git push no-mistakes
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
feat(agent): add native Grok Build support * feat: add native Grok agent support * no-mistakes(review): Preserve Grok invocation environment * no-mistakes(document): Clarify Grok’s pipeline-only skill role * docs: complete native Grok ExecPlan * no-mistakes(document): Clarify Grok opt-out documentation * no-mistakes: apply CI fixes --------- Co-authored-by: Boris <boriza@users.noreply.github.com> | 9 天前 | |
chore: backpass extracting memory to skills | 1 天前 | |
chore: backpass extracting memory to skills | 1 天前 | |
ci: migrate PR gate to shared action (#821) * ci: flip this repo's own gate to the shared require-no-mistakes action The composite action added in #819 was published but nothing called it - this repository kept running the inline copy it was extracted from. The gate is now a thin caller pinned to 32d396ac0f29135daf7fcb9964aba9d5f4e796d6, the commit that first carried the action. Pinning an already-published commit is the self-certification guard: a PR that edits the action is still fully tested on its own head (the Go tests execute the working-tree verify.py), while the required check judging that PR keeps running the released copy, so a change can never rewrite its own judge. Everything the caller owns is preserved byte-for-byte: the job name "PR must be raised via no-mistakes", the run-name and concurrency identity, the body-bearing-events-only trigger set, the read-only fork boundary, and the release automation exemptions. Those exemptions stay in the job-level `if:` rather than moving to the action's exempt-authors input, because an in-job exemption still needs the run to start and a GITHUB_TOKEN PR's run is created in action_required and never starts. workflow_no_mistakes_required_test.go now owns the CALLER - immutable 40-hex pin, single delegating step, exemptions, triggers, concurrency identity, fork boundary - and drives the real action through a workflow event payload, which is the only thing that proves the input-free wiring reaches a verdict. Per-verdict coverage stays in require_no_mistakes_action_test.go against the same interpreter rather than being duplicated. prsummary_test.go's generator/gate sync check follows the signature marker into verify.py. * no-mistakes(review): Fix workflow pin metadata and exemption coverage * no-mistakes(review): Correct action pin provenance wording * no-mistakes(review): Correct remaining action pin provenance comment * no-mistakes(review): Exercise composite action through caller tests * no-mistakes(review): Enforce exact shared action pin * no-mistakes(document): Update shared action migration documentation | 7 天前 | |
fix: replace the running executable during Windows self-update (#650) * fix: replace the running executable during Windows self-update Fixes #373 * fix(update): assert platform-appropriate permissions in replace tests Windows does not preserve Unix mode bits, so a hard 0751 assertion fails on windows-latest even when the replace logic is correct. Expect 0666 on Windows and keep 0751 everywhere else, and report the expected value in the failure message instead of a hardcoded 751. --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> | 7 天前 | |
fix(pipeline): make native agent timeouts observable and bounded (#877) * fix(pipeline): measure agent silence and bound a wedged auto-fix agent A pipeline agent invocation that exhausted its budget reported "agent timed out after 30m0s (agent silent for 30m0s)": the configured budget printed twice, with nothing measured, and on the shared agent-run seam the adapter's own error discarded. A wedged agent, a busy one, and a crashed one were therefore indistinguishable, so two real 30-minute timeouts on one task (one at Review, one at the CI fix step) left no evidence to act on. Three defects composed that failure. The claim was fabricated. classifyAgentRun, reviewAgentError, and testAgentError all restated their own budget as if it were an observation. agentActivity now measures the invocation and is the single owner of the evidence: whether output was ever seen, how long ago the last output was, and whether a subprocess launched. The evidence was discarded. For a native agent the adapter error carries the killed process's exit status and its captured stderr, which is the only account of what the process was doing, including an authentication prompt written to stderr that nothing else surfaces. It is now appended to every timeout diagnostic as "agent reported: ...", and testAgentError no longer replaces it with the bare context cause. Progress was unobservable. Adapters forward only assistant prose to OnChunk, and a tool-using turn emits none until the very end (verified against pi 0.84.3, which streams tool_execution_* and toolcall_* with no text_delta), so a healthy fix round looked identical to a wedge. nativeAgentPipe now raises a throttled LifecyclePhaseActivity for every non-empty read of a native subprocess's stdout or stderr. The executor records it as step activity so axi status can see a live agent, and never writes it to the step log. Subprocess start and exit deliberately do not count as output: start proves launch rather than work, and exit is the deadline's own consequence. The CI path also had no bounded outcome. A fix-agent timeout was logged as a warning and the identical request was re-issued on the next poll, up to auto_fix.ci attempts, each costing another full budget invisibly until ci_timeout ended the run hours later. It now parks at an ask-user gate carrying the measured diagnostic and, when the timed-out agent left uncommitted work, the run worktree holding it. The run and its worktree stay alive, so no commits are lost and no second run has to take custody of the branch, and a further attempt is the operator's to spend. Only a proven budget burn parks; other fix failures keep warn-and-retry. Review deliberately still fails the run rather than parking: the Push step commits leftover worktree changes, so an approved park would ship a half-finished, unreviewed fix. No timeout was raised, no retry added, no agent order or model pin touched. * no-mistakes(document): Document native agent timeout outcomes * no-mistakes(ci): Fixed Greptile's retry-lifecycle finding. Retry and unknown lifecycle metadata no longer count as measured agent output, while subprocess byte activity still does. Added a behavioral regression proving retry events remain forwarded but a retry-only invocation is diagnosed as silent. Verified with make lint and race-enabled pipeline and pipeline/steps tests * no-mistakes(review): Keep fallback notices out of agent activity measurements * no-mistakes(review): Measure subprocess silence from latest launch * no-mistakes(review): Redact adapter credentials from timeout findings * no-mistakes(review): Reset activity evidence between agent attempts * no-mistakes(review): Reset activity before fresh fixer sessions * no-mistakes(document): Document per-attempt timeout evidence * no-mistakes(ci): Fixed Greptile's finding by resetting the activity start timestamp at every retry or fallback boundary, preventing earlier attempts from inflating silence duration when the current attempt never launches. Added a behavioral regression covering a delayed failed attempt followed by a silent, never-launched fallback. Verified with make lint, race-enabled pipeline tests, repeated focused regressions, and the executable silent-agent axi e2e test * no-mistakes(review): Reset activity before OpenCode format fallback * no-mistakes(document): Document all fresh-attempt timeout resets | 2 天前 | |
fix(pipeline): make native agent timeouts observable and bounded (#877) * fix(pipeline): measure agent silence and bound a wedged auto-fix agent A pipeline agent invocation that exhausted its budget reported "agent timed out after 30m0s (agent silent for 30m0s)": the configured budget printed twice, with nothing measured, and on the shared agent-run seam the adapter's own error discarded. A wedged agent, a busy one, and a crashed one were therefore indistinguishable, so two real 30-minute timeouts on one task (one at Review, one at the CI fix step) left no evidence to act on. Three defects composed that failure. The claim was fabricated. classifyAgentRun, reviewAgentError, and testAgentError all restated their own budget as if it were an observation. agentActivity now measures the invocation and is the single owner of the evidence: whether output was ever seen, how long ago the last output was, and whether a subprocess launched. The evidence was discarded. For a native agent the adapter error carries the killed process's exit status and its captured stderr, which is the only account of what the process was doing, including an authentication prompt written to stderr that nothing else surfaces. It is now appended to every timeout diagnostic as "agent reported: ...", and testAgentError no longer replaces it with the bare context cause. Progress was unobservable. Adapters forward only assistant prose to OnChunk, and a tool-using turn emits none until the very end (verified against pi 0.84.3, which streams tool_execution_* and toolcall_* with no text_delta), so a healthy fix round looked identical to a wedge. nativeAgentPipe now raises a throttled LifecyclePhaseActivity for every non-empty read of a native subprocess's stdout or stderr. The executor records it as step activity so axi status can see a live agent, and never writes it to the step log. Subprocess start and exit deliberately do not count as output: start proves launch rather than work, and exit is the deadline's own consequence. The CI path also had no bounded outcome. A fix-agent timeout was logged as a warning and the identical request was re-issued on the next poll, up to auto_fix.ci attempts, each costing another full budget invisibly until ci_timeout ended the run hours later. It now parks at an ask-user gate carrying the measured diagnostic and, when the timed-out agent left uncommitted work, the run worktree holding it. The run and its worktree stay alive, so no commits are lost and no second run has to take custody of the branch, and a further attempt is the operator's to spend. Only a proven budget burn parks; other fix failures keep warn-and-retry. Review deliberately still fails the run rather than parking: the Push step commits leftover worktree changes, so an approved park would ship a half-finished, unreviewed fix. No timeout was raised, no retry added, no agent order or model pin touched. * no-mistakes(document): Document native agent timeout outcomes * no-mistakes(ci): Fixed Greptile's retry-lifecycle finding. Retry and unknown lifecycle metadata no longer count as measured agent output, while subprocess byte activity still does. Added a behavioral regression proving retry events remain forwarded but a retry-only invocation is diagnosed as silent. Verified with make lint and race-enabled pipeline and pipeline/steps tests * no-mistakes(review): Keep fallback notices out of agent activity measurements * no-mistakes(review): Measure subprocess silence from latest launch * no-mistakes(review): Redact adapter credentials from timeout findings * no-mistakes(review): Reset activity evidence between agent attempts * no-mistakes(review): Reset activity before fresh fixer sessions * no-mistakes(document): Document per-attempt timeout evidence * no-mistakes(ci): Fixed Greptile's finding by resetting the activity start timestamp at every retry or fallback boundary, preventing earlier attempts from inflating silence duration when the current attempt never launches. Added a behavioral regression covering a delayed failed attempt followed by a silent, never-launched fallback. Verified with make lint, race-enabled pipeline tests, repeated focused regressions, and the executable silent-agent axi e2e test * no-mistakes(review): Reset activity before OpenCode format fallback * no-mistakes(document): Document all fresh-attempt timeout resets | 2 天前 | |
feat(agent): add native Grok Build support * feat: add native Grok agent support * no-mistakes(review): Preserve Grok invocation environment * no-mistakes(document): Clarify Grok’s pipeline-only skill role * docs: complete native Grok ExecPlan * no-mistakes(document): Clarify Grok opt-out documentation * no-mistakes: apply CI fixes --------- Co-authored-by: Boris <boriza@users.noreply.github.com> | 9 天前 | |
fix(cli): scope AXI run resolution to the current branch (#850) * fix(axi): scope status and logs run resolution to the caller's branch `axi status` could report another branch's run as though it were this worktree's, with nothing in the output marking it as unrelated. Several worktrees of one clone, each on its own branch, all read back the same foreign terminal run; a supervising agent judging validation by that read concludes the work failed while its real pipeline is still in flight. Cause, established in `resolveRun` (internal/cli/axi_query.go): the branch-scoped lookup had no terminating branch, so when the caller's branch had no run the function fell through to a repo-wide lookup and returned the repository's active-or-most-recent run on any branch. `runAxiStatus` then rendered it under the same `run:` key a run of the caller's own gets. The active path was never wrong - a branch with its own active run always resolved it - which is why two worktrees reported correctly and the rest did not. - resolveRun stops at the caller's branch: its active run, else its most recent one, else no run. A detached HEAD owns no branch and so resolves nothing rather than guessing. - `axi status` with no run for the branch reports `current_branch`, `runs_on_current_branch: 0`, and the recent-runs table, so a deliberate `--run <id>` inspection stays one step away. - `--run <id>` still renders any run in full, but under `other_branch_run:` with a top-level `current_branch:` when that run's branch differs from the caller's - reusing the home view's `other_branch_active_run` vocabulary, so a consumer keyed on `run:` can never pick up a foreign run. - `axi logs` shares the resolution and is fixed with it; its no-run error now points at `--run <id>`. * no-mistakes(review): Share AXI run snapshot during no-run rendering * no-mistakes(review): Surface branch lookup failures and clarify run selection * no-mistakes(review): Correct detached-HEAD AXI help guidance * no-mistakes(review): Qualify no-run guidance for successful status responses * no-mistakes(review): Preserve explicit AXI run identity and safe guidance * no-mistakes(review): Guard explicit-run gates with proven branch ownership * no-mistakes(document): Clarify branch-scoped AXI documentation * no-mistakes(document): Clarify branch-scoped AXI reporting contracts * no-mistakes: apply CI fixes * chore: ignore the CI-repair agent's in-worktree scratch HOME The CI-repair agent reproduces a failing check locally by pointing HOME at a directory inside the run worktree. That directory fills with Go module and macOS Library caches, and commitRepair stages with `git add -A` (internal/pipeline/steps/ci_fix.go), so the caches were committed onto the branch and pushed to the pull request. | 3 天前 | |
fix(cli): scope AXI run resolution to the current branch (#850) * fix(axi): scope status and logs run resolution to the caller's branch `axi status` could report another branch's run as though it were this worktree's, with nothing in the output marking it as unrelated. Several worktrees of one clone, each on its own branch, all read back the same foreign terminal run; a supervising agent judging validation by that read concludes the work failed while its real pipeline is still in flight. Cause, established in `resolveRun` (internal/cli/axi_query.go): the branch-scoped lookup had no terminating branch, so when the caller's branch had no run the function fell through to a repo-wide lookup and returned the repository's active-or-most-recent run on any branch. `runAxiStatus` then rendered it under the same `run:` key a run of the caller's own gets. The active path was never wrong - a branch with its own active run always resolved it - which is why two worktrees reported correctly and the rest did not. - resolveRun stops at the caller's branch: its active run, else its most recent one, else no run. A detached HEAD owns no branch and so resolves nothing rather than guessing. - `axi status` with no run for the branch reports `current_branch`, `runs_on_current_branch: 0`, and the recent-runs table, so a deliberate `--run <id>` inspection stays one step away. - `--run <id>` still renders any run in full, but under `other_branch_run:` with a top-level `current_branch:` when that run's branch differs from the caller's - reusing the home view's `other_branch_active_run` vocabulary, so a consumer keyed on `run:` can never pick up a foreign run. - `axi logs` shares the resolution and is fixed with it; its no-run error now points at `--run <id>`. * no-mistakes(review): Share AXI run snapshot during no-run rendering * no-mistakes(review): Surface branch lookup failures and clarify run selection * no-mistakes(review): Correct detached-HEAD AXI help guidance * no-mistakes(review): Qualify no-run guidance for successful status responses * no-mistakes(review): Preserve explicit AXI run identity and safe guidance * no-mistakes(review): Guard explicit-run gates with proven branch ownership * no-mistakes(document): Clarify branch-scoped AXI documentation * no-mistakes(document): Clarify branch-scoped AXI reporting contracts * no-mistakes: apply CI fixes * chore: ignore the CI-repair agent's in-worktree scratch HOME The CI-repair agent reproduces a failing check locally by pointing HOME at a directory inside the run worktree. That directory fills with Go module and macOS Library caches, and commitRepair stages with `git add -A` (internal/pipeline/steps/ci_fix.go), so the caches were committed onto the branch and pushed to the pull request. | 3 天前 | |
fix(daemon): move test evidence out of system temp storage (#735) * fix(daemon): keep run evidence off shared /tmp and reap it ourselves The test step wrote evidence to os.TempDir()/no-mistakes-evidence. The daemon's service unit exports only HOME, PATH, and proxy variables, so TMPDIR is unset and that resolved to the shared /tmp - which Ubuntu has mounted as a systemd tmpfs since 24.10, putting every screenshot and rendered-HTML artifact in RAM. Nothing in this program ever removed it, either. The directory was a fixed name that accumulated one subdirectory per run, cleaned only by an OS timer we do not control and that has no equivalent on Windows. On one developer machine that was 876 run directories over ten days, 823 of them empty: the test step creates the directory before the agent decides whether it has anything to write. Evidence now lives at <NM_HOME>/evidence/<runID>, owned by internal/paths like every other location. The app root is disk backed on macOS, Linux, and Windows alike, so there is no runtime.GOOS branch and the macOS path is not regressed - it improves, since /var/folders is periodically purged and that silently broke the local artifact paths older PR bodies fall back to. Cleanup is now ours, in three layers: a finished run's empty directory is removed at run cleanup, a reaper bounds the directory by age and count oldest-first after every run and at daemon startup, and the pre-relocation temp directory is drained under the same policy. All three reuse the existing pending/running guard, so a run still in flight is never touched. test.evidence gains local_root, retention, and max_runs. They are global-only: a repository does not get to name a filesystem path this machine's daemon writes to, nor set the retention budget for a directory every repository on the machine shares. There is deliberately no environment variable - the service unit preserves only proxy keys, so an env-gated value would be dropped on the next update. Also removes the second, independent copy of the evidence path in the agent steering preamble, which rebuilt it from os.TempDir() on its own. The executor now resolves the path once and both consumers read it. * no-mistakes(review): Protect unowned directories from evidence reaping * no-mistakes(document): Clarify managed evidence storage scope * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * fix(daemon): clean run evidence at the recovered-run completion boundary Evidence ownership claims cleanup runs after each run, but only the fresh-run defer called cleanupRunEvidence. A run parked at an approval gate when the daemon stopped is finished by resumeRecoveredRun, which has its own completion defer, so a resumed run kept its empty evidence directory until some later run or a restart happened to sweep it. There are exactly two completion boundaries and both are now covered. The regression test drives resumeRecoveredRun and asserts the directory is gone afterwards; every outcome of a resumed run shares that defer, so the boundary is the thing worth asserting on. * ci: give the test job a budget the Windows leg actually fits in The Windows leg was cancelled at timeout-minutes twice in a row with no verdict, on a suite where every package that reported had passed. It is process-spawn bound rather than compute bound, so it compiles every test binary and then runs the git-backed packages at roughly 10x their Linux cost, and 25 minutes no longer covered that. An evidence-free cancellation is worse than a slow job: it is reported as a check failure and reads as a defect in the change under test, which is exactly how it was read here. The cap stays a runaway guard rather than a target. Linux and macOS finish far inside it, 40 minutes still keeps a wedged runner well short of the six-hour default, and go test -timeout is deliberately unchanged so a genuine hang still produces a goroutine dump first. This does not close the coherence gap behind it: -timeout bounds each test binary while timeout-minutes bounds the whole job including compile, so total wall can still exceed the cap with no binary reaching its own deadline. Bounding per-job wall properly is follow-up work. * chore: pin review auto-fix to the product default in this repo The code default for auto_fix.review is 0 so review findings park for a human decision, but this repo carried no auto_fix block and therefore inherited whatever an operator set globally. With it enabled, a one-line CI timeout change drew a speculative review finding that the auto-fixer answered with a new DB table, a schema migration, and a new package, then spent three rounds finding errors in its own invention. None of it was asked for, and a parked finding would have surfaced the question instead of quietly answering it. Only review is pinned. The deterministic steps keep whatever the operator configured, because a lint or test finding has an objective checker and does not need a human to decide whether the fix belongs. * no-mistakes(review): Reject evidence roots inside managed worktrees * no-mistakes(document): Clarify evidence storage constraints | 15 天前 | |
chore(main): release 1.60.0 (#875) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | 2 天前 | |
chore: backpass extracting memory to skills | 1 天前 | |
chore(main): release 1.60.0 (#875) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> | 2 天前 | |
chore(agents): use @AGENTS.md import instead of CLAUDE.md symlink (#758) Co-authored-by: Kun Chen <kun-1@kunchenguid.com> | 13 天前 | |
ci: migrate PR gate to shared action (#821) * ci: flip this repo's own gate to the shared require-no-mistakes action The composite action added in #819 was published but nothing called it - this repository kept running the inline copy it was extracted from. The gate is now a thin caller pinned to 32d396ac0f29135daf7fcb9964aba9d5f4e796d6, the commit that first carried the action. Pinning an already-published commit is the self-certification guard: a PR that edits the action is still fully tested on its own head (the Go tests execute the working-tree verify.py), while the required check judging that PR keeps running the released copy, so a change can never rewrite its own judge. Everything the caller owns is preserved byte-for-byte: the job name "PR must be raised via no-mistakes", the run-name and concurrency identity, the body-bearing-events-only trigger set, the read-only fork boundary, and the release automation exemptions. Those exemptions stay in the job-level `if:` rather than moving to the action's exempt-authors input, because an in-job exemption still needs the run to start and a GITHUB_TOKEN PR's run is created in action_required and never starts. workflow_no_mistakes_required_test.go now owns the CALLER - immutable 40-hex pin, single delegating step, exemptions, triggers, concurrency identity, fork boundary - and drives the real action through a workflow event payload, which is the only thing that proves the input-free wiring reaches a verdict. Per-verdict coverage stays in require_no_mistakes_action_test.go against the same interpreter rather than being duplicated. prsummary_test.go's generator/gate sync check follows the signature marker into verify.py. * no-mistakes(review): Fix workflow pin metadata and exemption coverage * no-mistakes(review): Correct action pin provenance wording * no-mistakes(review): Correct remaining action pin provenance comment * no-mistakes(review): Exercise composite action through caller tests * no-mistakes(review): Enforce exact shared action pin * no-mistakes(document): Update shared action migration documentation | 7 天前 | |
Initial commit | 4 个月前 | |
test(e2e): add antigravity fixture recording and replay coverage (#809) * test(agent): cover antigravity in fakeagent and the e2e user journey * no-mistakes(document): Add antigravity to agent lists, doctor example, and fakeagent doc comment * no-mistakes(document): Add antigravity to agent Values and auto resolution order in docs * feat(recordfixture): capture antigravity fixtures via the owned e2e-record workflow * no-mistakes(review): Assert Antigravity recorder argv forwarding; focused tests pass * fix(recordfixture): stage agy captures atomically and contain the process tree * no-mistakes(review): Test plain fixture replay path by splitting TestRunAgyReplaysRecordedFixture into structured/plain subtests * no-mistakes(review): Validate Antigravity captures and replay configured fixtures reliably * no-mistakes(document): Document Antigravity capture and replay behavior * no-mistakes: apply CI fixes * fix(recordfixture): expect cmd-exe quote escaping in agy argv test; dedupe antigravity docs The windows-core run at 0ba9bd95 failed TestCaptureAgyPlacesForwardedFlagsBeforePromptAndSchemaLast because the fake .cmd agent records Go's literal backslash-quote escaping: cmd.exe %~1 expansion does not undo it, while real agy parses argv with CommandLineToArgvW and sees the unescaped JSON. Assert the escaped schema arg on Windows with a comment explaining the harness-only artifact. After rebasing onto main (#812), agents.md carried two Antigravity adapter sections and two supported-agents table rows. Keep one of each, reflecting final capabilities: session resume via --conversation and terminal-authoritative result precedence (structured_output > result.response > stream deltas). * fix(recordfixture): reject any non-SUCCESS agy result during capture validation validateAgyCapture only inspected the final result status, so a capture containing an ERROR result followed by SUCCESS validated even though the production replay parser treats any ERROR result as fatal. Fail fast on the first non-SUCCESS result and require at least one result event. | 8 天前 | |
test(e2e): add antigravity fixture recording and replay coverage (#809) * test(agent): cover antigravity in fakeagent and the e2e user journey * no-mistakes(document): Add antigravity to agent lists, doctor example, and fakeagent doc comment * no-mistakes(document): Add antigravity to agent Values and auto resolution order in docs * feat(recordfixture): capture antigravity fixtures via the owned e2e-record workflow * no-mistakes(review): Assert Antigravity recorder argv forwarding; focused tests pass * fix(recordfixture): stage agy captures atomically and contain the process tree * no-mistakes(review): Test plain fixture replay path by splitting TestRunAgyReplaysRecordedFixture into structured/plain subtests * no-mistakes(review): Validate Antigravity captures and replay configured fixtures reliably * no-mistakes(document): Document Antigravity capture and replay behavior * no-mistakes: apply CI fixes * fix(recordfixture): expect cmd-exe quote escaping in agy argv test; dedupe antigravity docs The windows-core run at 0ba9bd95 failed TestCaptureAgyPlacesForwardedFlagsBeforePromptAndSchemaLast because the fake .cmd agent records Go's literal backslash-quote escaping: cmd.exe %~1 expansion does not undo it, while real agy parses argv with CommandLineToArgvW and sees the unescaped JSON. Assert the escaped schema arg on Windows with a comment explaining the harness-only artifact. After rebasing onto main (#812), agents.md carried two Antigravity adapter sections and two supported-agents table rows. Keep one of each, reflecting final capabilities: session resume via --conversation and terminal-authoritative result precedence (structured_output > result.response > stream deltas). * fix(recordfixture): reject any non-SUCCESS agy result during capture validation validateAgyCapture only inspected the final result status, so a capture containing an ERROR result followed by SUCCESS validated even though the production replay parser treats any ERROR result as fatal. Fail fast on the first non-SUCCESS result and require at least one result event. | 8 天前 | |
test(e2e): add antigravity fixture recording and replay coverage (#809) * test(agent): cover antigravity in fakeagent and the e2e user journey * no-mistakes(document): Add antigravity to agent lists, doctor example, and fakeagent doc comment * no-mistakes(document): Add antigravity to agent Values and auto resolution order in docs * feat(recordfixture): capture antigravity fixtures via the owned e2e-record workflow * no-mistakes(review): Assert Antigravity recorder argv forwarding; focused tests pass * fix(recordfixture): stage agy captures atomically and contain the process tree * no-mistakes(review): Test plain fixture replay path by splitting TestRunAgyReplaysRecordedFixture into structured/plain subtests * no-mistakes(review): Validate Antigravity captures and replay configured fixtures reliably * no-mistakes(document): Document Antigravity capture and replay behavior * no-mistakes: apply CI fixes * fix(recordfixture): expect cmd-exe quote escaping in agy argv test; dedupe antigravity docs The windows-core run at 0ba9bd95 failed TestCaptureAgyPlacesForwardedFlagsBeforePromptAndSchemaLast because the fake .cmd agent records Go's literal backslash-quote escaping: cmd.exe %~1 expansion does not undo it, while real agy parses argv with CommandLineToArgvW and sees the unescaped JSON. Assert the escaped schema arg on Windows with a comment explaining the harness-only artifact. After rebasing onto main (#812), agents.md carried two Antigravity adapter sections and two supported-agents table rows. Keep one of each, reflecting final capabilities: session resume via --conversation and terminal-authoritative result precedence (structured_output > result.response > stream deltas). * fix(recordfixture): reject any non-SUCCESS agy result during capture validation validateAgyCapture only inspected the final result status, so a capture containing an ERROR result followed by SUCCESS validated even though the production replay parser treats any ERROR result as fatal. Fail fast on the first non-SUCCESS result and require at least one result event. | 8 天前 | |
feat: add shared no-mistakes PR enforcement action (#819) * ci: add shared require-no-mistakes composite action The `PR must be raised via no-mistakes` enforcement shell is copied inline across ~15 repositories, and the copies drifted: several never gained the head_sha bind, so a compliant PR could be pushed to afterwards and the stale attestation still passed. Extract the known-good enforcement (PR #797) into one composite action at .github/actions/require-no-mistakes so every repository becomes a thin caller. It verifies the signature line, parses the v1 pipeline-step attestation, binds it to the PR head SHA, and requires review, test, and document to be completed, keeping the >= 1.46.0 and not-raised-via-no-mistakes error copy verbatim. Per-repo configuration is exemptions only (exempt-authors, exempt-bot-authors, exempt-head-branches); which steps are required is deliberately not an input, so a caller cannot weaken the gate while still reporting the same check name. An ordinary pull_request caller forwards nothing: the action reads the PR facts from the event payload. require_no_mistakes_action_test.go executes the action's real entrypoint the way a runner does and covers every verdict, the exemption surface, and the event-payload binding. FOLLOW-UP (do not lose this): this repository's own gate, .github/workflows/no-mistakes-required.yml, is deliberately UNTOUCHED here. GitHub downloads `uses:` actions at job setup, so pinning the gate to a release tag that predates this action would fail the check closed on this PR and every PR until such a release exists. Once a release is cut that CONTAINS this action, a one-file follow-up PR flips that gate to kunchenguid/no-mistakes/.github/actions/require-no-mistakes@<that tag>, which is the self-certification guard: a PR editing the action is then judged by the last released copy, never its own. Migrating the other ~15 repositories to the shared action is separate follow-up work and is not done here. * no-mistakes(document): Clarify shared action rollout documentation * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * no-mistakes: apply CI fixes * docs(ci): state the require-no-mistakes trust boundary as an explicit non-goal Greptile flagged that a hand-written PR body reproducing the documented attestation format passes the gate. That is real, but pre-existing: it is inherited verbatim from the inline gate this action consolidates, so the shared action neither introduces nor widens it. Record the accepted decision where a reader meets it. The action README gains a "Non-goal" subsection and verify.py's module docstring gains a matching NON-GOAL paragraph, both naming the gate a contributor guardrail rather than a forgery-proof security boundary, and both pointing at signed attestations (backlog nm-signed-attestations-r1) as the robust fix that is out of scope here. Documentation only; no behavior change. * no-mistakes(document): Clarify shared action rollout status * no-mistakes: apply CI fixes | 7 天前 | |
fix(pipeline): generate MP4 demos and gate review fixes (#91) * fix(mp4): generate demo.mp4 and require approval for review findings * no-mistakes(document): update README demo output docs | 4 个月前 | |
fix(pipeline): generate MP4 demos and gate review fixes (#91) * fix(mp4): generate demo.mp4 and require approval for review findings * no-mistakes(document): update README demo output docs | 4 个月前 | |
fix(pipeline): generate MP4 demos and gate review fixes (#91) * fix(mp4): generate demo.mp4 and require approval for review findings * no-mistakes(document): update README demo output docs | 4 个月前 | |
fix(pipeline): keep local Test validation targeted (#540) * fix(pipeline): make local Test targeted validation, not full-suite CI Local Test (normal evidence agent and Test-repair) must select the smallest relevant checks and end-user-aligned evidence for the requested intent, and is explicitly forbidden from running a complete repository suite. Repair mode reproduces the specific failure and re-verifies only with focused checks; a generic driver full-suite instruction does not override that product boundary. Remove this repo's broad go test -race ./... commands.test dogfood override so later runs stop paying for local complete-suite walks. Keep the race-enabled full suite in remote CI as the mandatory broad-regression owner. Document the commands.test contract as targeted validation without shell heuristics. * no-mistakes(document): Document targeted local Test contract | 1 个月前 | |
feat(cli): add AXI agent command surface (#241) * feat(cli): add agent-facing AXI commands * no-mistakes(review): Fix branch-scoped AXI run handling * no-mistakes(review): Handle AXI preflight status failures * no-mistakes(review): Fix AXI rerun validation scoping * no-mistakes(review): Fix AXI branch-scoped run resolution * no-mistakes(document): Sync docs with AXI agent flow | 2 个月前 | |
feat(cli): add AXI agent command surface (#241) * feat(cli): add agent-facing AXI commands * no-mistakes(review): Fix branch-scoped AXI run handling * no-mistakes(review): Handle AXI preflight status failures * no-mistakes(review): Fix AXI rerun validation scoping * no-mistakes(review): Fix AXI branch-scoped run resolution * no-mistakes(document): Sync docs with AXI agent flow | 2 个月前 | |
feat(cli): add daemon restart command (#102) * feat(cli): add daemon restart command and use it on install * no-mistakes(review): fix daemon restart failure handling * no-mistakes(review): fix daemon restart recovery * no-mistakes(document): document daemon restart behavior * no-mistakes(lint): {"summary":"Format daemon command test"} | 4 个月前 | |
fix(telemetry): use self-hosted Umami defaults (#157) * fix(telemetry): use self-hosted Umami config * no-mistakes(document): Update telemetry documentation defaults * no-mistakes(document): Clarify telemetry website ID default | 4 个月前 | |
ci: force release-please tag creation (#126) * ci: force release-please tag creation * no-mistakes: apply agent fixes | 4 个月前 | |
ci: migrate PR gate to shared action (#821) * ci: flip this repo's own gate to the shared require-no-mistakes action The composite action added in #819 was published but nothing called it - this repository kept running the inline copy it was extracted from. The gate is now a thin caller pinned to 32d396ac0f29135daf7fcb9964aba9d5f4e796d6, the commit that first carried the action. Pinning an already-published commit is the self-certification guard: a PR that edits the action is still fully tested on its own head (the Go tests execute the working-tree verify.py), while the required check judging that PR keeps running the released copy, so a change can never rewrite its own judge. Everything the caller owns is preserved byte-for-byte: the job name "PR must be raised via no-mistakes", the run-name and concurrency identity, the body-bearing-events-only trigger set, the read-only fork boundary, and the release automation exemptions. Those exemptions stay in the job-level `if:` rather than moving to the action's exempt-authors input, because an in-job exemption still needs the run to start and a GITHUB_TOKEN PR's run is created in action_required and never starts. workflow_no_mistakes_required_test.go now owns the CALLER - immutable 40-hex pin, single delegating step, exemptions, triggers, concurrency identity, fork boundary - and drives the real action through a workflow event payload, which is the only thing that proves the input-free wiring reaches a verdict. Per-verdict coverage stays in require_no_mistakes_action_test.go against the same interpreter rather than being duplicated. prsummary_test.go's generator/gate sync check follows the signature marker into verify.py. * no-mistakes(review): Fix workflow pin metadata and exemption coverage * no-mistakes(review): Correct action pin provenance wording * no-mistakes(review): Correct remaining action pin provenance comment * no-mistakes(review): Exercise composite action through caller tests * no-mistakes(review): Enforce exact shared action pin * no-mistakes(document): Update shared action migration documentation | 7 天前 | |
ci: simplify release workflow and restore macOS coverage (#147) * ci: drop check and test jobs from release workflow * no-mistakes(review): Restore macOS CI coverage * no-mistakes: apply agent fixes | 4 个月前 | |
ci: split the Windows test leg and re-fix two CI flakes (#738) A single Windows ./... job could exceed timeout-minutes without any binary hitting go test -timeout. Split git-heavy packages from the remainder, replace the bash SIGTERM trap that macOS still raced, and cancel parked executor tests so Windows can unlink lint.log. | 15 天前 | |
docs: add documentation site and publishing workflow (#36) * feat(docs): add documentation site * no-mistakes(review): harden docs build and Astro version * no-mistakes(review): harden docs Pages deployment workflow * no-mistakes(review): align docs with canonical config keys * no-mistakes(review): fix docs accuracy for config and platform notes * no-mistakes(review): fix docs workflow and CI naming * no-mistakes(review): Scope docs workflow concurrency group * no-mistakes(document): Updated `README.md` to reflect the new documentation site introduced by this change and to document the new `make docs` and `make docs-preview` targets added to the Makefile. * no-mistakes: apply babysit fixes | 4 个月前 | |
ci(workflows): add required checks and generated file guards (#125) | 4 个月前 | |
ci: migrate PR gate to shared action (#821) * ci: flip this repo's own gate to the shared require-no-mistakes action The composite action added in #819 was published but nothing called it - this repository kept running the inline copy it was extracted from. The gate is now a thin caller pinned to 32d396ac0f29135daf7fcb9964aba9d5f4e796d6, the commit that first carried the action. Pinning an already-published commit is the self-certification guard: a PR that edits the action is still fully tested on its own head (the Go tests execute the working-tree verify.py), while the required check judging that PR keeps running the released copy, so a change can never rewrite its own judge. Everything the caller owns is preserved byte-for-byte: the job name "PR must be raised via no-mistakes", the run-name and concurrency identity, the body-bearing-events-only trigger set, the read-only fork boundary, and the release automation exemptions. Those exemptions stay in the job-level `if:` rather than moving to the action's exempt-authors input, because an in-job exemption still needs the run to start and a GITHUB_TOKEN PR's run is created in action_required and never starts. workflow_no_mistakes_required_test.go now owns the CALLER - immutable 40-hex pin, single delegating step, exemptions, triggers, concurrency identity, fork boundary - and drives the real action through a workflow event payload, which is the only thing that proves the input-free wiring reaches a verdict. Per-verdict coverage stays in require_no_mistakes_action_test.go against the same interpreter rather than being duplicated. prsummary_test.go's generator/gate sync check follows the signature marker into verify.py. * no-mistakes(review): Fix workflow pin metadata and exemption coverage * no-mistakes(review): Correct action pin provenance wording * no-mistakes(review): Correct remaining action pin provenance comment * no-mistakes(review): Exercise composite action through caller tests * no-mistakes(review): Enforce exact shared action pin * no-mistakes(document): Update shared action migration documentation | 7 天前 | |
chore(ci): skip pull_request runs for release-please output-only PRs (#617) Exclude the exact release-please output set from every pull_request trigger so GITHUB_TOKEN release PRs create zero workflow runs instead of pending action_required checks. Keep bot job ifs as defense in depth and pin the filter with a config-derived drift test. | 29 天前 | |
ci: prevent Windows test job timeouts (#645) * perf(ci): keep the Windows test job well inside its timeout The windows-latest test job repeatedly overran timeout-minutes and was cancelled (twice on PR #636). It is not a hang: no test exceeds ~32s, the per-binary `go test -timeout=15m` never fired, and every package that completed reported a normal duration. The job is process-spawn bound. Git-backed packages cost roughly 10x their Linux time on the Windows runner (internal/git 5.7s -> 53s, internal/branchsync 31s -> 415s) because Defender scans every git.exe spawn and every file the temp repos create, and internal/branchsync ran all 52 tests serially, making it the job's 7-minute wall floor. Observed windows job runtimes over 20 recent runs: 10.7-25.3m against a 25m cap, median ~14m. Excludes the ephemeral build and test trees this job creates from Defender scanning, and takes internal/branchsync off the serial critical path with t.Parallel. Locally the package drops from 49.5s to 19.5s with -race clean over repeated runs; no coverage is skipped or weakened. * no-mistakes(review): Harden Windows workflow contract tests * no-mistakes(document): Windows CI documentation already accurate * no-mistakes: apply CI fixes | 27 天前 | |
fix(telemetry): use self-hosted Umami defaults (#157) * fix(telemetry): use self-hosted Umami config * no-mistakes(document): Update telemetry documentation defaults * no-mistakes(document): Clarify telemetry website ID default | 4 个月前 |
git push no-mistakes
干掉所有 slop,开出干净的 PR。
English · 简体中文
no-mistakes 在你真实的远端前面放了一个本地 git 代理。
把分支推给 no-mistakes 而不是 origin,它会拉起一个用完即弃的 worktree,跑一条 AI 驱动的校验流水线,只有每一项检查都通过后才把分支转发到配置的推送目标,并自动开出一个干净的 PR。
- 不阻塞 —— 流水线在隔离的 worktree 里跑,不打断你手头的工作。
- 不挑 agent —— 支持
claude、codex、grok、rovodev、opencode、pi、copilot、antigravity,也可通过acpx使用cursor/acp:<target>,并支持有序 fallback。 - agent 原生 ——
/no-mistakes既能让编码 agent 完成一个任务再过网关,也能直接为已提交的工作过网关:它跑完流水线、让流水线应用安全的修复,剩下的升级给你。 - 人始终说了算 —— 自动修复,还是逐条审查 findings,你决定。
- 默认就是干净 PR —— 推送、开 PR、盯 CI、自动修复失败,一气呵成。
完整文档:https://kunchenguid.github.io/no-mistakes/
工作原理
你的分支
│ git push no-mistakes
▼
┌───────────────────────────────────────────────┐
│ 用完即弃的 worktree —— 你的工作原地不动 │
│ review → test → docs → lint → push → PR → CI │
└───────────────────────────────────────────────┘
│ 每项检查变绿
▼
干净的 PR,已替你开好
每一步要么自己通过,要么停下来给你一条 finding 让你处理。 安全、机械性的修复会自动应用;任何牵涉到你意图的,都会升级给你来 approve(批准)、fix(修复) 或 skip(跳过)。 在每项检查都变绿之前,没有任何东西会到达配置的推送目标。
安装
curl -fsSL https://raw.githubusercontent.com/kunchenguid/no-mistakes/main/docs/install.sh | sh
Windows、Go install 以及从源码构建的说明,见安装指南。
快速上手
$ no-mistakes init
✓ Gate initialized
repo /Users/you/src/my-repo
gate no-mistakes → /Users/you/.no-mistakes/repos/abc123def456.git
remote git@github.com:you/my-repo.git
skill /no-mistakes installed for agents at user level
Push through the gate with:
git push no-mistakes <branch>
$ git checkout my-branch
# 在分支里干点活……
$ git push no-mistakes
* Pipeline started
Run no-mistakes to review.
$ no-mistakes
# 打开当前运行的 TUI
如果是 GitHub fork 贡献,让 origin 指向父仓库,并用 no-mistakes init --fork-url <your-fork-url> 初始化。
在 TUI 里你逐条处理 finding:auto-fix 类自动替你应用(或由你 approve 放行),ask-user 类需要你判断,由你 approve、fix 或 skip。
每项检查变绿后,网关会把你的分支转发到配置的推送目标并替你开好 PR,不用手动 git push origin,也不用手写 PR 正文。
想让编码 agent 无人值守地走完同一套流程?
用 /no-mistakes(见下文)。
触发网关的三种方式
每一处改动都走同一条流水线。改动就绪时,挑一个最贴合你当下工作方式的入口:
git push no-mistakes—— 显式的 Git 路径。把已提交的分支推给网关 remote,而不是origin。no-mistakes—— TUI。改完之后运行它(无需先提交),向导会带你建分支、提交、推过网关,然后挂到这次运行上。no-mistakes -y会把这一切自动做完。/no-mistakes—— agent skill。用/no-mistakes <task>让编码 agent 完成一个任务再过网关,或用裸/no-mistakes为已提交的工作过网关。它跑完流水线、让流水线应用安全的修复,并在任何需要人来拍板的地方停下来问你。
no-mistakes init 会为 Claude Code 及其他 agent 安装 /no-mistakes skill。底层上这个 skill 驱动的是 no-mistakes axi —— 同一套审批流程的非交互式 TOON 接口。
完整的首次运行走查见快速上手。
开发
make build # 构建 bin/no-mistakes(带版本信息)
make test # 运行 go test -race ./...(不含 e2e 套件)
make e2e # 运行打了标签的端到端 agent 旅程套件
make e2e-record # agent 线格式变化时,重新录制 e2e fixtures
make lint # 检查生成的 skill 是否漂移,并跑 go vet ./...
make skill # 重新生成已提交的 no-mistakes skill 文件
make fmt # 运行 gofmt -w .
make demo # 重新生成 demo.gif 和 demo.mp4(需要 vhs 和 ffmpeg)
make docs # 在 docs/dist 构建 Astro 文档站
完整 target 列表见 Makefile。
make e2e-record 会用真实的 claude、codex、opencode 和 antigravity CLI 覆盖 internal/e2e/fixtures/,会消耗真实 API 额度,提交前应当审查。