@agent-relay/factory 0.1.80 → 0.1.81

package/dist/orchestrator/factory.js

@@ -6,7 +6,7 @@ import { DEFAULT_DISCOVERY_SWEEP_BUDGET_MS, DEFAULT_READINESS_RECONCILE_TIMEOUT_
 import { DEFAULT_RELAYFILE_OPERATION_TIMEOUT_MS, RelayfileOperationTimeoutError, relayfileTimeoutWithPhase, withRelayfileCallDeadline, } from '../mount/relayfile-operation-timeout.js';
 import { linearByStatePath, linearByIdPath, linearByUuidPath } from '../constants/linear.js';
 import { stateResolutionFromIds } from '../linear/state-resolver.js';
-import { GithubMergeGate, closeProbePr } from '../github/index.js';
+import { GhCliGithubMergeGate, MountedGithubMergeGate, closeProbePr } from '../github/index.js';
 import { factoryGithubIssueCommentDraftName, isFactoryGithubIssueCommentDraftName, isFactoryGithubOperationDraftName, } from '../github/writeback-paths.js';
 import { VerificationPipeline } from '../environments/verification-pipeline.js';
 import { factoryWorktreeIssueSlug, factoryWorktreePath } from '../git/agent-worktree.js';
@@ -64,8 +64,7 @@ const LIVE_EVENT_DRAIN_BATCH_SIZE = 5;
 const COMPLETION_SWEEP_INTERVAL_MS = 15_000;
 const COMPLETION_SWEEP_BATCH_SIZE = 2;
 const PREVIEW_SWEEP_INTERVAL_MS = 60_000;
-const PROBE_PR_GH_BACKOFF_MS = 60_000;
-const PROBE_PR_GH_CANDIDATE_LIMIT = 200;
+const PROBE_PR_RESOLVED_CACHE_MS = 60_000;
 const PUBLISHED_PR_CONFIRM_ATTEMPTS = 20;
 const PUBLISHED_PR_CONFIRM_DELAY_MS = 100;
 const SLACK_REPLY_EVENTS_LIMIT = 100;
@@ -119,8 +118,8 @@ const BABYSITTER_PR_SNAPSHOT_DEAD_LETTER_LIMIT = 256;
 const BABYSITTER_PR_SNAPSHOT_DRAIN_PER_SWEEP = 16;
 // A durably faulted mount would otherwise log an error per path per sweep.
 const BABYSITTER_PR_SNAPSHOT_ESCALATED_LOG_EVERY = 20;
-// Adoption probes an issue's open PR through the (already gh-backed-off) probe
-// resolver, so it runs on its own slower cadence than the completion sweep.
+// Adoption probes an issue's open PR through the mounted projection, so its
+// full-tree fallback runs on a slower cadence than the completion sweep.
 const BABYSITTER_ORPHAN_SWEEP_INTERVAL_MS = 60_000;
 // Warn once per PR identity that arrives unowned, then fall back to debug. The
 // counter carries the true volume; the log only has to make it discoverable.
@@ -457,10 +456,9 @@ export class FactoryLoop {
     #mergeGate;
     #verificationGate;
     #probeCloser;
+    #defaultProbeCloser;
     #probePrResolver;
     #customProbePrResolver;
-    #hasProbePrGhRunner;
-    #probePrGhRunner;
     #logger;
     #clock;
     #processIdentityReader;
@@ -787,7 +785,6 @@ export class FactoryLoop {
     #publishedPullRequests = new Map();
     #previewReferences = new Map();
     #removedPreviewIds = new Set();
-    #probePrGhBackoffUntilMs = new Map();
     #probePrResolvedCache = new Map();
     // GitHub issue mirror-id -> resolved Linear mirror path, so repeat ingestion
     // cycles read the mirror directly instead of re-scanning all Linear issues.
@@ -880,7 +877,7 @@ export class FactoryLoop {
         this.#githubWriteback = ports.githubWriteback ?? defaultGithubWriteback(config, ports.mount);
         this.#slack = config.slack ? MountSlackWriteback(ports.mount, config.slack) : ports.slack;
         this.#github = ports.github ?? MountGithubRead(ports.mount);
-        this.#mergeGate = ports.mergeGate ?? new GithubMergeGate();
+        this.#mergeGate = ports.mergeGate ?? defaultMergeGate(config, ports.mount);
         this.#verificationGate = ports.verificationGate ?? (config.verification.enabled
             ? new VerificationPipeline({
                 descriptorPath: config.verification.descriptorPath,
@@ -892,10 +889,9 @@ export class FactoryLoop {
                 maxTeardownTimeoutMs: config.verification.maxTeardownTimeoutMs,
             })
             : undefined);
+        this.#defaultProbeCloser = !ports.probeCloser;
         this.#probeCloser = ports.probeCloser ?? closeProbePr;
         this.#customProbePrResolver = Boolean(ports.probePrResolver);
-        this.#hasProbePrGhRunner = Boolean(ports.probePrGhRunner);
-        this.#probePrGhRunner = ports.probePrGhRunner ?? failClosedGhRunner;
         this.#probePrResolver = ports.probePrResolver ??
             ((issue) => this.#resolveIssuePr(issue, { repo: this.#probeRepoForIssue(issue) }));
         this.#logger = normalizeLogger(ports.logger ?? console);
@@ -2421,11 +2417,6 @@ export class FactoryLoop {
                     }
                     if (pr.draft) {
                         this.#increment('completionSweepDraftPr');
-                        // Must match the key `#completionPrForIssue` resolves under —
-                        // same options, same repo scope — or this backoff is written
-                        // under a name nothing reads and the draft PR is re-fetched from
-                        // gh on every pass.
-                        this.#probePrGhBackoffUntilMs.set(this.#probePrCacheKey(issue, { repo: this.#probeRepoForIssue(issue) }), this.#clock.now() + PROBE_PR_GH_BACKOFF_MS);
                         return undefined;
                     }
                     if (record.decision.implementers.length > 1 && !await this.#allImplementersHaveCompletionPr(record)) {
@@ -2557,9 +2548,7 @@ export class FactoryLoop {
         }
     }
     // Candidate PR meta paths for an ownerless record, newest PR first. Resolution
-    // reuses the durable dispatch receipts and then the probe resolver (which
-    // carries its own gh backoff, so a record whose implementer has not opened a
-    // PR yet costs no more than a cached miss).
+    // reuses the durable dispatch receipts and then the mounted probe resolver.
     async #orphanedPrMetaPaths(record) {
         const wanted = [];
         if (this.#usesDurableDispatchLifecycle()) {
@@ -2708,19 +2697,13 @@ export class FactoryLoop {
         return dependencyRepoForIssue(issue, undefined, this.#config, { allowDefault: false });
     }
     /**
-     * The key for BOTH `#probePrResolvedCache` and `#probePrGhBackoffUntilMs`.
-     *
-     * Shared rather than inlined because those two maps are written from more than
-     * one place: `#resolveIssuePr` writes both, and the completion sweep writes a
-     * draft-PR backoff directly. Those writes must agree on the key or the backoff
-     * is set under a name nothing reads, which silently costs a gh call per pass.
+     * The key for `#probePrResolvedCache`.
      *
      * `repo` is part of the key because it narrows which pull requests the
      * resolution can even see — an issue whose route changes must not be served
-     * the previous repository's PR, or held off gh by the previous repository's
-     * negative backoff, because the completion path probes and CLOSES what this
-     * returns. `*` marks the unscoped walk, a genuinely different resolution that
-     * must not share an entry with any single-repo one.
+     * the previous repository's PR, because the completion path probes and
+     * CLOSES what this returns. `*` marks the unscoped walk, a genuinely
+     * different resolution that must not share an entry with any single-repo one.
      *
      * Every dimension is a trailing `:`-prefixed segment so the completion
      * invalidation — which clears `stateKey` plus everything starting
@@ -2745,31 +2728,13 @@ export class FactoryLoop {
             // method. The cache had a reader and no writer on the hot path, so the
             // full tree walk repeated for every caller, on every sweep, forever.
             //
-            // Cached on the same terms as the gh branch below — same key, same TTL,
-            // same draft exclusion — because the reason to keep a draft uncached is a
-            // property of the PR (its state is about to flip and the caller wants to
-            // see that promptly), not of which resolver observed it.
+            // Keep drafts uncached because their state is expected to flip and callers
+            // need to observe that promptly.
             if (!mountPr.draft) {
-                this.#probePrResolvedCache.set(key, { pr: mountPr, expiresAtMs: now + PROBE_PR_GH_BACKOFF_MS });
+                this.#probePrResolvedCache.set(key, { pr: mountPr, expiresAtMs: now + PROBE_PR_RESOLVED_CACHE_MS });
             }
             return mountPr;
         }
-        const backoffUntil = this.#probePrGhBackoffUntilMs.get(key) ?? 0;
-        if (backoffUntil > now) {
-            this.#increment('probePrGhBackoffSkips');
-            return undefined;
-        }
-        const ghPr = await resolveIssuePrFromGh(this.#probePrGhRunner, this.#config, issue, opts, this.#logger);
-        this.#increment('probePrGhResolveAttempts');
-        if (ghPr) {
-            this.#probePrGhBackoffUntilMs.delete(key);
-            if (!ghPr.draft) {
-                this.#probePrResolvedCache.set(key, { pr: ghPr, expiresAtMs: now + PROBE_PR_GH_BACKOFF_MS });
-            }
-            this.#increment('probePrGhResolveHits');
-            return ghPr;
-        }
-        this.#probePrGhBackoffUntilMs.set(key, now + PROBE_PR_GH_BACKOFF_MS);
         return undefined;
     }
     async runOnce(opts = {}) {
@@ -8223,18 +8188,18 @@ export class FactoryLoop {
                 const roots = githubIssueRepoRoots(owner, repo);
                 const cachedBatches = roots.map((root) => this.#cachedDiscoveryTree(root));
                 const allRootsCached = cachedBatches.every((paths) => paths !== undefined);
-                const indexedPaths = allRootsCached
-                    ? undefined
-                    : await this.#githubIssuePathsFromIndex(owner, repo);
+                // The issue index is the current eligibility authority, while the
+                // durable trees are only an incremental fallback for mounts whose
+                // index is absent or malformed. A checkpoint can legitimately retain
+                // stale membership (for example across an older cache format or a
+                // missed change window); letting two cached roots bypass a healthy
+                // index makes that stale snapshot self-validating forever.
+                const indexedPaths = await this.#githubIssuePathsFromIndex(owner, repo);
                 // Keep the fallback roots as separate batches. Flattening a very large
                 // provider result is synchronous work and can starve the durable loop
                 // heartbeat before the bounded scan below gets a chance to yield.
                 let pathBatches;
-                if (allRootsCached) {
-                    pathBatches = cachedBatches;
-                    this.#increment('githubIssueDiscoveryCacheReposUsed');
-                }
-                else if (indexedPaths) {
+                if (indexedPaths) {
                     // Do not feed this into the discovery cache: the index only covers
                     // open, labeled issues, so it is a filtered subset of the real
                     // tree (and an empty result for whichever root form the index
@@ -8244,6 +8209,10 @@ export class FactoryLoop {
                     pathBatches = [indexedPaths];
                     this.#increment('githubIssueIndexReposUsed');
                 }
+                else if (allRootsCached) {
+                    pathBatches = cachedBatches;
+                    this.#increment('githubIssueDiscoveryCacheReposUsed');
+                }
                 else {
                     pathBatches = [];
                     for (const root of roots) {
@@ -8781,9 +8750,9 @@ export class FactoryLoop {
         const repo = dependencyRepoForIssue(issue, undefined, this.#config);
         if (!repo)
             return false;
-        // This probe does NOT go through `#resolveIssuePr` — it must not fall back to
-        // gh — so it never saw that method's cache, and `#terminalDependencyIdentities`
-        // only ever memoises the TRUE answer. A dependency that is not merged was
+        // This specialized probe does not go through `#resolveIssuePr`, so it never
+        // saw that method's cache, and `#terminalDependencyIdentities` only ever
+        // memoises the TRUE answer. A dependency that is not merged was
         // therefore re-walked in full for every issue declaring it, on every sweep;
         // several issues blocked on one dependency multiplied a single tree walk by
         // the number of blocked issues. Memoise the negative answer too, on exactly
@@ -10561,44 +10530,6 @@ export class FactoryLoop {
         return true;
     }
     async #openPullRequestByHead(repo, expectedHeadRef) {
-        if (this.#hasProbePrGhRunner) {
-            try {
-                const result = await this.#probePrGhRunner([
-                    'pr',
-                    'list',
-                    '--repo',
-                    repo,
-                    '--head',
-                    expectedHeadRef,
-                    '--state',
-                    'open',
-                    '--json',
-                    'number,url,headRefName,isDraft',
-                    '--limit',
-                    '10',
-                ]);
-                const payload = parseJsonContent(result.stdout);
-                if (Array.isArray(payload)) {
-                    const candidates = payload.flatMap((entry) => {
-                        const candidate = asRecord(entry);
-                        const number = numberValue(candidate?.number);
-                        const url = stringValue(candidate?.url);
-                        const headRef = stringValue(candidate?.headRefName);
-                        if (!number || !url || headRef !== expectedHeadRef || candidate?.isDraft !== false)
-                            return [];
-                        return [{ repo, number, url, headRef }];
-                    });
-                    return candidates.sort((a, b) => b.number - a.number)[0];
-                }
-            }
-            catch (error) {
-                this.#logger.warn?.('[factory] exact-head gh PR lookup failed; falling back to mounted metadata', {
-                    repo,
-                    headRef: expectedHeadRef,
-                    error: describeError(error).errorMessage,
-                });
-            }
-        }
         const parts = githubRepoParts(repo);
         if (!parts)
             return undefined;
@@ -15370,11 +15301,6 @@ export class FactoryLoop {
                     this.#probePrResolvedCache.delete(cacheKey);
                 }
             }
-            for (const backoffKey of [...this.#probePrGhBackoffUntilMs.keys()]) {
-                if (backoffKey === stateKey || backoffKey.startsWith(`${stateKey}:`)) {
-                    this.#probePrGhBackoffUntilMs.delete(backoffKey);
-                }
-            }
             // Cancellation must see the subscription identity so it can issue the
             // idempotent Relayfile DELETE before clearing the local owner maps.
             await this.#cancelBabysittersForIssue(record.issue);
@@ -18047,19 +17973,29 @@ export class FactoryLoop {
         if (!probe) {
             return;
         }
-        await this.#probeCloser({
+        const closeInput = {
             repo: probe.repo,
             prNumber: probe.prNumber,
             expectedIssueKey: issue.key,
             requireTitleMarker: false,
-            ...(this.#mount.githubWrite ? { githubWrite: this.#mount.githubWrite } : {}),
-        });
+        };
+        if (this.#defaultProbeCloser) {
+            await closeProbePr({
+                ...closeInput,
+                ...(probe.path ? { path: probe.path } : {}),
+                mount: this.#mount,
+                ...(this.#mount.githubWrite ? { githubWrite: this.#mount.githubWrite } : {}),
+            });
+        }
+        else {
+            await this.#probeCloser(closeInput);
+        }
         this.#increment('mergeGateSyntheticClosed');
     }
     async #waitForMergeReady(pr) {
         let lastReason = 'not checked';
         for (let attempt = 1; attempt <= MERGE_GATE_MAX_ATTEMPTS; attempt += 1) {
-            const verdict = await this.#mergeGate.check({ repo: pr.repo, number: pr.prNumber });
+            const verdict = await this.#mergeGate.check({ repo: pr.repo, number: pr.prNumber, ...(pr.path ? { path: pr.path } : {}) });
             lastReason = verdict.reason;
             if (verdict.ready && verdict.live.headRefOid) {
                 return verdict;
@@ -18080,14 +18016,44 @@ export class FactoryLoop {
         return hasTitlePrefix(issue.title, FACTORY_E2E_MARKER);
     }
 }
+/**
+ * The guarded merge is a GitHub mutation, so it answers to the same identity
+ * policy as the lifecycle writeback. Under exact `github.identity: "app"` the
+ * gate refuses the merge instead of squash-merging as the operator's local
+ * `gh` user; `auto` and `user` keep today's behavior.
+ *
+ * Exported so the selection itself is testable rather than buried in the
+ * constructor — the same shape as `defaultGithubWriteback` below. `run` is a
+ * test seam only: production passes nothing and gets `defaultGhRunner`. No
+ * test may reach the real `gh` binary here, because the operation it would
+ * perform is an irreversible merge.
+ */
+export const defaultMergeGate = (config, mount, run) => new MountedGithubMergeGate(mount, new GhCliGithubMergeGate(run, config.github.identity));
+const hasAppGithubLifecycleWrite = (write) => Boolean(write?.postIssueComment &&
+    write.ensureRepositoryLabel &&
+    write.mutateIssueLabel &&
+    write.updateIssue);
 const defaultGithubWriteback = (config, mount) => {
-    if (config.github.identity !== 'app') {
+    const identity = config.github.identity;
+    const cloudContainer = mount.writebackTransport === 'relayfile-cloud';
+    if (identity === 'user') {
+        if (cloudContainer) {
+            throw new Error('GitHub identity "user" requires lifecycle writes through local gh, but the Factory cloud container does not contain gh. ' +
+                'Use identity "auto" or "app" with a connected workspace GitHub App lifecycle write path.');
+        }
         return new GhCliGithubWriteback();
     }
-    if (!mount.githubWrite) {
+    if (hasAppGithubLifecycleWrite(mount.githubWrite)) {
+        return new AppGithubWriteback(mount.githubWrite, mount.githubRead);
+    }
+    if (identity === 'app') {
         throw new Error('GitHub identity "app" requires a connected workspace GitHub App lifecycle write path; refusing to fall back to the local gh user');
     }
-    return new AppGithubWriteback(mount.githubWrite, mount.githubRead);
+    if (cloudContainer) {
+        throw new Error('GitHub identity "auto" cannot select lifecycle writeback in the Factory cloud container: no connected workspace GitHub App lifecycle write path is available, ' +
+            'and the container does not contain gh.');
+    }
+    return new GhCliGithubWriteback();
 };
 export function parseLinearIssue(path, content) {
     const parsed = parseJsonContent(content);
@@ -19689,79 +19655,6 @@ export const resolveIssuePrFromMount = async (mount, config, issue, opts = {}, l
     }
     return resolved;
 };
-const resolveIssuePrFromGh = async (run, config, issue, opts = {}, logger) => {
-    const candidates = [];
-    let lookupFailures = 0;
-    for (const repo of reposFromConfig(config)) {
-        let payload;
-        try {
-            const result = await run([
-                'pr',
-                'list',
-                '--repo',
-                repo,
-                '--state',
-                'all',
-                '--json',
-                'number,title,body,headRefName,headRepository,headRepositoryOwner,isCrossRepository,isDraft,state,url',
-                '--limit',
-                String(PROBE_PR_GH_CANDIDATE_LIMIT),
-            ]);
-            if (!result.stdout.trim()) {
-                lookupFailures += 1;
-                logger?.warn?.('[factory] gh PR resolver returned empty output', { issue: issue.key, repo });
-                continue;
-            }
-            payload = parseJsonContent(result.stdout);
-        }
-        catch (error) {
-            lookupFailures += 1;
-            logger?.warn?.('[factory] gh PR resolver failed', { issue: issue.key, repo, error });
-            continue;
-        }
-        if (!Array.isArray(payload)) {
-            lookupFailures += 1;
-            logger?.warn?.('[factory] gh PR resolver returned non-array payload', { issue: issue.key, repo });
-            continue;
-        }
-        if (payload.length >= PROBE_PR_GH_CANDIDATE_LIMIT) {
-            logger?.warn?.('[factory] gh PR resolver hit candidate limit', { issue: issue.key, repo, limit: PROBE_PR_GH_CANDIDATE_LIMIT });
-            if (opts.failOnLookupError)
-                lookupFailures += 1;
-        }
-        for (const entry of payload) {
-            const pr = ghProbePrCandidate(entry);
-            if (!pr ||
-                (!factoryBranchMatchesIssue(pr.headRef, issue.key) &&
-                    !(opts.allowLegacyGithubBranch && legacyGithubBranchMatchesIssue(pr.headRef, issue))))
-                continue;
-            if (opts.openOnly && normalizePrState(pr.state) !== 'OPEN')
-                continue;
-            const score = issuePrMatchScore(pr, issue, opts.titleMarker ?? config.safety.requireTitlePrefix, opts);
-            if (score <= 0)
-                continue;
-            candidates.push({
-                repo,
-                prNumber: pr.number,
-                draft: pr.draft,
-                headRef: pr.headRef,
-                headRepo: pr.headRepo,
-                crossRepository: pr.crossRepository ?? (pr.headRepo ? pr.headRepo.toLowerCase() !== repo.toLowerCase() : undefined),
-                state: pr.state,
-                url: pr.url,
-                score,
-                open: normalizePrState(pr.state) === 'OPEN',
-            });
-        }
-    }
-    const resolved = candidates.sort((a, b) => b.score - a.score ||
-        Number(b.open) - Number(a.open) ||
-        b.prNumber - a.prNumber)[0];
-    if (!resolved && opts.failOnLookupError && lookupFailures > 0) {
-        throw new Error(`Unable to confirm open pull request state for ${issue.key} in ${lookupFailures} configured repository lookup(s)`);
-    }
-    return resolved;
-};
 const reposFromConfig = (config) => {
     const repos = new Set([
         ...Object.values(config.repos.byLabel),
@@ -19880,32 +19773,6 @@ const readProbePrCandidate = async (mount, path) => {
         return undefined;
     }
 };
-const ghProbePrCandidate = (value) => {
-    const payload = asRecord(value);
-    if (!payload)
-        return undefined;
-    const number = numberValue(payload.number);
-    if (typeof number !== 'number' || !Number.isInteger(number) || number <= 0)
-        return undefined;
-    const headRepository = asRecord(payload.headRepository);
-    const headRepositoryOwner = asRecord(payload.headRepositoryOwner);
-    const headRepo = githubRepositoryFullName(payload.headRepository) ?? (() => {
-        const name = stringValue(headRepository?.name);
-        const owner = stringValue(headRepositoryOwner?.login) ?? stringValue(headRepositoryOwner?.name);
-        return name && owner ? `${owner}/${name}` : undefined;
-    })();
-    return {
-        number,
-        title: stringValue(payload.title) ?? '',
-        body: stringValue(payload.body) ?? '',
-        headRef: stringValue(payload.headRefName) ?? '',
-        headRepo,
-        crossRepository: booleanValue(payload.isCrossRepository),
-        draft: booleanValue(payload.isDraft),
-        state: stringValue(payload.state),
-        url: stringValue(payload.url),
-    };
-};
 const issuePrMatchScore = (pr, issue, marker, opts = {}) => {
     if (opts.requireTitleMarker && !hasTitlePrefix(pr.title, marker))
         return 0;
@@ -19948,7 +19815,6 @@ const legacyGithubPrCanBeAdopted = (issue, pr) => {
     return pr.crossRepository === false || pr.headRepo?.toLowerCase() === pr.repo.toLowerCase();
 };
 const normalizePrState = (state) => state?.toUpperCase();
-const failClosedGhRunner = async () => ({ stdout: '[]' });
 const ISSUE_KEY_PATTERN = /^[A-Z]+-\d+$/u;
 const isIssuePathUnderRoot = (path) => path.startsWith(`${ISSUE_ROOT}/`) && path.endsWith('.json');
 const isIssueFilePath = (path) => isIssuePathUnderRoot(path) &&