devlyn-cli 4.2.4 → 4.2.5

package/bin/devlyn.js

@@ -880,6 +880,7 @@ function install(targets, global, optionalNames = []) {
     else installClaudeCore();
   }
   log(`\n✅ devlyn ${PKG.version} installed`, 'green');
+  if (global) log('The principles block installs per project: run npx devlyn-cli in the project without --global.');
   noticeGlobalDrift(roots);
   return roots;
 }

package/bin/skill-history.json

@@ -1,10 +1,11 @@
 {
-  "source": "devlyn-cli@4.1.0 (npm tarball sha1 398ff07d3d689b56cc22e18ac50260bc6e4e9e85); devlyn-cli@4.2.0 (npm tarball sha1 c93c2fb1cf5630b18d2eba0085182c14fddbe2d5); devlyn-cli@4.2.4 (_shared and devlyn-ideate, fingerprinted from an install of its packed tarball); whole-tree fingerprints from bin/skill-ownership.js; deprecated commands: commands/ and optional-commands/*/ files of devlyn-cli 0.0.1-0.5.8 (every published version that shipped them), LF-normalized SHA-256",
+  "source": "devlyn-cli@4.1.0 (npm tarball sha1 398ff07d3d689b56cc22e18ac50260bc6e4e9e85); devlyn-cli@4.2.0 (npm tarball sha1 c93c2fb1cf5630b18d2eba0085182c14fddbe2d5); devlyn-cli@4.2.4 and 4.2.5 (_shared and devlyn-ideate, fingerprinted from an install of each packed tarball); whole-tree fingerprints from bin/skill-ownership.js; deprecated commands: commands/ and optional-commands/*/ files of devlyn-cli 0.0.1-0.5.8 (every published version that shipped them), LF-normalized SHA-256",
   "skills": {
     "_shared": [
       "eb3327d5e6940bd5e0459fa28c9ab323d9c58ccfdeb9426c19cd027cc4e5c4ed",
       "8c80926ab03b2477e52264495b35c2116f65fc51b02e8c56e441b5705872392a",
-      "3c81c575cc43d70488865b440204cb399091405d9b7f81dbf047a32d3d5ac045"
+      "3c81c575cc43d70488865b440204cb399091405d9b7f81dbf047a32d3d5ac045",
+      "6546d6b833701f2641a004802cfc17ec62442e5d0003f396cb0231b676ba9a4a"
     ],
     "devlyn-design-ui": [
       "91080266232fb62b6f1d45932184f065589e12eb66f02fb6442527c6dfcd81b6"
@@ -16,7 +17,8 @@
     "devlyn-ideate": [
       "8ff5148cc65b4608c35b29afd6fef20d42d8da93a094144d98cfc63e74089b6e",
       "5824f07e455fe1c3942bf595a12e935258d4c0a851ca1bf741db915603d1c4e0",
-      "7f451e48e391643b34f6249244bc47d93d6303875e7b092771e3af0718343bc1"
+      "7f451e48e391643b34f6249244bc47d93d6303875e7b092771e3af0718343bc1",
+      "d6433bf0f96dd9dd485c3623885255738654674b3e23cfcc1a2cfd24f3cda96e"
     ],
     "devlyn-queue": [
       "4c7d988dcd154c7bf658d2d24cd7868955df9d854ed87eb784742d6d4bb229e0"

package/config/skills/_shared/role-config.py

@@ -102,7 +102,8 @@ def resolve(work, default_engine, *, available=None, shared=SHARED):
     """The project's executor pin, else the invoking CLI; status only, never a dispatch decision."""
     config, source = read_config(Path(work) / ".devlyn/engines.json", optional=True, shared=shared)
     engine = config.get("executor", default_engine)
-    adapter(engine, shared=shared)
+    # read_config validates pins; the invoking host needs no adapter to report its own default.
+    name(engine, "engine")
     available = available or (lambda candidate: shutil.which(candidate) is not None)
     return {"executor": {"engine": engine, "source": "engines.json" if "executor" in config else "default",
                          "availability": "CLI-present/auth-unchecked" if available(engine) else "CLI-unavailable"},
@@ -113,6 +114,7 @@ def select(work, default_engine, *, available=None, shared=SHARED):
     """The executor for dispatch. A pin is a promise: an unavailable pinned engine is never substituted."""
     result = resolve(work, default_engine, available=available, shared=shared)
     executor = result["executor"]
+    adapter(executor["engine"], shared=shared)
     if executor["source"] == "engines.json" and executor["availability"] == "CLI-unavailable":
         fail(f"pinned executor {executor['engine']} is unavailable; install and authenticate its CLI, "
              f"verify `{executor['engine']} --version`, and retry, or pin an available engine with `devlyn-engines executor <name>`",

package/config/skills/_shared/task-complete.py

@@ -375,9 +375,14 @@ def gh(receipt, *args):
     return command(["gh", *args, "--repo", "github.com/"+receipt["repository"]])
 
 
+def repository_info(repository):
+    info = json.loads(command(["gh", "repo", "view", "github.com/"+repository, "--json", "nameWithOwner,url,defaultBranchRef,mergeCommitAllowed"]))
+    require(info["nameWithOwner"].lower() == repository.lower() and info["url"].lower() == "https://github.com/"+repository.lower(), "GitHub repository identity changed")
+    return info
+
+
 def repo_policy(receipt):
-    info = json.loads(command(["gh", "repo", "view", "github.com/"+receipt["repository"], "--json", "nameWithOwner,url,defaultBranchRef,mergeCommitAllowed"]))
-    require(info["nameWithOwner"].lower() == receipt["repository"].lower() and info["url"].lower() == "https://github.com/"+receipt["repository"].lower(), "GitHub repository identity changed")
+    info = repository_info(receipt["repository"])
     require(info["defaultBranchRef"]["name"] == receipt["base"] and receipt["branch"] != info["defaultBranchRef"]["name"], "base/default branch changed; retain resources")
     return info
 
@@ -799,7 +804,7 @@ def main():
     attachment = actions.add_parser("attach")
     attachment.add_argument("--receipt", required=True)
     attachment.add_argument("--commit", required=True)
-    attachment.add_argument("--file", default="docs/specs/queue.md")
+    attachment.add_argument("--file", required=True)
     completion = actions.add_parser("complete")
     completion.add_argument("--receipt", required=True)
     completion.add_argument("--acceptance")
@@ -2141,6 +2146,12 @@ class CompletionTests(unittest.TestCase):
                 result, _ = self.cli("accept", "--receipt", self.receipt, "--acceptance", acceptance, success=False)
                 self.assertEqual(result["status"], "FAILED" if verdict == "FAILED" else "BLOCKED", result)
 
+    def test_attach_requires_an_explicit_queue_file(self):
+        result = self.run_cmd([sys.executable, str(Path(__file__).resolve()), 'attach',
+                               '--receipt', str(self.root / 'absent.json'), '--commit', 'HEAD'], success=False)
+        self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+        self.assertIn('the following arguments are required: --file', result.stderr)
+
     def test_attach_requires_the_terminal_checkout_only_for_a_publishable_result(self):
         for verdict in ("ACCEPTED", "FAILED"):
             with self.subTest(verdict=verdict):

package/config/skills/devlyn-ideate/SKILL.md

@@ -100,6 +100,8 @@ Run `python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" status --repo .` and report it
 
 ## drain
 
+`status`, `add` and `drain` write the repository's Git directory, and auto/pr delivery needs network access, so a sandboxed host runs them with escalation or full access.
+
 Follow [loop.md](references/loop.md). The executor is the configured route, the `.devlyn/engines.json` `executor` pin or else this CLI, checked per `_shared/engine-preflight.md`. Pass its argv after `--`. `<git dir>` is the output of `git rev-parse --path-format=absolute --git-common-dir`, where the executor commits and writes its submission; the drain fills `{worktree_git_dir}` with the task worktree's own Git directory, which Codex's sandbox keeps read-only unless that exact directory is listed:
 
 | Executor | argv |

package/config/skills/devlyn-ideate/references/loop.md

@@ -11,7 +11,7 @@ python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" drain --repo . [--local-only] [--wo
 
 Both print one JSON object; exit 1 is `BLOCKED` with a `reason`.
 
-- `status` writes nothing beyond finishing `add`'s cleanup (step 1): reconciled counts (`pending`, `active`, `accepted`, `failed`, `blocked`, `legacy_pending`), the `next` task, `blockers`, deliveries still pending with their resume (drain again until the terminal commit is attached, then `task-complete.py complete --receipt <receipt>`), and under `cleanup` the package copies `add` kept or could not remove.
+- `status` takes `queue.lock` in the repository's Git directory and finishes `add`'s cleanup (step 1); it reports reconciled counts (`pending`, `active`, `accepted`, `failed`, `blocked`, `legacy_pending`), the `next` task, `blockers`, deliveries still pending with their resume (drain again until the terminal commit is attached, then `task-complete.py complete --receipt <receipt>`), and under `cleanup` the package copies `add` kept or could not remove.
 - `drain` ends `DRAINED` (no runnable task remains; open deliveries show per task), `WAITING` (a task waits with its reason, or legacy rows need planning) or `BLOCKED` (conflict, invalid input or a recovery blocker). Progress lines `devlyn-loop: <task>: <event>` go to stderr.
 - `--local-only` (alias `--no-push`) keeps the loop local. A manifest `delivery: local-only` and any earlier local receipt of the loop keep that restriction for later drains. A local loop needs no remote; nothing is fetched or pushed. An `auto`/`pr` loop none of whose tasks has a pushed PR runs as a local loop from its capture and the branch it was added on. Once one has, that PR is never rewritten to local and the loop is never run locally: its tasks wait, naming the PR, while other work continues.
 - Worktrees default to `<repo parent>/<repo name>.devlyn/<loop-id>/<task-id>`.

package/config/skills/devlyn-ideate/scripts/queue.py

@@ -843,9 +843,9 @@ def evidence_ignored(anchor, common, start):
 
 
 def allocate(v, row, opts):
-    """Allocate the task's owned worktree, or return why it waits: origin names no GitHub repository, or its refreshed
-    remote base holds another version of the loop's package or lacks the checkout's instructions (waiting() checks a local
-    start before selection)."""
+    """Allocate the task's owned worktree, or return why it waits: origin names no GitHub repository, its base is not the
+    default, or its refreshed remote base holds another version of the loop's package or lacks the checkout's instructions
+    (waiting() checks a local start before selection)."""
     identity, loop, task = row["identity"], row["loop"], row["task"]
     package = v["packages"][loop]
     manifest = package["manifest"]
@@ -868,6 +868,13 @@ def allocate(v, row, opts):
         except helper["CompletionError"]:
             return (f"{manifest['delivery']} delivery needs an origin remote of the form https://github.com/<owner>/<repo>, "
                     "git@github.com:<owner>/<repo> or ssh://git@github.com/<owner>/<repo>; set one, or drain with --local-only")
+        try:
+            default = helper["repository_info"](values["repository"])["defaultBranchRef"]["name"]
+        except (helper["CompletionError"], OSError, KeyError, TypeError, ValueError) as exc:
+            return f"cannot check delivery repository: {exc}"
+        if manifest["base_ref"] != default:
+            return (f"{manifest['delivery']} delivery base {manifest['base_ref']} is not the repository's default branch {default}; "
+                    f"plan the loop on {default}, or drain with --local-only")
         try:
             start = helper["remote_base"]({"common_gitdir": str(common), "remote": "origin", "base": manifest["base_ref"]})
         except helper["CompletionError"] as exc:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn-cli",
-  "version": "4.2.4",
+  "version": "4.2.5",
   "description": "Loop & harness engineering for AI coding agents (Claude Code, Codex, and any AGENTS.md-driven agent) — core engineering principles for CLAUDE.md/AGENTS.md and a loop designer that splits one intent into tasks agents drain hands-free",
   "homepage": "https://github.com/fysoul17/devlyn-cli#readme",
   "bin": {