@a2f0/agent-tool 0.1.17 → 0.1.18

package/src/workflows/pr.ts

@@ -0,0 +1,137 @@
+import { execFileSync } from "node:child_process";
+import { gitEnvironment } from "../git/environment";
+import { readFileSync } from "node:fs";
+import { loadConfig } from "../config";
+import { remoteBranchHead, resolvePr, resolveRepositoryGitUrl } from "../git/prContext";
+import { assertMergeChecks } from "../pr/mergeChecks";
+import { assertStrictBaseFreshness } from "../pr/baseFreshness";
+import { resolvePullRequestMergeTarget } from "../pr/squashMerge";
+import { planVersions } from "../version/bumpVersions";
+import { assert, clean, currentBranch, git, head, json, oid, option, flag, output, poll, timeoutOptions } from "./core";
+
+export interface PullRequest {
+  number: number; url: string; state: string; title: string; headRefName: string; headRefOid: string;
+  baseRefName: string; baseRefOid: string; isDraft: boolean; mergeable: string; mergeStateStatus: string;
+  isCrossRepository: boolean; mergeCommit: { oid: string } | null;
+}
+export function pullRequest(number?: string, repo?: string): PullRequest {
+  return json<PullRequest>(["pr", "view", ...(number ? [number] : []), ...(repo ? ["-R", repo] : []), "--json", "number,url,state,title,headRefName,headRefOid,baseRefName,baseRefOid,isDraft,mergeable,mergeStateStatus,isCrossRepository,mergeCommit"]);
+}
+interface Check { name: string; state: string; workflow: string }
+export function checkSnapshot(pr: { prNumber: string; repo: string }, expected: string): { ok: boolean; waiting: boolean; headOid: string; checks: Check[]; reason: string | null } {
+  const initial = json<{ headRefOid: string; statusCheckRollup: unknown[] }>(["pr", "view", pr.prNumber, "-R", pr.repo, "--json", "headRefOid,statusCheckRollup"]);
+  assert(initial.headRefOid === expected, "PR HEAD changed while waiting; review the new commit.");
+  assert(Array.isArray(initial.statusCheckRollup), "Could not read checks.");
+  const checks = initial.statusCheckRollup.length ? json<Check[]>(["pr", "checks", pr.prNumber, "-R", pr.repo, "--json", "name,state,workflow"]) : [];
+  assert(Array.isArray(checks), "Could not read checks.");
+  const after = pullRequest(pr.prNumber, pr.repo);
+  assert(after.headRefOid === expected && after.state === "OPEN", "PR HEAD or state changed while waiting.");
+  try {
+    assertMergeChecks(JSON.stringify({ headRefOid: expected, checks }), expected);
+    return { ok: true, waiting: false, headOid: expected, checks, reason: null };
+  } catch (error) {
+    const requiredSkipped = loadConfig().merge.requiredChecks.some(required => {
+      const matches = checks.filter(check => check.name === required.name && (required.workflow === undefined || check.workflow === required.workflow));
+      return matches.length > 0 && matches.every(check => check.state === "SKIPPED");
+    });
+    const failed = requiredSkipped || checks.some(check => !["SUCCESS", "SKIPPED", "PENDING", "QUEUED", "IN_PROGRESS", "WAITING", "REQUESTED", "EXPECTED"].includes(check.state));
+    return { ok: false, waiting: !failed, headOid: expected, checks, reason: (error as Error).message };
+  }
+}
+
+export function preflight(expectedHead: string, baseBranch: string, baseOid: string): unknown {
+  oid(expectedHead); oid(baseOid); clean();
+  assert(head() === expectedHead, "Local HEAD differs from reviewed HEAD.");
+  const identity = resolvePr();
+  const pr = pullRequest(identity.prNumber, identity.repo);
+  assert(pr.headRefOid === expectedHead && pr.headRefName === currentBranch(), "PR does not match the current branch and reviewed HEAD.");
+  assert(pr.state === "OPEN" && !pr.isDraft && pr.mergeable === "MERGEABLE" && pr.mergeStateStatus === "CLEAN", `PR is not ready to merge (${pr.state}/${pr.mergeable}/${pr.mergeStateStatus}).`);
+  const target = resolvePullRequestMergeTarget(identity, baseBranch);
+  assert(target.headOid === expectedHead, "PR head changed during preflight.");
+  assert(remoteBranchHead(resolveRepositoryGitUrl(identity.repo), baseBranch) === baseOid, "Live base differs from reviewed base; integrate, validate and review again.");
+  assert(git(["merge-base", expectedHead, baseOid]) === baseOid, "Reviewed HEAD does not include the reviewed base.");
+  const config = loadConfig();
+  if (config.merge.requireStrictBaseFreshness) assertStrictBaseFreshness(identity.repo, baseBranch);
+  const checks = checkSnapshot(identity, expectedHead);
+  assert(checks.ok, checks.reason ?? "Checks have not passed.");
+  // Explicit version policy opts in; unversioned repositories need no manifest.
+  if (config.versions.packages !== null) assert(planVersions(process.cwd(), baseOid).every(plan => plan.headVersion === plan.targetVersion), "Package versions are stale against the reviewed base.");
+  assert(head() === expectedHead, "Local HEAD changed during preflight.");
+  return { ok: true, repo: identity.repo, pr: pr.number, url: pr.url, headOid: expectedHead, baseBranch, baseOid, checks: checks.checks };
+}
+
+interface Comment { id: string; databaseId: number; body: string; url: string; author: { login: string } | null }
+interface Page<T> { nodes: T[]; pageInfo: { hasNextPage: boolean; endCursor: string | null } }
+interface Thread { id: string; isResolved: boolean; isOutdated: boolean; path: string; line: number | null; comments: Page<Comment> }
+function graphql<T>(query: string, variables: Record<string, string | number>): T {
+  const response = json<{ data?: T; errors?: unknown[] }>(["api", "graphql", "-f", `query=${query}`, ...Object.entries(variables).flatMap(([key, value]) => [typeof value === "number" ? "-F" : "-f", `${key}=${value}`])]);
+  assert(response.data && !response.errors?.length, "GitHub GraphQL response was incomplete.");
+  return response.data;
+}
+const commentFields = "nodes { id databaseId body url author { login } } pageInfo { hasNextPage endCursor }";
+export function reviewThreads(pr: { prNumber: string; repo: string }): Thread[] {
+  const [owner, name] = pr.repo.split("/") as [string, string];
+  const threads: Thread[] = [];
+  let cursor: string | undefined;
+  do {
+    const data = graphql<{ repository: { pullRequest: { reviewThreads: Page<Thread> } } }>(`query($owner:String!,$name:String!,$number:Int!,$cursor:String){repository(owner:$owner,name:$name){pullRequest(number:$number){reviewThreads(first:100,after:$cursor){nodes{id isResolved isOutdated path line comments(first:100){${commentFields}}} pageInfo{hasNextPage endCursor}}}}}`, { owner, name, number: Number(pr.prNumber), ...(cursor ? { cursor } : {}) });
+    const page = data.repository.pullRequest.reviewThreads;
+    assert(Array.isArray(page.nodes), "Invalid review thread page.");
+    threads.push(...page.nodes);
+    assert(!page.pageInfo.hasNextPage || !!page.pageInfo.endCursor && page.pageInfo.endCursor !== cursor, "Invalid thread pagination cursor.");
+    cursor = page.pageInfo.hasNextPage ? page.pageInfo.endCursor! : undefined;
+  } while (cursor);
+  for (const thread of threads) {
+    let page = thread.comments;
+    const seen = new Set<string>();
+    while (page.pageInfo.hasNextPage) {
+      const after = page.pageInfo.endCursor;
+      assert(after && !seen.has(after), "Invalid comment pagination cursor."); seen.add(after);
+      const data = graphql<{ node: { comments: Page<Comment> } }>(`query($id:ID!,$cursor:String){node(id:$id){... on PullRequestReviewThread{comments(first:100,after:$cursor){${commentFields}}}}}`, { id: thread.id, cursor: after });
+      page = data.node.comments;
+      thread.comments.nodes.push(...page.nodes);
+    }
+    thread.comments.pageInfo = page.pageInfo;
+  }
+  return threads;
+}
+
+function threadsCommand(args: string[]): number {
+  const action = args.shift();
+  const identity = resolvePr();
+  if (action === "list") { assert(!args.length, "Usage: pr threads list"); output({ ...identity, threads: reviewThreads(identity) }); return 0; }
+  if (action === "reply") {
+    const bodyFile = option(args, "--body-file");
+    assert(args.length === 1 && /^\d+$/.test(args[0]!), "Usage: pr threads reply <comment-id> [--body-file <file>] (otherwise stdin)");
+    const body = readFileSync(bodyFile ?? 0, "utf8");
+    assert(body.trim(), "Reply body is empty.");
+    const comment = json<{ pull_request_url: string }>(["api", `repos/${identity.repo}/pulls/comments/${args[0]}`]);
+    assert(comment.pull_request_url.endsWith(`/repos/${identity.repo}/pulls/${identity.prNumber}`), "Comment belongs to another PR.");
+    output(JSON.parse(execFileSync("gh", ["api", "--method", "POST", `repos/${identity.repo}/pulls/${identity.prNumber}/comments/${args[0]}/replies`, "--input", "-"], { input: JSON.stringify({ body }), encoding: "utf8", env: gitEnvironment(), maxBuffer: 64 * 1024 * 1024 }))); return 0;
+  }
+  assert(action === "resolve" && args.length === 1, "Usage: pr threads resolve <thread-id>");
+  const thread = reviewThreads(identity).find(thread => thread.id === args[0]);
+  assert(thread, "Thread does not belong to this PR.");
+  if (thread.isResolved) { output({ id: thread.id, isResolved: true, changed: false }); return 0; }
+  output(graphql("mutation($id:ID!){resolveReviewThread(input:{threadId:$id}){thread{id isResolved}}}", { id: thread.id })); return 0;
+}
+
+export async function prWorkflowCommand(args: string[]): Promise<number> {
+  const action = args.shift();
+  if (action === "threads") return threadsCommand(args);
+  if (action === "context") {
+    assert(!args.length, "Usage: pr context");
+    const identity = resolvePr(); const pr = pullRequest(identity.prNumber, identity.repo);
+    output({ repo: identity.repo, ...pr, liveBaseOid: remoteBranchHead(resolveRepositoryGitUrl(identity.repo), pr.baseRefName), localHeadOid: head() }); return 0;
+  }
+  if (action === "preflight") { assert(args.length === 3, "Usage: pr preflight <reviewed-head> <base-branch> <reviewed-base>"); output(preflight(args[0]!, args[1]!, args[2]!)); return 0; }
+  assert(action === "checks", "Unknown PR workflow command.");
+  const wait = flag(args, "--wait");
+  const expected = option(args, "--head") ?? head();
+  const options = timeoutOptions(args);
+  assert(!args.length, "Usage: pr checks [--wait] [--head <oid>] [--timeout seconds] [--interval seconds]"); oid(expected);
+  const identity = resolvePr();
+  const inspect = () => { const value = checkSnapshot(identity, expected); return { done: !value.waiting, value }; };
+  const result = wait ? await poll(inspect, options) : inspect().value;
+  output({ ...identity, ...result }); return result.ok ? 0 : 1;
+}

package/src/workflows/repository.ts

@@ -0,0 +1,109 @@
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { loadConfig } from "../config";
+import { remoteBranchHead, resolveFreshBaseRef, resolveRepositoryGitUrl } from "../git/prContext";
+import { viewCurrentBranchPr } from "../git/currentBranchPr";
+import { assert, clean, currentBranch, flag, git, head, mutateGit, oid, output, read, repository } from "./core";
+import { pullRequest } from "./pr";
+import { assertStrictBaseFreshness } from "../pr/baseFreshness";
+
+export function repoCommand(args: string[]): number {
+  const action = args.shift();
+  if (action === "context") {
+    const fetch = flag(args, "--fetch");
+    assert(!args.length, "Usage: repo context [--fetch]");
+    const repo = repository();
+    const branch = git(["branch", "--show-current"]) || null;
+    const pr = branch ? viewCurrentBranchPr(branch) : undefined;
+    const baseRepo = pr?.repo ?? repo.nameWithOwner;
+    const baseBranch = pr?.baseRefName ?? repo.defaultBranchRef.name;
+    const fetchedBaseOid = fetch ? resolveFreshBaseRef(baseRepo, baseBranch) : undefined;
+    output({ repo: repo.nameWithOwner, defaultBranch: repo.defaultBranchRef.name, branch, headOid: head(), clean: !git(["status", "--porcelain=v1", "--untracked-files=all"]), pr: pr ?? null, baseRepo, baseBranch, liveBaseOid: remoteBranchHead(resolveRepositoryGitUrl(baseRepo), baseBranch), ...(fetch ? { fetchedBaseOid } : {}) }); return 0;
+  }
+  const apply = flag(args, "--apply");
+  const keep = flag(args, "--keep-branch");
+  assert(action === "cleanup" && args.length === 2 && /^\d+$/.test(args[0]!), "Usage: repo cleanup <PR-number> <shipped-head> [--apply] [--keep-branch]");
+  const shipped = oid(args[1]!);
+  const repo = repository();
+  const pr = pullRequest(args[0], repo.nameWithOwner);
+  assert(pr.state === "MERGED" && pr.mergeCommit?.oid && pr.headRefOid === shipped, "PR must be confirmed MERGED at the shipped HEAD.");
+  assert(!pr.isCrossRepository, "Cleanup of fork branches requires explicit manual checkout/remote handling.");
+  const defaultBranch = repo.defaultBranchRef.name;
+  assert(pr.headRefName !== defaultBranch, "Refusing to delete the default branch.");
+  clean();
+  const branch = currentBranch();
+  assert(branch === pr.headRefName || branch === defaultBranch, "Checkout is on an unrelated branch.");
+  if (branch === pr.headRefName) assert(head() === shipped, "Feature branch has commits beyond the shipped HEAD.");
+  const feature = spawnSync("git", ["rev-parse", "--verify", `refs/heads/${pr.headRefName}`], { encoding: "utf8" });
+  assert(feature.status === 0 || feature.status === 128, "Could not inspect feature branch.");
+  if (feature.status === 0) assert(feature.stdout.trim() === shipped, "Local feature branch no longer points to the shipped HEAD.");
+  const url = resolveRepositoryGitUrl(repo.nameWithOwner);
+  const remoteFeature = remoteBranchHead(url, pr.headRefName);
+  assert(!remoteFeature || remoteFeature === shipped, "Remote feature branch moved beyond the shipped HEAD.");
+  const plan = { repo: repo.nameWithOwner, pr: pr.number, mergeOid: pr.mergeCommit.oid, shippedHead: shipped, defaultBranch, featureBranch: pr.headRefName, keepBranch: keep };
+  if (!apply) { output({ ...plan, applied: false }); return 0; }
+  const completed: string[] = [];
+  try {
+    const defaultOid = resolveFreshBaseRef(repo.nameWithOwner, defaultBranch);
+    assert(git(["merge-base", defaultOid, pr.mergeCommit.oid]) === pr.mergeCommit.oid, "Default branch does not contain the confirmed merge commit.");
+    const localDefault = spawnSync("git", ["rev-parse", "--verify", `refs/heads/${defaultBranch}`], { encoding: "utf8" });
+    if (localDefault.status === 0) {
+      assert(git(["merge-base", localDefault.stdout.trim(), defaultOid]) === localDefault.stdout.trim(), "Local default branch diverged; preserve it for inspection.");
+      mutateGit(["switch", defaultBranch]);
+      mutateGit(["merge", "--ff-only", defaultOid]);
+    } else { assert(localDefault.status === 128, "Could not inspect local default branch."); mutateGit(["switch", "--no-track", "-c", defaultBranch, defaultOid]); }
+    assert(currentBranch() === defaultBranch && head() === defaultOid, "Checkout changed during default-branch update.");
+    clean(); completed.push("updated-default");
+    if (!keep) {
+      if (feature.status === 0) {
+        assert(git(["rev-parse", `refs/heads/${pr.headRefName}`]) === shipped, "Local feature branch changed before deletion.");
+        mutateGit(["branch", "-D", "--", pr.headRefName]); completed.push("deleted-local-branch");
+      }
+      const live = remoteBranchHead(url, pr.headRefName);
+      assert(!live || live === shipped, "Remote feature branch changed before deletion.");
+      if (live) {
+        // REST avoids pre-push hooks. GitHub has no expected-OID delete guard.
+        read("gh", ["api", "--method", "DELETE", `repos/${repo.nameWithOwner}/git/refs/heads/${encodeURIComponent(pr.headRefName)}`]);
+        completed.push("deleted-remote-branch");
+      }
+    }
+    output({ ...plan, applied: true, completed, branch: currentBranch(), headOid: head() }); return 0;
+  } catch (error) { output({ ...plan, applied: true, completed, error: (error as Error).message }); return 1; }
+}
+
+export function policyCommand(args: string[]): number {
+  assert(args.length === 1 && args[0] === "check", "Usage: policy check");
+  const repo = repository();
+  const branch = repo.defaultBranchRef.name;
+  const rules = read("gh", ["api", "--paginate", `repos/${repo.nameWithOwner}/rules/branches/${encodeURIComponent(branch)}`, "--jq", ".[]"]).split("\n").filter(Boolean).map((line): unknown => JSON.parse(line));
+  const protection = spawnSync("gh", ["api", `repos/${repo.nameWithOwner}/branches/${encodeURIComponent(branch)}/protection`], { encoding: "utf8" });
+  assert(protection.status === 0 || /HTTP 404/.test(protection.stderr), "Could not read classic branch protection.");
+  const classic = protection.status === 0 ? JSON.parse(protection.stdout) as { required_status_checks?: { contexts?: string[]; checks?: { context: string }[]; strict?: boolean } } : null;
+  const required = new Set<string>(classic?.required_status_checks?.contexts ?? []);
+  for (const check of classic?.required_status_checks?.checks ?? []) required.add(check.context);
+  for (const rule of rules as { type: string; parameters?: { required_status_checks?: { context: string }[] } }[]) if (rule.type === "required_status_checks") for (const check of rule.parameters?.required_status_checks ?? []) required.add(check.context);
+  const configured = loadConfig().merge;
+  const missing = [...required].filter(name => !configured.requiredChecks.some(check => check.name === name));
+  const issues = missing.map(name => `Required context '${name}' is absent from merge.requiredChecks.`);
+  if (configured.requireStrictBaseFreshness) { try { assertStrictBaseFreshness(repo.nameWithOwner, branch); } catch (error) { issues.push((error as Error).message); } }
+  output({ ok: !issues.length, repo: repo.nameWithOwner, branch, configured, classicProtection: classic, effectiveRules: rules, requiredContexts: [...required], missingConfiguredChecks: missing, issues, notes: ["Workflow names and conditional aggregate dependencies require workflow inspection; protection contexts alone do not identify workflows.", "A classic-protection 404 means unavailable or absent; effective rules are queried independently."] });
+  return issues.length ? 1 : 0;
+}
+
+export function toolchainCommand(args: string[]): number {
+  assert(args.length === 1 && args[0] === "check", "Usage: toolchain check");
+  const file = path.join(process.cwd(), ".mise.toml");
+  assert(existsSync(file), "No .mise.toml in this directory.");
+  const config = Bun.TOML.parse(readFileSync(file, "utf8")) as { tools?: Record<string, unknown> };
+  const tools = Object.entries(config.tools ?? {}).map(([name, pin]) => {
+    const expected = typeof pin === "string" ? pin : null;
+    const executable = name === "python" ? "python3" : name;
+    const supported = /^[a-z][a-z0-9-]*$/.test(executable) && expected !== null && /^\d+(?:\.\d+){1,3}$/.test(expected);
+    const resolved = supported ? Bun.which(executable) : null;
+    const version = resolved ? spawnSync(resolved, ["--version"], { encoding: "utf8", timeout: 5000, maxBuffer: 65536 }) : null;
+    const actual = `${version?.stdout ?? ""}\n${version?.stderr ?? ""}`.match(/\b\d+\.\d+(?:\.\d+){0,2}\b/)?.[0] ?? null;
+    return { name, expected, resolved, actual, ok: supported && version?.status === 0 && (actual === expected || actual?.startsWith(`${expected}.`) === true), ...(supported ? {} : { reason: "Unsupported pin syntax; inspect manually." }) };
+  });
+  output({ ok: tools.length > 0 && tools.every(tool => tool.ok), file, tools }); return tools.length && tools.every(tool => tool.ok) ? 0 : 1;
+}