@yagni-app/code-staging 1.2.4-staging.1803.1 → 1.2.4-staging.1821.1

package/dist/extension/pipeline/missionChecks.js

@@ -0,0 +1,197 @@
+/**
+ * `checks.json`, the mission file that hands the build's verify gate what to
+ * run besides its own detected scripts: the plan's approved checks (each with
+ * what the host already knows: it fails on the unchanged code, or the sandbox
+ * cannot start it) and the pull request's CI jobs, read from the repository's
+ * workflows at build time.
+ *
+ * The format's producer is `renderMissionChecksJson` in
+ * `packages/backend/src/integrations/e2b/missionFiles.ts`; this package does
+ * not depend on the backend, so it reads the same version 1 with its own
+ * parser. A change there is a change here. A file that is missing or does not
+ * read as version 1 means no repository checks, never a stopped build.
+ */
+import { readFileSync } from "node:fs";
+export const MISSION_CHECKS_FILE_NAME = "checks.json";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isString = (value) => typeof value === "string";
+function stringList(value) {
+    return Array.isArray(value) && value.every(isString) ? value : null;
+}
+function stringRecord(value) {
+    if (!isRecord(value))
+        return null;
+    return Object.values(value).every(isString) ? value : null;
+}
+function parseStep(value) {
+    if (!isRecord(value) || !isString(value.name) || !isString(value.run))
+        return null;
+    const step = { name: value.name, run: value.run };
+    if (value.workingDirectory !== undefined) {
+        if (!isString(value.workingDirectory))
+            return null;
+        step.workingDirectory = value.workingDirectory;
+    }
+    if (value.env !== undefined) {
+        const env = stringRecord(value.env);
+        if (!env)
+            return null;
+        step.env = env;
+    }
+    return step;
+}
+function parseJob(value) {
+    if (!isRecord(value) ||
+        !isString(value.workflow) ||
+        !isString(value.job) ||
+        !isString(value.name))
+        return null;
+    if (!Array.isArray(value.steps) || !Array.isArray(value.cannotRun))
+        return null;
+    const steps = [];
+    for (const raw of value.steps) {
+        const step = parseStep(raw);
+        if (!step)
+            return null;
+        steps.push(step);
+    }
+    const cannotRun = [];
+    for (const raw of value.cannotRun) {
+        if (!isRecord(raw) || !isString(raw.step) || !isString(raw.reason))
+            return null;
+        cannotRun.push({ step: raw.step, reason: raw.reason });
+    }
+    const job = {
+        workflow: value.workflow,
+        job: value.job,
+        name: value.name,
+        steps,
+        cannotRun,
+    };
+    for (const key of ["paths", "pathsIgnore"]) {
+        if (value[key] === undefined)
+            continue;
+        const list = stringList(value[key]);
+        if (!list)
+            return null;
+        job[key] = list;
+    }
+    return job;
+}
+/** The file, or null when the text is not a well-formed version 1 file. */
+export function parseMissionChecksFile(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        // Not JSON: the caller reports the null.
+        return null;
+    }
+    if (!isRecord(parsed) ||
+        parsed.version !== 1 ||
+        !Array.isArray(parsed.checks) ||
+        !Array.isArray(parsed.ciJobs)) {
+        return null;
+    }
+    const checks = [];
+    for (const raw of parsed.checks) {
+        if (!isRecord(raw) || !isString(raw.command))
+            return null;
+        if (raw.status !== "runnable" && raw.status !== "fails_on_base" && raw.status !== "cannot_run")
+            return null;
+        const check = { command: raw.command, status: raw.status };
+        if (isString(raw.cause))
+            check.cause = raw.cause;
+        checks.push(check);
+    }
+    const ciJobs = [];
+    for (const raw of parsed.ciJobs) {
+        const job = parseJob(raw);
+        if (!job)
+            return null;
+        ciJobs.push(job);
+    }
+    return { version: 1, checks, ciJobs };
+}
+/**
+ * Read the file. `missing` (no such file: a host that predates it, or a run
+ * with no mission) is silent; `unreadable` and `malformed` are the caller's to
+ * report once.
+ */
+export function readMissionChecksFile(path, readFile = (p) => readFileSync(p, "utf8")) {
+    let text;
+    try {
+        text = readFile(path);
+    }
+    catch (err) {
+        const code = isRecord(err) && typeof err.code === "string" ? err.code : null;
+        return { file: null, problem: code === "ENOENT" ? "missing" : "unreadable" };
+    }
+    const file = parseMissionChecksFile(text);
+    return file ? { file } : { file: null, problem: "malformed" };
+}
+/** GitHub's filter glob: `*` within one path segment, `**` across segments, `?` one character. */
+export function globToRegExp(pattern) {
+    let source = "";
+    for (let index = 0; index < pattern.length; index += 1) {
+        const char = pattern[index];
+        if (char === "*" && pattern[index + 1] === "*") {
+            source += ".*";
+            index += 1;
+        }
+        else if (char === "*") {
+            source += "[^/]*";
+        }
+        else if (char === "?") {
+            source += "[^/]";
+        }
+        else {
+            source += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+        }
+    }
+    return new RegExp(`^${source}$`);
+}
+/** The part of a pattern before its first glob character. */
+function literalPrefix(pattern) {
+    const at = pattern.search(/[*?[]/);
+    return at < 0 ? pattern : pattern.slice(0, at);
+}
+/**
+ * Whether one changed path matches a pattern. Porcelain reports a new
+ * untracked folder as `dir/`, not its files: it matches when the pattern's
+ * literal start and the folder overlap, so a doubt runs the job.
+ */
+function pathMatches(pattern, path) {
+    if (!path.endsWith("/"))
+        return globToRegExp(pattern).test(path);
+    const prefix = literalPrefix(pattern);
+    return prefix.startsWith(path) || path.startsWith(prefix);
+}
+/** An ordered list with `!` exclusions: the last pattern that matches decides. */
+function listMatches(patterns, path) {
+    let matched = false;
+    for (const raw of patterns) {
+        const negated = raw.startsWith("!");
+        if (pathMatches(negated ? raw.slice(1) : raw, path))
+            matched = !negated;
+    }
+    return matched;
+}
+/**
+ * Whether a change to `changedPaths` runs this job on its pull request, by
+ * GitHub's rules: with `paths`, when any changed path matches; with
+ * `paths-ignore`, unless every changed path is ignored (a new folder is never
+ * taken as ignored). No filter: always. No changed paths: never.
+ */
+export function ciJobInScope(job, changedPaths) {
+    if (changedPaths.length === 0)
+        return false;
+    if (job.paths)
+        return changedPaths.some((path) => listMatches(job.paths, path));
+    if (job.pathsIgnore) {
+        return changedPaths.some((path) => path.endsWith("/") || !listMatches(job.pathsIgnore, path));
+    }
+    return true;
+}
+//# sourceMappingURL=missionChecks.js.map

package/dist/extension/pipeline/orchestrator.d.ts

@@ -98,6 +98,14 @@ export interface RunPipelineDeps {
     grounded?: boolean;
     /** Environment inherited by spawned child stages. Defaults to the parent process env. */
     childEnv?: NodeJS.ProcessEnv;
+    /**
+     * Extra pi flags for the stages that write code: the single-writer
+     * implement, each builder, the synthesizer, every fixer, and the review
+     * loop's fix stage. Headless /go passes the launcher's `--skill` /
+     * `--prompt-template` paths here (YAG-784). Map, plan, the partitioner and
+     * the review lenses never get them.
+     */
+    extraArgs?: string[];
     /**
      * The no-op guard's git seam (injected for unit tests). Captures the repo
      * HEAD + porcelain status so the orchestrator can tell whether the build half

package/dist/extension/pipeline/orchestrator.js

@@ -275,12 +275,14 @@ export async function runPipeline(ticket, deps) {
     // `go:implement:<workstream>`), so per-workstream spend attributes for free the
     // way review lenses do. Every other stage leaves it undefined and keeps the
     // runner's own `go:<stage>` default.
-    const stageDepsFor = (tag, callerLabel) => {
+    // `writes` marks a build or fix child, the only ones that get `extraArgs`.
+    const stageDepsFor = (tag, callerLabel, writes = false) => {
         const onEvent = deps.onEvent;
         return {
             cwd: deps.cwd,
             signal: deps.signal,
             ...(deps.childEnv ? { env: deps.childEnv } : {}),
+            ...(writes && deps.extraArgs?.length ? { extraArgs: deps.extraArgs } : {}),
             ...(runId ? { attribution: { runId } } : {}),
             ...(callerLabel ? { callerLabel } : {}),
             onEvent: (ev) => {
@@ -462,7 +464,7 @@ export async function runPipeline(ticket, deps) {
         // after the builders have fixed what it pointed at.
         let summaryDefects = [];
         if (fanned) {
-            const synth = await runStageFn({ ...synthesizerStage(), tools: stage.tools }, { ticket: promptTicket, previous: composeSynthesizerInput(handoff, report), grounded }, stageDepsFor({ stageId: stage.id }, SYNTHESIZER_CALLER_LABEL));
+            const synth = await runStageFn({ ...synthesizerStage(), tools: stage.tools }, { ticket: promptTicket, previous: composeSynthesizerInput(handoff, report), grounded }, stageDepsFor({ stageId: stage.id }, SYNTHESIZER_CALLER_LABEL, true));
             stages.push(synth);
             if (!isFailed(synth) && synth.finalOutput.trim()) {
                 body = synth.finalOutput;
@@ -495,7 +497,7 @@ export async function runPipeline(ticket, deps) {
                 const fixes = await mapWithConcurrencyLimit(assigned, ceiling, async (a) => {
                     const siblings = workstreams.filter((s) => s.name !== a.workstream.name);
                     progress({ kind: "stage_start", stageId: stage.id, workstream: a.workstream.name });
-                    const fixed = await runStageFn({ ...fixerStage(a.workstream, renderFindings(a.findings), siblings), tools: stage.tools }, { ticket: promptTicket, grounded }, stageDepsFor({ stageId: stage.id, workstream: a.workstream.name }, workstreamCallerLabel(a.workstream.name)));
+                    const fixed = await runStageFn({ ...fixerStage(a.workstream, renderFindings(a.findings), siblings), tools: stage.tools }, { ticket: promptTicket, grounded }, stageDepsFor({ stageId: stage.id, workstream: a.workstream.name }, workstreamCallerLabel(a.workstream.name), true));
                     progress({
                         kind: "stage_done",
                         stageId: stage.id,
@@ -520,7 +522,7 @@ export async function runPipeline(ticket, deps) {
             if (unassigned.length > 0) {
                 const findingsText = renderFindings(unassigned);
                 const fixStage = fanned ? synthesizerFixStage(findingsText) : fixerStage(undefined, findingsText);
-                const fixed = await runStageFn({ ...fixStage, tools: stage.tools }, { ticket: promptTicket, grounded }, stageDepsFor({ stageId: stage.id }, fanned ? SYNTHESIZER_CALLER_LABEL : undefined));
+                const fixed = await runStageFn({ ...fixStage, tools: stage.tools }, { ticket: promptTicket, grounded }, stageDepsFor({ stageId: stage.id }, fanned ? SYNTHESIZER_CALLER_LABEL : undefined, true));
                 stages.push(fixed);
                 if (fanned) {
                     if (!isFailed(fixed) && fixed.finalOutput.trim()) {
@@ -587,7 +589,7 @@ export async function runPipeline(ticket, deps) {
         const partitionTag = { stageId: stage.id };
         const runSingleWriter = async (decision) => {
             recordDecision(decision, beforeBuild);
-            const written = await runStageFn(stage, { ticket: promptTicket, previous, grounded }, stageDepsFor({ stageId: stage.id }));
+            const written = await runStageFn(stage, { ticket: promptTicket, previous, grounded }, stageDepsFor({ stageId: stage.id }, undefined, true));
             stages.push(written);
             // A failed or credit-starved writer never reaches the checker: the build
             // loop's own guard turns it into `partial` or the honest stage error, and
@@ -670,7 +672,7 @@ export async function runPipeline(ticket, deps) {
             // starts and finishes on its own timing, tagged so interleaved events stay
             // attributed, and callers that ignore the tag still see one implement pair.
             progress({ kind: "stage_start", stageId: stage.id, workstream: w.name });
-            const built = await runStageFn({ ...builderStage(w, siblings), tools: stage.tools }, { ticket: promptTicket, previous, grounded }, stageDepsFor({ stageId: stage.id, workstream: w.name }, workstreamCallerLabel(w.name)));
+            const built = await runStageFn({ ...builderStage(w, siblings), tools: stage.tools }, { ticket: promptTicket, previous, grounded }, stageDepsFor({ stageId: stage.id, workstream: w.name }, workstreamCallerLabel(w.name), true));
             // A child that died says so on its own done beat (the `degraded` flag the
             // review lenses already use), so no surface paints a dead builder as built.
             progress({
@@ -1107,7 +1109,7 @@ export async function runPipeline(ticket, deps) {
         const fixStartedAt = clock();
         progress({ kind: "stage_start", stageId: "fix", round });
         stageEvent("fix", "start", { round });
-        const fixResult = await runStageFn(fix, { ticket: promptTicket, previous: designContext ? `${serializeBlocking(findings)}\n\n${designContext}` : serializeBlocking(findings), grounded }, stageDepsFor({ stageId: "fix", round }));
+        const fixResult = await runStageFn(fix, { ticket: promptTicket, previous: designContext ? `${serializeBlocking(findings)}\n\n${designContext}` : serializeBlocking(findings), grounded }, stageDepsFor({ stageId: "fix", round }, undefined, true));
         observedMs.fix = clock() - fixStartedAt;
         stages.push(fixResult);
         log("stage_done", { stageId: "fix", exitCode: fixResult.exitCode });

package/dist/extension/pipeline/runner.d.ts

@@ -35,6 +35,12 @@ export interface RunStageDeps {
     };
     /** Optional environment for spawned child stages. Defaults to Node's inherited env. */
     env?: NodeJS.ProcessEnv;
+    /**
+     * Extra pi flags for this child, placed before the positional task prompt.
+     * Headless /go passes the launcher's `--skill` / `--prompt-template` paths
+     * here for build and fix stages only (YAG-784).
+     */
+    extraArgs?: string[];
     /**
      * YAG-471 attribution: the tracked run's server-assigned id (a UUID), sent to
      * the child as `YAGNI_RUN_ID` so the model proxy's `x-yagni-run-id` header

package/dist/extension/pipeline/runner.js

@@ -122,7 +122,11 @@ export async function runStage(stage, ctx, deps) {
             ...(tierCap ? { tierCap } : {}),
         });
         const { piCli, extensionPath } = resolveChild();
-        const argv = groundedChildArgv(passthrough, { piCli, extensionPath });
+        const argv = groundedChildArgv(passthrough, {
+            piCli,
+            extensionPath,
+            ...(deps.extraArgs?.length ? { extraArgs: deps.extraArgs } : {}),
+        });
         // Fold events into a fixed-size accumulator as they stream — never retain
         // the full array (that OOMs on a verbose stage; YAG-317 follow-up).
         const acc = newEventAccumulator();

package/dist/extension/pipeline/verify.d.ts

@@ -46,6 +46,8 @@
  * command output passes through {@link scrubSecrets} before it can enter
  * findings, handoffs, or run records (§0.9).
  */
+import { type ToolchainFile } from "../toolchain/spawnHook.js";
+import { type MissionChecksFile } from "./missionChecks.js";
 import type { Finding } from "./types.js";
 /**
  * Total wall-clock budget for a single verify run before it is abandoned
@@ -55,6 +57,17 @@ import type { Finding } from "./types.js";
 export declare const VERIFY_TIMEOUT_MS: number;
 /** Per-PACKAGE wall-clock budget for the test half (spec §3d); overrun fails open. Ten minutes until 2026-10-09. */
 export declare const VERIFY_TEST_TIMEOUT_MS: number;
+/**
+ * The repository-checks half (the plan's approved checks and the pull
+ * request's CI steps) across a whole build: the gate runs after implement,
+ * after each fix turn and every review round, so a cap per call alone could
+ * add an hour to a build.
+ */
+export declare const REPO_CHECKS_BUILD_BUDGET_MS: number;
+/** The same half's cap in one gate call, inside the run budget's verify allowance. */
+export declare const REPO_CHECKS_CALL_BUDGET_MS: number;
+/** One approved check's or CI step's cap. */
+export declare const REPO_CHECK_TIMEOUT_MS: number;
 /** A resolved verify command plus how it was found. */
 export interface VerifyCommand {
     /** Shell-free command + args, e.g. ["pnpm", "run", "typecheck"]. */
@@ -116,7 +129,10 @@ export declare function isFannedOutScript(body: string): boolean;
  * Parse `git status --porcelain` into repo-relative changed paths. Each line is
  * `XY <path>`; we drop the 2-char XY status + its separating space, and for a
  * rename/copy (`R  old -> new`) take the destination. Pure; the impure git
- * shell-out is {@link snapshotWorkspace}.
+ * shell-out is {@link snapshotWorkspace}, whose status is trimmed as a whole:
+ * a first line ` M path` arrives as `M path`. A whole line always has a space
+ * third, so a line without one lost its leading space and its path starts one
+ * column earlier.
  */
 export declare function parseChangedPaths(status: string): string[];
 /**
@@ -261,6 +277,25 @@ export declare function buildVerifyEnv(source?: NodeJS.ProcessEnv): NodeJS.Proce
  * once instead of parking in watch mode until the 10-min cap kills it.
  */
 export declare function buildTestEnv(source?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * The environment an approved check or CI step runs under: the test half's
+ * (no `YAGNI_*`, no NODE_OPTIONS, CI on) minus the secrets the host strips
+ * from its own check runs, on the repository's toolchain when the build named
+ * one (the same PATH and variables the model's shell gets), then the step's
+ * own literal variables.
+ */
+export declare function buildRepoCheckEnv(source?: NodeJS.ProcessEnv, toolchain?: ToolchainFile | null, stepEnv?: Record<string, string>): NodeJS.ProcessEnv;
+/** One porcelain line's path, and whether it is untracked. */
+interface TreeEntry {
+    path: string;
+    untracked: boolean;
+}
+/**
+ * The porcelain entries in `after` that `before` did not have: what the
+ * repository checks wrote into the tree. A path that was already dirty is the
+ * build's, and is not listed. Pure.
+ */
+export declare function newTreeEntries(before: string, after: string): TreeEntry[];
 export declare function makeDefaultExec(opts?: {
     graceMs?: number;
     killTree?: (pid: number) => void;
@@ -289,6 +324,29 @@ export interface MakeRunVerifyOpts {
     testTimeoutMs?: number;
     /** Test-half env override for determinism in tests (default: buildTestEnv() per run). */
     testEnv?: NodeJS.ProcessEnv;
+    /**
+     * The mission's `checks.json` (the approved checks and the pull request's CI
+     * jobs). Absent or null: no repository-checks half, as before.
+     */
+    repoChecks?: () => MissionChecksFile | null;
+    /**
+     * This run's own changed paths (repo-relative), which scope the CI jobs by
+     * their `paths` filters. Default: the same `git status` the scope reads,
+     * minus the pre-run dirt.
+     */
+    changedPaths?: (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<string[]>;
+    /** Repository-checks env override for determinism in tests (default: buildRepoCheckEnv() per run). */
+    repoChecksEnv?: NodeJS.ProcessEnv;
+    /** The toolchain the repository checks run on (default: `YAGNI_TOOLCHAIN_FILE`, when it reads). */
+    toolchain?: () => ToolchainFile | null;
+    repoChecksBuildBudgetMs?: number;
+    repoChecksCallBudgetMs?: number;
+    repoCheckTimeoutMs?: number;
+    now?: () => number;
+    /** The tree's porcelain status before and after the half (default: `git status`). */
+    treeStatus?: (cwd: string, signal?: AbortSignal) => Promise<string>;
+    /** Undo what the half wrote into the tree (default: `git clean` / `git checkout` of exactly those paths). */
+    undoTreeWrites?: (cwd: string, entries: TreeEntry[]) => Promise<void>;
 }
 /**
  * One workstream as the scoped checker sees it: the name its findings are
@@ -365,4 +423,5 @@ export declare function makeWorkstreamCheck(opts?: MakeWorkstreamCheckOpts): (cw
  * blocks a real change on its own failure.
  */
 export declare function makeRunVerify(opts?: MakeRunVerifyOpts): (cwd: string, signal?: AbortSignal, baselinePaths?: string[]) => Promise<VerifyOutcome>;
+export {};
 //# sourceMappingURL=verify.d.ts.map