Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions openspec/changes/add-vale-rule-engine/tasks.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,9 +13,9 @@

## 2. Check orchestration

- [ ] 2.1 Dispatch to distinct executors by engine directory — ast-grep (`sg/`) → scanner, Vale (`vale/`) → runner, runtime (`runtime/rules/`) → harness
- [ ] 2.2 Run engines concurrently, merge `CheckResult`s into one set, derive the exit code from merged severities, and keep an unavailable engine from aborting the others
- [ ] 2.3 Tests: a mixed `sg`+`vale`+`runtime` corpus runs all executors and merges; with the `vale` binary absent, ast-grep results still return
- [x] 2.1 Dispatch to distinct executors by engine directory — ast-grep (`sg/`) → scanner, Vale (`vale/`) → runner, runtime (`runtime/rules/`) → harness
- [x] 2.2 Run engines concurrently, merge `CheckResult`s into one set, derive the exit code from merged severities, and keep an unavailable engine from aborting the others
- [x] 2.3 Tests: a mixed `sg`+`vale`+`runtime` corpus runs all executors and merges; with the `vale` binary absent, ast-grep results still return

## 3. Engine-selection knowledge topic

Expand Down
84 changes: 47 additions & 37 deletions packages/cli/src/commands/check.ts
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,11 @@ import { resolve, join, isAbsolute, relative } from "node:path";
import { stat } from "node:fs/promises";
import { defineCommand } from "citty";

import { runAstGrepScan } from "../rules/scan";
import type { CheckResult } from "../types/check";
import { hasValeRules, runEngines } from "../rules/dispatch";
import { formatText } from "../util/format";
import { resolveSgConfigPath } from "../filesystem/sgconfig";
import { ensureTasklessDirectory } from "../filesystem/directory";
import {
dedupeFindings,
discoverAstGrepRuleSources,
planEngineDispatch,
} from "../rules/engines";
Expand All @@ -30,7 +28,6 @@ import {
selectBlessedRuntimeRules,
signRuntimeChecks,
} from "../rules/runtime/run-set";
import { executeRuntimeRules } from "../rules/runtime/harness";

async function pathExists(absolutePath: string): Promise<boolean> {
try {
Expand Down Expand Up @@ -316,7 +313,7 @@ export const checkCommand = defineCommand({
}

// Rules dispatch by the engine directory that contains them. This is also
// the migration trigger: no config is generated on the check path any
// the migration trigger: no config is generated on the check path any
// more, so without this call an upgraded CLI would keep reading a stale
// layout.
//
Expand All @@ -330,9 +327,11 @@ export const checkCommand = defineCommand({
const dispatch = await planEngineDispatch(cwd);

// Static rules (trusted ast-grep YAML) always run; runtime rules
// (untrusted check.ts) are gated separately. An engine directory this CLI
// has no executor for (vale) contributes nothing, and a directory that is
// not a known engine is ignored rather than handed to someone's parser.
// (untrusted check.ts) are gated separately. Vale is discovered below,
// in the "anything to run?" gate — every known engine now has an
// executor, so none of them can be assumed to contribute nothing. A
// directory that is not a known engine is still ignored rather than
// handed to someone's parser.
const astGrepSources = await discoverAstGrepRuleSources(cwd);
// Both halves matter: `executor` alone is read from the static layout
// table and is therefore always `runtime-harness`, so gating on it only
Expand All @@ -347,7 +346,18 @@ export const checkCommand = defineCommand({
? await discoverRuntimeRules(cwd)
: [];

if (astGrepSources.length === 0 && runtimeRules.length === 0) {
// "No rules configured" has to mean *no engine* has any, not just these
// two: a project whose only rules live in `.taskless/vale/rules/` would
// otherwise return here and Vale would never be dispatched, which is a
// silent skip of the engine the user actually configured. Asked last and
// short-circuited, so the ordinary project with ast-grep or runtime rules
// pays nothing and `runEngines` still owns the decision to spawn Vale.
const noRuleFiles =
astGrepSources.length === 0 &&
runtimeRules.length === 0 &&
!(await hasValeRules(cwd));

if (noRuleFiles) {
if (args.json) {
console.log(
JSON.stringify(
Expand All @@ -363,22 +373,9 @@ export const checkCommand = defineCommand({
}

try {
const results: CheckResult[] = [];

// Static rules: always scan, no verification (inert data). Each
// ast-grep source is scanned on its own — `sg/rules/` and, for an
// unmigrated checkout, the legacy `.taskless/rules/` — and identical
// findings from both are collapsed so a rule present in both layouts
// is reported once.
const staticResults: CheckResult[] = [];
for (const source of astGrepSources) {
const configPath = await resolveSgConfigPath(cwd, source);
const scan = await runAstGrepScan(cwd, existingPaths, { configPath });
staticResults.push(...scan.results);
}
results.push(...dedupeFindings(staticResults));

// Runtime rules: run only what the server validated (or forced).
// Runtime rules are planned before dispatch, not during it: planning
// consults auth and reconcile state, which is a decision about *what*
// may run rather than part of running it.
const plan = await planRuntime(cwd, runtimeRules, {
anonymous: args.anonymous,
dangerouslyRunScripts: Boolean(args["dangerously-run-scripts"]),
Expand All @@ -389,26 +386,40 @@ export const checkCommand = defineCommand({
`Notice: runtime rule ${skipped.rule} was not run — ${skipped.reason}.`
);
}
if (plan.execute.length > 0) {
const runtimeResults = await executeRuntimeRules(cwd, plan.execute, {
paths: existingPaths,
timeoutMs: parseTimeoutMs(args.timeout),
});
results.push(...runtimeResults);
}

// Every engine runs concurrently and merges into one result set. An
// engine that cannot run reports a notice and the others still return.
const astGrepConfigPaths = await Promise.all(
astGrepSources.map((source) => resolveSgConfigPath(cwd, source))
);
const dispatched = await runEngines({
cwd,
paths: existingPaths,
astGrepConfigPaths,
runtimeRules: plan.execute,
runtimeTimeoutMs: parseTimeoutMs(args.timeout),
});
const results = dispatched.results;

for (const notice of dispatched.notices) warn(`Notice: ${notice}`);
for (const failure of dispatched.failures) warn(`Error: ${failure}`);

let errorCount = 0;
let warningCount = 0;
for (const result of results) {
if (result.severity === "error") errorCount++;
else if (result.severity === "warning") warningCount++;
}
const hasErrors = errorCount > 0;
scanCounts = { errorCount, warningCount, findings: results.length };

// Computed by `runEngines`, not here: the exit code is a fact about a
// completed dispatch, and an engine failure has to fail the check even
// with no findings.
const { exitCode } = dispatched;

if (args.json) {
const output = checkOutputSchema.parse({
success: !hasErrors,
success: exitCode === 0,
results,
...(plan.skipped.length > 0 ? { skipped: plan.skipped } : {}),
});
Expand All @@ -417,9 +428,8 @@ export const checkCommand = defineCommand({
console.log(formatText(results));
}

// Exit code: 1 if any errors, 0 otherwise
if (hasErrors) {
process.exitCode = 1;
if (exitCode !== 0) {
process.exitCode = exitCode;
}
} catch (error) {
const message = `Error: ${error instanceof Error ? error.message : String(error)}`;
Expand Down
224 changes: 224 additions & 0 deletions packages/cli/src/rules/dispatch.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,224 @@
import { readdir } from "node:fs/promises";
import { join } from "node:path";

import type { CheckResult } from "../types/check";
import { dedupeFindings, ENGINE_LAYOUTS, type EngineName } from "./engines";
import { executeRuntimeRules } from "./runtime/harness";
import type { RuntimeRule } from "./runtime/discover";
import { runAstGrepScan } from "./scan";
import { runVale } from "./vale/run";

/** Errno values that mean "the directory is not there", and nothing worse. */
const ABSENT_DIRECTORY_CODES = new Set(["ENOENT", "ENOTDIR"]);

/**
* Whether `.taskless/vale/rules/` holds anything to run.
*
* The spec is explicit that an empty rules directory means Vale is not invoked
* at all. Worth an explicit check rather than letting Vale run and report
* nothing: a scaffolded-but-empty engine directory is the common state after
* `taskless init`, and spawning a subprocess per check to confirm it found
* nothing is pure cost.
*
* Only absence is swallowed. A blanket `catch` here would read an unreadable
* rules directory (`EACCES`, a bad mount) as "no rules" and skip Vale with no
* notice and no failure — the same silent-disable that `ValeRunOutcome`'s
* `blocking` field exists to prevent one file over. Anything that is not
* absence propagates, so `runEngines` reports it as an engine failure rather
* than a clean run.
*/
export async function hasValeRules(cwd: string): Promise<boolean> {
try {
const entries = await readdir(
join(cwd, ".taskless", ENGINE_LAYOUTS.vale.rulesDirectory)
);
return entries.some((entry) => entry.endsWith(".yml"));
} catch (error) {
const code = (error as NodeJS.ErrnoException).code;
if (code !== undefined && ABSENT_DIRECTORY_CODES.has(code)) return false;
throw error;
}
}
Comment thread
thecodedrift marked this conversation as resolved.

/** One engine's contribution to a check. */
export interface EngineOutcome {
engine: EngineName;
results: CheckResult[];
/**
* Something the user should see that is not a finding — an engine that could
* not run. Advisory: it does not affect the exit code.
*/
notice?: string;
/**
* The engine was present and failed. Unlike a notice this must reach the exit
* code, or a broken engine reads as a clean run.
*/
failure?: string;
}

export interface DispatchOptions {
cwd: string;
/** Target paths, already filtered to those that exist. */
paths: string[];
/**
* One `--config` path per ast-grep rule source, already resolved. The source
* each was derived from is the caller's concern; dispatch only runs configs.
*/
astGrepConfigPaths: string[];
/** Runtime rules that survived planning. Empty means the harness is skipped. */
runtimeRules: RuntimeRule[];
runtimeTimeoutMs?: number;
valeTimeoutMs?: number;
}

export interface DispatchResult {
/** Every engine's findings, merged. */
results: CheckResult[];
/** Advisory messages: engines that could not run. */
notices: string[];
/** Failures that must fail the check even with no findings. */
failures: string[];
/** Per-engine detail, for callers that report engine by engine. */
outcomes: EngineOutcome[];
/**
* The process exit code this run implies.
*
* Two independent reasons to fail, and both are needed. An error-severity
* finding is the ordinary one. An engine failure is the one that is easy to
* miss: a Vale that timed out or rejected its config produces no findings, so
* without it a broken engine exits 0 and reads exactly like a clean run.
*
* Carried on the result rather than derived by each caller. It is a fact
* about a completed dispatch, fixed the moment the engines settle, so
* computing it once here removes the chance of two callers disagreeing about
* what counts as failure.
*/
exitCode: number;
}

/**
* ast-grep over every source, deduped.
*
* `sg/rules/` and the legacy `.taskless/rules/` are scanned separately, so a
* rule present in both reports twice; the finding is its own identity, so
* identical matches collapse.
*/
async function runAstGrepEngine(
options: DispatchOptions
): Promise<EngineOutcome> {
const results: CheckResult[] = [];
for (const configPath of options.astGrepConfigPaths) {
const scan = await runAstGrepScan(options.cwd, options.paths, {
configPath,
});
results.push(...scan.results);
}
return { engine: "sg", results: dedupeFindings(results) };
}

/**
* Vale, when it has rules to run.
*
* The three non-ok outcomes divide along the line `outcome.blocking` draws: an
* absent binary is a notice, because an unsupported arch is an ordinary state
* and failing there would make `check` unrunnable on a machine where the other
* engines work; a timeout or a crash is a failure, because Vale was present and
* asked to work, and reporting that as a skip lets a broken rule file read as
* "no Vale findings".
*
* Reading the severity off the outcome rather than asking a helper is the point
* of that field: an engine reports how bad its own trouble is, and a caller
* cannot forget to ask. Every engine we add answers the same question the same
* way.
*/
async function runValeEngine(options: DispatchOptions): Promise<EngineOutcome> {
if (!(await hasValeRules(options.cwd))) {
return { engine: "vale", results: [] };
}

const outcome = await runVale({
cwd: options.cwd,
paths: options.paths,
timeoutMs: options.valeTimeoutMs,
});

if (outcome.status === "ok") {
return { engine: "vale", results: outcome.results };
}
return outcome.blocking
? { engine: "vale", results: [], failure: outcome.message }
: { engine: "vale", results: [], notice: outcome.message };
}

/** The runtime harness, over rules that planning already cleared to run. */
async function runRuntimeEngine(
options: DispatchOptions
): Promise<EngineOutcome> {
if (options.runtimeRules.length === 0) {
return { engine: "runtime", results: [] };
}
const results = await executeRuntimeRules(options.cwd, options.runtimeRules, {
paths: options.paths,
timeoutMs: options.runtimeTimeoutMs,
});
return { engine: "runtime", results };
}

/**
* Run every engine that has work, concurrently, and merge what they report.
*
* Concurrency is the point: the engines are independent subprocesses over the
* same paths, and running them in sequence makes a check as slow as the sum of
* its engines for no benefit.
*
* It also forces the isolation question. `allSettled`, not `all`: `all` rejects
* on the first rejection and abandons the others, so one engine throwing would
* discard results the rest had already produced — exactly the "an unavailable
* engine must not abort the others" requirement, and the shape that makes it
* true by construction rather than by everyone remembering to catch.
*
* A rejected engine becomes a failure rather than being swallowed. The engines
* themselves report expected trouble as an outcome; a thrown error is something
* unforeseen, and treating it as "no findings" would be the silent-disable
* failure again.
*/
export async function runEngines(
options: DispatchOptions
): Promise<DispatchResult> {
const engines: Array<[EngineName, Promise<EngineOutcome>]> = [
["sg", runAstGrepEngine(options)],
["vale", runValeEngine(options)],
["runtime", runRuntimeEngine(options)],
];

const settled = await Promise.allSettled(engines.map(([, task]) => task));

const outcomes: EngineOutcome[] = settled.map((entry, index) => {
const engine = engines[index]?.[0] ?? "sg";
if (entry.status === "fulfilled") return entry.value;
const reason: unknown = entry.reason;
return {
engine,
results: [],
failure: `${engine} engine failed: ${
reason instanceof Error ? reason.message : String(reason)
}`,
};
});

const results = outcomes.flatMap((outcome) => outcome.results);
const failures = outcomes.flatMap((outcome) => outcome.failure ?? []);

return {
results,
notices: outcomes.flatMap((outcome) => outcome.notice ?? []),
failures,
outcomes,
exitCode:
results.some((finding) => finding.severity === "error") ||
failures.length > 0
? 1
: 0,
};
}

Loading
Loading