@yagni-app/code-staging 1.2.7-staging.2069.1 → 1.2.8-staging.2076.1

package/dist/extension/pipeline/cloud.d.ts

@@ -16,7 +16,7 @@
  * lives (`packages/shared/src/attempts.ts`): the two meet only at this JSON.
  */
 import type { ContinuationStage } from "./continuation.js";
-import type { VerifyCheckRun, VerifyOutcome } from "./verify.js";
+import { type VerifyCheckRun, type VerifyOutcome } from "./verify.js";
 import type { WorktreeExec } from "./worktree.js";
 import type { Finding, PipelineLane, PipelineResult, StopReason } from "./types.js";
 /** Set on every stage child of a cloud session, so its prompt describes the cloud sandbox. */
@@ -152,6 +152,15 @@ export declare function ticketOfBranch(branch: string | null): string | undefine
 export declare function attemptCommitted(cwd: string, exec: WorktreeExec, attemptId: string): Promise<boolean | null>;
 /** Read the execution's work off git. Never throws: a read that fails is a note. */
 export declare function gitFacts(cwd: string, exec: WorktreeExec, baseSha: string): Promise<GitFacts>;
+/**
+ * The checks that gave no verdict because the sandbox could not run them,
+ * each with why, as one sentence for the person who reads the result: no
+ * change to the code makes them run, so the loop never held the change on
+ * them. A check only not run on this tree (its budget spent, the build
+ * stopped first, its note {@link CHECK_NOT_RUN_NOTE}) is not one: another run
+ * could give it a verdict. Null when no check could not run. Pure.
+ */
+export declare function cannotRunNote(checks: readonly VerifyCheckRun[]): string | null;
 /** What the session's last act needs, gathered once the pipeline has stopped. */
 export interface CloudCompletion {
     identity: CloudIdentity;

package/dist/extension/pipeline/cloud.js

@@ -22,6 +22,7 @@ import { planTitle, runFinish, verifyTrailerValue } from "./finish.js";
 import { buildPlanFile, planMarkdown } from "./planOutput.js";
 import { cloudLane } from "./stages.js";
 import { applyStageTiers, parseStageTiers, STAGE_TIERS_ENV } from "./tierCap.js";
+import { CHECK_NOT_RUN_NOTE } from "./verify.js";
 /** Set on every stage child of a cloud session, so its prompt describes the cloud sandbox. */
 export const CLOUD_SESSION_ENV = "YAGNI_GO_CLOUD";
 /** Where the session writes `plan.md`, `plan.json` and `result.json`. */
@@ -235,6 +236,32 @@ export async function gitFacts(cwd, exec, baseSha) {
         notes,
     };
 }
+/** Checks the cannot-run note names before "and N more". */
+const MAX_NAMED_CANNOT_RUN = 5;
+/**
+ * The checks that gave no verdict because the sandbox could not run them,
+ * each with why, as one sentence for the person who reads the result: no
+ * change to the code makes them run, so the loop never held the change on
+ * them. A check only not run on this tree (its budget spent, the build
+ * stopped first, its note {@link CHECK_NOT_RUN_NOTE}) is not one: another run
+ * could give it a verdict. Null when no check could not run. Pure.
+ */
+export function cannotRunNote(checks) {
+    const unrun = checks.filter((check) => check.baseline === "cannot_run" &&
+        check.exitCode === null &&
+        !(check.note ?? "").startsWith(CHECK_NOT_RUN_NOTE));
+    if (unrun.length === 0)
+        return null;
+    const named = unrun.slice(0, MAX_NAMED_CANNOT_RUN).map((check) => {
+        const cause = (check.note ?? "")
+            .split("; `")[0]
+            .replace(/^could not run(?: in the sandbox)?:?\s*/, "")
+            .trim();
+        return `\`${check.name}\` (${cause || "could not run"})`;
+    });
+    const more = unrun.length - named.length;
+    return `No change to the code can make ${unrun.length === 1 ? "this check" : "these checks"} run here, so ${unrun.length === 1 ? "it was" : "they were"} never a finding to fix and gave no verdict on this change: ${named.join("; ")}${more > 0 ? `; and ${more} more` : ""}.`;
+}
 /** A finding as the result dedupes it: where it is and what it says. */
 function findingKey(finding) {
     return `${finding.file ?? ""}:${finding.line ?? ""}:${finding.message}`;
@@ -312,6 +339,9 @@ export async function completeCloudSession(c, ran) {
                 notes.push(`The checks could not run on the final tree: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        const unrun = cannotRunNote(checks?.checks ?? []);
+        if (unrun)
+            notes.push(unrun);
         // The loop judged the tree it last verified; what the final scan or checks
         // found blocking in the tree being committed means it did not stop clean.
         if (stop === "clean" && extra.some(isBlockingFinding)) {

package/dist/extension/pipeline/continuation.d.ts

@@ -10,9 +10,10 @@
  *    run's own change (an implement that only confirms finished work is not
  *    `no_changes`, and the verify gate scopes to the whole diff against HEAD);
  *  - an attempt that stopped in review, fix or verify re-enters the review→fix
- *    loop at the next round, through the same `resume_loop` seam a resumed
- *    interactive run uses. An attempt that stopped in implement (or before)
- *    runs implement again on the approved plan.
+ *    loop at the next round, but never on the lane's last, so its review is
+ *    always followed by a fix pass, through the same `resume_loop` seam a
+ *    resumed interactive run uses. An attempt that stopped in implement (or
+ *    before) runs implement again on the approved plan.
  *
  * The file is the host's contract, so anything unreadable is refused here and
  * the caller runs a normal mission instead of crashing.
@@ -58,11 +59,21 @@ export declare function continuesInLoop(continuation: ContinuationInputs): boole
  * the same design context.
  */
 export declare function continuationReviewInput(continuation: ContinuationInputs, mission: MissionInputs | undefined, committed?: boolean): string;
+/**
+ * The round a continuation re-enters the loop at: the earlier attempt's count
+ * goes on, but never onto the lane's last round, so the review it starts
+ * with is always followed by one fix pass before the cap can stop it. A
+ * resume onto the cap reviewed, hit the cap and stopped `round_cap` without a
+ * fix: COREX-1291's eight fix sessions (continue.json `roundsDone: 4` on the
+ * cloud lane's four rounds) each ran one review and changed nothing. A lane of
+ * one round has no fix pass to give. Pure.
+ */
+export declare function continuationRound(reviewRoundsDone: number, maxRounds: number): number;
 /**
  * The resume plan that re-enters the review→fix loop for a continuation that
  * stopped in review, fix or verify; undefined when implement must run again.
- * The round continues the earlier attempt's count, capped at the lane's last
- * round so a continuation always gets one review. `committed` is the cloud
+ * Its round is {@link continuationRound}'s, so a continuation always gets a
+ * review and a fix pass for what that review finds. `committed` is the cloud
  * lane's resume, whose earlier work is on the branch.
  */
 export declare function continuationResumePlan(continuation: ContinuationInputs, ctx: {

package/dist/extension/pipeline/continuation.js

@@ -10,9 +10,10 @@
  *    run's own change (an implement that only confirms finished work is not
  *    `no_changes`, and the verify gate scopes to the whole diff against HEAD);
  *  - an attempt that stopped in review, fix or verify re-enters the review→fix
- *    loop at the next round, through the same `resume_loop` seam a resumed
- *    interactive run uses. An attempt that stopped in implement (or before)
- *    runs implement again on the approved plan.
+ *    loop at the next round, but never on the lane's last, so its review is
+ *    always followed by a fix pass, through the same `resume_loop` seam a
+ *    resumed interactive run uses. An attempt that stopped in implement (or
+ *    before) runs implement again on the approved plan.
  *
  * The file is the host's contract, so anything unreadable is refused here and
  * the caller runs a normal mission instead of crashing.
@@ -95,11 +96,23 @@ export function continuationReviewInput(continuation, mission, committed = false
     const design = missionDesignContext(mission);
     return design ? `${summary}\n\n${design}` : summary;
 }
+/**
+ * The round a continuation re-enters the loop at: the earlier attempt's count
+ * goes on, but never onto the lane's last round, so the review it starts
+ * with is always followed by one fix pass before the cap can stop it. A
+ * resume onto the cap reviewed, hit the cap and stopped `round_cap` without a
+ * fix: COREX-1291's eight fix sessions (continue.json `roundsDone: 4` on the
+ * cloud lane's four rounds) each ran one review and changed nothing. A lane of
+ * one round has no fix pass to give. Pure.
+ */
+export function continuationRound(reviewRoundsDone, maxRounds) {
+    return Math.max(1, Math.min(reviewRoundsDone + 1, maxRounds - 1));
+}
 /**
  * The resume plan that re-enters the review→fix loop for a continuation that
  * stopped in review, fix or verify; undefined when implement must run again.
- * The round continues the earlier attempt's count, capped at the lane's last
- * round so a continuation always gets one review. `committed` is the cloud
+ * Its round is {@link continuationRound}'s, so a continuation always gets a
+ * review and a fix pass for what that review finds. `committed` is the cloud
  * lane's resume, whose earlier work is on the branch.
  */
 export function continuationResumePlan(continuation, ctx, opts = {}) {
@@ -107,7 +120,7 @@ export function continuationResumePlan(continuation, ctx, opts = {}) {
         return undefined;
     return {
         mode: "resume_loop",
-        round: Math.min(continuation.reviewRoundsDone + 1, opts.maxRounds ?? MAX_REVIEW_ROUNDS),
+        round: continuationRound(continuation.reviewRoundsDone, opts.maxRounds ?? MAX_REVIEW_ROUNDS),
         reviewInput: continuationReviewInput(continuation, ctx.mission, opts.committed),
         priorRounds: [],
         ticket: ctx.ticket,

package/dist/extension/pipeline/verify.d.ts

@@ -300,6 +300,25 @@ export declare function detectVerifyTestCommands(cwd: string, opts?: DetectOpts)
  * verify failure.
  */
 export declare function classifyVerifyInfraFailure(output: string, exitCode: number): string | null;
+/**
+ * Why a repository check gave no verdict when the paths it reads are not
+ * there: `diff` against a log an earlier plan step writes, `grep` in a folder
+ * named from the wrong root (COREX-1291: `diff: /tmp/fym-baseline-tsc.log:
+ * No such file or directory`, exit 2, eight fix sessions burned on it). The
+ * comparison never ran, so the check says nothing of the code, and a fix
+ * turn cannot make it run. Null when the output names no such path, when the
+ * tool that said so is not one the command runs (a test's own output), when
+ * a missing path is one this change touched (a file it deleted, a folder it
+ * made): that is the change's to put back, or when the rest of the output
+ * carries a located diagnostic (a compound check whose other half failed for
+ * real): the missing path is then not the whole story, and the check stays
+ * the change's failure. Pure.
+ */
+export declare function classifyMissingInput(command: string, output: string, at: {
+    repoRoot: string;
+    dir: string;
+    changedPaths?: readonly string[];
+}): string | null;
 /**
  * What a run could not start without, when its output says so in a way the
  * gate recognises: a credential or variable the environment lacks, or a

package/dist/extension/pipeline/verify.js

@@ -541,6 +541,87 @@ export function classifyVerifyInfraFailure(output, exitCode) {
     }
     return null;
 }
+/**
+ * Tools whose "No such file or directory" names a path the check reads (or,
+ * for `tee`, writes into): the comparison or search never ran.
+ */
+const PATH_READING_TOOLS = new Set("awk cat cmp comm cut diff egrep fgrep find grep head jq ls rg sed sort stat tail tee wc".split(" "));
+/**
+ * A tool's own line for a path that is not there, GNU's and BSD's: `diff:
+ * /tmp/a.log: No such file or directory`, `ls: cannot access 'x': No such
+ * file or directory`, `awk: cannot open x (No such file or directory)`.
+ */
+const MISSING_PATH_LINE = /^(?:\S*\/)?([a-z][\w-]*):\s+(.*?)\s*[:(]?\s*No such file or directory\b/;
+/** What a tool says before the path it could not open. */
+const MISSING_PATH_VERB = /^(?:(?:error|fatal):\s*)?(?:(?:cannot|can't|could not|couldn't|unable to)\s+(?:access|open|read|stat|statx)(?:\s+file)?:?\s+|IO error for operation on\s+)/i;
+/** Missing paths a cause names before "and N more". */
+const MAX_NAMED_MISSING_PATHS = 3;
+/** The path in what a tool said about it, or null when it names none plainly. */
+function missingPathIn(what) {
+    const quoted = [...what.matchAll(/[`'"‘]([^`'"’\n]+)[`'"’]/g)].at(-1)?.[1]?.trim();
+    if (quoted)
+        return quoted;
+    for (const segment of what.replace(MISSING_PATH_VERB, "").split(/:\s+/)) {
+        const path = segment.replace(/\s+for reading$/, "").trim();
+        if (path && !/\s/.test(path))
+            return path;
+    }
+    return null;
+}
+/** True when `tool` is a command the shell line runs, not a word in an argument. */
+function commandRuns(command, tool) {
+    return new RegExp(`(?:^|[\\s;&|(!{\`])(?:\\S*/)?${tool}(?=[\\s;&|)]|$)`).test(command);
+}
+/** Two repo-relative paths are one, or one holds the other. */
+function pathsOverlap(a, b) {
+    const x = a.replace(/\/+$/, "");
+    const y = b.replace(/\/+$/, "");
+    return x === y || x.startsWith(`${y}/`) || y.startsWith(`${x}/`);
+}
+/**
+ * Why a repository check gave no verdict when the paths it reads are not
+ * there: `diff` against a log an earlier plan step writes, `grep` in a folder
+ * named from the wrong root (COREX-1291: `diff: /tmp/fym-baseline-tsc.log:
+ * No such file or directory`, exit 2, eight fix sessions burned on it). The
+ * comparison never ran, so the check says nothing of the code, and a fix
+ * turn cannot make it run. Null when the output names no such path, when the
+ * tool that said so is not one the command runs (a test's own output), when
+ * a missing path is one this change touched (a file it deleted, a folder it
+ * made): that is the change's to put back, or when the rest of the output
+ * carries a located diagnostic (a compound check whose other half failed for
+ * real): the missing path is then not the whole story, and the check stays
+ * the change's failure. Pure.
+ */
+export function classifyMissingInput(command, output, at) {
+    const missing = new Map();
+    const rest = [];
+    for (const raw of output.split("\n")) {
+        const match = MISSING_PATH_LINE.exec(raw.trim());
+        const tool = match?.[1];
+        if (!match || !tool || !PATH_READING_TOOLS.has(tool) || !commandRuns(command, tool)) {
+            rest.push(raw);
+            continue;
+        }
+        const path = missingPathIn(match[2] ?? "");
+        if (!path)
+            continue;
+        const repoPath = relative(at.repoRoot, isAbsolutePath(path) ? path : join(at.dir, path)) || ".";
+        const inRepo = repoPath !== ".." && !repoPath.startsWith("../") && !isAbsolutePath(repoPath);
+        if (inRepo && (at.changedPaths ?? []).some((changed) => pathsOverlap(changed, repoPath))) {
+            return null;
+        }
+        missing.set(inRepo ? repoPath : path, inRepo);
+    }
+    if (missing.size === 0)
+        return null;
+    if (parseVerifyFailures(rest.join("\n"), 1, command).some((finding) => finding.file))
+        return null;
+    const named = [...missing]
+        .slice(0, MAX_NAMED_MISSING_PATHS)
+        .map(([path, inRepo]) => (inRepo ? path : `${path} (outside the repository)`));
+    const more = missing.size - named.length;
+    return `${missing.size === 1 ? "a path it reads does not exist" : "paths it reads do not exist"}: ${named.join(", ")}${more > 0 ? ` and ${more} more` : ""}`;
+}
 /**
  * Test-half infra/environment patterns (spec §3d): failure shapes that mean the
  * ENVIRONMENT could not run the suite — a DB that is not up, a missing env var,
@@ -1502,7 +1583,8 @@ export function makeRunVerify(opts = {}) {
      * The repository-checks half: the plan's approved checks, then the pull
      * request's CI steps its changed paths trigger. A failure becomes `critical`
      * findings the fix turn works on, except where it can never clear: a check
-     * the sandbox cannot start, an infra failure, an approved check that already
+     * the sandbox cannot start, an infra failure, a path the check reads that is
+     * not there ({@link classifyMissingInput}), an approved check that already
      * failed on the unchanged code (the host compares it after the build), and a
      * CI step that fails exactly as it did before a fix turn (it may fail on the
      * base too, and the pull request's CI shows it). Those are notes.
@@ -1599,6 +1681,7 @@ export function makeRunVerify(opts = {}) {
             approvedFailed: new Set(),
             checks: [],
             approvedRuns: new Map(),
+            changedPaths: paths,
         };
         const before = await treeStatus(cwd, signal).catch((err) => {
             const msg = err instanceof Error ? err.message : String(err);
@@ -1688,8 +1771,21 @@ export function makeRunVerify(opts = {}) {
             }
             const output = scrubSecrets(rawOutput);
             const cls = classifyTestFailure(output, code, MAX_LOCATED_FINDINGS, env);
-            if (cls.kind === "infra" && !(cls.needs && check.passedOnBase)) {
-                const reason = `could not run: ${cls.reason}`;
+            // A path the check reads that is not there (a log an earlier plan step
+            // writes, a folder named from the wrong root) gave no verdict either,
+            // unless the check passed on the unchanged code: then the change lost it.
+            // One already failing on the base is a note as it is, its record kept.
+            const cause = cls.kind === "infra" && !(cls.needs && check.passedOnBase)
+                ? cls.reason
+                : cls.kind === "uncertain" && check.baseline === "runnable" && !check.passedOnBase
+                    ? classifyMissingInput(command, output, {
+                        repoRoot: run.cwd,
+                        dir,
+                        changedPaths: run.changedPaths,
+                    })
+                    : null;
+            if (cause) {
+                const reason = `could not run: ${cause}`;
                 const entry = record("cannot_run", `${reason}; ${exitSummary(check.name, code, output)}`);
                 opts.onCheck?.(checkEnded(entry, output));
                 return { kind: "note", reason };
@@ -2370,8 +2466,13 @@ export function makeMeasureChecksOnBase(opts = {}) {
                     }
                     const output = scrubSecrets(rawOutput);
                     const cls = classifyTestFailure(output, code, Number.POSITIVE_INFINITY, env);
-                    if (cls.kind === "infra") {
-                        result.notes.push(`\`${label}\`: could not run: ${cls.reason}`);
+                    const cause = cls.kind === "infra"
+                        ? cls.reason
+                        : cls.kind === "uncertain"
+                            ? classifyMissingInput(check.command, output, { repoRoot: cwd, dir: cwd })
+                            : null;
+                    if (cause) {
+                        result.notes.push(`\`${label}\`: could not run: ${cause}`);
                         continue;
                     }
                     const found = repoCommandFindings({ output, code, env }, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.2.7-staging.2069.1",
+  "version": "1.2.8-staging.2076.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "618a0d09ec56651efeb5669dc92e21a1ce8699ef"
+  "yagniSourceSha": "54b2ac0b0df83d33d1882e399cd60c4954d673d1"
 }