@yagni-app/code-staging 1.2.6-staging.1960.1 → 1.2.6-staging.1973.1

package/dist/extension/pipeline/headlessGo.js

@@ -507,6 +507,7 @@ export async function runHeadlessGo(argv, deps = {}) {
             ...gateOpts,
             ...(baseline ? { baseline } : {}),
             ...(scan ? { scanChange: scan } : {}),
+            ...(cloud ? { unreadTestFailureIsFinding: true } : {}),
         });
         gate = made;
         runVerify = async (verifyCwd, signal, baselinePaths) => {

package/dist/extension/pipeline/verify.d.ts

@@ -35,7 +35,9 @@
  * become `critical` findings through the same review->fix loop; infra/env
  * failures (connection refused, missing env, DB/auth, command not found) and
  * anything UNCERTAIN fail OPEN with an honest note, never a never-clearable
- * critical.
+ * critical. A cloud session's gate (`unreadTestFailureIsFinding`) makes an
+ * UNCERTAIN failure a finding carrying the output tail, unless the clean tree
+ * failed the same command.
  *
  * Safe-by-default and FAIL-OPEN: if no scoped, non-fanned-out command is
  * detectable, or the command cannot be spawned, or it times out, the gate
@@ -68,6 +70,11 @@ export declare const REPO_CHECKS_BUILD_BUDGET_MS: number;
 export declare const REPO_CHECKS_CALL_BUDGET_MS: number;
 /** One approved check's or CI step's cap. */
 export declare const REPO_CHECK_TIMEOUT_MS: number;
+/**
+ * A command's exit as a note says it: what ran, its exit code and the first
+ * line of the tail a finding would carry. Pure.
+ */
+export declare function exitSummary(label: string, code: number, output: string): string;
 /** A resolved verify command plus how it was found. */
 export interface VerifyCommand {
     /** Shell-free command + args, e.g. ["pnpm", "run", "typecheck"]. */
@@ -105,7 +112,10 @@ export interface VerifyCheckRun {
     command: string;
     /** Where it ran, repo-relative ("." for the root). */
     cwd: string;
-    /** Null when the command never exited: it timed out, was aborted, or was not found. */
+    /**
+     * Null when the command gave no verdict: it timed out, was aborted, was not
+     * found, or exited on an environment that could not run it (its note says how).
+     */
     exitCode: number | null;
     durationMs: number;
     /**
@@ -114,7 +124,11 @@ export interface VerifyCheckRun {
      * neither.
      */
     baseline: "runnable" | "fails_on_base" | "cannot_run";
-    /** Why it has no exit code: "timed out", "aborted", "not found" or "could not run". */
+    /**
+     * Why it has no exit code ("timed out", "aborted", "not found", "could not
+     * run", or the cause with the exit and the first line of its output tail),
+     * or beside one, that the unchanged code failed it too.
+     */
     note?: string;
 }
 /**
@@ -430,6 +444,13 @@ export interface MakeRunVerifyOpts {
      * findings. Absent: every failure is a finding, as before.
      */
     baseline?: VerifyBaseline | null;
+    /**
+     * The cloud session's rule (spec decision 3): a test run that exits
+     * non-zero with output no parser reads is a finding carrying its output
+     * tail, unless the baseline saw the clean tree fail the same command, which
+     * is a note. Absent (mission mode): it fails open with a note, as before.
+     */
+    unreadTestFailureIsFinding?: boolean;
     /**
      * The host's secret and binary scans over what this run added
      * (changeScan.ts, YAG-1000), given the tree's pre-run dirt to leave out;

package/dist/extension/pipeline/verify.js

@@ -35,7 +35,9 @@
  * become `critical` findings through the same review->fix loop; infra/env
  * failures (connection refused, missing env, DB/auth, command not found) and
  * anything UNCERTAIN fail OPEN with an honest note, never a never-clearable
- * critical.
+ * critical. A cloud session's gate (`unreadTestFailureIsFinding`) makes an
+ * UNCERTAIN failure a finding carrying the output tail, unless the clean tree
+ * failed the same command.
  *
  * Safe-by-default and FAIL-OPEN: if no scoped, non-fanned-out command is
  * detectable, or the command cannot be spawned, or it times out, the gate
@@ -87,6 +89,22 @@ const MAX_NAMED_CANNOT_RUN = 10;
 /** Cap on located findings parsed from one failing run, and on the opaque-tail message. */
 const MAX_LOCATED_FINDINGS = 25;
 const MAX_TAIL_CHARS = 1000;
+/** The last MAX_TAIL_CHARS of a command's output, trimmed: what an unlocated finding carries. */
+function outputTail(output) {
+    return (output.length > MAX_TAIL_CHARS ? output.slice(-MAX_TAIL_CHARS) : output).trim();
+}
+/**
+ * A command's exit as a note says it: what ran, its exit code and the first
+ * line of the tail a finding would carry. Pure.
+ */
+export function exitSummary(label, code, output) {
+    const first = outputTail(output)
+        .split("\n")
+        .map((line) => line.trim())
+        .find(Boolean);
+    const line = first && first.length > 200 ? `${first.slice(0, 197)}...` : first;
+    return `\`${label}\` exited ${code}${line ? `; its output tail begins: ${line}` : " with no output"}`;
+}
 /** The verify lens reuses `does_it_hold` (does the change build/test) to avoid widening ReviewLens. */
 const VERIFY_LENS = "does_it_hold";
 /**
@@ -557,17 +575,7 @@ export function classifyTestFailure(output, exitCode, limit = MAX_LOCATED_FINDIN
         };
     }
     if (FAILURE_SUMMARY.some((re) => re.test(output))) {
-        const tail = output.length > MAX_TAIL_CHARS ? output.slice(output.length - MAX_TAIL_CHARS) : output;
-        return {
-            kind: "failures",
-            findings: [
-                {
-                    severity: "critical",
-                    lens: VERIFY_LENS,
-                    message: `verify (test) failed (exit ${exitCode}). Output tail:\n${tail.trim()}`,
-                },
-            ],
-        };
+        return { kind: "failures", findings: [tailFinding("test", exitCode, output)] };
     }
     return { kind: "uncertain" };
 }
@@ -633,14 +641,15 @@ export function parseVerifyFailures(output, exitCode, label, limit = MAX_LOCATED
     }
     if (located.length > 0)
         return located;
-    const tail = output.length > MAX_TAIL_CHARS ? output.slice(output.length - MAX_TAIL_CHARS) : output;
-    return [
-        {
-            severity: "critical",
-            lens: VERIFY_LENS,
-            message: `verify (${label}) failed (exit ${exitCode}). Output tail:\n${tail.trim()}`,
-        },
-    ];
+    return [tailFinding(label, exitCode, output)];
+}
+/** One unlocated finding carrying the output's tail. */
+function tailFinding(label, exitCode, output) {
+    return {
+        severity: "critical",
+        lens: VERIFY_LENS,
+        message: `verify (${label}) failed (exit ${exitCode}). Output tail:\n${outputTail(output)}`,
+    };
 }
 /** Trim a trailing slash and normalise separators for the path math below. */
 const normDir = (p) => p.replace(/\\/g, "/").replace(/\/+$/, "");
@@ -685,6 +694,12 @@ function liftFinding(finding, repoRoot, commandCwd) {
     const file = toRepoRelativePath(finding.file, repoRoot, commandCwd);
     return file === finding.file ? finding : { ...finding, file };
 }
+/**
+ * A test command's baseline entry when the clean tree failed it with output
+ * no parser reads: it already failed there. It matches no failure's key, so
+ * it never excuses a finding.
+ */
+const UNREAD_FAILURE_KEY = "\u0000unread failure";
 /** One command's identity across the baseline run and the build's runs: where it runs and what it runs. */
 export function verifyCommandKey(command) {
     return `${command.cwd}\u0000${command.argv.join(" ")}`;
@@ -1251,13 +1266,14 @@ export function makeRunVerify(opts = {}) {
         const startedAt = now();
         try {
             const { code, output: rawOutput } = await exec(repoCheckArgv(command), dir, composed, env);
-            const record = (baseline) => run.checks.push({
+            const record = (baseline, note) => run.checks.push({
                 name: check.name,
                 command,
                 cwd: relative(run.cwd, dir) || ".",
-                exitCode: code,
+                exitCode: note ? null : code,
                 durationMs: now() - startedAt,
                 baseline,
+                ...(note ? { note } : {}),
             });
             if (code === 0) {
                 record(check.baseline);
@@ -1265,9 +1281,12 @@ export function makeRunVerify(opts = {}) {
             }
             const output = scrubSecrets(rawOutput);
             const cls = classifyTestFailure(output, code);
-            record(cls.kind === "infra" ? "cannot_run" : check.baseline);
-            if (cls.kind === "infra")
-                return { kind: "note", reason: `could not run: ${cls.reason}` };
+            if (cls.kind === "infra") {
+                const reason = `could not run: ${cls.reason}`;
+                record("cannot_run", `${reason}; ${exitSummary(check.name, code, output)}`);
+                return { kind: "note", reason };
+            }
+            record(check.baseline);
             return { kind: "failed", output, code };
         }
         catch (err) {
@@ -1470,7 +1489,7 @@ export function makeRunVerify(opts = {}) {
                     const infra = classifyVerifyInfraFailure(output, code);
                     if (infra) {
                         reasons.push(`verify (${command.label}) could not run: ${infra}`);
-                        recordCommand(command, code, startedAt, "cannot_run");
+                        recordCommand(command, null, startedAt, "cannot_run", `could not run: ${infra}; ${exitSummary(command.label, code, output)}`);
                         continue;
                     }
                 }
@@ -1514,11 +1533,30 @@ export function makeRunVerify(opts = {}) {
                         const { code, output: rawOutput } = await exec(command.argv, command.cwd, composed, testEnv);
                         const output = scrubSecrets(rawOutput);
                         const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
-                        recordCommand(command, code, startedAt, cls.kind === "infra" ? "cannot_run" : standing(command));
                         if (cls.kind === "infra") {
+                            recordCommand(command, null, startedAt, "cannot_run", `could not run: ${cls.reason}; ${exitSummary(command.label, code, output)}`);
                             reasons.push(`tests (${where}) could not run: ${cls.reason}; 'clean' reflects typecheck + review only`);
                             continue;
                         }
+                        const base = standing(command);
+                        if (cls.kind === "uncertain" && opts.unreadTestFailureIsFinding) {
+                            anyRan = true;
+                            testLabels.push(command.label);
+                            if (base === "fails_on_base") {
+                                const summary = exitSummary(command.label, code, output);
+                                recordCommand(command, code, startedAt, base, `failed on the unchanged code too: ${summary}`);
+                                reasons.push(`tests (${where}) failed on the unchanged code too, so not a finding: ${summary}`);
+                            }
+                            else {
+                                // One finding per command, past the cap too: it is the only
+                                // word of this command's failure.
+                                recordCommand(command, code, startedAt, base);
+                                testFindingCount += 1;
+                                findings.push(tailFinding(command.label, code, output));
+                            }
+                            continue;
+                        }
+                        recordCommand(command, code, startedAt, base);
                         if (cls.kind === "uncertain") {
                             // Failing OPEN on an uninterpretable failure (§3d): an honest note,
                             // never a guessed finding the fix stage cannot clear.
@@ -1689,6 +1727,9 @@ export function makeTakeVerifyBaseline(opts = {}) {
                         const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY);
                         if (cls.kind === "infra" || cls.kind === "uncertain") {
                             result.notes.push(`${command.label} (${command.cwd}): ${cls.kind === "infra" ? cls.reason : "output not interpretable"}`);
+                            if (cls.kind === "uncertain") {
+                                baseline.set(verifyCommandKey(command), new Map([[UNREAD_FAILURE_KEY, 1]]));
+                            }
                             continue;
                         }
                         failed = cls.kind === "failures" ? cls.findings : [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.6-staging.1960.1",
+  "version": "1.2.6-staging.1973.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "6525a69ea8f8955a94acebf1b574974f0dc41fd0"
+  "yagniSourceSha": "0cc9459eb25b5a357e700f90b803ff0adf194a0e"
 }