carthagent 1.0.7 → 1.1.0-preview.13

package/evaluate.mjs

@@ -23,7 +23,33 @@ const { values: args } = parseArgs({ options: {
   timeout: { type: 'string', default: '600' }, 'max-turns': { type: 'string', default: '100' }, 'max-cost': { type: 'string', default: '3' },
   python: { type: 'string' }, 'seed-from': { type: 'string' }, 'allow-live': { type: 'boolean', default: false },
   'dry-run': { type: 'boolean', default: false },
+  help: { type: 'boolean', short: 'h', default: false },
 } });
+if (args.help) {
+  console.log(`Usage: ctg eval [options]
+
+Opt-in live A/B evaluation of baseline vs custom configurations against a
+scenario manifest under scenarios/<name>/. Live calls spend API credit and
+generated code runs with your permissions, so a run must be explicit.
+
+Options:
+  --mode baseline|custom|both   What to evaluate (default both)
+  --task <name>                  Scenario short name (default cli)
+  --scenario <name>              Scenario directory (overrides --task)
+  --model <id>                   Model id
+  --provider <name>              Provider name; needs <PROVIDER>_API_KEY
+  --thinking <level>             Thinking level (default medium)
+  --timeout <seconds>            Per-run timeout, max 3600 (default 600)
+  --max-turns <n>                Turn budget, max 1000 (default 100)
+  --max-cost <usd>               Cost budget (default 3)
+  --python <path>                Python executable for scenarios that need it
+  --seed-from <dir>              Continue from a previous candidate directory
+  --allow-live                   Confirm live provider calls
+  --dry-run                      Assemble and preview without calling a provider
+  --help, -h                     Show this help
+`);
+  process.exit(0);
+}
 if (!args['allow-live'] && !args['dry-run']) throw Error('Live calls spend API credit and generated code runs with your permissions. Use --allow-live explicitly (or --dry-run to preview the assembled run without calling a provider).');
 if (!['baseline', 'custom', 'both'].includes(args.mode)) throw Error('Use --mode baseline|custom|both');
 for (const key of ['timeout', 'max-turns', 'max-cost']) if (!(Number(args[key]) > 0 && Number.isFinite(Number(args[key])))) throw Error(`Invalid ${key}`);
@@ -197,7 +223,8 @@ for (const mode of args.mode === 'both' ? ['baseline', 'custom'] : [args.mode])
     cwd,
     evidenceSchema: 2,
     runtime: NATIVE_EVALUATION_RUNTIME,
-    runtimeVersion: result.opencodeVersion,
+    compatibilityVersion: result.compatibilityVersion,
+    runtimeVersion: result.runtimeVersion,
     exitCode: result.exitCode,
     timedOut: result.timedOut,
     budgetReason: result.budgetReason,

package/lib/budget.mjs

@@ -22,7 +22,7 @@ export function budgetReason(budget, action, now = Date.now()) {
 
 export function validateBudgetOptions(opts, { allowWithoutDelivery = false } = {}) {
   const keys = ['maxTools', 'maxSeconds', 'maxRepairs'];
-  if (!allowWithoutDelivery && opts.delivery === false && keys.some(key => opts[key] !== undefined)) {
+if (!allowWithoutDelivery && opts.delivery === false && keys.some(key => opts[key] !== undefined)) {
     throw Error('Budget options require the delivery extension');
   }
   budgetLimits(flag => opts[{ 'delivery-max-tools': 'maxTools', 'delivery-max-seconds': 'maxSeconds', 'delivery-max-repairs': 'maxRepairs' }[flag]]);

package/lib/codegraph.mjs

@@ -153,7 +153,7 @@ const parsers = new Map(); // lang -> dedicated parser (setLanguage once; concur
 async function parserFor(lang) {
   if (!runtimePromise) {
     runtimePromise = (async () => {
-      const Parser = require_('web-tree-sitter');
+      const Parser = require_('web-tree-sitter-legacy');
       await Parser.init();
       const wasmDir = require_.resolve('tree-sitter-wasms/package.json').replace(/package\.json$/, 'out');
       const languages = new Map();

package/lib/delivery-review.mjs

@@ -41,13 +41,23 @@ export async function captureDeliveryReview(state, cwd, directory, signal) {
   return { ...capture, diff: text.slice(0, 12000), truncated: text.length > 12000, unresolvedFindings: (state.reviewFindings || []).filter(f => !f.resolution), next: 'Read the full capture path if truncated; new text source is included. Inspect binary assets separately. Probe critical component connections and user outcomes, not only individual functions or artifact existence. Record coverage, findings and limitations; earlier findings require explicit resolutions with evidence, never silently move them to limitations.' };
 }
 
+/** Models commonly send `assertion` or a string array; both carry the same claim. */
+function coverageAssertions(item) {
+  const value = item.assertions ?? item.assertion;
+  if (Array.isArray(value)) return value.filter(v => typeof v === 'string' && v.trim()).join('; ');
+  return typeof value === 'string' ? value : '';
+}
+
 export function recordDeliveryReview(state, cwd, params) {
   const capture = state.reviewCapture;
   const hash = fingerprint(cwd, ['.']);
   if (!capture || capture.id !== params.captureId || capture.runId !== state.runId || capture.revision !== state.revision || capture.fingerprint !== hash) throw Error('Review capture missing or stale. Use delivery_review action=inspect after final source edits.');
   if (pendingRequirements(state, hash).length) throw Error('Run fresh checks for every requirement before recording review.');
   const nonempty = value => typeof value === 'string' && value.trim().length > 0;
-  if (!Array.isArray(params.coverage) || (state.plan.acceptance || []).some(a => !params.coverage.some(c => c.requirement === a.requirement && nonempty(c.assertions)))) throw Error('Review coverage must explain concrete assertions for every exact acceptance requirement, including required validators.');
+  if (!Array.isArray(params.coverage) || params.coverage.some(c => !c || typeof c !== 'object')) throw Error('coverage must be an array of {requirement, assertions, status?} objects.');
+  params = { ...params, coverage: params.coverage.map(c => ({ ...c, assertions: coverageAssertions(c) })) };
+  const uncovered = (state.plan.acceptance || []).filter(a => !params.coverage.some(c => c.requirement === a.requirement && nonempty(c.assertions))).map(a => a.requirement);
+  if (uncovered.length) throw Error(`Review coverage must explain concrete assertions for every exact acceptance requirement, including required validators. Missing: ${JSON.stringify(uncovered.slice(0, 10))}${uncovered.length > 10 ? ` (+${uncovered.length - 10} more)` : ''}. Each item: {requirement: <exact acceptance text>, assertions: "<what the checks assert>", status?: "demonstrated"|"unverified"}.`);
   if (params.coverage.some(c => c.status !== undefined && !['demonstrated', 'unverified'].includes(c.status))) throw Error('Coverage status must be demonstrated or unverified.');
   if (!Array.isArray(params.probes) || !params.probes.length || params.probes.some(p => !nonempty(p))) throw Error('Record boundary/metamorphic probes and observed results, not just a generic review claim.');
   if (!Array.isArray(params.findings) || params.findings.some(p => !nonempty(p))) throw Error('findings must be an array; unresolved findings require repairs or a blocked handoff.');

package/lib/delivery.mjs

@@ -4,6 +4,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync, readFileSync, mkdirSync, writeFileSync, renameSync, openSync, writeSync, closeSync } from 'node:fs';
 import { resolve, relative, isAbsolute, join, dirname, basename } from 'node:path';
 import { spawn } from 'node:child_process';
+import { withoutRuntimeGithubToken } from './environment.mjs';
 
 // Generic dependency/cache/output directories excluded from the source fingerprint.
 // Scenarios or projects can add more via the manifest; these are the common defaults.
@@ -425,7 +426,7 @@ export function atomicJson(path, data) {
 export function killTree(child) {
   if (!child.pid) return;
   if (process.platform === 'win32') {
-    const killer = spawn('taskkill.exe', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore' });
+    const killer = spawn('taskkill.exe', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore', env: withoutRuntimeGithubToken() });
     killer.on('error', () => child.kill());
   } else {
     try { process.kill(-child.pid, 'SIGKILL'); } catch { child.kill('SIGKILL'); }
@@ -443,7 +444,7 @@ export async function runCommand(argv, { cwd, timeoutSeconds = 60, signal, logPa
   const started = Date.now();
   return new Promise(resolveResult => {
     let tail = '', written = 0, timedOut = false, cancelled = false, outputLimit = false;
-    const child = spawn(argv[0], argv.slice(1), { cwd, shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
+    const child = spawn(argv[0], argv.slice(1), { cwd, env: withoutRuntimeGithubToken(), shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
     const stop = () => killTree(child);
     const abort = () => { cancelled = true; stop(); };
     const timer = setTimeout(() => { timedOut = true; stop(); }, timeoutSeconds * 1000);

package/lib/environment.mjs

@@ -0,0 +1,8 @@
+/** Return a copy of an environment without the optional runtime transport token. */
+export function withoutRuntimeGithubToken(env = process.env) {
+  const clean = { ...env };
+  for (const key of Object.keys(clean)) {
+    if (key.toUpperCase() === 'CTG_RUNTIME_GITHUB_TOKEN') delete clean[key];
+  }
+  return clean;
+}

package/lib/guidance.mjs

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { unframe } from './tui/framing.mjs';
+import { unframe } from '../plugins/carthagent/src/server/framing.mjs';
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 export const DEFAULT_PROFILE_DIR = join(root, 'guidance', 'profiles');