cohorte 1.3.4 → 1.5.0

package/core/templates/steps/init-pipeline/02-interview-gaps.md

@@ -20,7 +20,7 @@ Ask ONLY what you couldn't confidently detect. Batch related questions. Cover:
   Recommended option: dot/failures-only reporter (`--reporter=dot` vitest/playwright, `--silent`
   jest, `-q` pytest, `--quiet` eslint/ruff — whatever the detected runner supports). These land in
   `test_quiet_cmd`/`lint_quiet_cmd` + `commands.test_quiet`/`lint_quiet` and are what agents and the
-  `/review`·`/smoke` pre-flight actually run (SCHEMA.md §Output discipline). If the human declines or
+  `/review` pre-flight actually run (SCHEMA.md §Output discipline). If the human declines or
   the runner has no such flag, leave `""` — consumers then fall back to `<cmd> 2>&1 | tail -40`.
 - **Contract** — mechanism (`shared-types-zod` / `openapi` / `protobuf` / `json-schema` / `none`) and
   where feature contracts are authored. If `none`, surfaces sync by the spec prose alone.

package/core/templates/steps/init-pipeline/04-write-render.md

@@ -15,7 +15,7 @@
    (`<SURFACE_EXTRA_NEVER>`, `<SURFACE_DESIGN_INPUT>`, `<SURFACE_TDD_STEP1>` — fill design-related ones
    only when `uses_design`).
    Leave the fixed agents as-is (generic, shipped by the installer): `review.md`, `release.md`,
-   `smoke.md`, `profile-reader.md`.
+   `profile-reader.md`.
 4. **Generate `.claude/gate-config.json`** from the `gate` block — copy all five keys verbatim:
    `{"deny": [...], "ask": [...], "ask_on_default_branch": [...], "default_branch": "<vcs.default_branch>",
    "preflight": {"enabled": <gate.preflight.enabled>, "agents": [...], "max_age_minutes": <n>}}`
@@ -27,7 +27,11 @@
    variants** and repo-wide `commands.*` equivalents as `Bash(<cmd>:*)` rules, plus read-only git —
    `Bash(git status:*)`, `Bash(git diff:*)`, `Bash(git log:*)`, `Bash(git rev-parse:*)` — plus the
    shipped pipeline scripts for BOTH cores (`Bash(.claude/pipeline/scripts/:*)` and
-   `Bash(~/.claude/pipeline/scripts/:*)` — preflight, kanban-move, telemetry-send), and the
+   `Bash(~/.claude/pipeline/scripts/:*)` — preflight, kanban-move, telemetry-send) **plus the
+   `bash`-prefixed form the `/loop` driver uses** (`Bash(bash .claude/pipeline/scripts/loop.sh:*)`
+   and `Bash(bash ~/.claude/pipeline/scripts/loop.sh:*)`) — those prefix rules match a command
+   *starting* with the path, so `bash <path>` needs its own entry or `/loop` stalls on a permission
+   prompt at every launch, and the
    retrieval provider's MCP tools when wired (e.g. `mcp__serena`). Never allowlist anything matching
    a `gate.ask`/`gate.deny` pattern. Mention the human can widen it later with
    `/fewer-permission-prompts`) + the hooks, **conditioned on the install mode:**
@@ -86,8 +90,8 @@
     `build_cmd`s that are non-empty). Derive the setup steps from the detected stack — mirror what a
     sibling workflow does if one exists. `/ship` watches these checks before the merge.
 11. **Metrics sink & report buffer:** add `.claude/pipeline-metrics.jsonl` to `.gitignore` — `/build`,
-    `/review`, `/fix` and `/smoke` append per-dispatch evidence there (SCHEMA §Specialization reads it).
-    Also add `specs/reports/` — `/review` and `/smoke` stage their last report there so a `/fix` (or
+    `/review` and `/fix` append per-dispatch evidence there (SCHEMA §Specialization reads it).
+    Also add `specs/reports/` — `/review` stages its last report there so a `/fix` (or
     `/spec` Mode B) survives a `/clear`; it's a derived buffer, not a versioned artifact.
 12. **Design system:** if `design.enabled` with a snapshot dir, note that `/align-ds` is active; else the
     `/align-ds` command will no-op with a clear message.

package/core/workflows/audit.js

@@ -21,9 +21,67 @@ export const meta = {
   ],
 }
 
-const target = (typeof args === 'string' ? args.trim() : args && args.target) || ''
+// The Workflow runtime hands `args` to a script verbatim, so a caller that passes a
+// JSON-ENCODED STRING instead of a real object gets that string back here. The old
+// `typeof args === 'string' ? args.trim()` then took the whole blob as the value — which
+// is how a report landed on disk named `specs/reports/{"feature": "x"}.md`, and how
+// maxRounds/smoke were silently dropped on the same run. Parse it back into the object
+// it was meant to be; a bare slug stays valid shorthand.
+const ARGS = (() => {
+  if (typeof args === 'string') {
+    const t = args.trim()
+    if (t.startsWith('{')) {
+      try { const o = JSON.parse(t); if (o && typeof o === 'object' && !Array.isArray(o)) return o } catch {}
+    }
+    return { feature: t, target: t }
+  }
+  return args && typeof args === 'object' ? args : {}
+})()
+const target = ARGS.target || ''
 
-const PROFILE = { type: 'object', additionalProperties: true }
+// The profile-reader returns through a StructuredOutput tool call, and a haiku agent
+// intermittently nests the whole profile as a JSON *string* under a single wrapper field
+// ({"output": "{\"surfaces\": …}"}) instead of putting the profile's keys at the top level.
+// The schema here used to be {type:'object', additionalProperties:true} — no declared
+// properties, no required keys — so that wrapper validated cleanly and every field then read
+// as undefined: `surfaces` fell back to [], parallel([]) dispatched zero agents, the
+// dead-agent guard had no surfaces to find missing, and the run reported a verdict having
+// done nothing. On the surface it is indistinguishable from a clean run with an empty diff.
+// Declaring the shape gives the tool layer something to validate and the agent something to
+// aim at; unwrapProfile() salvages a wrapped return that still gets through; and the
+// zero-surface abort below makes the silent-success path impossible either way.
+// See also the structured-output section of core/agents/profile-reader.md.
+const PROFILE = {
+  type: 'object', additionalProperties: true,
+  properties: {
+    error: { type: 'string', description: 'set ONLY when PIPELINE.md is missing or unparseable' },
+    surfaces: {
+      type: 'array',
+      description: "one entry per surface, at the TOP LEVEL of this object — never a JSON string",
+      items: {
+        type: 'object', required: ['key'], additionalProperties: true,
+        properties: { key: { type: 'string' }, path: { type: 'string' }, agent: { type: 'string' } },
+      },
+    },
+  },
+}
+
+// Salvage a profile handed back as JSON text rather than as an object — either the whole
+// return, or nested under a single wrapper field. Anything already shaped like a profile
+// (has `surfaces`, or is the documented `{error}` failure shape) passes through untouched.
+const unwrapProfile = p => {
+  if (typeof p === 'string') { try { return JSON.parse(p) } catch { return null } }
+  if (!p || typeof p !== 'object') return null
+  if (Array.isArray(p.surfaces) || p.error) return p
+  for (const v of Object.values(p)) {
+    if (typeof v !== 'string') continue
+    try {
+      const inner = JSON.parse(v)
+      if (inner && typeof inner === 'object' && !Array.isArray(inner)) return inner
+    } catch {}
+  }
+  return p
+}
 
 const GATES = {
   type: 'object', required: ['failures'], additionalProperties: false,
@@ -64,15 +122,21 @@ const BACKLOG = {
 
 // ── Phase 0 — profile ────────────────────────────────────────────────────────
 phase('Profile')
-const profile = await agent(
+const profile = unwrapProfile(await agent(
   'Return this project\'s PIPELINE.md `yaml pipeline-profile` block as JSON, per your instructions.',
   { agentType: 'profile-reader', label: 'profile', schema: PROFILE, effort: 'low' },
-)
+))
 if (!profile || profile.error) {
   return { error: `profile unreadable: ${(profile && profile.error) || 'profile-reader returned nothing'}` }
 }
 const cmds = profile.commands || {}
 const surfaces = Array.isArray(profile.surfaces) ? profile.surfaces : []
+// A profile with no surfaces cannot do this workflow's work, and every later
+// guard compares against `surfaces` — an empty list makes them all vacuously
+// pass. Fail loudly here instead of finishing with nothing done.
+if (!surfaces.length) {
+  return { error: 'profile has no surfaces — nothing would be audited. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /doctor' }
+}
 const quiet = (q, full) => (q && !String(q).startsWith('<') ? q : full ? `${full} 2>&1 | tail -40` : '')
 const scope = target || 'the whole repo'
 

package/core/workflows/refactor.js

@@ -29,13 +29,72 @@ export const meta = {
 // /refactor handles it with less overhead than a workflow run.
 const MIN_ITEMS = 5
 
+// The Workflow runtime hands `args` to a script verbatim, so a caller that passes a
+// JSON-ENCODED STRING instead of a real object gets that string back here. The old
+// `typeof args === 'string' ? args.trim()` then took the whole blob as the value — which
+// is how a report landed on disk named `specs/reports/{"feature": "x"}.md`, and how
+// maxRounds/smoke were silently dropped on the same run. Parse it back into the object
+// it was meant to be; a bare slug stays valid shorthand.
+const ARGS = (() => {
+  if (typeof args === 'string') {
+    const t = args.trim()
+    if (t.startsWith('{')) {
+      try { const o = JSON.parse(t); if (o && typeof o === 'object' && !Array.isArray(o)) return o } catch {}
+    }
+    return { feature: t, target: t }
+  }
+  return args && typeof args === 'object' ? args : {}
+})()
+
 const wanted = (() => {
-  const d = args && args.domains
+  const d = ARGS.domains
   if (!d || d === 'all') return 'all'
   return Array.isArray(d) ? d : [String(d)]
 })()
 
-const PROFILE = { type: 'object', additionalProperties: true }
+// The profile-reader returns through a StructuredOutput tool call, and a haiku agent
+// intermittently nests the whole profile as a JSON *string* under a single wrapper field
+// ({"output": "{\"surfaces\": …}"}) instead of putting the profile's keys at the top level.
+// The schema here used to be {type:'object', additionalProperties:true} — no declared
+// properties, no required keys — so that wrapper validated cleanly and every field then read
+// as undefined: `surfaces` fell back to [], parallel([]) dispatched zero agents, the
+// dead-agent guard had no surfaces to find missing, and the run reported a verdict having
+// done nothing. On the surface it is indistinguishable from a clean run with an empty diff.
+// Declaring the shape gives the tool layer something to validate and the agent something to
+// aim at; unwrapProfile() salvages a wrapped return that still gets through; and the
+// zero-surface abort below makes the silent-success path impossible either way.
+// See also the structured-output section of core/agents/profile-reader.md.
+const PROFILE = {
+  type: 'object', additionalProperties: true,
+  properties: {
+    error: { type: 'string', description: 'set ONLY when PIPELINE.md is missing or unparseable' },
+    surfaces: {
+      type: 'array',
+      description: "one entry per surface, at the TOP LEVEL of this object — never a JSON string",
+      items: {
+        type: 'object', required: ['key'], additionalProperties: true,
+        properties: { key: { type: 'string' }, path: { type: 'string' }, agent: { type: 'string' } },
+      },
+    },
+  },
+}
+
+// Salvage a profile handed back as JSON text rather than as an object — either the whole
+// return, or nested under a single wrapper field. Anything already shaped like a profile
+// (has `surfaces`, or is the documented `{error}` failure shape) passes through untouched.
+const unwrapProfile = p => {
+  if (typeof p === 'string') { try { return JSON.parse(p) } catch { return null } }
+  if (!p || typeof p !== 'object') return null
+  if (Array.isArray(p.surfaces) || p.error) return p
+  for (const v of Object.values(p)) {
+    if (typeof v !== 'string') continue
+    try {
+      const inner = JSON.parse(v)
+      if (inner && typeof inner === 'object' && !Array.isArray(inner)) return inner
+    } catch {}
+  }
+  return p
+}
 
 const OPEN = {
   type: 'object', required: ['domains'], additionalProperties: false,
@@ -65,14 +124,20 @@ const VERIFY = {
 
 // ── Phase 0 — profile ────────────────────────────────────────────────────────
 phase('Profile')
-const profile = await agent(
+const profile = unwrapProfile(await agent(
   'Return this project\'s PIPELINE.md `yaml pipeline-profile` block as JSON, per your instructions.',
   { agentType: 'profile-reader', label: 'profile', schema: PROFILE, effort: 'low' },
-)
+))
 if (!profile || profile.error) {
   return { error: `profile unreadable: ${(profile && profile.error) || 'profile-reader returned nothing'}` }
 }
 const surfaces = Array.isArray(profile.surfaces) ? profile.surfaces : []
+// A profile with no surfaces cannot do this workflow's work, and every later
+// guard compares against `surfaces` — an empty list makes them all vacuously
+// pass. Fail loudly here instead of finishing with nothing done.
+if (!surfaces.length) {
+  return { error: 'profile has no surfaces — nothing would be refactored. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /doctor' }
+}
 const byKey = Object.fromEntries(surfaces.map(s => [s.key, s]))
 const contractPath = (profile.contract && profile.contract.path) || ''
 const base = (profile.vcs && profile.vcs.default_branch) || 'main'

package/core/workflows/review.js

@@ -26,10 +26,73 @@ export const meta = {
   ],
 }
 
-const feature = typeof args === 'string' ? args.trim() : args && args.feature
+// The Workflow runtime hands `args` to a script verbatim, so a caller that passes a
+// JSON-ENCODED STRING instead of a real object gets that string back here. The old
+// `typeof args === 'string' ? args.trim()` then took the whole blob as the value — which
+// is how a report landed on disk named `specs/reports/{"feature": "x"}.md`, and how
+// maxRounds/smoke were silently dropped on the same run. Parse it back into the object
+// it was meant to be; a bare slug stays valid shorthand.
+const ARGS = (() => {
+  if (typeof args === 'string') {
+    const t = args.trim()
+    if (t.startsWith('{')) {
+      try { const o = JSON.parse(t); if (o && typeof o === 'object' && !Array.isArray(o)) return o } catch {}
+    }
+    return { feature: t, target: t }
+  }
+  return args && typeof args === 'object' ? args : {}
+})()
+const isSlug = s => typeof s === 'string' && /^[A-Za-z0-9._-]+$/.test(s)
+const feature = ARGS.feature
 if (!feature) throw new Error('cohorte-review needs args = {feature: "<feature_id>"}')
+if (!isSlug(feature)) {
+  throw new Error(`cohorte-review got a feature id that is not a slug: ${JSON.stringify(feature)}. ` +
+    'Pass args as a real object, e.g. {feature: "titlebar-project-switcher"} — not a JSON string.')
+}
+
+// The profile-reader returns through a StructuredOutput tool call, and a haiku agent
+// intermittently nests the whole profile as a JSON *string* under a single wrapper field
+// ({"output": "{\"surfaces\": …}"}) instead of putting the profile's keys at the top level.
+// The schema here used to be {type:'object', additionalProperties:true} — no declared
+// properties, no required keys — so that wrapper validated cleanly and every field then read
+// as undefined: `surfaces` fell back to [], parallel([]) dispatched zero agents, the
+// dead-agent guard had no surfaces to find missing, and the run reported a verdict having
+// done nothing. On the surface it is indistinguishable from a clean run with an empty diff.
+// Declaring the shape gives the tool layer something to validate and the agent something to
+// aim at; unwrapProfile() salvages a wrapped return that still gets through; and the
+// zero-surface abort below makes the silent-success path impossible either way.
+// See also the structured-output section of core/agents/profile-reader.md.
+const PROFILE = {
+  type: 'object', additionalProperties: true,
+  properties: {
+    error: { type: 'string', description: 'set ONLY when PIPELINE.md is missing or unparseable' },
+    surfaces: {
+      type: 'array',
+      description: "one entry per surface, at the TOP LEVEL of this object — never a JSON string",
+      items: {
+        type: 'object', required: ['key'], additionalProperties: true,
+        properties: { key: { type: 'string' }, path: { type: 'string' }, agent: { type: 'string' } },
+      },
+    },
+  },
+}
 
-const PROFILE = { type: 'object', additionalProperties: true }
+// Salvage a profile handed back as JSON text rather than as an object — either the whole
+// return, or nested under a single wrapper field. Anything already shaped like a profile
+// (has `surfaces`, or is the documented `{error}` failure shape) passes through untouched.
+const unwrapProfile = p => {
+  if (typeof p === 'string') { try { return JSON.parse(p) } catch { return null } }
+  if (!p || typeof p !== 'object') return null
+  if (Array.isArray(p.surfaces) || p.error) return p
+  for (const v of Object.values(p)) {
+    if (typeof v !== 'string') continue
+    try {
+      const inner = JSON.parse(v)
+      if (inner && typeof inner === 'object' && !Array.isArray(inner)) return inner
+    } catch {}
+  }
+  return p
+}
 
 const PREFLIGHT = {
   type: 'object', required: ['pass'], additionalProperties: false,
@@ -88,16 +151,22 @@ const VERDICT = {
 
 // ── Phase 0 — profile ────────────────────────────────────────────────────────
 phase('Profile')
-const profile = await agent(
+const profile = unwrapProfile(await agent(
   'Return this project\'s PIPELINE.md `yaml pipeline-profile` block as JSON, per your instructions.',
   { agentType: 'profile-reader', label: 'profile', schema: PROFILE, effort: 'low' },
-)
+))
 if (!profile || profile.error) {
   return { verdict: 'ABORTED', reason: `profile unreadable: ${(profile && profile.error) || 'profile-reader returned nothing'}` }
 }
 const cmds = profile.commands || {}
 const base = (profile.vcs && profile.vcs.default_branch) || 'main'
 const surfaces = Array.isArray(profile.surfaces) ? profile.surfaces : []
+// A profile with no surfaces cannot do this workflow's work, and every later
+// guard compares against `surfaces` — an empty list makes them all vacuously
+// pass. Fail loudly here instead of finishing with nothing done.
+if (!surfaces.length) {
+  return { verdict: 'ABORTED', reason: 'profile has no surfaces — nothing would be reviewed. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /doctor' }
+}
 const quiet = (q, full) => (q && !String(q).startsWith('<') ? q : full ? `${full} 2>&1 | tail -40` : '')
 const checks = [cmds.typecheck, quiet(cmds.lint_quiet, cmds.lint), quiet(cmds.test_quiet, cmds.test)]
   .filter(c => c && !String(c).startsWith('<'))