@yagni-app/code-staging 1.2.6-staging.1987.1 → 1.2.6-staging.1993.1

package/dist/extension/pipeline/verify.d.ts

@@ -106,6 +106,17 @@ export interface VerifyOutcome {
     /** Every command the gate ran, with how it exited (the cloud session's `result.json` checks). */
     checks?: VerifyCheckRun[];
 }
+/** An approved check's name on the report: its command, cut at 80 characters. */
+export declare function checkLabel(command: string): string;
+/**
+ * True when a command changes the checkout's git state: a commit, a branch
+ * created or switched, a reset, a stash, a push. `git branch`, `git remote`
+ * and `git config` count as reads only in their listing forms. The same rule
+ * as `changesGitState` in the backend's attempts/inputs.ts, which leaves such
+ * a check out of the session's `checks.json`; both test files read one
+ * command corpus (test/fixtures/gitStateCommands.json), so they cannot drift.
+ */
+export declare function changesGitState(command: string): boolean;
 /** One command the gate ran, and how it went. */
 export interface VerifyCheckRun {
     name: string;

package/dist/extension/pipeline/verify.js

@@ -107,6 +107,52 @@ export function exitSummary(label, code, output) {
 }
 /** The verify lens reuses `does_it_hold` (does the change build/test) to avoid widening ReviewLens. */
 const VERIFY_LENS = "does_it_hold";
+/** An approved check's name on the report: its command, cut at 80 characters. */
+export function checkLabel(command) {
+    return command.length > 80 ? `${command.slice(0, 77)}...` : command;
+}
+/** Git subcommands that only read: a check may run them as often as it likes. */
+const READ_ONLY_GIT = new Set("status diff log show ls-files ls-tree rev-parse rev-list check-ignore grep blame describe cat-file shortlog diff-tree merge-base for-each-ref show-ref name-rev count-objects var version help".split(" "));
+/**
+ * One git call in a shell command: what precedes it (a separator, a quote, a
+ * `$(`), its global options (`-C dir`, `-c k=v`, `--git-dir=...`,
+ * `--no-pager`), its subcommand, and its arguments up to the next separator.
+ */
+const GIT_CALL = 
+// Each alternative is disjoint from the others (no backtracking blow-up).
+/(?:^|[\s;&|(`!"'/])git((?:\s+(?:-[cC]\s+\S+|--[A-Za-z][\w-]*(?:=\S+)?|-[ABD-Zabd-z]))*)\s+([a-z][\w-]*)((?:[ \t][^;&|)`\n\r]*)?)/g;
+/**
+ * True when a command changes the checkout's git state: a commit, a branch
+ * created or switched, a reset, a stash, a push. `git branch`, `git remote`
+ * and `git config` count as reads only in their listing forms. The same rule
+ * as `changesGitState` in the backend's attempts/inputs.ts, which leaves such
+ * a check out of the session's `checks.json`; both test files read one
+ * command corpus (test/fixtures/gitStateCommands.json), so they cannot drift.
+ */
+export function changesGitState(command) {
+    const calls = command.matchAll(GIT_CALL);
+    for (const call of calls) {
+        const sub = call[2] ?? "";
+        const args = (call[3] ?? "").replace(/["']/g, "").trim().split(/\s+/).filter(Boolean);
+        if (READ_ONLY_GIT.has(sub))
+            continue;
+        const listing = args.every((arg) => arg.startsWith("-") &&
+            !/^-[dDmMcC]$|^--(?:delete|move|copy|set-upstream|unset|add|replace-all|edit)/.test(arg));
+        if (sub === "branch" && listing)
+            continue;
+        if (sub === "remote" &&
+            (args.length === 0 || args.every((arg) => arg === "-v" || arg === "--verbose")))
+            continue;
+        if (sub === "config" &&
+            (args.includes("--get") ||
+                args.includes("--list") ||
+                args.includes("-l") ||
+                (args.length === 1 && !args[0]?.startsWith("-"))))
+            continue;
+        return true;
+    }
+    return false;
+}
 /**
  * Why a command threw instead of exiting, as its check record says it. `run`
  * is the run's own signal (a /stop or the run's end); `capped` is the one
@@ -434,6 +480,9 @@ const TEST_INFRA_PATTERNS = [
         "missing environment variable",
     ],
     [/\bprocess\.env\.[A-Z0-9_]+ is (?:undefined|not set)\b/, "missing environment variable"],
+    // Yarn Berry reading a `${TOKEN}` in .yarnrc.yml that the environment lacks
+    // (staging bench 2026-10-23: GITHUB_PACKAGES_TOKEN): the suite never started.
+    [/\bEnvironment variable not found \([A-Za-z0-9_]+\)/, "missing environment variable"],
     [/\bSASL\b|\bSCRAM-SERVER\b/, "database auth failed (missing DB credentials?)"],
     [/\bpassword authentication failed\b/i, "database auth failed"],
     [/\brole "[^"]*" does not exist\b/i, "database role does not exist"],
@@ -1151,9 +1200,23 @@ export function makeRunVerify(opts = {}) {
         const reasons = [];
         const labels = [];
         const cannotRun = [];
+        // An approved check the sandbox cannot run is on the report as one with no
+        // verdict, so a session that never ran it is never read as all green
+        // (#2694): the host leaves its pull request a draft.
+        const unrunnable = [];
         for (const check of file.checks) {
-            if (check.status === "cannot_run")
-                cannotRun.push(`\`${check.command}\`${check.cause ? ` (${check.cause})` : ""}`);
+            if (check.status !== "cannot_run")
+                continue;
+            cannotRun.push(`\`${check.command}\`${check.cause ? ` (${check.cause})` : ""}`);
+            unrunnable.push({
+                name: checkLabel(check.command),
+                command: check.command,
+                cwd: ".",
+                exitCode: null,
+                durationMs: 0,
+                baseline: "cannot_run",
+                note: `could not run in the sandbox${check.cause ? `: ${check.cause}` : ""}`,
+            });
         }
         const paths = await changedPaths(cwd, signal, input.baselinePaths);
         // A job the pull request's CI reported failed runs whatever its paths say.
@@ -1200,12 +1263,12 @@ export function makeRunVerify(opts = {}) {
         const steps = jobs.flatMap((job) => job.steps.map((step) => ({ job, step })));
         if (approved.length === 0 && steps.length === 0) {
             report();
-            return { findings, reasons, labels, checks: [] };
+            return { findings, reasons, labels, checks: unrunnable };
         }
         const buildLeft = (opts.repoChecksBuildBudgetMs ?? REPO_CHECKS_BUILD_BUDGET_MS) - repoChecksSpentMs;
         if (buildLeft < REPO_CHECK_MIN_START_MS) {
             reasons.push("approved checks and CI steps not run again: the build's check budget is spent; the host still runs the approved checks after the build");
-            return { findings, reasons, labels, checks: [] };
+            return { findings, reasons, labels, checks: unrunnable };
         }
         const callBudget = Math.min(opts.repoChecksCallBudgetMs ?? REPO_CHECKS_CALL_BUDGET_MS, timeoutMs - (now() - input.callStartedAt), buildLeft);
         const halfStartedAt = now();
@@ -1254,7 +1317,7 @@ export function makeRunVerify(opts = {}) {
         if (run.notReached > 0) {
             reasons.push(`${run.notReached} approved check(s) or CI step(s) not reached in the gate's time budget; the host still runs the approved checks after the build`);
         }
-        return { findings, reasons, labels, checks: run.checks };
+        return { findings, reasons, labels, checks: [...unrunnable, ...run.checks] };
     }
     /** One repository command's verdict: passed, a note (it could not run), or a failure with its output. */
     async function runRepoCommand(run, command, dir, stepEnv, check) {
@@ -1328,7 +1391,13 @@ export function makeRunVerify(opts = {}) {
                 run.notReached += 1;
                 continue;
             }
-            const label = check.command.length > 80 ? `${check.command.slice(0, 77)}...` : check.command;
+            const label = checkLabel(check.command);
+            if (changesGitState(check.command)) {
+                // A check runs every round: one that commits, branches or resets would
+                // move the session's HEAD under its own work. Never run, and said.
+                run.reasons.push(`approved check \`${label}\` not run: it changes the checkout's git state (a branch, a commit or a reset), which a check must never do`);
+                continue;
+            }
             const verdict = await runRepoCommand(run, check.command, run.cwd, undefined, {
                 name: label,
                 baseline: check.status,
@@ -1393,6 +1462,14 @@ export function makeRunVerify(opts = {}) {
                 continue;
             }
             const where = `CI ${job.name}, step "${step.name}"`;
+            if (changesGitState(step.run)) {
+                // The runner's checkout is its own; here it is the session's branch.
+                const reason = "it changes the checkout's git state";
+                run.reasons.push(`${where} not run: ${reason}`);
+                stoppedJobs.add(job);
+                settle(job, "cannot_run", reason);
+                continue;
+            }
             const key = `${job.workflow}\u0000${job.job}\u0000${step.name}\u0000${step.run}`;
             const dir = step.workingDirectory
                 ? join(run.cwd, step.workingDirectory.replace(/^\.\/+/, ""))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.6-staging.1987.1",
+  "version": "1.2.6-staging.1993.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "c2d1f347d692ab8adbd5a5007f4a3d5c7b7d7d77"
+  "yagniSourceSha": "d016e89ef2032f809b217a8cca48b847f5770774"
 }