@agilno-tech/rivet 0.1.0-alpha.0

package/src/commands/delivery.js

@@ -0,0 +1,223 @@
+import { loadProjectConfig } from '../config/load.js';
+import { gitExecutable, resolveConfiguredProject } from '../cli/project-discovery.js';
+import { CliError, EXIT_CODES } from '../cli/output.js';
+import { runArgv } from '../discovery/tools.js';
+import { createGitClient } from '../git/client.js';
+import { createFeatureRunStore } from '../feature/run-store.js';
+import {
+  deliveryRecordPaths,
+  listExistingFeatureRunPaths,
+  resolveExistingFeatureRunPaths,
+} from '../state/paths.js';
+import { loadDeliveryCandidate } from '../delivery/prepare.js';
+import { createDeliveryStore } from '../delivery/store.js';
+import { createDeliveryService, createTrustedDeliveryExecutor } from '../delivery/service.js';
+import { createAuthorityEnvelope } from '../policy/authority.js';
+import { createApprovalRegistry } from '../policy/approvals.js';
+import { runRemoteDelivery } from './delivery-remote.js';
+import { trackerTargetFromRun } from '../delivery/tracker-target.js';
+import { hash } from '../delivery/contract.js';
+
+function fail(message, code = 'INVALID_INPUT') {
+  throw new CliError(message, code);
+}
+async function selectRun(project, flags, subcommand, runner) {
+  if (flags.run !== undefined) {
+    const paths = await resolveExistingFeatureRunPaths(project, flags.run, {
+      runner,
+    });
+    if (paths === null) fail('The selected run was not found.', 'REPOSITORY_CONFLICT');
+    return paths;
+  }
+  const candidates = [];
+  for (const paths of await listExistingFeatureRunPaths(project, { runner })) {
+    const record =
+      subcommand !== 'prepare'
+        ? await createDeliveryStore(await deliveryRecordPaths(paths)).read()
+        : await createFeatureRunStore(paths).readOnly();
+    if (record && (subcommand !== 'prepare' || record.status === 'awaiting-final-approval'))
+      candidates.push(paths);
+  }
+  if (candidates.length !== 1)
+    fail('Select one verified run with --run=<id>; no unique delivery run was found.', 'REPOSITORY_CONFLICT');
+  return candidates[0];
+}
+
+export async function deliveryCommand(parsed, dependencies) {
+  const { subcommand, operands, flags } = parsed;
+  if (
+    !['prepare', 'status', 'refresh', 'publish', 'review', 'review-update', 'merge', 'deploy', 'tracker-update', 'tracker-status', 'tracker-transition', 'reconcile', 'recover'].includes(subcommand) ||
+    operands.length ||
+    Object.keys(flags).some(
+      (key) => !['project', 'run', 'remote', 'json', 'provider', 'method', 'title', 'body'].includes(key)
+    ) ||
+    (subcommand === 'review-update' ? typeof flags.title !== 'string' || typeof flags.body !== 'string' : flags.title !== undefined || flags.body !== undefined) ||
+    (flags.run !== undefined && !/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(flags.run)) ||
+    flags.run?.length > 64 ||
+    (subcommand !== 'prepare' && flags.remote !== undefined) ||
+    (flags.provider !== undefined &&
+      (!['refresh', 'publish', 'review', 'review-update', 'merge', 'deploy', 'tracker-update', 'tracker-status', 'tracker-transition', 'reconcile'].includes(subcommand) ||
+        !/^[a-z][a-z0-9-]{0,63}$/.test(flags.provider))) ||
+    (flags.method !== undefined &&
+      (subcommand !== 'merge' || !['merge', 'squash', 'rebase'].includes(flags.method))) ||
+    (['publish', 'review', 'review-update', 'merge', 'deploy', 'tracker-update', 'tracker-transition'].includes(subcommand) && flags.json)
+  ) {
+    fail(
+      'Use rivet delivery prepare|status|refresh|publish|review|review-update|merge|deploy|tracker-update|tracker-status|tracker-transition|reconcile|recover [--run=<id>] [--project=<path>]. Prepare accepts --remote; remote operations accept --provider; interactive merge accepts --method=merge|squash|rebase. JSON is unavailable for delivery writes.'
+    );
+  }
+  const project = await resolveConfiguredProject(dependencies.cwd(), flags.project, {
+    runner: dependencies.runGit,
+    env: dependencies.env,
+  });
+  const executable = await gitExecutable(dependencies.env);
+  const runner = (_command, args, options) => (dependencies.runGit ?? runArgv)(executable, args, options);
+  let result;
+  try {
+    const paths = await selectRun(project.root, flags, subcommand, runner);
+    const store = createDeliveryStore(await deliveryRecordPaths(paths));
+    if (subcommand === 'recover') {
+      const recovery = await store.recover();
+      if (flags.json) dependencies.output.json({ok: true, runId: paths.runId, recovery});
+      else {
+        dependencies.output.log(recovery.recoveredLocks.length
+          ? `Recovered abandoned delivery locks: ${recovery.recoveredLocks.join(', ')}.`
+          : 'No abandoned delivery locks needed recovery.');
+        dependencies.output.log('Reconcile any pending provider outcome with rivet delivery reconcile.');
+      }
+      return EXIT_CODES.SUCCESS;
+    }
+    result = await store.read();
+    if (subcommand === 'prepare') {
+      const gitClient = await createGitClient({ gitExecutable: executable });
+      const candidate = await loadDeliveryCandidate({
+        project: project.root,
+        runId: paths.runId,
+        remoteName: flags.remote,
+        gitClient,
+        runner,
+      });
+      if (result !== null) {
+        if (
+          result.candidate.localVerification.evidenceDigest !== candidate.localVerification.evidenceDigest ||
+          result.candidate.repository.url !== candidate.repository.url ||
+          result.candidate.sourceBranch !== candidate.sourceBranch ||
+          result.candidate.targetBranch !== candidate.targetBranch
+        )
+          fail(
+            'Delivery already records a different candidate. Inspect its status before continuing.',
+            'REPOSITORY_CONFLICT'
+          );
+      } else {
+        const service = createDeliveryService({
+          store,
+          executor: createTrustedDeliveryExecutor({
+            provider: candidate.repository.provider,
+            capabilities: [],
+          }),
+          providerId: 'repository',
+          subjectId: 'delivery-cli',
+          expectedApproverId: 'terminal-human',
+          authority: createAuthorityEnvelope({
+            actorId: 'delivery-cli',
+            principal: 'agent',
+            actions: [],
+            ownedPaths: [],
+            providers: [],
+            commands: [],
+          }),
+          approvalRegistry: createApprovalRegistry({
+            approvers: [{ id: 'terminal-human', principal: 'human' }],
+          }),
+          clock: () => new Date().toISOString(),
+        });
+        result = await service.initialize(candidate);
+      }
+    }
+    if (['refresh', 'publish', 'review', 'review-update', 'merge', 'deploy', 'tracker-update', 'tracker-status', 'tracker-transition', 'reconcile'].includes(subcommand)) {
+      result = await runRemoteDelivery({
+        action: subcommand,
+        publicationContext: {project: project.root, gitExecutable: executable},
+        store,
+        config: project.config,
+        reloadConfig: () => loadProjectConfig(project.root),
+        loadTrackerTarget: async candidate => trackerTargetFromRun(await createFeatureRunStore(paths).readOnly(), candidate),
+        flags,
+        dependencies,
+        validateLocal: async (expected) => {
+          const gitClient = await createGitClient({ gitExecutable: executable });
+          // Select the previously recorded repository even if another remote exists.
+          const { discoverRepositoryRemotes, parseRepositoryRemote } = await import('../repositories/index.js');
+          const remotes = await discoverRepositoryRemotes(project.root, { runner });
+          const remote = remotes.find((item) => {try {return hash(parseRepositoryRemote(item.url)) === hash(expected.repository);} catch {return false;}});
+          if (!remote) fail('The prepared repository remote is no longer configured.', 'REPOSITORY_CONFLICT');
+          const current = await loadDeliveryCandidate({
+            project: project.root,
+            runId: paths.runId,
+            remoteName: remote.name,
+            gitClient,
+            runner,
+          });
+          if (
+            hash(current.localVerification) !== hash(expected.localVerification) ||
+            hash(current.repository) !== hash(expected.repository) ||
+            current.sourceBranch !== expected.sourceBranch ||
+            current.targetBranch !== expected.targetBranch
+          )
+            fail(
+              'The local candidate changed. Verify the work before preparing delivery again.',
+              'REPOSITORY_CONFLICT'
+            );
+        },
+      });
+    }
+    if (result === null)
+      fail(
+        'No delivery record exists. Run rivet delivery prepare after verification.',
+        'REPOSITORY_CONFLICT'
+      );
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    if (error?.code === 'ERR_DELIVERY_BRANCH_NOT_PUBLISHED') fail(error.safeMessage, 'REPOSITORY_CONFLICT');
+    if (subcommand === 'recover') fail(
+      'Delivery recovery stopped. Locks must be at least five minutes old and owned by a provably dead process on this machine. Live, foreign, unsafe or previously claimed locks require investigation; no force option is available.',
+      'REPOSITORY_CONFLICT'
+    );
+    fail(
+      'Delivery stopped. Check verification, configured provider access, supported delivery policy and delivery status. An uncertain operation requires delivery reconcile before retry.',
+      'REPOSITORY_CONFLICT'
+    );
+  }
+  const incomplete = deliveryOutcomeIncomplete(subcommand, result);
+  if (flags.json) dependencies.output.json({ ok: !incomplete, result });
+  else {
+    if (result.trackerStatus) {
+      dependencies.output.log(`Tracker: ${result.trackerStatus.target.issueUrl}\nCurrent status: ${result.trackerStatus.current.name}`);
+      for (const choice of result.trackerStatus.destinations) dependencies.output.log(`${choice.state.name} (${choice.name}; ${choice.state.type})${choice.eligible ? '' : ' - unavailable: requires fields or screen'}`);
+    }
+    if (result.reviewUpdateNoop) dependencies.output.log('The review already has the requested title and body. No write was sent.');
+    if (result.trackerTransitionNoop) dependencies.output.log('The selected destination is already current. No write was sent and no transition receipt was created.');
+    dependencies.output.log(`Recorded delivery stage: ${result.stage}`);
+    dependencies.output.log(`Run: ${result.candidate.runId}`);
+    dependencies.output.log(`Repository: ${result.candidate.repository.url}`);
+    dependencies.output.log(`Commit: ${result.candidate.headSha}`);
+    dependencies.output.log(
+      incomplete
+        ? 'Outcome is not confirmed. Run rivet delivery reconcile; do not repeat the write.'
+        : 'Status records confirmed stages. Delivery writes require configured provider support and interactive approval.'
+    );
+  }
+  return incomplete ? EXIT_CODES.PROVIDER_UNAVAILABLE : EXIT_CODES.SUCCESS;
+}
+
+export function deliveryOutcomeIncomplete(subcommand, result) {
+  if (subcommand === 'review-update' && result.reviewUpdateNoop) return false;
+  if (subcommand === 'tracker-transition' && result.trackerTransitionNoop) return false;
+  if (subcommand === 'tracker-status') return false;
+  if (!['publish', 'review', 'review-update', 'merge', 'deploy', 'tracker-update', 'tracker-status', 'tracker-transition', 'reconcile'].includes(subcommand)) return false;
+  if (result.operations.some(op => ['dispatching', 'indeterminate'].includes(op.state))) return true;
+  if (subcommand === 'reconcile') return false;
+  const action = subcommand === 'publish' ? 'branch-publish' : subcommand === 'review' ? 'review-request' : subcommand;
+  const alreadyPublished = subcommand === 'publish' && result.observation?.publication?.remoteSha === result.candidate.headSha;
+  return !alreadyPublished && !result.operations.some(op => op.action === action && op.state === 'succeeded');
+}

package/src/commands/dependency-approval.js

@@ -0,0 +1,21 @@
+function visible(value) {
+  return String(value).replace(/[\u0000-\u001f\u007f-\u009f]/g, character =>
+    `\\u${character.codePointAt(0).toString(16).padStart(4, '0')}`);
+}
+
+export function confirmIsolatedDependencyInstall(dependencies, signal) {
+  return plan => {
+    if (plan.kind === 'portable') {
+      dependencies.output.log(`Prepare project dependencies in ${visible(plan.worktreePath)}?`);
+      dependencies.output.log(`Approved checkout: ${visible(plan.expectedBranch)} at ${visible(plan.expectedCommit)}`);
+      for (const input of plan.inputs) dependencies.output.log(`Input: ${visible(input.path)} sha256=${input.sha256}`);
+      for (const step of plan.steps) dependencies.output.log(`Command in ${visible(step.cwd)}: ${JSON.stringify(step.argv)}`);
+      dependencies.output.log('These exact project commands may execute dependency code. Approval is not a filesystem sandbox.');
+      return dependencies.confirmDependencyInstall(plan, { signal });
+    }
+    dependencies.output.log(`Install locked dependencies in ${visible(plan.worktreePath)}?`);
+    dependencies.output.log(`Command: ${visible(plan.executable)} ${plan.args.map(visible).join(' ')}`);
+    dependencies.output.log('Package installation may run scripts supplied by the project or its dependencies.');
+    return dependencies.confirmDependencyInstall(plan, { signal });
+  };
+}

package/src/commands/doctor.js

@@ -0,0 +1,191 @@
+import { createIntegrationRegistry } from '../integrations/registry.js';
+import { resolve } from 'node:path';
+
+import { EXIT_CODES } from '../cli/output.js';
+import { inspectCommandReadiness } from '../config/command-readiness.js';
+import { commandToolKey, compileProjectDependencies, compileQualitySteps } from '../config/commands.js';
+import { loadProjectConfig, providerCredentialStatus } from '../config/load.js';
+import { discoverTools } from '../discovery/tools.js';
+import { verifyCommandExecutable } from '../policy/commands.js';
+
+function emit(output, json, payload, exitCode) {
+  if (json) {
+    output.json(payload, exitCode === EXIT_CODES.SUCCESS ? 'stdout' : 'stderr');
+  } else if (exitCode === EXIT_CODES.SUCCESS) {
+    output.log(`Doctor: ${payload.status}. ${payload.summary}`);
+  } else {
+    output.error(`Doctor: ${payload.status}. ${payload.summary}`);
+    for(const step of payload.checks?.commands?.steps??[]) {
+      if(!step.available) output.error(`  ${step.id}: ${step.status}; command ${JSON.stringify(step.argv)} in ${JSON.stringify(step.cwd)}. Check the executable on PATH and the configured project command.`);
+    }
+  }
+  return exitCode;
+}
+
+function requiredToolReady(tool) {
+  return tool?.present === true
+    && typeof tool.version === 'string'
+    && tool.version.length > 0
+    && tool.supported === true;
+}
+
+async function boundedProbe(probe, provider, timeoutMs) {
+  let timer;
+  try {
+    return await Promise.race([
+      probe(provider),
+      new Promise(resolvePromise => {
+        timer = setTimeout(() => resolvePromise({ status: 'timeout' }), timeoutMs);
+      }),
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+async function providerChecks(config, probe, timeoutMs = 3_000) {
+  const checks = [];
+  for (const provider of config.providers.providers) {
+    if (provider.projectIds?.length && !provider.projectIds.includes(config.project.id)) {
+      checks.push({ id: provider.id, readiness: 'out-of-scope', connectivity: 'not_checked' });
+      continue;
+    }
+    if (provider.transport && provider.transport !== 'direct-api') {
+      checks.push({ id: provider.id, readiness: 'host-or-local', connectivity: 'not_checked' });
+      continue;
+    }
+    if (provider.mode === 'disabled') {
+      checks.push({ id: provider.id, readiness: 'disabled', connectivity: 'not_checked' });
+      continue;
+    }
+    if (typeof probe !== 'function') {
+      checks.push({ id: provider.id, readiness: 'configured', connectivity: 'not_checked' });
+      continue;
+    }
+    try {
+      const result = await boundedProbe(probe, {
+        id: provider.id,
+        kind: provider.kind,
+        endpoint: provider.endpoint,
+      }, timeoutMs);
+      const connectivity = result?.status === 'available' ? 'available'
+        : result?.status === 'timeout' ? 'timeout' : 'unavailable';
+      checks.push({ id: provider.id, readiness: connectivity === 'available' ? 'ready' : 'unavailable', connectivity });
+    } catch {
+      checks.push({ id: provider.id, readiness: 'unavailable', connectivity: 'error' });
+    }
+  }
+  return checks;
+}
+
+export async function diagnoseDoctor(projectRoot, dependencies = {}) {
+  let config;
+  try {
+    config = await (dependencies.configLoader ?? loadProjectConfig)(projectRoot, { fs: dependencies.fs });
+  } catch {
+    return {
+      ok: false,
+      status: 'fail',
+      exitCode: EXIT_CODES.MISSING_CONFIGURATION,
+      error: {
+        code: 'MISSING_CONFIGURATION',
+        exitCode: EXIT_CODES.MISSING_CONFIGURATION,
+        message: 'Project configuration is missing or invalid.',
+      },
+      checks: { configuration: { status: 'fail' } },
+      summary: 'Project configuration is missing or invalid.',
+    };
+  }
+  const environment = dependencies.env ?? process.env;
+  const packageManager = config.project.stack.packageManager;
+  const direct=config.project.schemaVersion===3;
+  const commandSteps = compileQualitySteps(config);
+  const dependencyPlan = compileProjectDependencies(config.project);
+  const executableSteps = [...commandSteps, ...(dependencyPlan?.steps ?? [])];
+  const managers = [...new Set([
+    ...(direct ? [] : [packageManager]),
+    ...executableSteps.map(step => direct ? step.argv[0] : step.argv[0].toLowerCase().replace(/\.(?:cmd|exe)$/, '')),
+  ])];
+  const toolDiscovery = dependencies.toolDiscovery ?? discoverTools;
+  const reports = direct ? [await toolDiscovery({runtimeOnly:true},{cwd:projectRoot,runner:dependencies.runner})] : await Promise.all(managers.map(manager => toolDiscovery({ packageManager: manager }, {
+    cwd: projectRoot,
+    runner: dependencies.runner,
+  })));
+  let tools = Object.freeze({
+    ...reports[0],
+    ...(!direct ? Object.fromEntries(managers.map((manager, index) => [manager, reports[index]?.[manager] ?? {}])) : {}),
+  });
+  if (typeof dependencies.resolveCommandExecutable === 'function') {
+    const entries = direct ? [...new Map(executableSteps.map(step => [
+      commandToolKey(step.argv[0], step.cwd), { runner: step.argv[0], cwd: step.cwd },
+    ])).entries()] : managers.map(manager => [manager, { runner: manager, cwd: '.' }]);
+    const resolutions = await Promise.all(entries.map(async ([key, step]) => {
+      let runtimeResolved = false;
+      try {
+        const executable = await dependencies.resolveCommandExecutable(step.runner, direct
+          ? { execution: 'argv', worktree: projectRoot, cwd: step.cwd } : {});
+        await verifyCommandExecutable(executable, direct ? { execution: 'argv' } : {});
+        runtimeResolved = true;
+      } catch {}
+      return [key, Object.freeze({ ...(tools[key] ?? {}), runtimeResolved })];
+    }));
+    tools = Object.freeze({ ...tools, ...Object.fromEntries(resolutions) });
+  }
+  const credentials = dependencies.hostReadiness === true ? [] : providerCredentialStatus(config, environment);
+  const providers = dependencies.hostReadiness === true ? [] : await providerChecks(
+    config,
+    dependencies.providerProbe,
+    dependencies.providerProbeTimeoutMs,
+  );
+  const commands = inspectCommandReadiness(projectRoot, config, { fs: dependencies.fs, tools });
+  const missingCredentials = credentials.filter(item => item.required && !item.present);
+  const unavailableProviders = providers.filter(item => ['unavailable', 'timeout', 'error'].includes(item.connectivity));
+  const toolsReady = requiredToolReady(tools.node)
+    && (direct || managers.every(manager => requiredToolReady(tools[manager]) && tools[manager].runtimeResolved !== false))
+    && requiredToolReady(tools.git);
+  const otherFailure = missingCredentials.length > 0 || unavailableProviders.length > 0 || !toolsReady;
+  const preparationReady = !otherFailure && commands.preparationReady === true;
+  const preparationRequired = preparationReady && !commands.ready;
+  const failed = otherFailure || (!commands.ready && !preparationReady)
+    || commands.dependencies?.preparationReady === false;
+  const exitCode = missingCredentials.length > 0 || unavailableProviders.length > 0
+    ? EXIT_CODES.PROVIDER_UNAVAILABLE
+    : failed ? EXIT_CODES.FAILED_GATE : EXIT_CODES.SUCCESS;
+  return {
+    ok: !failed,
+    preparationReady,
+    status: failed ? 'fail' : preparationRequired ? 'preparation-required' : providers.some(item => item.connectivity === 'not_checked') ? 'warn' : 'pass',
+    exitCode,
+    checks: {
+      configuration: { status: 'pass' },
+      tools,
+      credentials,
+      providers,
+      commands,
+      integrations: createIntegrationRegistry({config,projectId:config.project.id,environment,host:dependencies.integrationHost}).check(),
+    },
+    summary: failed ? 'One or more readiness checks failed.' : preparationRequired
+      ? 'Configured dependencies require installation in the isolated checkout after approval. Quality commands have not run; use rivet task deps once the checkout exists.'
+      : 'Configuration and local readiness checks completed.',
+  };
+}
+
+export async function doctor(parsed, dependencies = {}) {
+  const json = parsed.flags.json === true;
+  const projectRoot = resolve(parsed.flags.project ?? dependencies.cwd?.() ?? process.cwd());
+  try {
+    const result = await diagnoseDoctor(projectRoot, dependencies);
+    return emit(dependencies.output, json, result, result.exitCode);
+  } catch {
+    return emit(dependencies.output, json, {
+      ok: false,
+      status: 'fail',
+      summary: 'Doctor could not complete safely.',
+      error: {
+        code: 'INTERNAL_ERROR',
+        exitCode: EXIT_CODES.INTERNAL_ERROR,
+        message: 'Doctor could not complete safely.',
+      },
+    }, EXIT_CODES.INTERNAL_ERROR);
+  }
+}

package/src/commands/evidence.js

@@ -0,0 +1,44 @@
+import { CliError, EXIT_CODES } from '../cli/output.js';
+import { collectEvidenceBundle } from '../evidence/collect.js';
+
+export async function createEvidence(input) {
+  const bundle = await collectEvidenceBundle(input);
+  return Object.freeze({
+    ok: true,
+    status: bundle.manifest.status,
+    bundle,
+  });
+}
+
+export async function evidenceCommand(parsed, dependencies = {}) {
+  if (!parsed || parsed.command !== 'evidence' || parsed.subcommand !== null
+    || !Array.isArray(parsed.operands) || parsed.operands.length !== 0
+    || !parsed.flags || Reflect.ownKeys(parsed.flags).some(key => key !== 'json')) {
+    throw new CliError('Evidence command options are invalid.', 'INVALID_INPUT');
+  }
+  const context = dependencies.evidence;
+  if (!context || typeof context.requestFor !== 'function') {
+    throw new CliError('Evidence collection is not configured.', 'MISSING_CONFIGURATION');
+  }
+  const request = await context.requestFor(Object.freeze({ command: 'evidence' }));
+  const result = await createEvidence(request);
+  if (parsed.flags.json) {
+    dependencies.output.json({
+      ok: true,
+      command: 'evidence',
+      result: {
+        status: result.status,
+        runDirectory: result.bundle.runDirectory,
+        manifestPath: result.bundle.manifestPath,
+        manifestChecksum: result.bundle.manifestChecksum,
+        archivePath: result.bundle.archivePath,
+        archiveChecksum: result.bundle.archiveChecksum,
+        durablyPublished: result.bundle.durablyPublished,
+        publication: result.bundle.publication,
+      },
+    });
+  } else {
+    dependencies.output.log('Evidence: ' + result.status + '. Archive SHA-256: ' + result.bundle.archiveChecksum + '.');
+  }
+  return EXIT_CODES.SUCCESS;
+}