alissa-tools-github-revloop 0.31.1__tar.gz → 0.31.2__tar.gz

{alissa_tools_github_revloop-0.31.1/src/main/alissa_tools_github_revloop.egg-info → alissa_tools_github_revloop-0.31.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.31.1
+Version: 0.31.2
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.31.1 → alissa_tools_github_revloop-0.31.2}/src/main/alissa/tools/github/revloop/alissa.py

@@ -1141,6 +1141,26 @@ class Alissa:
         """
         run(["alissa", "tmux", "kill", session], timeout=30, check=False)
 
+    def tail_session(self, session: str, lines: int) -> str:
+        """The last `lines` of ONE session's terminal, via `alissa tmux tail`.
+
+        The stale-round probe's evidence seam (issue #136): it asks whether a
+        session that reads alive is parked on Claude Code's first-run dialog.
+        Read-only, and best-effort by contract -- a CLI that cannot capture
+        the pane (the session just died, no tmux server, a timeout) answers
+        the EMPTY string, which the classifier treats as "no evidence", never
+        as the dialog: absence of a capture keeps the existing defer.
+        """
+        try:
+            return run(
+                ["alissa", "tmux", "tail", "-n", str(lines), session],
+                timeout=30,
+                check=False,
+            )
+        except CommandError as exc:
+            log.debug("could not tail %s: %s", session, exc)
+            return ""
+
     def add_repo_to_workspace(
         self, owner: str, repo: str, workspace_root: Path, *, dry_run: bool = False
     ) -> None:

{alissa_tools_github_revloop-0.31.1 → alissa_tools_github_revloop-0.31.2}/src/main/alissa/tools/github/revloop/loop.py

@@ -40,6 +40,15 @@ from .alissa import (
 )
 from .alissa_client import AlissaClient
 from .bows import EMPTY_SET_WARNING, FEED_PREFIX, BowRepoSource
+from .trust import (
+    FIRST_RUN_DIALOG_MARKERS,
+    WEDGE_FIRST_RUN_DIALOG,
+    hub_root as hub_root_of,
+    hub_trust_paths,
+    pane_shows_first_run_dialog,
+    seed_trust,
+    write_derived_repos,
+)
 from .config import (
     HUB_ADD,
     REPOS_BOWS,
@@ -1240,6 +1249,39 @@ def stalled_kind(session: str) -> str:
     return f"{ESCALATION_STALLED}:{session}"
 
 
+# The first-run-dialog wedge's ping-ledger kind prefix (issue #136; see
+# ReviewWatcher._wedged_on_first_run_dialog). Like the stalled ping it recurs
+# per EPISODE, and the episode identity is the session name: the daemon
+# killed a session whose pane sat on one of Claude Code's first-run gates,
+# seeded the trust the gate was asking for, and re-queued the round itself.
+# The row dedupes the WARNING (one per episode -- a kill that fails and is
+# retried next poll logs its retry at INFO) and, under its own kind, the
+# activity-comment line.
+ESCALATION_FIRST_RUN_DIALOG = "first-run-dialog"
+
+# How many pane lines the first-run-dialog check reads. The trust dialog is a
+# ~12-line box and the bypass-permissions gate ~20; a session sitting on
+# either has printed nothing since, so the last 40 lines hold the whole
+# prompt with room for the banner above it.
+FIRST_RUN_PANE_TAIL_LINES = 40
+
+
+def first_run_dialog_kind(session: str) -> str:
+    """The ping-ledger kind that dedupes ONE first-run-dialog wedge episode's
+    WARNING. stalled_kind's episode reasoning: every spawn of every round can
+    meet the dialog (a hub trusted after session k was killed is trusted for
+    session k+1, but a seeding that failed to land leaves the next session
+    on the same prompt), and episode k's row must not silence episode
+    k+1's. The session name is nonce-unique per spawn, so it is the key."""
+    return f"{ESCALATION_FIRST_RUN_DIALOG}:{session}"
+
+
+def first_run_dialog_activity_kind(session: str) -> str:
+    """The ping-ledger kind that dedupes the episode's activity-comment line;
+    recorded only after the append lands, so a transient failure retries."""
+    return f"activity-{ESCALATION_FIRST_RUN_DIALOG}:{session}"
+
+
 def capout_kind(head_sha: str, granted: int) -> str:
     """The ping-ledger kind that dedupes ONE cap-out page.
 
@@ -1815,6 +1857,13 @@ class ReviewWatcher:
         # has listed this pass (the preflight refresh, or a sweep whose list
         # failed), and the refresh lists for itself.
         self._pass_roster: list[ManagedSession] | None = None
+        # The (repo, number, round) whose alive session the stale-round probe
+        # just killed as `wedged:first-run-dialog` (issue #136), so the
+        # respawn site logs its re-enqueue at INFO instead of a second
+        # WARNING: the classifier's WARNING already said everything the
+        # "presumed dead" line would, and the issue's contract is ONE.
+        # Consumed by the respawn that follows in the same evaluate().
+        self._dialog_wedge_cleared: "tuple[str, int, int] | None" = None
         # (repo full name, PR number) -> when the reviewer login was most
         # recently asked to review that PR, per the issue timeline (an ISO
         # stamp, or None for never) -- the round-admission gate's one GitHub
@@ -1954,6 +2003,39 @@ class ReviewWatcher:
             # Telemetry-class: the console's window onto the derived set.
             # Best-effort inside State, like every other telemetry write.
             self.state.record_derived_repos(source.sources())
+        self._record_derived(source.derived)
+
+    def _record_derived(self, derived: "tuple[str, ...]") -> None:
+        """Issue #136: make the derived allowlist visible to the entrypoint's
+        boot-time trust seeding (`{root}/.alissa-derived-repos`) and trust
+        the derived hubs NOW -- hub-ified or not, exactly as the entrypoint
+        trusts a static allowlist's hubs before they exist. Both are
+        best-effort and idempotent; dry-run writes nothing. Called after
+        every refresh, so a retained set (a refresh that failed keeps the
+        last derived set) is re-asserted too, at no cost when nothing
+        changed."""
+        if not derived:
+            return
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would record %d derived repo(s) and pre-trust "
+                "their hubs for claude", len(derived),
+            )
+            return
+        write_derived_repos(self.config.workspace_root, derived)
+        paths: "list[Path]" = []
+        for full_name in derived:
+            owner, _, repo = full_name.partition("/")
+            if not owner or not repo:
+                continue
+            paths.extend(hub_trust_paths(self.config.hub_for(owner, repo)))
+        changed = seed_trust(paths)
+        if changed:
+            log.info(
+                "repos_source=bows: pre-trusted the hubs of %d derived "
+                "repo(s) for claude (root and main/ each) in %s",
+                len(derived), ", ".join(str(t) for t in changed),
+            )
 
     def _search_allowlist(self) -> "tuple[str, ...] | None":
         """The allowlist the review-requested search runs over, or None when
@@ -2371,14 +2453,28 @@ class ReviewWatcher:
         if age is not None:
             # Logged only once the gate has let the respawn through, so the
             # line cannot claim a re-enqueue that back-pressure then deferred.
-            log.warning(
-                "%s round %d has been in flight %.0f min with no submitted review "
-                "and its session is gone or finished — re-enqueuing (reviewer "
-                "session presumed dead)",
-                pr.slug,
-                round_,
-                age / 60,
-            )
+            # A round whose session the probe killed as wedged on the
+            # first-run dialog was already WARNED once by the classifier, so
+            # its re-enqueue is INFO (issue #136: one WARNING per episode).
+            wedged = self._dialog_wedge_cleared == (pr.full_name, number, round_)
+            self._dialog_wedge_cleared = None
+            if wedged:
+                log.info(
+                    "%s round %d re-enqueuing after its session was killed "
+                    "(%s)",
+                    pr.slug,
+                    round_,
+                    WEDGE_FIRST_RUN_DIALOG,
+                )
+            else:
+                log.warning(
+                    "%s round %d has been in flight %.0f min with no submitted "
+                    "review and its session is gone or finished — re-enqueuing "
+                    "(reviewer session presumed dead)",
+                    pr.slug,
+                    round_,
+                    age / 60,
+                )
 
         return self._spawn(
             pr,
@@ -4041,6 +4137,22 @@ class ReviewWatcher:
         if ses.is_idle and quiet_for >= self.config.reap_grace_seconds:
             return None  # idle-finished: it died without submitting -> respawn
 
+        # Issue #136: alive is a process, not a reviewer. A session sitting
+        # on Claude Code's first-run "trust this folder?" (or the
+        # bypass-permissions) gate is listed, registers activity, and will
+        # never submit anything -- the directive typed into the pane was
+        # swallowed by the prompt. Only here, on a SUCCESSFUL listing that
+        # names the row, and only when the pane SHOWS the gate: every other
+        # alive-but-idle case keeps the floored defer below, exactly as
+        # before. A match has been killed and its hub seeded, so the round
+        # re-queues NOW as the dead-session path would (same attempt/round
+        # accounting: `reenqueued`, the `stale_reenqueued` bucket).
+        if self._wedged_on_first_run_dialog(
+            pr, round_, session, str(row["task_ref"] or "") or None, cap
+        ):
+            self._dialog_wedge_cleared = (pr.full_name, pr.number, round_)
+            return None
+
         if (
             age >= STALLED_DEFER_MULTIPLE * STALE_ROUND_SECONDS
             and not self.state.pinged(pr.full_name, pr.number, stalled_kind(session))
@@ -4356,7 +4468,9 @@ class ReviewWatcher:
 
         The two backing stores are not interchangeable and the split is the
         whole point: durable in production, process-lifetime in dry-run, so
-        neither mode can ever silence the other. See _warn_identity_drift.
+        neither mode can ever silence the other. See _warn_identity_drift;
+        the first-run-dialog wedge (_wedged_on_first_run_dialog) keys its
+        one-WARNING-per-episode gate through the same pair.
         """
         if record:
             return self.state.pinged(pr.full_name, pr.number, kind)
@@ -4936,7 +5050,7 @@ class ReviewWatcher:
             stability=stability.text if stability is not None else "",
         )
 
-        hub, problem = self._ensure_hub(pr)
+        hub, problem = self._ensure_hub(pr, task_ref=task.ref if task else None)
         if problem is not None:
             return Decision(Action.SKIPPED, problem, round_)
 
@@ -5040,7 +5154,9 @@ class ReviewWatcher:
             env_var=self.config.reviewer_token_env, reviewer=self.github.login
         )
 
-    def _ensure_hub(self, pr: PullRequest) -> tuple[Path, str | None]:
+    def _ensure_hub(
+        self, pr: PullRequest, *, task_ref: "str | None" = None
+    ) -> tuple[Path, str | None]:
         """Resolve the reviewer's cwd, hub-ifying the repo first if configured.
 
         Returns (hub, problem). `problem` is non-None when the round cannot run.
@@ -5050,9 +5166,20 @@ class ReviewWatcher:
         _refused_before_start, above the CI gate. The re-read below is not
         redundant with it -- `add` can have created the hub in between, and this
         is the check that says so.
+
+        Either way out (hub present, or hub-ified here) the hub is pre-trusted
+        for claude BEFORE the caller enqueues the session (issue #136; see
+        `_trust_hub`). `task_ref` names the round's review task, so the
+        `REVIEW-<task>` checkout the skill may create is trusted too.
         """
         hub = self.config.hub_for(pr.owner, pr.repo)
         if hub.is_dir():
+            # A hub that appeared between boots was never seeded by the
+            # entrypoint at all, and a REVIEW-* checkout may have appeared
+            # since the last spawn: trust is re-asserted before EVERY spawn.
+            # Idempotent and cheap -- a state file already carrying every
+            # path is not rewritten.
+            self._trust_hub(hub, "before spawn", task_ref)
             return hub, None
 
         # Guarded twice: config.load() rejects 'add' without an allowlist, and
@@ -5085,8 +5212,160 @@ class ReviewWatcher:
                 f"{hub} still does not exist — check hub_template against the "
                 f"manifest's `dir:` override"
             )
+        # Issue #136: the entrypoint pre-trusts only the hubs it can name at
+        # boot, and under `repos_source: bows` a hub created here was never
+        # among them -- the first session on it would sit on Claude Code's
+        # "trust this folder?" dialog while the stale-round probe read it as
+        # alive. Seed the hub root, main/ (the spawn cwd) and the review
+        # checkout BEFORE the session is enqueued.
+        self._trust_hub(hub, "hub-ified", task_ref)
         return hub, None
 
+    def _trust_hub(
+        self, cwd: Path, why: str, task_ref: "str | None" = None
+    ) -> "list[Path]":
+        """Pre-accept Claude Code's trust dialog for every directory a
+        reviewer session on this hub may start in or `cd` into (see
+        `trust.hub_trust_paths`: the hub root, `main/`, the `REVIEW-<task>`
+        checkout), in both claude state files. Returns the state files that
+        changed. Dry-run seeds nothing. Best-effort by construction
+        (`seed_trust` never raises): a session can still be spawned into an
+        untrusted hub -- it just may wedge on the dialog, which the
+        stale-round probe now detects -- so a failed seed must never cost the
+        spawn."""
+        paths = hub_trust_paths(cwd, task_ref=task_ref)
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would pre-trust %d claude dir(s) for hub %s (%s)",
+                len(paths), hub_root_of(cwd), why,
+            )
+            return []
+        changed = seed_trust(paths)
+        if changed:
+            log.info(
+                "trusted hub %s for claude (%s): %d dir(s) — %s — written to %s",
+                hub_root_of(cwd), why, len(paths),
+                ", ".join(str(p) for p in paths),
+                ", ".join(str(t) for t in changed),
+            )
+        return changed
+
+    def _wedged_on_first_run_dialog(
+        self,
+        pr: PullRequest,
+        round_: int,
+        session: str,
+        task_ref: "str | None",
+        cap: int,
+    ) -> bool:
+        """Issue #136: is this stale round's alive session sitting on one of
+        Claude Code's first-run gates -- and if so, clear the lane.
+
+        Reads the pane (`alissa tmux tail`, 40 lines) and asks
+        `trust.pane_shows_first_run_dialog` whether the session is PARKED on
+        a gate -- the gate's accept option among the last lines with nothing
+        but the gate's own chrome below it, its question strictly above -- not merely
+        whether the gate's words appear: this repo's own README, CHANGELOG,
+        `trust.py` and issue #136 quote them, so a session that cats or
+        diffs any of them has them on screen while at work, and a kill here
+        would double the round. A pane not parked on a gate, or one the CLI
+        could not capture, answers False and the caller keeps the floored
+        defer it always took (the other alive-but-idle causes -- an expired
+        login, a usage limit, any other permission prompt -- are
+        deliberately NOT classified here).
+
+        A match is `wedged:first-run-dialog`: ONE WARNING per episode (keyed
+        first_run_dialog_kind(session) -- in the durable ping ledger in
+        production, in the process-lifetime `_dry_run_drift` set under
+        dry-run, the `_warn_identity_drift` split, so a diagnostic pass can
+        never silence production nor production the diagnostic; a kill that
+        fails and is retried next poll logs at INFO), then the row's own session is
+        killed (`alissa tmux kill <name>`, never a sweep), the hub it started
+        in is trusted (root, main/, the review checkout -- the very entries
+        the gate was asking for, so the re-queued round does not meet it
+        again), one activity-comment line records the act, and True tells
+        the caller to re-queue the round NOW, exactly as a dead session
+        would (the respawn is `reenqueued`, lands in the `stale_reenqueued`
+        bucket, and burns the round's attempt the same way). Dry-run
+        classifies and logs (once per episode, in memory) but writes no
+        ledger row, kills nothing and answers False (the defer holds). A
+        kill that fails answers False too: the defer holds and the
+        next poll, reading the same pane, tries again -- the remedy for a
+        session that will not die, not a loop to guard against.
+
+        The pane is untrusted third-party terminal content: only its
+        CLASSIFICATION reaches the log; the capture itself stays at DEBUG.
+        """
+        pane = self.alissa.tail_session(session, FIRST_RUN_PANE_TAIL_LINES)
+        if not pane_shows_first_run_dialog(pane):
+            return False
+        log.debug(
+            "%s: last %d pane lines of %s:\n%s",
+            WEDGE_FIRST_RUN_DIALOG, FIRST_RUN_PANE_TAIL_LINES, session, pane,
+        )
+        cwd = self.config.hub_for(pr.owner, pr.repo)
+        hub = hub_root_of(cwd)
+        kind = first_run_dialog_kind(session)
+        # Durable in production, process-lifetime in dry-run (review round 1
+        # of PR #137): the two stores never meet, so a `--once --dry-run`
+        # pass over the default state path cannot eat production's WARNING.
+        record = not self.config.dry_run
+        if self._drift_gated(pr, kind, record):
+            log.info(
+                "%s: session %s (%s round %d) is still on claude's first-run "
+                "dialog — retrying the kill",
+                WEDGE_FIRST_RUN_DIALOG, session, pr.slug, round_,
+            )
+        else:
+            log.warning(
+                "%s: session %s (%s round %d) reads alive but its pane shows "
+                "claude's first-run dialog (%s) — the directive was swallowed "
+                "by the prompt and no verdict will ever be submitted. Killing "
+                "it, pre-trusting hub %s (root, main/, review checkout) for "
+                "claude, and re-queuing round %d now (counted exactly as a dead "
+                "session's respawn). Operator lever: `alissa tmux tail "
+                "<session>` to see the prompt, `tmux send-keys -t <session> "
+                "Down Enter` to accept it by hand, or kill + seed as the daemon "
+                "does",
+                WEDGE_FIRST_RUN_DIALOG, session, pr.slug, round_,
+                " / ".join(repr(m) for m in FIRST_RUN_DIALOG_MARKERS), hub,
+                round_,
+            )
+            self._note_drift_gate(pr, kind, record)
+        if self.config.dry_run:
+            log.info(
+                "[dry-run] would kill %s, pre-trust %s and re-queue round %d",
+                session, hub, round_,
+            )
+            return False
+        try:
+            self.alissa.kill_session(session)
+        except CommandError as exc:
+            log.warning(
+                "%s: could not kill %s (%s) — kills are best-effort; the round "
+                "keeps its defer and the kill is retried next poll",
+                WEDGE_FIRST_RUN_DIALOG, session, exc,
+            )
+            return False
+        self._trust_hub(cwd, WEDGE_FIRST_RUN_DIALOG, task_ref)
+        activity_kind = first_run_dialog_activity_kind(session)
+        if not self.state.pinged(pr.full_name, pr.number, activity_kind):
+            landed = self._append_activity(
+                pr,
+                self._activity_line(
+                    session,
+                    round_,
+                    f"{WEDGE_FIRST_RUN_DIALOG} — session `{session}` read alive "
+                    f"but its pane sat on claude's first-run dialog (the hub was "
+                    f"not pre-trusted); killed, hub `{hub}` pre-trusted, round "
+                    f"{round_} re-queued",
+                    cap,
+                ),
+            )
+            if landed:
+                self.state.record_ping(pr.full_name, pr.number, activity_kind)
+        return True
+
     def preflight(self) -> list[str]:
         """Startup checks. Returns warnings; raises on anything fatal."""
         warnings: list[str] = []

alissa_tools_github_revloop-0.31.2/src/main/alissa/tools/github/revloop/trust.py

@@ -0,0 +1,473 @@
+"""Hub trust: keeping Claude Code's per-directory "trust this folder?" gate
+pre-accepted for every directory a reviewer session may start in (issue
+#136; the reviewer-side sibling of devloop PR #124 / issue #123).
+
+Claude Code asks, once per directory, whether the folder it was started in
+is trusted -- and `--dangerously-skip-permissions` does NOT suppress that
+dialog. A headless session that meets it hangs: the directive `alissa tmux
+queue` types into the pane is swallowed by the prompt, the session sits in
+the roster reading alive, and the stale-round probe (correctly) declines to
+respawn over a live session -- `round k is stale but session … is still
+active — not respawning over a live reviewer`, every poll, for as long as
+the pane sits there.
+
+The container entrypoint seeds the gate at boot for the hubs it can NAME at
+boot: the `ALISSA_REVIEW_REPOS` allowlist plus every hub already on disk.
+Under `repos_source: bows` `ALISSA_REVIEW_REPOS` is empty -- the allowlist
+is DERIVED from the feed Bodies of Work at runtime -- so a repo hub-ified
+after boot was never trusted. This module closes that gap from the daemon's
+side, in three places the loop calls:
+
+* after every successful feed refresh: the derived list is written to
+  `{root}/.alissa-derived-repos` (`DERIVED_REPOS_FILENAME`) so the NEXT
+  boot's entrypoint seeding can read it, and the derived hubs are trusted
+  right away, hub-ified or not (trusting a path that does not exist yet is
+  exactly what the entrypoint already does for the static allowlist);
+* at hub-ify time and before every spawn (`ReviewWatcher._ensure_hub`): the
+  hub root, `{hub}/main` (where the reviewer starts, per `hub_template`),
+  the `REVIEW-<task>` checkout the review skill may create for the PR head,
+  and every such checkout already on disk;
+* after a first-run-dialog wedge kill: the hub the wedged session started
+  in, so the re-queued round does not meet the same prompt.
+
+WHAT IS TRUSTED IS THE REVIEWER'S SHAPE, NOT THE DEVELOPER'S. devloop's
+sessions start in the hub root and create `TASK-*` worktrees; this daemon
+starts a session in `{root}/{repo}/main` (the `hub_template` default, the
+docker README's "Reviewers `cd` into `{root}/{repo}/main`"), and the
+alissa-code-review skill tells a reviewer that must run code to make a
+throwaway `REVIEW-TASK-<id>` worktree beside `main/`. So `hub_trust_paths`
+lists the hub root, `main/`, the session cwd when the template puts it
+elsewhere, the checkout named for the round's task, and every `REVIEW-*`
+directory on disk.
+
+The merge is the entrypoint's, transposed: load-then-update of
+`~/.claude.json` and `$CLAUDE_CONFIG_DIR/.claude.json` (when set --
+`CLAUDE_CONFIG_DIR` reliably relocates only the credential file, so both
+targets are written and whichever claude reads carries the flag), only ever
+ADDING `projects[<path>].hasTrustDialogAccepted = true`. Idempotent: a target
+that already carries every entry is not rewritten at all, which is also what
+keeps the daemon's writes off a file Claude Code itself rewrites -- the only
+time this module touches the file is when a NEW directory has to be
+trusted. That write is guarded on three sides, because Claude Code itself
+rewrites the same file while sessions run: the temp-file + rename keeps a
+concurrent READER from ever seeing a torn file; a compare-and-swap
+immediately before the rename (the file must still hold the bytes the merge
+was computed from) keeps the OTHER WRITER's update from being discarded
+wholesale -- the payload is the whole file, so a lost update could drop
+another session's `projects` entries or the persisted login; and a re-read
+after the rename catches a writer that landed right after ours and dropped
+OUR entries. Either miss restarts the merge on top of the newer file, a
+bounded number of times, and giving up is one WARNING. Never raises: trust
+is a convenience for the session about to spawn, and a failed write is one
+WARNING, never a lost poll.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import os
+import re
+from pathlib import Path
+from typing import Iterable, Sequence
+
+log = logging.getLogger(__name__)
+
+# The file the daemon writes the derived (bows-mode) allowlist to, under the
+# workspace root, one `owner/repo` per line -- and the file the entrypoint's
+# first-run seeding reads at the NEXT boot (`ALISSA_DERIVED_REPOS_FILE`
+# overrides the location on both sides). The same name and override as
+# devloop's, so an operator who knows one image knows the other.
+DERIVED_REPOS_FILENAME = ".alissa-derived-repos"
+ENV_DERIVED_REPOS_FILE = "ALISSA_DERIVED_REPOS_FILE"
+
+# The state file Claude Code keeps its per-directory trust in, relative to
+# $HOME and to $CLAUDE_CONFIG_DIR.
+CLAUDE_STATE_FILENAME = ".claude.json"
+ENV_CLAUDE_CONFIG_DIR = "CLAUDE_CONFIG_DIR"
+TRUST_KEY = "hasTrustDialogAccepted"
+
+# The throwaway worktree the alissa-code-review skill tells a reviewer to
+# create beside `main/` when it must run code: `REVIEW-TASK-<id>`. Listed by
+# prefix so a checkout already on disk is trusted whatever task it was for.
+REVIEW_CHECKOUT_PREFIX = "REVIEW-"
+
+# What a pane PARKED on one of Claude Code's first-run gates shows -- and
+# what corroborates that it is parked there rather than merely mentioning
+# it (devloop PR #124 review round 1). The gates' words are quoted by this
+# repo's README, CHANGELOG, this module and issue #136, so a session that
+# cats any of them, greps the tree or shows a diff has them on screen while
+# at work -- and a match kills the session. The classifier therefore asks
+# for the gate's SHAPE, not its vocabulary (see `pane_shows_first_run_dialog`):
+#
+# * the gate's ACCEPT option (`FIRST_RUN_DIALOG_OPTIONS`) is one of the last
+#   `FIRST_RUN_DIALOG_TAIL_LINES` non-blank lines of the capture, once the
+#   selection cursor, option numbering and box drawing are stripped;
+# * nothing follows it but the gate's own chrome (`FIRST_RUN_DIALOG_CHROME`):
+#   a session that printed ANYTHING after the text -- a spinner, a tool
+#   call, the `>` input prompt an idle session sits at, a shell prompt --
+#   is not on the gate;
+# * the gate's QUESTION (`FIRST_RUN_DIALOG_MARKERS`) appears STRICTLY above
+#   the option line -- the markers are the questions' own words, none of
+#   which the accept options contain, so the option line can never stand
+#   in for its question (PR #137 review round 1: with `trust this folder`
+#   as the marker and the option line counted, `Yes, I trust this folder`
+#   alone satisfied this leg).
+#
+# The trust dialog reads "Quick safety check: Is this a project you created
+# or one you trust? … ❯ No, exit / Yes, I trust this folder"; the
+# bypass-permissions gate reads "WARNING: Claude Code running in Bypass
+# Permissions mode … No, exit / Yes, I accept" (either option order, with
+# or without numbering, an optional "Enter to confirm · Esc to exit" footer
+# and box drawing). Both are gates the entrypoint's seeding is meant to
+# pre-answer, so a pane parked on either is a session the seeding missed,
+# not a session at work. devloop's `hubs.py` checks the same first two legs
+# on the same fixtures (shared verbatim); its third leg still counts the
+# option line and carries `trust this folder` as the marker, which this
+# module tightened -- a devloop follow-up, so the two seats agree again.
+# The trust gate's older wording ("Do you trust the files in this folder?")
+# is kept so a pinned Claude Code that still draws it is a gate too.
+FIRST_RUN_DIALOG_MARKERS = (
+    "quick safety check",
+    "is this a project you created",
+    "trust the files in this folder",
+    "bypass permissions mode",
+)
+FIRST_RUN_DIALOG_OPTIONS = (
+    "yes, i trust this folder",
+    "yes, i accept",
+)
+FIRST_RUN_DIALOG_CHROME = (
+    "no, exit",
+    "enter to confirm",
+)
+FIRST_RUN_DIALOG_TAIL_LINES = 6
+
+# What a gate draws AROUND its text: box drawing, the selection cursor and
+# whitespace (stripped from both ends of a line), then "1." / "2)" option
+# numbering. Nothing else is stripped -- a diff's `+`, a markdown bullet,
+# a quote's backtick and the `>` of Claude Code's input prompt all stay,
+# which is what keeps a line that merely quotes a gate from reading as one.
+_DIALOG_DECORATION = "❯ \t│┃║╭╮╰╯┌┐└┘├┤┬┴┼─━═"
+_DIALOG_NUMBERING = re.compile(r"^\d+[.)]\s*")
+
+# How many times `seed_trust` restarts a merge that another writer moved
+# the file under (see the module docstring) before it gives up with a
+# WARNING. Claude Code's own rewrites are bursts around a session's start
+# and end, not a stream, so a second pass is expected to land.
+SEED_TRUST_ATTEMPTS = 3
+
+# The wedge classification the loop logs and records for a stale round
+# whose session's pane shows one of those gates.
+WEDGE_FIRST_RUN_DIALOG = "wedged:first-run-dialog"
+
+
+def claude_state_targets(
+    home: "Path | str | None" = None, config_dir: "Path | str | None" = None
+) -> "list[Path]":
+    """The `.claude.json` files to merge trust into: `$HOME/.claude.json`,
+    plus `$CLAUDE_CONFIG_DIR/.claude.json` when that variable is set and
+    non-blank. Both arguments default to the environment (`~` expansion
+    honours `HOME`), which is what lets a test point the merge at scratch
+    directories without touching the daemon's own files."""
+    home_dir = Path(home) if home is not None else Path(os.path.expanduser("~"))
+    targets = [home_dir / CLAUDE_STATE_FILENAME]
+    raw = (
+        str(config_dir)
+        if config_dir is not None
+        else os.environ.get(ENV_CLAUDE_CONFIG_DIR, "")
+    ).strip()
+    if raw:
+        extra = Path(raw) / CLAUDE_STATE_FILENAME
+        if extra != targets[0]:
+            targets.append(extra)
+    return targets
+
+
+def hub_root(cwd: "Path | str") -> Path:
+    """The hub above a reviewer's session cwd. `hub_template` defaults to
+    `{root}/{repo}/main`, so the cwd's parent is the hub; a template that
+    starts sessions in the hub root itself names the hub directly."""
+    path = Path(cwd)
+    return path.parent if path.name == "main" else path
+
+
+def review_checkout_name(task_ref: "str | None") -> "str | None":
+    """The throwaway worktree the review skill creates for a round that must
+    run code: `REVIEW-<task ref>` (`REVIEW-TASK-<id>`), or None without a
+    review task to name it after."""
+    ref = (task_ref or "").strip()
+    return f"{REVIEW_CHECKOUT_PREFIX}{ref}" if ref else None
+
+
+def hub_trust_paths(
+    cwd: "Path | str", *, task_ref: "str | None" = None
+) -> "list[Path]":
+    """Every directory a reviewer session on this hub may START in or `cd`
+    into: the hub root, `{hub}/main` (the spawn cwd under the default
+    template), the session cwd itself when the template puts it elsewhere,
+    the `REVIEW-<task>` checkout the skill may create for this round's PR
+    head, and every `REVIEW-*` checkout already on disk (a re-queued round
+    may find a surviving one). The root, `main` and the named checkout are
+    listed whether or not they exist yet -- the point of seeding is to be
+    there BEFORE the directory is used. De-duplicated, first mention wins."""
+    start = Path(cwd)
+    root = hub_root(start)
+    paths = [root, root / "main", start]
+    checkout = review_checkout_name(task_ref)
+    if checkout:
+        paths.append(root / checkout)
+    try:
+        paths.extend(sorted(
+            p for p in root.glob(f"{REVIEW_CHECKOUT_PREFIX}*") if p.is_dir()
+        ))
+    except OSError:
+        pass
+    out: "list[Path]" = []
+    for p in paths:
+        if p not in out:
+            out.append(p)
+    return out
+
+
+def _load_state(path: Path) -> "tuple[str | None, dict]":
+    """The state file's raw text (None when absent) and its parsed object
+    (`{}` when absent or not a JSON object). Only ABSENCE is folded into
+    "start fresh": an unparseable file raises `ValueError` up to
+    `seed_trust`, which skips that target rather than replacing it (a
+    corrupt state file is never silently overwritten). The raw text is what
+    `_write_atomic` compares against before its rename."""
+    try:
+        with open(path, encoding="utf-8") as fh:
+            raw = fh.read()
+    except FileNotFoundError:
+        return None, {}
+    data = json.loads(raw)
+    return raw, (data if isinstance(data, dict) else {})
+
+
+def _raw_text(path: Path) -> "str | None":
+    try:
+        return path.read_text(encoding="utf-8")
+    except FileNotFoundError:
+        return None
+
+
+def _write_atomic(path: Path, data: dict, expected: "str | None") -> bool:
+    """Write `data` over `path` by temp file + rename -- unless the file no
+    longer holds `expected` (the raw text the caller merged from), in which
+    case nothing is replaced and False is returned so the caller merges
+    again on top of whoever wrote in between. The rename keeps READERS
+    safe (never a torn file); the check before it keeps the OTHER WRITER's
+    update safe, down to the gap between the check and the rename."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    tmp = path.with_name(path.name + ".tmp")
+    with open(tmp, "w", encoding="utf-8") as fh:
+        json.dump(data, fh, indent=2)
+        fh.write("\n")
+    if _raw_text(path) != expected:
+        tmp.unlink(missing_ok=True)
+        return False
+    os.replace(tmp, path)
+    return True
+
+
+def _add_trust(state: dict, wanted: "list[str]") -> "list[str]":
+    """Merge `projects[<path>].hasTrustDialogAccepted = true` for every
+    wanted path into `state` (in place, repairing a missing or non-object
+    `projects`). Returns the paths that were NOT already trusted."""
+    projects = state.get("projects")
+    if not isinstance(projects, dict):
+        projects = {}
+        state["projects"] = projects
+    added = []
+    for p in wanted:
+        entry = projects.get(p)
+        if not isinstance(entry, dict):
+            entry = {}
+            projects[p] = entry
+        if entry.get(TRUST_KEY) is not True:
+            entry[TRUST_KEY] = True
+            added.append(p)
+    return added
+
+
+def _untrusted(state: dict, wanted: "list[str]") -> "list[str]":
+    projects = state.get("projects")
+    if not isinstance(projects, dict):
+        return list(wanted)
+    return [
+        p for p in wanted
+        if not isinstance(projects.get(p), dict)
+        or projects[p].get(TRUST_KEY) is not True
+    ]
+
+
+def _merge_target(target: Path, wanted: "list[str]") -> bool:
+    """Merge `wanted` into ONE claude state file. True when the file was
+    written. Load, merge, compare-and-swap, verify -- and start over, up to
+    SEED_TRUST_ATTEMPTS times, whenever another writer moved the file
+    between the load and the rename (the swap refuses) or right after the
+    rename (the verify finds an entry missing). Never raises."""
+    wrote = False
+    for _ in range(SEED_TRUST_ATTEMPTS):
+        try:
+            raw, state = _load_state(target)
+        except (OSError, ValueError) as exc:
+            if wrote:
+                # Our write landed; whoever replaced it since left something
+                # this daemon will not touch. Nothing more to do here.
+                log.debug("trust: %s unreadable after the merge (%s)", target, exc)
+                return True
+            log.warning(
+                "trust: could not read %s (%s) — leaving it untouched; the "
+                "directories are NOT pre-trusted there: %s",
+                target, exc, ", ".join(wanted),
+            )
+            return False
+        added = _add_trust(state, wanted)
+        if not added:
+            # Every entry is present: it always was, or the pass before
+            # this one landed and survived.
+            return wrote
+        try:
+            swapped = _write_atomic(target, state, raw)
+        except OSError as exc:
+            log.warning(
+                "trust: could not write %s (%s) — the directories are NOT "
+                "pre-trusted there: %s", target, exc, ", ".join(added),
+            )
+            return wrote
+        if not swapped:
+            log.info(
+                "trust: %s changed underneath the merge — merging %s again "
+                "on top of the newer file", target, ", ".join(added),
+            )
+            continue
+        wrote = True
+        try:
+            _, after = _load_state(target)
+        except (OSError, ValueError) as exc:
+            log.debug("trust: %s unreadable right after the merge (%s)", target, exc)
+            return True
+        missing = _untrusted(after, wanted)
+        if not missing:
+            log.debug("trust: %s now pre-trusts %s", target, ", ".join(added))
+            return True
+        log.info(
+            "trust: %s was rewritten right after the merge and lost %s — "
+            "merging again", target, ", ".join(missing),
+        )
+    log.warning(
+        "trust: gave up merging into %s after %d attempts — another writer "
+        "kept rewriting it, so the directories may NOT be pre-trusted there: %s",
+        target, SEED_TRUST_ATTEMPTS, ", ".join(wanted),
+    )
+    return wrote
+
+
+def seed_trust(
+    paths: "Iterable[Path | str]",
+    *,
+    home: "Path | str | None" = None,
+    config_dir: "Path | str | None" = None,
+) -> "list[Path]":
+    """Merge `projects[<path>].hasTrustDialogAccepted = true` for every path
+    into every claude state target. Returns the targets that were WRITTEN
+    (a target already carrying every entry is left untouched -- byte for
+    byte, no rewrite). Never raises and never removes anything: an
+    unparseable target is skipped with a WARNING rather than replaced, a
+    failed write is a WARNING too, and a target another writer keeps
+    moving under the merge is retried a bounded number of times (see
+    `_merge_target` and the module docstring) before that, too, is one
+    WARNING.
+
+    Paths are recorded as absolute strings, which is how Claude Code keys
+    them; a relative path is resolved against the cwd, which is never what a
+    caller means, so callers pass absolute hubs."""
+    wanted: "list[str]" = []
+    for p in paths:
+        s = os.fspath(Path(p))
+        if s not in wanted:
+            wanted.append(s)
+    changed: "list[Path]" = []
+    if not wanted:
+        return changed
+    for target in claude_state_targets(home, config_dir):
+        if _merge_target(target, wanted):
+            changed.append(target)
+    return changed
+
+
+def derived_repos_path(root: "Path | str") -> Path:
+    """Where the derived allowlist is written under this workspace root, or
+    wherever `ALISSA_DERIVED_REPOS_FILE` points (the same override the
+    entrypoint honours, so an operator relocating one relocates both)."""
+    override = os.environ.get(ENV_DERIVED_REPOS_FILE, "").strip()
+    if override:
+        return Path(override)
+    return Path(root) / DERIVED_REPOS_FILENAME
+
+
+def write_derived_repos(root: "Path | str", repos: "Sequence[str]") -> "Path | None":
+    """Record the derived allowlist, one `owner/repo` per line, for the next
+    boot's entrypoint seeding (the entrypoint's 3a block is the only reader:
+    it skips blank lines, `#` comments and lines without a `/`). Rewritten
+    only when the content differs.
+    Returns the path written, or None when nothing changed or the write
+    failed (logged; never raised -- the daemon has already trusted the hubs
+    itself, so this file only matters to a future boot)."""
+    path = derived_repos_path(root)
+    body = "".join(f"{r}\n" for r in repos)
+    try:
+        if path.is_file() and path.read_text(encoding="utf-8") == body:
+            return None
+        path.parent.mkdir(parents=True, exist_ok=True)
+        tmp = path.with_name(path.name + ".tmp")
+        tmp.write_text(body, encoding="utf-8")
+        os.replace(tmp, path)
+    except OSError as exc:
+        log.warning(
+            "could not record the derived allowlist at %s (%s) — the next "
+            "boot's entrypoint seeding will not pre-trust these hubs until a "
+            "refresh succeeds: %s", path, exc, ", ".join(repos),
+        )
+        return None
+    return path
+
+
+def _dialog_line(line: str) -> str:
+    """A pane line reduced to the text a gate would render there (see
+    _DIALOG_DECORATION), casefolded."""
+    text = line.strip(_DIALOG_DECORATION)
+    text = _DIALOG_NUMBERING.sub("", text).strip(_DIALOG_DECORATION)
+    return text.casefold()
+
+
+def _is_dialog_chrome(text: str) -> bool:
+    return any(text.startswith(chrome) for chrome in FIRST_RUN_DIALOG_CHROME)
+
+
+def pane_shows_first_run_dialog(pane: str) -> bool:
+    """Whether a session's terminal tail is PARKED on one of Claude Code's
+    first-run gates: the gate's accept option among the last
+    FIRST_RUN_DIALOG_TAIL_LINES non-blank lines, nothing but the gate's own
+    chrome below it, and the gate's question strictly above it (the notes on
+    FIRST_RUN_DIALOG_MARKERS say why each leg is there). An empty capture
+    (the CLI could not tail) is never a dialog -- absence of evidence keeps
+    the defer -- and neither is a pane that merely MENTIONS a gate: a
+    session at work or idle at its prompt has printed something below the
+    words, and that something is not the gate's chrome."""
+    if not pane:
+        return False
+    lines = [t for t in (_dialog_line(ln) for ln in pane.splitlines()) if t]
+    tail = lines[-FIRST_RUN_DIALOG_TAIL_LINES:]
+    for offset in range(len(tail) - 1, -1, -1):
+        if any(tail[offset].startswith(o) for o in FIRST_RUN_DIALOG_OPTIONS):
+            break
+    else:
+        return False
+    if not all(_is_dialog_chrome(t) for t in tail[offset + 1:]):
+        return False
+    above = lines[:len(lines) - len(tail) + offset]
+    return any(m in t for t in above for m in FIRST_RUN_DIALOG_MARKERS)

alissa_tools_github_revloop-0.31.2/src/main/alissa/tools/github/revloop/version

@@ -0,0 +1 @@
+0.31.2

{alissa_tools_github_revloop-0.31.1 → alissa_tools_github_revloop-0.31.2/src/main/alissa_tools_github_revloop.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-revloop
-Version: 0.31.1
+Version: 0.31.2
 Summary: ALISSA-TOOLS-GITHUB-REVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_revloop-0.31.1 → alissa_tools_github_revloop-0.31.2}/src/main/alissa_tools_github_revloop.egg-info/SOURCES.txt

@@ -17,6 +17,7 @@ src/main/alissa/tools/github/revloop/loop_events.py
 src/main/alissa/tools/github/revloop/proc.py
 src/main/alissa/tools/github/revloop/prreview.py
 src/main/alissa/tools/github/revloop/state.py
+src/main/alissa/tools/github/revloop/trust.py
 src/main/alissa/tools/github/revloop/version
 src/main/alissa/tools/github/revloop/version.py
 src/main/alissa/tools/github/revloop/webui/__init__.py

alissa_tools_github_revloop-0.31.1/src/main/alissa/tools/github/revloop/version

@@ -1 +0,0 @@
-0.31.1