prizmkit 1.1.91 → 1.1.92

package/bundled/dev-pipeline/run-feature.sh

@@ -9,13 +9,14 @@ set -euo pipefail
 # from a feature list.
 #
 # Usage:
-#   ./run-feature.sh run [.prizmkit/plans/feature-list.json]            Run all features
+#   ./run-feature.sh run [.prizmkit/plans/feature-list.json] [options]  Run all features
 #   ./run-feature.sh run <feature-id> [options]         Run a single feature
 #   ./run-feature.sh status [.prizmkit/plans/feature-list.json]         Show pipeline status
 #   ./run-feature.sh reset                              Clear all state
 #
 # Environment Variables:
-#   MAX_RETRIES           Max retries per feature (default: 3)
+#   MAX_RETRIES           Max code retries per feature (default: 3)
+#   MAX_INFRA_RETRIES     Max infrastructure/provider retries per feature (default: 3)
 #   SESSION_TIMEOUT       Session timeout in seconds (default: 0 = no limit)
 #   AI_CLI                AI CLI command name (override; also readable from .prizmkit/config.json)
 #   CODEBUDDY_CLI         Legacy alias for AI_CLI (deprecated, use AI_CLI instead)
@@ -45,6 +46,7 @@ SCRIPTS_DIR="$SCRIPT_DIR/scripts"
 
 # Configuration (override via environment variables)
 MAX_RETRIES=${MAX_RETRIES:-3}
+MAX_INFRA_RETRIES=${MAX_INFRA_RETRIES:-3}
 SESSION_TIMEOUT=${SESSION_TIMEOUT:-0}
 HEARTBEAT_STALE_THRESHOLD=${HEARTBEAT_STALE_THRESHOLD:-600}
 HEARTBEAT_INTERVAL=${HEARTBEAT_INTERVAL:-30}
@@ -162,9 +164,23 @@ spawn_and_wait_session() {
     # Check for stale-kill marker (heartbeat killed the process due to no progress)
     local stale_kill_marker="$session_dir/logs/stale-kill.json"
     local was_stale_killed=false
+    local stale_kill_reason=""
     if [[ -f "$stale_kill_marker" ]]; then
         was_stale_killed=true
-        log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+        stale_kill_reason=$(python3 - "$stale_kill_marker" <<'PY' 2>/dev/null || true
+import json, sys
+try:
+    with open(sys.argv[1], encoding="utf-8") as fh:
+        print(json.load(fh).get("reason") or "")
+except Exception:
+    pass
+PY
+)
+        if [[ "$stale_kill_reason" == "error_loop" ]]; then
+            log_warn "Session was killed by heartbeat monitor due to repeated read-offset/wasted-call errors"
+        else
+            log_warn "Session was stale-killed by heartbeat monitor (no progress for too long)"
+        fi
     fi
 
     local was_infra_error=false
@@ -221,8 +237,12 @@ spawn_and_wait_session() {
         log_warn "Infrastructure errors are retried without consuming code retry budget"
         session_status="infra_error"
     elif [[ "$was_stale_killed" == true ]]; then
-        log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
-        log_warn "Stale-killed sessions are treated as failed; dev branch is preserved for inspection"
+        if [[ "$stale_kill_reason" == "error_loop" ]]; then
+            log_warn "Session killed due to repeated read-offset/wasted-call error loop"
+        else
+            log_warn "Session stale-killed (no progress for ${STALE_KILL_THRESHOLD}s)"
+        fi
+        log_warn "Heartbeat-killed sessions are treated as failed; dev branch is preserved for inspection"
         session_status="crashed"
     elif [[ $exit_code -ne 0 ]]; then
         log_warn "Session exited with code $exit_code"
@@ -240,10 +260,10 @@ spawn_and_wait_session() {
             # No commits found — check if there are uncommitted changes (session
             # did work but didn't commit, e.g. context window exhausted)
             local uncommitted=""
-            uncommitted=$(git -C "$project_root" status --porcelain 2>/dev/null | head -1 || true)
+            uncommitted=$(prizm_git_status_safe "$project_root" | head -1 || true)
             if [[ -n "$uncommitted" ]]; then
                 log_warn "Session exited cleanly but produced no commits (uncommitted changes found) — auto-committing..."
-                git -C "$project_root" add -A 2>/dev/null || true
+                prizm_git_add_all_safe "$project_root" || true
                 if git -C "$project_root" commit --no-verify -m "chore($feature_id): auto-commit session work" 2>/dev/null; then
                     log_info "Auto-commit succeeded"
                     session_status="success"
@@ -262,10 +282,10 @@ spawn_and_wait_session() {
     if [[ "$session_status" == "success" ]]; then
         if git -C "$project_root" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
             local dirty_files=""
-            dirty_files=$(git -C "$project_root" status --porcelain 2>/dev/null || true)
+            dirty_files=$(prizm_git_status_safe "$project_root" || true)
             if [[ -n "$dirty_files" ]]; then
                 log_info "Auto-committing remaining session artifacts..."
-                git -C "$project_root" add -A 2>/dev/null || true
+                prizm_git_add_all_safe "$project_root" || true
                 git -C "$project_root" commit --no-verify --amend --no-edit 2>/dev/null \
                     || git -C "$project_root" commit --no-verify -m "chore($feature_id): include remaining session artifacts" 2>/dev/null \
                     || true
@@ -385,8 +405,9 @@ finalize_feature_status_after_branch_return() {
     local session_id="$3"
     local session_status="$4"
     local max_retries="$5"
-    local session_dir="$6"
-    local base_branch="${7:-main}"
+    local max_infra_retries="$6"
+    local session_dir="$7"
+    local base_branch="${8:-main}"
 
     local feature_slug="${_SPAWN_FEATURE_SLUG:-}"
     local progress_json="$session_dir/logs/progress.json"
@@ -422,6 +443,7 @@ finalize_feature_status_after_branch_return() {
         --session-status "$session_status" \
         --session-id "$session_id" \
         --max-retries "$max_retries" \
+        --max-infra-retries "$max_infra_retries" \
         --action update 2>&1) || {
         log_error "Failed to update feature status: $update_output"
         log_error ".prizmkit/plans/feature-list.json may be out of sync. Manual intervention needed."
@@ -467,6 +489,8 @@ for feat in data.get('features', []):
                 --state-dir "$STATE_DIR" \
                 --feature-id "$_interrupted_id" \
                 --session-status "failed" \
+                --max-retries "$MAX_RETRIES" \
+                --max-infra-retries "$MAX_INFRA_RETRIES" \
                 --action update 2>/dev/null || true
             log_info "Feature $_interrupted_id marked as failed due to interrupt"
         fi
@@ -592,6 +616,16 @@ run_one() {
                 SESSION_TIMEOUT="$1"
                 shift
                 ;;
+            --max-infra-retries)
+                shift
+                if [[ $# -eq 0 ]]; then
+                    log_error "--max-infra-retries requires a value"
+                    exit 1
+                fi
+                prizm_require_positive_int "--max-infra-retries" "$1"
+                MAX_INFRA_RETRIES="$1"
+                shift
+                ;;
             F-*|f-*)
                 feature_id="$1"
                 shift
@@ -916,6 +950,8 @@ else:
                 --state-dir "$STATE_DIR" \
                 --feature-id "$feature_id" \
                 --session-status "failed" \
+                --max-retries "$MAX_RETRIES" \
+                --max-infra-retries "$MAX_INFRA_RETRIES" \
                 --action update 2>/dev/null || true
             log_info "Feature $feature_id marked as failed due to interrupt"
         fi
@@ -949,12 +985,13 @@ else:
     if branch_create "$_proj_root" "$_branch_name" "$_source_branch"; then
         _DEV_BRANCH_NAME="$_branch_name"
     else
-        log_warn "Failed to create branch; running session on current branch"
+        log_error "Failed to create branch: $_branch_name from $_source_branch — aborting to avoid running on $_source_branch"
+        return 1
     fi
 
     spawn_and_wait_session \
         "$feature_id" "$feature_list" "$session_id" \
-        "$bootstrap_prompt" "$session_dir" 999 "$feature_model" "$_ORIGINAL_BRANCH"
+        "$bootstrap_prompt" "$session_dir" "$MAX_RETRIES" "$feature_model" "$_ORIGINAL_BRANCH"
     local session_status="$_SPAWN_RESULT"
 
     # Merge dev branch back to original on success
@@ -976,12 +1013,11 @@ else:
     branch_ensure_return "$_proj_root" "$_ORIGINAL_BRANCH"
 
     finalize_feature_status_after_branch_return \
-        "$feature_id" "$feature_list" "$session_id" "$session_status" 999 "$session_dir" "$_ORIGINAL_BRANCH"
+        "$feature_id" "$feature_list" "$session_id" "$session_status" "$MAX_RETRIES" "$MAX_INFRA_RETRIES" "$session_dir" "$_ORIGINAL_BRANCH"
 
     # Commit feature status update on the original branch (after guaranteed return)
     if ! git -C "$_proj_root" diff --quiet "$feature_list" 2>/dev/null; then
-        git -C "$_proj_root" add "$feature_list" 2>/dev/null || true
-        git -C "$_proj_root" commit --no-verify -m "chore($feature_id): update feature status" 2>/dev/null || true
+        prizm_git_commit_paths "$_proj_root" "chore($feature_id): update feature status" "$feature_list"
     fi
 
     echo ""
@@ -1080,7 +1116,8 @@ main() {
     if [[ -n "$features_filter" ]]; then
         log_info "Features filter: $features_filter"
     fi
-    log_info "Max retries per feature: $MAX_RETRIES"
+    log_info "Max code retries per feature: $MAX_RETRIES"
+    log_info "Max infrastructure retries per feature: $MAX_INFRA_RETRIES"
     if [[ $SESSION_TIMEOUT -gt 0 ]]; then
         log_info "Session timeout: ${SESSION_TIMEOUT}s"
     else
@@ -1259,28 +1296,41 @@ DEPLOY_PROMPT_EOF
         fi
 
         # Parse feature info
-        local feature_id feature_title retry_count resume_phase
+        local feature_id feature_title retry_count infra_error_count resume_phase
         feature_id=$(echo "$next_feature" | jq -r '.feature_id')
         feature_title=$(echo "$next_feature" | jq -r '.title')
         retry_count=$(echo "$next_feature" | jq -r '.retry_count // 0')
+        infra_error_count=$(echo "$next_feature" | jq -r '.infra_error_count // 0')
         resume_phase=$(echo "$next_feature" | jq -r '.resume_from_phase // "null"')
 
         echo ""
         echo -e "${BOLD}────────────────────────────────────────────────────${NC}"
         log_info "Feature: ${BOLD}$feature_id${NC} — $feature_title"
-        log_info "Retry: $retry_count / $MAX_RETRIES"
+        log_info "Code retry: $retry_count / $MAX_RETRIES"
+        log_info "Infrastructure retry: $infra_error_count / $MAX_INFRA_RETRIES"
         if [[ "$resume_phase" != "null" ]]; then
             log_info "Resuming from Phase $resume_phase"
         fi
         echo -e "${BOLD}────────────────────────────────────────────────────${NC}"
 
-        # Commit dirty working tree before starting feature
+        # Do not auto-commit an arbitrary dirty baseline on the original branch.
+        # Only pipeline bookkeeping is committed explicitly; user/source WIP,
+        # submodule dirt, specs, and root-level hidden tool temporary worktrees
+        # must never be swept into main by a broad git add.
         local _dirty_files=""
-        _dirty_files=$(git -C "$_proj_root" status --porcelain 2>/dev/null || true)
+        _dirty_files=$(prizm_git_status_non_bookkeeping "$_proj_root" "$STATE_DIR" "$feature_list" || true)
         if [[ -n "$_dirty_files" ]]; then
-            log_info "Dirty working tree detected — committing before $feature_id..."
-            git -C "$_proj_root" add -A 2>/dev/null || true
-            git -C "$_proj_root" commit --no-verify -m "ready for run $feature_id" 2>/dev/null || true
+            log_error "Dirty working tree detected before $feature_id; refusing to commit it on $_ORIGINAL_BRANCH."
+            log_error "Commit/stash your changes or start from a clean branch, then rerun the pipeline."
+            printf '%s\n' "$_dirty_files" | sed 's/^/  /'
+            break
+        fi
+
+        local _bookkeeping_dirty=""
+        _bookkeeping_dirty=$(prizm_git_status_bookkeeping "$_proj_root" "$STATE_DIR" "$feature_list" || true)
+        if [[ -n "$_bookkeeping_dirty" ]]; then
+            log_info "Committing pending pipeline bookkeeping before $feature_id..."
+            prizm_git_commit_paths "$_proj_root" "chore($feature_id): include pipeline bookkeeping" "$feature_list" "$STATE_DIR"
         fi
 
         # Mark feature as in-progress BEFORE creating dev branch
@@ -1293,8 +1343,7 @@ DEPLOY_PROMPT_EOF
             --action start >/dev/null 2>&1 || true
         # Commit the in_progress status on the original branch
         if ! git -C "$_proj_root" diff --quiet "$feature_list" 2>/dev/null; then
-            git -C "$_proj_root" add "$feature_list" 2>/dev/null || true
-            git -C "$_proj_root" commit --no-verify -m "chore($feature_id): mark in_progress" 2>/dev/null || true
+            prizm_git_commit_paths "$_proj_root" "chore($feature_id): mark in_progress" "$feature_list"
         fi
 
         # Create per-feature dev branch (from the now-updated original branch)
@@ -1303,8 +1352,9 @@ DEPLOY_PROMPT_EOF
             _DEV_BRANCH_NAME="$_feature_branch"
             log_info "Dev branch: $_feature_branch"
         else
-            log_warn "Failed to create dev branch; running on current branch: $_ORIGINAL_BRANCH"
+            log_error "Failed to create dev branch: $_feature_branch from $_ORIGINAL_BRANCH — aborting to avoid running on $_ORIGINAL_BRANCH"
             _DEV_BRANCH_NAME=""
+            break
         fi
 
         # Generate session ID and bootstrap prompt
@@ -1397,20 +1447,20 @@ DEPLOY_PROMPT_EOF
         branch_ensure_return "$_proj_root" "$_ORIGINAL_BRANCH"
 
         finalize_feature_status_after_branch_return \
-            "$feature_id" "$feature_list" "$session_id" "$session_status" "$MAX_RETRIES" "$session_dir" "$_ORIGINAL_BRANCH"
+            "$feature_id" "$feature_list" "$session_id" "$session_status" "$MAX_RETRIES" "$MAX_INFRA_RETRIES" "$session_dir" "$_ORIGINAL_BRANCH"
         local item_status_after_session="${_SPAWN_ITEM_STATUS:-}"
 
         # Commit feature status update on the original branch (after guaranteed return)
         if ! git -C "$_proj_root" diff --quiet "$feature_list" 2>/dev/null; then
-            git -C "$_proj_root" add "$feature_list" 2>/dev/null || true
-            git -C "$_proj_root" commit --no-verify -m "chore($feature_id): update feature status" 2>/dev/null || true
+            prizm_git_commit_paths "$_proj_root" "chore($feature_id): update feature status" "$feature_list"
         fi
 
         session_count=$((session_count + 1))
         total_subagent_calls=$((total_subagent_calls + _SUBAGENT_COUNT))
 
         # Stop-on-failure: abort only after the task is actually marked failed.
-        # Pending retry outcomes, including infrastructure errors, keep running.
+        # Pending retry outcomes keep running; both code and infra failures have
+        # bounded budgets in update-feature-status.py.
         if [[ "$session_status" != "success" && "$STOP_ON_FAILURE" == "1" && "$item_status_after_session" == "failed" ]]; then
             echo ""
             log_error "════════════════════════════════════════════════════"
@@ -1420,7 +1470,7 @@ DEPLOY_PROMPT_EOF
             log_error "════════════════════════════════════════════════════"
             break
         elif [[ "$session_status" != "success" && "$STOP_ON_FAILURE" == "1" ]]; then
-            log_info "STOP_ON_FAILURE: $feature_id is ${item_status_after_session:-unknown}; retry budget not exhausted, continuing."
+            log_info "STOP_ON_FAILURE: $feature_id is ${item_status_after_session:-unknown}; code/infra retry budget not exhausted, continuing."
         fi
 
         # Brief pause before next iteration
@@ -1459,9 +1509,14 @@ show_help() {
     echo "  --clean                     Delete artifacts and reset before running"
     echo "  --no-reset                  Skip feature status reset step"
     echo "  --timeout N                 Session timeout in seconds (default: 0 = no limit)"
+    echo "  --max-infra-retries N       Max infrastructure/provider retries (default: 3)"
+    echo ""
+    echo "Pipeline Options (run all):"
+    echo "  --max-infra-retries N       Max infrastructure/provider retries (default: 3)"
     echo ""
     echo "Environment Variables:"
-    echo "  MAX_RETRIES           Max retries per feature (default: 3)"
+    echo "  MAX_RETRIES           Max code retries per feature (default: 3)"
+    echo "  MAX_INFRA_RETRIES     Max infrastructure/provider retries per feature (default: 3)"
     echo "  SESSION_TIMEOUT       Session timeout in seconds (default: 0 = no limit)"
     echo "  AI_CLI                AI CLI command name (auto-detected: cbc, claude, or codex)"
     echo "  MODEL                 AI model ID (e.g. claude-opus-4.6, claude-sonnet-4.6, claude-haiku-4.5)"
@@ -1512,6 +1567,16 @@ case "${1:-run}" in
                         _run_features_filter="$1"
                         shift
                         ;;
+                    --max-infra-retries)
+                        shift
+                        if [[ $# -eq 0 ]]; then
+                            log_error "--max-infra-retries requires a value"
+                            exit 1
+                        fi
+                        prizm_require_positive_int "--max-infra-retries" "$1"
+                        MAX_INFRA_RETRIES="$1"
+                        shift
+                        ;;
                     *)
                         _run_feature_list="$1"
                         shift