pdd-cli 0.0.264__tar.gz → 0.0.266__tar.gz

{pdd_cli-0.0.264 → pdd_cli-0.0.266}/.github/workflows/release.yml

@@ -202,10 +202,11 @@ jobs:
       #                                artifact:read, distribution:package,
       #                                distribution:publish). A project-locked
       #                                token (e.g. an e2e profile) will NOT work.
-      #   vars.PDS_CLI_PACKAGE         install spec for the private
-      #                                @promptdriven/pds CLI — an npm spec once
-      #                                published, or an https/tarball URL.
-      #   vars.PDS_API_URL             PDS backend (default the CLI's built-in).
+      #   vars.PDS_CLI_PACKAGE         install spec for the @promptdriven/pds
+      #                                CLI, for example @promptdriven/pds@latest
+      #                                or a pinned version.
+      #   vars.PDS_API_URL             PDS backend. Defaults to production when
+      #                                the repo variable is unset.
       #   vars.RELEASE_VIDEO_PROJECT_ID  optional stable PDS project to reuse
       #                                across releases (else a per-release
       #                                "PDD <tag> release" project is created).
@@ -215,7 +216,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PDS_TOKEN: ${{ secrets.PDS_TOKEN }}
-          PDS_API_URL: ${{ vars.PDS_API_URL }}
+          PDS_API_URL: ${{ vars.PDS_API_URL || 'https://video.promptdriven.ai' }}
           PDS_CLI_PACKAGE: ${{ vars.PDS_CLI_PACKAGE }}
           CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           RELEASE_VIDEO_PROJECT_ID: ${{ vars.RELEASE_VIDEO_PROJECT_ID }}

{pdd_cli-0.0.264 → pdd_cli-0.0.266}/Makefile

@@ -58,6 +58,7 @@ help:
 	@echo "  make publish                 - Build & upload current version to PyPI"
 	@echo "  make publish-public          - Copy artifacts to public repo only"
 	@echo "  make release-video           - Generate and upload a YouTube video for the current release tag"
+	@echo "  make release-local           - Run release with local Infisical PDS release token"
 	@echo "  make check-deps              - Check pyproject.toml and requirements.txt are in sync"
 	@echo "  make release                 - On main: tag HEAD with next vN.N.N and push (BUMP=patch|minor|major; default patch)"
 	@echo "                                  Actions publishes to PyPI via OIDC after gltanaka approval"
@@ -91,6 +92,10 @@ RELEASE_VIDEO_DRY_RUN ?= 0
 RELEASE_VIDEO_PROJECT_ID ?=
 CLAUDE_CLI ?= claude
 PDS_CLI ?= pds
+PDS_API_URL ?= https://video.promptdriven.ai
+INFISICAL ?= infisical
+INFISICAL_ENV ?= prod
+INFISICAL_PATH ?= /
 
 # Python files
 PY_PROMPTS := $(shell find $(PROMPTS_DIR) -name "*_python.prompt")
@@ -106,6 +111,11 @@ ifeq ($(CI),true)
 SKIP_MAKEFILE_REGEN := 1
 endif
 
+RELEASE_MAKE_GOALS := release release-video release-local release-infisical check-release-video-config check-release-video-config-local check-release-video-config-infisical
+ifneq ($(filter $(RELEASE_MAKE_GOALS),$(MAKECMDGOALS)),)
+SKIP_MAKEFILE_REGEN := 1
+endif
+
 # Auto-skip Makefile regeneration if prompt file doesn't exist (e.g., public repo)
 ifeq ($(wildcard $(MAKEFILE_PROMPT)),)
 SKIP_MAKEFILE_REGEN := 1
@@ -122,7 +132,7 @@ TEST_OUTPUTS := $(patsubst $(PDD_DIR)/%.py,$(TESTS_DIR)/test_%.py,$(PY_OUTPUTS))
 # All Example files in context directory (recursive)
 EXAMPLE_FILES := $(shell find $(CONTEXT_DIR) -name "*_example.py" 2>/dev/null)
 
-.PHONY: all clean test requirements production coverage staging regression regression-public sync-regression all-regression cloud-regression install build upload-pypi analysis fix crash update update-extension generate run-examples verify detect change lint publish publish-public public-ensure public-update public-import public-diff sync-public ensure-dev-deps cloud-test cloud-test-quick cloud-test-build cloud-test-push cloud-test-setup test-frontend release release-video check-release-remote check-release-branch check-release-clean
+.PHONY: all clean test requirements production coverage staging regression regression-public sync-regression all-regression cloud-regression install build upload-pypi analysis fix crash update update-extension generate run-examples verify detect change lint publish publish-public public-ensure public-update public-import public-diff sync-public ensure-dev-deps cloud-test cloud-test-quick cloud-test-build cloud-test-push cloud-test-setup test-frontend release release-local release-infisical release-video check-release-remote check-release-branch check-release-clean check-release-video-config check-release-video-config-local check-release-video-config-infisical
 
 all: $(PY_OUTPUTS) $(MAKEFILE_OUTPUT) $(CSV_OUTPUTS) $(EXAMPLE_OUTPUTS) $(TEST_OUTPUTS)
 
@@ -735,6 +745,30 @@ check-release-clean:
 		exit 1; \
 	fi
 
+check-release-video-config:
+	@RELEASE_PDS_TOKEN="$${PDS_TOKEN:-}"; \
+	if [ -z "$$RELEASE_PDS_TOKEN" ]; then RELEASE_PDS_TOKEN="$${PDS_RELEASE_TOKEN:-}"; fi; \
+	if [ -n "$$RELEASE_PDS_TOKEN" ]; then export PDS_TOKEN="$$RELEASE_PDS_TOKEN"; export PDS_PROFILE=; fi; \
+	export PDS_API_URL="$${PDS_API_URL:-$(PDS_API_URL)}"; \
+	python scripts/release_video.py \
+		--preflight \
+		--pds-cli "$(PDS_CLI)" \
+		--project-id "$(RELEASE_VIDEO_PROJECT_ID)"
+
+check-release-video-config-local: check-release-video-config-infisical
+
+check-release-video-config-infisical:
+	@command -v "$(INFISICAL)" >/dev/null 2>&1 || { echo "Error: $(INFISICAL) CLI is required."; exit 1; }
+	@"$(INFISICAL)" run --env "$(INFISICAL_ENV)" --path "$(INFISICAL_PATH)" --silent -- \
+		$(MAKE) --no-print-directory check-release-video-config
+
+release-local: release-infisical
+
+release-infisical:
+	@command -v "$(INFISICAL)" >/dev/null 2>&1 || { echo "Error: $(INFISICAL) CLI is required."; exit 1; }
+	@"$(INFISICAL)" run --env "$(INFISICAL_ENV)" --path "$(INFISICAL_PATH)" --silent -- \
+		$(MAKE) --no-print-directory release
+
 release-video:
 	@if [ "$(RELEASE_VIDEO)" = "0" ]; then \
 		echo "Skipping release video because RELEASE_VIDEO=0"; \
@@ -742,6 +776,10 @@ release-video:
 	fi; \
 	DRY_RUN_FLAG=""; \
 	if [ "$(RELEASE_VIDEO_DRY_RUN)" = "1" ]; then DRY_RUN_FLAG="--dry-run"; fi; \
+	RELEASE_PDS_TOKEN="$${PDS_TOKEN:-}"; \
+	if [ -z "$$RELEASE_PDS_TOKEN" ]; then RELEASE_PDS_TOKEN="$${PDS_RELEASE_TOKEN:-}"; fi; \
+	if [ -n "$$RELEASE_PDS_TOKEN" ]; then export PDS_TOKEN="$$RELEASE_PDS_TOKEN"; export PDS_PROFILE=; fi; \
+	export PDS_API_URL="$${PDS_API_URL:-$(PDS_API_URL)}"; \
 	RELEASE_TAG="$(RELEASE_TAG)" RELEASE_GIT_SHA="$(RELEASE_GIT_SHA)" \
 	python scripts/release_video.py \
 		--output-dir "$(RELEASE_VIDEO_OUTPUT_DIR)" \
@@ -754,7 +792,7 @@ release-video:
 		--privacy "$(RELEASE_VIDEO_PRIVACY)" \
 		$$DRY_RUN_FLAG
 
-release: check-deps check-suspicious-files check-release-remote check-release-branch check-release-clean
+release: check-deps check-suspicious-files check-release-remote check-release-branch check-release-clean check-release-video-config
 	@echo "Preparing release"
 	@set -e; \
 	echo "Fetching tags from origin"; \

{pdd_cli-0.0.264/pdd_cli.egg-info → pdd_cli-0.0.266}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pdd-cli
-Version: 0.0.264
+Version: 0.0.266
 Summary: PDD (Prompt-Driven Development) Command Line Interface
 Author: Greg Tanaka
 Author-email: glt@alumni.caltech.edu

{pdd_cli-0.0.264 → pdd_cli-0.0.266}/README.md

@@ -58,6 +58,9 @@ For pre-merge prompt and user-story quality (vague terms, vocabulary, optional L
 For deterministic contract-section lint (`<contract_rules>`, `<coverage>`, waivers, story `## Covers`), see [docs/contract_check.md](docs/contract_check.md).
 
 For a rule-to-story/test coverage matrix (`pdd checkup coverage`), see [docs/coverage_contracts.md](docs/coverage_contracts.md).
+
+For non-interactive bounded prompt repair after a failed prompt source-set checkup, see [docs/prompt_repair.md](docs/prompt_repair.md).
+
 ## Installation
 
 ### Prerequisites for macOS
@@ -2879,7 +2882,7 @@ Run an automated health check on a project from a GitHub issue. The checkup work
 
 `checkup` can also run against an existing pull request. With `--pr <PR_URL>` alone it reviews the PR diff on its own merits (correctness / quality), using full project context (architecture, `.pddrc`); the issue-alignment gate is skipped. Add `--issue <ISSUE_URL>` to also verify the PR resolves that issue. Default PR mode runs the standard checkup steps on the PR branch, can commit and push generated fixes back to that same PR, and skips PR creation because the PR already exists. Use `--no-fix` for verification-only PR checks, or `--review-loop` for the separate reviewer/fixer loop (which still requires `--issue`).
 
-**Final PR gate ("ready for maintainer review")** — `pdd checkup --pr <PR_URL> --issue <ISSUE_URL> --final-gate` (issue #1406): once a PR exists, "ready" means this one canonical gate passed. It runs two layers against the existing PR — **Layer 1** is the PR-scoped checkup (the standard steps, pushing fixes only to the same PR head, never opening a new PR) and **Layer 2** is the maintainer-style reviewer/fixer review-loop on the resulting head. Unlike a bare `--review-loop` (which always exits 0 once it produces a report), `--final-gate` returns a **real ship verdict**: it exits non-zero unless the review-loop's final state is genuinely clean (verified head matches the remote, the reviewer accepted the PR, no findings remain, and — with `--issue` — the PR is issue-aligned). A Layer 1 failure short-circuits before Layer 2. This is the same gate `pdd-issue`'s autonomous final verification uses, so a PR that passes automation has cleared the same bar a human maintainer/Codex review would apply. `--final-gate` requires both `--pr` and `--issue` and cannot be combined with `--review-loop`, `--no-fix`, `--review-only`, `--start-step`, `--no-gates`, or `--test-scope targeted` — the canonical verdict deliberately keeps the deterministic gates and runs the full suite.
+**Final PR gate ("ready for maintainer review")** — `pdd checkup --pr <PR_URL> --issue <ISSUE_URL> --final-gate` (issue #1406): once a PR exists, "ready" means this one canonical issue-resolution gate passed. It runs two layers against the existing PR — **Layer 1** is the PR-scoped checkup (the standard steps, pushing fixes only to the same PR head, never opening a new PR) and **Layer 2** is the maintainer-style reviewer/fixer review-loop on the resulting head. Unlike a bare `--review-loop` (which always exits 0 once it produces a report), `--final-gate` returns a **real ship verdict**: it exits non-zero unless the review-loop's final state is genuinely clean (verified head matches the remote, the reviewer accepted the PR, no findings remain, and the PR is issue-aligned). A Layer 1 failure short-circuits before Layer 2. This is the same gate `pdd-issue`'s autonomous final verification uses, so a PR that passes automation has cleared the same bar a human maintainer/Codex review would apply. By default the gate uses local full-suite evidence (`--full-suite-source local`, `--test-scope full`). In GitHub App/CI environments, use `--full-suite-source github-checks --test-scope targeted`: Layer 1 runs targeted local checks, then the gate fails closed unless GitHub checks pass on the current PR head before Layer 2. `--final-gate` requires both `--pr` and `--issue`. It cannot be combined with `--review-loop`, `--no-fix`, `--review-only`, `--start-step`, or `--no-gates`.
 
 **Local utilities** (no GitHub issue URL): `pdd checkup lint`, `pdd checkup contract check`, `pdd checkup coverage`, **`pdd checkup snapshot`** for nondeterministic-prompt snapshot policy (prompts with `<shell>`, `<web>`, or `query=` includes must have a replayable artifact under `.pdd/evidence/`), and **`pdd checkup gate`** for evidence-manifest policy enforcement before merge. There is no top-level `pdd gate` or `pdd policy snapshot` command—use `pdd checkup snapshot` only.
 
@@ -2908,7 +2911,8 @@ Options:
 - `--pr PR_URL`: Review an existing pull request instead of creating a new one. With no `--issue`, the PR is reviewed on its own merits. Cannot be combined with a positional issue URL.
 - `--issue ISSUE_URL`: Optional source GitHub issue for `--pr`; when provided, used as the expected behavior and acceptance criteria for PR verification (the alignment gate applies). Required with `--review-loop`; cannot be passed without `--pr`.
 - `--review-loop`: In PR mode, run the primary-reviewer/fixer loop. The primary reviewer reviews the PR, the fixer addresses actionable findings, fixes are committed and pushed to the PR branch, and the primary reviewer verifies until clean or a limit is reached.
-- `--final-gate`: The canonical final PR gate (issue #1406). Requires both `--pr` and `--issue`. Runs the PR-scoped checkup as Layer 1 (no new PR) and the review-loop as Layer 2, then returns a real ship verdict (exit non-zero unless the PR is genuinely shippable). This is what "ready for maintainer review" means once a PR exists, and the gate `pdd-issue` uses for its final verification. Cannot be combined with `--review-loop`, `--no-fix`, `--review-only`, `--start-step`, `--no-gates`, or `--test-scope targeted`.
+- `--final-gate`: The canonical final PR gate (issue #1406). Requires both `--pr` and `--issue`. Runs the PR-scoped checkup as Layer 1 (no new PR) and the review-loop as Layer 2, then returns a real ship verdict (exit non-zero unless the PR is genuinely shippable and issue-aligned). This is what "ready for maintainer review" means once a PR exists, and the gate `pdd-issue` uses for its final verification. Cannot be combined with `--review-loop`, `--no-fix`, `--review-only`, `--start-step`, or `--no-gates`.
+- `--full-suite-source local|github-checks`: Final-gate full-suite source (default: `local`). `local` requires `--test-scope full`. `github-checks` requires `--test-scope targeted`; Layer 1 runs targeted local tests and GitHub checks on the current PR head provide the full-suite truth before Layer 2.
 - `--review-only`: With `--review-loop`, run only the primary reviewer first pass. This never invokes the fixer, commits, or pushes.
 - `--reviewer ROLE`: Primary reviewer role for `--review-loop` (for example, `codex`).
 - `--fixer ROLE`: Fixer role for `--review-loop` (for example, `claude`). The fixer must be different from the reviewer unless `--review-only` is used.
@@ -2922,9 +2926,13 @@ Options:
 - `--continue-on-reviewer-limit`: Report provider, rate, context-window, timeout, auth, network, sandbox, permission, and non-zero-exit reviewer failures as `degraded` instead of `failed`. Degraded reviewers are still not clean unless a configured fallback reviewer completes successfully and takes over as the active reviewer.
 - `--fallback-reviewer-on-failure`: When the primary reviewer ends in `failed` or `missing` (not `degraded`), run a second review pass using the fixer's identity as a fallback reviewer. On a clean fallback the rendered `reviewer-status:` line shows the primary as `clean` so the cloud verdict adapter's real-reviewer-clean rule can fire, while the primary's original failure detail is preserved in the `### Reviewer Diagnostics` subsection of the final report with a `superseded_by_fallback` marker. Off by default to preserve existing CI expectations.
 - `--no-gates`: Disable the deterministic local gates (`git diff --check` against the PR range, `doc-contract`, `prettier --check`, `npx --no-install tsc --noEmit`, a non-mutating Python syntax check via the builtin `compile()`, `ruff check`/`ruff format --check`/`black --check`/`mypy`) that otherwise run before any `clean` verdict in `--review-loop`. **`ruff format --check`** is opt-in: it fires only when **either** `[tool.ruff.format]` is declared in `pyproject.toml`, **or** a literal `ruff format` / `ruff-format` reference appears in `.pre-commit-config.yaml`, `cloudbuild-*-ci.yaml`, or `.github/workflows/*.{yml,yaml}` (canonical pre-commit hook id matches the hyphenated form). Touched CI files are excluded from the signal scan to defend against PR-poisoned opt-in. The Python syntax gate routes through `compile()` rather than `python -m py_compile` so it never writes `__pycache__/*.pyc` into the worktree; the TypeScript gate uses `--no-install` so it never hits the npm registry. Gate subprocesses resolve `git` and tool binaries through a sanitized PATH so a PR cannot provide worktree-local shims via `PATH=.:$PATH`. Default: gates are enabled. The flag exists only as a diagnostic/emergency escape hatch — under normal operation a failing gate must block the PR from being declared clean even when the LLM reviewer says clean. Issue #1092.
-- `doc-contract` repo config: non-PDD projects can declare documentation contracts in `.pdd/doc_contract.json` or `.pdd/doc-contract.json` with `version: 1` and `rules` containing `source_globs`, `added_regex`, and `docs`/`doc_paths`. Each captured added surface must be documented in the configured docs/sections; optional `doc_regex` can tie named captures together, such as requiring an operation and its new skip condition to appear in the same documented contract. In PR mode the base branch’s config is authoritative, so a PR cannot bypass the gate by weakening its own config. For prompt-level regression testing, changed non-LLM `.prompt` files must also be covered by at least one `user_stories/story__*.md` link, making `pdd detect --stories` the executable prompt test for those prompt changes.
+- `doc-contract` repo config: non-PDD projects can declare documentation contracts in `.pdd/doc_contract.json` or `.pdd/doc-contract.json` with `version: 1` and `rules` containing `source_globs`, `added_regex`, and `docs`/`doc_paths`. Each captured added surface must be documented in the configured docs/sections; optional `doc_regex` can tie named captures together, such as requiring an operation and its new skip condition to appear in the same documented contract. In PR mode the base branch’s config is authoritative, so a PR cannot bypass the gate by weakening its own config.
 - `--gate-timeout FLOAT`: Per-gate timeout in seconds (default: 60). Applies to every discovered gate; the runner kills the subprocess and surfaces the gate as a `runner-error` blocker finding when the timeout fires.
 - `--gate-allow GATE`: Repeatable allowlist token forwarded to `discover_gates` as `extra_allow`. Reserved for future versions to opt extra gate names into the discovery set; the current default discovery is allowlist-only and the argument is accepted but does not widen it. Useful primarily as a forward-compat plumbing hook for CI configurations.
+- `--prompt-repair MODE`: Non-interactive prompt repair mode when automatic prompt checkup fails. Accepted values: `off` (default, no repair), `best-effort` (repair and continue even if issues remain after repair), `strict` (block on unresolved issues after repair). Overrides the `prompt_repair` setting in `[tool.pdd.checkup]` in `pyproject.toml`.
+- `--max-prompt-repair-rounds INT`: Maximum repair-and-recheck iterations per prompt file (default: 1).
+- `--max-prompt-token-growth INT`: Maximum token increase allowed during a single repair pass (default: 1000).
+- `--max-prompt-repair-seconds FLOAT`: Wall-clock timeout for the entire prompt repair loop in seconds (default: 120.0).
 
 **Deterministic-gate coverage limits (issue #1092)**: The default gate set is intentionally conservative because PR contents are untrusted on fork PRs. As a result the following workflows do NOT block a clean verdict and you should still rely on CI / human review for them:
 - **JS/TS PRs that change any `.js` / `.cjs` / `.mjs` file (anywhere in the worktree)**: prettier and eslint script gates are skipped because their configs can `require()` arbitrary local JavaScript (including subdirectory plugin modules) and the require chain is undecidable without running the very code we are trying to gate. A PR-sized JS formatting/lint regression on such a PR will only be caught by CI.

{pdd_cli-0.0.264 → pdd_cli-0.0.266}/architecture.json

@@ -7334,11 +7334,12 @@
     }
   },
   {
-    "reason": "Entry point for the agentic checkup workflow \u2014 fetches the GitHub issue when one is provided (optional in PR mode), loads project context, and dispatches to the checkup orchestrator or PR review-loop.",
-    "description": "Accepts an optional GitHub issue URL; when one is provided it fetches issue content and comments, otherwise (PR mode only) it threads empty issue context so the PR is reviewed on its own merits. Loads architecture.json and .pddrc, then invokes the multi-step checkup orchestrator, the PR-mode primary-reviewer/fixer review loop, or (final_gate) the canonical two-layer final PR gate (issue #1406): Layer 1 PR-scoped checkup then Layer 2 review-loop on the resulting head, returning a real ship verdict derived from the review-loop final-state.json. PR review-loop context is bounded and includes PR body, changed files, comments, and submitted reviews.",
+    "reason": "Entry point for the agentic checkup workflow; in PR mode the linked issue is optional (own-merits review).",
+    "description": "Accepts an optional GitHub issue URL; when one is provided it fetches issue content and comments, otherwise (PR mode only) it threads empty issue context so the PR is reviewed on its own merits. Loads architecture.json and .pddrc, optionally runs a bounded non-interactive prompt repair loop on changed .prompt files, then invokes the multi-step checkup orchestrator, the PR-mode primary-reviewer/fixer review loop, or (final_gate) the canonical two-layer final PR gate (issue #1406): Layer 1 PR-scoped checkup then Layer 2 review-loop on the resulting head, returning a real ship verdict derived from the review-loop final-state.json. PR review-loop context is bounded and includes PR body, changed files, comments, and submitted reviews.",
     "dependencies": [
       "agentic_common_python.prompt",
-      "checkup_review_loop_python.prompt"
+      "checkup_review_loop_python.prompt",
+      "prompt_repair_python.prompt"
     ],
     "priority": 217,
     "filename": "agentic_checkup_python.prompt",
@@ -7354,7 +7355,7 @@
         "functions": [
           {
             "name": "run_agentic_checkup",
-            "signature": "(issue_url: Optional[str] = None, *, verbose: bool, quiet: bool, no_fix: bool, timeout_adder: float, use_github_state: bool, reasoning_time: Optional[float], pr_url: Optional[str], review_loop: bool, final_gate: bool, review_only: bool, reviewers: str, reviewer: Optional[str], fixer: Optional[str], reviewer_fallback: Optional[str], fixer_fallback: Optional[str], max_review_rounds: int, max_review_cost: float, max_review_minutes: float, require_all_reviewers_clean: bool, continue_on_reviewer_limit: bool, require_final_fresh_review: bool, blocking_severities: Optional[str], clean_reviewer_states: Optional[str], fallback_reviewer_on_failure: bool, enable_gates: bool = True, gate_timeout: float = 60.0, gate_allow: Tuple[str, ...] = (), start_step_override: Optional[Union[int, float]] = None, cwd: Optional[Path] = None) -> Tuple[bool, str, float, str]",
+            "signature": "(issue_url: Optional[str] = None, *, verbose: bool = False, quiet: bool = False, no_fix: bool = False, timeout_adder: float = 0.0, use_github_state: bool = True, reasoning_time: Optional[float] = None, pr_url: Optional[str] = None, review_loop: bool = False, final_gate: bool = False, review_only: bool = False, reviewers: str = \"codex,claude\", reviewer: Optional[str] = None, fixer: Optional[str] = None, reviewer_fallback: Optional[str] = None, fixer_fallback: Optional[str] = None, max_review_rounds: int = 5, max_review_cost: float = 50.0, max_review_minutes: float = 90.0, require_all_reviewers_clean: bool = True, continue_on_reviewer_limit: bool = False, require_final_fresh_review: bool = True, blocking_severities: Optional[str] = None, clean_reviewer_states: Optional[str] = None, fallback_reviewer_on_failure: bool = False, enable_gates: bool = True, gate_timeout: float = 60.0, gate_allow: Tuple[str, ...] = (), start_step_override: Optional[Union[int, float]] = None, cwd: Optional[Path] = None, prompt_repair: str = \"off\", max_prompt_repair_rounds: int = 1, max_prompt_token_growth: int = 1000, max_prompt_repair_seconds: float = 120.0) -> Tuple[bool, str, float, str]",
             "returns": "Tuple[bool, str, float, str]",
             "sideEffects": [
               "Fetches the GitHub issue (when provided) and PR context via gh api",
@@ -7394,6 +7395,22 @@
             "sideEffects": [
               "Reads PR metadata, changed files, PR comments, and PR reviews with gh api"
             ]
+          },
+          {
+            "name": "_discover_prompt_paths",
+            "signature": "(cwd: Path) -> List[Path]",
+            "returns": "List[Path]",
+            "sideEffects": [
+              "Runs git diff to detect tracked/new .prompt files; falls back to glob"
+            ]
+          },
+          {
+            "name": "_review_loop_ship_verdict",
+            "signature": "(final_state: Optional[Dict[str, Any]], *, has_issue: bool) -> bool",
+            "returns": "bool",
+            "sideEffects": [
+              "None"
+            ]
           }
         ]
       }
@@ -7523,7 +7540,7 @@
   },
   {
     "reason": "Enforces deterministic-gate checks (linter, syntax, and doc-contract gates) in checkup review loops.",
-    "description": "Discovers and executes a conservative, allowlisted set of repo-local checks (PR-range git diff --check, doc-contract, prettier --check via package.json, a non-mutating Python syntax check via the builtin compile() builtin per changed .py file, optional ruff/black/mypy when configured in pyproject.toml, optional `npx --no-install tsc --noEmit` when typescript is declared AND node_modules/typescript/bin/tsc is on disk). The doc-contract gate supports repo-declared `.pdd/doc_contract.json` / `.pdd/doc-contract.json` rules for non-PDD projects; when a base-tree config exists it is authoritative so a reviewed PR cannot weaken its own documentation contract. It also enforces prompt-level story coverage for changed non-LLM `.prompt` files by requiring a linked `user_stories/story__*.md`, so user stories serve as the prompt regression-test artifact for `pdd detect --stories` (issue #560 bridge). Per-file gates pass POSIX `--` end-of-options separator so paths cannot be parsed as flags. Each gate runs as a list-form subprocess with bounded timeout, output truncation, PDD_* env scrubbing, sanitized PATH, and secret redaction; gate discovery and changed-file git probes resolve a trusted absolute git binary outside the PR worktree so PATH=.:$PATH cannot run a PR-shipped ./git. Failing gates are converted into synthetic blocker ReviewFinding rows with reviewer prefix 'gate:' so the review loop refuses the clean verdict and routes the deterministic failure through the fixer.",
+    "description": "Discovers and executes a conservative, allowlisted set of repo-local checks (PR-range git diff --check, doc-contract, prettier --check via package.json, a non-mutating Python syntax check via the builtin compile() builtin per changed .py file, optional ruff/black/mypy when configured in pyproject.toml, optional `npx --no-install tsc --noEmit` when typescript is declared AND node_modules/typescript/bin/tsc is on disk). The doc-contract gate supports repo-declared `.pdd/doc_contract.json` / `.pdd/doc-contract.json` rules for non-PDD projects; when a base-tree config exists it is authoritative so a reviewed PR cannot weaken its own documentation contract. Per-file gates pass POSIX `--` end-of-options separator so paths cannot be parsed as flags. Each gate runs as a list-form subprocess with bounded timeout, output truncation, PDD_* env scrubbing, sanitized PATH, and secret redaction; gate discovery and changed-file git probes resolve a trusted absolute git binary outside the PR worktree so PATH=.:$PATH cannot run a PR-shipped ./git. Failing gates are converted into synthetic blocker ReviewFinding rows with reviewer prefix 'gate:' so the review loop refuses the clean verdict and routes the deterministic failure through the fixer.",
     "dependencies": [
       "checkup_review_loop_python.prompt"
     ],
@@ -8114,10 +8131,13 @@
     }
   },
   {
-    "reason": "Registers the pdd checkup CLI command for project health checks and lint dispatch.",
+    "reason": "Registers the pdd checkup CLI command, which orchestrates project-wide health checks and fixes.",
     "description": "Defines the checkup Click command including pdd checkup lint dispatch, validate-arch-includes, and agentic checkup integration. In PR mode (--pr) the --issue option is optional (PR reviewed on its own merits when omitted); --pr stays mutually exclusive with the positional TARGET, and --issue without --pr is rejected.",
     "dependencies": [
-      "agentic_checkup_python.prompt"
+      "agentic_checkup_python.prompt",
+      "commands/prompt_python.prompt",
+      "commands/contracts_python.prompt",
+      "commands/gate_python.prompt"
     ],
     "priority": 236,
     "filename": "commands/checkup_python.prompt",
@@ -9912,7 +9932,7 @@
   },
   {
     "reason": "Single blocking pre-checkup gate that drift-syncs and build/smoke-verifies a PR before handing off to checkup --pr.",
-    "description": "A blocking pre-checkup quality gate invoked by both the change/feature and fix/bug e2e orchestrators immediately before `pdd checkup --pr`. Runs two ordered phases against the PR worktree and returns a single hard pass/fail the caller uses to block the handoff. Phase 1 (drift-sync) brings code, prompt, architecture.json and .pdd/meta into sync in the worktree via run_metadata_sync / sync_all_prompts_to_architecture / detect_drift+heal_module, then re-detects to confirm. .pdd/meta fingerprints written here via run_metadata_sync cover prompt+code only (example/test hashes are null), so canonical fingerprint finalization belongs to the post-merge sync (#1317): BOTH orchestrator paths defer it — the fix path filters .pdd/** from its commit, the change path restores tracked .pdd/meta after the gate — so the PR tree may still show fingerprint drift until the post-merge sync completes it. Phase 2 (build/smoke) runs deterministic per-file checks (py_compile/ruff/tsc) plus a project smoke layer (import changed modules, route/router-object probe, caller-compatibility sweep over both from-import and alias-import call sites, git-diff-targeted unit tests including directly-changed test files) and hard-blocks on any red result. Closes the vacuous-pass hole in run_ci_validation_loop by running its own checks rather than only polling GitHub required checks; preserves the fork-PR-RCE constraint by delegating to checkup_gates._script_is_acceptable, which runs only validated, safe package.json scripts (never build scripts) and skips the npm-family path entirely when the PR touches package.json / a package-manager config; the gate adds no command execution of its own beyond that allowlist. Docs-only diffs short-circuit; strict mode reuses PDD_STRICT_DOC_SYNC (issue #1293).",
+    "description": "A blocking pre-checkup quality gate invoked by both the change/feature and fix/bug e2e orchestrators immediately before `pdd checkup --pr`. Runs two ordered phases against the PR worktree and returns a single hard pass/fail the caller uses to block the handoff. Phase 1 (drift-sync) brings code, prompt, architecture.json and .pdd/meta into sync in the worktree via run_metadata_sync / sync_all_prompts_to_architecture / detect_drift+heal_module, then re-detects to confirm. .pdd/meta fingerprints written here via run_metadata_sync cover prompt+code only (example/test hashes are null), so canonical fingerprint finalization belongs to the post-merge sync (#1317): BOTH orchestrator paths defer it \u2014 the fix path filters .pdd/** from its commit, the change path restores tracked .pdd/meta after the gate \u2014 so the PR tree may still show fingerprint drift until the post-merge sync completes it. Phase 2 (build/smoke) runs deterministic per-file checks (py_compile/ruff/tsc) plus a project smoke layer (import changed modules, route/router-object probe, caller-compatibility sweep over both from-import and alias-import call sites, git-diff-targeted unit tests including directly-changed test files) and hard-blocks on any red result. Closes the vacuous-pass hole in run_ci_validation_loop by running its own checks rather than only polling GitHub required checks; preserves the fork-PR-RCE constraint by delegating to checkup_gates._script_is_acceptable, which runs only validated, safe package.json scripts (never build scripts) and skips the npm-family path entirely when the PR touches package.json / a package-manager config; the gate adds no command execution of its own beyond that allowlist. Docs-only diffs short-circuit; strict mode reuses PDD_STRICT_DOC_SYNC (issue #1293).",
     "dependencies": [
       "checkup_gates_python.prompt",
       "ci_drift_heal_python.prompt",
@@ -9941,5 +9961,33 @@
         ]
       }
     }
+  },
+  {
+    "reason": "Non-interactive prompt source-set repair orchestrator using the internal change() contract.",
+    "description": "Implements run_prompt_repair_loop(): consumes pdd.prompt_source_set_report.v1 findings and supporting context, synthesizes bounded change instructions, applies the complete prompt through pdd.change.change(), enforces token growth, rebuilds the full source-set report after each round, and writes an audit artifact to .pdd/evidence/prompt_repair/.",
+    "dependencies": [
+      "change_python.prompt",
+      "checkup_prompt_main_python.prompt",
+      "prompt_lint_python.prompt"
+    ],
+    "priority": 250,
+    "filename": "prompt_repair_python.prompt",
+    "filepath": "pdd/prompt_repair.py",
+    "tags": [
+      "module",
+      "python"
+    ],
+    "interface": {
+      "type": "module",
+      "module": {
+        "functions": [
+          {
+            "name": "run_prompt_repair_loop",
+            "signature": "(path: Path, config: PromptRepairConfig, *, context: Optional[Dict[str, str]] = None, cwd: Optional[Path] = None) -> RepairResult",
+            "returns": "RepairResult"
+          }
+        ]
+      }
+    }
   }
 ]

{pdd_cli-0.0.264 → pdd_cli-0.0.266}/docs/ONBOARDING.md

@@ -667,12 +667,12 @@ git commit -m "docs: update documentation"
 The version is derived from git tags via setuptools-scm. To release, on `main`:
 
 ```bash
-make release              # patch bump (default)
-make release BUMP=minor   # minor bump
-make release BUMP=major   # major bump
+make release-local             # patch bump with local Infisical PDS token
+make release-local BUMP=minor  # minor bump
+make release-local BUMP=major  # major bump
 ```
 
-`make release` tags `HEAD` with the next `vX.Y.Z`, pushes the tag, then runs `make release-video`. The release-video step asks Claude Code to turn the release diff/notes into a short video script and calls the Prompt Driven Studio CLI (`pds release-video create --target publish --platform youtube --privacy unlisted --wait`) to create and upload an unlisted YouTube video. Set `PDS_CLI` if `pds` is not on `PATH`, and set `RELEASE_VIDEO_PROJECT_ID` when the PDS token is scoped to an existing project. Use `RELEASE_VIDEO=0` only for an emergency release that must skip paid video generation/upload. GitHub Actions then builds the wheel, waits for the `gltanaka` approval on the `pypi-publish` environment, publishes to PyPI via OIDC, and creates a GitHub Release with auto-generated notes.
+`make release-local` injects the local Infisical `PDS_RELEASE_TOKEN`, tags `HEAD` with the next `vX.Y.Z`, pushes the tag, then runs `make release-video`. The release-video step asks Claude Code to turn the release diff/notes into a short video script and calls the Prompt Driven Studio CLI (`pds release-video create --target publish --platform youtube --privacy unlisted --wait`) to create and upload an unlisted YouTube video. Set `PDS_CLI` if `pds` is not on `PATH`, and set `RELEASE_VIDEO_PROJECT_ID` only for emergency recovery with a fixed-project PDS token. Use `RELEASE_VIDEO=0` only for an emergency release that must skip paid video generation/upload. GitHub Actions then builds the wheel, waits for the `gltanaka` approval on the `pypi-publish` environment, publishes to PyPI via OIDC, and creates a GitHub Release with auto-generated notes.
 
 ### 9. Troubleshooting Development Setup
 

{pdd_cli-0.0.264 → pdd_cli-0.0.266}/docs/prompt_lint.md

@@ -55,7 +55,11 @@ To achieve maximum velocity and specification quality in Prompt-Driven Developme
 ```mermaid
 graph TD
     A["1. Write Draft Prompt (.prompt)"] --> B["2. Run 'pdd checkup lint'"]
-    B -->|Flagged Ambiguities| C["Refine Prose & Add <vocabulary>"]
+    B -->|"Flagged Ambiguities (repair=off)"| C["Refine Prose & Add <vocabulary>"]
+    B -->|"Flagged Ambiguities (repair=best-effort)"| R["Non-interactive prompt repair"]
+    R --> B2["Re-run checkup lint"]
+    B2 -->|"Still failing"| C
+    B2 -->|"Linter Passes"| D
     C --> B
     B -->|Linter Passes| D["3. Generate Code ('pdd generate')"]
     D --> E["4. Verify Code ('make test')"]
@@ -75,6 +79,8 @@ pdd checkup lint prompts/my_feature_python.prompt --llm
 ```
 Review the advisory warnings, refine any vague terms, and build a precise `<vocabulary>` block in the prompt to define what ambiguous terms mean in your domain. Rerun the linter until the scan is clean.
 
+When `prompt_repair = "best-effort"` is set in `pyproject.toml` `[tool.pdd.checkup]` (or `--prompt-repair best-effort` is passed), a failed prompt source-set checkup automatically triggers a bounded, non-interactive repair pass — adding missing vocabulary definitions, normalizing contract rule IDs, filling coverage gaps — before re-running the full source-set check. See [docs/prompt_repair.md](prompt_repair.md) for configuration and safety details.
+
 ### Step 3: Generate Code
 Once the prompt contract is clean and deterministic, generate the initial implementation:
 ```bash

pdd_cli-0.0.266/docs/prompt_repair.md

@@ -0,0 +1,114 @@
+# Non-Interactive Prompt Repair Loop
+
+When automatic prompt checkup fails, PDD can run a **bounded, non-interactive repair pass**, re-run checkup, then continue or report remaining issues.
+
+Keeps PDD in prompt space: improve the prompt before code-level debugging.
+
+## Workflow
+
+```text
+PDD creates/modifies prompt
+     ↓
+deterministic prompt checkup
+     ↓
+pass → continue to code generation/change
+fail → non-interactive prompt repair
+     ↓
+prompt checkup again
+     ↓
+pass/warn → continue | else report remaining issues (strict may block)
+```
+
+## Usage
+
+```bash
+# Disable repair (default)
+pdd checkup ... --prompt-repair off
+
+# Best-effort repair (continues even if issues remain after repair)
+pdd checkup ... --prompt-repair best-effort
+```
+
+## What the Repair Loop Fixes
+
+The repair brief consumes prompt-fixable findings from the structured source-set
+report: lint, contract, and coverage (for example unchecked requirements or missing
+contract rules). External-only findings such as gate `missing_evidence`, drift
+readiness notes, and snapshot policy failures that require evidence capture do
+not drive automated repair. The loop applies the smallest coherent prompt-only
+update through the internal `pdd change` implementation, then rebuilds the
+complete report.
+
+The repair loop does **not** edit generated code, tests, stories, or other files.
+
+## Configuration
+
+```toml
+# pyproject.toml
+[tool.pdd.checkup]
+prompt_repair = "best-effort"   # off | best-effort | strict
+max_prompt_repair_rounds = 1
+max_prompt_token_growth = 1000
+max_prompt_repair_seconds = 120
+```
+
+| Key | Default | Description |
+|-----|---------|-------------|
+| `prompt_repair` | `off` | Repair mode: `off` disables; `best-effort` repairs and continues on failure; `strict` blocks on unresolved issues after repair |
+| `max_prompt_repair_rounds` | `1` | Maximum repair-and-recheck iterations |
+| `max_prompt_token_growth` | `1000` | Maximum token increase allowed during repair |
+| `max_prompt_repair_seconds` | `120` | Wall-clock timeout for the entire repair loop |
+
+## CLI Flags
+
+The following flags can be passed to `pdd checkup` (and related commands that invoke checkup) to override `pyproject.toml [tool.pdd.checkup]` defaults:
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `--prompt-repair MODE` | `off` | Non-interactive repair mode: `off`, `best-effort`, or `strict` |
+| `--max-prompt-repair-rounds INT` | `1` | Maximum repair-and-recheck iterations |
+| `--max-prompt-token-growth INT` | `1000` | Maximum token increase allowed during repair |
+| `--max-prompt-repair-seconds FLOAT` | `120.0` | Wall-clock timeout for the entire repair loop |
+
+## Token Delta Reporting
+
+After repair, PDD reports the token impact:
+
+```
+Prompt token delta: +312 tokens
+Note: 240 tokens are reusable contract preamble.
+```
+
+A warning is emitted if growth exceeds `max_prompt_token_growth`.
+
+## Safety
+
+- Deterministic source-set checkup remains the authority after every repair round
+- Prompt changes use `pdd.change.change()` and its modified-prompt delimiter contract
+- No generated code edits
+- Audit note written under `.pdd/evidence/prompt_repair/<slug>-<timestamp>.json`
+
+## Evidence
+
+Each repair run writes a record to the run's evidence manifest:
+
+```json
+{
+  "run_id": "...",
+  "prompt_path": "prompts/my_module_python.prompt",
+  "tokens_before": 412,
+  "tokens_after": 724,
+  "token_delta": 312,
+  "rounds_used": 1,
+  "issues_before": 3,
+  "issues_after": 0,
+  "status": "repaired"
+}
+```
+
+## Non-goals
+
+- No separate `pdd checkup coach` command
+- No interactive questions (deferred to a later issue in the stack)
+- No CI interactive mode
+- No unbounded agentic repo search

{pdd_cli-0.0.264 → pdd_cli-0.0.266}/pdd/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.0.264'
-__version_tuple__ = version_tuple = (0, 0, 264)
+__version__ = version = '0.0.266'
+__version_tuple__ = version_tuple = (0, 0, 266)
 
-__commit_id__ = commit_id = 'gd5df6afb9'
+__commit_id__ = commit_id = 'g38a270530'