@agent-native/core 0.136.4 → 0.137.0

package/corpus/templates/factory/actions/govern-agent-native-pull-request.ts

@@ -0,0 +1,386 @@
+import { defineAction } from "@agent-native/core/action";
+import { and, desc, eq } from "drizzle-orm";
+import { z } from "zod";
+
+import { resolveConnectorSecret } from "../server/connectors/credentials.js";
+import { getDb } from "../server/db/index.js";
+import {
+  triageDecisions,
+  triageConfig,
+  triageItems,
+  triageRuns,
+} from "../server/db/schema.js";
+import { requireFactoryAutomation } from "../server/lib/require-factory-automation.js";
+import {
+  requireWorkspaceMember,
+  workspaceMemberIdentityFromContext,
+} from "../server/lib/require-workspace-member.js";
+import { createAiServicesGitReadClient } from "../server/triage/ai-services-git.js";
+import { createGitHubClient } from "../server/triage/github-client.js";
+import { stableId } from "../server/triage/ids.js";
+import {
+  parseTriageMetadata,
+  serializeTriageMetadata,
+} from "../server/triage/metadata.js";
+import { reconcileBabysitState } from "../server/triage/pr-babysit.js";
+import { decidePullRequestGovernance } from "../server/triage/pr-policy.js";
+
+function repositoryRef(value: string): { owner: string; repo: string } {
+  const match = /^([^/\s]+)\/([^/\s]+)$/.exec(value.trim());
+  if (!match)
+    throw new Error("Repository must use the owner/repository format.");
+  return { owner: match[1], repo: match[2] };
+}
+
+function requiredAiServicesEnv(
+  name: "BUILDER_AI_SERVICES_URL" | "BUILDER_PROJECT_ID",
+): string {
+  const value =
+    name === "BUILDER_AI_SERVICES_URL"
+      ? process.env.BUILDER_AI_SERVICES_URL // guard:allow-env-credential - non-secret deployment endpoint
+      : process.env.BUILDER_PROJECT_ID; // guard:allow-env-credential - non-secret deployment project id
+  if (!value) throw new Error(`${name} is required for PR governance.`);
+  return value;
+}
+
+async function hasVerifiedFactoryRun(input: {
+  itemId: string | undefined;
+  orgId: string;
+  pullRequestBody: string | null;
+  headRef: string;
+}): Promise<boolean> {
+  const db = getDb();
+  const runConditions = [eq(triageRuns.orgId, input.orgId)];
+  if (input.itemId) {
+    runConditions.push(eq(triageRuns.itemId, input.itemId));
+  }
+  const runs = await db
+    .select({
+      itemId: triageRuns.itemId,
+      provider: triageRuns.provider,
+      providerTaskId: triageRuns.providerTaskId,
+      status: triageRuns.status,
+    })
+    .from(triageRuns)
+    .where(and(...runConditions))
+    .limit(200);
+  const verifiedItemIds = new Set(
+    runs
+      .filter(
+        (run) =>
+          (run.provider === "builder-http" || run.provider === "bot-tag") &&
+          run.status === "completed" &&
+          run.providerTaskId !== null,
+      )
+      .map((run) => run.itemId),
+  );
+  const body = input.pullRequestBody ?? "";
+  if (input.itemId && verifiedItemIds.has(input.itemId)) {
+    return (
+      input.headRef === `factory/${input.itemId.slice(0, 12)}` ||
+      body.includes(`Factory item: ${input.itemId}`)
+    );
+  }
+  if (input.itemId) return false;
+
+  if (!body && !input.headRef.startsWith("factory/")) return false;
+  const items = await db
+    .select({ id: triageItems.id, sourceUrl: triageItems.sourceUrl })
+    .from(triageItems)
+    .where(eq(triageItems.orgId, input.orgId))
+    .orderBy(desc(triageItems.updatedAt))
+    .limit(100);
+  return items.some((item) => {
+    if (!verifiedItemIds.has(item.id)) return false;
+    return (
+      body.includes(`Factory item: ${item.id}`) ||
+      (item.sourceUrl !== null && body.includes(item.sourceUrl)) ||
+      input.headRef === `factory/${item.id.slice(0, 12)}`
+    );
+  });
+}
+
+export default defineAction({
+  description:
+    "Govern one agent-native pull request after fetching bounded GitHub and ai-services evidence. Auto-approve only clear internal bug fixes with clean CI and handled review feedback; auto-merge only the verified Factory Builder flow. Clips, Design, and Content are always owner-managed.",
+  schema: z.object({
+    repo: z.string().trim().min(1).max(256),
+    pullRequestNumber: z.number().int().positive(),
+    itemId: z.string().min(1).optional(),
+    clearBug: z.boolean(),
+    productUxImplications: z.boolean().default(false),
+    reason: z.string().trim().min(1).max(4_000),
+  }),
+  http: false,
+  run: async (
+    {
+      repo,
+      pullRequestNumber,
+      itemId,
+      clearBug,
+      productUxImplications,
+      reason,
+    },
+    context,
+  ) => {
+    const { userEmail, orgId } = await requireWorkspaceMember(
+      workspaceMemberIdentityFromContext(context),
+    );
+    await requireFactoryAutomation(context, { userEmail, orgId }, "governance");
+    const repository = repositoryRef(repo);
+    const configuredRepository = (
+      await getDb()
+        .select({ repository: triageConfig.repository })
+        .from(triageConfig)
+        .where(and(eq(triageConfig.id, orgId), eq(triageConfig.orgId, orgId)))
+        .limit(1)
+    )[0]?.repository;
+    if (!configuredRepository || configuredRepository.trim() !== repo.trim()) {
+      throw new Error(
+        "PR governance is restricted to the configured Factory repository.",
+      );
+    }
+    if (itemId) {
+      const item = (
+        await getDb()
+          .select({
+            repository: triageItems.repository,
+            pullRequestNumber: triageItems.pullRequestNumber,
+          })
+          .from(triageItems)
+          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+          .limit(1)
+      )[0];
+      if (
+        !item ||
+        item.repository !== repo.trim() ||
+        item.pullRequestNumber !== pullRequestNumber
+      ) {
+        throw new Error(
+          "Factory item does not match the governed repository and pull request.",
+        );
+      }
+    }
+    const github = createGitHubClient({ ownerEmail: userEmail, orgId });
+    const pullRequest = await github.getPullRequestSummary(
+      repository,
+      pullRequestNumber,
+    );
+    const privateKey = await resolveConnectorSecret(
+      "BUILDER_PRIVATE_KEY",
+      userEmail,
+      { orgId },
+    );
+    if (!privateKey)
+      throw new Error(
+        "BUILDER_PRIVATE_KEY is required to read PR review evidence.",
+      );
+    const projectId = requiredAiServicesEnv("BUILDER_PROJECT_ID");
+    const snapshot = await createAiServicesGitReadClient({
+      baseUrl: requiredAiServicesEnv("BUILDER_AI_SERVICES_URL"),
+      authorization: `Bearer ${privateKey.startsWith("bpk-") ? privateKey : `bpk-${privateKey}`}`,
+    }).fetchPullRequest({ projectId, repo, pullRequestNumber });
+    if (snapshot.headSha !== pullRequest.headSha) {
+      throw new Error(
+        `PR evidence is stale: GitHub reports ${pullRequest.headSha}, ai-services reports ${snapshot.headSha}.`,
+      );
+    }
+
+    const checksPassed =
+      snapshot.coverage === "complete" &&
+      snapshot.checks.length > 0 &&
+      snapshot.checks.every((check) => check.state === "passed");
+    const reviewStateClean = snapshot.reviews.every(
+      (review) =>
+        review.state !== "changes_requested" && review.state !== "pending",
+    );
+    const reviewFeedback = reconcileBabysitState({
+      comments: snapshot.comments,
+      checks: snapshot.checks,
+      commentsTruncated: snapshot.commentsTruncated,
+      botAuthors: [
+        "github-actions",
+        "github-actions[bot]",
+        "dependabot[bot]",
+        "builderio[bot]",
+      ],
+    });
+    const reviewFeedbackHandled = reviewStateClean && reviewFeedback.isClean;
+    const internalMember = await github.checkOrganizationMember(
+      "BuilderIO",
+      pullRequest.userLogin,
+    );
+    const factoryTriggered = await hasVerifiedFactoryRun({
+      itemId,
+      orgId,
+      pullRequestBody: pullRequest.body,
+      headRef: pullRequest.headRef,
+    });
+    const governance = decidePullRequestGovernance({
+      author: pullRequest.userLogin,
+      repository: repo,
+      title: pullRequest.title,
+      summary: pullRequest.body,
+      changedFiles: snapshot.changedFiles ?? [],
+      clearBug,
+      productUxImplications,
+      checksPassed,
+      reviewFeedbackHandled,
+      openNonDraft: pullRequest.state === "open" && !pullRequest.draft,
+      internalBuilderMember: internalMember.isMember,
+      factoryTriggered,
+    });
+
+    if (itemId) {
+      const item = (
+        await getDb()
+          .select()
+          .from(triageItems)
+          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+          .limit(1)
+      )[0];
+      if (!item) throw new Error("Factory item not found for PR governance.");
+      const decisionId = stableId(
+        "pr-governance",
+        orgId,
+        itemId,
+        snapshot.headSha,
+      );
+      await getDb()
+        .insert(triageDecisions)
+        .values({
+          id: decisionId,
+          itemId,
+          ruleId: null,
+          mode: "automation",
+          outcome: governance.autoMerge
+            ? "auto_merge"
+            : governance.autoApprove
+              ? "auto_approve"
+              : "needs_manual",
+          reason: `${reason} ${governance.reason}`.trim(),
+          guardResultsJson: JSON.stringify(governance.guardResults),
+          model: "factory-pr-governance",
+          promptVersion: 1,
+          createdAt: new Date().toISOString(),
+          ownerEmail: userEmail,
+          orgId,
+        })
+        .onConflictDoNothing();
+    }
+
+    if (!governance.autoApprove) {
+      if (itemId) {
+        await getDb()
+          .update(triageItems)
+          .set({
+            status: governance.ownerOwnedArea ? "needs_manual" : "pr_observed",
+            updatedAt: new Date().toISOString(),
+          })
+          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
+      }
+      return {
+        ok: true,
+        action: "needs_manual",
+        ownerOwnedArea: governance.ownerOwnedArea,
+        reason: governance.reason,
+        checksPassed,
+        reviewFeedbackHandled,
+      };
+    }
+
+    let approvalUrl: string | null = null;
+    if (itemId) {
+      const item = (
+        await getDb()
+          .select({
+            metadataJson: triageItems.metadataJson,
+            status: triageItems.status,
+          })
+          .from(triageItems)
+          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+          .limit(1)
+      )[0];
+      if (!item) throw new Error("Factory item disappeared after PR approval.");
+      const metadata = parseTriageMetadata(item.metadataJson);
+      const previouslyApproved =
+        item.status === "auto_approved" &&
+        metadata.autoApprovalHeadSha === snapshot.headSha &&
+        typeof metadata.autoApprovalUrl === "string";
+      if (previouslyApproved) approvalUrl = metadata.autoApprovalUrl as string;
+      if (!previouslyApproved) {
+        const approval = await github.approvePullRequest(
+          repository,
+          pullRequestNumber,
+          "Factory auto-approved: clear internal bug fix with passing CI and handled review feedback.",
+        );
+        approvalUrl = approval.htmlUrl;
+        metadata.autoApprovedAt = new Date().toISOString();
+        metadata.autoApprovalUrl = approval.htmlUrl;
+        metadata.autoApprovalHeadSha = snapshot.headSha;
+        await getDb()
+          .update(triageItems)
+          .set({
+            metadataJson: serializeTriageMetadata(metadata),
+            status: "auto_approved",
+            updatedAt: new Date().toISOString(),
+          })
+          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
+      }
+    } else {
+      approvalUrl = (
+        await github.approvePullRequest(
+          repository,
+          pullRequestNumber,
+          "Factory auto-approved: clear internal bug fix with passing CI and handled review feedback.",
+        )
+      ).htmlUrl;
+    }
+
+    if (!governance.autoMerge) {
+      return {
+        ok: true,
+        action: "approved",
+        approvalUrl,
+        checksPassed,
+        reviewFeedbackHandled,
+      };
+    }
+
+    const merge = await github.mergePullRequest(
+      repository,
+      pullRequestNumber,
+      `Merge Factory bug fix #${pullRequestNumber}`,
+      snapshot.headSha,
+    );
+    if (itemId) {
+      const item = (
+        await getDb()
+          .select({ metadataJson: triageItems.metadataJson })
+          .from(triageItems)
+          .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)))
+          .limit(1)
+      )[0];
+      if (!item) throw new Error("Factory item disappeared after PR merge.");
+      const metadata = parseTriageMetadata(item.metadataJson);
+      metadata.autoMergedAt = new Date().toISOString();
+      metadata.mergeSha = merge.sha;
+      await getDb()
+        .update(triageItems)
+        .set({
+          metadataJson: serializeTriageMetadata(metadata),
+          status: "merged",
+          updatedAt: new Date().toISOString(),
+        })
+        .where(and(eq(triageItems.id, itemId), eq(triageItems.orgId, orgId)));
+    }
+    return {
+      ok: true,
+      action: "merged",
+      approvalUrl,
+      mergeSha: merge.sha,
+      checksPassed,
+      reviewFeedbackHandled,
+    };
+  },
+});

package/corpus/templates/factory/actions/list-factory-automations.ts

@@ -0,0 +1,53 @@
+import { defineAction } from "@agent-native/core/action";
+import {
+  listAutomationDefinitions,
+  listAutomationRuns,
+} from "@agent-native/core/triggers";
+import { z } from "zod";
+
+import {
+  requireWorkspaceMember,
+  workspaceMemberIdentityFromContext,
+} from "../server/lib/require-workspace-member.js";
+
+export default defineAction({
+  description:
+    "List the organization-scoped Factory automations with their trigger, editable prompt, model, schedule, enabled state, and recent runs.",
+  agentTool: false,
+  schema: z.object({ factoryId: z.string().trim().min(1).optional() }),
+  http: { method: "GET" },
+  readOnly: true,
+  run: async (_, context) => {
+    const { userEmail, orgId } = await requireWorkspaceMember(
+      workspaceMemberIdentityFromContext(context),
+    );
+    const definitions = await listAutomationDefinitions(
+      { userEmail, orgId },
+      "organization",
+    );
+    return Promise.all(
+      definitions
+        .filter(({ meta }) => meta.domain === "factory")
+        .map(async ({ resource, name, meta, body, canUpdate }) => ({
+          id: resource.id,
+          name,
+          prompt: body,
+          body,
+          model: meta.model ?? null,
+          schedule: meta.schedule || null,
+          enabled: meta.enabled,
+          triggerType: meta.triggerType,
+          event: meta.event ?? null,
+          timezone: meta.timezone ?? null,
+          condition: meta.condition ?? null,
+          createdBy: meta.createdBy ?? null,
+          canUpdate,
+          runs: await listAutomationRuns({
+            owners: [resource.owner],
+            automation: name,
+            limit: 20,
+          }),
+        })),
+    );
+  },
+});

package/corpus/templates/factory/actions/list-triage-items.ts

@@ -8,18 +8,22 @@ import {
   requireWorkspaceMember,
   workspaceMemberIdentityFromContext,
 } from "../server/lib/require-workspace-member.js";
-import { triageItemStatusSchema } from "../server/triage/contracts.js";
+import {
+  triageItemStatusSchema,
+  triageSourceSchema,
+} from "../server/triage/contracts.js";
 
 export default defineAction({
   description:
     "List the Factory observation queue. Results are scoped to the active workspace and include the latest shadow decision summary.",
   schema: z.object({
     status: triageItemStatusSchema.optional(),
+    source: triageSourceSchema.optional(),
     limit: z.coerce.number().int().min(1).max(100).default(50),
   }),
   http: { method: "GET" },
   readOnly: true,
-  run: async ({ status, limit }, context) => {
+  run: async ({ status, source, limit }, context) => {
     const { orgId } = await requireWorkspaceMember(
       workspaceMemberIdentityFromContext(context),
     );
@@ -31,6 +35,7 @@ export default defineAction({
         and(
           eq(triageItems.orgId, orgId),
           status ? eq(triageItems.status, status) : undefined,
+          source ? eq(triageItems.source, source) : undefined,
         ),
       )
       .orderBy(desc(triageItems.updatedAt))

package/corpus/templates/factory/actions/poll-github-sources.ts

@@ -0,0 +1,203 @@
+import { defineAction } from "@agent-native/core/action";
+import { and, eq } from "drizzle-orm";
+import { z } from "zod";
+
+import { getDb } from "../server/db/index.js";
+import { triageConfig, triageItems } from "../server/db/schema.js";
+import { requireFactoryAutomation } from "../server/lib/require-factory-automation.js";
+import {
+  requireWorkspaceMember,
+  workspaceMemberIdentityFromContext,
+} from "../server/lib/require-workspace-member.js";
+import { createGitHubClient } from "../server/triage/github-client.js";
+import { itemDedupeKey } from "../server/triage/ids.js";
+import { mergeTriageMetadata } from "../server/triage/metadata.js";
+
+function parseRepository(value: string): { owner: string; repo: string } {
+  const match = /^([^/\s]+)\/([^/\s]+)$/.exec(value.trim());
+  if (!match) {
+    throw new Error("Factory repository must use the owner/repository format.");
+  }
+  return { owner: match[1], repo: match[2] };
+}
+
+export default defineAction({
+  description:
+    "Poll the configured GitHub repository for bounded open issues and pull requests and record them in the Factory queue. This does not write to GitHub.",
+  schema: z.object({
+    includeIssues: z.boolean().default(true),
+    includePullRequests: z.boolean().default(true),
+  }),
+  http: false,
+  run: async ({ includeIssues, includePullRequests }, context) => {
+    const { userEmail, orgId } = await requireWorkspaceMember(
+      workspaceMemberIdentityFromContext(context),
+    );
+    await requireFactoryAutomation(
+      context,
+      { userEmail, orgId },
+      "sourcePolling",
+    );
+    const config = (
+      await getDb()
+        .select()
+        .from(triageConfig)
+        .where(and(eq(triageConfig.id, orgId), eq(triageConfig.orgId, orgId)))
+        .limit(1)
+    )[0];
+    if (config?.githubPollingEnabled !== 1) {
+      throw new Error("Enable GitHub polling before polling GitHub sources.");
+    }
+    if (!config.repository) {
+      throw new Error("Configure a GitHub repository before polling GitHub.");
+    }
+
+    const repositoryName = config.repository;
+    const repository = parseRepository(repositoryName);
+    const client = createGitHubClient({ ownerEmail: userEmail, orgId });
+    const [issues, pullRequests] = await Promise.all([
+      includeIssues
+        ? client.listOpenIssues(repository, 50)
+        : Promise.resolve([]),
+      includePullRequests
+        ? client.listOpenPullRequests(repository, 50)
+        : Promise.resolve([]),
+    ]);
+    const db = getDb();
+    const now = new Date().toISOString();
+    let issueCount = 0;
+    let pullRequestCount = 0;
+
+    await db.transaction(async (tx) => {
+      for (const issue of issues) {
+        const id = itemDedupeKey(
+          {
+            source: "github_issue",
+            externalId: `${repositoryName}#${issue.number}`,
+          },
+          orgId,
+        );
+        const existing = (
+          await tx
+            .select()
+            .from(triageItems)
+            .where(and(eq(triageItems.id, id), eq(triageItems.orgId, orgId)))
+            .limit(1)
+        )[0];
+        const metadata = mergeTriageMetadata(existing?.metadataJson ?? "{}", {
+          kind: "github_issue",
+          author: issue.userLogin,
+          labels: [...issue.labels],
+          errorReport: [issue.title, issue.body ?? ""]
+            .filter(Boolean)
+            .join("\n\n"),
+          updatedAt: issue.updatedAt,
+        });
+        await tx
+          .insert(triageItems)
+          .values({
+            id,
+            source: "github_issue",
+            externalId: `${repositoryName}#${issue.number}`,
+            sourceUrl: issue.htmlUrl,
+            title: issue.title,
+            summary: issue.body?.slice(0, 4_000) ?? null,
+            status: existing?.status ?? "received",
+            risk: existing?.risk ?? "unknown",
+            coverage: existing?.coverage ?? "complete",
+            dedupeKey: id,
+            metadataJson: metadata,
+            lastSeenAt: issue.updatedAt,
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+            ownerEmail: existing?.ownerEmail ?? userEmail,
+            orgId,
+          })
+          .onConflictDoUpdate({
+            target: triageItems.id,
+            set: {
+              sourceUrl: issue.htmlUrl,
+              title: issue.title,
+              summary: issue.body?.slice(0, 4_000) ?? null,
+              metadataJson: metadata,
+              lastSeenAt: issue.updatedAt,
+              updatedAt: now,
+            },
+          });
+        issueCount += 1;
+      }
+
+      for (const pullRequest of pullRequests) {
+        const id = itemDedupeKey(
+          {
+            source: "github",
+            externalId: `${repositoryName}#${pullRequest.number}`,
+            repository: repositoryName,
+            pullRequestNumber: pullRequest.number,
+          },
+          orgId,
+        );
+        const existing = (
+          await tx
+            .select()
+            .from(triageItems)
+            .where(and(eq(triageItems.id, id), eq(triageItems.orgId, orgId)))
+            .limit(1)
+        )[0];
+        const metadata = mergeTriageMetadata(existing?.metadataJson ?? "{}", {
+          kind: "pull_request",
+          author: pullRequest.userLogin,
+          headRef: pullRequest.headRef,
+          baseRef: pullRequest.baseRef,
+          draft: pullRequest.draft,
+          updatedAt: pullRequest.updatedAt,
+        });
+        await tx
+          .insert(triageItems)
+          .values({
+            id,
+            source: "github",
+            externalId: `${repositoryName}#${pullRequest.number}`,
+            sourceUrl: pullRequest.htmlUrl,
+            title: pullRequest.title,
+            summary: pullRequest.body?.slice(0, 4_000) ?? null,
+            status: existing?.status ?? "pr_observed",
+            risk: existing?.risk ?? "unknown",
+            repository: repositoryName,
+            pullRequestNumber: pullRequest.number,
+            headSha: pullRequest.headSha,
+            coverage: existing?.coverage ?? "partial",
+            dedupeKey: id,
+            metadataJson: metadata,
+            lastSeenAt: pullRequest.updatedAt,
+            createdAt: existing?.createdAt ?? now,
+            updatedAt: now,
+            ownerEmail: existing?.ownerEmail ?? userEmail,
+            orgId,
+          })
+          .onConflictDoUpdate({
+            target: triageItems.id,
+            set: {
+              sourceUrl: pullRequest.htmlUrl,
+              title: pullRequest.title,
+              summary: pullRequest.body?.slice(0, 4_000) ?? null,
+              repository: repositoryName,
+              pullRequestNumber: pullRequest.number,
+              headSha: pullRequest.headSha,
+              metadataJson: metadata,
+              lastSeenAt: pullRequest.updatedAt,
+              updatedAt: now,
+            },
+          });
+        pullRequestCount += 1;
+      }
+    });
+
+    return {
+      ok: true,
+      repository: repositoryName,
+      issues: issueCount,
+      pullRequests: pullRequestCount,
+    };
+  },
+});