devlyn-cli 4.2.11 → 4.2.13

package/bin/skill-history.json

@@ -151,6 +151,7 @@
       "f12077a8c5f5b6f08c1e220b6f4a191eca8de0daf35fd8ce060ec7a45bb700ff",
       "f133dd1c3c40f6b4cf6879285cf282dcac436a99479717d8cb6968ad885ce0a2",
       "f1b0f66a2079af7423e0889435dc3bc1e5e14c20e7d29d4d55a56217cdb036ee",
+      "f1b9e7216e6ba6cd39999326239c7e4ba96d0339beb4b68579800f11b1b28954",
       "f22d5b4ebe5f973cbbd5a1fc747c068915e0b4a5b0326754f6a750065091853c",
       "f2bcfa0471aba81a10e3d0e6fd43bd6ec670601a4ba3a7d719e595edf9ab032a",
       "f958bfabd2e056fea911526fba2196d2ed5a48828f576e5ce1657100b466db20",
@@ -301,6 +302,7 @@
       "0098d266ee9d7c79c0c0a0c30474e9bf13fa0c76911668b79206985136c94f80",
       "0122885c08069474ca4a0a5825f885364a62938885f0e501c09242d176c34b08",
       "05e824f63a6381e02042afb1df0f1437584e25a80de8e9db0bd9456aaeb7aab8",
+      "0601ee535419b7039d5da34bd9c8e1c2b3631307214e4afaf394dd47494090c7",
       "0cef055580e00f9ed439eacb2dff9d238bb11619457472016095a8915162fa4b",
       "0dc69c20434966015176d83baa6f95b3421f9e13d0b1bd608a22f0560eae1049",
       "0fe9b270d670f70da9d2535969b6117684b7c1517806b3029ebaf9624da8006c",
@@ -332,6 +334,7 @@
       "a3b852c30898b572021b32721638f67d9f44cae98653da3362456a7b88208de7",
       "a7d7d65fd5f672cb404e6069fdc42ad7077deaa80ed8500cfa8b382dab2e3e29",
       "aba66b674683935e4c28c93333896dc116ffe67e7a35fe30b3599a8be507e94e",
+      "b2e4437fa981317362d03ee032e1cfd8b686316e966c6ba12ecd619a009c80a6",
       "c1b8e3ebf38e2be8972aa003e9614a782cb4f195c69d20b95a475ebf9aaaab9e",
       "ce282a55328c2d071cacc377670fbebea4da4b9a7fee81b25293fb26763f17c9",
       "cf61a917a804503ef1e26fbb1cf498181e843a0758ec001f84edb7bcac837448",

package/config/skills/_shared/task-completion.md

@@ -159,12 +159,6 @@ resume its delivery. Allocate a replacement from the current remote base,
 include only the still-needed task changes and correction, and verify and
 accept it anew. If the predecessor has merged, make a new follow-up instead.
 
-Queue drains follow ideate's loop protocol
-(`../devlyn-ideate/references/loop.md`): its evidence-derived `loop` result is
-bound with `accept` before the queue-only terminal commit is attached with
-`attach`, and dependent local tasks allocate from the accepted predecessor's
-source. Failed results keep custody and a recovery ref but are never published.
-
 ## Deliver and resume
 
 Wait for your children, stop your dev servers and task writers, then leave the

package/config/skills/devlyn-ideate/SKILL.md

@@ -92,7 +92,7 @@ A removed flag stops with its instruction and selects no other behavior.
 
 ## add
 
-An absolute path to a package's `meta.md` is added as it is; anything else is planned first. Add with `python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" add '<absolute meta.md>'`, the only writer of a loop's queue file `docs/specs/<loop-id>/queue.md`; never edit one by hand. In every delivery mode add makes no commit on the checked-out branch and leaves the branch, the index and tracked files as they are: it holds the package and its rows at `refs/devlyn/captures/<loop-id>`, records the add and removes the package copies equal to that capture. Report the capture ref and its `git show` command, any `cleanup` entry, and that a revision needs a new loop id. It refuses package changes staged in the index (unstage them and add again), and a retry of the same add reports it as added, also once the copies are gone. Tasks start from committed state, a local loop from the branch it was added on and `auto`/`pr` from the remote base, so commit, and for `auto`/`pr` push, whatever the plan depends on. A pending legacy raw-intent row of `docs/specs/queue.md` is replaced in place by a package whose `## Intent` reproduces the row verbatim, added with `--materialize <line>`.
+An absolute path to a package's `meta.md` is added as it is; anything else is planned first. Add with `python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" add '<absolute meta.md>'`, the only writer of a loop's queue file `docs/specs/<loop-id>/queue.md`; never edit one by hand. In every delivery mode add makes no commit on the checked-out branch and leaves the branch, the index and tracked files as they are: it holds the package and its rows at `refs/devlyn/captures/<loop-id>`, records the add and removes the package copies equal to that capture. Report the capture ref and its `git show` command, any `cleanup` entry, and that a revision needs a new loop id. A retry of the same add reports it as added, also once the copies are gone. Tasks start from committed state, a local loop from the branch it was added on and `auto`/`pr` from the remote base, so commit, and for `auto`/`pr` push, whatever the plan depends on. A pending legacy raw-intent row of `docs/specs/queue.md` is replaced in place by a package whose `## Intent` reproduces the row verbatim, added with `--materialize <line>`.
 
 ## status
 

package/config/skills/devlyn-ideate/references/loop.md

@@ -1,6 +1,6 @@
 # Loop protocol
 
-`drain` runs the queue serially. Each eligible task gets an owned worktree, committed inputs, one executor exchange, evidence-derived acceptance, a queue-only terminal commit and delivery. The executor works under the installed methodology (the CLAUDE.md/AGENTS.md instruction block); the loop adds no phase graph, reviewer quota, engine router or restart cycle. Formats: [package-format.md](package-format.md). Allocation, custody, delivery and cleanup follow the completion contract in `$DEVLYN_SHARED_DIR/task-completion.md`.
+`drain` runs the queue serially. Each eligible task gets an owned worktree, committed inputs, one executor exchange, evidence-derived acceptance, a queue-only terminal commit and delivery. The executor works under the installed methodology (the CLAUDE.md/AGENTS.md instruction block). Formats: [package-format.md](package-format.md).
 
 ## Commands
 
@@ -11,7 +11,7 @@ python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" drain --repo . [--local-only] [--wo
 
 Both print one JSON object; exit 1 is `BLOCKED` with a `reason`.
 
-- `status` takes `queue.lock` in the repository's Git directory and finishes `add`'s cleanup (step 1); it reports reconciled counts (`pending`, `active`, `accepted`, `failed`, `blocked`, `legacy_pending`), the `next` task, `blockers`, deliveries still pending with their resume (drain again until the terminal commit is attached, then `task-complete.py complete --receipt <receipt>`), and under `cleanup` the package copies `add` kept or could not remove.
+- `status` takes `queue.lock` in the repository's Git directory and finishes `add`'s cleanup (step 1); it reports reconciled counts (`pending`, `active`, `accepted`, `failed`, `blocked`, `legacy_pending`), the `next` task, `blockers`, deliveries still pending with their resume (drain again until the terminal commit is attached, then the printed completion command; add `--writers-stopped` only after stopping the task's writers), and under `cleanup` the package copies `add` kept or could not remove.
 - `drain` ends `DRAINED` (no runnable task remains; open deliveries show per task), `WAITING` (a task waits with its reason, or legacy rows need planning) or `BLOCKED` (unreadable or ambiguous authoritative queue, invalid invocation, preflight refusal or held drain lock). Progress lines `devlyn-loop: <task>: <event>` go to stderr.
 - `--local-only` (alias `--no-push`) keeps the loop local. A manifest `delivery: local-only` and any earlier local receipt of the loop keep that restriction for later drains. A local loop needs no remote; nothing is fetched or pushed. An `auto`/`pr` loop none of whose tasks has a pushed PR runs as a local loop from its capture and the branch it was added on. Once one has, that PR is never rewritten to local and the loop is never run locally: its tasks wait, naming the PR, while other work continues.
 - Worktrees default to `<repo parent>/<repo name>.devlyn/<loop-id>/<task-id>`.
@@ -32,7 +32,7 @@ The host supplies the executor and maps its configured engine to the argv; the l
 6. **Derive acceptance** with `acceptance.py accept`. It binds the committed contract to the packet digests; requires the candidate to be the owned branch head with HEAD checked out on that branch, to descend from the inputs, to leave the package (its queue file included) and `docs/specs/queue.md` untouched and to have a clean worktree; executes each declared command on that source, recording raw stdout/stderr and exit, timeout or spawn outcomes (a runner result is reused only when it is wholly clean — no reasons, so no failed check and no source change during its checks — for the same source and contract digests, with unchanged streams); evaluates the file and diff guards against the inputs; confirms the source is unchanged; checks review records; and writes `.devlyn/loop/acceptance.json`. Missing checks, missing review coverage and open binding findings cannot produce `[x]`, and acceptance weakening is not repair. This establishes command outcomes and evidence completeness, not a reviewer's semantic judgment; deliberate evidence forgery is outside the trust model.
 7. **Bind before terminal metadata.** `task-complete.py accept --receipt <receipt> --acceptance <worktree>/.devlyn/loop/acceptance.json` takes evidence custody and points the recovery ref at the source. Failed results are bound the same way; they never become a frontier or a publishable product.
 8. **Commit the terminal transition** under the queue lock: one commit whose sole parent is the bound source and whose only change is this task's row in `docs/specs/<loop-id>/queue.md` (`[x]`, or `[F] — <first reason> (receipt <id>)`), validated as the only legal transition. Then `task-complete.py attach --receipt <receipt> --commit <terminal> --file docs/specs/<loop-id>/queue.md` records it separately from the source and moves the recovery ref to it.
-9. **Deliver** with `task-complete.py complete --receipt <receipt> --writers-stopped`, plus `--local-only` or, until the receipt records a mode, the manifest's `--mode auto|pr`, so a per-task `--mode` persists. Local-only keeps source, custody and the recovery ref with no remote effect. `auto`/`pr` publish the terminal commit under the completion contract; a pending or refused delivery keeps product acceptance, resources and a resume command. Where writer cessation cannot be observed, or a process still uses the tree, a merged delivery settles (`COMPLETE`) with its workspace, task ref and custody retained and reported under workspace cleanup; retained cleanup never blocks the queue. Failed products are never published. The receipt's `delivery` field checkpoints the latest outcome. A local chain is never turned into stacked PRs; publishing it requires integrated acceptance of the actual publication candidate.
+9. **Deliver** after waiting for the executor, with `task-complete.py complete --receipt <receipt> --writers-stopped`, plus `--local-only` or, until the receipt records a mode, the packet's `--mode auto|pr`, so a per-task `--mode` persists. Local-only keeps source, custody and the recovery ref with no remote effect. `auto`/`pr` publish the terminal commit under the completion contract; a pending or refused delivery keeps product acceptance, resources and a resume command. Where writer cessation cannot be observed, or a process still uses the tree, a merged delivery settles (`COMPLETE`) with its workspace, task ref and custody retained and reported under workspace cleanup; retained cleanup never blocks the queue. Failed products are never published. The receipt's `delivery` field checkpoints the latest outcome. A local chain is never turned into stacked PRs; publishing it requires integrated acceptance of the actual publication candidate.
 10. **Recover** from durable state only:
 
     | Interrupted | Resume |

package/config/skills/devlyn-ideate/scripts/acceptance.py

@@ -267,18 +267,32 @@ def guard_results(packet, expected, source):
         results.append({"rule": "forbidden_files", "subject": path, "passed": path not in changed, "blocking": True})
     limit = expected.get("max_deps_added", 0)
     try:
-        added = len(dependency_names(work, source) - dependency_names(work, inputs))
-        subject, passed = f"{added} added, limit {limit}", added <= limit
+        before = dependency_names(work, inputs)
     except ValueError as exc:
-        subject, passed = str(exc), False
+        subject, passed = (f"inputs package.json at {inputs} unreadable; limit cannot apply. "
+                           f"Fix base: regular npm-valid file; start a new loop. {exc}"), False
+    else:
+        try:
+            added = len(dependency_names(work, source) - before)
+            subject, passed = f"{added} added, limit {limit}", added <= limit
+        except ValueError as exc:
+            subject, passed = f"candidate package.json at {source} is invalid; fix it in the candidate. {exc}", False
     results.append({"rule": "max_deps_added", "subject": subject, "passed": passed, "blocking": True})
     return results
 
 
 def dependency_names(work, commit):
     """Package names under dependencies and devDependencies of the root package.json at `commit`; a missing file has none."""
-    if not git(work, "ls-tree", commit, "--", "package.json").stdout:
+    entry = git(work, "ls-tree", commit, "--", "package.json").stdout
+    if not entry:
         return set()
+    mode, kind, _ = entry.split(maxsplit=2)
+    if mode not in (b"100644", b"100755") or kind != b"blob":
+        kind = "symlink" if mode == b"120000" else "gitlink" if mode == b"160000" else kind.decode("ascii")
+        if mode == b"120000":
+            target = git(work, "show", f"{commit}:package.json").stdout.decode("utf-8", "backslashreplace")
+            kind += f" to {target!r}"
+        raise ValueError(f"{kind} (mode {mode.decode('ascii')}); expected a regular file")
     try:
         # Read as npm reads it: a leading BOM is ignored, a duplicate key's last value wins, a null section is empty and
         # NaN or Infinity is invalid.
@@ -718,7 +732,9 @@ class AcceptanceTests(unittest.TestCase):
         moved from dependencies to devDependencies counts 0 and is accepted; an invalid package.json fails the guard,
         naming it. A leading UTF-8 BOM, which npm and Node accept, is ignored: with one at both commits, one added
         counts 1. A duplicate key (its last value wins) and a null dependencies section, which npm also reads, count 0
-        and are accepted; NaN, which npm rejects, fails the guard."""
+        and are accepted; NaN, which npm rejects, fails the guard. Invalid inputs fail before an invalid candidate,
+        naming inputs and the base repair/new loop action; invalid candidates name the candidate and its repair.
+        The action survives the queue's 200-character first-reason collapse, with parser detail after it."""
         passing = {"verification_commands": [{"argv": [sys.executable, "-c", "pass"], "contract_refs": ["R1"]}]}
 
         def guard(inputs, source):
@@ -743,7 +759,7 @@ class AcceptanceTests(unittest.TestCase):
         with self.subTest("invalid"):
             commit, result, deps = guard({"dependencies": {"a": "1"}}, '{"dependencies": {"a": "1",}}\n')
             self.assertEqual((deps["passed"], result["verdict"]), (False, "FAILED"))
-            self.assertIn(f"package.json at {commit} is invalid", deps["subject"])
+            self.assertTrue(deps["subject"].startswith(f"candidate package.json at {commit} is invalid; fix it in the candidate."))
         with self.subTest("BOM"):
             self.write("package.json", "\ufeff" + json.dumps({"dependencies": {"a": "1"}}))
             _, _, deps = guard(None, "\ufeff" + json.dumps({"dependencies": {"a": "1", "b": "1"}}))
@@ -755,7 +771,72 @@ class AcceptanceTests(unittest.TestCase):
         with self.subTest("NaN"):
             commit, result, deps = guard({"dependencies": {"a": "1"}}, '{"config": {"threshold": NaN}}')
             self.assertEqual((deps["passed"], result["verdict"]), (False, "FAILED"))
-            self.assertIn(f"package.json at {commit} is invalid", deps["subject"])
+            self.assertTrue(deps["subject"].startswith(f"candidate package.json at {commit} is invalid; fix it in the candidate."))
+        with self.subTest("invalid inputs precede invalid candidate"):
+            self.write("package.json", "{")
+            _, result, deps = guard(None, "[")
+            self.assertEqual((deps["passed"], result["verdict"]), (False, "FAILED"))
+            self.assertTrue(deps["subject"].startswith(f"inputs package.json at {self.packet['inputs_sha']} unreadable; limit cannot apply."))
+            one_line = runpy.run_path(str(Path(__file__).with_name("queue.py")))["one_line"]
+            for size in (40, 64):
+                reason = result["reasons"][0].replace(self.packet["inputs_sha"], "a" * size)
+                self.assertIn("Fix base: regular npm-valid file; start a new loop", one_line(reason))
+
+    @unittest.skipIf(os.name == "nt", "a symbolic link needs a privilege on Windows")
+    def test_max_deps_added_rejects_symlinks(self):
+        """Prediction: a candidate package.json symlink to a file named '{}' containing a dependency fails the guard,
+        naming the candidate, symlink and target; before, the target text parsed as an empty object and passed limit 0.
+        An ordinary candidate symlink also names its target and candidate repair. An inputs symlink fails first even
+        when the candidate is invalid JSON, naming inputs and the base repair/new loop action."""
+        passing = {"verification_commands": [{"argv": [sys.executable, "-c", "pass"], "contract_refs": ["R1"]}]}
+        package = self.work / "package.json"
+        one_line = runpy.run_path(str(Path(__file__).with_name("queue.py")))["one_line"]
+        for side, target in (("candidate", "{}"), ("inputs", "deps.json"), ("candidate", "deps.json")):
+            with self.subTest(side=side, target=target):
+                package.unlink(missing_ok=True)
+                self.write(target, json.dumps({"dependencies": {"hidden": "1"}}))
+                if side == "inputs":
+                    package.symlink_to(target)
+                else:
+                    self.write("package.json", "{}")
+                self.inputs(passing)
+                package.unlink()
+                if side == "candidate":
+                    package.symlink_to(target)
+                else:
+                    self.write("package.json", "[")
+                source = self.commit("product")
+                result = self.submit(source)
+                deps = next(g for g in result["guards"] if g["rule"] == "max_deps_added")
+                self.assertEqual((deps["passed"], result["verdict"]), (False, "FAILED"))
+                commit = self.packet["inputs_sha"] if side == "inputs" else source
+                self.assertTrue(deps["subject"].startswith(f"{side} package.json at {commit}"))
+                self.assertIn(f"symlink to {target!r}", deps["subject"])
+                action = "Fix base: regular npm-valid file; start a new loop" if side == "inputs" else "fix it in the candidate."
+                self.assertIn(action, one_line(result["reasons"][0]))
+
+    def test_max_deps_added_requires_regular_blobs(self):
+        """Prediction: both regular blob modes count names; a tree or gitlink at package.json fails the guard with
+        its kind and candidate repair, rather than escaping as an AcceptanceError without a guard subject."""
+        self.write("package.json", '{"dependencies": {"a": "1"}}')
+        self.inputs()
+        inputs = self.packet["inputs_sha"]
+        blob = self.g("rev-parse", f"{inputs}:package.json")
+        tree = self.g("rev-parse", f"{inputs}^{{tree}}")
+        for mode, kind, oid in (("100644", "blob", blob), ("100755", "blob", blob),
+                                ("040000", "tree", tree), ("160000", "commit", inputs)):
+            with self.subTest(mode=mode):
+                made = subprocess.run(["git", "-C", str(self.work), "mktree"],
+                                      input=f"{mode} {kind} {oid}\tpackage.json\n".encode(), capture_output=True, check=True)
+                source = self.g("commit-tree", made.stdout.decode().strip(), "-p", inputs, "-m", "package kind")
+                deps = next(g for g in guard_results(self.packet, {}, source) if g["rule"] == "max_deps_added")
+                if kind == "blob":
+                    self.assertEqual(dependency_names(self.work, source), {"a"})
+                    self.assertEqual((deps["passed"], deps["subject"]), (True, "0 added, limit 0"))
+                else:
+                    self.assertFalse(deps["passed"])
+                    self.assertTrue(deps["subject"].startswith(f"candidate package.json at {source} is invalid; fix it in the candidate."))
+                    self.assertIn("gitlink" if kind == "commit" else kind, deps["subject"])
 
 
 def main():

package/config/skills/devlyn-ideate/scripts/queue.py

@@ -1238,11 +1238,21 @@ def summary(v, row):
         item["reason"] = reason
     if receipt:
         acceptance_record = receipt.get("acceptance") or {}
-        branch, worktree = None, None
+        branch, worktree, resume = None, None, None
         try:
             worktree = receipt["worktree"] if receipt.get("worktree") and Path(receipt["worktree"]).exists() else None
             if receipt.get("branch") and ref_value(v["anchor"], "refs/heads/" + receipt["branch"]):
                 branch = receipt["branch"]
+            if receipt.get("acceptance") and receipt.get("delivery") not in SETTLED:
+                if receipt.get("queue"):
+                    argv = [sys.executable, str(SKILLS / "_shared/task-complete.py"), "complete", "--receipt", str(state["path"])]
+                    if receipt.get("writers_released"):
+                        argv.append("--writers-stopped")
+                    if not receipt.get("local_only") and not receipt.get("mode_override"):
+                        argv += ["--mode", read_json(state["path"].parent / "packet.json")["delivery"]]
+                    resume = shlex.join(argv)
+                else:
+                    resume = "drain again: the terminal commit is not attached yet"
         except (LoopError, OSError) as exc:
             diagnostic = (f"task summary unavailable: {row['identity']} worktree {receipt.get('worktree')}, "
                           f"branch {receipt.get('branch')}: {exc}; repair access and drain again")
@@ -1250,9 +1260,7 @@ def summary(v, row):
                 v["cleanup"].append(diagnostic)
         item.update(allocation_base=receipt.get("baseline"), **{"source" if state["kind"] == "accepted" else "candidate": receipt.get("source_sha")},
                     terminal=(receipt.get("queue") or {}).get("commit"), delivery=receipt.get("delivery"), pr=receipt.get("pr_url"),
-                    resume=None if not receipt.get("acceptance") or receipt.get("delivery") in SETTLED
-                    else shlex.join([sys.executable, str(SKILLS / "_shared/task-complete.py"), "complete", "--receipt", str(state["path"])])
-                    if receipt.get("queue") else "drain again: the terminal commit is not attached yet",
+                    resume=resume,
                     assumptions=acceptance_record.get("assumptions", []),
                     questions=[r.removeprefix("needs-review: ") for r in acceptance_record.get("reasons", []) if r.startswith("needs-review: ")],
                     worktree=worktree,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn-cli",
-  "version": "4.2.11",
+  "version": "4.2.13",
   "description": "Loop & harness engineering for AI coding agents (Claude Code, Codex, and any AGENTS.md-driven agent) — core engineering principles for CLAUDE.md/AGENTS.md and a loop designer that splits one intent into tasks agents drain hands-free",
   "homepage": "https://github.com/fysoul17/devlyn-cli#readme",
   "bin": {