smol-symphony 0.1.0 → 0.3.0

package/assets/symphony-mise.system.toml

@@ -0,0 +1,68 @@
+# Symphony-bundled mise (jdx/mise) SYSTEM config — issue 209.
+#
+# The orchestrator stages this file into EVERY agent VM at /etc/mise/config.toml
+# (mise's SYSTEM config = LOWEST precedence; applies everywhere, overridable per
+# project). It is the SINGLE source of truth for the agent runtime (node) + the ACP
+# agent CLIs — read off the host's OWN disk at boot and staged per-dispatch (like the
+# vm-agent launcher), so it is decoupled from the image digest. Bump a pin HERE and
+# restart symphony; NO `npm run build:image` + digest repin is needed. That decoupling
+# is the whole point of issue 209: agent-CLI versioning is no longer coupled to the
+# base image.
+#
+# Pins MUST match the versions the host ACP transport speaks. ALL agent CLIs are
+# pinned DELIBERATELY: an unpinned bump can silently change codex's Responses-API
+# transport, opencode's acp/custom-provider behavior, or Claude Code's model-stream
+# handling (an unpinned claude-code 2.1.156 -> 2.1.160 once stalled dispatches mid-turn,
+# idle on the /v1/messages stream until the stall reaper killed them). Bump these
+# consciously, not by drift.
+#
+# node stays >= 21: the in-VM launcher needs the global WHATWG WebSocket. The agent
+# runtime node is resolved system-scoped (`mise which node` from `/`), so a consuming
+# repo's mise.toml can override `node` for the PROJECT's build/test (the workspace
+# shims) WITHOUT downgrading the agent itself.
+#
+# A consuming repo's own mise.toml / .tool-versions (HIGHER precedence) ADDS project
+# toolchains (rust, go, kotlin+gradle, a different node, ...) on top of this set;
+# `mise install` with cwd = workspace installs the MERGED system + project tool set
+# into the shared, home-based, warm-cached data dir.
+#
+# The `npm:` backend installs an npm package and exposes its bins as mise shims; node
+# comes from mise's core node backend (nodejs.org prebuilts).
+#
+# ── npm lifecycle scripts (load-bearing — issue 209 review) ──────────────────────
+# mise's `npm:` backend installs with `--ignore-scripts=true` by DEFAULT (a supply-
+# chain hardening default; see mise.jdx.dev/dev-tools/backends/npm). That SUPPRESSES
+# the package `postinstall` hooks that some agent CLIs use to materialize their native
+# binary, so a plain string pin would `mise install` cleanly but then fail at RUNTIME
+# when the CLI tries to exec a missing/stub binary. Two of our pins ship a native
+# binary via a `postinstall` (verified against the registry metadata for the pinned
+# versions):
+#   • @anthropic-ai/claude-code  → "postinstall": "node install.cjs"   (bin: claude.exe)
+#   • opencode-ai                → "postinstall": "node ./postinstall.mjs" (bin: opencode.exe)
+# @openai/codex + @zed-industries/codex-acp ship their native binary via
+# optionalDependencies platform packages resolved at runtime by a JS bin shim
+# (bin/codex.js, bin/codex-acp.js) and declare NO install script; they don't strictly
+# need scripts, but we enable them UNIFORMLY across the native-binary CLIs so the
+# contract is robust to version drift and to the platform packages' own install steps.
+# @agentclientprotocol/claude-agent-acp is pure JS (ships dist/) with no native binary
+# and no install hook, so it stays a plain pin.
+#
+# Opting back in uses the per-tool `npm_args = "--ignore-scripts=false"` option, which
+# ONLY takes effect when npm is the active package manager — hence the explicit
+# `[settings.npm] package_manager = "npm"` below. `auto` (the default) would fall back
+# to npm TODAY (the base image ships no bun/pnpm), but a future baked package manager
+# would silently switch and re-suppress scripts; pinning npm locks the contract.
+
+[settings.npm]
+# Force npm as the npm-backend installer so the per-tool `npm_args` below reliably
+# apply (bun/pnpm ignore npm_args and don't run lifecycle scripts by default). The
+# base image ships only `mise`; npm comes from the `node` install above.
+package_manager = "npm"
+
+[tools]
+node = "24"
+"npm:@anthropic-ai/claude-code" = { version = "2.1.156", npm_args = "--ignore-scripts=false" }
+"npm:@openai/codex" = { version = "0.135.0", npm_args = "--ignore-scripts=false" }
+"npm:@agentclientprotocol/claude-agent-acp" = "0.39.0"
+"npm:@zed-industries/codex-acp" = { version = "0.15.0", npm_args = "--ignore-scripts=false" }
+"npm:opencode-ai" = { version = "1.15.12", npm_args = "--ignore-scripts=false" }

package/dist/src/bin/symphony.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// FCIS rewrite — the `symphony` binary ENTRYPOINT.
+//
+// Usage:
+//   symphony [path-to-WORKFLOW.yaml] [--port <port>] [--reconcile-force] [--verbose]
+//   symphony doctor    [path-to-WORKFLOW.yaml] [--port <port>]
+//   symphony reconcile [path-to-WORKFLOW.yaml] [--force] [--port <port>]
+//
+// This file is intentionally a one-liner: the ENTIRE composition lives in the
+// single composition root (src/shell/main.ts — the one file allowed to import the
+// functional core). All this entrypoint does is invoke that root's `main()` and
+// translate an unhandled rejection into a non-zero exit. Keeping it this thin
+// means `package.json`'s `bin` target (dist/bin/symphony.js) and the `tsx`
+// dev/start scripts share exactly the wiring path the tests exercise via
+// `main(argv)`.
+//
+// package.json declares:  "bin": { "symphony": "dist/bin/symphony.js" }
+// and dev scripts run this file directly via tsx (src/bin/symphony.ts).
+import process from 'node:process';
+import { main } from '../shell/main.js';
+// The composition root installs its own SIGINT/SIGTERM graceful-shutdown handlers
+// and owns every process.exit on the preflight / bind-failure paths. Here we only
+// backstop a thrown/ rejected main() — a startup failure that escaped bailStartup
+// — with a fatal log + non-zero exit so the operator sees the cause.
+main(process.argv.slice(2)).catch((err) => {
+    const e = err;
+    process.stderr.write(`fatal: ${e.message}\n${e.stack ?? ''}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=symphony.js.map

package/dist/src/bin/symphony.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"symphony.js","sourceRoot":"","sources":["../../../src/bin/symphony.ts"],"names":[],"mappings":";AACA,mDAAmD;AACnD,EAAE;AACF,SAAS;AACT,qFAAqF;AACrF,+DAA+D;AAC/D,yEAAyE;AACzE,EAAE;AACF,8EAA8E;AAC9E,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,gBAAgB;AAChB,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AAExE,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAExC,kFAAkF;AAClF,kFAAkF;AAClF,kFAAkF;AAClF,qEAAqE;AACrE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACjD,MAAM,CAAC,GAAG,GAAY,CAAC;IACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,IAAI,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/src/core/actions/context.js

@@ -0,0 +1,109 @@
+// FCIS rewrite — pure ActionContext derivation + forwarded-env computation.
+//
+// Ports the two pure helpers from the original
+// `src/agent/runner-decisions.ts` (`deriveActionContext`, `computeForwardedEnv`)
+// plus the credential-strip filter the runner used to layer on top of
+// `computeForwardedEnv` via `src/agent/vm-guards.ts:stripCredentialEnv`.
+//
+// In the original the runner did:
+//   stripCredentialEnv(computeForwardedEnv(forward_env, undefined, readEnv))
+// `stripCredentialEnv` is itself a pure string-name filter (no IO), so the
+// FCIS design folds the strip directly into the pure core function: the single
+// `computeForwardedEnv` here returns the boot env with EVERY credential-bearing
+// var already removed. The credential policy itself (`isCredentialEnvName`) is
+// the ONE wired into the running app — it lives in `core/vm-guards.ts` and is
+// re-exported here (no duplicate). The guest holds only placeholders Gondolin
+// substitutes at egress (host-only refresh / placeholder-only guest invariant),
+// so a real token must never enter the forwarded boot env. `readEnv` is injected
+// so the function stays deterministic and unit-testable (no `process.env` in core).
+//
+// HARD CONSTRAINTS (gate-enforced):
+//   - 100% SYNCHRONOUS. No async/await/Promise anywhere.
+//   - No IO, no node: imports, no process/fetch, no wall clock, no randomness.
+//   - Imports ONLY from src/types/** and other pure-core modules (vm-guards).
+/**
+ * Map a `RunningEntryView` snapshot + optional staged `SYMPHONY_*` env into the
+ * `ActionContext` the actions executor consumes. Mirrors the prior inline
+ * fallback chain in the original `buildActionContext` / `deriveActionContext`
+ * so a Done state reads `$branch` from the action-template namespace (the staged
+ * `SYMPHONY_*` env feeds the fallbacks).
+ *
+ * Fallback chain (highest → lowest precedence) per field:
+ *   branch       SYMPHONY_BRANCH        → `agent/<identifier>`
+ *   base_branch  SYMPHONY_BASE_BRANCH   → view.base_branch_at_dispatch → input.baseBranchDefault → 'main'
+ *   repo         repoEnv (SYMPHONY_REPO)→ view.github_repo_at_dispatch → input.repoDefault → null
+ *   pr_title     SYMPHONY_PR_TITLE      → `<id>: <title>` (or `<id>` if untitled)
+ *   pr_body_file SYMPHONY_PR_BODY_FILE  → ''
+ */
+export function deriveActionContext(input) {
+    const { view, extraEnv } = input;
+    const issueId = view.issue.id;
+    const issueTitle = view.issue.title;
+    const trimmedTitle = issueTitle.trim();
+    const defaultPrTitle = trimmedTitle.length > 0 ? `${issueId}: ${trimmedTitle}` : issueId;
+    // SYMPHONY_REPO wins; then the dispatch-pinned repo; then the live
+    // workspace.github_repo default; null when none is set. The cfg fallback is
+    // load-bearing because the dispatch-time pin (github_repo_at_dispatch) is not
+    // populated yet — without it a Done transition resolves $repo to null and
+    // silently skips push_branch / create_pr_if_missing. Mirrors runner-loop.ts's
+    // `|| cfg.workspace.github_repo` for the clone path.
+    const repoEnv = input.repoEnv;
+    const repoFromEnv = repoEnv && repoEnv.length > 0 ? repoEnv : null;
+    const repoPinned = view.github_repo_at_dispatch;
+    const repoFromPin = repoPinned && repoPinned.length > 0 ? repoPinned : null;
+    const repoDefault = input.repoDefault && input.repoDefault.length > 0 ? input.repoDefault : null;
+    const repo = repoFromEnv ?? repoFromPin ?? repoDefault;
+    // base_branch: staged env → dispatch-pinned base → live workspace.base_branch
+    // default → 'main' (the original's literal floor). Same cfg-fallback rationale
+    // as $repo: the dispatch-time pin isn't populated yet.
+    const pinnedBase = view.base_branch_at_dispatch;
+    const baseDefault = input.baseBranchDefault && input.baseBranchDefault.length > 0 ? input.baseBranchDefault : 'main';
+    const baseBranch = extraEnv?.SYMPHONY_BASE_BRANCH ?? (pinnedBase.length > 0 ? pinnedBase : baseDefault);
+    return {
+        identifier: view.identifier,
+        workspace: view.workspace_path,
+        branch: extraEnv?.SYMPHONY_BRANCH ?? `agent/${view.identifier}`,
+        base_branch: baseBranch,
+        issue_title: issueTitle,
+        issue_body: view.issue.description ?? '',
+        repo,
+        pr_title: extraEnv?.SYMPHONY_PR_TITLE ?? defaultPrTitle,
+        pr_body_file: extraEnv?.SYMPHONY_PR_BODY_FILE ?? '',
+    };
+}
+// ─── Forwarded boot env (with credential strip folded in) ────────────────────
+// The strict boot-env credential policy lives canonically in core/vm-guards.ts
+// (the copy actually wired into the running app via runner/vm-plan.ts). It is
+// imported for `computeForwardedEnv` AND re-exported here so this module's
+// importers (and its test) keep the `actions/context.js` specifier without a
+// duplicate definition + duplicate named-set/prefix/suffix constants.
+// vm-guards.ts is pure core, so importing it from another pure-core module is
+// allowed.
+import { isCredentialEnvName } from '../vm-guards.js';
+export { isCredentialEnvName };
+/**
+ * Compute the VM boot env from the `forward_env` list, dropping `omitVar` when
+ * set AND every credential-bearing var (strict boot-env policy). `omitVar` lets
+ * a caller exclude a single var by name; the runner strips all credential vars
+ * uniformly (the guest holds only a placeholder Gondolin substitutes at egress),
+ * so callers pass `omitVar = undefined` and rely on the credential filter.
+ * `readEnv` is injected so this stays deterministic and unit-testable (no
+ * `process.env` in core).
+ *
+ * A name that survives the credential filter but reads as empty/undefined is
+ * skipped (the original only forwarded vars with a non-empty value).
+ */
+export function computeForwardedEnv(forwardList, omitVar, readEnv) {
+    const env = {};
+    for (const k of forwardList) {
+        if (k === omitVar)
+            continue;
+        if (isCredentialEnvName(k))
+            continue;
+        const v = readEnv(k);
+        if (v && v.length > 0)
+            env[k] = v;
+    }
+    return env;
+}
+//# sourceMappingURL=context.js.map

package/dist/src/core/actions/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../src/core/actions/context.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,EAAE;AACF,+CAA+C;AAC/C,iFAAiF;AACjF,sEAAsE;AACtE,yEAAyE;AACzE,EAAE;AACF,kCAAkC;AAClC,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,oFAAoF;AACpF,EAAE;AACF,oCAAoC;AACpC,yDAAyD;AACzD,+EAA+E;AAC/E,8EAA8E;AA8B9E;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IACjE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;IACpC,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,YAAY,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAEzF,mEAAmE;IACnE,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,8EAA8E;IAC9E,qDAAqD;IACrD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,WAAW,GAAG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC;IAChD,MAAM,WAAW,GAAG,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACjG,MAAM,IAAI,GAAG,WAAW,IAAI,WAAW,IAAI,WAAW,CAAC;IAEvD,8EAA8E;IAC9E,+EAA+E;IAC/E,uDAAuD;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,uBAAuB,CAAC;IAChD,MAAM,WAAW,GACf,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC;IACnG,MAAM,UAAU,GACd,QAAQ,EAAE,oBAAoB,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAEvF,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,SAAS,EAAE,IAAI,CAAC,cAAc;QAC9B,MAAM,EAAE,QAAQ,EAAE,eAAe,IAAI,SAAS,IAAI,CAAC,UAAU,EAAE;QAC/D,WAAW,EAAE,UAAU;QACvB,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE;QACxC,IAAI;QACJ,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,IAAI,cAAc;QACvD,YAAY,EAAE,QAAQ,EAAE,qBAAqB,IAAI,EAAE;KACpD,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,sEAAsE;AACtE,8EAA8E;AAC9E,WAAW;AACX,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAA8B,EAC9B,OAA2B,EAC3B,OAA4C;IAE5C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,OAAO;YAAE,SAAS;QAC5B,IAAI,mBAAmB,CAAC,CAAC,CAAC;YAAE,SAAS;QACrC,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/core/actions/parse.js

@@ -0,0 +1,192 @@
+// FCIS rewrite — pure parser for per-state `actions:` blocks.
+//
+// Functional core: every export here is a pure, synchronous (data) -> data
+// function. No IO, no clock, no randomness, no node: imports. Imports only from
+// src/types. Lifts the YAML shape of a per-state `actions:` block into the
+// closed `WorkflowAction` union, validating each kind's required fields up-front
+// so a missing `head:` on `create_pr_if_missing` (or a misspelled `kind:`) fails
+// at workflow load instead of at the first dispatch into the terminal state.
+//
+// Ported faithfully from the original src/actions/parsing.ts.
+import { WorkflowError } from '../../types/errors.js';
+import { asString, asInt } from '../coerce.js';
+const KNOWN_KINDS = [
+    'push_branch',
+    'create_pr_if_missing',
+    'run_in_vm',
+];
+function expectString(stateName, idx, kind, key, v) {
+    const s = asString(v);
+    if (s === null || s.length === 0) {
+        throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] (${kind}): "${key}" must be a non-empty string`);
+    }
+    return s;
+}
+function parsePredicate(stateName, idx, raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw === 'string')
+        return raw;
+    if (typeof raw === 'object' && !Array.isArray(raw)) {
+        const m = raw;
+        if (typeof m.branch_exists === 'string')
+            return { branch_exists: m.branch_exists };
+        if (typeof m.file_present === 'string')
+            return { file_present: m.file_present };
+    }
+    throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] "if" must be a "$var" string, {branch_exists: <ref>}, or {file_present: <path>}`);
+}
+function parseErrorPolicy(stateName, idx, raw) {
+    if (raw === undefined || raw === null)
+        return undefined;
+    if (typeof raw !== 'object' || Array.isArray(raw)) {
+        throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] "on_error" must be a map`);
+    }
+    const m = raw;
+    const out = {};
+    if (m.retry !== undefined) {
+        if (typeof m.retry !== 'object' || m.retry === null || Array.isArray(m.retry)) {
+            throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] "on_error.retry" must be a map`);
+        }
+        const r = m.retry;
+        const count = asInt(r.count);
+        const backoff = asInt(r.backoff_ms);
+        if (count === null || count < 0) {
+            throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] "on_error.retry.count" must be a non-negative integer`);
+        }
+        if (backoff === null || backoff < 0) {
+            throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] "on_error.retry.backoff_ms" must be a non-negative integer`);
+        }
+        out.retry = { count, backoff_ms: backoff };
+    }
+    if (m.then !== undefined) {
+        const thenRouteTo = typeof m.then === 'object' && m.then !== null && !Array.isArray(m.then)
+            ? m.then.route_to
+            : undefined;
+        if (m.then === 'abort') {
+            out.then = 'abort';
+        }
+        else if (typeof thenRouteTo === 'string') {
+            out.then = { route_to: thenRouteTo };
+        }
+        else {
+            throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] "on_error.then" must be "abort" or {route_to: <state>}`);
+        }
+    }
+    return out;
+}
+function parseAction(stateName, idx, raw) {
+    if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {
+        throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] must be a map with a "kind" field`);
+    }
+    const m = raw;
+    const kind = asString(m.kind);
+    if (!kind || !KNOWN_KINDS.includes(kind)) {
+        throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] "kind" must be one of: ${KNOWN_KINDS.join(', ')} (got: ${String(m.kind)})`);
+    }
+    const base = {
+        name: asString(m.name) ?? undefined,
+        if: parsePredicate(stateName, idx, m.if),
+        on_error: parseErrorPolicy(stateName, idx, m.on_error),
+    };
+    // Strip undefined to keep parsed records clean (deep-equal in tests).
+    const cleanBase = {};
+    if (base.name !== undefined)
+        cleanBase.name = base.name;
+    if (base.if !== null)
+        cleanBase.if = base.if;
+    if (base.on_error !== undefined)
+        cleanBase.on_error = base.on_error;
+    switch (kind) {
+        case 'push_branch':
+            return {
+                kind: 'push_branch',
+                remote: expectString(stateName, idx, kind, 'remote', m.remote),
+                ref: expectString(stateName, idx, kind, 'ref', m.ref),
+                ...cleanBase,
+            };
+        case 'create_pr_if_missing':
+            return {
+                kind: 'create_pr_if_missing',
+                base: expectString(stateName, idx, kind, 'base', m.base),
+                head: expectString(stateName, idx, kind, 'head', m.head),
+                title_from: expectString(stateName, idx, kind, 'title_from', m.title_from),
+                body_from: expectString(stateName, idx, kind, 'body_from', m.body_from),
+                ...cleanBase,
+            };
+        case 'run_in_vm': {
+            const name = asString(m.name);
+            if (!name || name.length === 0) {
+                throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] (run_in_vm): "name" is required (run-log label + snapshot key)`);
+            }
+            // The name labels the action's run-log output + snapshot key. Restrict it
+            // to a safe identifier set so the label is unambiguous and free of path
+            // separators / leading dots.
+            if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) {
+                throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] (run_in_vm): "name" must match /^[A-Za-z0-9][A-Za-z0-9._-]*$/ (got: ${JSON.stringify(name)})`);
+            }
+            const cmdRaw = m.cmd;
+            if (!Array.isArray(cmdRaw) ||
+                cmdRaw.length === 0 ||
+                !cmdRaw.every((s) => typeof s === 'string')) {
+                throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] (run_in_vm): "cmd" must be a non-empty list of strings`);
+            }
+            const envRaw = m.env;
+            let env;
+            if (envRaw !== undefined) {
+                if (typeof envRaw !== 'object' || envRaw === null || Array.isArray(envRaw)) {
+                    throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] (run_in_vm): "env" must be a map of string→string`);
+                }
+                env = {};
+                for (const [k, v] of Object.entries(envRaw)) {
+                    if (typeof v !== 'string') {
+                        throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] (run_in_vm): env["${k}"] must be a string`);
+                    }
+                    env[k] = v;
+                }
+            }
+            const timeout = m.timeout === undefined ? undefined : asInt(m.timeout);
+            if (m.timeout !== undefined && (timeout === null || timeout === undefined || timeout <= 0)) {
+                throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions[${idx}] (run_in_vm): "timeout" must be a positive integer (seconds)`);
+            }
+            const action = {
+                kind: 'run_in_vm',
+                name,
+                cmd: cmdRaw,
+                ...cleanBase,
+            };
+            if (env !== undefined)
+                action.env = env;
+            if (timeout !== undefined && timeout !== null)
+                action.timeout = timeout;
+            return action;
+        }
+        default: {
+            // Exhaustiveness check at the type level — adding a new kind to the union
+            // without extending this switch is a TypeScript error.
+            const _exhaustive = kind;
+            void _exhaustive;
+            throw new WorkflowError('workflow_parse_error', `unreachable action kind: ${String(kind)}`);
+        }
+    }
+}
+/**
+ * Lift a per-state `actions:` YAML block into the typed `WorkflowAction` union.
+ *
+ * - `undefined` (no `actions:` key) -> `undefined`.
+ * - `null` (declared but empty) -> `[]`.
+ * - Any non-list -> throws `WorkflowError('workflow_parse_error', ...)`.
+ *
+ * Each entry is validated per-kind; the first invalid entry throws.
+ */
+export function parseActionsBlock(stateName, raw) {
+    if (raw === undefined)
+        return undefined;
+    if (raw === null)
+        return [];
+    if (!Array.isArray(raw)) {
+        throw new WorkflowError('workflow_parse_error', `state "${stateName}": actions must be a list of typed action records`);
+    }
+    return raw.map((entry, idx) => parseAction(stateName, idx, entry));
+}
+//# sourceMappingURL=parse.js.map

package/dist/src/core/actions/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../../../src/core/actions/parse.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAC3E,gFAAgF;AAChF,2EAA2E;AAC3E,iFAAiF;AACjF,iFAAiF;AACjF,6EAA6E;AAC7E,EAAE;AACF,8DAA8D;AAS9D,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,GAAkC;IACjD,aAAa;IACb,sBAAsB;IACtB,WAAW;CACH,CAAC;AAEX,SAAS,YAAY,CACnB,SAAiB,EACjB,GAAW,EACX,IAAY,EACZ,GAAW,EACX,CAAU;IAEV,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,MAAM,IAAI,OAAO,GAAG,8BAA8B,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,GAAW,EAAE,GAAY;IAClE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;YAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;QACnF,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,mFAAmF,CACxH,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,SAAiB,EACjB,GAAW,EACX,GAAY;IAEZ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,4BAA4B,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,kCAAkC,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,CAAC,KAAgC,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,yDAAyD,CAC9F,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,8DAA8D,CACnG,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,KAAK,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,WAAW,GACf,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACrE,CAAC,CAAE,CAAC,CAAC,IAAgC,CAAC,QAAQ;YAC9C,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;QACrB,CAAC;aAAM,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,0DAA0D,CAC/F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,GAAW,EAAE,GAAY;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,qCAAqC,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,CAAE,WAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,4BAA4B,WAAW,CAAC,IAAI,CAC9E,IAAI,CACL,UAAU,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAC7B,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,SAAS;QACnC,EAAE,EAAE,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QACxC,QAAQ,EAAE,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC;KACvD,CAAC;IACF,sEAAsE;IACtE,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,SAAS,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxD,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI;QAAE,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IAC7C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;QAAE,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAEpE,QAAQ,IAA0B,EAAE,CAAC;QACnC,KAAK,aAAa;YAChB,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;gBAC9D,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC;gBACrD,GAAG,SAAS;aACb,CAAC;QACJ,KAAK,sBAAsB;YACzB,OAAO;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;gBACxD,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;gBACxD,UAAU,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC;gBAC1E,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC;gBACvE,GAAG,SAAS;aACb,CAAC;QACJ,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,kEAAkE,CACvG,CAAC;YACJ,CAAC;YACD,0EAA0E;YAC1E,wEAAwE;YACxE,6BAA6B;YAC7B,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,yEAAyE,IAAI,CAAC,SAAS,CACzH,IAAI,CACL,GAAG,CACL,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;YACrB,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACtB,MAAM,CAAC,MAAM,KAAK,CAAC;gBACnB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC3C,CAAC;gBACD,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,0DAA0D,CAC/F,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;YACrB,IAAI,GAAuC,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3E,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,qDAAqD,CAC1F,CAAC;gBACJ,CAAC;gBACD,GAAG,GAAG,EAAE,CAAC;gBACT,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;oBACvE,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;wBAC1B,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,uBAAuB,CAAC,qBAAqB,CAClF,CAAC;oBACJ,CAAC;oBACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBACb,CAAC;YACH,CAAC;YACD,MAAM,OAAO,GACX,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACzD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC3F,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,cAAc,GAAG,+DAA+D,CACpG,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAkB;gBAC5B,IAAI,EAAE,WAAW;gBACjB,IAAI;gBACJ,GAAG,EAAE,MAAkB;gBACvB,GAAG,SAAS;aACb,CAAC;YACF,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,GAAG,GAAG,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC;YACxE,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,0EAA0E;YAC1E,uDAAuD;YACvD,MAAM,WAAW,GAAU,IAAa,CAAC;YACzC,KAAK,WAAW,CAAC;YACjB,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,4BAA4B,MAAM,CAAC,IAAI,CAAC,EAAE,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,GAAY;IAC/D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CACrB,sBAAsB,EACtB,UAAU,SAAS,mDAAmD,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC"}

package/dist/src/core/actions/plan.js

@@ -0,0 +1,197 @@
+// FCIS rewrite — pure action planner (ported from src/actions/effects.ts +
+// the per-kind appliers in src/actions/executor.ts of the reference
+// orchestrator).
+//
+// FUNCTIONAL CORE. Every function here is SYNCHRONOUS and pure: (data) -> data.
+// No IO, no async/await/Promise, no clock, no randomness, no Effects executed.
+// Imports ONLY from src/types (NodeNext ESM → .js extensions on relative
+// imports) plus the sibling pure core helpers (template.ts, predicates.ts).
+//
+// WHAT MOVED INTO CORE (vs. the reference):
+//   • The reference `planActions` (src/actions/effects.ts) only rendered each
+//     action and emitted a `{ kind:'run' | 'render_failed' }` envelope; the
+//     ACTUAL git/gh/vm decisions lived in the async per-kind appliers in
+//     executor.ts (applyPushBranch, applyMerge, …). Those appliers WERE the
+//     side-effect-deciding logic interleaved with IO.
+//   • Here the per-kind mapping is lifted into the pure core: each rendered
+//     action is mapped to its git/gh/vm/tracker `Effect[]` SEQUENCE as DATA.
+//     The shell becomes a dumb interpreter that runs the emitted effects and
+//     folds outcomes back (the conditional branches the appliers used to take
+//     — "PR already exists? skip create", "non-fast-forward? force-with-lease"
+//     — are still in the shell's run-fold, but the candidate effects, including
+//     the NFF fallback sub-sequence, are produced here as data).
+//
+// The push_branch NFF (non-fast-forward) recovery is the keystone (mustFix, all
+// judges): the planner emits BOTH the plain push and the force-with-lease
+// fallback sub-sequence (fetch → rev-parse → push_force_with_lease) as data, so
+// the shell never has to decide what the recovery looks like — only WHETHER to
+// take it (on a non-fast-forward push result).
+import { renderTree } from './template.js';
+import { evaluatePredicate } from './predicates.js';
+// ─── defaults (mirror src/actions/effects.ts) ────────────────────────────────
+const DEFAULT_RETRY_COUNT = 3;
+const DEFAULT_RETRY_BACKOFF_MS = 1_000;
+/** Reference default per-command timeout (executor.ts defaultCommandTimeoutMs). */
+const DEFAULT_COMMAND_TIMEOUT_MS = 300_000;
+/**
+ * Pure planner — same inputs always produce the same `PlannedAction[]`.
+ *
+ * Faithful to src/actions/effects.ts:planActions for the envelope + snapshot
+ * keying; extended to emit the per-kind Effect sequence as data.
+ */
+export function planActions(actions, ctx, opts) {
+    return actions.map((action, index) => planOne(action, index, ctx, opts));
+}
+function planOne(action, index, ctx, opts) {
+    const snapshotKey = actionSnapshotKey(action, index);
+    const r = renderTree(action, ctx);
+    if (!r.ok) {
+        return { kind: 'render_failed', snapshotKey, error: r.error };
+    }
+    const rendered = r.value;
+    const predicate = evaluatePredicate(actionPredicate(rendered), ctx, opts.workspacePath);
+    const { effects, nffFallback } = mapEffects(rendered, opts);
+    return {
+        kind: 'run',
+        snapshotKey,
+        actionKind: rendered.kind,
+        rendered,
+        predicate,
+        policy: normalizePolicy(actionPolicy(rendered)),
+        effects,
+        nffFallback,
+    };
+}
+// ─── snapshot keying (faithful to actionSnapshotKey) ──────────────────────────
+function actionSnapshotKey(action, idx) {
+    if (action.name && action.name.length > 0)
+        return `${action.kind}:${action.name}`;
+    return `${action.kind}:#${idx}`;
+}
+// ─── policy normalization (faithful to effectivePolicy) ───────────────────────
+// NOTE: the new NormalizedActionPolicy shape (src/types/actions.ts) flattens the
+// reference `{ retry: { count, backoff_ms } }` into `{ retryCount, backoffMs }`.
+function normalizePolicy(p) {
+    return {
+        retryCount: p?.retry?.count ?? DEFAULT_RETRY_COUNT,
+        backoffMs: p?.retry?.backoff_ms ?? DEFAULT_RETRY_BACKOFF_MS,
+        then: p?.then ?? 'abort',
+    };
+}
+// BaseAction carries `if`/`on_error` but the discriminated union has no shared
+// accessor; read them positionally without widening to `any`.
+function actionPredicate(a) {
+    return a.if;
+}
+function actionPolicy(a) {
+    return a.on_error;
+}
+function mapEffects(action, opts) {
+    switch (action.kind) {
+        case 'push_branch':
+            return mapPushBranch(action, opts);
+        case 'create_pr_if_missing':
+            return mapCreatePrIfMissing(action, opts);
+        case 'run_in_vm':
+            return mapRunInVm(action, opts);
+        default: {
+            // Exhaustiveness guard — a new kind without a mapping is a compile error.
+            const _exhaustive = action;
+            void _exhaustive;
+            return { effects: [], nffFallback: null };
+        }
+    }
+}
+// push_branch — `git push -u <remote> <ref>`, with the non-fast-forward
+// recovery (fetch → rev-parse remote-tracking → push_force_with_lease) emitted
+// as a SEPARATE data sub-sequence. Mirrors applyPushBranch + isNonFastForward.
+//
+// The reference resolved the remote SHA at runtime (it read the live remote-
+// tracking ref). Core cannot read the remote, so `expectedRemoteSha` is a
+// placeholder ('') the shell rewrites with the SHA the preceding rev_parse
+// returns. The lease keeps the force-push safe under a true concurrent push.
+function mapPushBranch(action, opts) {
+    const cwd = opts.workspacePath;
+    const effects = [
+        { family: 'git', kind: 'push', cwd, remote: action.remote, ref: action.ref },
+    ];
+    const remoteTrackingRef = `refs/remotes/${action.remote}/${action.ref}`;
+    const nffFallback = [
+        { family: 'git', kind: 'fetch', cwd, remote: action.remote, ref: action.ref },
+        { family: 'git', kind: 'rev_parse', cwd, ref: remoteTrackingRef },
+        {
+            family: 'git',
+            kind: 'push_force_with_lease',
+            cwd,
+            remote: action.remote,
+            ref: action.ref,
+            // Placeholder; shell substitutes the SHA from the rev_parse above.
+            expectedRemoteSha: '',
+        },
+    ];
+    return { effects, nffFallback };
+}
+// create_pr_if_missing — `gh pr list/view` then `gh pr create` if missing.
+// Mirrors applyCreatePrIfMissing. The reference probed `gh pr view <head>`
+// (non-zero ⇒ open one). The effect union models the probe as
+// `gh.pr_list_for_branch` (head branch → existing PR?), and the create as
+// `gh.pr_create`. The shell skips the create when the probe finds a PR.
+//
+// body_from / `--body-file` vs `--body`: the reference decided this at runtime
+// by stat-ing the body string against the workspace (looksLikeFile). Core
+// cannot stat, so it carries `bodyIsFile` as a STRUCTURAL guess (a single-line
+// path-shaped value); the shell confirms the file exists before choosing the
+// flag. A multi-line body is unambiguously NOT a file.
+function mapCreatePrIfMissing(action, opts) {
+    const cwd = opts.workspacePath;
+    const effects = [
+        { family: 'gh', kind: 'pr_list_for_branch', cwd, branch: action.head },
+        {
+            family: 'gh',
+            kind: 'pr_create',
+            cwd,
+            base: action.base,
+            head: action.head,
+            title: action.title_from,
+            bodyOrFile: action.body_from,
+            bodyIsFile: looksLikeFilePath(action.body_from),
+        },
+    ];
+    return { effects, nffFallback: null };
+}
+// run_in_vm — a plain uncached `vm.exec` on the live per-issue VM. Mirrors
+// applyRunInVm / executeRunInVm. The exec timeout mirrors executeRunInVm:
+// action.timeout (seconds) overrides the bound default (ms).
+function mapRunInVm(action, opts) {
+    const env = action.env ?? {};
+    const timeoutMs = action.timeout !== undefined
+        ? action.timeout * 1000
+        : (opts.defaultCommandTimeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS);
+    const effects = [
+        // vmId is a placeholder the shell binds to the per-issue VM at exec time
+        // (core has no handle to the live VM). workdir is the workspace mount.
+        {
+            family: 'vm',
+            kind: 'exec',
+            vmId: '',
+            command: action.cmd,
+            workdir: opts.workspacePath,
+            env,
+            timeoutMs,
+        },
+    ];
+    return { effects, nffFallback: null };
+}
+// ─── helpers ──────────────────────────────────────────────────────────────────
+/**
+ * Structural guess at whether a `body_from` value names a file (so the shell
+ * passes `--body-file` rather than `--body`). The reference (looksLikeFile)
+ * stat-ed the path against the workspace — an IO read core cannot do — so here
+ * we only rule OUT the unambiguous non-paths: empty strings and multi-line
+ * bodies. A single-line value is FLAGGED as file-shaped; the shell confirms the
+ * file exists before committing to `--body-file`.
+ */
+function looksLikeFilePath(value) {
+    return value.length > 0 && !value.includes('\n');
+}
+//# sourceMappingURL=plan.js.map

package/dist/src/core/actions/plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.js","sourceRoot":"","sources":["../../../../src/core/actions/plan.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,oEAAoE;AACpE,iBAAiB;AACjB,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,4CAA4C;AAC5C,8EAA8E;AAC9E,4EAA4E;AAC5E,yEAAyE;AACzE,4EAA4E;AAC5E,sDAAsD;AACtD,4EAA4E;AAC5E,6EAA6E;AAC7E,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,gFAAgF;AAChF,iEAAiE;AACjE,EAAE;AACF,gFAAgF;AAChF,0EAA0E;AAC1E,gFAAgF;AAChF,+EAA+E;AAC/E,+CAA+C;AAa/C,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAQpD,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,mFAAmF;AACnF,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAkC,EAClC,GAAkB,EAClB,IAAiB;IAEjB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,OAAO,CACd,MAAsB,EACtB,KAAa,EACb,GAAkB,EAClB,IAAiB;IAEjB,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC;IACzB,MAAM,SAAS,GAAG,iBAAiB,CACjC,eAAe,CAAC,QAAQ,CAAC,EACzB,GAAG,EACH,IAAI,CAAC,aAAa,CACnB,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5D,OAAO;QACL,IAAI,EAAE,KAAK;QACX,WAAW;QACX,UAAU,EAAE,QAAQ,CAAC,IAAI;QACzB,QAAQ;QACR,SAAS;QACT,MAAM,EAAE,eAAe,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC/C,OAAO;QACP,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,SAAS,iBAAiB,CAAC,MAAsB,EAAE,GAAW;IAC5D,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAClF,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;AAClC,CAAC;AAED,iFAAiF;AACjF,iFAAiF;AACjF,iFAAiF;AAEjF,SAAS,eAAe,CAAC,CAAgC;IACvD,OAAO;QACL,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,mBAAmB;QAClD,SAAS,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,IAAI,wBAAwB;QAC3D,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,OAAO;KACzB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,8DAA8D;AAC9D,SAAS,eAAe,CAAC,CAAiB;IACxC,OAAQ,CAA8B,CAAC,EAAE,CAAC;AAC5C,CAAC;AACD,SAAS,YAAY,CAAC,CAAiB;IACrC,OAAQ,CAAsC,CAAC,QAAQ,CAAC;AAC1D,CAAC;AASD,SAAS,UAAU,CAAC,MAAsB,EAAE,IAAiB;IAC3D,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,KAAK,sBAAsB;YACzB,OAAO,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC5C,KAAK,WAAW;YACd,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,CAAC;YACR,0EAA0E;YAC1E,MAAM,WAAW,GAAU,MAAM,CAAC;YAClC,KAAK,WAAW,CAAC;YACjB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,+EAA+E;AAC/E,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,2EAA2E;AAC3E,6EAA6E;AAC7E,SAAS,aAAa,CAAC,MAAwB,EAAE,IAAiB;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;IAC/B,MAAM,OAAO,GAAa;QACxB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;KAC7E,CAAC;IACF,MAAM,iBAAiB,GAAG,gBAAgB,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;IACxE,MAAM,WAAW,GAAa;QAC5B,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE;QAC7E,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE;QACjE;YACE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;YAC7B,GAAG;YACH,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,mEAAmE;YACnE,iBAAiB,EAAE,EAAE;SACtB;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,2EAA2E;AAC3E,2EAA2E;AAC3E,8DAA8D;AAC9D,0EAA0E;AAC1E,wEAAwE;AACxE,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,+EAA+E;AAC/E,6EAA6E;AAC7E,uDAAuD;AACvD,SAAS,oBAAoB,CAC3B,MAA+B,EAC/B,IAAiB;IAEjB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC;IAC/B,MAAM,OAAO,GAAa;QACxB,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;QACtE;YACE,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,WAAW;YACjB,GAAG;YACH,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,MAAM,CAAC,UAAU;YACxB,UAAU,EAAE,MAAM,CAAC,SAAS;YAC5B,UAAU,EAAE,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC;SAChD;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,6DAA6D;AAC7D,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAiB;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7B,MAAM,SAAS,GACb,MAAM,CAAC,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI;QACvB,CAAC,CAAC,CAAC,IAAI,CAAC,uBAAuB,IAAI,0BAA0B,CAAC,CAAC;IACnE,MAAM,OAAO,GAAa;QACxB,yEAAyE;QACzE,uEAAuE;QACvE;YACE,MAAM,EAAE,IAAI;YACZ,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,OAAO,EAAE,IAAI,CAAC,aAAa;YAC3B,GAAG;YACH,SAAS;SACV;KACF,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC"}