pi-cicd 1.0.13 → 1.0.15

package/install.mjs

@@ -34,6 +34,13 @@ const projectRoot = findProjectRoot(pkgRoot);
 function copySkills() {
   const skillsSrc = path.join(pkgRoot, "skills");
   const skillsDest = path.join(projectRoot, "skills", pkgName);
+
+  // Ensure destination is contained within projectRoot to prevent path traversal
+  const relativeDest = path.relative(projectRoot, skillsDest);
+  if (relativeDest.startsWith('..') || path.isAbsolute(relativeDest)) {
+    console.error(`ERROR: Refusing to copy skills outside project root: ${skillsDest}`);
+    return;
+  }
   
   console.log(`Copying skills from: ${skillsSrc}`);
   console.log(`Copying skills to: ${skillsDest}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-cicd",
-  "version": "1.0.13",
+  "version": "1.0.15",
   "description": "Extension for Pi coding agent",
   "type": "module",
   "main": "./index.ts",

package/src/config.ts

@@ -51,6 +51,29 @@ const DEFAULT_CONFIG: PiCiConfig = {
   },
 };
 
+/** Recursively merge `override` into `base`, handling nested objects.
+ * Does not mutate either argument.
+ */
+function deepMerge(base: Record<string, unknown>, override: Record<string, unknown>): Record<string, unknown> {
+	const result: Record<string, unknown> = { ...base };
+	for (const key of Object.keys(override)) {
+		const bv = base[key];
+		const ov = override[key];
+		if (
+			bv !== undefined && ov !== undefined &&
+			typeof bv === "object" && !Array.isArray(bv) &&
+			typeof ov === "object" && !Array.isArray(ov)
+		) {
+			result[key] = deepMerge(bv as Record<string, unknown>, ov as Record<string, unknown>);
+		} else {
+			result[key] = ov;
+		}
+	}
+	return result;
+}
+
+export { deepMerge };
+
 /**
  * Load pi-ci configuration from `.pi/pi-ci.json` (if present) merged with defaults.
  */
@@ -62,38 +85,23 @@ export async function loadCiConfig(cwd?: string): Promise<PiCiConfig> {
   try {
     text = await readFile(configPath, "utf-8");
   } catch {
-    return { ...DEFAULT_CONFIG };
+    return structuredClone(DEFAULT_CONFIG) as PiCiConfig;
   }
 
-  const raw: unknown = JSON.parse(text);
-  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-    return { ...DEFAULT_CONFIG };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    raw = null;
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return structuredClone(DEFAULT_CONFIG) as PiCiConfig;
   }
 
-  const user = raw as Record<string, unknown>;
-  return {
-    enabled: typeof user.enabled === "boolean" ? user.enabled : DEFAULT_CONFIG.enabled,
-    idleTimeoutMs:
-      typeof user.idleTimeoutMs === "number" ? user.idleTimeoutMs : DEFAULT_CONFIG.idleTimeoutMs,
-    maxRetries:
-      typeof user.maxRetries === "number" ? user.maxRetries : DEFAULT_CONFIG.maxRetries,
-    retryBackoffMaxMs:
-      typeof user.retryBackoffMaxMs === "number"
-        ? user.retryBackoffMaxMs
-        : DEFAULT_CONFIG.retryBackoffMaxMs,
-    exitCodes: {
-      ...DEFAULT_CONFIG.exitCodes,
-      ...(typeof user.exitCodes === "object" && user.exitCodes !== null
-        ? (user.exitCodes as Partial<PiCiExitCodeConfig>)
-        : {}),
-    },
-    report: {
-      ...DEFAULT_CONFIG.report,
-      ...(typeof user.report === "object" && user.report !== null
-        ? (user.report as Partial<PiCiReportConfig>)
-        : {}),
-    },
-  };
+  return deepMerge(
+    structuredClone(DEFAULT_CONFIG) as unknown as Record<string, unknown>,
+    raw as Record<string, unknown>,
+  ) as unknown as PiCiConfig;
 }
 
-export { DEFAULT_CONFIG };
+export { DEFAULT_CONFIG };

package/src/deploy/canary-deploy.ts

@@ -127,10 +127,10 @@ export class CanaryDeploy {
 
     return {
       timestamp: Date.now(),
-      successRate: 95 + Math.random() * 5,
-      latency: 50 + Math.random() * 100,
-      errorRate: Math.random() * 3,
-      requests: Math.floor(100 + Math.random() * 900),
+      successRate: 95 + (new Uint32Array(1)[0]! % 5),
+      latency: 50 + (new Uint32Array(1)[0]! % 100),
+      errorRate: (new Uint32Array(1)[0]! % 3),
+      requests: Math.floor(100 + (new Uint32Array(1)[0]! % 900)),
     };
   }
 

package/src/deploy/landing-queue.ts

@@ -3,6 +3,8 @@
  * Based on gstack /landing-report pattern
  */
 
+
+import { randomUUID } from 'node:crypto';
 export type DeployStatus = 'pending' | 'deploying' | 'deployed' | 'failed' | 'cancelled';
 export type DeployEnvironment = 'staging' | 'production';
 
@@ -37,7 +39,7 @@ export class LandingQueue {
    */
   enqueue(version: string, environment: DeployEnvironment, message?: string): QueuedDeploy {
     const deploy: QueuedDeploy = {
-      id: `deploy-${Date.now()}-${Math.random().toString(36).slice(2, 6)}`,
+      id: `deploy-${randomUUID()}`,
       version,
       environment,
       status: 'pending',

package/src/headless/answer-injector.ts

@@ -23,7 +23,12 @@ export async function loadAnswers(filePath: string): Promise<AnswerEntry[]> {
     return [];
   }
 
-  const raw: unknown = JSON.parse(text);
+  let raw: unknown;
+  try {
+    raw = JSON.parse(text);
+  } catch {
+    raw = { answer: text };
+  }
 
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error(`Answers file must contain a JSON object with an "answers" array`);
@@ -54,7 +59,12 @@ export async function loadAnswers(filePath: string): Promise<AnswerEntry[]> {
  * Synchronous variant that reads from a string (useful for testing).
  */
 export function parseAnswers(jsonText: string): AnswerEntry[] {
-  const raw: unknown = JSON.parse(jsonText);
+  let raw: unknown;
+  try {
+    raw = JSON.parse(jsonText);
+  } catch {
+    raw = { answer: jsonText };
+  }
 
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error(`Answers file must contain a JSON object with an "answers" array`);

package/src/headless/orchestrator.ts

@@ -68,6 +68,9 @@ export class HeadlessOrchestrator {
    * 2. Execute steps via the hook, checking for answer injection
    * 3. On idle timeout → retry with exponential backoff
    * 4. Emit ci_end with the resolved exit code
+   *
+   * In "plan" mode, iterates through all plan steps sequentially.
+   * In "single" mode, executes one prompt to completion.
    */
   async run(prompt: string, mode: "single" | "plan"): Promise<OrchestratorResult> {
     const startTime = Date.now();
@@ -81,24 +84,29 @@ export class HeadlessOrchestrator {
     this.emit(startEvent);
 
     let lastExitCode: ExitCode = EXIT_CODES.ERROR;
-    let retries = 0;
 
-    while (retries <= this.maxRetries) {
-      const result = await this.runAttempt(prompt);
-      lastExitCode = result;
+    if (mode === "plan") {
+      // Plan mode: iterate through steps until done or failure
+      lastExitCode = await this.runPlanMode(prompt);
+    } else {
+      // Single mode: one attempt with retries
+      let retries = 0;
+      while (retries <= this.maxRetries) {
+        const result = await this.runAttempt(prompt);
+        lastExitCode = result;
 
-      if (lastExitCode === EXIT_CODES.SUCCESS) break;
-      if (lastExitCode === EXIT_CODES.BLOCKED || lastExitCode === EXIT_CODES.CANCELLED) break;
+        if (lastExitCode === EXIT_CODES.SUCCESS) break;
+        if (lastExitCode === EXIT_CODES.BLOCKED || lastExitCode === EXIT_CODES.CANCELLED) break;
 
-      // Retry on error/timeout
-      retries++;
-      if (retries <= this.maxRetries) {
-        const delay = Math.min(
-          RESTART_CONFIG.baseDelayMs *
-            Math.pow(RESTART_CONFIG.backoffMultiplier, retries - 1),
-          RESTART_CONFIG.maxDelayMs,
-        );
-        await sleep(delay);
+        retries++;
+        if (retries <= this.maxRetries) {
+          const delay = Math.min(
+            RESTART_CONFIG.baseDelayMs *
+              Math.pow(RESTART_CONFIG.backoffMultiplier, retries - 1),
+            RESTART_CONFIG.maxDelayMs,
+          );
+          await sleep(delay);
+        }
       }
     }
 
@@ -118,6 +126,50 @@ export class HeadlessOrchestrator {
     };
   }
 
+  /**
+   * Run in plan mode: iterate through steps until all complete or one fails.
+   * Each step prompt is derived from the original prompt + step context.
+   */
+  private async runPlanMode(prompt: string): Promise<ExitCode> {
+    let stepIndex = 0;
+    let lastExitCode: ExitCode = EXIT_CODES.SUCCESS;
+
+    while (stepIndex <= this.maxRetries) {
+      const stepPrompt = `[Step ${stepIndex + 1}] ${prompt}`;
+      const result = await this.runAttempt(stepPrompt);
+      lastExitCode = result;
+
+      if (result === EXIT_CODES.SUCCESS) {
+        // Step succeeded, emit step completion and continue to next
+        this.emit({
+          type: "ci_step_complete",
+          timestamp: new Date().toISOString(),
+          step: stepIndex + 1,
+        });
+        stepIndex++;
+        continue;
+      }
+
+      if (result === EXIT_CODES.BLOCKED || result === EXIT_CODES.CANCELLED) {
+        // Stop without retry
+        return result;
+      }
+
+      // Error or timeout - retry this step
+      stepIndex++;
+      if (stepIndex <= this.maxRetries) {
+        const delay = Math.min(
+          RESTART_CONFIG.baseDelayMs *
+            Math.pow(RESTART_CONFIG.backoffMultiplier, stepIndex - 1),
+          RESTART_CONFIG.maxDelayMs,
+        );
+        await sleep(delay);
+      }
+    }
+
+    return lastExitCode;
+  }
+
   /**
    * Single attempt: run with idle detection.
    */

package/src/index.ts

@@ -4,35 +4,39 @@
  * Registers the /ci status command and CI lifecycle hooks.
  */
 
-import type { CIEvent, CIOptions, ExitCode } from "./src/types.ts";
-import { EXIT_CODES } from "./src/types.ts";
+import type { CIEvent, CIOptions, ExitCode } from "./types.ts";
+import { EXIT_CODES } from "./types.ts";
 import {
   ciStatusHandler,
   createRunTracker,
   clearRuns,
   registerRun,
   type CIRunRecord,
-} from "./src/tools/ci_status.ts";
-import { CIPipeline, type PipelineResult } from "./src/ci/pipeline.ts";
-import { generateReport } from "./src/ci/report.ts";
+} from "./tools/ci_status.ts";
+import { CIPipeline, type PipelineResult } from "./ci/pipeline.ts";
+import { generateReport } from "./ci/report.ts";
 
 // Re-export for consumers
-export { EXIT_CODES } from "./src/types.ts";
-export { resolveExitCode } from "./src/headless/exit-codes.ts";
-export { loadAnswers, matchAnswer, parseAnswers } from "./src/headless/answer-injector.ts";
-export { IdleDetector } from "./src/headless/idle-detector.ts";
-export { CIEventCollector, writeCIEvent } from "./src/headless/jsonl-stream.ts";
-export { HeadlessOrchestrator } from "./src/headless/orchestrator.ts";
-export { CIPipeline } from "./src/ci/pipeline.ts";
-export { createPR, detectBaseBranch } from "./src/ci/pr-creator.ts";
-export { parseTestResults } from "./src/ci/test-runner.ts";
-export { generateReport } from "./src/ci/report.ts";
-export { ciStatusHandler, registerRun, clearRuns, createRunTracker } from "./src/tools/ci_status.ts";
-export { loadCiConfig, DEFAULT_CONFIG } from "./src/config.ts";
-export type { PiCiConfig } from "./src/config.ts";
+export { EXIT_CODES } from "./types.ts";
+export { resolveExitCode } from "./headless/exit-codes.ts";
+export { loadAnswers, matchAnswer, parseAnswers } from "./headless/answer-injector.ts";
+export { IdleDetector } from "./headless/idle-detector.ts";
+export { CIEventCollector, writeCIEvent } from "./headless/jsonl-stream.ts";
+export { HeadlessOrchestrator } from "./headless/orchestrator.ts";
+export { CIPipeline } from "./ci/pipeline.ts";
+export { createPR, detectBaseBranch } from "./ci/pr-creator.ts";
+export { parseTestResults } from "./ci/test-runner.ts";
+export { generateReport } from "./ci/report.ts";
+export { ciStatusHandler, registerRun, clearRuns, createRunTracker } from "./tools/ci_status.ts";
+export { loadCiConfig, DEFAULT_CONFIG } from "./config.ts";
+export type { PiCiConfig } from "./config.ts";
 
 /**
- * Extension API type (minimal — avoids hard dep on pi-coding-agent types).
+ * Extension API type.
+ * NOTE: We define this inline rather than importing from @earendil-works/pi-coding-agent
+ * because the peer dependency does not export the full ExtensionAPI shape.
+ * The minimal interface covers only the methods pi-cicd actually uses (registerCommand, on).
+ * If the host API adds required methods in future, update this interface accordingly.
  */
 interface ExtensionAPI {
   registerCommand?: (name: string, handler: (args: unknown) => string | Promise<string>) => void;

package/src/types.ts

@@ -29,7 +29,8 @@ export type CIEventType =
   | "ci_edit"
   | "ci_test"
   | "ci_cost"
-  | "ci_end";
+  | "ci_end"
+  | "ci_step_complete";
 
 export interface CIEventBase {
   type: CIEventType;
@@ -81,13 +82,19 @@ export interface CIEndEvent extends CIEventBase {
   duration_ms: number;
 }
 
+export interface CIStepCompleteEvent extends CIEventBase {
+  type: "ci_step_complete";
+  step: number;
+}
+
 export type CIEvent =
   | CIStartEvent
   | CIProgressEvent
   | CIEditEvent
   | CITestEvent
   | CICostEvent
-  | CIEndEvent;
+  | CIEndEvent
+  | CIStepCompleteEvent;
 
 // ---------------------------------------------------------------------------
 // Answer injection

package/src/workflow/deployment-workflow.ts

@@ -40,6 +40,7 @@ export interface DeploymentState {
   failedSteps: string[];
   startedAt: string;
   finishedAt?: string;
+  error?: string;
 }
 
 /**
@@ -103,7 +104,8 @@ export function createDeploymentWorkflow(
 }
 
 /**
- * Execute a deployment workflow
+ * Execute a deployment workflow with proper dependency handling.
+ * Steps are processed in dependency order, re-queued when dependencies are met.
  */
 export async function* executeDeploymentWorkflow(
   workflow: DeploymentWorkflow,
@@ -123,24 +125,52 @@ export async function* executeDeploymentWorkflow(
   const stepMap = new Map(workflow.steps.map(s => [s.id, s]));
   const completed = new Set<string>();
   
-  for (const step of workflow.steps) {
-    // Check dependencies
-    if (step.dependsOn?.some(dep => !completed.has(dep))) {
-      continue; // Dependencies not met
-    }
-    
-    state.status = "running";
-    state.currentStep = step.id;
-    yield state;
+  // Track pending steps that haven't been processed yet
+  const pendingSteps = [...workflow.steps];
+  
+  // Keep iterating until all steps are processed
+  while (pendingSteps.length > 0) {
+    let madeProgress = false;
     
-    const result = await executor(step);
+    // Find steps whose dependencies are all met
+    for (let i = 0; i < pendingSteps.length; i++) {
+      const step = pendingSteps[i];
+      
+      // Check if all dependencies are satisfied
+      if (step.dependsOn?.some(dep => !completed.has(dep))) {
+        continue; // Dependencies not met yet, try next step
+      }
+      
+      // Dependencies are met - execute this step
+      pendingSteps.splice(i, 1); // Remove from pending
+      i--; // Adjust index after splice
+      madeProgress = true;
+      
+      state.status = "running";
+      state.currentStep = step.id;
+      yield state;
+      
+      const result = await executor(step);
+      
+      if (result.success) {
+        completed.add(step.id);
+        state.completedSteps.push(step.id);
+      } else {
+        state.failedSteps.push(step.id);
+        state.status = "failed";
+        state.error = result.error;
+        state.finishedAt = new Date().toISOString();
+        yield state;
+        return;
+      }
+    }
     
-    if (result.success) {
-      completed.add(step.id);
-      state.completedSteps.push(step.id);
-    } else {
-      state.failedSteps.push(step.id);
+    // If no progress but steps remain, we have circular dependencies
+    if (!madeProgress && pendingSteps.length > 0) {
+      const circularDeps = pendingSteps.map(s => s.id).join(", ");
+      state.failedSteps.push(...pendingSteps.map(s => s.id));
       state.status = "failed";
+      state.error = `Circular dependency detected among: ${circularDeps}`;
       state.finishedAt = new Date().toISOString();
       yield state;
       return;