@a2f0/agent-tool 0.1.23 → 0.1.25

package/src/version/lockfileVersions.ts

@@ -1,5 +1,6 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
+import { packageDirectories } from "../bun/workspace";
 import { manifestPath, readVersion, workspacePackages } from "./packageVersion";
 
 function field(value: unknown, key: string): unknown {
@@ -41,3 +42,126 @@ export function assertBunLockVersions(
     );
   }
 }
+
+const SECTIONS = ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"];
+
+function entries(value: unknown): [string, string][] {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+    ? Object.entries(value).map(([name, spec]) => [name, typeof spec === "string" ? spec : JSON.stringify(spec)])
+    : [];
+}
+
+/**
+ * Third-party declarations that bun.lock does not already record, as
+ * `<manifest>: <name>@<spec>`: a package added or re-sourced by hand rather
+ * than through an approved add. Every manifest Bun installs is compared with
+ * the lockfile's record of that workspace, section by section, and the root's
+ * catalogs, overrides, and patches with the lockfile's. A new workspace may
+ * only use a third-party package at a spec the lockfile already records.
+ */
+export function unresolvedDependencies(
+  rootDir: string,
+  lockSource = readFileSync(path.join(rootDir, "bun.lock"), "utf8"),
+): string[] {
+  const lock = Bun.JSONC.parse(lockSource);
+  const workspaces = field(lock, "workspaces");
+  const root = realpathSync(rootDir);
+  const manifests = packageDirectories(root).map((directory) => ({
+    key: path.relative(root, directory).split(path.sep).join("/"),
+    manifest: JSON.parse(readFileSync(path.join(directory, "package.json"), "utf8")) as Record<string, unknown>,
+  }));
+  const known = new Set<string>();
+  for (const [, workspace] of entries(workspaces).length ? Object.entries(workspaces as object) : []) {
+    for (const section of SECTIONS) for (const [name, spec] of entries(field(workspace, section))) known.add(`${name}@${spec}`);
+  }
+  // A name the lockfile resolved to a workspace that no longer exists would now come from the registry.
+  const current = new Set(manifests.map(({ manifest }) => manifest.name));
+  const removed = new Set(Object.values((workspaces ?? {}) as Record<string, unknown>).map((workspace) => field(workspace, "name")).filter((name) => typeof name === "string" && !current.has(name)));
+  const missing = new Set<string>();
+  for (const { key, manifest } of manifests) {
+    const recorded = field(workspaces, key);
+    for (const section of SECTIONS) {
+      for (const [name, spec] of entries(manifest[section])) {
+        if (removed.has(name)) missing.add(`${key || "."}: ${name}@${spec} (its workspace was removed)`);
+        // A workspace's name with a version spec can still resolve from the registry; only `workspace:` is local.
+        if (spec.startsWith("workspace:")) continue;
+        // A relative source names different code from a new directory, so only position-independent specs carry over.
+        const relative = /^(?:file:|link:|\.{1,2}\/|\/|~\/)/.test(spec);
+        const covered = recorded === undefined ? !relative && known.has(`${name}@${spec}`) : field(field(recorded, section), name) === spec;
+        if (!covered) missing.add(`${key || "."}: ${name}@${spec}`);
+      }
+    }
+  }
+  const rootManifest = manifests.find(({ key }) => key === "")?.manifest ?? {};
+  const nested = field(rootManifest, "workspaces");
+  const catalogs = field(rootManifest, "catalogs") ?? field(nested, "catalogs");
+  const sources: [string, unknown, unknown][] = [
+    ["catalog", field(rootManifest, "catalog") ?? field(nested, "catalog"), field(lock, "catalog")],
+    // Names from both sides, so deleting a whole named catalog is compared too.
+    ...[...new Set([...entries(catalogs), ...entries(field(lock, "catalogs"))].map(([name]) => name))].map((name): [string, unknown, unknown] => [`catalogs.${name}`, field(catalogs, name), field(field(lock, "catalogs"), name)]),
+    ["overrides", field(rootManifest, "overrides") ?? field(rootManifest, "resolutions"), field(lock, "overrides")],
+    ["patchedDependencies", field(rootManifest, "patchedDependencies"), field(lock, "patchedDependencies")],
+  ];
+  for (const [label, declared, recorded] of sources) {
+    // Nested overrides are objects on both sides; compare them as JSON, in both directions.
+    for (const [name, spec] of entries(declared)) if (entries(recorded).find(([key]) => key === name)?.[1] !== spec) missing.add(`${label}: ${name}@${spec}`);
+    for (const [name] of entries(recorded)) if (!entries(declared).some(([key]) => key === name)) missing.add(`${label}: removed ${name}`);
+  }
+  return [...missing].sort();
+}
+
+function workspaceVersions(rootDir: string): Map<string, string> {
+  const root = realpathSync(rootDir);
+  const versions = new Map<string, string>();
+  for (const directory of packageDirectories(root)) {
+    const manifest = JSON.parse(readFileSync(path.join(directory, "package.json"), "utf8")) as Record<string, unknown>;
+    if (typeof manifest.name === "string" && typeof manifest.version === "string") versions.set(manifest.name, manifest.version);
+  }
+  return versions;
+}
+
+/** Workspace versions as bun.lock last resolved them, by package name. */
+export function lockedWorkspaceVersions(
+  rootDir: string,
+  lockSource = readFileSync(path.join(rootDir, "bun.lock"), "utf8"),
+): Map<string, string> {
+  const versions = new Map<string, string>();
+  for (const workspace of Object.values((field(Bun.JSONC.parse(lockSource), "workspaces") ?? {}) as Record<string, unknown>)) {
+    const name = field(workspace, "name"), version = field(workspace, "version");
+    if (typeof name === "string" && typeof version === "string") versions.set(name, version);
+  }
+  return versions;
+}
+
+/**
+ * Declarations that a workspace satisfied at its locked version but no longer
+ * does, whether a committed or a prepared bump moved it, so Bun would resolve
+ * them from the registry instead of the workspace.
+ */
+export function lostWorkspaceReferences(rootDir: string, before: ReadonlyMap<string, string>): string[] {
+  const root = realpathSync(rootDir);
+  const after = workspaceVersions(root);
+  const rootManifest = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8")) as Record<string, unknown>;
+  const nested = field(rootManifest, "workspaces");
+  // `catalog:` names a root catalog entry; compare the version it stands for.
+  const resolve = (name: string, spec: string): unknown => {
+    if (!spec.startsWith("catalog:")) return spec;
+    const catalog = spec.slice("catalog:".length);
+    return catalog && catalog !== "default"
+      ? field(field(field(rootManifest, "catalogs") ?? field(nested, "catalogs"), catalog), name)
+      : field(field(rootManifest, "catalog") ?? field(nested, "catalog"), name);
+  };
+  const lost = new Set<string>();
+  for (const directory of packageDirectories(root)) {
+    const manifest = JSON.parse(readFileSync(path.join(directory, "package.json"), "utf8")) as Record<string, unknown>;
+    const key = path.relative(root, directory).split(path.sep).join("/") || ".";
+    for (const section of SECTIONS) {
+      for (const [name, spec] of entries(manifest[section])) {
+        const old = before.get(name), now = after.get(name), range = resolve(name, spec);
+        if (spec.startsWith("workspace:") || old === undefined || now === undefined || typeof range !== "string") continue;
+        if (Bun.semver.satisfies(old, range) && !Bun.semver.satisfies(now, range)) lost.add(`${key}: ${name}@${spec}`);
+      }
+    }
+  }
+  return [...lost].sort();
+}

package/src/version/prepareVersions.ts

@@ -1,7 +1,7 @@
 import { loadConfig } from "../config";
 import { validateCommitSubject } from "../pr/validateCommitSubject";
 import { checkVersions, planVersions, rewriteVersions } from "./bumpVersions";
-import { assertBunLockVersions } from "./lockfileVersions";
+import { assertBunLockVersions, lockedWorkspaceVersions, lostWorkspaceReferences, unresolvedDependencies } from "./lockfileVersions";
 import {
   assertAllowedPaths,
   assertClean,
@@ -69,11 +69,24 @@ export function prepareVersions(rootDir: string, baseOid?: string): number {
   const allowed = [...pending.map((plan) => plan.manifest), ...(lockfile ? [lockfile] : [])];
   let committed = false;
   let lockfileChanged = false;
+  if (lockfile) {
+    // The refresh below is unfrozen; it may record workspace changes, never resolve a hand-added package.
+    const missing = unresolvedDependencies(rootDir);
+    if (missing.length) {
+      throw new Error(`bun.lock does not record ${missing.join(", ")}; add or change third-party packages through agent-tool bun commands, or refresh the lockfile with approval, before preparing versions.`);
+    }
+  }
+  const versionsBefore = lockfile ? lockedWorkspaceVersions(rootDir) : undefined;
   try {
     assertHead(rootDir, startHead);
     rewriteVersions(rootDir, baseCommit);
+    if (versionsBefore) {
+      // A bump can leave a version-pinned reference unsatisfied by its workspace, sending it to the registry.
+      const lost = lostWorkspaceReferences(rootDir, versionsBefore);
+      if (lost.length) throw new Error(`The version bump leaves ${lost.join(", ")} unsatisfied by the workspace, so Bun would fetch it from the registry; use a workspace: spec.`);
+    }
     if (lockfile) {
-      // Also repairs a stale lockfile after a deliberate release or new package.
+      // Records the bumped workspace versions in the lockfile.
       runProjectCommand(rootDir, ["bun", "install", "--lockfile-only", "--ignore-scripts"]);
       assertBunLockVersions(rootDir);
     }

package/src/workflows/pr.ts

@@ -1,6 +1,8 @@
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { gitEnvironment } from "../git/environment";
-import { readFileSync } from "node:fs";
+import { closeSync, readFileSync } from "node:fs";
+import { createLog } from "../commands/logFile";
+import { DEFAULT_LIMITS, logTail, outputLimit } from "../commands/output";
 import { loadConfig } from "../config";
 import { remoteBranchHead, resolvePr, resolveRepositoryGitUrl } from "../git/prContext";
 import { assertMergeChecks } from "../pr/mergeChecks";
@@ -39,6 +41,29 @@ export function checkSnapshot(pr: { prNumber: string; repo: string }, expected:
   }
 }
 
+const NOT_FAILED = ["SUCCESS", "SKIPPED", "NEUTRAL", "PENDING", "QUEUED", "IN_PROGRESS", "WAITING", "REQUESTED", "EXPECTED"];
+
+/** Each failed GitHub Actions job of the PR head, saved to a private log with a bounded tail. */
+export function failedJobLogs(pr: { prNumber: string; repo: string }, expected: string, limits = DEFAULT_LIMITS) {
+  const view = json<{ headRefOid: string }>(["pr", "view", pr.prNumber, "-R", pr.repo, "--json", "headRefOid"]);
+  assert(view.headRefOid === expected, "PR HEAD differs from the requested head; pass --head with the PR's commit.");
+  const checks = json<(Check & { link: string })[]>(["pr", "checks", pr.prNumber, "-R", pr.repo, "--json", "name,state,workflow,link"]);
+  assert(Array.isArray(checks), "Could not read checks.");
+  const failed = checks.filter(check => !NOT_FAILED.includes(check.state)).map(check => {
+    const job = check.link?.match(/\/actions\/runs\/(\d+)\/job\/(\d+)/);
+    if (!job) return { ...check, log: null, note: "Not a GitHub Actions job; follow its link." };
+    const { log, fd } = createLog("agent-tool-ci-");
+    let status: number | null;
+    try { status = spawnSync("gh", ["run", "view", job[1]!, "-R", pr.repo, "--job", job[2]!, "--log-failed"], { stdio: ["ignore", fd, fd], env: gitEnvironment() }).status; }
+    finally { closeSync(fd); }
+    const tail = logTail(log, limits);
+    return { ...check, runId: Number(job[1]), jobId: Number(job[2]), ok: status === 0, log, tail: tail.text, truncated: tail.truncated };
+  });
+  // A push while reading would label another commit's logs with the requested head.
+  assert(json<{ headRefOid: string }>(["pr", "view", pr.prNumber, "-R", pr.repo, "--json", "headRefOid"]).headRefOid === expected, "PR HEAD changed while reading logs; read them again for the new head.");
+  return failed;
+}
+
 export function preflight(expectedHead: string, baseBranch: string, baseOid: string): unknown {
   oid(expectedHead); oid(baseOid); clean();
   assert(head() === expectedHead, "Local HEAD differs from reviewed HEAD.");
@@ -125,6 +150,14 @@ export async function prWorkflowCommand(args: string[]): Promise<number> {
     output({ repo: identity.repo, ...pr, liveBaseOid: remoteBranchHead(resolveRepositoryGitUrl(identity.repo), pr.baseRefName), localHeadOid: head() }); return 0;
   }
   if (action === "preflight") { assert(args.length === 3, "Usage: pr preflight <reviewed-head> <base-branch> <reviewed-base>"); output(preflight(args[0]!, args[1]!, args[2]!)); return 0; }
+  if (action === "logs") {
+    const expected = option(args, "--head") ?? head();
+    const maxBytes = option(args, "--max-bytes"), tailLines = option(args, "--tail-lines");
+    const limits = { maxBytes: maxBytes ? outputLimit("--max-bytes", maxBytes) : DEFAULT_LIMITS.maxBytes, tailLines: tailLines ? outputLimit("--tail-lines", tailLines) : DEFAULT_LIMITS.tailLines };
+    assert(!args.length, "Usage: pr logs [--head <oid>] [--max-bytes N] [--tail-lines N]"); oid(expected);
+    const identity = resolvePr();
+    output({ ...identity, headOid: expected, failed: failedJobLogs(identity, expected, limits) }); return 0;
+  }
   assert(action === "checks", "Unknown PR workflow command.");
   const wait = flag(args, "--wait");
   const expected = option(args, "--head") ?? head();