amsd-pipeline-shared 0.5.0 → 0.5.2

package/orchestrations/scripts/lib/engine-paths.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# What the ENGINE owns — the bash half of src/config/enginePaths.ts.
+#
+# These directories hold epam-cli's own state: knowledge base, agent profiles, run logs,
+# code indexes, telemetry, contracts. None of it is client content, none of it is writer
+# output, and none of it may be committed into a client codeline.
+#
+# ONE definition, because this rule has already drifted three ways. lib/git-ops.sh carried
+# the full list, worktree-health-check.sh excluded only orchestrations/logs/* (so
+# orchestrations/agents/KB.md passed straight through), Step 9's auto-commit excluded
+# nothing, and lib/story-outputs.sh had its own separate regex covering only two of the
+# five. Live metrolinx 20260804T225443Z: the engine's KB.md was written into the upexpress
+# client repo and recorded as writer output in that lane's manifest.
+#
+# The real perimeter is the WRITE seam (src/config/enginePaths.ts, enforced in
+# WriteFileTool). Everything here is defence in depth.
+
+_ENGINE_OWNED_DIRS=( 'orchestrations' '.epam' '.codegraph' '.deepeval' '.contracts' )
+
+# engine_paths_filter — stdin: repo-relative paths. stdout: those that are NOT engine-owned.
+#
+# Matches whole path SEGMENTS, never a substring: `src/orchestrations-ui/App.tsx` is client
+# code and must survive, while `orchestrations/agents/KB.md` and
+# `packages/web/.epam/settings.json` must both be dropped.
+engine_paths_filter() {
+    local _line
+    local _owned_list
+    _owned_list=$(printf '%s\n' "${_ENGINE_OWNED_DIRS[@]}")
+    while IFS= read -r _line; do
+        [ -n "$_line" ] || continue
+        # -x -F: exact, literal, whole-segment. No pattern matching.
+        if printf '%s\n' "$_line" | tr '/' '\n' | grep -qxF "$_owned_list" 2>/dev/null; then
+            continue
+        fi
+        printf '%s\n' "$_line"
+    done
+}
+
+# engine_paths_pathspec — the same owned set, as git pathspec exclusions.
+#
+# engine_paths_filter above filters a LIST of paths. Some callers need the exclusion applied by
+# git itself, because their output is a patch rather than a list and there are no paths to filter.
+# Both read _ENGINE_OWNED_DIRS, so the set is defined once: restating it in pathspec form at a
+# call site is how this rule has already drifted three ways.
+#
+# Usage:  mapfile -t _ex < <(engine_paths_pathspec); git diff <ref> -- . "${_ex[@]}"
+engine_paths_pathspec() {
+    local _d
+    for _d in "${_ENGINE_OWNED_DIRS[@]}"; do
+        printf ':!%s/*\n:!*/%s/*\n' "$_d" "$_d"
+    done
+}

package/orchestrations/scripts/lib/flags.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# ─────────────────────────────────────────────────────────────────────────────
+# lib/flags.sh — ONE helper owns whether a boolean env flag is on.
+#
+# THE BUG THIS EXISTS FOR (hit live 2026-08-03): a run was launched with
+# SKIP_REGRESSION_GUARD=1 and Step 5 ran anyway, because that check was
+# `[ "${SKIP_REGRESSION_GUARD:-false}" != "true" ]` — only the literal string
+# `true` worked. The flag silently did nothing and the operator had no signal.
+#
+# THE ACTUAL DEFECT was not one flag: the codebase ran TWO conventions at once —
+#   != "true" : SKIP_REGRESSION_GUARD, SKIP_PRE_REVIEW_GATE, SKIP_LINT_GATE, SKIP_AUTO_PR
+#   != "1"    : SKIP_CPA, SKIP_TC_WRITER, SKIP_SKILL_ASSESSMENT, SKIP_GATE_REMEDIATION
+# so `SKIP_REGRESSION_GUARD=1` failed precisely BECAUSE it matched the other half
+# of the same codebase. Every flag was a coin flip. A flag that silently does
+# nothing is the same failure class as a gate that logs instead of blocking: the
+# operator believes an instruction took effect when it did not.
+#
+# Usage — always pass a `:-` default so `set -u` cannot trip:
+#     if is_truthy "${SKIP_SOMETHING:-}"; then ... ; fi
+#     ! is_truthy "${SKIP_SOMETHING:-}" && run_the_thing
+#
+# Unset or empty is FALSE, so a gate is never skipped by accident — the safe
+# default survives a typo in the variable name.
+#
+# Guarded by test/unit/orchestration/env-flags-truthy.test.ts, which also fails
+# if any SKIP_* flag anywhere goes back to a bare literal comparison.
+# ─────────────────────────────────────────────────────────────────────────────
+
+# is_truthy <value> — 0 (success) when the value means "on".
+# Accepts 1 / true / yes / on, case-insensitive. Everything else is off.
+is_truthy() {
+    local _v="${1:-}"
+    _v="$(printf '%s' "$_v" | tr '[:upper:]' '[:lower:]')"
+    case "$_v" in
+        1|true|yes|on) return 0 ;;
+        *) return 1 ;;
+    esac
+}