mirror of
https://github.com/garrytan/gstack.git
synced 2026-10-31 22:14:25 +01:00
Garry Tanandcapy-ai[bot]
45a678323b
* v1.91.70.0 feat(unattended): artifact contract, unattended session kind, findings-derived review log, gate list Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: register test/fixtures/multi-agent-wave as a free fixture (consumer: headless-artifacts.test.ts) Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
129 lines
6.4 KiB
Bash
Executable File
129 lines
6.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# gstack-review-log — atomically log a review result
|
|
# Usage: gstack-review-log '{"skill":"...","timestamp":"...","status":"..."}'
|
|
#
|
|
# Before reading a diff: gstack-review-log --start review
|
|
# After that pass: gstack-review-log '{...,"completed":true,"converged":true}' --finish TOKEN
|
|
# With a findings file: gstack-review-log '{...}' --findings findings.jsonl
|
|
# status/unresolved/issues_found/critical_gaps are DERIVED from the file (B7);
|
|
# a claimed value that disagrees is rejected with REVIEW_STATUS_MISMATCH.
|
|
# Exit: 0 written · 1 rejected (binding or validation failed; stderr says why) · 2 usage.
|
|
# Diff reviews get wtree only from a consumed, matching start capture on an
|
|
# unchanged tree. Completion/convergence are reviewer-reported, not proof that
|
|
# a model read the code. Caller-supplied binding fields are always discarded.
|
|
# Plan-tier rows retain their legacy binding behavior.
|
|
set -euo pipefail
|
|
export GIT_OPTIONAL_LOCKS=0
|
|
export GIT_CONFIG_PARAMETERS="${GIT_CONFIG_PARAMETERS:+$GIT_CONFIG_PARAMETERS }'core.fsmonitor=false' 'core.untrackedCache=false'"
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
eval "$("$SCRIPT_DIR/gstack-slug" 2>/dev/null)"
|
|
. "$(dirname "$0")/gstack-state-root.sh" 2>/dev/null || { echo "$0: cannot resolve the gstack state root: $(dirname "$0")/gstack-state-root.sh is missing. fix: reinstall with ./setup or /gstack-upgrade (docs/state-root.md)" >&2; exit 1; }
|
|
gstack_state_root_select
|
|
GSTACK_HOME="$_gstack_sr_root"
|
|
mkdir -p "$GSTACK_HOME/projects/$SLUG"
|
|
|
|
INPUT="${1:-}"
|
|
export GSTACK_REVIEW_DIR="$GSTACK_HOME/projects/$SLUG"
|
|
export GSTACK_REVIEW_REPO="$(git rev-parse --show-toplevel 2>/dev/null || true)"
|
|
export GSTACK_REVIEW_BRANCH="$(git symbolic-ref --short HEAD 2>/dev/null || git rev-parse HEAD 2>/dev/null || true)"
|
|
export GSTACK_REVIEW_LIB="$SCRIPT_DIR/../lib/review-evidence.ts"
|
|
case "$(uname -s)" in
|
|
MINGW*|MSYS*|CYGWIN*)
|
|
if command -v cygpath >/dev/null 2>&1; then
|
|
GSTACK_REVIEW_LIB="$(cygpath -m "$GSTACK_REVIEW_LIB")"
|
|
GSTACK_REVIEW_DIR="$(cygpath -m "$GSTACK_REVIEW_DIR")"
|
|
fi
|
|
;;
|
|
esac
|
|
export GSTACK_REVIEW_LOG="$GSTACK_REVIEW_DIR/$BRANCH-reviews.jsonl"
|
|
|
|
# Compute binding fields (best-effort; empty outside a git repo).
|
|
COMMIT_FULL=$(git rev-parse HEAD 2>/dev/null || true)
|
|
TREE=""
|
|
WTREE=""
|
|
DIRTY=""
|
|
if [ -n "$COMMIT_FULL" ]; then
|
|
TREE=$(git rev-parse 'HEAD^{tree}' 2>/dev/null || true)
|
|
# E4: the fingerprint's new objects go to a private 0700 directory this
|
|
# operation owns (a read-only .git still fingerprints), and stay readable
|
|
# until the consumers below (bindReview / checkSharedLibsReuse read the tree
|
|
# and blobs) finish; removed on EXIT/INT/TERM. gstack-wtree's one-line
|
|
# diagnostic reaches stderr; stdout stays the hash.
|
|
if WTREE_OBJECTS=$(mktemp -d "${TMPDIR:-/tmp}/gstack-wtree-objects-XXXXXX" 2>/dev/null); then
|
|
case "$(uname -s)" in
|
|
MINGW*|MSYS*|CYGWIN*) command -v cygpath >/dev/null 2>&1 && WTREE_OBJECTS="$(cygpath -m "$WTREE_OBJECTS")" ;;
|
|
esac
|
|
trap 'rm -rf "$WTREE_OBJECTS"' EXIT
|
|
trap 'exit 130' INT TERM
|
|
WTREE=$(GSTACK_WTREE_OBJECT_DIR="$WTREE_OBJECTS" "$SCRIPT_DIR/gstack-wtree" || true)
|
|
export GIT_ALTERNATE_OBJECT_DIRECTORIES="$WTREE_OBJECTS${GIT_ALTERNATE_OBJECT_DIRECTORIES:+:$GIT_ALTERNATE_OBJECT_DIRECTORIES}"
|
|
else
|
|
echo "gstack-review-log: cannot create a private object directory under ${TMPDIR:-/tmp}; no working-tree fingerprint. Set TMPDIR to a writable directory." >&2
|
|
fi
|
|
if [ -n "$(git status --porcelain -uno 2>/dev/null | head -1)" ]; then
|
|
DIRTY="true"
|
|
else
|
|
DIRTY="false"
|
|
fi
|
|
fi
|
|
|
|
# Gate findings get `actor` from the session classifier, never from the caller;
|
|
# a non-interactive session's gate findings are forced to action "open".
|
|
SESSION_KIND=$("$SCRIPT_DIR/gstack-session-kind" 2>/dev/null || echo interactive)
|
|
export GSTACK_STAMP_COMMIT_FULL="$COMMIT_FULL" GSTACK_STAMP_TREE="$TREE" GSTACK_STAMP_WTREE="$WTREE" GSTACK_STAMP_DIRTY="$DIRTY" GSTACK_STAMP_SESSION_KIND="$SESSION_KIND"
|
|
if [ "$INPUT" = --start ]; then
|
|
GSTACK_REVIEW_SKILL="${2:-}" bun -e '
|
|
const { captureReviewStart } = await import(process.env.GSTACK_REVIEW_LIB);
|
|
console.log(captureReviewStart(process.env.GSTACK_REVIEW_SKILL));
|
|
'
|
|
exit $?
|
|
fi
|
|
if [ "$INPUT" = --check-shared-libs ] && [ "$#" -eq 2 ]; then
|
|
GSTACK_REVIEW_TOKEN="$2" bun -e '
|
|
const { checkSharedLibsReuse } = await import(process.env.GSTACK_REVIEW_LIB);
|
|
console.log(JSON.stringify(checkSharedLibsReuse(JSON.parse(await Bun.stdin.text()), process.env.GSTACK_REVIEW_TOKEN)));
|
|
'
|
|
exit $?
|
|
fi
|
|
usage() {
|
|
echo 'Usage: gstack-review-log JSON [--finish TOKEN] [--findings FILE] | --start SKILL | --check-shared-libs TOKEN < finding.json' >&2
|
|
echo 'Exit codes: 0 written · 1 rejected · 2 usage' >&2
|
|
exit 2
|
|
}
|
|
[ "$#" -ge 1 ] || usage
|
|
TOKEN=""
|
|
FINDINGS=""
|
|
shift
|
|
while [ "$#" -gt 0 ]; do
|
|
case "$1" in
|
|
--finish) [ "$#" -ge 2 ] || usage; TOKEN="$2"; shift 2 ;;
|
|
--findings) [ "$#" -ge 2 ] || usage; FINDINGS="$2"; shift 2 ;;
|
|
*) usage ;;
|
|
esac
|
|
done
|
|
case "$INPUT" in --*) usage ;; esac
|
|
|
|
# Validate (reject malformed or injection attempts) AND stamp in one pass.
|
|
# Caller values for the binding keys are dropped before stamping. A binding or
|
|
# validation failure reaches stderr as its own line (never folded into
|
|
# "invalid JSON"), and exits 1 with nothing written.
|
|
STAMPED=$(printf '%s' "$INPUT" | GSTACK_REVIEW_TOKEN="$TOKEN" GSTACK_REVIEW_FINDINGS="$FINDINGS" bun -e "
|
|
const { bindReview } = await import(process.env.GSTACK_REVIEW_LIB);
|
|
let rec;
|
|
try { rec = JSON.parse(await Bun.stdin.text()); } catch (e) { console.error('gstack-review-log: invalid JSON, skipping (' + e.message + ')'); process.exit(1); }
|
|
if (!rec || Array.isArray(rec) || typeof rec !== 'object') { console.error('gstack-review-log: invalid JSON, skipping (expected an object)'); process.exit(1); }
|
|
try {
|
|
console.log(JSON.stringify(bindReview(rec, process.env.GSTACK_REVIEW_TOKEN, process.env, process.env.GSTACK_REVIEW_FINDINGS || undefined)));
|
|
} catch (e) { console.error(e.message); process.exit(1); }
|
|
") || exit 1
|
|
|
|
echo "$STAMPED" >> "$GSTACK_HOME/projects/$SLUG/$BRANCH-reviews.jsonl"
|
|
|
|
# gbrain-sync: enqueue for cross-machine sync (no-op if sync is off). Plan B1:
|
|
# an unattended session never enqueues, whatever the inherited sync mode.
|
|
if [ "$("$SCRIPT_DIR/gstack-session-kind" 2>/dev/null || echo interactive)" = "unattended" ]; then
|
|
echo "review-log: sync skipped (unattended session)" >&2
|
|
else
|
|
"$SCRIPT_DIR/gstack-brain-enqueue" "projects/$SLUG/$BRANCH-reviews.jsonl" 2>/dev/null &
|
|
fi
|