cclaw-cli 7.7.1 → 8.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (284) hide show
  1. package/README.md +211 -134
  2. package/dist/artifact-frontmatter.d.ts +51 -0
  3. package/dist/artifact-frontmatter.js +131 -0
  4. package/dist/artifact-paths.d.ts +7 -27
  5. package/dist/artifact-paths.js +20 -249
  6. package/dist/cancel.d.ts +16 -0
  7. package/dist/cancel.js +66 -0
  8. package/dist/cli.d.ts +2 -27
  9. package/dist/cli.js +107 -511
  10. package/dist/compound.d.ts +26 -0
  11. package/dist/compound.js +96 -0
  12. package/dist/config.d.ts +14 -51
  13. package/dist/config.js +23 -359
  14. package/dist/constants.d.ts +11 -18
  15. package/dist/constants.js +19 -106
  16. package/dist/content/antipatterns.d.ts +1 -0
  17. package/dist/content/antipatterns.js +109 -0
  18. package/dist/content/artifact-templates.d.ts +10 -0
  19. package/dist/content/artifact-templates.js +550 -0
  20. package/dist/content/cancel-command.d.ts +2 -2
  21. package/dist/content/cancel-command.js +25 -17
  22. package/dist/content/core-agents.d.ts +9 -233
  23. package/dist/content/core-agents.js +39 -768
  24. package/dist/content/decision-protocol.d.ts +1 -12
  25. package/dist/content/decision-protocol.js +27 -20
  26. package/dist/content/examples.d.ts +8 -42
  27. package/dist/content/examples.js +293 -425
  28. package/dist/content/idea-command.d.ts +2 -0
  29. package/dist/content/idea-command.js +38 -0
  30. package/dist/content/iron-laws.d.ts +4 -138
  31. package/dist/content/iron-laws.js +18 -197
  32. package/dist/content/meta-skill.d.ts +1 -3
  33. package/dist/content/meta-skill.js +57 -134
  34. package/dist/content/node-hooks.d.ts +12 -8
  35. package/dist/content/node-hooks.js +188 -838
  36. package/dist/content/recovery.d.ts +8 -0
  37. package/dist/content/recovery.js +179 -0
  38. package/dist/content/reference-patterns.d.ts +4 -13
  39. package/dist/content/reference-patterns.js +260 -389
  40. package/dist/content/research-playbooks.d.ts +8 -8
  41. package/dist/content/research-playbooks.js +108 -121
  42. package/dist/content/review-loop.d.ts +6 -192
  43. package/dist/content/review-loop.js +29 -731
  44. package/dist/content/skills.d.ts +8 -38
  45. package/dist/content/skills.js +681 -732
  46. package/dist/content/specialist-prompts/architect.d.ts +1 -0
  47. package/dist/content/specialist-prompts/architect.js +225 -0
  48. package/dist/content/specialist-prompts/brainstormer.d.ts +1 -0
  49. package/dist/content/specialist-prompts/brainstormer.js +168 -0
  50. package/dist/content/specialist-prompts/index.d.ts +2 -0
  51. package/dist/content/specialist-prompts/index.js +14 -0
  52. package/dist/content/specialist-prompts/planner.d.ts +1 -0
  53. package/dist/content/specialist-prompts/planner.js +182 -0
  54. package/dist/content/specialist-prompts/reviewer.d.ts +1 -0
  55. package/dist/content/specialist-prompts/reviewer.js +193 -0
  56. package/dist/content/specialist-prompts/security-reviewer.d.ts +1 -0
  57. package/dist/content/specialist-prompts/security-reviewer.js +133 -0
  58. package/dist/content/specialist-prompts/slice-builder.d.ts +1 -0
  59. package/dist/content/specialist-prompts/slice-builder.js +232 -0
  60. package/dist/content/stage-playbooks.d.ts +8 -0
  61. package/dist/content/stage-playbooks.js +404 -0
  62. package/dist/content/start-command.d.ts +2 -12
  63. package/dist/content/start-command.js +221 -207
  64. package/dist/flow-state.d.ts +21 -178
  65. package/dist/flow-state.js +67 -170
  66. package/dist/fs-utils.d.ts +6 -26
  67. package/dist/fs-utils.js +29 -162
  68. package/dist/gitignore.d.ts +2 -1
  69. package/dist/gitignore.js +51 -34
  70. package/dist/harness-detect.d.ts +10 -0
  71. package/dist/harness-detect.js +29 -0
  72. package/dist/harness-prompt.d.ts +26 -0
  73. package/dist/harness-prompt.js +142 -0
  74. package/dist/install.d.ts +35 -15
  75. package/dist/install.js +238 -1347
  76. package/dist/knowledge-store.d.ts +19 -163
  77. package/dist/knowledge-store.js +56 -590
  78. package/dist/logger.d.ts +8 -3
  79. package/dist/logger.js +13 -4
  80. package/dist/orchestrator-routing.d.ts +29 -0
  81. package/dist/orchestrator-routing.js +156 -0
  82. package/dist/run-persistence.d.ts +7 -118
  83. package/dist/run-persistence.js +29 -845
  84. package/dist/runtime/run-hook.entry.d.ts +1 -3
  85. package/dist/runtime/run-hook.entry.js +19 -4
  86. package/dist/runtime/run-hook.mjs +13 -1024
  87. package/dist/types.d.ts +25 -261
  88. package/dist/types.js +8 -36
  89. package/package.json +6 -3
  90. package/dist/artifact-linter/brainstorm.d.ts +0 -2
  91. package/dist/artifact-linter/brainstorm.js +0 -353
  92. package/dist/artifact-linter/design.d.ts +0 -18
  93. package/dist/artifact-linter/design.js +0 -444
  94. package/dist/artifact-linter/findings-dedup.d.ts +0 -56
  95. package/dist/artifact-linter/findings-dedup.js +0 -232
  96. package/dist/artifact-linter/plan.d.ts +0 -2
  97. package/dist/artifact-linter/plan.js +0 -826
  98. package/dist/artifact-linter/review-army.d.ts +0 -49
  99. package/dist/artifact-linter/review-army.js +0 -520
  100. package/dist/artifact-linter/review.d.ts +0 -2
  101. package/dist/artifact-linter/review.js +0 -113
  102. package/dist/artifact-linter/scope.d.ts +0 -2
  103. package/dist/artifact-linter/scope.js +0 -158
  104. package/dist/artifact-linter/shared.d.ts +0 -637
  105. package/dist/artifact-linter/shared.js +0 -2163
  106. package/dist/artifact-linter/ship.d.ts +0 -2
  107. package/dist/artifact-linter/ship.js +0 -250
  108. package/dist/artifact-linter/spec.d.ts +0 -2
  109. package/dist/artifact-linter/spec.js +0 -176
  110. package/dist/artifact-linter/tdd.d.ts +0 -118
  111. package/dist/artifact-linter/tdd.js +0 -1404
  112. package/dist/artifact-linter.d.ts +0 -15
  113. package/dist/artifact-linter.js +0 -517
  114. package/dist/codex-feature-flag.d.ts +0 -58
  115. package/dist/codex-feature-flag.js +0 -193
  116. package/dist/content/closeout-guidance.d.ts +0 -14
  117. package/dist/content/closeout-guidance.js +0 -44
  118. package/dist/content/diff-command.d.ts +0 -1
  119. package/dist/content/diff-command.js +0 -43
  120. package/dist/content/harness-doc.d.ts +0 -1
  121. package/dist/content/harness-doc.js +0 -65
  122. package/dist/content/hook-events.d.ts +0 -9
  123. package/dist/content/hook-events.js +0 -23
  124. package/dist/content/hook-manifest.d.ts +0 -81
  125. package/dist/content/hook-manifest.js +0 -156
  126. package/dist/content/hooks.d.ts +0 -11
  127. package/dist/content/hooks.js +0 -1972
  128. package/dist/content/idea.d.ts +0 -60
  129. package/dist/content/idea.js +0 -416
  130. package/dist/content/language-policy.d.ts +0 -2
  131. package/dist/content/language-policy.js +0 -13
  132. package/dist/content/learnings.d.ts +0 -6
  133. package/dist/content/learnings.js +0 -141
  134. package/dist/content/observe.d.ts +0 -19
  135. package/dist/content/observe.js +0 -86
  136. package/dist/content/opencode-plugin.d.ts +0 -1
  137. package/dist/content/opencode-plugin.js +0 -635
  138. package/dist/content/review-prompts.d.ts +0 -1
  139. package/dist/content/review-prompts.js +0 -104
  140. package/dist/content/runtime-shared-snippets.d.ts +0 -8
  141. package/dist/content/runtime-shared-snippets.js +0 -80
  142. package/dist/content/session-hooks.d.ts +0 -7
  143. package/dist/content/session-hooks.js +0 -107
  144. package/dist/content/skills-elicitation.d.ts +0 -1
  145. package/dist/content/skills-elicitation.js +0 -167
  146. package/dist/content/stage-command.d.ts +0 -2
  147. package/dist/content/stage-command.js +0 -17
  148. package/dist/content/stage-schema.d.ts +0 -117
  149. package/dist/content/stage-schema.js +0 -955
  150. package/dist/content/stages/_lint-metadata/index.d.ts +0 -2
  151. package/dist/content/stages/_lint-metadata/index.js +0 -97
  152. package/dist/content/stages/brainstorm.d.ts +0 -2
  153. package/dist/content/stages/brainstorm.js +0 -184
  154. package/dist/content/stages/design.d.ts +0 -2
  155. package/dist/content/stages/design.js +0 -288
  156. package/dist/content/stages/index.d.ts +0 -8
  157. package/dist/content/stages/index.js +0 -11
  158. package/dist/content/stages/plan.d.ts +0 -2
  159. package/dist/content/stages/plan.js +0 -191
  160. package/dist/content/stages/review.d.ts +0 -2
  161. package/dist/content/stages/review.js +0 -240
  162. package/dist/content/stages/schema-types.d.ts +0 -203
  163. package/dist/content/stages/schema-types.js +0 -1
  164. package/dist/content/stages/scope.d.ts +0 -2
  165. package/dist/content/stages/scope.js +0 -254
  166. package/dist/content/stages/ship.d.ts +0 -2
  167. package/dist/content/stages/ship.js +0 -159
  168. package/dist/content/stages/spec.d.ts +0 -2
  169. package/dist/content/stages/spec.js +0 -170
  170. package/dist/content/stages/tdd.d.ts +0 -4
  171. package/dist/content/stages/tdd.js +0 -273
  172. package/dist/content/state-contracts.d.ts +0 -1
  173. package/dist/content/state-contracts.js +0 -63
  174. package/dist/content/status-command.d.ts +0 -4
  175. package/dist/content/status-command.js +0 -109
  176. package/dist/content/subagent-context-skills.d.ts +0 -4
  177. package/dist/content/subagent-context-skills.js +0 -279
  178. package/dist/content/subagents.d.ts +0 -3
  179. package/dist/content/subagents.js +0 -997
  180. package/dist/content/templates.d.ts +0 -26
  181. package/dist/content/templates.js +0 -1692
  182. package/dist/content/track-render-context.d.ts +0 -18
  183. package/dist/content/track-render-context.js +0 -53
  184. package/dist/content/tree-command.d.ts +0 -1
  185. package/dist/content/tree-command.js +0 -64
  186. package/dist/content/utility-skills.d.ts +0 -30
  187. package/dist/content/utility-skills.js +0 -160
  188. package/dist/content/view-command.d.ts +0 -2
  189. package/dist/content/view-command.js +0 -92
  190. package/dist/delegation.d.ts +0 -649
  191. package/dist/delegation.js +0 -1539
  192. package/dist/early-loop.d.ts +0 -70
  193. package/dist/early-loop.js +0 -302
  194. package/dist/execution-topology.d.ts +0 -44
  195. package/dist/execution-topology.js +0 -95
  196. package/dist/gate-evidence.d.ts +0 -85
  197. package/dist/gate-evidence.js +0 -631
  198. package/dist/harness-adapters.d.ts +0 -151
  199. package/dist/harness-adapters.js +0 -756
  200. package/dist/harness-selection.d.ts +0 -31
  201. package/dist/harness-selection.js +0 -214
  202. package/dist/hook-schema.d.ts +0 -6
  203. package/dist/hook-schema.js +0 -114
  204. package/dist/hook-schemas/claude-hooks.v1.json +0 -10
  205. package/dist/hook-schemas/codex-hooks.v1.json +0 -10
  206. package/dist/hook-schemas/cursor-hooks.v1.json +0 -13
  207. package/dist/init-detect.d.ts +0 -2
  208. package/dist/init-detect.js +0 -50
  209. package/dist/internal/advance-stage/advance.d.ts +0 -89
  210. package/dist/internal/advance-stage/advance.js +0 -655
  211. package/dist/internal/advance-stage/cancel-run.d.ts +0 -8
  212. package/dist/internal/advance-stage/cancel-run.js +0 -19
  213. package/dist/internal/advance-stage/flow-state-coercion.d.ts +0 -3
  214. package/dist/internal/advance-stage/flow-state-coercion.js +0 -81
  215. package/dist/internal/advance-stage/helpers.d.ts +0 -14
  216. package/dist/internal/advance-stage/helpers.js +0 -145
  217. package/dist/internal/advance-stage/hook.d.ts +0 -8
  218. package/dist/internal/advance-stage/hook.js +0 -40
  219. package/dist/internal/advance-stage/parsers.d.ts +0 -72
  220. package/dist/internal/advance-stage/parsers.js +0 -357
  221. package/dist/internal/advance-stage/proactive-delegation-trace.d.ts +0 -24
  222. package/dist/internal/advance-stage/proactive-delegation-trace.js +0 -56
  223. package/dist/internal/advance-stage/review-loop.d.ts +0 -16
  224. package/dist/internal/advance-stage/review-loop.js +0 -199
  225. package/dist/internal/advance-stage/rewind.d.ts +0 -14
  226. package/dist/internal/advance-stage/rewind.js +0 -108
  227. package/dist/internal/advance-stage/start-flow.d.ts +0 -13
  228. package/dist/internal/advance-stage/start-flow.js +0 -241
  229. package/dist/internal/advance-stage/verify.d.ts +0 -21
  230. package/dist/internal/advance-stage/verify.js +0 -185
  231. package/dist/internal/advance-stage.d.ts +0 -7
  232. package/dist/internal/advance-stage.js +0 -138
  233. package/dist/internal/cohesion-contract-stub.d.ts +0 -24
  234. package/dist/internal/cohesion-contract-stub.js +0 -148
  235. package/dist/internal/compound-readiness.d.ts +0 -23
  236. package/dist/internal/compound-readiness.js +0 -102
  237. package/dist/internal/detect-public-api-changes.d.ts +0 -5
  238. package/dist/internal/detect-public-api-changes.js +0 -45
  239. package/dist/internal/detect-supply-chain-changes.d.ts +0 -6
  240. package/dist/internal/detect-supply-chain-changes.js +0 -138
  241. package/dist/internal/early-loop-status.d.ts +0 -7
  242. package/dist/internal/early-loop-status.js +0 -93
  243. package/dist/internal/envelope-validate.d.ts +0 -7
  244. package/dist/internal/envelope-validate.js +0 -66
  245. package/dist/internal/flow-state-repair.d.ts +0 -20
  246. package/dist/internal/flow-state-repair.js +0 -104
  247. package/dist/internal/plan-split-waves.d.ts +0 -190
  248. package/dist/internal/plan-split-waves.js +0 -764
  249. package/dist/internal/runtime-integrity.d.ts +0 -7
  250. package/dist/internal/runtime-integrity.js +0 -268
  251. package/dist/internal/slice-commit.d.ts +0 -7
  252. package/dist/internal/slice-commit.js +0 -619
  253. package/dist/internal/tdd-loop-status.d.ts +0 -14
  254. package/dist/internal/tdd-loop-status.js +0 -68
  255. package/dist/internal/tdd-red-evidence.d.ts +0 -7
  256. package/dist/internal/tdd-red-evidence.js +0 -153
  257. package/dist/internal/waiver-grant.d.ts +0 -62
  258. package/dist/internal/waiver-grant.js +0 -294
  259. package/dist/internal/wave-status.d.ts +0 -74
  260. package/dist/internal/wave-status.js +0 -506
  261. package/dist/managed-resources.d.ts +0 -53
  262. package/dist/managed-resources.js +0 -313
  263. package/dist/policy.d.ts +0 -10
  264. package/dist/policy.js +0 -167
  265. package/dist/retro-gate.d.ts +0 -9
  266. package/dist/retro-gate.js +0 -47
  267. package/dist/run-archive.d.ts +0 -61
  268. package/dist/run-archive.js +0 -391
  269. package/dist/runs.d.ts +0 -2
  270. package/dist/runs.js +0 -2
  271. package/dist/stack-detection.d.ts +0 -116
  272. package/dist/stack-detection.js +0 -489
  273. package/dist/streaming/event-stream.d.ts +0 -31
  274. package/dist/streaming/event-stream.js +0 -114
  275. package/dist/tdd-cycle.d.ts +0 -107
  276. package/dist/tdd-cycle.js +0 -289
  277. package/dist/tdd-verification-evidence.d.ts +0 -17
  278. package/dist/tdd-verification-evidence.js +0 -122
  279. package/dist/track-heuristics.d.ts +0 -27
  280. package/dist/track-heuristics.js +0 -154
  281. package/dist/util/slice-id.d.ts +0 -58
  282. package/dist/util/slice-id.js +0 -89
  283. package/dist/worktree-manager.d.ts +0 -20
  284. package/dist/worktree-manager.js +0 -108
@@ -1,49 +0,0 @@
1
- export declare function validateReviewArmy(projectRoot: string): Promise<{
2
- valid: boolean;
3
- errors: string[];
4
- }>;
5
- export interface ReviewVerdictConsistencyResult {
6
- ok: boolean;
7
- errors: string[];
8
- finalVerdict: "APPROVED" | "APPROVED_WITH_CONCERNS" | "BLOCKED" | "UNKNOWN";
9
- openCriticalCount: number;
10
- shipBlockerCount: number;
11
- }
12
- export interface ReviewSecurityNoChangeAttestationResult {
13
- ok: boolean;
14
- errors: string[];
15
- hasSecurityFinding: boolean;
16
- hasNoChangeAttestation: boolean;
17
- }
18
- /**
19
- * Ensure the narrative verdict in 07-review.md is consistent with the
20
- * structured review-army reconciliation. A review cannot declare
21
- * APPROVED while open Critical findings or shipBlockers remain.
22
- */
23
- export declare function checkReviewVerdictConsistency(projectRoot: string): Promise<ReviewVerdictConsistencyResult>;
24
- export interface ReviewTddDuplicationConflict {
25
- findingId: string;
26
- tddSeverity: string | null;
27
- reviewSeverity: string | null;
28
- tddDisposition: string | null;
29
- reviewDisposition: string | null;
30
- }
31
- export interface ReviewTddDuplicationResult {
32
- ok: boolean;
33
- errors: string[];
34
- conflicts: ReviewTddDuplicationConflict[];
35
- tddArtifactExists: boolean;
36
- reviewArtifactExists: boolean;
37
- }
38
- /**
39
- * Cross-artifact duplication guard.
40
- *
41
- * When the same finding ID (`F-NN`) appears in both
42
- * `06-tdd.md > Per-Slice Review` and `07-review-army.json`, the
43
- * severity and disposition MUST match. Per-slice tdd reviews own
44
- * single-slice findings; review cites them, never re-classifies.
45
- *
46
- * If neither artifact uses `F-NN` IDs, the check is a no-op.
47
- */
48
- export declare function checkReviewTddNoCrossArtifactDuplication(projectRoot: string): Promise<ReviewTddDuplicationResult>;
49
- export declare function checkReviewSecurityNoChangeAttestation(projectRoot: string): Promise<ReviewSecurityNoChangeAttestationResult>;
@@ -1,520 +0,0 @@
1
- import fs from "node:fs/promises";
2
- import path from "node:path";
3
- import { RUNTIME_ROOT } from "../constants.js";
4
- import { exists } from "../fs-utils.js";
5
- import { extractH2Sections, sectionBodyByName } from "./shared.js";
6
- async function resolveNamedArtifactPath(projectRoot, fileName) {
7
- const relPath = path.join(RUNTIME_ROOT, "artifacts", fileName);
8
- const absPath = path.join(projectRoot, relPath);
9
- return { absPath, relPath };
10
- }
11
- function isNonEmptyString(v) {
12
- return typeof v === "string" && v.length > 0;
13
- }
14
- function isFiniteNumber(v) {
15
- return typeof v === "number" && Number.isFinite(v);
16
- }
17
- function isNonNegativeInteger(v) {
18
- return Number.isInteger(v) && v >= 0;
19
- }
20
- function isStringArray(v) {
21
- return Array.isArray(v) && v.every((item) => typeof item === "string");
22
- }
23
- export async function validateReviewArmy(projectRoot) {
24
- const errors = [];
25
- const { absPath, relPath } = await resolveNamedArtifactPath(projectRoot, "07-review-army.json");
26
- if (!(await exists(absPath))) {
27
- return { valid: false, errors: [`Missing file: ${relPath}`] };
28
- }
29
- let parsed;
30
- try {
31
- parsed = JSON.parse(await fs.readFile(absPath, "utf8"));
32
- }
33
- catch (e) {
34
- const msg = e instanceof Error ? e.message : String(e);
35
- return { valid: false, errors: [`Invalid JSON: ${msg}`] };
36
- }
37
- if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
38
- return { valid: false, errors: ["Root value must be a JSON object."] };
39
- }
40
- const root = parsed;
41
- if (!("version" in root) || !isFiniteNumber(root.version) || root.version < 1) {
42
- errors.push('Field "version" must be a finite number >= 1.');
43
- }
44
- if (!isNonEmptyString(root.generatedAt)) {
45
- errors.push('Field "generatedAt" must be a non-empty string.');
46
- }
47
- if (!("scope" in root) || root.scope === null || typeof root.scope !== "object" || Array.isArray(root.scope)) {
48
- errors.push('Field "scope" must be an object.');
49
- }
50
- else {
51
- const scope = root.scope;
52
- if (!isNonEmptyString(scope.base)) {
53
- errors.push("scope.base must be a non-empty string.");
54
- }
55
- if (!isNonEmptyString(scope.head)) {
56
- errors.push("scope.head must be a non-empty string.");
57
- }
58
- if (!isStringArray(scope.files)) {
59
- errors.push("scope.files must be an array of strings.");
60
- }
61
- }
62
- const severitySet = new Set(["Critical", "Important", "Suggestion"]);
63
- const statusSet = new Set(["open", "accepted", "resolved"]);
64
- const sourceSet = new Set([
65
- "spec",
66
- "correctness",
67
- "security",
68
- "performance",
69
- "architecture",
70
- "external-safety"
71
- ]);
72
- const findingIds = new Set();
73
- const openCriticalIds = new Set();
74
- if (!Array.isArray(root.findings)) {
75
- errors.push('Field "findings" must be an array.');
76
- }
77
- else {
78
- root.findings.forEach((f, i) => {
79
- if (f === null || typeof f !== "object" || Array.isArray(f)) {
80
- errors.push(`findings[${i}] must be an object.`);
81
- return;
82
- }
83
- const o = f;
84
- if (!isNonEmptyString(o.id)) {
85
- errors.push(`findings[${i}].id must be a non-empty string.`);
86
- }
87
- else if (findingIds.has(o.id)) {
88
- errors.push(`findings[${i}].id must be unique.`);
89
- }
90
- else {
91
- findingIds.add(o.id);
92
- }
93
- if (!isNonEmptyString(o.severity) || !severitySet.has(o.severity)) {
94
- errors.push(`findings[${i}].severity must be one of: Critical, Important, Suggestion.`);
95
- }
96
- if (!isNonEmptyString(o.status) || !statusSet.has(o.status)) {
97
- errors.push(`findings[${i}].status must be one of: open, accepted, resolved.`);
98
- }
99
- if (!isNonEmptyString(o.fingerprint)) {
100
- errors.push(`findings[${i}].fingerprint must be a non-empty string.`);
101
- }
102
- if (!isFiniteNumber(o.confidence) || o.confidence < 1 || o.confidence > 10) {
103
- errors.push(`findings[${i}].confidence must be a number in [1,10].`);
104
- }
105
- if (!isStringArray(o.reportedBy) || o.reportedBy.length === 0) {
106
- errors.push(`findings[${i}].reportedBy must be a non-empty string array.`);
107
- }
108
- if (o.sources !== undefined) {
109
- if (!isStringArray(o.sources) || o.sources.length === 0) {
110
- errors.push(`findings[${i}].sources must be a non-empty string array when present.`);
111
- }
112
- else {
113
- const invalidSources = o.sources.filter((source) => !sourceSet.has(source));
114
- if (invalidSources.length > 0) {
115
- errors.push(`findings[${i}].sources contains unknown values: ${invalidSources.join(", ")}.`);
116
- }
117
- }
118
- }
119
- if (o.location === undefined || o.location === null) {
120
- errors.push(`findings[${i}].location is required and must be an object with file + line.`);
121
- }
122
- else if (typeof o.location !== "object" || Array.isArray(o.location)) {
123
- errors.push(`findings[${i}].location must be an object with file + line.`);
124
- }
125
- else {
126
- const loc = o.location;
127
- if (!isNonEmptyString(loc.file)) {
128
- errors.push(`findings[${i}].location.file must be a non-empty string.`);
129
- }
130
- if (!isFiniteNumber(loc.line) || loc.line < 1) {
131
- errors.push(`findings[${i}].location.line must be a positive number.`);
132
- }
133
- }
134
- if (o.recommendation !== undefined && !isNonEmptyString(o.recommendation)) {
135
- errors.push(`findings[${i}].recommendation must be a non-empty string when present.`);
136
- }
137
- if (o.severity === "Critical" && o.status === "open" && !isNonEmptyString(o.recommendation)) {
138
- errors.push(`findings[${i}] open Critical finding must include recommendation.`);
139
- }
140
- if (o.id && o.severity === "Critical" && o.status === "open" && typeof o.id === "string") {
141
- openCriticalIds.add(o.id);
142
- }
143
- });
144
- }
145
- if (!("reconciliation" in root) || root.reconciliation === null || typeof root.reconciliation !== "object") {
146
- errors.push('Field "reconciliation" must be an object.');
147
- }
148
- else {
149
- const rec = root.reconciliation;
150
- if (!isNonNegativeInteger(rec.duplicatesCollapsed)) {
151
- errors.push("reconciliation.duplicatesCollapsed must be a non-negative integer.");
152
- }
153
- if (!Array.isArray(rec.conflicts)) {
154
- errors.push("reconciliation.conflicts must be an array.");
155
- }
156
- else {
157
- rec.conflicts.forEach((c, ci) => {
158
- if (c === null || typeof c !== "object" || Array.isArray(c)) {
159
- errors.push(`reconciliation.conflicts[${ci}] must be an object.`);
160
- return;
161
- }
162
- const co = c;
163
- if (!isNonEmptyString(co.findingId)) {
164
- errors.push(`reconciliation.conflicts[${ci}].findingId must be a non-empty string.`);
165
- }
166
- else if (!findingIds.has(co.findingId)) {
167
- errors.push(`reconciliation.conflicts[${ci}].findingId references unknown finding "${co.findingId}".`);
168
- }
169
- if (!isNonEmptyString(co.description)) {
170
- errors.push(`reconciliation.conflicts[${ci}].description must be a non-empty string.`);
171
- }
172
- });
173
- }
174
- if (!isStringArray(rec.multiSpecialistConfirmed)) {
175
- errors.push("reconciliation.multiSpecialistConfirmed must be an array of finding ids.");
176
- }
177
- else {
178
- for (const msId of rec.multiSpecialistConfirmed) {
179
- if (!findingIds.has(msId)) {
180
- errors.push(`reconciliation.multiSpecialistConfirmed references unknown finding id "${msId}".`);
181
- continue;
182
- }
183
- if (Array.isArray(root.findings)) {
184
- const finding = root.findings.find((f) => {
185
- return f && typeof f === "object" && !Array.isArray(f) && f.id === msId;
186
- });
187
- if (finding && typeof finding === "object" && !Array.isArray(finding)) {
188
- const reportedBy = finding.reportedBy;
189
- const count = Array.isArray(reportedBy)
190
- ? new Set(reportedBy.filter((v) => typeof v === "string")).size
191
- : 0;
192
- if (count < 2) {
193
- errors.push(`reconciliation.multiSpecialistConfirmed entry "${msId}" must be confirmed by at least 2 distinct reviewers (found ${count}).`);
194
- }
195
- }
196
- }
197
- }
198
- }
199
- if (!isStringArray(rec.shipBlockers)) {
200
- errors.push("reconciliation.shipBlockers must be an array of finding ids.");
201
- }
202
- else {
203
- const blockers = new Set(rec.shipBlockers);
204
- for (const id of rec.shipBlockers) {
205
- if (!findingIds.has(id)) {
206
- errors.push(`reconciliation.shipBlockers references unknown finding id "${id}".`);
207
- }
208
- }
209
- for (const criticalId of openCriticalIds) {
210
- if (!blockers.has(criticalId)) {
211
- errors.push(`reconciliation.shipBlockers must include open Critical finding "${criticalId}".`);
212
- }
213
- }
214
- }
215
- if (isStringArray(rec.multiSpecialistConfirmed)) {
216
- for (const id of rec.multiSpecialistConfirmed) {
217
- if (!findingIds.has(id)) {
218
- errors.push(`reconciliation.multiSpecialistConfirmed references unknown finding id "${id}".`);
219
- }
220
- }
221
- }
222
- if (rec.layerCoverage !== undefined) {
223
- if (rec.layerCoverage === null || typeof rec.layerCoverage !== "object" || Array.isArray(rec.layerCoverage)) {
224
- errors.push("reconciliation.layerCoverage must be an object when present.");
225
- }
226
- else {
227
- const coverage = rec.layerCoverage;
228
- for (const source of sourceSet) {
229
- if (coverage[source] !== undefined && typeof coverage[source] !== "boolean") {
230
- errors.push(`reconciliation.layerCoverage.${source} must be boolean when present.`);
231
- }
232
- }
233
- }
234
- }
235
- }
236
- return { valid: errors.length === 0, errors };
237
- }
238
- /**
239
- * Ensure the narrative verdict in 07-review.md is consistent with the
240
- * structured review-army reconciliation. A review cannot declare
241
- * APPROVED while open Critical findings or shipBlockers remain.
242
- */
243
- export async function checkReviewVerdictConsistency(projectRoot) {
244
- const errors = [];
245
- const reviewMdPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "07-review.md");
246
- const armyJsonPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "07-review-army.json");
247
- let finalVerdict = "UNKNOWN";
248
- if (await exists(reviewMdPath)) {
249
- const raw = await fs.readFile(reviewMdPath, "utf8");
250
- const sections = extractH2Sections(raw);
251
- const verdictBody = sectionBodyByName(sections, "Final Verdict");
252
- if (verdictBody) {
253
- const chosen = [];
254
- for (const token of ["APPROVED_WITH_CONCERNS", "APPROVED", "BLOCKED"]) {
255
- const regex = new RegExp(`\\b${token}\\b`, "u");
256
- if (regex.test(verdictBody)) {
257
- // APPROVED would match inside APPROVED_WITH_CONCERNS; prefer the longer match first.
258
- if (token === "APPROVED" && /\bAPPROVED_WITH_CONCERNS\b/u.test(verdictBody))
259
- continue;
260
- chosen.push(token);
261
- }
262
- }
263
- if (chosen.length === 1) {
264
- finalVerdict = chosen[0];
265
- }
266
- else if (chosen.length > 1) {
267
- errors.push(`Final Verdict section lists multiple verdict tokens (${chosen.join(", ")}). Select exactly one.`);
268
- }
269
- else {
270
- errors.push('Final Verdict section does not select APPROVED, APPROVED_WITH_CONCERNS, or BLOCKED.');
271
- }
272
- }
273
- else {
274
- errors.push('07-review.md is missing the "## Final Verdict" section.');
275
- }
276
- }
277
- let openCriticalCount = 0;
278
- let shipBlockerCount = 0;
279
- if (await exists(armyJsonPath)) {
280
- try {
281
- const raw = await fs.readFile(armyJsonPath, "utf8");
282
- const parsed = JSON.parse(raw);
283
- const findings = Array.isArray(parsed.findings) ? parsed.findings : [];
284
- for (const f of findings) {
285
- if (!f || typeof f !== "object" || Array.isArray(f))
286
- continue;
287
- const o = f;
288
- if (o.severity === "Critical" && o.status === "open") {
289
- openCriticalCount++;
290
- }
291
- }
292
- const rec = parsed.reconciliation && typeof parsed.reconciliation === "object" && !Array.isArray(parsed.reconciliation)
293
- ? parsed.reconciliation
294
- : null;
295
- if (rec && Array.isArray(rec.shipBlockers)) {
296
- shipBlockerCount = rec.shipBlockers.filter((v) => typeof v === "string").length;
297
- }
298
- }
299
- catch {
300
- // JSON validity is the concern of validateReviewArmy; skip silently here.
301
- }
302
- }
303
- if (finalVerdict === "APPROVED" && (openCriticalCount > 0 || shipBlockerCount > 0)) {
304
- errors.push(`Final Verdict is APPROVED but review-army has ${openCriticalCount} open Critical finding(s) and ${shipBlockerCount} shipBlocker(s). Use BLOCKED or APPROVED_WITH_CONCERNS.`);
305
- }
306
- // APPROVED_WITH_CONCERNS is intended for Important/Suggestion findings
307
- // the author has accepted. An *open* Critical finding or an active
308
- // shipBlocker must route through BLOCKED (review_verdict_blocked gate)
309
- // rather than pass as a concession — previously this slipped through.
310
- if (finalVerdict === "APPROVED_WITH_CONCERNS" &&
311
- (openCriticalCount > 0 || shipBlockerCount > 0)) {
312
- errors.push(`Final Verdict is APPROVED_WITH_CONCERNS but review-army has ${openCriticalCount} open Critical finding(s) and ${shipBlockerCount} shipBlocker(s). Resolve them or use BLOCKED.`);
313
- }
314
- return {
315
- ok: errors.length === 0,
316
- errors,
317
- finalVerdict,
318
- openCriticalCount,
319
- shipBlockerCount
320
- };
321
- }
322
- const FINDING_ID_PATTERN = /\bF-\d+\b/giu;
323
- const SEVERITY_TOKENS = ["Critical", "Important", "Suggestion"];
324
- const DISPOSITION_TOKENS = ["open", "accepted", "resolved", "deferred", "won't-fix", "wont-fix"];
325
- function findFirstToken(text, tokens) {
326
- for (const token of tokens) {
327
- const escaped = token.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
328
- const regex = new RegExp(`\\b${escaped}\\b`, "iu");
329
- if (regex.test(text))
330
- return token;
331
- }
332
- return null;
333
- }
334
- function normalizeDisposition(value) {
335
- if (value === null)
336
- return null;
337
- const lower = value.toLowerCase();
338
- if (lower === "wont-fix" || lower === "won't-fix")
339
- return "won't-fix";
340
- return lower;
341
- }
342
- function extractTddPerSliceFindings(perSliceBody) {
343
- const rows = new Map();
344
- const lines = perSliceBody.split(/\r?\n/u);
345
- for (const line of lines) {
346
- const ids = line.match(FINDING_ID_PATTERN);
347
- if (!ids || ids.length === 0)
348
- continue;
349
- const severity = findFirstToken(line, SEVERITY_TOKENS);
350
- const disposition = normalizeDisposition(findFirstToken(line, DISPOSITION_TOKENS));
351
- for (const rawId of ids) {
352
- const id = rawId.toUpperCase();
353
- if (rows.has(id))
354
- continue;
355
- rows.set(id, { id, severity, disposition });
356
- }
357
- }
358
- return rows;
359
- }
360
- /**
361
- * Cross-artifact duplication guard.
362
- *
363
- * When the same finding ID (`F-NN`) appears in both
364
- * `06-tdd.md > Per-Slice Review` and `07-review-army.json`, the
365
- * severity and disposition MUST match. Per-slice tdd reviews own
366
- * single-slice findings; review cites them, never re-classifies.
367
- *
368
- * If neither artifact uses `F-NN` IDs, the check is a no-op.
369
- */
370
- export async function checkReviewTddNoCrossArtifactDuplication(projectRoot) {
371
- const tddPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "06-tdd.md");
372
- const armyPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "07-review-army.json");
373
- const tddArtifactExists = await exists(tddPath);
374
- const reviewArtifactExists = await exists(armyPath);
375
- if (!tddArtifactExists || !reviewArtifactExists) {
376
- return {
377
- ok: true,
378
- errors: [],
379
- conflicts: [],
380
- tddArtifactExists,
381
- reviewArtifactExists
382
- };
383
- }
384
- const tddRaw = await fs.readFile(tddPath, "utf8");
385
- const tddSections = extractH2Sections(tddRaw);
386
- const perSliceBody = sectionBodyByName(tddSections, "Per-Slice Review");
387
- if (!perSliceBody) {
388
- return {
389
- ok: true,
390
- errors: [],
391
- conflicts: [],
392
- tddArtifactExists,
393
- reviewArtifactExists
394
- };
395
- }
396
- const tddFindings = extractTddPerSliceFindings(perSliceBody);
397
- if (tddFindings.size === 0) {
398
- return {
399
- ok: true,
400
- errors: [],
401
- conflicts: [],
402
- tddArtifactExists,
403
- reviewArtifactExists
404
- };
405
- }
406
- let parsed;
407
- try {
408
- parsed = JSON.parse(await fs.readFile(armyPath, "utf8"));
409
- }
410
- catch {
411
- return {
412
- ok: true,
413
- errors: [],
414
- conflicts: [],
415
- tddArtifactExists,
416
- reviewArtifactExists
417
- };
418
- }
419
- if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
420
- return {
421
- ok: true,
422
- errors: [],
423
- conflicts: [],
424
- tddArtifactExists,
425
- reviewArtifactExists
426
- };
427
- }
428
- const root = parsed;
429
- const findings = Array.isArray(root.findings) ? root.findings : [];
430
- const conflicts = [];
431
- for (const f of findings) {
432
- if (!f || typeof f !== "object" || Array.isArray(f))
433
- continue;
434
- const o = f;
435
- if (typeof o.id !== "string")
436
- continue;
437
- const id = o.id.toUpperCase();
438
- const tddRow = tddFindings.get(id);
439
- if (!tddRow)
440
- continue;
441
- const reviewSeverity = typeof o.severity === "string" ? o.severity : null;
442
- const reviewDisposition = normalizeDisposition(typeof o.status === "string" ? o.status : null);
443
- const severityMismatch = tddRow.severity !== null &&
444
- reviewSeverity !== null &&
445
- tddRow.severity.toLowerCase() !== reviewSeverity.toLowerCase();
446
- const dispositionMismatch = tddRow.disposition !== null &&
447
- reviewDisposition !== null &&
448
- tddRow.disposition !== reviewDisposition;
449
- if (severityMismatch || dispositionMismatch) {
450
- conflicts.push({
451
- findingId: id,
452
- tddSeverity: tddRow.severity,
453
- reviewSeverity,
454
- tddDisposition: tddRow.disposition,
455
- reviewDisposition
456
- });
457
- }
458
- }
459
- const errors = conflicts.map((c) => {
460
- const parts = [];
461
- if (c.tddSeverity !== null && c.reviewSeverity !== null && c.tddSeverity.toLowerCase() !== c.reviewSeverity.toLowerCase()) {
462
- parts.push(`severity tdd=${c.tddSeverity} vs review-army=${c.reviewSeverity}`);
463
- }
464
- if (c.tddDisposition !== null && c.reviewDisposition !== null && c.tddDisposition !== c.reviewDisposition) {
465
- parts.push(`disposition tdd=${c.tddDisposition} vs review-army=${c.reviewDisposition}`);
466
- }
467
- return `Finding ${c.findingId} appears in both 06-tdd.md > Per-Slice Review and 07-review-army.json with mismatched ${parts.join(" and ")}. Review must cite, not re-classify.`;
468
- });
469
- return {
470
- ok: errors.length === 0,
471
- errors,
472
- conflicts,
473
- tddArtifactExists,
474
- reviewArtifactExists
475
- };
476
- }
477
- export async function checkReviewSecurityNoChangeAttestation(projectRoot) {
478
- const reviewMdPath = path.join(projectRoot, RUNTIME_ROOT, "artifacts", "07-review.md");
479
- if (!(await exists(reviewMdPath))) {
480
- return {
481
- ok: true,
482
- errors: [],
483
- hasSecurityFinding: false,
484
- hasNoChangeAttestation: false
485
- };
486
- }
487
- const errors = [];
488
- const raw = await fs.readFile(reviewMdPath, "utf8");
489
- const sections = extractH2Sections(raw);
490
- const securityBody = sectionBodyByName(sections, "Layer 2 Security")
491
- ?? sectionBodyByName(sections, "Layer 2b: Security")
492
- ?? sectionBodyByName(sections, "Layer 2 Findings");
493
- if (!securityBody) {
494
- errors.push('07-review.md is missing a Layer 2 security section.');
495
- return {
496
- ok: false,
497
- errors,
498
- hasSecurityFinding: false,
499
- hasNoChangeAttestation: false
500
- };
501
- }
502
- const securityTableRowPattern = /^\|\s*[^|\n]+\|\s*[^|\n]+\|\s*security\s*\|\s*[^|\n]+\|\s*[^|\n]+\|/imu;
503
- const securityBulletPattern = /^[*-]\s+.*\b(?:security|auth|injection|secret|credential|permission)\b/imu;
504
- const hasSecurityFinding = securityTableRowPattern.test(securityBody) || securityBulletPattern.test(securityBody);
505
- const attestationMatch = /\b(NO_CHANGE_ATTESTATION|NO_SECURITY_IMPACT)\b\s*:\s*(.*)/iu.exec(securityBody);
506
- const attestationToken = attestationMatch?.[1] ?? "NO_CHANGE_ATTESTATION";
507
- const hasNoChangeAttestation = Boolean(attestationMatch && attestationMatch[2]?.trim().length > 0);
508
- if (attestationMatch && attestationMatch[2]?.trim().length === 0) {
509
- errors.push(`${attestationToken} must include a non-empty rationale.`);
510
- }
511
- if (!hasSecurityFinding && !hasNoChangeAttestation) {
512
- errors.push("Layer 2 security evidence missing: include at least one security finding or `NO_CHANGE_ATTESTATION: <reason>` / `NO_SECURITY_IMPACT: <reason>`.");
513
- }
514
- return {
515
- ok: errors.length === 0,
516
- errors,
517
- hasSecurityFinding,
518
- hasNoChangeAttestation
519
- };
520
- }
@@ -1,2 +0,0 @@
1
- import { type StageLintContext } from "./shared.js";
2
- export declare function lintReviewStage(ctx: StageLintContext): Promise<void>;
@@ -1,113 +0,0 @@
1
- import { evaluateInvestigationTrace, markdownFieldRegex, sectionBodyByName } from "./shared.js";
2
- import { checkReviewTddNoCrossArtifactDuplication } from "./review-army.js";
3
- export async function lintReviewStage(ctx) {
4
- const { projectRoot, track, raw, absFile, sections, findings, parsedFrontmatter, brainstormShortCircuitBody, brainstormShortCircuitActivated, staleDiagramAuditEnabled, isTrivialOverride } = ctx;
5
- evaluateInvestigationTrace(ctx, "Changed-File Coverage");
6
- // Universal Layer 2.7 structural checks (superpowers requesting + receiving).
7
- const frameBody = sectionBodyByName(sections, "Pre-Critic Self-Review");
8
- if (frameBody !== null) {
9
- const required = [
10
- "Build/lint/type-check/tests passed locally",
11
- "Diff matches spec/plan (no scope creep)",
12
- "Evidence (commands + result):",
13
- "Goal:",
14
- "Approach:",
15
- "Risk areas:",
16
- "Verification done:",
17
- "Open questions"
18
- ];
19
- const missing = required.filter((token) => {
20
- const escaped = token
21
- .replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")
22
- .replace(/\\:/gu, "\\s*:");
23
- return !new RegExp(escaped, "iu").test(frameBody);
24
- });
25
- findings.push({
26
- section: "Pre-Critic Self-Review Coverage",
27
- required: true,
28
- rule: "Pre-Critic Self-Review must include key self-check lines plus Goal, Approach, Risk areas, Verification done, and Open questions.",
29
- found: missing.length === 0,
30
- details: missing.length === 0
31
- ? "Pre-Critic Self-Review covers all required fields."
32
- : `Pre-Critic Self-Review is missing field(s): ${missing.join(", ")}.`
33
- });
34
- }
35
- const criticBody = sectionBodyByName(sections, "Critic Subagent Dispatch");
36
- if (criticBody !== null) {
37
- const required = [
38
- "Critic agent definition path",
39
- "Dispatch surface",
40
- "Frame sent",
41
- "Critic returned"
42
- ];
43
- const missing = required.filter((token) => !criticBody.includes(token));
44
- findings.push({
45
- section: "Critic Subagent Dispatch Shape",
46
- required: true,
47
- rule: "Critic Subagent Dispatch must declare agent definition path, dispatch surface, frame sent, and critic-returned summary.",
48
- found: missing.length === 0,
49
- details: missing.length === 0
50
- ? "Critic dispatch metadata complete."
51
- : `Critic Subagent Dispatch is missing field(s): ${missing.join(", ")}.`
52
- });
53
- }
54
- const receivingBody = sectionBodyByName(sections, "Receiving Posture");
55
- if (receivingBody !== null) {
56
- const ack = /no performative agreement/iu.test(receivingBody);
57
- findings.push({
58
- section: "Receiving Posture Anti-Sycophancy",
59
- required: true,
60
- rule: "Receiving Posture must affirm `No performative agreement (forbidden openers acknowledged)`.",
61
- found: ack,
62
- details: ack
63
- ? "Receiving posture acknowledged anti-sycophancy."
64
- : "Receiving Posture is missing the anti-sycophancy acknowledgement line."
65
- });
66
- }
67
- const dupResult = await checkReviewTddNoCrossArtifactDuplication(projectRoot);
68
- findings.push({
69
- section: "review.no_cross_artifact_duplication",
70
- required: true,
71
- rule: "[P1] review.no_cross_artifact_duplication — when a finding ID appears in both `06-tdd.md > Per-Slice Review` and `07-review-army.json`, severity and disposition must match (review cites tdd; never re-classifies).",
72
- found: dupResult.ok,
73
- details: dupResult.ok
74
- ? dupResult.tddArtifactExists && dupResult.reviewArtifactExists
75
- ? "No cross-artifact severity/disposition conflicts between tdd Per-Slice Review and review-army findings."
76
- : "Skipped: tdd Per-Slice Review or review-army artifact not present."
77
- : dupResult.errors.join(" ")
78
- });
79
- const lensCoverageBody = sectionBodyByName(sections, "Lens Coverage");
80
- if (lensCoverageBody === null) {
81
- findings.push({
82
- section: "reviewer.lens_coverage_missing",
83
- required: true,
84
- rule: "[P1] reviewer.lens_coverage_missing — review artifact must include `## Lens Coverage` with Performance/Compatibility/Observability/Security lines.",
85
- found: false,
86
- details: "No ## heading matching required section \"Lens Coverage\"."
87
- });
88
- }
89
- else {
90
- const performance = markdownFieldRegex("Performance", "NO_IMPACT|FOUND_\\d+").test(lensCoverageBody);
91
- const compatibility = markdownFieldRegex("Compatibility", "NO_IMPACT|FOUND_\\d+").test(lensCoverageBody);
92
- const observability = markdownFieldRegex("Observability", "NO_IMPACT|FOUND_\\d+").test(lensCoverageBody);
93
- const security = markdownFieldRegex("Security", "routed\\s+to\\s+security-reviewer").test(lensCoverageBody);
94
- const missing = [];
95
- if (!performance)
96
- missing.push("Performance");
97
- if (!compatibility)
98
- missing.push("Compatibility");
99
- if (!observability)
100
- missing.push("Observability");
101
- if (!security)
102
- missing.push("Security");
103
- findings.push({
104
- section: "reviewer.lens_coverage_missing",
105
- required: true,
106
- rule: "[P1] reviewer.lens_coverage_missing — `Lens Coverage` must include Performance/Compatibility/Observability (`NO_IMPACT` or `FOUND_<n>`) and Security routing line.",
107
- found: missing.length === 0,
108
- details: missing.length === 0
109
- ? "Lens Coverage includes all required reviewer lens lines."
110
- : `Lens Coverage missing or malformed line(s): ${missing.join(", ")}.`
111
- });
112
- }
113
- }