agent-nuvira 3.3.1 → 3.3.4

package/dist/agents/release-preflight.js

@@ -0,0 +1,259 @@
+/**
+ * Release preflight — check the things a release cannot undo BEFORE it starts.
+ *
+ * WHY THIS EXISTS. A live release run bumped the version, committed, tagged and
+ * pushed `v3.3.2` — and only THEN discovered it could not publish, because the
+ * version-pinned CLI cast still recorded 3.3.1 and `prepublishOnly`'s test run
+ * refuses a stale artifact. Everything irreversible had already happened. A
+ * release has exactly one cheap moment: before the first phase.
+ *
+ * The checks are chosen by the same rule `credentials verify` follows — report
+ * what was MEASURED, and never fail on a check that could not be made:
+ *
+ *   1. `npm view <name>@<version>` — is this version already published? (The one
+ *      condition under which the whole run is pointless; npm is immutable, so a
+ *      second publish of 3.3.2 can only fail.)
+ *   2. The working tree — is it a git repo, is there a remote, is the branch
+ *      ahead/behind, does the target tag already exist locally or on the remote?
+ *   3. The provider×model pair — ONLY when a phase will actually call a model.
+ *      Since the release phases became deterministic that is normally zero
+ *      phases, and claiming to have verified a route nothing will use would be
+ *      exactly the kind of decorative check this repo keeps deleting.
+ *
+ * A `definitive` failure (the registry answered, the version exists, the tag is
+ * taken) blocks the run unless `--force`. An `unknown` (offline, no npm token,
+ * no network) warns and continues — a closed network must not make releases
+ * impossible, and pretending those checks passed would be worse than admitting
+ * they did not run.
+ */
+import { execSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveProvider } from '../cli/router.js';
+import { resolveRoute } from '../inference/route-resolver.js';
+import { logger } from '../utils/logger.js';
+const defaultRunner = (command, timeoutMs = 60_000) => {
+    try {
+        const output = execSync(`${command} 2>&1`, { timeout: timeoutMs, encoding: 'utf-8', stdio: 'pipe' });
+        return { ok: true, output: (output || '').trim() };
+    }
+    catch (err) {
+        const error = err;
+        return { ok: false, output: (error.stdout || error.stderr || error.message || '').trim() };
+    }
+};
+/**
+ * Read the package name/version the release concerns.
+ * Exported for tests and for the caller that computes the target version.
+ */
+export function readReleaseTarget(cwd = process.cwd()) {
+    try {
+        const raw = readFileSync(join(cwd, 'package.json'), 'utf-8');
+        const pkg = JSON.parse(raw);
+        return { name: pkg.name || '', version: pkg.version || '', private: pkg.private };
+    }
+    catch {
+        return null;
+    }
+}
+/** Is `name@version` already on the registry? */
+export function checkVersionPublished(name, version, runner = defaultRunner) {
+    const name_ = 'npm version available';
+    if (!name || !version) {
+        return { name: name_, status: 'warn', detail: 'no package name/version to check', definitive: false };
+    }
+    const result = runner(`npm view "${name}@${version}" version`, 60_000);
+    if (result.ok && result.output.includes(version)) {
+        return {
+            name: name_,
+            status: 'block',
+            detail: `${name}@${version} is ALREADY published — a second publish of the same version cannot succeed. Bump further or fix the version.`,
+            definitive: true,
+        };
+    }
+    if (!result.ok && /E404|not found|No match found/i.test(result.output)) {
+        // The definitive "this version does not exist yet" answer.
+        return { name: name_, status: 'ok', detail: `${name}@${version} is not published yet`, definitive: true };
+    }
+    // Offline, registry error, no token — an unanswerable question.
+    return {
+        name: name_,
+        status: 'warn',
+        detail: `could not check the registry (${result.output.split('\n')[0]?.slice(0, 120) || 'no output'})`,
+        definitive: false,
+    };
+}
+/** Repo/remote/tag state — the facts that make a push succeed or collide. */
+export function checkGitState(targetVersion, cwd = process.cwd(), runner = defaultRunner) {
+    const run = runner;
+    const checks = [];
+    const inside = run('git rev-parse --is-inside-work-tree', 15_000);
+    if (!inside.ok || !inside.output.includes('true')) {
+        return [{ name: 'git repository', status: 'block', detail: `${cwd} is not a git repository`, definitive: true }];
+    }
+    const remotes = run('git remote', 15_000);
+    checks.push(remotes.ok && remotes.output.trim()
+        ? { name: 'git remote', status: 'ok', detail: remotes.output.split('\n')[0].trim(), definitive: true }
+        : { name: 'git remote', status: 'block', detail: 'no git remote configured — the commit could not be pushed', definitive: true });
+    const tag = `v${targetVersion}`;
+    const localTag = run(`git tag -l "${tag}"`, 15_000);
+    const tagExistsLocally = localTag.ok && localTag.output.trim() === tag;
+    // The remote answer needs the network; a failure here is 'unknown', not 'fine'.
+    const remoteTag = run(`git ls-remote --tags origin "refs/tags/${tag}"`, 60_000);
+    const tagExistsRemotely = remoteTag.ok && remoteTag.output.trim().length > 0;
+    if (tagExistsLocally || tagExistsRemotely) {
+        checks.push({
+            name: 'release tag',
+            status: 'block',
+            detail: `${tag} already exists ${tagExistsRemotely ? 'on the remote' : 'locally'} — ` +
+                'publishing this version again is not possible; bump further or delete the tag deliberately.',
+            definitive: true,
+        });
+    }
+    else if (!remoteTag.ok) {
+        checks.push({
+            name: 'release tag',
+            status: 'warn',
+            detail: `could not check the remote for ${tag} (${remoteTag.output.split('\n')[0]?.slice(0, 100) || 'no output'})`,
+            definitive: false,
+        });
+    }
+    else {
+        checks.push({ name: 'release tag', status: 'ok', detail: `${tag} is free locally and on the remote`, definitive: true });
+    }
+    const dirty = run('git status --porcelain', 30_000);
+    if (dirty.ok) {
+        const count = dirty.output.split('\n').filter(Boolean).length;
+        checks.push({
+            name: 'working tree',
+            status: count === 0 ? 'ok' : 'warn',
+            detail: count === 0 ? 'clean' : `${count} uncommitted change(s) will be included in the release commit`,
+            definitive: true,
+        });
+    }
+    return checks;
+}
+/**
+ * Run every check. Never throws; a check that cannot run reports `warn`.
+ */
+export async function runReleasePreflight(input) {
+    const cwd = input.cwd || process.cwd();
+    const target = readReleaseTarget(cwd);
+    const checks = [];
+    if (!target) {
+        checks.push({ name: 'package.json', status: 'block', detail: `no readable package.json in ${cwd}`, definitive: true });
+    }
+    else if (target.private) {
+        checks.push({
+            name: 'package privacy',
+            status: 'block',
+            detail: 'package.json is `private: true` — npm refuses to publish it',
+            definitive: true,
+        });
+    }
+    else {
+        checks.push(...checkGitState(input.targetVersion, cwd, input.runner));
+        checks.push(checkVersionPublished(target.name, input.targetVersion, input.runner));
+    }
+    // The model pair, ONLY when a phase will call a model. Reporting a verified
+    // route nothing uses would be a decorative check.
+    if (input.needsModel) {
+        if (!input.probeModel) {
+            checks.push({
+                name: 'provider×model',
+                status: 'warn',
+                detail: 'a phase will call a model, but no probe was supplied — the route is unverified',
+                definitive: false,
+            });
+        }
+        else {
+            try {
+                const probe = await input.probeModel();
+                checks.push({
+                    name: 'provider×model',
+                    status: probe.ok ? 'ok' : probe.checked ? 'block' : 'warn',
+                    detail: probe.detail,
+                    definitive: probe.checked,
+                });
+            }
+            catch (err) {
+                checks.push({
+                    name: 'provider×model',
+                    status: 'warn',
+                    detail: `probe failed: ${err instanceof Error ? err.message : String(err)}`.slice(0, 200),
+                    definitive: false,
+                });
+            }
+        }
+    }
+    const blocked = checks.some((c) => c.status === 'block' && c.definitive);
+    return { checks, blocked, summary: formatPreflight({ checks, blocked }) };
+}
+/** One screen: what was verified, what could not be, and what stops the run. */
+export function formatPreflight(result) {
+    const icon = (c) => c.status === 'ok' ? '✅' : c.status === 'warn' ? '⚠️ ' : '❌';
+    const lines = ['📋 Release preflight'];
+    for (const c of result.checks) {
+        lines.push(`  ${icon(c)} ${c.name}: ${c.detail}`);
+    }
+    if (result.blocked) {
+        lines.push('  → These are definitive: the release is stopped before anything irreversible happens.');
+    }
+    else if (result.checks.some((c) => c.status === 'warn')) {
+        lines.push('  → Warnings could not be verified (offline / no token). The release will run; they are not claims that it passed.');
+    }
+    return lines.join('\n');
+}
+/**
+ * Verify the route a model-calling phase would use — WITHOUT spending a
+ * generation.
+ *
+ * What this genuinely proves: the provider is constructible and reachable, and
+ * the model exists on it (the resolver validates against the provider's LIVE
+ * model list, which is a real API call). What it does NOT prove: that a
+ * generation succeeds for this prompt. The detail string says exactly that, so
+ * the report cannot be read as more than it is.
+ */
+export async function probeProviderModel(configManager, providerOption, modelOption) {
+    try {
+        const resolved = resolveProvider(configManager, providerOption);
+        if (typeof resolved.provider.isAvailable === 'function' && !(await resolved.provider.isAvailable())) {
+            return { ok: false, checked: true, detail: `${resolved.type} reports itself unavailable (missing key or unreachable)` };
+        }
+        const route = await resolveRoute({
+            providerType: resolved.type,
+            provider: resolved.provider,
+            model: modelOption,
+            source: 'publish',
+            task: 'release preflight',
+        });
+        const substituted = route.substituted ? ` (requested '${route.requested}' was substituted)` : '';
+        return {
+            ok: true,
+            checked: true,
+            detail: `${resolved.type}/${route.model} exists on the provider's live model list${substituted}; ` +
+                'a generation was NOT attempted — this verifies the pair, not a successful call',
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            checked: false,
+            detail: `could not resolve the pair: ${err instanceof Error ? err.message : String(err)}`.slice(0, 200),
+        };
+    }
+}
+/** Log a preflight result at the right level for each status. */
+export function reportPreflight(result) {
+    for (const check of result.checks) {
+        const line = `  ${check.status === 'ok' ? '✅' : check.status === 'warn' ? '⚠️ ' : '❌'} preflight · ${check.name}: ${check.detail}`;
+        if (check.status === 'ok')
+            logger.info(line);
+        else
+            logger.warn(line);
+    }
+    if (result.blocked) {
+        logger.error('  ❌ preflight found a definitive blocker — the release did not start (use --force to override)');
+    }
+}
+//# sourceMappingURL=release-preflight.js.map

package/dist/agents/release-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-preflight.js","sourceRoot":"","sources":["../../src/agents/release-preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAmC5C,MAAM,aAAa,GAAkB,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,EAAE,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,OAAO,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAA6D,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC7F,CAAC;AACH,CAAC,CAAC;AAkBF;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2D,CAAC;QACtF,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,OAAe,EACf,SAAwB,aAAa;IAErC,MAAM,KAAK,GAAG,uBAAuB,CAAC;IACtC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kCAAkC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,IAAI,OAAO,WAAW,EAAE,MAAM,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO;YACL,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,+GAA+G;YACzI,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,2DAA2D;QAC3D,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,uBAAuB,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAC5G,CAAC;IACD,gEAAgE;IAChE,OAAO;QACL,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,iCAAiC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,GAAG;QACtG,UAAU,EAAE,KAAK;KAClB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,aAAqB,EACrB,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,EACnB,SAAwB,aAAa;IAErC,MAAM,GAAG,GAAG,MAAM,CAAC;IACnB,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,MAAM,MAAM,GAAG,GAAG,CAAC,qCAAqC,EAAE,MAAM,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,OAAO,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAG,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,IAAI,CACT,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;QACjC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QACtG,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,2DAA2D,EAAE,UAAU,EAAE,IAAI,EAAE,CACnI,CAAC;IAEF,MAAM,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC;IAEvE,gFAAgF;IAChF,MAAM,SAAS,GAAG,GAAG,CAAC,0CAA0C,GAAG,GAAG,EAAE,MAAM,CAAC,CAAC;IAChF,MAAM,iBAAiB,GAAG,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAE7E,IAAI,gBAAgB,IAAI,iBAAiB,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,OAAO;YACf,MAAM,EACJ,GAAG,GAAG,mBAAmB,iBAAiB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,KAAK;gBAC7E,6FAA6F;YAC/F,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,kCAAkC,GAAG,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,GAAG;YAClH,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,oCAAoC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3H,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YACnC,MAAM,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,KAAK,+DAA+D;YACvG,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAqB;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAqB,EAAE,CAAC;IAEpC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,+BAA+B,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACzH,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,6DAA6D;YACrE,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,CAAC;IAED,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,gFAAgF;gBACxF,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE,CAAC;gBACvC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;oBAC1D,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,KAAK,CAAC,OAAO;iBAC1B,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,iBAAiB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACzF,UAAU,EAAE,KAAK;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC;IACzE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,eAAe,CAAC,MAAsD;IACpF,MAAM,IAAI,GAAG,CAAC,CAAiB,EAAU,EAAE,CACzC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;IAE9D,MAAM,KAAK,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACvG,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC,oHAAoH,CAAC,CAAC;IACnI,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAA4B,EAC5B,cAAuB,EACvB,WAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;QAChE,IAAI,OAAO,QAAQ,CAAC,QAAQ,CAAC,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACpG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,0DAA0D,EAAE,CAAC;QAC1H,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;YAC/B,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QACjG,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,IAAI;YACb,MAAM,EACJ,GAAG,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,4CAA4C,WAAW,IAAI;gBAC1F,gFAAgF;SACnF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,+BAA+B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACxG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,MAAuB;IACrD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,gBAAgB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACnI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACjH,CAAC;AACH,CAAC"}

package/dist/agents/release-runner.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Release runners — the DETERMINISTIC half of the publish pipeline.
+ *
+ * `nuvira publish` defines its phases as goals ("Bump version (patch), update
+ * CHANGELOG.md with release notes") and used to hand every one of them to the
+ * LLM orchestrator. That made a mechanical release depend on plan quality and
+ * provider health: a live 3.3.2 run planned an unrelated job (add
+ * `standard-version`, write a new `scripts/release.ts`) instead of bumping the
+ * version, and the write steps then failed under a rate-limited provider. A
+ * release is not a creative task — every step here is a command with a known
+ * correct outcome — so each phase now carries a RUNNER, and the orchestrator is
+ * only used for phases that have none (e.g. the free-text `evaluate` phase of
+ * `nuvira phase add`).
+ *
+ * Properties that matter:
+ * - A runner reads the world at RUN time (version, changelog, branch, remote)
+ *   rather than closing over state, so a phase resumed later in a new process
+ *   sees the same facts the filesystem does.
+ * - Nothing is invented: the changelog entry is built from `git log`, and the
+ *   commit headline is the changelog heading when one exists.
+ * - An author-written `## vX.Y.Z` section in CHANGELOG.md is LEFT ALONE. The
+ *   generated entry is a fallback for the case where nobody wrote one, never an
+ *   overwrite of prose a human wrote.
+ * - Failures carry the command's own output as the error, so the summary line
+ *   the user reads says what npm/git actually said.
+ * - A phase refuses the work it must not do, rather than doing it and reporting
+ *   afterwards: the git phase will not tag a release that changes the dependency
+ *   set, and the version phase will not commit a version whose pinned artifacts
+ *   are stale.
+ */
+export type BumpType = 'patch' | 'minor' | 'major';
+export interface PhaseRunOutcome {
+    success: boolean;
+    summary: string;
+    error?: string;
+    details?: string;
+}
+/** A phase's deterministic implementation. No arguments: it reads the world. */
+export type ReleasePhaseRunner = () => Promise<PhaseRunOutcome>;
+/** Phase ids produced by `buildPublishPhases` — the runner table's keys. */
+export declare const RELEASE_PHASE_IDS: {
+    readonly tests: "phase-1-tests";
+    readonly version: "phase-2-version";
+    readonly git: "phase-3-git";
+    readonly npm: "phase-4-npm";
+    readonly github: "phase-5-github";
+};
+/**
+ * What actually failed, in the form an operator can act on.
+ *
+ * WHY. A failed Test Verification used to report `tail(output, 400)`, which on a
+ * real vitest run is a few characters of the LAST line — the reader learns the
+ * suite failed but not which file, which test, or why, and has to re-run the
+ * suite by hand to find out. That is the difference between a pipeline that can
+ * only refuse and one that can be repaired: the diagnosis is the deliverable.
+ * Measured on the release that surfaced this: 7 files and 25 timeouts, none of
+ * them named by the pipeline.
+ */
+export interface TestFailureShape {
+    /** The failing test files vitest reported, deduped. */
+    files: string[];
+    /** The failure signatures found, e.g. `Test timed out in 15000ms`. */
+    kinds: string[];
+    /**
+     * EVERY failure was a timeout. Worth its own flag because a timeout is a claim
+     * about scheduling or a live network path, not about the code — it is the
+     * difference between "the work is broken" and "the machine or the environment
+     * was". A release must not be graded on the second by accident.
+     */
+    timeoutsOnly: boolean;
+}
+/** Read what failed out of a vitest run, in a form a caller can act on. */
+export declare function testFailureShape(output: string): TestFailureShape;
+/**
+ * The digest a failed Test Verification reports: which files, what kind, and
+ * whether the shape is the one that means "re-run before blaming the code".
+ */
+export declare function testFailureDigest(output: string, context?: string): string;
+interface PackageManifest {
+    version?: string;
+    scripts?: Record<string, string>;
+    [key: string]: unknown;
+}
+export declare function readManifest(cwd?: string): PackageManifest | null;
+export declare function readVersion(cwd?: string): string;
+/** Pure version arithmetic — exported so it can be pinned by test. */
+export declare function bumpVersionString(current: string, bumpType: BumpType): string;
+/** The tag this release is measured from — version tags only (`v3.3.1`). */
+export declare function lastReleaseTag(): string;
+export declare function commitsSince(base: string): string[];
+/** Does CHANGELOG.md already have a section for this version? Section = `## vX.Y.Z`. */
+export declare function hasChangelogSection(version: string, changelog: string): boolean;
+/**
+ * The headline of `## vX.Y.Z — headline`, used as the commit subject.
+ * Returns '' when the section carries no headline.
+ */
+export declare function changelogHeadline(version: string, changelog: string): string;
+/** The full text of the `## vX.Y.Z` section, for GitHub release notes. */
+export declare function changelogSection(version: string, changelog: string): string;
+export declare function runTestsPhase(): Promise<PhaseRunOutcome>;
+export declare function runVersionBumpPhase(bumpType?: BumpType): Promise<PhaseRunOutcome>;
+export declare function dependencyDelta(cwd?: string): string[];
+/**
+ * Which dependencies moved in a NESTED manifest — staged content vs HEAD's.
+ *
+ * `null` means NO CLAIM CAN BE MADE: the staged content cannot be read, the file
+ * is new (there is no HEAD side), or it is not JSON. A caller must treat `null`
+ * as unverifiable rather than as "nothing moved" — this guard exists so a
+ * dependency cannot enter a tagged release unseen, and "I could not read it" is
+ * not "it is fine".
+ */
+export declare function nestedDependencyDelta(path: string, cwd?: string): string[] | null;
+export interface NestedManifestVerdict {
+    /** Dependency edits the guard can name, as `<path>: +pkg (section)`. */
+    moved: string[];
+    /** Manifests it can make no claim about: new, deleted, unreadable, or a lockfile. */
+    unverifiable: string[];
+}
+/**
+ * Decide what a release commit should do about the nested manifests it carries.
+ *
+ * WHY IT IS NOT "refuse every nested manifest edit". That was the first version,
+ * and it produced a FALSE POSITIVE the first time it ran for real: three
+ * sub-package manifests (`packages/sdk`, `src/agent-sdk`, `vscode-extension`)
+ * whose entire diff was a `repository` / `homepage` URL pointing at the new docs
+ * repo. No dependencies moved, yet the release could not be completed without
+ * `NUVIRA_ALLOW_DEP_CHANGES=1` — and an override that gets used on a false alarm
+ * is an override that stops meaning anything. A URL edit and a dependency edit
+ * are distinguishable, so the guard distinguishes them and keeps its teeth for
+ * the case it was built for.
+ *
+ * Lockfiles stay unverifiable on purpose: `yarn.lock`, `pnpm-lock.yaml` and
+ * `bun.lock` are not JSON, and a nested lockfile only moves when its sibling's
+ * dependencies do.
+ */
+export declare function evaluateNestedManifests(paths: string[], deltaOf: (path: string) => string[] | null): NestedManifestVerdict;
+/**
+ * Run the project's own hook for artifacts that embed the version.
+ *
+ * The hook is an explicit npm script rather than a guess at which directories
+ * are generated: a project that needs one declares `release:artifacts`, and a
+ * project without it skips this cleanly. Guessing by path ("rebuild if `public/`
+ * is tracked") would be wrong in both directions, and wrong silently.
+ */
+export declare function regenerateVersionPinnedArtifacts(): Promise<PhaseRunOutcome>;
+export declare function runGitPhase(): Promise<PhaseRunOutcome>;
+/** Turn npm's exit text into the sentence the user needs. */
+export declare function describeNpmError(output: string): string;
+export declare function runNpmPhase(): Promise<PhaseRunOutcome>;
+export declare function runGitHubReleasePhase(): Promise<PhaseRunOutcome>;
+/**
+ * The deterministic implementation for every phase `buildPublishPhases`
+ * produces. A phase whose id is absent here keeps the orchestrator.
+ */
+export declare function createReleaseRunners(bumpType: BumpType): Record<string, ReleasePhaseRunner>;
+export {};
+//# sourceMappingURL=release-runner.d.ts.map

package/dist/agents/release-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-runner.d.ts","sourceRoot":"","sources":["../../src/agents/release-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAYH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEnD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;AAEhE,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB;;;;;;CAMpB,CAAC;AAsCX;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAsBjE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAiB1E;AAID,UAAU,eAAe;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wBAAgB,YAAY,CAAC,GAAG,SAAgB,GAAG,eAAe,GAAG,IAAI,CAQxE;AAED,wBAAgB,WAAW,CAAC,GAAG,SAAgB,GAAG,MAAM,CAEvD;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAM7E;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAKnD;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAO/E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAI5E;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQ3E;AAaD,wBAAsB,aAAa,IAAI,OAAO,CAAC,eAAe,CAAC,CA2E9D;AAID,wBAAsB,mBAAmB,CAAC,QAAQ,GAAE,QAAkB,GAAG,OAAO,CAAC,eAAe,CAAC,CAgFhG;AAyBD,wBAAgB,eAAe,CAAC,GAAG,SAAgB,GAAG,MAAM,EAAE,CA0B7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAgB,GAAG,MAAM,EAAE,GAAG,IAAI,CA0BxF;AAED,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,qFAAqF;IACrF,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,GAAG,IAAI,GACzC,qBAAqB,CAkBvB;AAED;;;;;;;GAOG;AACH,wBAAsB,gCAAgC,IAAI,OAAO,CAAC,eAAe,CAAC,CAiBjF;AAID,wBAAsB,WAAW,IAAI,OAAO,CAAC,eAAe,CAAC,CA+J5D;AAID,6DAA6D;AAC7D,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAWvD;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,eAAe,CAAC,CAwB5D;AAID,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,eAAe,CAAC,CAqCtE;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAQ3F"}