -O<pager>` executes the supplied pager command.
-  { subcommand: 'grep', option: '-O' },
-] as const;
-const HOSTED_API_MUTATION_OPTIONS = [
-  '--field',
-  '--form',
-  '--input',
-  '--method',
-  '--raw-field',
-  '-F',
-  '-X',
-  '-f',
-] as const;
-
-const reject = (reason: string): BashAuthorization => ({
-  allowed: false,
-  reason,
-});
-
-const allow = (tokens: ReadonlyArray<string>): BashAuthorization => ({
-  allowed: true,
-  tokens: [...tokens],
-});
-
-const hasOption = (tokens: ReadonlyArray<string>, option: string): boolean =>
-  tokens.some((token) => token === option || token.startsWith(`${option}=`));
-
-/**
- * Authorizes a tokenized command against the static read-only Bash preset.
- *
- * @param tokens - Restricted command tokens.
- * @returns The authorization decision.
- */
-export const authorizeReadOnlyBash = (
-  tokens: ReadonlyArray<string>,
-): BashAuthorization => {
-  const executable = tokens[0] ?? '';
-  if (READ_ONLY_EXECUTABLES.has(executable)) {
-    const hasRipgrepPreprocessor =
-      executable === 'rg' &&
-      (hasOption(tokens, '--pre') || hasOption(tokens, '--pre-glob'));
-    return hasRipgrepPreprocessor
-      ? reject('rg preprocessors are not allowed in read-only mode')
-      : allow(tokens);
-  }
-
-  if (executable !== 'git') {
-    return reject(`"${executable}" is not in the read-only Bash preset`);
-  }
-
-  const gitCommand = parseRestrictedGitCommand(tokens);
-  if (!gitCommand || !READ_ONLY_GIT_SUBCOMMANDS.has(gitCommand.subcommand)) {
-    return reject(
-      `git subcommand "${gitCommand?.subcommand ?? ''}" is not read-only`,
-    );
-  }
-
-  const dangerousOption = DANGEROUS_GIT_OPTIONS.find((option) =>
-    hasOption(tokens, option),
-  );
-  if (dangerousOption) {
-    return reject(
-      `git option "${dangerousOption}" is not allowed in read-only mode`,
-    );
-  }
-
-  const dangerousShortOption = DANGEROUS_GIT_SHORT_OPTIONS.find(
-    ({ subcommand, option }) =>
-      gitCommand.subcommand === subcommand &&
-      tokens
-        .slice(gitCommand.subcommandIndex + 1)
-        .some((token) => token === option || token.startsWith(option)),
-  );
-  return dangerousShortOption
-    ? reject(
-        `git option "${dangerousShortOption.option}" is not allowed in read-only mode`,
-      )
-    : allow(tokens);
-};
-
-/**
- * Reports whether a tokenized command belongs to the read-only preset.
- *
- * @param tokens - Restricted command tokens.
- * @returns `true` when the read-only preset owns the command.
- */
-export const usesReadOnlyBashPreset = (
-  tokens: ReadonlyArray<string>,
-): boolean => {
-  const executable = tokens[0] ?? '';
-  return (
-    READ_ONLY_EXECUTABLES.has(executable) ||
-    (executable === 'git' &&
-      READ_ONLY_GIT_SUBCOMMANDS.has(
-        parseRestrictedGitCommand(tokens)?.subcommand ?? '',
-      ))
-  );
-};
-
-/**
- * Prevents mutation flags in allow-listed GitHub and GitLab API reads.
- *
- * @param tokens - Restricted command tokens.
- * @returns The authorization decision.
- */
-export const authorizeHostedApiRead = (
-  tokens: ReadonlyArray<string>,
-): BashAuthorization => {
-  const executable = basename(tokens[0] ?? '');
-  if ((executable !== 'gh' && executable !== 'glab') || tokens[1] !== 'api') {
-    return allow(tokens);
-  }
-
-  const mutationOption = HOSTED_API_MUTATION_OPTIONS.find((option) =>
-    tokens
-      .slice(2)
-      .some(
-        (token) =>
-          token === option ||
-          token.startsWith(`${option}=`) ||
-          (option.length === 2 && token.startsWith(option)),
-      ),
-  );
-  return mutationOption
-    ? reject(
-        `${executable} api option "${mutationOption}" is not allowed by a static read-only rule`,
-      )
-    : allow(tokens);
-};

package/src/policy/restricted-git.ts

@@ -1,30 +0,0 @@
-import type { RestrictedGitCommand } from './bash-types.ts';
-
-/**
- * Finds the Git subcommand in a tokenized restricted command.
- *
- * Only the global options deliberately supported by the policy are skipped.
- *
- * @param tokens - Tokenized Git command.
- * @returns The subcommand and its index, or `undefined` for an invalid shape.
- */
-export const parseRestrictedGitCommand = (
-  tokens: ReadonlyArray<string>,
-): RestrictedGitCommand | undefined => {
-  let index = 1;
-  while (index < tokens.length) {
-    const token = tokens[index];
-    if (token === '-C') {
-      if (!tokens[index + 1]) return undefined;
-      index += 2;
-      continue;
-    }
-    if (token === '--no-pager') {
-      index += 1;
-      continue;
-    }
-    if (!token || token.startsWith('-')) return undefined;
-    return { subcommand: token, subcommandIndex: index };
-  }
-  return undefined;
-};

package/src/policy/reviewed-artifact.ts

@@ -1,97 +0,0 @@
-export type ParsedJsonDocuments = {
-  readonly documents: ReadonlyArray<unknown>;
-  readonly hasMalformedCandidate: boolean;
-};
-
-/**
- * Narrows an unknown value to a non-array record.
- *
- * @param value - Value to inspect.
- * @returns `true` when the value is a record.
- */
-export const isRecord = (
-  value: unknown,
-): value is Readonly<Record<string, unknown>> =>
-  value !== null && typeof value === 'object' && !Array.isArray(value);
-
-/**
- * Parses a complete JSON artifact and JSON fenced blocks while retaining
- * whether any JSON-looking candidate was malformed.
- *
- * @param text - Reviewed artifact text.
- * @returns Parsed documents and malformed-candidate state.
- */
-export const parseJsonDocumentsWithValidity = (
-  text: string,
-): ParsedJsonDocuments => {
-  const documents: Array<unknown> = [];
-  let hasMalformedCandidate = false;
-  const addDocument = (candidate: string): void => {
-    try {
-      documents.push(JSON.parse(candidate));
-    } catch {
-      hasMalformedCandidate = true;
-    }
-  };
-
-  const trimmed = text.trim();
-  if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
-    addDocument(trimmed);
-  }
-
-  const fences = /```(?:json)?[ \t]*\r?\n([\s\S]*?)```/giu;
-  for (const match of text.matchAll(fences)) {
-    const candidate = match[1]?.trim();
-    if (candidate) addDocument(candidate);
-  }
-  return { documents, hasMalformedCandidate };
-};
-
-/**
- * Parses all valid JSON documents from a reviewed artifact.
- *
- * @param text - Reviewed artifact text.
- * @returns Valid JSON documents in source order.
- */
-export const parseJsonDocuments = (text: string): ReadonlyArray<unknown> =>
-  parseJsonDocumentsWithValidity(text).documents;
-
-/**
- * Extracts verification commands for one role from a parsed artifact.
- *
- * @param value - Parsed artifact document.
- * @param role - Verification role whose commands should be returned.
- * @returns Command strings in artifact order.
- */
-export const verificationCommands = (
-  value: unknown,
-  role: 'worker' | 'reviewer',
-): Array<string> => {
-  if (!isRecord(value) || !Array.isArray(value.repositories)) return [];
-  return value.repositories.flatMap((repository) => {
-    if (!isRecord(repository) || !Array.isArray(repository[role])) return [];
-    return repository[role].flatMap((check) =>
-      isRecord(check) && typeof check.command === 'string'
-        ? [check.command]
-        : [],
-    );
-  });
-};
-
-/**
- * Extracts Bash command actions from a parsed remote-action artifact.
- *
- * @param value - Parsed artifact document.
- * @returns Bash commands in artifact order.
- */
-export const remoteActionCommands = (value: unknown): Array<string> => {
-  if (!isRecord(value) || !Array.isArray(value.actions)) return [];
-  return value.actions.flatMap((action) =>
-    isRecord(action) &&
-    action.toolName === 'bash' &&
-    isRecord(action.input) &&
-    typeof action.input.command === 'string'
-      ? [action.input.command]
-      : [],
-  );
-};