@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.28

package/packages/azdo/scripts/probe-ado-rules.ts

@@ -0,0 +1,311 @@
+#!/usr/bin/env bun
+// probe-ado-rules.ts — verify the LIVE Azure DevOps process rules against the
+// pinned expectation (src/workflow-ladder.csv). Read-only metadata first,
+// then an empirical matrix probe of a REAL item supplied by the operator
+// (default 546): the item is reset (→ Removed → New, both verified open)
+// and walked to each ladder state, where every CSV transition for that state
+// is attempted via RAW json-patch — bypassing this repo's own fence on
+// purpose (the probe tests ADO, not us). If an expected-refused edge turns
+// out allowed and moves the item, the walk returns and continues. The item
+// is restored to its original state at the end.
+//
+// Usage: bun packages/azdo/scripts/probe-ado-rules.ts [item-id] [--metadata-only]
+import { AdoClient } from "../src/lib/client.ts";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const ORG = "amsterdamdatalabs";
+const PROJECT = "Infrastructure-AzDo";
+const ORG_API = `https://dev.azure.com/${ORG}/_apis`;
+const PROJECT_API = `https://dev.azure.com/${ORG}/${PROJECT}/_apis`;
+const ITEM_ID = Number(process.argv.find((a) => /^\d+$/.test(a)) ?? 546);
+const METADATA_ONLY = process.argv.includes("--metadata-only");
+
+interface CsvRow {
+  workItemType: string;
+  fromState: string;
+  toState: string;
+  rule: string;
+  skippedStates: string;
+  owner: string;
+  note: string;
+  observed?: string;
+}
+
+const orgClient = new AdoClient({ baseUrl: ORG_API });
+const projectClient = new AdoClient({ baseUrl: PROJECT_API });
+
+function loadExpectations(type: string): CsvRow[] {
+  const csv = readFileSync(join(import.meta.dir, "../src/workflow-ladder.csv"), "utf8");
+  const rows: CsvRow[] = [];
+  for (const line of csv.trim().split("\n").slice(1)) {
+    const [workItemType, fromState, toState, rule, skippedStates, owner, note] = line.split(",");
+    if (workItemType !== type) continue;
+    rows.push({ workItemType, fromState, toState, rule, skippedStates, owner, note });
+  }
+  return rows;
+}
+
+async function authToken(): Promise<string> {
+  const raw = projectClient as unknown as { acquireAccessToken(): Promise<string> };
+  return raw.acquireAccessToken();
+}
+
+async function patchState(id: number, state: string): Promise<{ ok: boolean; status: number; message: string }> {
+  const token = await authToken();
+  const resp = await fetch(`${PROJECT_API}/wit/workitems/${id}?api-version=7.1`, {
+    method: "PATCH",
+    headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json-patch+json" },
+    body: JSON.stringify([{ op: "add", path: "/fields/System.State", value: state }]),
+  });
+  const text = await resp.text();
+  return { ok: resp.ok, status: resp.status, message: text.replace(/\s+/g, " ").slice(0, 200) };
+}
+
+async function currentState(id: number): Promise<string> {
+  const item = await projectClient.get<any>(`/wit/workitems/${id}`, { "api-version": "7.1" });
+  return item.fields?.["System.State"] ?? "?";
+}
+
+// forward main line per the CSV's edges — allowed AND human-only edges both
+// count for ordering: G1/G3 are fence-only, so ADO still permits them and
+// the walk uses them to traverse (their rows are probed like any other).
+function forwardOrder(rows: CsvRow[]): string[] {
+  const edges = new Map<string, string>();
+  for (const r of rows) {
+    if ((r.rule === "allowed" || r.rule === "human-only") && r.fromState !== r.toState && !edges.has(r.fromState)) {
+      edges.set(r.fromState, r.toState);
+    }
+  }
+  const order: string[] = [];
+  let s = "New";
+  const guard = new Set<string>();
+  while (s && !guard.has(s)) {
+    guard.add(s);
+    order.push(s);
+    s = edges.get(s) ?? "";
+  }
+  return order;
+}
+
+// The forward main line in order — the walk's map. ADO permits the fence-only
+// hops (G1 etc.) for this identity, so traversal may use every adjacent edge.
+const MAIN = [
+  "New",
+  "In Planning",
+  "Awaiting Approval",
+  "Approved",
+  "Spec Validation",
+  "In Implementation",
+  "In Testing",
+  "In Review",
+  "Updating Docs",
+  "Done",
+];
+
+async function resetToNew(id: number): Promise<void> {
+  for (let i = 0; i < 6; i++) {
+    const here = await currentState(id);
+    if (here === "New") return;
+    await patchState(id, here === "Parked for Removal" ? "Removed" : "New");
+  }
+}
+
+async function walkTo(id: number, rows: CsvRow[], target: string): Promise<boolean> {
+  for (let guard = 0; guard < 30; guard++) {
+    const here = await currentState(id);
+    if (here === target) return true;
+    let next: string;
+    if (target === "Committed") next = "Committed"; // retired state: enter directly to probe its exits
+    else if (target === "Parked for Removal") next = "Parked for Removal"; // parkable from anywhere
+    else if (target === "Removed") next = here === "Parked for Removal" ? "Removed" : "Parked for Removal";
+    else if (here === "Parked for Removal" || here === "Removed") next = "New";
+    else if (MAIN.indexOf(here) === -1) return false; // retired/unknown — cannot walk
+    else {
+      const hi = MAIN.indexOf(here);
+      const ti = MAIN.indexOf(target);
+      next = hi < ti ? MAIN[hi + 1]! : "New";
+    }
+    const res = await patchState(id, next);
+    if (!res.ok) return false;
+  }
+  return false;
+}
+
+async function probeState(id: number, rows: CsvRow[], state: string): Promise<void> {
+  for (let round = 0; round < 24; round++) {
+    if ((await currentState(id)) !== state) {
+      if (!(await walkTo(id, rows, state))) {
+        for (const r of rows.filter((x) => x.fromState === state && x.toState !== "Committed" && x.observed === undefined)) {
+          r.observed = `UNREACHED (could not return to "${state}")`;
+        }
+        return;
+      }
+      continue;
+    }
+    // deferred: → Committed rows are probed in the epilogue (they can strand
+    // the walk in the ruleless retired state mid-pass)
+    const candidates = rows.filter(
+      (r) => r.fromState === state && r.toState !== "Committed" && r.observed === undefined && r.fromState !== r.toState
+    );
+    const refusedFirst = [
+      ...candidates.filter((r) => r.rule !== "allowed" && r.rule !== "human-only"),
+      ...candidates.filter((r) => r.rule === "allowed" || r.rule === "human-only"),
+    ];
+    const next = refusedFirst[0];
+    if (!next) return; // all rows for this state probed
+    const res = await patchState(id, next.toState);
+    next.observed = res.ok ? "allowed" : `refused ${res.status}: ${res.message}`;
+  }
+}
+
+function verdictClass(observed: string | undefined): string {
+  if (!observed) return "?";
+  if (observed.startsWith("allowed")) return "allowed";
+  if (observed.startsWith("refused")) return "refused";
+  if (observed.startsWith("identity")) return "identity";
+  return "unreached";
+}
+
+function report(name: string, rows: CsvRow[]) {
+  console.log(`\n---- ${name}: observed vs expected ----`);
+  const holes: string[] = []; // expected allowed but ADO refused → blocks real flow
+  const fenceOnly: string[] = []; // expected refused but ADO allows → our fence is the only guard
+  const unreached: string[] = [];
+  for (const r of rows) {
+    const obs = verdictClass(r.observed);
+    const exp = r.rule === "allowed" ? "allowed" : "refused";
+    let mark = "OK ";
+    if (obs === "unreached" || obs === "?") { mark = "?? "; unreached.push(`${r.fromState} → ${r.toState} (expected ${r.rule})`); }
+    else if (exp === "allowed" && obs !== "allowed") { mark = "!! "; holes.push(`${r.fromState} → ${r.toState}: expected allowed, ADO ${obs} — ${r.observed}`); }
+    else if (exp === "refused" && obs === "allowed") { mark = "!! "; fenceOnly.push(`${r.fromState} → ${r.toState} (expected ${r.rule})`); }
+    console.log(`${mark}${r.fromState.padEnd(18)} → ${r.toState.padEnd(18)} expected=${r.rule.padEnd(12)} observed=${r.observed ?? "?"}`);
+  }
+  console.log(`\nWHITE SPOTS (${name})`);
+  console.log(` blockers (expected allowed, ADO refused): ${holes.length}`);
+  for (const h of holes) console.log(`  !! ${h}`);
+  console.log(` our-fence-only (expected refused, ADO allows — ADO cannot enforce against this identity): ${fenceOnly.length}`);
+  for (const f of fenceOnly) console.log(`  ** ${f}`);
+  console.log(` unreached: ${unreached.length}`);
+  for (const u of unreached) console.log(`  ?? ${u}`);
+}
+
+// ---- Phase A: read-only metadata ----------------------------------------
+console.log("== Phase A: process metadata ==");
+let processId: string | null = null;
+try {
+  const processes = await orgClient.get<any>("/work/processes", { "api-version": "7.1" });
+  const list = processes.value ?? [];
+  const adl = list.find((p: any) => String(p.name ?? "").trim() === "ADL-Product");
+  processId = adl?.typeId ?? adl?.id ?? null;
+  console.log(`processes: ${list.map((p: any) => `${JSON.stringify(p.name)}(${p.id})`).join(", ")}`);
+  console.log(`ADL-Product id: ${processId ?? "NOT FOUND"}`);
+} catch (e) {
+  console.log(`processes list unreadable: ${String(e).slice(0, 140)}`);
+}
+
+if (processId) {
+  let wits: any[] = [];
+  try {
+    const list = await orgClient.get<any>(`/work/processes/${processId}/workitemtypes`, { "api-version": "7.1" });
+    wits = list.value ?? [];
+  } catch (e) {
+    console.log(`workitemtypes unreadable: ${String(e).slice(0, 140)}`);
+  }
+  for (const name of ["Bug", "Product Backlog Item"]) {
+    const wit = wits.find((w: any) => String(w.name).trim() === name);
+    if (!wit) { console.log(`${name}: NOT in workitemtypes list`); continue; }
+    const ref = encodeURIComponent(wit.referenceName ?? wit.id ?? name);
+    try {
+      const states = await orgClient.get<any>(`/work/processes/${processId}/workitemtypes/${ref}/states`, { "api-version": "7.1" });
+      const names = (states.value ?? []).map((s: any) => `${s.name}${s.isDisabled ? " (disabled)" : ""}`);
+      console.log(`${name} states (${names.length}): ${names.join(" | ")}`);
+    } catch (e) {
+      console.log(`${name} states unreadable: ${String(e).slice(0, 120)}`);
+    }
+    for (const api of ["7.2-preview.1", "7.1"]) {
+      try {
+        const rules = await orgClient.get<any>(`/work/processes/${processId}/workitemtypes/${ref}/rules`, { "api-version": api });
+        const rs = rules.value ?? [];
+        console.log(`${name} rules (${api}): READABLE, ${rs.length}`);
+        for (const r of rs.slice(0, 24)) console.log(` - [${r.isDisabled ? "off" : "on"}] ${r.name}`);
+        break;
+      } catch (e) {
+        console.log(`${name} rules (${api}): ${String(e).slice(0, 80)}`);
+      }
+    }
+  }
+}
+
+// ---- Phase B: empirical matrix probe of the operator-supplied item -------
+if (METADATA_ONLY) {
+  console.log("\n(metadata-only: skipping empirical probe)");
+} else try {
+  const item = await getItemAny(ITEM_ID);
+  const type: string = item.fields?.["System.WorkItemType"];
+  const startState: string = item.fields?.["System.State"];
+  console.log(`\n== Phase B: probing #${ITEM_ID} (${type}, started at "${startState}") ==`);
+  const rows = loadExpectations(type);
+  await resetToNew(ITEM_ID);
+  const probeTargets = [...MAIN, "Parked for Removal", "Removed"];
+  for (const state of probeTargets) {
+    await probeState(ITEM_ID, rows, state);
+    await resetToNew(ITEM_ID); // clean slate between states
+  }
+  // Epilogue: → Committed rows, then Committed exits (the retired state has
+  // no ADO rules, so entering/exiting behaves differently — probe it last,
+  // reset whenever the walk strands).
+  const parkedTargets = [...probeTargets, "Committed"];
+  for (const state of parkedTargets) {
+    const row = rows.find((r) => r.fromState === state && r.toState === "Committed" && r.observed === undefined);
+    if (!row) continue;
+    const reached = await walkTo(ITEM_ID, rows, state);
+    console.log(`(epilogue: at "${await currentState(ITEM_ID)}", probing ${state} → Committed — walk ${reached ? "ok" : "FAILED"})`);
+    if (reached) {
+      const res = await patchState(ITEM_ID, "Committed");
+      row.observed = res.ok ? "allowed" : `refused ${res.status}: ${res.message}`;
+      console.log(`(epilogue: ${state} → Committed observed=${row.observed.slice(0, 60)})`);
+    } else {
+      row.observed = `UNREACHED (could not reach "${state}")`;
+    }
+    await resetToNew(ITEM_ID);
+  }
+  // Committed exits: enter from Done (empirically reachable), probe each row,
+  // escaping to New after every successful move.
+  if (rows.some((r) => r.fromState === "Committed" && r.observed === undefined)) {
+    if (await walkTo(ITEM_ID, rows, "Done")) {
+      await patchState(ITEM_ID, "Committed");
+      for (let round = 0; round < 20; round++) {
+        if ((await currentState(ITEM_ID)) !== "Committed") {
+          const back = await patchState(ITEM_ID, "Committed");
+          if (!back.ok) break;
+        }
+        const next = rows.find((r) => r.fromState === "Committed" && r.observed === undefined && r.fromState !== r.toState);
+        if (!next) break;
+        const res = await patchState(ITEM_ID, next.toState);
+        next.observed = res.ok ? "allowed" : `refused ${res.status}: ${res.message}`;
+      }
+    } else {
+      for (const r of rows.filter((x) => x.fromState === "Committed" && x.observed === undefined)) {
+        r.observed = 'UNREACHED (could not reach "Done" to enter Committed)';
+      }
+    }
+  }
+  await resetToNew(ITEM_ID);
+  for (const r of rows.filter((x) => x.observed === undefined)) {
+    r.observed = "UNREACHED (state never visited)";
+  }
+  report(type, rows);
+  // restore
+  await resetToNew(ITEM_ID);
+  const finalState = await currentState(ITEM_ID);
+  console.log(finalState === startState
+    ? `\nrestored: #${ITEM_ID} back at "${startState}"`
+    : `\n!! RESTORE INCOMPLETE: at "${finalState}", expected "${startState}"`);
+} catch (e) {
+  console.log(`probe failed: ${String(e).slice(0, 240)}`);
+}
+
+async function getItemAny(id: number): Promise<any> {
+  return projectClient.get<any>(`/wit/workitems/${id}`, { "api-version": "7.1" });
+}

package/packages/azdo/src/azdo-pl.ts

@@ -21,11 +21,6 @@ async function getClient(): Promise<AdoClient> {
   return client
 }
 
-/** Test seam: forget the cached client — see azdo-wit.ts's resetClientForTests() for why. */
-export function resetClientForTests(): void {
-  client = undefined
-}
-
 /** GET a JSON payload. */
 async function getJson<T>(c: AdoClient, path: string, params?: Record<string, string>): Promise<T> {
   return c.get<T>(path, { 'api-version': '7.1', ...params });
@@ -182,9 +177,9 @@ export async function buildRun(args: BuildRunArgs): Promise<string> {
   }, null, 2);
 }
 
-export type BuildRunDetailArgs = { buildId: string; tail?: string | undefined };
+type BuildRunDetailArgs = { buildId: string; tail?: string | undefined };
 
-export async function buildGetRunDetail(args: BuildRunDetailArgs): Promise<string> {
+async function buildGetRunDetail(args: BuildRunDetailArgs): Promise<string> {
   const buildId = Number(args.buildId);
   if (!Number.isInteger(buildId) || buildId < 1) throw new Error(`buildId must be a positive integer; got '${args.buildId}'`);
   const c = await getClient()
@@ -226,50 +221,3 @@ export async function buildGetRunDetail(args: BuildRunDetailArgs): Promise<strin
     failedTaskLogs,
   }, null, 2);
 }
-
-export type BuildStageDetailArgs = { buildId: string; stageName: string; tail?: string };
-
-export async function buildGetStageDetail(args: BuildStageDetailArgs): Promise<string> {
-  const buildId = Number(args.buildId);
-  const stageName = args.stageName;
-  const tail = args.tail ? parseInt(args.tail) : undefined;
-  if (!buildId || !stageName) {
-    throw new Error('--build-id and --stage-name are required');
-  }
-  const c = await getClient()
-  const timeline = await getJson<any>(c, `/build/builds/${buildId}/timeline`);
-  const stage = timeline.records.find((r: any) => r.type === 'Stage' && r.name === stageName);
-  if (!stage) {
-    throw new Error(`Stage '${stageName}' not found`);
-  }
-  const nodes = buildTree(timeline.records);
-  const root = nodes.get(stage.id)!;
-  sortTree(root);
-  const failures = failedTasks(root);
-
-  let failedTaskLogs: Array<Record<string, unknown>> | undefined;
-  if (tail) {
-    failedTaskLogs = [];
-    const collect = async (node: TimelineNode): Promise<void> => {
-      if (node.type === 'Task' && node.result === 'failed' && node.logId != null) {
-        const lines = (await getText(c, `/build/builds/${buildId}/logs/${node.logId}`))
-          .split('\n')
-          .map((line) => line.replace(/\r/g, '').trim())
-          .filter(Boolean);
-        failedTaskLogs!.push({ task: node.name, logId: node.logId, tail: lines.slice(-tail) });
-      }
-      for (const child of node.children) await collect(child);
-    };
-    await collect(root);
-  }
-
-  return JSON.stringify({
-    stageName: root.name,
-    state: root.state,
-    result: root.result,
-    stage: root,
-    failedTaskCount: failures.length,
-    failures,
-    failedTaskLogs,
-  }, null, 2);
-}

package/packages/azdo/src/azdo-pr-review.ts

@@ -64,19 +64,19 @@ export type VoteName = keyof typeof VOTE_VALUES;
 export const VOTE_NAMES = Object.keys(VOTE_VALUES) as readonly VoteName[];
 
 /** Row 8's exact text — the hook (adl-pr-review-role.ts) uses the identical string; kept in sync by the shared test corpus, not by import (agent-hooks does not depend on this package). */
-export const NO_VOTE_GATE_ON_INTEGRATION_MESSAGE =
+const NO_VOTE_GATE_ON_INTEGRATION_MESSAGE =
   'no vote gate on integration — CI + auto-complete only, no human or agent review there';
 
 /** Row 7's exact text. */
-export function voteRoleDeniedMessage(agent: string): string {
+function voteRoleDeniedMessage(agent: string): string {
   return `human approval gate — an agent vote does not substitute for Tarun's or Vivek's own review (docs/operations/agent-permissions.md row 7); '${agent}' may still comment`;
 }
 
-export function targetBranchRequiredMessage(): string {
+function targetBranchRequiredMessage(): string {
   return "vote requires targetBranch (the pull request's real target branch) — refusing rather than casting a vote on a PR this call never named";
 }
 
-export function targetBranchMismatchMessage(claimed: string, actual: string): string {
+function targetBranchMismatchMessage(claimed: string, actual: string): string {
   return `targetBranch '${claimed}' does not match this pull request's real target '${actual}' — refusing rather than trusting a stale or wrong claim`;
 }