Merge pull request #517 from Multiplier-Labs/feat/goal-runs

feat: GoalRun loop engine — durable act→verify→continue loops with maker-checker + deterministic PR finalization

Author: alari76

package.json

@@ -26,7 +26,8 @@
     "bin/",
     "dist/",
     "server/dist/",
-    "server/workflows/"
+    "server/workflows/",
+    "server/loops/"
   ],
   "scripts": {
     "dev": "vite",

server/glob-match.test.ts

@@ -0,0 +1,50 @@
+/** Tests for the glob matcher used by Goal Run readonly constraints. */
+import { describe, it, expect } from 'vitest'
+import { globToRegExp, matchesAnyGlob } from './glob-match.js'
+
+describe('globToRegExp', () => {
+  it('matches a directory tree with **', () => {
+    const re = globToRegExp('.github/workflows/**')
+    expect(re.test('.github/workflows/ci.yml')).toBe(true)
+    expect(re.test('.github/workflows/nested/deploy.yml')).toBe(true)
+    expect(re.test('.github/other/ci.yml')).toBe(false)
+  })
+
+  it('* does not cross path separators', () => {
+    const re = globToRegExp('src/*.ts')
+    expect(re.test('src/index.ts')).toBe(true)
+    expect(re.test('src/sub/index.ts')).toBe(false)
+  })
+
+  it('? matches a single non-slash character', () => {
+    const re = globToRegExp('v?.txt')
+    expect(re.test('v1.txt')).toBe(true)
+    expect(re.test('v12.txt')).toBe(false)
+    expect(re.test('v/.txt')).toBe(false)
+  })
+
+  it('matches an extension glob', () => {
+    const re = globToRegExp('*.lock')
+    expect(re.test('yarn.lock')).toBe(true)
+    expect(re.test('package-lock.json')).toBe(false)
+  })
+
+  it('escapes regex metacharacters in literals', () => {
+    const re = globToRegExp('a.b+c')
+    expect(re.test('a.b+c')).toBe(true)
+    expect(re.test('axbxc')).toBe(false)
+  })
+})
+
+describe('matchesAnyGlob', () => {
+  it('returns true when any pattern matches', () => {
+    const globs = ['.github/workflows/**', 'tests/security/**']
+    expect(matchesAnyGlob('tests/security/auth.test.ts', globs)).toBe(true)
+    expect(matchesAnyGlob('.github/workflows/ci.yml', globs)).toBe(true)
+    expect(matchesAnyGlob('src/index.ts', globs)).toBe(false)
+  })
+
+  it('returns false for an empty pattern list', () => {
+    expect(matchesAnyGlob('anything', [])).toBe(false)
+  })
+})

server/glob-match.ts

@@ -0,0 +1,44 @@
+/**
+ * Minimal glob matcher for Goal Run readonly constraints.
+ *
+ * Supports the subset needed by loop specs (e.g. `.github/workflows/**`,
+ * `tests/security/**`, `*.lock`):
+ *   **  — any run of characters, including '/'
+ *   *   — any run of characters except '/'
+ *   ?   — a single character except '/'
+ * Everything else is matched literally. Patterns are anchored to the full path.
+ *
+ * Intentionally dependency-free — the codebase ships no glob library, and the
+ * constraint set is small and author-controlled, so a focused matcher beats
+ * pulling in micromatch.
+ */
+
+const REGEX_SPECIAL = new Set(['.', '+', '^', '$', '{', '}', '(', ')', '|', '[', ']', '\\'])
+
+/** Convert a glob to a RegExp anchored to the whole string. */
+export function globToRegExp(glob: string): RegExp {
+  let out = ''
+  for (let i = 0; i < glob.length; i++) {
+    const ch = glob[i]
+    if (ch === '*') {
+      if (glob[i + 1] === '*') {
+        out += '.*'
+        i++ // consume the second '*'
+      } else {
+        out += '[^/]*'
+      }
+    } else if (ch === '?') {
+      out += '[^/]'
+    } else if (REGEX_SPECIAL.has(ch)) {
+      out += `\\${ch}`
+    } else {
+      out += ch
+    }
+  }
+  return new RegExp(`^${out}$`)
+}
+
+/** True when `path` matches any of the supplied globs. */
+export function matchesAnyGlob(path: string, globs: string[]): boolean {
+  return globs.some((g) => globToRegExp(g).test(path))
+}