@ai-sdlc/orchestrator 0.4.0 → 0.6.0

package/dist/runners/claude-code.js

@@ -7,11 +7,33 @@ import { promisify } from 'node:util';
 import { DEFAULT_MODEL, DEFAULT_ALLOWED_TOOLS, DEFAULT_RUNNER_TIMEOUT_MS, DEFAULT_LINT_COMMAND, DEFAULT_FORMAT_COMMAND, DEFAULT_COMMIT_MESSAGE_TEMPLATE, DEFAULT_COMMIT_CO_AUTHOR, } from '../defaults.js';
 import { formatContextForPrompt } from '../analysis/context-builder.js';
 const execFileAsync = promisify(execFile);
+/**
+ * Build verification step instructions (lint, format, typecheck).
+ * Returns an array of numbered step strings starting from the given step number.
+ */
+function buildVerificationSteps(startStep, lintCmd, fmtCmd, typecheckCmd) {
+    let step = startStep;
+    const lines = [];
+    if (lintCmd && fmtCmd) {
+        lines.push(`${++step}. After making code changes, run \`${lintCmd}\` and \`${fmtCmd}\` to catch issues before committing.`);
+    }
+    else if (lintCmd) {
+        lines.push(`${++step}. After making code changes, run \`${lintCmd}\` to catch issues before committing.`);
+    }
+    else if (fmtCmd) {
+        lines.push(`${++step}. After making code changes, run \`${fmtCmd}\` to catch issues before committing.`);
+    }
+    if (typecheckCmd) {
+        lines.push(`${++step}. IMPORTANT: Run \`${typecheckCmd}\` to verify there are no TypeScript errors. The pre-commit hook will reject your commit if there are type errors. Fix ALL type errors before committing.`);
+    }
+    return { lines, nextStep: step };
+}
 export function buildPrompt(ctx) {
     const lintCmd = ctx.lintCommand ?? DEFAULT_LINT_COMMAND;
     const fmtCmd = ctx.formatCommand ?? DEFAULT_FORMAT_COMMAND;
+    const typecheckCmd = ctx.typecheckCommand;
     const lines = [
-        `You are fixing issue #${ctx.issueNumber}: ${ctx.issueTitle}`,
+        `You are fixing issue ${/^\d+$/.test(ctx.issueId) ? '#' : ''}${ctx.issueId}: ${ctx.issueTitle}`,
         '',
         '## Issue Description',
         ctx.issueBody,
@@ -23,35 +45,31 @@ export function buildPrompt(ctx) {
         if (fmtCmd) {
             lines.push(`${++step}. If the failure is a formatting/prettier error, run \`${fmtCmd}\` to auto-fix it.`);
         }
-        if (lintCmd && fmtCmd) {
-            lines.push(`${++step}. After making ANY code changes, always run \`${lintCmd}\` and \`${fmtCmd}\` to catch issues before committing.`);
-        }
-        else if (lintCmd) {
-            lines.push(`${++step}. After making ANY code changes, always run \`${lintCmd}\` to catch issues before committing.`);
-        }
-        else if (fmtCmd) {
-            lines.push(`${++step}. After making ANY code changes, always run \`${fmtCmd}\` to catch issues before committing.`);
-        }
+        const ciVerify = buildVerificationSteps(step, lintCmd, fmtCmd, typecheckCmd);
+        lines.push(...ciVerify.lines);
+        step = ciVerify.nextStep;
         lines.push(`${++step}. Write or update tests if needed to cover your fix.`, `${++step}. NEVER modify files matching the blocked paths below — violations will be automatically detected and the change will be rejected.`, `${++step}. Keep your changes to at most ${ctx.constraints.maxFilesPerChange} files.`);
     }
+    else if (ctx.reviewFindings) {
+        let step = 0;
+        lines.push('## Review Findings', '', ctx.reviewFindings, '', '## Instructions', `${++step}. Read the review findings above carefully.`, `${++step}. Read the relevant source files to understand the context.`, `${++step}. Address all the review findings by making necessary code changes.`, `${++step}. Write or update tests if requested by the reviewers.`);
+        const reviewVerify = buildVerificationSteps(step, lintCmd, fmtCmd, typecheckCmd);
+        lines.push(...reviewVerify.lines);
+        step = reviewVerify.nextStep;
+        lines.push(`${++step}. NEVER modify files matching the blocked paths below — violations will be automatically detected and the change will be rejected.`, `${++step}. Keep your changes to at most ${ctx.constraints.maxFilesPerChange} files.`);
+    }
     else {
         let step = 0;
         lines.push('## Instructions', `${++step}. Read the relevant source files to understand the codebase.`, `${++step}. Implement the fix or feature described in the issue.`, `${++step}. Write or update tests to cover your changes.`);
-        if (lintCmd && fmtCmd) {
-            lines.push(`${++step}. After making code changes, run \`${lintCmd}\` and \`${fmtCmd}\` to ensure CI will pass.`);
-        }
-        else if (lintCmd) {
-            lines.push(`${++step}. After making code changes, run \`${lintCmd}\` to ensure CI will pass.`);
-        }
-        else if (fmtCmd) {
-            lines.push(`${++step}. After making code changes, run \`${fmtCmd}\` to ensure CI will pass.`);
-        }
+        const defaultVerify = buildVerificationSteps(step, lintCmd, fmtCmd, typecheckCmd);
+        lines.push(...defaultVerify.lines);
+        step = defaultVerify.nextStep;
         lines.push(`${++step}. NEVER modify files matching the blocked paths below — violations will be automatically detected and the change will be rejected.`, `${++step}. Keep your changes to at most ${ctx.constraints.maxFilesPerChange} files.`);
     }
     lines.push('', '## Constraints (enforced — violations will be automatically rejected)', `- Maximum files to change: ${ctx.constraints.maxFilesPerChange}`, `- Tests required: ${ctx.constraints.requireTests}`, `- Blocked paths (NEVER modify — changes will be rejected): ${ctx.constraints.blockedPaths.join(', ') || 'none'}`);
     // Append relevant episodic memory if available
     if (ctx.memory) {
-        const episodes = ctx.memory.episodic.search(`issue-${ctx.issueNumber}`);
+        const episodes = ctx.memory.episodic.search(`issue-${ctx.issueId}`);
         if (episodes.length > 0) {
             lines.push('', '## Previous Context');
             for (const ep of episodes.slice(0, 5)) {
@@ -76,32 +94,276 @@ async function gitExec(workDir, args) {
     const { stdout } = await execFileAsync('git', args, { cwd: workDir });
     return stdout.trim();
 }
+/**
+ * Format a stream-json event into a concise, human-readable log line.
+ */
+function formatEventForLog(line) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    const type = parsed.type;
+    if (type === 'system') {
+        return `init session=${parsed.session_id?.slice(0, 8)}`;
+    }
+    if (type === 'assistant') {
+        const message = parsed.message;
+        const content = message?.content;
+        if (!content?.length)
+            return null;
+        const parts = [];
+        for (const block of content) {
+            if (block.type === 'thinking') {
+                const text = String(block.thinking ?? '');
+                parts.push(`thinking: ${text.slice(0, 120)}${text.length > 120 ? '...' : ''}`);
+            }
+            else if (block.type === 'text') {
+                const text = String(block.text ?? '');
+                parts.push(`text: ${text.slice(0, 120)}${text.length > 120 ? '...' : ''}`);
+            }
+            else if (block.type === 'tool_use') {
+                const name = String(block.name ?? '');
+                const input = (block.input ?? {});
+                const file = extractFilePath(input);
+                parts.push(file ? `${name}: ${file}` : name);
+            }
+        }
+        return parts.join(' | ');
+    }
+    if (type === 'user') {
+        const message = parsed.message;
+        const content = message?.content;
+        if (!content?.length)
+            return null;
+        const block = content[0];
+        if (block.type === 'tool_result') {
+            const text = String(block.content ?? '');
+            const truncated = text.slice(0, 80);
+            return `result: ${truncated}${text.length > 80 ? '...' : ''}`;
+        }
+        return null;
+    }
+    if (type === 'result') {
+        const cost = parsed.total_cost_usd;
+        const turns = parsed.num_turns;
+        const duration = parsed.duration_ms;
+        return `done — ${turns ?? '?'} turns, ${duration ? Math.round(duration / 1000) + 's' : '?'}, $${cost?.toFixed(4) ?? '?'}`;
+    }
+    return null;
+}
+/**
+ * Extract a file path from a tool_use input object.
+ */
+function extractFilePath(input) {
+    return ((typeof input.file_path === 'string' ? input.file_path : undefined) ??
+        (typeof input.path === 'string' ? input.path : undefined) ??
+        (typeof input.pattern === 'string' ? input.pattern : undefined) ??
+        (typeof input.command === 'string' ? input.command.slice(0, 80) : undefined));
+}
+/**
+ * Parse a single NDJSON line from Claude Code stream-json output
+ * and emit a progress event if applicable.
+ */
+function parseStreamEvent(line, onProgress) {
+    let parsed;
+    try {
+        parsed = JSON.parse(line);
+    }
+    catch {
+        return undefined;
+    }
+    const type = parsed.type;
+    if (type === 'assistant') {
+        const message = parsed.message;
+        const content = message?.content;
+        if (!content)
+            return undefined;
+        for (const block of content) {
+            if (block.type === 'tool_use') {
+                const toolName = String(block.name ?? '');
+                const input = (block.input ?? {});
+                const filePath = extractFilePath(input);
+                onProgress({
+                    type: 'tool_start',
+                    tool: toolName,
+                    file: filePath,
+                    message: filePath ? `${toolName}: ${filePath}` : toolName,
+                });
+            }
+            else if (block.type === 'text') {
+                const text = String(block.text ?? '');
+                if (text.length > 0) {
+                    onProgress({
+                        type: 'text',
+                        message: text.slice(0, 200),
+                    });
+                }
+            }
+        }
+    }
+    if (type === 'result') {
+        const resultText = parsed.result;
+        const costUsd = parsed.total_cost_usd;
+        // Extract token usage from result event
+        const modelUsage = parsed.modelUsage;
+        let tokenUsage;
+        if (modelUsage) {
+            const firstModel = Object.keys(modelUsage)[0];
+            if (firstModel) {
+                const usage = modelUsage[firstModel];
+                tokenUsage = {
+                    inputTokens: usage.inputTokens ?? 0,
+                    outputTokens: usage.outputTokens ?? 0,
+                    cacheReadTokens: usage.cacheReadInputTokens ?? undefined,
+                    model: firstModel,
+                };
+            }
+        }
+        if (costUsd !== undefined) {
+            onProgress({ type: 'cost', costUsd, message: `Total cost: $${costUsd.toFixed(4)}` });
+        }
+        return { resultText: resultText ?? undefined, costUsd, tokenUsage };
+    }
+    return undefined;
+}
 function runClaude(prompt, workDir, opts) {
     const tools = opts?.allowedTools?.join(',') ?? DEFAULT_ALLOWED_TOOLS;
     const timeoutMs = opts?.timeoutMs ?? DEFAULT_RUNNER_TIMEOUT_MS;
     return new Promise((resolve, reject) => {
         const model = opts?.model ?? process.env.AI_SDLC_MODEL ?? DEFAULT_MODEL;
-        const child = spawn('claude', ['-p', '--model', model, '--allowedTools', tools], {
+        const claudeArgs = [
+            '-p',
+            '--output-format',
+            'stream-json',
+            '--verbose',
+            '--model',
+            model,
+            '--allowedTools',
+            tools,
+        ];
+        // When running inside an OpenShell sandbox, prefix with sandbox connect.
+        const useOpenShell = opts?.sandboxId && process.env.AI_SDLC_SANDBOX_PROVIDER === 'openshell';
+        let cmd;
+        let args;
+        if (useOpenShell) {
+            cmd = 'openshell';
+            args = ['sandbox', 'connect', opts.sandboxId, '--', 'claude', ...claudeArgs];
+        }
+        else {
+            cmd = 'claude';
+            args = claudeArgs;
+        }
+        const startTime = Date.now();
+        const logPrefix = `[ai-sdlc:runner]`;
+        process.stderr.write(`${logPrefix} spawning: ${cmd} ${args.join(' ')}\n`);
+        process.stderr.write(`${logPrefix} workDir: ${workDir}\n`);
+        process.stderr.write(`${logPrefix} timeout: ${timeoutMs}ms\n`);
+        const child = spawn(cmd, args, {
             cwd: workDir,
             stdio: ['pipe', 'pipe', 'pipe'],
             env: { ...process.env },
             timeout: timeoutMs,
         });
-        const chunks = [];
+        process.stderr.write(`${logPrefix} pid: ${child.pid}\n`);
+        let lastActivity = Date.now();
+        let resultText;
+        let resultCost;
+        let resultTokenUsage;
+        // Buffer for incomplete NDJSON lines
+        let lineBuffer = '';
+        const onProgress = opts?.onProgress;
+        child.stdout.on('data', (data) => {
+            lastActivity = Date.now();
+            // Parse NDJSON lines from stream-json output
+            lineBuffer += data.toString('utf-8');
+            const lines = lineBuffer.split('\n');
+            // Keep the last (possibly incomplete) line in the buffer
+            lineBuffer = lines.pop() ?? '';
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed)
+                    continue;
+                // Log formatted events to stderr for CI visibility
+                const formatted = formatEventForLog(trimmed);
+                if (formatted) {
+                    process.stderr.write(`${logPrefix} ${formatted}\n`);
+                }
+                if (onProgress) {
+                    const result = parseStreamEvent(trimmed, onProgress);
+                    if (result) {
+                        if (result.resultText !== undefined)
+                            resultText = result.resultText;
+                        if (result.costUsd !== undefined)
+                            resultCost = result.costUsd;
+                        if (result.tokenUsage)
+                            resultTokenUsage = result.tokenUsage;
+                    }
+                }
+                else {
+                    // Still parse result event even without progress callback
+                    try {
+                        const parsed = JSON.parse(trimmed);
+                        if (parsed.type === 'result') {
+                            resultText = parsed.result;
+                            resultCost = parsed.total_cost_usd;
+                            const modelUsage = parsed.modelUsage;
+                            if (modelUsage) {
+                                const firstModel = Object.keys(modelUsage)[0];
+                                if (firstModel) {
+                                    const usage = modelUsage[firstModel];
+                                    resultTokenUsage = {
+                                        inputTokens: usage.inputTokens ?? 0,
+                                        outputTokens: usage.outputTokens ?? 0,
+                                        cacheReadTokens: usage.cacheReadInputTokens ?? undefined,
+                                        model: firstModel,
+                                    };
+                                }
+                            }
+                        }
+                    }
+                    catch {
+                        // Not JSON — ignore
+                    }
+                }
+            }
+        });
         const errChunks = [];
-        child.stdout.on('data', (data) => chunks.push(data));
-        child.stderr.on('data', (data) => errChunks.push(data));
+        child.stderr.on('data', (data) => {
+            errChunks.push(data);
+            lastActivity = Date.now();
+            process.stderr.write(data);
+        });
+        // Heartbeat: log progress every 30s so CI knows the process is alive
+        const heartbeat = setInterval(() => {
+            const elapsed = Math.round((Date.now() - startTime) / 1000);
+            const idle = Math.round((Date.now() - lastActivity) / 1000);
+            process.stderr.write(`${logPrefix} heartbeat: ${elapsed}s elapsed, ${idle}s idle\n`);
+        }, 30_000);
         child.on('close', (code) => {
-            const stdout = Buffer.concat(chunks).toString('utf-8');
+            clearInterval(heartbeat);
+            const elapsed = Math.round((Date.now() - startTime) / 1000);
             const stderr = Buffer.concat(errChunks).toString('utf-8');
+            process.stderr.write(`${logPrefix} exited: code=${code} elapsed=${elapsed}s\n`);
             if (code === 0) {
-                resolve({ stdout, stderr, model });
+                resolve({
+                    stdout: resultText ?? '',
+                    stderr,
+                    model: resultTokenUsage?.model ?? model,
+                    costUsd: resultCost,
+                });
             }
             else {
-                reject(new Error(`claude exited with code ${code}: ${stderr || stdout}`));
+                reject(new Error(`claude exited with code ${code}: ${stderr || resultText || ''}`));
             }
         });
-        child.on('error', reject);
+        child.on('error', (err) => {
+            clearInterval(heartbeat);
+            process.stderr.write(`${logPrefix} spawn error: ${err.message}\n`);
+            reject(err);
+        });
         // Send prompt via stdin and close it
         child.stdin.write(prompt);
         child.stdin.end();
@@ -137,29 +399,76 @@ export function parseTokenUsage(stderr, model) {
     }
     return undefined;
 }
+/**
+ * Run lint --fix and format commands (best-effort) so pre-commit hooks pass.
+ */
+async function runAutoFix(workDir, lintCmd, fmtCmd) {
+    if (fmtCmd) {
+        try {
+            const [bin, ...args] = fmtCmd.split(' ');
+            await execFileAsync(bin, args, { cwd: workDir });
+        }
+        catch {
+            // Format failures are non-fatal — the commit hook will catch remaining issues
+        }
+    }
+    if (lintCmd) {
+        try {
+            const [bin, ...args] = lintCmd.split(' ');
+            await execFileAsync(bin, args, { cwd: workDir });
+        }
+        catch {
+            // Lint --fix failures are non-fatal
+        }
+    }
+}
 export class ClaudeCodeRunner {
     async run(ctx) {
         const prompt = buildPrompt(ctx);
         try {
-            // Invoke Claude Code CLI in print mode, sending prompt via stdin
+            // Invoke Claude Code CLI with stream-json for real-time progress
             const result = await runClaude(prompt, ctx.workDir, {
                 allowedTools: ctx.allowedTools,
                 timeoutMs: ctx.timeoutMs,
                 model: ctx.model,
+                sandboxId: ctx.sandboxId,
+                onProgress: ctx.onProgress,
             });
-            // Parse token usage from stderr
+            // Token usage from stream-json result event (falls back to stderr parsing)
             const tokenUsage = parseTokenUsage(result.stderr, result.model);
-            // Collect changed files
+            // Collect changed files — check both uncommitted and already-committed changes
+            // The agent may have committed on its own (Claude Code can run git commit)
             const diffOutput = await gitExec(ctx.workDir, ['diff', '--name-only']);
             const untrackedOutput = await gitExec(ctx.workDir, [
                 'ls-files',
                 '--others',
                 '--exclude-standard',
             ]);
-            const filesChanged = [
+            const uncommittedFiles = [
                 ...diffOutput.split('\n').filter(Boolean),
                 ...untrackedOutput.split('\n').filter(Boolean),
             ];
+            // Check if agent already committed (and possibly pushed) —
+            // compare against the merge base with the target branch (main)
+            let committedFiles = [];
+            let agentAlreadyCommitted = false;
+            try {
+                // Find the merge base with main to see all new commits on this branch
+                const mergeBase = (await gitExec(ctx.workDir, ['merge-base', 'HEAD', 'origin/main'])).trim();
+                if (mergeBase) {
+                    const commitDiff = await gitExec(ctx.workDir, [
+                        'diff',
+                        '--name-only',
+                        `${mergeBase}..HEAD`,
+                    ]);
+                    committedFiles = commitDiff.split('\n').filter(Boolean);
+                    agentAlreadyCommitted = committedFiles.length > 0 && uncommittedFiles.length === 0;
+                }
+            }
+            catch {
+                // merge-base may fail if main doesn't exist locally — that's fine
+            }
+            const filesChanged = agentAlreadyCommitted ? committedFiles : uncommittedFiles;
             if (filesChanged.length === 0) {
                 return {
                     success: false,
@@ -169,14 +478,37 @@ export class ClaudeCodeRunner {
                     tokenUsage,
                 };
             }
-            // Stage and commit
+            // If the agent already committed, skip our commit step
+            if (agentAlreadyCommitted) {
+                return {
+                    success: true,
+                    filesChanged,
+                    summary: result.stdout.slice(0, 2000),
+                    tokenUsage,
+                };
+            }
+            // Stage, lint/format, and commit
+            await gitExec(ctx.workDir, ['add', '-A']);
+            // Run lint and format before committing to avoid pre-commit hook failures
+            const lintCmd = ctx.lintCommand ?? DEFAULT_LINT_COMMAND;
+            const fmtCmd = ctx.formatCommand ?? DEFAULT_FORMAT_COMMAND;
+            await runAutoFix(ctx.workDir, lintCmd, fmtCmd);
+            // Re-stage after auto-fix may have modified files
             await gitExec(ctx.workDir, ['add', '-A']);
             const tmpl = ctx.commitMessageTemplate ?? DEFAULT_COMMIT_MESSAGE_TEMPLATE;
             const coAuthor = ctx.commitCoAuthor ?? DEFAULT_COMMIT_CO_AUTHOR;
             const commitMsg = tmpl
-                .replace(/\{issueNumber\}/g, String(ctx.issueNumber))
+                .replace(/\{issueNumber\}/g, ctx.issueId)
                 .replace(/\{issueTitle\}/g, ctx.issueTitle);
-            await gitExec(ctx.workDir, ['commit', '-m', `${commitMsg}\n\nCo-Authored-By: ${coAuthor}`]);
+            try {
+                await gitExec(ctx.workDir, ['commit', '-m', `${commitMsg}\n\nCo-Authored-By: ${coAuthor}`]);
+            }
+            catch {
+                // Pre-commit hook may have auto-fixed files — re-stage and retry once
+                await runAutoFix(ctx.workDir, lintCmd, fmtCmd);
+                await gitExec(ctx.workDir, ['add', '-A']);
+                await gitExec(ctx.workDir, ['commit', '-m', `${commitMsg}\n\nCo-Authored-By: ${coAuthor}`]);
+            }
             return {
                 success: true,
                 filesChanged,

package/dist/runners/codex.js

@@ -73,12 +73,23 @@ export class CodexRunner {
         const timeoutMs = ctx.timeoutMs ?? DEFAULT_RUNNER_TIMEOUT_MS;
         const model = DEFAULT_CODEX_MODEL ?? 'codex-default';
         try {
-            const args = ['exec', '-', '--full-auto', '--json'];
+            const codexArgs = ['exec', '-', '--full-auto', '--json'];
             if (DEFAULT_CODEX_MODEL) {
-                args.push('-m', DEFAULT_CODEX_MODEL);
+                codexArgs.push('-m', DEFAULT_CODEX_MODEL);
+            }
+            // When running inside an OpenShell sandbox, prefix with sandbox connect
+            let cmd;
+            let args;
+            if (ctx.sandboxId) {
+                cmd = 'openshell';
+                args = ['sandbox', 'connect', ctx.sandboxId, '--', 'codex', ...codexArgs];
+            }
+            else {
+                cmd = 'codex';
+                args = codexArgs;
             }
             const { stdout, stderr } = await new Promise((resolve, reject) => {
-                const child = spawn('codex', args, {
+                const child = spawn(cmd, args, {
                     cwd: ctx.workDir,
                     stdio: ['pipe', 'pipe', 'pipe'],
                     env: { ...process.env },
@@ -129,7 +140,7 @@ export class CodexRunner {
             const tmpl = ctx.commitMessageTemplate ?? DEFAULT_COMMIT_MESSAGE_TEMPLATE;
             const coAuthor = ctx.commitCoAuthor ?? DEFAULT_COMMIT_CO_AUTHOR;
             const commitMsg = tmpl
-                .replace(/\{issueNumber\}/g, String(ctx.issueNumber))
+                .replace(/\{issueNumber\}/g, ctx.issueId)
                 .replace(/\{issueTitle\}/g, ctx.issueTitle);
             await gitExec(ctx.workDir, ['commit', '-m', `${commitMsg}\n\nCo-Authored-By: ${coAuthor}`]);
             return {

package/dist/runners/copilot.js

@@ -42,12 +42,23 @@ export class CopilotRunner {
         const timeoutMs = ctx.timeoutMs ?? DEFAULT_RUNNER_TIMEOUT_MS;
         const model = DEFAULT_COPILOT_MODEL ?? 'copilot-default';
         try {
-            const args = ['-p', prompt, '--yolo'];
+            const copilotArgs = ['-p', prompt, '--yolo'];
             if (DEFAULT_COPILOT_MODEL) {
-                args.push('--model', DEFAULT_COPILOT_MODEL);
+                copilotArgs.push('--model', DEFAULT_COPILOT_MODEL);
+            }
+            // When running inside an OpenShell sandbox, prefix with sandbox connect
+            let cmd;
+            let args;
+            if (ctx.sandboxId) {
+                cmd = 'openshell';
+                args = ['sandbox', 'connect', ctx.sandboxId, '--', 'copilot', ...copilotArgs];
+            }
+            else {
+                cmd = 'copilot';
+                args = copilotArgs;
             }
             const { stdout, stderr } = await new Promise((resolve, reject) => {
-                const child = spawn('copilot', args, {
+                const child = spawn(cmd, args, {
                     cwd: ctx.workDir,
                     stdio: ['ignore', 'pipe', 'pipe'],
                     env: { ...process.env },
@@ -95,7 +106,7 @@ export class CopilotRunner {
             const tmpl = ctx.commitMessageTemplate ?? DEFAULT_COMMIT_MESSAGE_TEMPLATE;
             const coAuthor = ctx.commitCoAuthor ?? DEFAULT_COMMIT_CO_AUTHOR;
             const commitMsg = tmpl
-                .replace(/\{issueNumber\}/g, String(ctx.issueNumber))
+                .replace(/\{issueNumber\}/g, ctx.issueId)
                 .replace(/\{issueTitle\}/g, ctx.issueTitle);
             await gitExec(ctx.workDir, ['commit', '-m', `${commitMsg}\n\nCo-Authored-By: ${coAuthor}`]);
             return {

package/dist/runners/cursor.js

@@ -62,12 +62,23 @@ export class CursorRunner {
         const timeoutMs = ctx.timeoutMs ?? DEFAULT_RUNNER_TIMEOUT_MS;
         const model = DEFAULT_CURSOR_MODEL ?? 'cursor-default';
         try {
-            const args = ['--print', prompt, '--force', '--output-format=stream-json'];
+            const cursorArgs = ['--print', prompt, '--force', '--output-format=stream-json'];
             if (DEFAULT_CURSOR_MODEL) {
-                args.push('-m', DEFAULT_CURSOR_MODEL);
+                cursorArgs.push('-m', DEFAULT_CURSOR_MODEL);
+            }
+            // When running inside an OpenShell sandbox, prefix with sandbox connect
+            let cmd;
+            let args;
+            if (ctx.sandboxId) {
+                cmd = 'openshell';
+                args = ['sandbox', 'connect', ctx.sandboxId, '--', 'cursor-agent', ...cursorArgs];
+            }
+            else {
+                cmd = 'cursor-agent';
+                args = cursorArgs;
             }
             const { stdout, stderr } = await new Promise((resolve, reject) => {
-                const child = spawn('cursor-agent', args, {
+                const child = spawn(cmd, args, {
                     cwd: ctx.workDir,
                     stdio: ['ignore', 'pipe', 'pipe'],
                     env: { ...process.env },
@@ -116,7 +127,7 @@ export class CursorRunner {
             const tmpl = ctx.commitMessageTemplate ?? DEFAULT_COMMIT_MESSAGE_TEMPLATE;
             const coAuthor = ctx.commitCoAuthor ?? DEFAULT_COMMIT_CO_AUTHOR;
             const commitMsg = tmpl
-                .replace(/\{issueNumber\}/g, String(ctx.issueNumber))
+                .replace(/\{issueNumber\}/g, ctx.issueId)
                 .replace(/\{issueTitle\}/g, ctx.issueTitle);
             await gitExec(ctx.workDir, ['commit', '-m', `${commitMsg}\n\nCo-Authored-By: ${coAuthor}`]);
             return {

package/dist/runners/generic-llm.js

@@ -52,7 +52,7 @@ export class GenericLLMRunner {
             });
         }
         const userContent = [
-            `Issue #${ctx.issueNumber}: ${ctx.issueTitle}`,
+            `Issue ${/^\d+$/.test(ctx.issueId) ? '#' : ''}${ctx.issueId}: ${ctx.issueTitle}`,
             '',
             ctx.issueBody,
             '',

package/dist/runners/index.d.ts

@@ -1,8 +1,10 @@
-export type { AgentRunner, AgentContext, AgentResult, TokenUsage } from './types.js';
+export type { AgentRunner, AgentContext, AgentResult, AgentProgressEvent, TokenUsage, } from './types.js';
 export { ClaudeCodeRunner, GitHubActionsRunner } from './claude-code.js';
 export { GenericLLMRunner, type GenericLLMConfig, type ChatCompletionResponse, } from './generic-llm.js';
 export { CopilotRunner } from './copilot.js';
 export { CursorRunner } from './cursor.js';
 export { CodexRunner } from './codex.js';
 export { RunnerRegistry, createRunnerRegistry, type RegisteredRunner } from './runner-registry.js';
+export { SecurityTriageRunner, type SecurityTriageConfig, type TriageVerdict, TRIAGE_SYSTEM_PROMPT, } from './security-triage.js';
+export { ReviewAgentRunner, REVIEW_PROMPTS, type ReviewAgentConfig, type ReviewType, type ReviewFinding, type ReviewVerdict, } from './review-agent.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/runners/index.js

@@ -4,4 +4,6 @@ export { CopilotRunner } from './copilot.js';
 export { CursorRunner } from './cursor.js';
 export { CodexRunner } from './codex.js';
 export { RunnerRegistry, createRunnerRegistry } from './runner-registry.js';
+export { SecurityTriageRunner, TRIAGE_SYSTEM_PROMPT, } from './security-triage.js';
+export { ReviewAgentRunner, REVIEW_PROMPTS, } from './review-agent.js';
 //# sourceMappingURL=index.js.map