baro-ai 0.117.2 → 0.117.4

package/dist/cli.mjs

@@ -20810,7 +20810,7 @@ var require_websocket = __commonJS({
     var http3 = __require("http");
     var net = __require("net");
     var tls = __require("tls");
-    var { randomBytes: randomBytes5, createHash: createHash20 } = __require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash21 } = __require("crypto");
     var { Duplex, Readable: Readable2 } = __require("stream");
     var { URL: URL2 } = __require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -21478,7 +21478,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash20("sha1").update(key + GUID).digest("base64");
+        const digest = createHash21("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -21847,7 +21847,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = __require("events");
     var http3 = __require("http");
     var { Duplex } = __require("stream");
-    var { createHash: createHash20 } = __require("crypto");
+    var { createHash: createHash21 } = __require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -22154,7 +22154,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash20("sha1").update(key + GUID).digest("base64");
+        const digest = createHash21("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -55271,7 +55271,7 @@ function asRecord(value) {
 }
 
 // ../baro-orchestrator/src/execution/collective-board.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { createHash as createHash14, randomUUID as randomUUID5 } from "crypto";
 
 // ../baro-orchestrator/src/planning/domain/runtime-amendments.ts
 import { createHash as createHash10 } from "crypto";
@@ -60108,7 +60108,12 @@ var CollectiveBoard = class extends SerializedObserver {
       baseGraphVersion: this.runtimeReplans.graphVersion,
       reason: `autonomous remediation for ${invariantIds.join(", ")}: ` + remediation.reason,
       mutation: {
-        addedStories: [remediation.story],
+        addedStories: [
+          this.withRemediationPrerequisites(
+            remediation.story,
+            invariantIds
+          )
+        ],
         removedStoryIds: [],
         modifiedDeps: {}
       }
@@ -60162,6 +60167,23 @@ var CollectiveBoard = class extends SerializedObserver {
       else this.scheduleNextWave();
     }
   }
+  /**
+   * A remediation waits for every queued, not-yet-integrated story already
+   * working the same invariants — e.g. the chain a surgeon split out of the
+   * previous remediation. Running beside that chain, it re-attempts work
+   * whose prerequisite has not landed and the review rejects it every turn
+   * (#199). Leased stories are left out: the story that raised the challenge
+   * is one, and a remediation must not wait on its own source.
+   */
+  withRemediationPrerequisites(story, invariantIds) {
+    const targets = new Set(invariantIds);
+    const prerequisites = (this.prd?.userStories ?? []).filter((candidate) => candidate.id !== story.id && !candidate.passes && !this.completed.includes(candidate.id) && !this.failed.has(candidate.id) && !this.leases.has(candidate.id) && (candidate.goalInvariantIds ?? []).some((id) => targets.has(id))).map(({ id }) => id);
+    if (prerequisites.length === 0) return story;
+    return {
+      ...story,
+      dependsOn: [.../* @__PURE__ */ new Set([...story.dependsOn, ...prerequisites])].sort()
+    };
+  }
   emitGoalRemediationAdmitted(remediation, graphVersion, disposition) {
     this.emit(
       GoalInvariantRemediationAdmitted.create({
@@ -60235,8 +60257,13 @@ var CollectiveBoard = class extends SerializedObserver {
     });
   }
   executeRuntimeReplan(queued, additionalImmutableStoryIds = [], retractedStoryIds = []) {
-    const { proposal, requireActiveLease } = queued;
-    const lease = this.leases.get(proposal.sourceStoryId);
+    const { requireActiveLease } = queued;
+    const lease = this.leases.get(queued.proposal.sourceStoryId);
+    const { proposal, selfBlock } = splitSelfDependency(
+      queued.proposal,
+      requireActiveLease ? lease : void 0,
+      this.prd
+    );
     const immutableStoryIds = this.runtimeImmutableStoryIds();
     for (const storyId of additionalImmutableStoryIds) {
       immutableStoryIds.add(storyId);
@@ -60265,6 +60292,7 @@ var CollectiveBoard = class extends SerializedObserver {
         })
       );
       this.reconcileRuntimeGraphApplication(outcome.applied);
+      if (selfBlock) this.onWorkBlocked(selfBlock);
       return outcome;
     }
     this.emitGraphDecision(outcome.event);
@@ -61243,7 +61271,8 @@ function addUnique(values, value) {
   if (!values.includes(value)) values.push(value);
 }
 function sameRemediationStory(current, expected) {
-  return current.id === expected.id && current.priority === expected.priority && current.title === expected.title && current.description === expected.description && sameStrings(current.dependsOn, expected.dependsOn) && current.retries === (expected.retries ?? 2) && sameStrings(current.acceptance, expected.acceptance ?? []) && sameStrings(current.tests, expected.tests ?? []) && sameStrings(
+  return current.id === expected.id && current.priority === expected.priority && current.title === expected.title && current.description === expected.description && // Admission may add same-invariant prerequisites to the proposal.
+  expected.dependsOn.every((id) => current.dependsOn.includes(id)) && sameStrings(current.acceptance, expected.acceptance ?? []) && sameStrings(current.tests, expected.tests ?? []) && sameStrings(
     current.goalInvariantIds ?? [],
     expected.goalInvariantIds ?? []
   ) && current.model === expected.model;
@@ -61268,6 +61297,34 @@ function nonNegativeSafeInteger(value) {
 function nonNegativeFinite(value) {
   return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : null;
 }
+function splitSelfDependency(proposal, lease, prd) {
+  const source = proposal.sourceStoryId;
+  const own = proposal.mutation.modifiedDeps[source];
+  if (!own || !lease || lease.leaseId !== proposal.leaseId || lease.generation !== proposal.generation) return { proposal };
+  const otherDeps = Object.fromEntries(
+    Object.entries(proposal.mutation.modifiedDeps).filter(([storyId]) => storyId !== source)
+  );
+  const stripped = {
+    ...proposal,
+    mutation: { ...proposal.mutation, modifiedDeps: otherDeps }
+  };
+  if (stripped.mutation.addedStories.length === 0 && stripped.mutation.removedStoryIds.length === 0 && Object.keys(otherDeps).length === 0) return { proposal };
+  const current = prd?.userStories.find(({ id }) => id === source)?.dependsOn ?? [];
+  const required2 = [...new Set(own.filter((id) => !current.includes(id)))];
+  if (required2.length === 0) return { proposal: stripped };
+  return {
+    proposal: stripped,
+    selfBlock: {
+      runId: proposal.runId,
+      blockId: `self-${createHash14("sha256").update(proposal.proposalId).digest("hex").slice(0, 24)}`,
+      storyId: source,
+      leaseId: proposal.leaseId,
+      generation: proposal.generation,
+      requiredStoryIds: required2,
+      reason: proposal.reason
+    }
+  };
+}
 function validDependencyBlock(request) {
   return request.blockId.trim().length > 0 && request.blockId.length <= 200 && request.reason.trim().length > 0 && request.reason.length <= 8e3 && request.requiredStoryIds.length > 0 && request.requiredStoryIds.length <= 32 && request.requiredStoryIds.every(
     (storyId) => storyId.trim().length > 0 && storyId.trim() === storyId && storyId.length <= 128
@@ -61326,7 +61383,7 @@ function sharedAbortCode(codes) {
 }
 
 // ../baro-orchestrator/src/goal/goal-guardian.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 var MAX_AGGREGATE_REMEDIATIONS_PER_INVARIANT = 3;
 var GoalGuardian = class extends BaseObserver {
   constructor(opts) {
@@ -61581,7 +61638,7 @@ var GoalGuardian = class extends BaseObserver {
       ({ invariantId }) => !this.contract.invariants.some(({ id }) => id === invariantId)
     )) return false;
     const canonical = [...targets].sort((left, right) => left.invariantId.localeCompare(right.invariantId) || left.challengeId.localeCompare(right.challengeId));
-    const digest = createHash14("sha256").update(this.contract.contractId).update("\0").update(canonical.length === 1 ? canonical[0].challengeId : canonical.map(({ challengeId, invariantId }) => `${invariantId}\0${challengeId}`).join("\0")).update(retryOf ? `\0retry-of\0${retryOf}` : "").digest("hex");
+    const digest = createHash15("sha256").update(this.contract.contractId).update("\0").update(canonical.length === 1 ? canonical[0].challengeId : canonical.map(({ challengeId, invariantId }) => `${invariantId}\0${challengeId}`).join("\0")).update(retryOf ? `\0retry-of\0${retryOf}` : "").digest("hex");
     return this.ledger.bindChallengeRemediationGroup(
       canonical.map(({ challengeId }) => challengeId),
       {
@@ -61648,7 +61705,7 @@ var GoalGuardian = class extends BaseObserver {
     if (this.ledger.hasOpenChallenge(invariantId)) return false;
     if (kind === "aggregate" && this.ledger.aggregateRemediationCount(invariantId) >= MAX_AGGREGATE_REMEDIATIONS_PER_INVARIANT) return false;
     const ordinal = this.ledger.challengeCount(invariantId) + 1;
-    const digest = createHash14("sha256").update(this.contract.contractId).update(`\0${kind}\0`).update(invariantId).update("\0").update(String(ordinal)).digest("hex");
+    const digest = createHash15("sha256").update(this.contract.contractId).update(`\0${kind}\0`).update(invariantId).update("\0").update(String(ordinal)).digest("hex");
     const challengeId = `${kind}-${invariantId.toLowerCase()}-${digest.slice(0, 12)}`;
     this.ledger.raiseChallenge({
       challengeId,
@@ -61679,7 +61736,7 @@ var GoalGuardian = class extends BaseObserver {
     )) return false;
     const targets = uniqueReviews.map(({ invariantId, reason }) => {
       const ordinal = this.ledger.challengeCount(invariantId) + 1;
-      const digest = createHash14("sha256").update(this.contract.contractId).update("\0aggregate-group\0").update(remediationGroupId).update("\0").update(invariantId).update("\0").update(String(ordinal)).digest("hex");
+      const digest = createHash15("sha256").update(this.contract.contractId).update("\0aggregate-group\0").update(remediationGroupId).update("\0").update(invariantId).update("\0").update(String(ordinal)).digest("hex");
       return {
         challengeId: `aggregate-${invariantId.toLowerCase()}-${digest.slice(0, 12)}`,
         invariantId,
@@ -62016,6 +62073,7 @@ function boundedChallengeReason(reason) {
   const cut = sentenceEnd > MAX_CRITERION_REASON_CHARS / 2 ? window2.slice(0, sentenceEnd + 1) : window2.slice(0, Math.max(window2.lastIndexOf(" "), 1));
   return `${cut} \u2026 [truncated; the full reasoning is in the story description]`;
 }
+var REMEDIATION_STORY_RETRIES = 0;
 function legacyRemediationStory(storyId, { challenge, invariant }) {
   return {
     id: storyId,
@@ -62025,7 +62083,7 @@ function legacyRemediationStory(storyId, { challenge, invariant }) {
 Observed risk: ${challenge.reason}
 Implement the smallest correct fix and focused regression evidence; preserve every other GoalContract invariant.`,
     dependsOn: [],
-    retries: 2,
+    retries: REMEDIATION_STORY_RETRIES,
     acceptance: [
       `[${invariant.id}] ${invariant.text}`,
       `Challenge ${challenge.challengeId} is addressed: ${boundedChallengeReason(challenge.reason)}`,
@@ -62047,7 +62105,7 @@ function groupedRemediationStory(storyId, targets) {
 ` + targets.map(({ challenge, invariant }) => `[${invariant.id}] ${invariant.text}
 Observed risk: ${challenge.reason}`).join("\n") + "\nImplement the smallest correct fix and focused regression evidence; preserve every other GoalContract invariant.",
     dependsOn: [],
-    retries: 2,
+    retries: REMEDIATION_STORY_RETRIES,
     acceptance: [
       ...targets.map(({ invariant }) => `[${invariant.id}] ${invariant.text}`),
       ...targets.map(({ challenge }) => `Challenge ${challenge.challengeId} is addressed: ${boundedChallengeReason(challenge.reason)}`),
@@ -63252,7 +63310,7 @@ function extractVerdictJson(text2) {
 }
 
 // ../baro-orchestrator/src/acceptance/critic-evidence.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { constants } from "fs";
 import { lstat as lstat2, open, readlink, realpath } from "fs/promises";
 import { isAbsolute as isAbsolute6, relative as relative7, resolve as resolve10, sep as sep4 } from "path";
@@ -63792,7 +63850,7 @@ async function changedContentFingerprint(target, timeoutMs) {
       `changed-content fingerprint exceeds ${MAX_FINGERPRINT_PATHS} paths`
     );
   }
-  const hash = createHash15("sha256");
+  const hash = createHash16("sha256");
   hashField(hash, "schema", "baro-critic-changed-content-v1");
   hashField(hash, "base", base);
   let totalBytes = 0;
@@ -63932,7 +63990,13 @@ async function assertNoSymlinkParents(cwd, absolute) {
   let current = resolve10(cwd);
   for (const part of parts.slice(0, -1)) {
     current = resolve10(current, part);
-    const stat2 = await lstat2(current);
+    let stat2;
+    try {
+      stat2 = await lstat2(current);
+    } catch (error) {
+      if (errorCode(error) === "ENOENT") return;
+      throw error;
+    }
     if (stat2.isSymbolicLink() || !stat2.isDirectory()) {
       throw new Error(
         "fingerprint path has a symlink or non-directory parent"
@@ -65406,7 +65470,7 @@ var CriticTargetRegistry = class extends BaseObserver {
 var import_cross_spawn3 = __toESM(require_cross_spawn(), 1);
 
 // ../baro-orchestrator/src/harness/codex/failure-diagnostics.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { stripVTControlCharacters } from "util";
 var MAX_MESSAGE_BYTES = 2 * 1024;
 var MAX_IDENTIFIER_BYTES = 128;
@@ -65565,7 +65629,7 @@ function mcpDiagnostic(lifecycle, item, redactionEnvironment) {
   const server = firstString(item, ["server", "server_name"]);
   const tool = firstString(item, ["tool", "tool_name", "name"]);
   const status = normalizedStatus(item.status);
-  const keyHash = createHash16("sha256");
+  const keyHash = createHash17("sha256");
   if (id) keyHash.update("id\0").update(id);
   else {
     keyHash.update("anonymous\0").update(server ?? "?").update("\0").update(tool ?? "?");
@@ -71520,10 +71584,10 @@ var GitCoordinator = class extends SerializedObserver {
 };
 
 // ../baro-orchestrator/src/goal/goal-invariant-reviewer.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 
 // ../baro-orchestrator/src/goal/goal-invariant-review-evidence.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import { constants as constants2 } from "fs";
 import { lstat as lstat3, open as open2, readlink as readlink2, realpath as realpath2 } from "fs/promises";
 import { isAbsolute as isAbsolute7, relative as relative8, resolve as resolve11, sep as sep5 } from "path";
@@ -71701,7 +71765,7 @@ async function collectStableRepositoryEvidence(cwd, baseSha, deadline) {
   }
   return {
     evidence: after,
-    fingerprint: createHash17("sha256").update("baro-goal-review-repository-v1\0").update(after, "utf8").digest("hex")
+    fingerprint: createHash18("sha256").update("baro-goal-review-repository-v1\0").update(after, "utf8").digest("hex")
   };
 }
 async function collectLosslessRepositoryEvidence(cwdValue, baseShaValue, deadline) {
@@ -73183,7 +73247,7 @@ function parseRemediationGroups(value, verdict, violatedCriteria, groupNamespace
 }
 function deterministicRemediationGroupId(invariantIds, namespace = "legacy") {
   const canonical = [...invariantIds].sort();
-  const digest = createHash18("sha256").update("baro-goal-remediation-group-v1\0").update(namespace).update("\0").update(canonical.join("\0")).digest("hex");
+  const digest = createHash19("sha256").update("baro-goal-remediation-group-v1\0").update(namespace).update("\0").update(canonical.join("\0")).digest("hex");
   return `goal-remediation-group-${digest.slice(0, 24)}`;
 }
 function aggregateStatus(invariants) {
@@ -76301,7 +76365,7 @@ function jsonQuotedShellArgument(value) {
 }
 
 // ../baro-orchestrator/src/telemetry/model-telemetry-collector.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 var ModelTelemetryCollector = class extends SerializedObserver {
   constructor(opts) {
     super();
@@ -76692,7 +76756,7 @@ function routeKey(storyId, correlation) {
   ]) : storyId;
 }
 function terminalFingerprint2(event, correlation) {
-  return createHash19("sha256").update(event.type).update("\0").update(JSON.stringify(event.data)).update("\0").update(correlation ? routeKey(correlation.storyId, correlation) : "legacy").digest("hex");
+  return createHash20("sha256").update(event.type).update("\0").update(JSON.stringify(event.data)).update("\0").update(correlation ? routeKey(correlation.storyId, correlation) : "legacy").digest("hex");
 }
 
 // ../baro-orchestrator/src/execution/operator.ts
@@ -83962,6 +84026,7 @@ function createRuntimeReplanTool(graphVersion) {
         },
         modifiedDeps: {
           type: "object",
+          description: "Record<storyId, full dependsOn>. Started stories are immutable, except your own: when stories you add here are prerequisites of THIS story, set your own id to your dependsOn plus their ids \u2014 the Board adds them, then suspends this story and resumes it after they integrate. Stop working once that is applied.",
           additionalProperties: {
             type: "array",
             items: { type: "string" }
@@ -87713,7 +87778,7 @@ var StoryFactory = class extends BaseObserver {
       ...includeCliDagMutationCommands ? [
         ...graphVersion !== void 0 ? [
           `- The launch DAG version is ${graphVersion}. To atomically add, replace, or rewire future work and receive the Board's decision immediately: ${command} emit ${capability} --kind replan --base-version ${graphVersion} --replan-json ${JSON.stringify('{"addedStories":[],"removedStoryIds":[],"modifiedDeps":{}}')} --reason ${JSON.stringify("WHY THE PLAN MUST CHANGE")}`,
-          "  Use the newest `graphVersion` returned by a prior decision. Active/already-started stories are immutable; express additional work as future stories.",
+          "  Use the newest `graphVersion` returned by a prior decision. Active/already-started stories are immutable; express additional work as future stories. The one exception is your own story: when stories you add are its prerequisites, also set `modifiedDeps` for your own id to your dependsOn plus their ids \u2014 the Board then suspends this story until they integrate, so stop work once the replan is applied.",
           `  If replan exits 3 or returns \`outcome_unknown\`, do not assume whether it applied. Resolve that same proposal before continuing: ${command} decision ${capability} --proposal ${JSON.stringify("PROPOSAL_ID")} --wait-ms 30000`
         ] : []
       ] : [],