oh-my-opencode 5.0.0-beta.8 → 5.0.0-beta.80

package/packages/omo-codex/plugin/components/ulw-loop/src/plan-io.ts

@@ -1,61 +1,122 @@
-import { createReadStream } from "node:fs";
-import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { createInterface } from "node:readline";
-
+import { AsyncLocalStorage } from "node:async_hooks";
+import { readdirSync } from "node:fs";
 import { aggregateCodexObjectiveForScope } from "./goal-status.js";
+import { readLedger as reconcileLedger } from "./ledger.js";
 import {
 	repoRelative,
 	type UlwLoopScope,
 	ulwLoopDir,
 	ulwLoopGoalsPath,
-	ulwLoopLedgerPath,
 	ulwLoopRelativeDir,
+	ulwLoopStateLockPath,
 } from "./paths.js";
-import type { UlwLoopLedgerEntry, UlwLoopPlan } from "./types.js";
-import { iso, ULW_LOOP_DIR, ULW_LOOP_GOALS, ULW_LOOP_LEDGER, UlwLoopError } from "./types.js";
+import { commit, materialize, materializeSync } from "./plan-commit.js";
+import { readOptional, reconcilePlan } from "./plan-log.js";
+import { planMissingError } from "./plan-missing-recovery.js";
+import { type StateLockOptions, withStateLock } from "./state-lock.js";
+import {
+	iso,
+	ULW_LOOP_DIR,
+	ULW_LOOP_GOALS,
+	ULW_LOOP_LEDGER,
+	UlwLoopError,
+	type UlwLoopLedgerEntry,
+	type UlwLoopPlan,
+} from "./types.js";
+
+export function readLedger(repoRoot: string, scope?: UlwLoopScope): UlwLoopLedgerEntry[] {
+	const lockPath = ulwLoopStateLockPath(repoRoot, scope);
+	if (heldLocks.getStore()?.has(lockPath)) {
+		assertStateLockOwned(lockPath);
+		materializeSync(ulwLoopDir(repoRoot, scope));
+	}
+	return reconcileLedger(repoRoot, scope);
+}
+export { planExists } from "./plan-log.js";
 
 const LEGACY_OBJECTIVE_PREFIX = `Complete all ulw-loop stories in ${ULW_LOOP_DIR}/${ULW_LOOP_GOALS}: `;
 const LEGACY_OBJECTIVE = `Complete all ulw-loop stories listed in ${ULW_LOOP_DIR}/${ULW_LOOP_GOALS}. Use ${ULW_LOOP_DIR}/${ULW_LOOP_LEDGER} as the durable audit trail.`;
 const locks = new Map<string, Promise<undefined>>();
-
-function hasCode(error: unknown, code: string): boolean {
-	return error instanceof Error && "code" in error && error.code === code;
+interface LockContext {
+	readonly token: string;
+	readonly migrations: Map<string, UlwLoopLedgerEntry[]>;
 }
-
-function isLegacyEnumeratedAggregateObjective(objective: string | undefined): objective is string {
-	return objective === LEGACY_OBJECTIVE || Boolean(objective?.startsWith(LEGACY_OBJECTIVE_PREFIX));
+const heldLocks = new AsyncLocalStorage<ReadonlyMap<string, LockContext>>();
+const lockOptions = new AsyncLocalStorage<StateLockOptions>();
+export function withMutationLockOptions<T>(options: StateLockOptions, fn: () => Promise<T>): Promise<T> {
+	return lockOptions.run(options, fn);
 }
-
-function isSteeringKind(value: unknown): value is UlwLoopLedgerEntry["kind"] {
-	return (
-		value === "steering_accepted" ||
-		value === "steering_rejected" ||
-		value === "criteria_revised" ||
-		value === "batch_updated"
-	);
+function tokenAt(lockPath: string): string | undefined {
+	const raw = readOptional(lockPath);
+	if (raw === undefined) return undefined;
+	try {
+		const record: unknown = JSON.parse(raw);
+		return typeof record === "object" && record !== null && "token" in record && typeof record.token === "string"
+			? record.token
+			: undefined;
+	} catch (error) {
+		if (error instanceof SyntaxError) return undefined;
+		throw error;
+	}
+}
+export function assertStateLockOwned(lockPath: string): void {
+	const context = heldLocks.getStore()?.get(lockPath);
+	if (context === undefined) return;
+	if (tokenAt(lockPath) !== context.token)
+		throw new UlwLoopError("The ulw-loop mutation lock changed owners.", "ULW_LOOP_LOCK_LOST");
+}
+export function migrationEntries(plan: UlwLoopPlan): readonly UlwLoopLedgerEntry[] {
+	for (const context of heldLocks.getStore()?.values() ?? []) {
+		const entries = context.migrations.get(plan.goalsPath);
+		if (entries !== undefined) {
+			context.migrations.delete(plan.goalsPath);
+			return entries;
+		}
+	}
+	return [];
 }
-
 export async function withUlwLoopMutationLock<T>(repoRoot: string, fn: () => Promise<T>): Promise<T>;
 export async function withUlwLoopMutationLock<T>(
 	repoRoot: string,
 	scope: UlwLoopScope | undefined,
 	fn: () => Promise<T>,
+	options?: StateLockOptions,
 ): Promise<T>;
 export async function withUlwLoopMutationLock<T>(
 	repoRoot: string,
 	scopeOrFn: UlwLoopScope | (() => Promise<T>) | undefined,
 	maybeFn?: () => Promise<T>,
+	options: StateLockOptions = {},
 ): Promise<T> {
 	const scope = typeof scopeOrFn === "function" ? undefined : scopeOrFn;
 	const fn = typeof scopeOrFn === "function" ? scopeOrFn : maybeFn;
 	if (fn === undefined) throw new UlwLoopError("Missing ulw-loop mutation body.", "ULW_LOOP_LOCK_BODY_MISSING");
 	const lockKey = `${repoRoot}\0${ulwLoopRelativeDir(scope)}`;
+	const lockPath = ulwLoopStateLockPath(repoRoot, scope);
+	const locked = () =>
+		withStateLock(
+			lockPath,
+			async (token) => {
+				return heldLocks.run(
+					new Map([...(heldLocks.getStore() ?? []), [lockPath, { token, migrations: new Map() }]]),
+					async () => {
+						for (let attempt = 0; ; attempt += 1) {
+							try {
+								return await fn();
+							} catch (error) {
+								if (!(error instanceof UlwLoopError) || error.code !== "ULW_LOOP_PUBLISH_CONFLICT") throw error;
+								assertStateLockOwned(lockPath);
+								if (attempt !== 0) throw error;
+							}
+						}
+					},
+				);
+			},
+			{ ...lockOptions.getStore(), ...options },
+		);
 	const prior = locks.get(lockKey) ?? Promise.resolve(undefined);
-	const run = prior.then(fn, fn);
-	// The stored gate resolves to undefined so the map never retains fn's result
-	// (plans/audits), and it removes itself once no newer waiter replaced it —
-	// otherwise a long-lived host leaks one entry per (repo, scope) forever.
-	const gate: Promise<undefined> = run.then(
+	const run = prior.then(locked, locked);
+	const gate = run.then(
 		() => undefined,
 		() => undefined,
 	);
@@ -65,126 +126,86 @@ export async function withUlwLoopMutationLock<T>(
 	});
 	return run;
 }
-
-export async function readUlwLoopPlan(repoRoot: string, scope?: UlwLoopScope): Promise<UlwLoopPlan> {
+export function readUlwLoopPlanSync(repoRoot: string, scope?: UlwLoopScope): UlwLoopPlan {
 	const path = ulwLoopGoalsPath(repoRoot, scope);
-	let raw: string;
-	try {
-		raw = await readFile(path, "utf8");
-	} catch (error) {
-		if (!hasCode(error, "ENOENT")) throw error;
-		throw new UlwLoopError(
-			`No ulw-loop plan found at ${repoRelative(path, repoRoot)}. Run \`omo-agent-toolkit ulw-loop create-goals ...\` first.`,
-			"ULW_LOOP_PLAN_MISSING",
-			{ cause: error },
-		);
-	}
-	const parsed: UlwLoopPlan = JSON.parse(raw);
-	if (parsed.version !== 1 || !Array.isArray(parsed.goals)) {
+	const parsed = reconcilePlan(ulwLoopDir(repoRoot, scope));
+	if (parsed === undefined) throw planMissingError(repoRelative(path, repoRoot), listUlwLoopSessionIds(repoRoot));
+	if (parsed.version !== 1 || !Array.isArray(parsed.goals))
 		throw new UlwLoopError(`Invalid ulw-loop plan at ${repoRelative(path, repoRoot)}.`, "ULW_LOOP_PLAN_INVALID");
-	}
 	const previousObjective = parsed.codexObjective;
 	if (
 		(parsed.codexGoalMode ?? "per_story") === "aggregate" &&
-		isLegacyEnumeratedAggregateObjective(previousObjective)
+		previousObjective !== undefined &&
+		(previousObjective === LEGACY_OBJECTIVE || previousObjective.startsWith(LEGACY_OBJECTIVE_PREFIX))
 	) {
-		const now = iso();
 		parsed.codexObjective = aggregateCodexObjectiveForScope(scope);
 		parsed.codexObjectiveAliases = [...new Set([...(parsed.codexObjectiveAliases ?? []), previousObjective])];
-		parsed.updatedAt = now;
-		await writePlan(repoRoot, parsed, scope);
-		await appendLedger(
-			repoRoot,
-			{
-				at: now,
-				kind: "aggregate_objective_migrated",
-				message: "Migrated legacy enumerated aggregate Codex objective to the stable pointer objective.",
-				before: { codexObjective: previousObjective },
-				after: { codexObjective: parsed.codexObjective },
-			},
-			scope,
-		);
+		heldLocks
+			.getStore()
+			?.get(ulwLoopStateLockPath(repoRoot, scope))
+			?.migrations.set(parsed.goalsPath, [
+				{
+					at: iso(),
+					kind: "aggregate_objective_migrated",
+					before: { codexObjective: previousObjective },
+					after: { codexObjective: parsed.codexObjective },
+				},
+			]);
 	}
 	return parsed;
 }
-
+export async function readUlwLoopPlan(repoRoot: string, scope?: UlwLoopScope): Promise<UlwLoopPlan> {
+	if (heldLocks.getStore()?.has(ulwLoopStateLockPath(repoRoot, scope))) {
+		assertStateLockOwned(ulwLoopStateLockPath(repoRoot, scope));
+		await materialize(ulwLoopDir(repoRoot, scope));
+	}
+	return readUlwLoopPlanSync(repoRoot, scope);
+}
+export function listUlwLoopSessionIds(repoRoot: string): readonly string[] {
+	try {
+		return readdirSync(ulwLoopDir(repoRoot), { withFileTypes: true })
+			.filter((entry) => entry.isDirectory())
+			.map((entry) => entry.name)
+			.sort();
+	} catch {
+		return [];
+	}
+}
 export async function writePlan(repoRoot: string, plan: UlwLoopPlan, scope?: UlwLoopScope): Promise<void> {
-	await mkdir(ulwLoopDir(repoRoot, scope), { recursive: true });
-	const path = ulwLoopGoalsPath(repoRoot, scope);
-	const tmpPath = `${path}.${process.pid}.${Date.now()}.tmp`;
-	await writeFile(tmpPath, `${JSON.stringify(plan, null, 2)}\n`, "utf8");
-	await rename(tmpPath, path);
+	await commit(repoRoot, scope, { plan, entries: [] });
 }
-
 export async function appendLedger(repoRoot: string, entry: UlwLoopLedgerEntry, scope?: UlwLoopScope): Promise<void> {
 	await appendLedgerEntries(repoRoot, [entry], scope);
 }
-
 export async function appendLedgerEntries(
 	repoRoot: string,
 	entries: readonly UlwLoopLedgerEntry[],
 	scope?: UlwLoopScope,
 ): Promise<void> {
-	if (entries.length === 0) return;
-	await mkdir(ulwLoopDir(repoRoot, scope), { recursive: true });
-	await appendFile(
-		ulwLoopLedgerPath(repoRoot, scope),
-		`${entries.map((entry) => JSON.stringify(entry)).join("\n")}\n`,
-		"utf8",
-	);
+	if (entries.length > 0) await commit(repoRoot, scope, { plan: await readUlwLoopPlan(repoRoot, scope), entries });
 }
-
-/**
- * Streams raw ledger lines without materializing the file. Real ledgers reach
- * many MB (legacy entries embedded full-plan snapshots), so `readFile` here
- * ballooned every steer/dedup path; line-at-a-time keeps memory O(longest line).
- */
-async function* ledgerLines(repoRoot: string, scope?: UlwLoopScope): AsyncGenerator<string> {
-	const stream = createReadStream(ulwLoopLedgerPath(repoRoot, scope), { encoding: "utf8" });
-	const lines = createInterface({ input: stream, crlfDelay: Number.POSITIVE_INFINITY });
-	try {
-		for await (const line of lines) {
-			if (line.trim().length > 0) yield line;
-		}
-	} catch (error) {
-		if (!hasCode(error, "ENOENT")) throw error;
-	} finally {
-		lines.close();
-		stream.destroy();
-	}
+function isSteeringKind(value: unknown): boolean {
+	return (
+		value === "steering_accepted" ||
+		value === "steering_rejected" ||
+		value === "criteria_revised" ||
+		value === "batch_updated"
+	);
 }
-
 export async function readSteeringLedgerEntries(repoRoot: string, scope?: UlwLoopScope): Promise<UlwLoopLedgerEntry[]> {
-	const entries: UlwLoopLedgerEntry[] = [];
-	for await (const line of ledgerLines(repoRoot, scope)) {
-		const entry: UlwLoopLedgerEntry = JSON.parse(line);
-		if (isSteeringKind(entry.kind)) entries.push(entry);
-	}
-	return entries;
+	return readLedger(repoRoot, scope).filter((entry) => isSteeringKind(entry.kind));
 }
-
-/**
- * First accepted steering entry matching an idempotency key/prompt signature.
- * A cheap substring probe on the raw line skips JSON.parse for the vast
- * majority of entries, so dedup stays flat even on legacy multi-MB ledgers.
- */
 export async function findAcceptedSteeringLedgerEntry(
 	repoRoot: string,
 	key: string,
 	scope?: UlwLoopScope,
 ): Promise<UlwLoopLedgerEntry | undefined> {
-	const probe = JSON.stringify(key);
-	for await (const line of ledgerLines(repoRoot, scope)) {
-		if (!line.includes(probe)) continue;
-		const entry: UlwLoopLedgerEntry = JSON.parse(line);
-		if (!isSteeringKind(entry.kind)) continue;
-		if (entry.steering?.invariant.accepted !== true) continue;
-		if (
-			entry.idempotencyKey === key ||
-			entry.steering.idempotencyKey === key ||
-			entry.steering.promptSignature === key
-		)
-			return entry;
-	}
-	return undefined;
+	return readLedger(repoRoot, scope).find(
+		(entry) =>
+			isSteeringKind(entry.kind) &&
+			entry.steering?.invariant.accepted === true &&
+			(entry.idempotencyKey === key ||
+				entry.steering.idempotencyKey === key ||
+				entry.steering.promptSignature === key),
+	);
 }

package/packages/omo-codex/plugin/components/ulw-loop/src/plan-log.ts

@@ -0,0 +1,112 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { type UlwLoopScope, ulwLoopDir } from "./paths.js";
+import { UlwLoopError, type UlwLoopLedgerEntry, type UlwLoopPlan } from "./types.js";
+
+export interface PlanCommitRecord {
+	readonly version: 1;
+	readonly revision: number;
+	readonly plan: UlwLoopPlan;
+	readonly ledger: readonly UlwLoopLedgerEntry[];
+}
+export function hasCode(error: unknown, code: string): boolean {
+	return error instanceof Error && "code" in error && error.code === code;
+}
+export function readOptional(path: string): string | undefined {
+	try {
+		return readFileSync(path, "utf8");
+	} catch (error) {
+		if (hasCode(error, "ENOENT")) return undefined;
+		throw error;
+	}
+}
+export function logNames(dir: string): string[] {
+	try {
+		return readdirSync(join(dir, "revisions"))
+			.filter((name) => /^\d{8,}\.json$/.test(name))
+			.sort();
+	} catch (error) {
+		if (hasCode(error, "ENOENT")) return [];
+		throw error;
+	}
+}
+function readRecord(dir: string, name: string): PlanCommitRecord | undefined {
+	try {
+		const record: PlanCommitRecord = JSON.parse(readFileSync(join(dir, "revisions", name), "utf8"));
+		return record.version === 1 &&
+			Number.isInteger(record.revision) &&
+			record.plan?.version === 1 &&
+			Array.isArray(record.plan.goals) &&
+			Array.isArray(record.ledger)
+			? record
+			: undefined;
+	} catch (error) {
+		if (!(error instanceof SyntaxError)) throw error;
+		return undefined;
+	}
+}
+// Only the audit trail needs every record; plan reads use readNewestRecord.
+export function readRecords(dir: string): PlanCommitRecord[] {
+	const records: PlanCommitRecord[] = [];
+	for (const name of logNames(dir)) {
+		const record = readRecord(dir, name);
+		if (record !== undefined) records.push(record);
+	}
+	return records.sort((a, b) => a.revision - b.revision);
+}
+// Every ulw-loop status probe reads the plan, each record embeds a full plan copy, and records are never
+// deleted - so a plan read parses the newest record only, newest first, and stops there. Names are ordered
+// by their parsed revision because a wider zero-padding would break lexicographic order.
+export function readNewestRecord(dir: string): PlanCommitRecord | undefined {
+	const names = logNames(dir).sort((a, b) => Number.parseInt(b, 10) - Number.parseInt(a, 10));
+	for (const name of names) {
+		const record = readRecord(dir, name);
+		if (record !== undefined) return record;
+	}
+	return undefined;
+}
+export function reconcilePlan(dir: string): UlwLoopPlan | undefined {
+	const raw = readOptional(join(dir, "goals.json"));
+	let cached: UlwLoopPlan | undefined;
+	if (raw !== undefined) {
+		try {
+			cached = JSON.parse(raw);
+		} catch (error) {
+			if (!(error instanceof SyntaxError)) throw error;
+		}
+	}
+	const latest = readNewestRecord(dir);
+	if (latest === undefined) return cached;
+	if (cached === undefined) return latest.plan;
+	if ((cached.revision ?? 0) > latest.revision) return cached;
+	// A goals.json written outside the commit log (the removed tool path rewrote it wholesale, never
+	// stamping `revision`) can hold goals no snapshot has. Serving the snapshot would drop them, so the
+	// cache wins and is stamped with the snapshot's revision: the next publish derives N+1 from it and
+	// folds the whole plan into a real record instead of colliding with an existing revision file.
+	// A cache that names an OLDER revision is a lagging view of a force-recreate and never wins.
+	if (cached.revision === undefined || cached.revision === latest.revision) {
+		const published = new Set(latest.plan.goals.map((goal) => goal.id));
+		if (Array.isArray(cached.goals) && cached.goals.some((goal) => !published.has(goal.id)))
+			return { ...cached, revision: latest.revision };
+	}
+	return latest.plan;
+}
+// Goals are never removed from a plan, so every `goal_added` the reconciled ledger still carries must
+// have a goal in the projection. A projection that lacks one is truncated and must not become goals.json.
+export function assertProjectionComplete(plan: UlwLoopPlan, ledger: readonly UlwLoopLedgerEntry[]): void {
+	const present = new Set(plan.goals.map((goal) => goal.id));
+	const missing = new Set<string>();
+	for (const entry of ledger)
+		if (entry.kind === "goal_added" && entry.goalId !== undefined && !present.has(entry.goalId))
+			missing.add(entry.goalId);
+	if (missing.size === 0) return;
+	throw new UlwLoopError(
+		`Refusing to rewrite goals.json: the ledger records goals the plan projection lacks (${[...missing].join(", ")}). Restore those goals into the newest revisions/ record (keeping plan.revision equal to its file number) before mutating this run.`,
+		"ULW_LOOP_PROJECTION_TRUNCATED",
+		{ details: { missingGoalIds: [...missing] } },
+	);
+}
+export function planExists(repoRoot: string, scope?: UlwLoopScope): boolean {
+	const dir = ulwLoopDir(repoRoot, scope);
+	return existsSync(join(dir, "goals.json")) || logNames(dir).length > 0;
+}

package/packages/omo-codex/plugin/components/ulw-loop/src/plan-missing-recovery.ts

@@ -0,0 +1,61 @@
+import { UlwLoopError } from "./runtime.js";
+import type { UlwLoopToolkitSurface } from "./surface.js";
+
+export const ULW_LOOP_CREATE_GOALS_COMMAND = 'omo-agent-toolkit ulw-loop create-goals --brief "<brief>" --json';
+
+export function createGoalsAction(surface: UlwLoopToolkitSurface): string {
+	return surface === "omo-senpi" ? 'agentToolkit.createGoals({ brief: "<brief>" })' : ULW_LOOP_CREATE_GOALS_COMMAND;
+}
+
+export interface PlanMissingRecovery {
+	readonly message: string;
+	readonly details?: { readonly existingSessionIds: readonly string[] };
+}
+
+/**
+ * A missing plan is either "never bootstrapped" or "bootstrapped under a different
+ * session id"; the recovery text has to answer both without the caller guessing.
+ */
+export function planMissingRecovery(
+	existingSessionIds: readonly string[],
+	surface: UlwLoopToolkitSurface = "lazycodex",
+): PlanMissingRecovery {
+	const lines = [`Recovery: bootstrap the plan with \`${createGoalsAction(surface)}\`.`];
+	if (existingSessionIds.length === 0) return { message: lines.join("\n") };
+	lines.push(
+		surface === "omo-senpi"
+			? `Existing ulw-loop session ids under .omo/ulw-loop/: ${existingSessionIds.join(", ")}. The SDK is bound to the current session; resume the owning session to target its plan.`
+			: `Existing ulw-loop session ids under .omo/ulw-loop/: ${existingSessionIds.join(", ")}. Re-run with \`--session-id <id>\` to target one of them.`,
+	);
+	return { message: lines.join("\n"), details: { existingSessionIds } };
+}
+
+export function planMissingError(
+	planPath: string,
+	existingSessionIds: readonly string[],
+	surface: UlwLoopToolkitSurface = "lazycodex",
+): UlwLoopError {
+	const recovery = planMissingRecovery(existingSessionIds, surface);
+	return new UlwLoopError(`No ulw-loop plan found at ${planPath}.\n${recovery.message}`, "ULW_LOOP_PLAN_MISSING", {
+		...(recovery.details === undefined ? {} : { details: recovery.details }),
+	});
+}
+
+export function sessionScopeRequiredMessage(flag: string, existingSessionIds: readonly string[]): string {
+	const lines = [
+		"No ulw-loop session scope: neither the session env (OMO_ULW_LOOP_SESSION_ID / CODEX_SESSION_ID / CODEX_THREAD_ID / PI_SESSION_ID) nor the flag names this run, and the shared .omo/ulw-loop root is never used implicitly because every session in this directory would read and overwrite it.",
+		`Recovery: pass the scope explicitly: \`${flag} <id>\` (subprocess, eval, and hook contexts do not inherit the session env).`,
+	];
+	if (existingSessionIds.length > 0) {
+		lines.push(`Existing ulw-loop session ids under .omo/ulw-loop/: ${existingSessionIds.join(", ")}.`);
+	}
+	return lines.join("\n");
+}
+
+export function sessionIdRequiredMessage(flag: string): string {
+	return [
+		`${flag} requires a non-empty value.`,
+		"Recovery: subprocess, eval, and hook contexts do not inherit the ulw-loop session env (OMO_ULW_LOOP_SESSION_ID / CODEX_SESSION_ID / CODEX_THREAD_ID / PI_SESSION_ID),",
+		`so pass the scope explicitly: \`${flag} <id>\` (for example \`${flag} 01a05b8a-6763-7780-834f-319423b071ce\`).`,
+	].join("\n");
+}

package/packages/omo-codex/plugin/components/ulw-loop/src/quality-gate-aggregate.ts

@@ -0,0 +1,11 @@
+import type { ValidateQualityGateOptions } from "./quality-gate.js";
+import { validateQualityGate } from "./quality-gate.js";
+
+/**
+ * Compatibility entry point for callers that used the former pre-pass API.
+ * Validation is performed by the real parser, which collects defects across
+ * every nested field before throwing one aggregate error.
+ */
+export function aggregateQualityGateDefects(input: unknown, opts: ValidateQualityGateOptions | undefined): void {
+	validateQualityGate(input, opts);
+}

package/packages/omo-codex/plugin/components/ulw-loop/src/quality-gate-artifacts.ts

@@ -0,0 +1,123 @@
+import { resolve } from "node:path";
+import { isWithinAttemptDir } from "./paths.js";
+import type { ValidateQualityGateOptions } from "./quality-gate.js";
+import {
+	invalid,
+	isPoisoned,
+	markPoisonedArtifactKind,
+	section,
+	stringArray,
+	textField,
+} from "./quality-gate-fields.js";
+import type { UlwLoopManualQaArtifactKind, UlwLoopManualQaArtifactRef, UlwLoopManualQaSurface } from "./types.js";
+
+export const SUPPORTED_SURFACES: readonly UlwLoopManualQaSurface[] = ["cli", "http", "tmux", "browser", "gui", "data"];
+export const SUPPORTED_KINDS: readonly UlwLoopManualQaArtifactKind[] = [
+	"cli-transcript",
+	"log",
+	"screenshot",
+	"image",
+	"http-dump",
+	"data-diff",
+];
+const COMPATIBLE_KINDS: Readonly<Record<UlwLoopManualQaSurface, readonly UlwLoopManualQaArtifactKind[]>> = {
+	cli: ["cli-transcript", "log"],
+	tmux: ["cli-transcript", "log"],
+	http: ["http-dump"],
+	browser: ["screenshot", "image"],
+	gui: ["screenshot", "image"],
+	data: ["data-diff"],
+};
+
+function isSupportedSurface(value: unknown): value is UlwLoopManualQaSurface {
+	return SUPPORTED_SURFACES.some((surface) => surface === value);
+}
+function isSupportedKind(value: unknown): value is UlwLoopManualQaArtifactKind {
+	return SUPPORTED_KINDS.some((kind) => kind === value);
+}
+
+export function surfaceField(value: unknown, field: string): UlwLoopManualQaSurface {
+	if (isSupportedSurface(value)) return value;
+	invalid(`${field} must be a supported manual QA surface (${SUPPORTED_SURFACES.join(", ")}).`, field);
+	return "cli";
+}
+export function kindField(value: unknown, field: string): UlwLoopManualQaArtifactKind {
+	if (isSupportedKind(value)) return value;
+	invalid(
+		`${field} must be a supported artifact kind (${SUPPORTED_KINDS.join(", ")}); review/QA reports belong in codeReview.reportPath or gateReview.reportPath, not artifactRefs.`,
+		field,
+	);
+	return "log";
+}
+export function compatibleKindsFor(surface: UlwLoopManualQaSurface): readonly UlwLoopManualQaArtifactKind[] {
+	return COMPATIBLE_KINDS[surface];
+}
+export function artifactCompatible(surface: UlwLoopManualQaSurface, kind: UlwLoopManualQaArtifactKind): boolean {
+	return compatibleKindsFor(surface).includes(kind);
+}
+export function checkFile(path: string, field: string, opts?: ValidateQualityGateOptions): void {
+	if (opts?.repoRoot === undefined || opts.fs === undefined || isPoisoned(field)) return;
+	const absolute = resolve(opts.repoRoot, path);
+	if (!opts.fs.existsSync(absolute)) {
+		invalid(`${field} must point to an existing artifact.`, field);
+		return;
+	}
+	if (opts.fs.statSync(absolute).size <= 0) invalid(`${field} must point to a non-empty artifact.`, field);
+	if (
+		opts.currentAttemptDir !== undefined &&
+		!isWithinAttemptDir(absolute, resolve(opts.repoRoot, opts.currentAttemptDir))
+	)
+		invalid(
+			`${field} (${path}) must point to an artifact from the current attempt (${opts.currentAttemptDir}).`,
+			field,
+		);
+}
+export function artifactMap(refs: readonly UlwLoopManualQaArtifactRef[]): Map<string, UlwLoopManualQaArtifactRef> {
+	const byId = new Map<string, UlwLoopManualQaArtifactRef>();
+	for (const ref of refs) {
+		if (byId.has(ref.id)) invalid(`manualQa.artifactRefs contains duplicate ${ref.id}.`, "manualQa.artifactRefs");
+		byId.set(ref.id, ref);
+	}
+	return byId;
+}
+export function parseArtifactRefs(
+	value: unknown,
+	opts?: ValidateQualityGateOptions,
+): readonly UlwLoopManualQaArtifactRef[] {
+	if (!Array.isArray(value) || value.length === 0) {
+		invalid("manualQa.artifactRefs must not be empty.", "manualQa.artifactRefs");
+		return [];
+	}
+	return value.flatMap((item, index) => {
+		const prefix = `manualQa.artifactRefs[${index}]`;
+		const ref = section(item, prefix);
+		if (isPoisoned(prefix)) return [];
+		const pathField = `${prefix}.path`;
+		const idField = `${prefix}.id`;
+		const kindFieldName = `${prefix}.kind`;
+		const descriptionField = `${prefix}.description`;
+		const path = textField(ref["path"], pathField);
+		const id = textField(ref["id"], idField);
+		const kind = kindField(ref["kind"], kindFieldName);
+		if (isPoisoned(kindFieldName)) markPoisonedArtifactKind(id);
+		const description = textField(ref["description"], descriptionField);
+		checkFile(path, pathField, opts);
+		return [{ id, kind, description, path }];
+	});
+}
+export function referencedArtifacts(
+	value: unknown,
+	field: string,
+	byId: ReadonlyMap<string, UlwLoopManualQaArtifactRef>,
+): readonly UlwLoopManualQaArtifactRef[] {
+	const ids = stringArray(value, field);
+	if (isPoisoned(field)) return [];
+	return ids.flatMap((id) => {
+		const artifact = byId.get(id);
+		if (artifact === undefined) {
+			invalid(`${field} references unknown artifact ${id}.`, field);
+			return [];
+		}
+		return [artifact];
+	});
+}