@archme/cli 0.8.1 → 0.9.0

package/dist/cli.js

@@ -10005,9 +10005,23 @@ async function tailLog(opts = {}) {
   await new Promise((resolve6, reject) => {
     let fileWatcher = null;
     let dirWatcher = null;
+    let poller = null;
+    let settled = false;
     const dir = dirname7(path7);
     const name = basename(path7);
-    const onChange = async () => {
+    const stop = () => {
+      settled = true;
+      fileWatcher?.close();
+      dirWatcher?.close();
+      if (poller) clearInterval(poller);
+      process.removeListener("SIGINT", handleSigint);
+    };
+    const fail = (err2) => {
+      if (settled) return;
+      stop();
+      reject(err2);
+    };
+    const readNew = async () => {
       try {
         const st = await stat(path7);
         if (st.size < offset) offset = 0;
@@ -10020,61 +10034,50 @@ async function tailLog(opts = {}) {
           });
           offset = st.size;
         }
+        if (!fileWatcher && !settled) attachFileWatcher();
       } catch (err2) {
         if (err2.code === "ENOENT") return;
-        reject(err2);
+        fail(err2);
       }
     };
-    const attachFileWatcher = () => {
-      try {
-        fileWatcher = watch(path7, (event) => {
-          if (event === "change") void onChange();
-        });
-      } catch (err2) {
-        if (err2.code !== "ENOENT") {
-          reject(err2);
-          return;
-        }
-        attachDirWatcher();
-      }
+    let chain = Promise.resolve();
+    const drain = () => {
+      if (settled) return;
+      chain = chain.then(readNew);
     };
-    const attachDirWatcher = () => {
+    const attachFileWatcher = () => {
       try {
-        dirWatcher = watch(dir, (_event, filename) => {
-          if (filename === name) {
-            void onChange().then(() => {
-              dirWatcher?.close();
-              dirWatcher = null;
-              attachFileWatcher();
-            });
-          }
-        });
-      } catch (err2) {
-        reject(err2);
+        fileWatcher = watch(path7, () => drain());
+        dirWatcher?.close();
+        dirWatcher = null;
+      } catch {
+        fileWatcher = null;
       }
     };
-    stat(path7).then(
-      () => attachFileWatcher(),
-      (err2) => {
-        if (err2.code === "ENOENT") {
-          attachDirWatcher();
-        } else {
-          reject(err2);
-        }
-      }
-    );
+    try {
+      dirWatcher = watch(dir, (_event, filename) => {
+        if (filename === name) drain();
+      });
+    } catch (err2) {
+      fail(err2);
+      return;
+    }
     const handleSigint = () => {
-      fileWatcher?.close();
-      dirWatcher?.close();
+      if (settled) return;
+      stop();
       resolve6();
     };
     process.once("SIGINT", handleSigint);
+    poller = setInterval(drain, FOLLOW_POLL_MS);
+    drain();
   });
 }
+var FOLLOW_POLL_MS;
 var init_logs = __esm({
   "src/daemon/service/logs.ts"() {
     "use strict";
     init_paths();
+    FOLLOW_POLL_MS = 500;
   }
 });
 
@@ -13294,6 +13297,13 @@ var init_sequenceChapters = __esm({
   }
 });
 
+// ../shared/architectureDiff.ts
+var init_architectureDiff = __esm({
+  "../shared/architectureDiff.ts"() {
+    init_storyChanges();
+  }
+});
+
 // ../shared/walkthrough.ts
 var MAX_WALKTHROUGH_STEPS, MAX_STEP_TITLE_CHARS;
 var init_walkthrough = __esm({
@@ -13301,6 +13311,7 @@ var init_walkthrough = __esm({
     init_storyChanges();
     init_sequenceChapters();
     init_validationCodes();
+    init_architectureDiff();
     MAX_WALKTHROUGH_STEPS = 20;
     MAX_STEP_TITLE_CHARS = 60;
   }
@@ -13317,13 +13328,15 @@ var init_walkthroughGuidance = __esm({
 - **Steps are in reading order, not build order.** This is not an implementation plan and not a restatement of your sequencing section \u2014 start where a reviewer should start, and put each step where it makes the next one make sense.
 - **Group by idea.** One step is one coherent change, usually 3\u20138 elements. A one-element step is fine and often valuable: an independent fix that would otherwise be lost among the rest. Aim for a handful of steps; the cap is ${MAX_WALKTHROUGH_STEPS}.
 - **Titles are terse** \u2014 a handle, not a summary. Under ${MAX_STEP_TITLE_CHARS} characters. \`Markers move per-repo\`, not \`This step explains how the source marker moves onto a per-repo table\`.
-- **Description is optional and usually absent.** Never restate the components, stories or connections the step already references \u2014 the reader is looking at them. Write one only for something the diagrams cannot show: a constraint, a consequence, a trade-off that is not visible in the graph.
-- **Write it for someone meeting this change for the first time.** They know the system; they have NOT read your proposal body and were not in the design discussion. Say plainly what the step does and why it is there. Two sentences is plenty.
+- **Every step gets a short description** \u2014 the narration a reader follows while the diagrams move beside it, one step at a time. Two or three plain sentences: what this part of the change is, why it exists, and how it fits the rest, at a high level. Example: \`This is the daemon picking up GitHub's answer after it posts a comment, review or approval on your behalf, and recording whether it worked.\`
+  - Not prescriptive: describe the change, do not tell the reviewer what to check or what to think of it.
+  - Not dense: no condensed paragraph of identifiers, flags and edge cases crammed into one sentence. Never restate the components, stories or connections the step already references \u2014 the reader is looking at them.
+- **Write it for someone meeting this change for the first time.** They know the system; they have NOT read your proposal body and were not in the design discussion. Say plainly what the step does and why it is there.
   - Don't argue with objections the reader hasn't raised \u2014 no \`not just a nicety\`, no \`as discussed\`, no \`this is why it is its own step\`. They don't know how the walkthrough was assembled and haven't disagreed with you. A trade-off worth stating is information (\`X was considered; it breaks Y\`), not a rebuttal.
   - Don't use the change's OWN new vocabulary undefined. If the step introduces a term, say what it means in the same breath or use plain words.
   - Bad: \`A correctness item, not a phase-3 nicety: anchors are repo-relative paths, so two repos with the same conventional layout collide silently and seed stories from the wrong one.\`
   - Good: \`With two repos in one project a path like src/index.ts exists in both, so looking up which component owns a changed file can return the wrong repo's. Each repo now records the container its code lives under, and lookups search only that subtree.\`
-- **Cover every story the change touches.** A changed story no step references is a change the reader will step straight past.
+- **Cover every change** \u2014 every story, component and connection the change touches \u2014 or \`set_walkthrough\` rejects the walkthrough and lists what is missing. Guided mode walks the steps and nothing after them, so anything no step reaches is a change the reviewer never sees. A connection is covered when a step names it, names both of its components, or names a story page that draws it as an arrow. Name a connection inside a component as \`<component path>::<id>\` (\`daemon::session_auth->key_account\`); a root connection by its plain id.
 - **Skip it for a small change.** A handful of elements needs no walkthrough; omit it rather than writing a step per element.
 - **Prefer CHAPTERS to narrow a diagram.** If a story's sequence carries \`%% chapter: <id> | <Label>\` markers, name the ones your step covers as \`chapters: [{ story, chapter }]\`, using the **id**, never the label \u2014 ids are stable across a rename, labels are not. A chapter is a page break the story's author already wrote, so it is sharper than naming components, where one hub the step mentions decides the whole view.`;
   }
@@ -16129,7 +16142,9 @@ function observeGithubPull(p) {
     createdAt: p.created_at ?? null,
     updatedAt: p.updated_at ?? null,
     mergedAt: p.merged_at ?? null,
-    closedAt: p.closed_at ?? null
+    closedAt: p.closed_at ?? null,
+    // Before the merge it is GitHub's throwaway test merge.
+    mergeCommitSha: p.merged_at ? p.merge_commit_sha ?? null : null
   };
 }
 function metaKey(o2) {
@@ -16164,6 +16179,7 @@ function toItem(o2, action, sent) {
     created_at: o2.createdAt,
     merged_at: o2.mergedAt,
     closed_at: o2.closedAt,
+    merge_commit_sha: o2.mergeCommitSha,
     body: o2.body,
     ...action === "synchronize" && sent.seq !== void 0 ? { seq: sent.seq } : {}
   };
@@ -16573,6 +16589,22 @@ var init_defaultBranch = __esm({
   }
 });
 
+// ../shared/prRefs.ts
+function pushCommitSubject(message) {
+  if (message == null) return null;
+  const [subject = "", ...body] = message.split("\n");
+  const pr = MERGE_PR_SUBJECT.exec(subject.trim());
+  const title = body.find((line) => line.trim())?.trim();
+  return pr && title && !TRAILER_LINE.test(title) ? `${title} (#${pr[1]})` : subject;
+}
+var MERGE_PR_SUBJECT, TRAILER_LINE;
+var init_prRefs = __esm({
+  "../shared/prRefs.ts"() {
+    MERGE_PR_SUBJECT = /^Merge pull request #(\d+) from \S+$/;
+    TRAILER_LINE = /^[A-Za-z0-9]+(?:-[A-Za-z0-9]+)+:\s/;
+  }
+});
+
 // src/daemon/localGit.ts
 var localGit_exports = {};
 __export(localGit_exports, {
@@ -16641,13 +16673,14 @@ async function firstParentRange(dir, marker, tip) {
 async function readCommitMeta(dir, sha) {
   const { exitCode, stdout } = await git(
     dir,
-    ["show", "-s", "--format=%s%n%an%n%cI", sha],
+    // %b last: it spans lines, and `pushCommitSubject` reads a merge commit's title from it.
+    ["show", "-s", "--format=%an%n%cI%n%s%n%b", sha],
     { allowFail: true }
   );
   if (exitCode !== 0) return { message: "", authorName: null, committedAt: null };
-  const [message = "", authorName = "", committedAt = ""] = stdout.split("\n");
+  const [authorName = "", committedAt = "", ...message] = stdout.split("\n");
   return {
-    message: message.trim(),
+    message: (pushCommitSubject(message.join("\n")) ?? "").trim(),
     authorName: authorName.trim() || null,
     committedAt: committedAt.trim() || null
   };
@@ -16676,6 +16709,7 @@ var init_localGit = __esm({
     init_execa();
     init_preflight();
     init_defaultBranch();
+    init_prRefs();
     GIT_TIMEOUT_MS = 10 * 60 * 1e3;
   }
 });
@@ -17117,6 +17151,7 @@ var init_localPoller = __esm({
 // src/daemon/run.ts
 var run_exports = {};
 __export(run_exports, {
+  JOB_TOKEN_PREFIX: () => JOB_TOKEN_PREFIX,
   MultipleAccountsError: () => MultipleAccountsError,
   __testDispatch: () => __testDispatch,
   affectedFieldForComplete: () => affectedFieldForComplete,
@@ -17128,6 +17163,7 @@ __export(run_exports, {
   claudeFailureDetail: () => claudeFailureDetail,
   computeDiff: () => computeDiff,
   parseClaudeResult: () => parseClaudeResult,
+  parseJobTokenResponse: () => parseJobTokenResponse,
   probeMcpAuth: () => probeMcpAuth,
   readBranchMarker: () => readBranchMarker,
   routeShutdownInterrupt: () => routeShutdownInterrupt,
@@ -17220,6 +17256,56 @@ async function getRepoCredentials(ctx, jobId, deviceId) {
     expires_at: typeof body.expires_at === "string" ? body.expires_at : null
   };
 }
+function parseJobTokenResponse(status, ok, body) {
+  if (!ok) {
+    throw new Error(`MCP job token unavailable: ${responseError(body, `job-token failed (${status})`)}`);
+  }
+  if (typeof body.token !== "string" || !body.token.startsWith(JOB_TOKEN_PREFIX) || body.token.length <= JOB_TOKEN_PREFIX.length) {
+    throw new Error("MCP job token response did not carry an amj_ token");
+  }
+  const str2 = (v) => typeof v === "string" ? v : null;
+  return {
+    token: body.token,
+    expires_at: str2(body.expires_at),
+    project_id: str2(body.project_id),
+    archme_branch: str2(body.archme_branch),
+    scope: str2(body.scope)
+  };
+}
+async function mintJobToken(ctx, jobId, deviceId) {
+  const response = await fetchWithAuthRetry(
+    "job-token",
+    () => {
+      const accessToken = ctx.auth.getAccessToken();
+      if (!accessToken) throw new Error("daemon is not signed in with a registered device");
+      return fetch(`${ctx.supabaseUrl.replace(/\/$/, "")}/functions/v1/agents-device/job-token`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          Authorization: `Bearer ${accessToken}`
+        },
+        body: JSON.stringify({
+          device_id: deviceId,
+          job_id: jobId
+        })
+      });
+    },
+    ctx.reLogin
+  );
+  const body = await parseJsonResponse(response);
+  return parseJobTokenResponse(response.status, response.ok, body);
+}
+async function writeAgentMcpConfig(ctx, job, deviceId, projectSlug, source) {
+  const { token } = await mintJobToken(ctx, job.id, deviceId);
+  const { configPath, cleanup } = await writeMcpConfig({
+    baseUrl: ctx.mcpBaseUrl,
+    projectSlug,
+    branch: job.archme_branch,
+    bearer: token,
+    source
+  });
+  return { configPath, cleanup, bearer: token };
+}
 async function buildGitEnv(credentials) {
   const dir = await mkdtemp3(join19(tmpdir3(), "archme-git-askpass-"));
   const askpassPath = join19(dir, "askpass.sh");
@@ -17771,7 +17857,7 @@ async function probeMcpAuth(mcpUrl, bearer, opts = {}) {
         body
       });
       lastStatus = res.status;
-      if (res.status !== 401) {
+      if (res.status !== 401 && res.status !== 403) {
         return {
           ok: true,
           attempts: i2 + 1,
@@ -17779,13 +17865,13 @@ async function probeMcpAuth(mcpUrl, bearer, opts = {}) {
           detail: `MCP accepted the daemon token (status ${res.status})`
         };
       }
-      lastDetail = "MCP returned 401 \u2014 token rejected by JWKS verification";
+      lastDetail = res.status === 403 ? "MCP returned 403 \u2014 job token rejected (job not running under this claim, or URL outside its binding)" : "MCP returned 401 \u2014 token rejected by JWKS verification";
     } catch (err2) {
       lastStatus = null;
       lastDetail = `network error reaching MCP: ${err2 instanceof Error ? err2.message : String(err2)}`;
     }
   }
-  if (lastStatus === 401) {
+  if (lastStatus === 401 || lastStatus === 403) {
     return { ok: false, attempts, lastStatus, detail: lastDetail };
   }
   return {
@@ -17860,19 +17946,12 @@ function parseClaudeResult(stdout) {
     return { summary: raw, modelServed: null, usage: null, costUsd: null, isError: false, parsed: false };
   }
 }
-async function setupDigestMcp(ctx, job) {
+async function setupDigestMcp(ctx, job, deviceId) {
   let cleanup;
   try {
+    if (!deviceId) throw new Error("daemon is not signed in with a registered device");
     const projectSlug = await lookupProjectSlug(ctx.supabase, job.project_id);
-    const mcpBearer = await ctx.auth.getMcpAccessToken();
-    const { configPath, cleanup: cleanupFn } = await writeMcpConfig({
-      baseUrl: ctx.mcpBaseUrl,
-      projectSlug,
-      branch: job.archme_branch,
-      bearer: mcpBearer
-      // No `source`: digest reads must not produce source-tagged commits — they
-      // don't write at all, but leaving it off keeps the URL read-shaped.
-    });
+    const { configPath, cleanup: cleanupFn, bearer: mcpBearer } = await writeAgentMcpConfig(ctx, job, deviceId, projectSlug);
     cleanup = cleanupFn;
     const probe = await probeMcpAuth(
       `${ctx.mcpBaseUrl}?project=${encodeURIComponent(projectSlug)}&branch=${encodeURIComponent(job.archme_branch)}`,
@@ -17895,7 +17974,7 @@ async function setupDigestMcp(ctx, job) {
 async function runJob(ctx, job, claimDeviceId) {
   if (job.job_kind === "digest") {
     const digestDevice = claimDeviceId ?? ctx.deviceForOrg(job.org_id) ?? ctx.auth.getDeviceId() ?? void 0;
-    const { mcp, cleanup } = await setupDigestMcp(ctx, job);
+    const { mcp, cleanup } = await setupDigestMcp(ctx, job, digestDevice);
     try {
       await runDigestJob(ctx, job, digestDevice, inFlight, mcp);
     } finally {
@@ -17927,6 +18006,27 @@ async function runJob(ctx, job, claimDeviceId) {
   }, HEARTBEAT_INTERVAL_MS);
   try {
     const projectSlug = await lookupProjectSlug(ctx.supabase, job.project_id);
+    const { configPath, cleanup: cleanupFn, bearer: mcpBearer } = await writeAgentMcpConfig(
+      ctx,
+      job,
+      deviceId,
+      projectSlug,
+      {
+        repo: `${job.repo_owner}/${job.repo_name}`,
+        before_sha: job.before_sha ?? null,
+        after_sha: job.after_sha,
+        job_id: job.id,
+        // Effective run mode — always diff or pr_update now (reconcile is gone).
+        mode: job.source_mode === "pr_update" ? "pr_update" : "diff",
+        commit_message: job.commit_message ?? null,
+        committed_at: job.head_commit_timestamp ?? null,
+        author_name: job.author_name ?? null,
+        author_login: job.author_login ?? null
+      }
+    );
+    activeCleanups.add(cleanupFn);
+    cleanupFns.push(cleanupFn);
+    markPhase("job_token");
     let clone;
     try {
       clone = await ensureCloneAndFetch(ctx, job, deviceId);
@@ -18007,27 +18107,6 @@ async function runJob(ctx, job, claimDeviceId) {
         throw new Error(`failed to materialize large diff to disk (${bytes} bytes): ${e.message}`);
       }
     }
-    const mcpBearer = await ctx.auth.getMcpAccessToken();
-    const { configPath, cleanup: cleanupFn } = await writeMcpConfig({
-      baseUrl: ctx.mcpBaseUrl,
-      projectSlug,
-      branch: job.archme_branch,
-      bearer: mcpBearer,
-      source: {
-        repo: `${job.repo_owner}/${job.repo_name}`,
-        before_sha: job.before_sha ?? null,
-        after_sha: job.after_sha,
-        job_id: job.id,
-        // Effective run mode — always diff or pr_update now (reconcile is gone).
-        mode: effectiveMode,
-        commit_message: job.commit_message ?? null,
-        committed_at: job.head_commit_timestamp ?? null,
-        author_name: job.author_name ?? null,
-        author_login: job.author_login ?? null
-      }
-    });
-    activeCleanups.add(cleanupFn);
-    cleanupFns.push(cleanupFn);
     let affectedSeed = "";
     let affectedForComplete = null;
     if (diff) {
@@ -18640,7 +18719,7 @@ ${signal} received, shutting down`);
   process.on("SIGINT", () => shutdown("SIGINT"));
   process.on("SIGTERM", () => shutdown("SIGTERM"));
 }
-var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, FAILURE_DETAIL_MAX, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, DEFAULT_CLONE_BASE_DIR, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, STORY_COVERAGE_GATE, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
+var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, FAILURE_DETAIL_MAX, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, DEFAULT_CLONE_BASE_DIR, JOB_TOKEN_PREFIX, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, STORY_COVERAGE_GATE, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
 var init_run = __esm({
   "src/daemon/run.ts"() {
     "use strict";
@@ -18702,6 +18781,7 @@ var init_run = __esm({
     ctxByJob = /* @__PURE__ */ new Map();
     deviceByJob = /* @__PURE__ */ new Map();
     DEFAULT_CLONE_BASE_DIR = `${homedir6()}/.archme-job-runner/clones`;
+    JOB_TOKEN_PREFIX = "amj_";
     INLINE_PATCH_BYTE_CAP = 2e5;
     GIT_SHA_RE = /^[0-9a-f]{40}$/;
     CURATOR_PREAMBLE = `## Your role
@@ -18830,6 +18910,11 @@ ${ANCHOR_VERIFICATION}`;
         return deviceByJob.get(jobId);
       },
       runJob,
+      // R7: the job-bound `amj_` MCP token mint and the digest's MCP setup, so a
+      // test can assert the agent's mcp.json carries the job token and never the
+      // daemon's own session.
+      mintJobToken,
+      setupDigestMcp,
       // Exposes the clone/fetch entrypoint so a test can assert that the repo-token
       // mint (getRepoCredentials -> agents-device/repo-token, gated on
       // claimed_by_device_id) uses the CLAIM-time device rather than recomputing via

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archme/cli",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "Map your codebase into a living architecture diagram: run `archme init` in a repo to scan it, `archme daemon start` to keep it current on every commit.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",