@askexenow/exe-os 0.9.374 → 0.9.376

package/dist/bin/exe-cicd.js

@@ -0,0 +1,1210 @@
+#!/usr/bin/env node
+import "../chunk-MLKGABMK.js";
+
+// src/bin/exe-cicd.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+import {
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  appendFileSync,
+  existsSync,
+  cpSync,
+  readdirSync,
+  rmSync,
+  chmodSync,
+  lstatSync,
+  mkdtempSync,
+  unlinkSync,
+  realpathSync
+} from "fs";
+import { homedir, loadavg } from "os";
+import path from "path";
+import { pathToFileURL } from "url";
+
+// src/lib/cicd-merge-policy.ts
+var FAILING = /* @__PURE__ */ new Set([
+  "FAILURE",
+  "ERROR",
+  "TIMED_OUT",
+  "CANCELLED",
+  "ACTION_REQUIRED",
+  "STALE"
+]);
+var IN_FLIGHT = /* @__PURE__ */ new Set([
+  "PENDING",
+  "IN_PROGRESS",
+  "QUEUED",
+  "WAITING",
+  // A null conclusion means the check has not concluded. Treating it as
+  // anything other than in-flight is how v1 masked real failures.
+  "NONE"
+]);
+var NON_SIGNAL_STATES = /* @__PURE__ */ new Set(["SKIPPED", "NEUTRAL"]);
+function classifyChecks(states, mergeable) {
+  if (mergeable === "CONFLICTING") return "CONFLICT";
+  let failed = 0;
+  let inFlight = 0;
+  let succeeded = 0;
+  for (const s of states) {
+    if (FAILING.has(s)) failed++;
+    else if (IN_FLIGHT.has(s)) inFlight++;
+    else if (s === "SUCCESS") succeeded++;
+    else if (NON_SIGNAL_STATES.has(s)) {
+    } else {
+      failed++;
+    }
+  }
+  if (failed > 0) return "RED";
+  if (inFlight > 0) return "PENDING";
+  if (states.length === 0) return "NOCHECKS";
+  if (succeeded === 0) return "NOCHECKS";
+  return "GREEN";
+}
+function missingRequiredChecks(reported, required) {
+  return required.filter((name) => reported.get(name) !== "SUCCESS");
+}
+var PROTECTED_PATH_PATTERN = /(^|\/)(\.github\/workflows\/|auth|crypto|keychain|migrations?\/|schema|publish\.ya?ml|release)/i;
+function touchesProtectedPath(files) {
+  return files.some((f) => PROTECTED_PATH_PATTERN.test(f));
+}
+var HOST_NOISE_LOAD_THRESHOLD = 18;
+function isLikelyHostNoise(loadAverage, threshold = HOST_NOISE_LOAD_THRESHOLD) {
+  return loadAverage > threshold;
+}
+var MAX_FIX_ATTEMPTS = 3;
+function decideAction(input) {
+  const {
+    verdict,
+    changedFiles: changedFiles2 = [],
+    missingRequired = [],
+    requiredChecksConfigured,
+    reviewDecision,
+    attempts = 0,
+    loadAverage = 0,
+    maxAttempts = MAX_FIX_ATTEMPTS
+  } = input;
+  switch (verdict) {
+    case "PENDING":
+      return { kind: "wait" };
+    case "CONFLICT":
+      return { kind: "rebase" };
+    case "NOCHECKS":
+      return {
+        kind: "hold",
+        reason: "no passing checks (absent, or all SKIPPED/NEUTRAL) \u2014 absence of failure is not proof of passing"
+      };
+    case "GREEN":
+      if (requiredChecksConfigured === false) {
+        return {
+          kind: "hold",
+          reason: "repo defines no required status checks \u2014 green here only means advisory checks passed"
+        };
+      }
+      if (reviewDecision != null && reviewDecision !== "APPROVED") {
+        return {
+          kind: "hold",
+          reason: `review decision is ${reviewDecision}, not APPROVED`
+        };
+      }
+      if (missingRequired.length > 0) {
+        return {
+          kind: "hold",
+          reason: `required checks with no reported success: ${missingRequired.join(", ")}`
+        };
+      }
+      if (touchesProtectedPath(changedFiles2)) {
+        return {
+          kind: "hold",
+          reason: "green but touches a protected path; human review required"
+        };
+      }
+      return { kind: "merge" };
+    case "RED": {
+      if (attempts >= maxAttempts) {
+        return {
+          kind: "stop",
+          reason: `${attempts} failed fix attempts \u2014 stopping for a human`
+        };
+      }
+      if (isLikelyHostNoise(loadAverage)) {
+        return {
+          kind: "hold",
+          reason: `host load ${loadAverage} \u2014 treating RED as host contention, not a code defect`
+        };
+      }
+      return { kind: "escalate", attempt: attempts + 1 };
+    }
+  }
+}
+
+// src/lib/cicd-failure-triage.ts
+var SIGNATURES = [
+  {
+    cls: "resource",
+    pattern: /ENOSPC|no space left on device|disk quota exceeded/i,
+    why: "runner ran out of disk"
+  },
+  {
+    cls: "resource",
+    pattern: /JavaScript heap out of memory|Killed process|signal SIGKILL|oom-kill/i,
+    why: "process was killed for memory"
+  },
+  {
+    cls: "resource",
+    pattern: /EMFILE|too many open files/i,
+    why: "runner hit the file-descriptor limit"
+  },
+  {
+    cls: "network",
+    pattern: /ECONNRESET|ETIMEDOUT|EAI_AGAIN|ENOTFOUND|socket hang up/i,
+    why: "network call failed"
+  },
+  {
+    cls: "network",
+    pattern: /429 Too Many Requests|rate limit exceeded|registry\.npmjs\.org.*(?:500|503)/i,
+    why: "upstream rate-limited or unavailable"
+  },
+  {
+    cls: "infrastructure",
+    // Deps resolve upward from the parent repo, so a worktree without its own
+    // node_modules fails this way with nothing wrong in the diff. Cost us a
+    // build investigation on this very branch.
+    //
+    // REGRESSION — codex-review P1 on PR #965: this used to also match
+    // `error TS2307: Cannot find module './foo'.` — a TypeScript COMPILER
+    // diagnostic pointing at a bad import the diff itself introduced, which is
+    // exactly a code defect, not a runner problem. Because this signature was
+    // checked before CODE_SIGNALS, that diagnostic classified as
+    // infrastructure with escalate:false and a real bug never reached the
+    // fixer. The negative lookbehind excludes "Cannot find module" when it is
+    // immediately preceded by a `TSxxxx:` diagnostic code, which only tsc
+    // produces — Node's runtime `MODULE_NOT_FOUND` error never has one.
+    pattern: /(?<!TS\d+:\s)Cannot find module|MODULE_NOT_FOUND|command not found: (?:tsx|vitest|tsc)/i,
+    why: "toolchain or dependency missing on the runner, not in the diff"
+  },
+  {
+    cls: "infrastructure",
+    pattern: /No runner matching|waiting for a runner|The self-hosted runner.*lost communication/i,
+    why: "no runner available"
+  },
+  {
+    cls: "timeout",
+    pattern: /The job running on runner .* has exceeded the maximum execution time|timed out after|Timeout - Async callback was not invoked/i,
+    why: "job exceeded its time budget \u2014 usually contention"
+  },
+  {
+    cls: "timeout",
+    pattern: /The operation was canceled/i,
+    why: "job was cancelled, commonly by a timeout on a loaded box"
+  }
+];
+var REVIEW_BLOCK = /review found \[?(?:CRITICAL|P0|P1)\]?|Review gate FAILED CLOSED|review gate.*blocking/i;
+var CODE_SIGNALS = [
+  /\bAssertionError\b|expected .* to (?:be|equal|contain)/i,
+  /\d+ (?:test|tests) failed|Tests:\s+\d+ failed/i,
+  /error TS\d+:/,
+  /✖ \d+ problems?|\d+ errors? and \d+ warnings?/i,
+  /FAIL\s+\S+\.(?:test|spec)\.[jt]sx?/
+];
+function triageFailureLog(log2) {
+  if (!log2.trim()) {
+    return {
+      cls: "unknown",
+      reason: "no log content available",
+      escalate: false
+    };
+  }
+  for (const sig of SIGNATURES) {
+    if (sig.pattern.test(log2)) {
+      return {
+        cls: sig.cls,
+        reason: `${sig.why} \u2014 environmental, not a code defect`,
+        escalate: false
+      };
+    }
+  }
+  if (REVIEW_BLOCK.test(log2)) {
+    return {
+      cls: "review",
+      reason: "an automated review gate found blocking issues in the diff",
+      escalate: true
+    };
+  }
+  for (const signal of CODE_SIGNALS) {
+    if (signal.test(log2)) {
+      return {
+        cls: "code",
+        reason: "log shows a genuine test/compile failure",
+        escalate: true
+      };
+    }
+  }
+  return {
+    cls: "unknown",
+    reason: "no recognised failure signature \u2014 escalating, but with low confidence",
+    escalate: true
+  };
+}
+function extractRelevantLines(log2, opts = {}) {
+  const { context = 3, maxLines = 200 } = opts;
+  const lines = log2.split("\n");
+  const interesting = /error|fail|✕|✖|✗|assert|expected|Cannot find|TS\d{4}|throw/i;
+  const keep = /* @__PURE__ */ new Set();
+  lines.forEach((line, i) => {
+    if (!interesting.test(line)) return;
+    for (let j = Math.max(0, i - context); j <= Math.min(lines.length - 1, i + context); j++) {
+      keep.add(j);
+    }
+  });
+  if (keep.size === 0) {
+    return lines.slice(-Math.min(maxLines, lines.length)).join("\n");
+  }
+  const ordered = [...keep].sort((a, b) => a - b).slice(0, maxLines);
+  const out = [];
+  let prev = -1;
+  for (const i of ordered) {
+    if (prev !== -1 && i > prev + 1) out.push("  ...");
+    out.push(lines[i] ?? "");
+    prev = i;
+  }
+  return out.join("\n");
+}
+
+// src/lib/cicd-fixer.ts
+var FIXER_BACKENDS = [
+  {
+    id: "glm",
+    command: "claude",
+    // Routed at Z.ai's Anthropic-compatible endpoint via the provider table.
+    args: ["-p", "{prompt}", "--permission-mode", "acceptEdits"],
+    envKeys: ["ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_MODEL"],
+    costRank: 1
+  },
+  {
+    id: "codex",
+    command: "codex",
+    args: ["exec", "{prompt}"],
+    envKeys: [],
+    costRank: 2
+  },
+  {
+    id: "opencode",
+    command: "opencode",
+    args: ["run", "{prompt}"],
+    envKeys: ["OPENCODE_API_KEY"],
+    costRank: 3
+  }
+];
+function selectFixer(available, attempt) {
+  if (available.length === 0) return null;
+  const ordered = FIXER_BACKENDS.filter((b) => available.includes(b.id)).sort((a, b) => a.costRank - b.costRank).map((b) => b.id);
+  if (ordered.length === 0) return null;
+  const idx = (Math.max(1, attempt) - 1) % ordered.length;
+  return ordered[idx] ?? null;
+}
+function buildFixPrompt(req) {
+  const files = req.changedFiles.length ? req.changedFiles.join("\n") : "(diff file list unavailable)";
+  return [
+    `CI is failing on ${req.repo} PR #${req.prNumber} (branch ${req.branch}).`,
+    `Triage classified this as: ${req.failureClass}.`,
+    "",
+    "Failing job output (trimmed to the relevant lines):",
+    "```",
+    req.evidence,
+    "```",
+    "",
+    "Files this PR already changes:",
+    "```",
+    files,
+    "```",
+    "",
+    "Your task:",
+    "1. Make the smallest change that makes this check pass.",
+    "2. Change ONLY what the failure requires. No refactors, no renames, no",
+    "   reformatting of code you did not otherwise touch, no drive-by improvements.",
+    "3. Do NOT edit CI workflow files, auth, crypto, keychain, migrations or",
+    "   release configuration. If the fix genuinely requires one of those, stop",
+    "   and explain why instead of editing it.",
+    "4. Do NOT weaken, skip, or delete a test to make it pass. If the test is",
+    "   correct and the code is wrong, fix the code.",
+    "5. If you cannot determine the cause with confidence, say so plainly rather",
+    "   than guessing. A wrong fix costs more than no fix.",
+    "",
+    "Do not commit or push. Leave the working tree modified for review."
+  ].join("\n");
+}
+function renderArgs(backend, prompt) {
+  return backend.args.map((a) => a.replace("{prompt}", prompt));
+}
+
+// src/lib/cicd-skylos.ts
+var SKYLOS_SEVERITIES = ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
+var SKYLOS_REPORT_KEYS = {
+  secrets: "secret",
+  danger: "security",
+  ai_defects: "ai_defect",
+  quality: "quality"
+};
+function parseChangedLines(diff) {
+  const out = /* @__PURE__ */ new Map();
+  let file = null;
+  for (const line of diff.split("\n")) {
+    if (line.startsWith("+++ ")) {
+      const raw = line.slice(4).trim();
+      file = raw === "/dev/null" ? null : raw.replace(/^b\//, "");
+      if (file && !out.has(file)) out.set(file, /* @__PURE__ */ new Set());
+      continue;
+    }
+    if (!file || !line.startsWith("@@")) continue;
+    const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+    if (!m) continue;
+    const start = Number(m[1]);
+    const count = m[2] === void 0 ? 1 : Number(m[2]);
+    const set = out.get(file);
+    if (!set) continue;
+    for (let i = 0; i < count; i += 1) set.add(start + i);
+  }
+  return out;
+}
+function buildSkylosArgs(opts) {
+  return [
+    opts.dir,
+    "--diff",
+    opts.baseRef,
+    "--secrets",
+    "--danger",
+    "--quality",
+    "--ai-defects",
+    "--format",
+    "json",
+    "--output",
+    opts.outputPath,
+    "--no-upload",
+    // Never let the scan decide an exit code for us. Phase 1 blocks nothing,
+    // and a non-zero exit would be indistinguishable from a crash.
+    "--force"
+  ];
+}
+var SEVERITY_RANK = {
+  CRITICAL: 0,
+  HIGH: 1,
+  MEDIUM: 2,
+  LOW: 3
+};
+function normaliseSeverity(raw) {
+  const s = String(raw ?? "").toUpperCase();
+  return SKYLOS_SEVERITIES.includes(s) ? s : "LOW";
+}
+function toRelative(file, repoDir) {
+  const root = repoDir.endsWith("/") ? repoDir : `${repoDir}/`;
+  return file.startsWith(root) ? file.slice(root.length) : file;
+}
+function parseSkylosReport(raw, opts) {
+  let doc;
+  try {
+    doc = JSON.parse(raw);
+  } catch (err) {
+    return {
+      status: "failed",
+      reason: `could not parse skylos JSON report: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  if (!doc || typeof doc !== "object" || Array.isArray(doc)) {
+    return { status: "failed", reason: "skylos JSON report was not an object" };
+  }
+  const allow = opts.changedFiles ? new Set(opts.changedFiles) : null;
+  const record = doc;
+  const findings = [];
+  for (const [key, category] of Object.entries(SKYLOS_REPORT_KEYS)) {
+    const bucket = record[key];
+    if (!Array.isArray(bucket)) continue;
+    for (const entry of bucket) {
+      if (!entry || typeof entry !== "object") continue;
+      const e = entry;
+      const file = toRelative(String(e.file ?? ""), opts.repoDir);
+      if (allow && !allow.has(file)) continue;
+      const line = Number(e.line ?? 0);
+      const touched = opts.changedLines?.get(file);
+      findings.push({
+        ruleId: String(e.rule_id ?? "SKY-?"),
+        severity: normaliseSeverity(e.severity),
+        category: String(e.category ?? category),
+        file,
+        line,
+        message: String(e.message ?? ""),
+        // No changedLines at all, or no entry for this file (new/untracked):
+        // treat the whole file as the patch.
+        onChangedLine: touched ? touched.has(line) : true
+      });
+    }
+  }
+  findings.sort(
+    (a, b) => Number(b.onChangedLine) - Number(a.onChangedLine) || (SEVERITY_RANK[a.severity] ?? 9) - (SEVERITY_RANK[b.severity] ?? 9) || a.file.localeCompare(b.file) || a.line - b.line
+  );
+  return { status: "ok", findings };
+}
+function countBySeverity(findings) {
+  const counts = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 };
+  for (const f of findings) counts[f.severity] += 1;
+  return counts;
+}
+var SKYLOS_LOG_LIMIT = 20;
+function summarizeSkylosScan(scan, ctx) {
+  const key = `${ctx.repo}#${ctx.prNumber}`;
+  const head = `SKYLOS ${key} \u2014 scan of ${ctx.backend}'s patch`;
+  if (scan.status === "unavailable") {
+    return [
+      `${head}: DID NOT RUN \u2014 ${scan.reason}.`,
+      `SKYLOS ${key} \u2014 this patch was pushed WITHOUT a static-analysis scan. Install skylos (\`pipx install skylos\`) or set EXE_CICD_SKYLOS_BIN to restore it.`
+    ];
+  }
+  if (scan.status === "failed") {
+    return [
+      `${head}: FAILED \u2014 ${scan.reason}.`,
+      `SKYLOS ${key} \u2014 this patch was pushed WITHOUT a usable static-analysis scan (non-blocking pilot; the push proceeded).`
+    ];
+  }
+  if (scan.findings.length === 0) {
+    return [`${head}: clean \u2014 0 findings in the changed lines (non-blocking pilot).`];
+  }
+  const c = countBySeverity(scan.findings);
+  const onPatch = scan.findings.filter((f) => f.onChangedLine).length;
+  const lines = [
+    `${head}: ${scan.findings.length} finding(s) \u2014 ${c.CRITICAL} critical, ${c.HIGH} high, ${c.MEDIUM} medium, ${c.LOW} low. ${onPatch} on lines this patch changed, ${scan.findings.length - onPatch} pre-existing in the touched files. NON-BLOCKING (pilot) \u2014 the push proceeds regardless.`
+  ];
+  for (const f of scan.findings.slice(0, SKYLOS_LOG_LIMIT)) {
+    const scope = f.onChangedLine ? "patch" : "file";
+    lines.push(`  SKYLOS ${scope} ${f.severity} ${f.ruleId} ${f.file}:${f.line} \u2014 ${f.message}`);
+  }
+  if (scan.findings.length > SKYLOS_LOG_LIMIT) {
+    lines.push(
+      `  SKYLOS ... and ${scan.findings.length - SKYLOS_LOG_LIMIT} more finding(s) not shown.`
+    );
+  }
+  return lines;
+}
+
+// src/bin/exe-cicd.ts
+var run = promisify(execFile);
+var STATE_DIR = path.join(homedir(), ".exe-os", "cicd");
+var STATE_FILE = path.join(STATE_DIR, "state.json");
+var LOG_FILE = path.join(STATE_DIR, "log.txt");
+var DEFAULT_REPOS = [
+  "exe-os",
+  "exe-build",
+  "exe-chat",
+  "exe-gateway",
+  "exe-crm",
+  "exe-wiki",
+  "exe-erp",
+  "exe-db"
+];
+var ORG = process.env.EXE_CICD_ORG ?? "AskExe";
+var FAILED_STATES = /* @__PURE__ */ new Set(["FAILURE", "ERROR", "TIMED_OUT", "CANCELLED"]);
+function jobIdFromUrl(url) {
+  if (!url) return null;
+  const m = /\/job\/(\d+)/.exec(url);
+  return m?.[1] ?? null;
+}
+function log(msg) {
+  const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${msg}`;
+  console.log(line);
+  try {
+    mkdirSync(STATE_DIR, { recursive: true });
+    appendFileSync(LOG_FILE, `${line}
+`);
+  } catch {
+  }
+}
+function readState() {
+  try {
+    const raw = JSON.parse(readFileSync(STATE_FILE, "utf8"));
+    const out = {};
+    for (const [key, value] of Object.entries(raw)) {
+      out[key] = typeof value === "number" ? { attempts: value } : value;
+    }
+    return out;
+  } catch {
+    return {};
+  }
+}
+function writeState(state) {
+  mkdirSync(STATE_DIR, { recursive: true });
+  writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
+}
+function attemptsForHead(record, headOid) {
+  if (!record) return 0;
+  if (record.headOid !== headOid) return 0;
+  return record.attempts;
+}
+function toCheckState(entry) {
+  const raw = entry.conclusion ?? entry.state ?? "NONE";
+  return String(raw).toUpperCase();
+}
+async function gh(args) {
+  const { stdout } = await run("gh", args, { maxBuffer: 32 * 1024 * 1024 });
+  return stdout;
+}
+async function listPullRequests(repo) {
+  try {
+    const out = await gh([
+      "pr",
+      "list",
+      "--repo",
+      `${ORG}/${repo}`,
+      "--state",
+      "open",
+      "--json",
+      "number,title,mergeable,isDraft,autoMergeRequest,statusCheckRollup,headRefName,headRefOid,reviewDecision"
+    ]);
+    return JSON.parse(out);
+  } catch {
+    return [];
+  }
+}
+var requiredChecksCache = /* @__PURE__ */ new Map();
+async function requiredChecks(repo) {
+  const cached = requiredChecksCache.get(repo);
+  if (cached !== void 0) return cached;
+  const contexts = /* @__PURE__ */ new Set();
+  let read = false;
+  try {
+    const out = await gh([
+      "api",
+      `repos/${ORG}/${repo}/branches/main/protection/required_status_checks`
+    ]);
+    const parsed = JSON.parse(out);
+    for (const c of parsed.contexts ?? []) contexts.add(c);
+    for (const c of parsed.checks ?? []) contexts.add(c.context);
+    read = true;
+  } catch {
+  }
+  try {
+    const out = await gh(["api", `repos/${ORG}/${repo}/rules/branches/main`]);
+    const rules = JSON.parse(out);
+    for (const r of rules) {
+      if (r.type !== "required_status_checks") continue;
+      for (const c of r.parameters?.required_status_checks ?? []) contexts.add(c.context);
+    }
+    read = true;
+  } catch {
+  }
+  const result = read ? [...contexts] : null;
+  requiredChecksCache.set(repo, result);
+  return result;
+}
+async function changedFiles(repo, num) {
+  try {
+    const out = await gh(["pr", "diff", String(num), "--repo", `${ORG}/${repo}`, "--name-only"]);
+    return out.split("\n").map((s) => s.trim()).filter(Boolean);
+  } catch {
+    return [".github/workflows/UNREADABLE"];
+  }
+}
+async function triageFailedJob(repo, pr) {
+  const failed = (pr.statusCheckRollup ?? []).find(
+    (c) => FAILED_STATES.has(String(c.conclusion ?? c.state ?? "").toUpperCase())
+  );
+  const jobId = jobIdFromUrl(failed?.detailsUrl ?? failed?.targetUrl);
+  if (!jobId) {
+    return {
+      cls: "unknown",
+      reason: "could not locate the failing job's log",
+      escalate: false
+    };
+  }
+  let raw;
+  try {
+    raw = await gh(["api", `repos/${ORG}/${repo}/actions/jobs/${jobId}/logs`]);
+  } catch {
+    return {
+      cls: "unknown",
+      reason: "failing job's log could not be read",
+      escalate: false
+    };
+  }
+  const result = triageFailureLog(raw);
+  if (result.escalate) {
+    result.evidence = extractRelevantLines(raw);
+    log(`  evidence: ${result.evidence.split("\n").length} relevant lines from job ${jobId}`);
+  }
+  return result;
+}
+var CHECKOUTS_DIR = path.join(STATE_DIR, "checkouts");
+var FIXER_TIMEOUT_MS = Number(process.env.EXE_CICD_FIXER_TIMEOUT_MS ?? 15 * 60 * 1e3);
+async function ensureCheckout(repo, branch, headOid, execFn = run) {
+  const dir = path.join(CHECKOUTS_DIR, repo);
+  mkdirSync(CHECKOUTS_DIR, { recursive: true });
+  if (!existsSync(path.join(dir, ".git"))) {
+    await execFn("git", ["clone", `https://github.com/${ORG}/${repo}.git`, dir], {});
+  }
+  await execFn("git", ["-C", dir, "fetch", "origin", branch], {});
+  await execFn("git", ["-C", dir, "checkout", "-B", branch, "FETCH_HEAD"], {});
+  await execFn("git", ["-C", dir, "reset", "--hard", headOid], {});
+  await execFn("git", ["-C", dir, "clean", "-fdx"], {});
+  return dir;
+}
+var SAFE_ENV_PASSTHROUGH = [
+  "PATH",
+  "USER",
+  "SHELL",
+  "LANG",
+  "LC_ALL",
+  "TMPDIR",
+  "TERM"
+];
+var FIXER_HOME_ROOT = path.join(STATE_DIR, "fixer-homes");
+var CODEX_CREDENTIAL_FILES = ["auth.json", "config.json"];
+function copyCodexCredentials(realCodexDir, isolatedCodexDir) {
+  mkdirSync(isolatedCodexDir, { recursive: true });
+  for (const name of CODEX_CREDENTIAL_FILES) {
+    const src = path.join(realCodexDir, name);
+    if (!existsSync(src)) continue;
+    try {
+      cpSync(src, path.join(isolatedCodexDir, name));
+    } catch {
+    }
+  }
+}
+function defaultIsolatedFixerHome(def) {
+  const dir = path.join(
+    FIXER_HOME_ROOT,
+    `${def.id}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
+  );
+  mkdirSync(dir, { recursive: true });
+  if (def.id === "codex") {
+    const realCodexDir = path.join(homedir(), ".codex");
+    if (existsSync(realCodexDir)) {
+      copyCodexCredentials(realCodexDir, path.join(dir, ".codex"));
+    }
+  }
+  return dir;
+}
+var GLM_BASE_URL = "https://api.z.ai/api/anthropic";
+var GLM_DEFAULT_MODEL = "glm-5.3";
+function resolveGlmAuthToken() {
+  if (process.env.ZAI_API_KEY) return process.env.ZAI_API_KEY;
+  try {
+    const raw = readFileSync(path.join(homedir(), ".glm-mcp", "config.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed.apiKey ?? null;
+  } catch {
+    return null;
+  }
+}
+function fixerEnv(def, isolatedHome) {
+  const env = { HOME: isolatedHome };
+  for (const key of [...SAFE_ENV_PASSTHROUGH, ...def.envKeys]) {
+    const value = process.env[key];
+    if (value !== void 0) env[key] = value;
+  }
+  if (def.id === "glm") {
+    if (!env.ANTHROPIC_AUTH_TOKEN) {
+      const token = resolveGlmAuthToken();
+      if (token) env.ANTHROPIC_AUTH_TOKEN = token;
+    }
+    if (!env.ANTHROPIC_BASE_URL) env.ANTHROPIC_BASE_URL = GLM_BASE_URL;
+    if (!env.ANTHROPIC_MODEL) env.ANTHROPIC_MODEL = GLM_DEFAULT_MODEL;
+  }
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_ASKPASS = "";
+  env.SSH_ASKPASS = "";
+  env.GIT_CONFIG_COUNT = "1";
+  env.GIT_CONFIG_KEY_0 = "credential.helper";
+  env.GIT_CONFIG_VALUE_0 = "";
+  return env;
+}
+var SECRET_ENV_KEYS = ["ANTHROPIC_AUTH_TOKEN", "OPENCODE_API_KEY"];
+var TOKEN_LIKE_PATTERN = /[A-Za-z0-9_\-]{20,}/g;
+function collectFixerSecrets(env, isolatedHome) {
+  const secrets = /* @__PURE__ */ new Set();
+  for (const key of SECRET_ENV_KEYS) {
+    const value = env[key];
+    if (value && value.length >= 8) secrets.add(value);
+  }
+  try {
+    const codexDir = path.join(isolatedHome, ".codex");
+    if (existsSync(codexDir)) {
+      for (const entry of readdirSync(codexDir, { withFileTypes: true })) {
+        if (!entry.isFile()) continue;
+        try {
+          const content = readFileSync(path.join(codexDir, entry.name), "utf8");
+          for (const match of content.matchAll(TOKEN_LIKE_PATTERN)) secrets.add(match[0]);
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  return [...secrets];
+}
+async function runFixerBackend(backend, prompt, cwd, execFn = run, homeDirFn = defaultIsolatedFixerHome, cleanupHomeFn = defaultCleanupFixerHome) {
+  const def = FIXER_BACKENDS.find((b) => b.id === backend);
+  if (!def) return { backend, ok: false, error: `unknown fixer backend: ${backend}` };
+  const args = renderArgs(def, prompt);
+  const isolatedHome = homeDirFn(def);
+  try {
+    const env = fixerEnv(def, isolatedHome);
+    const secrets = collectFixerSecrets(env, isolatedHome);
+    try {
+      await execFn(def.command, args, {
+        cwd,
+        env,
+        timeout: FIXER_TIMEOUT_MS,
+        maxBuffer: 32 * 1024 * 1024
+      });
+      return { backend, ok: true, secrets };
+    } catch (err) {
+      return { backend, ok: false, error: err instanceof Error ? err.message : String(err) };
+    }
+  } finally {
+    cleanupHomeFn(isolatedHome);
+  }
+}
+function forceRemovable(target) {
+  let st;
+  try {
+    st = lstatSync(target);
+  } catch {
+    return;
+  }
+  if (st.isSymbolicLink()) return;
+  if (!st.isDirectory()) {
+    try {
+      chmodSync(target, 384);
+    } catch {
+    }
+    return;
+  }
+  try {
+    chmodSync(target, 448);
+  } catch {
+  }
+  let children = [];
+  try {
+    children = readdirSync(target);
+  } catch {
+    return;
+  }
+  for (const child of children) forceRemovable(path.join(target, child));
+}
+function defaultCleanupFixerHome(home) {
+  try {
+    forceRemovable(home);
+    rmSync(home, { recursive: true, force: true });
+  } catch {
+  }
+}
+var SKYLOS_TIMEOUT_MS = Number(process.env.EXE_CICD_SKYLOS_TIMEOUT_MS ?? 10 * 60 * 1e3);
+var SKYLOS_BIN = process.env.EXE_CICD_SKYLOS_BIN ?? "skylos";
+var SKYLOS_REPORT_DIR = path.join(STATE_DIR, "skylos");
+function isMissingCommand(err) {
+  const code = err?.code;
+  if (code === "ENOENT") return true;
+  const msg = err instanceof Error ? err.message : String(err);
+  return /\bENOENT\b|not found|No such file or directory/i.test(msg);
+}
+async function changedFilesInCheckout(dir, execFn) {
+  const { stdout } = await execFn("git", ["-C", dir, "status", "--porcelain"], {});
+  const files = [];
+  for (const line of stdout.split("\n")) {
+    if (!line.trim()) continue;
+    const rest = line.slice(3).trim();
+    const arrow = rest.indexOf(" -> ");
+    if (arrow === -1) files.push(rest);
+    else files.push(rest.slice(0, arrow), rest.slice(arrow + 4));
+  }
+  return files;
+}
+async function runSkylosScan(dir, baseRef, execFn = run) {
+  let workDir = null;
+  let outputPath = null;
+  const skylosCacheDir = path.join(dir, ".skylos");
+  const skylosCachePreexisted = existsSync(skylosCacheDir);
+  try {
+    const changedFiles2 = await changedFilesInCheckout(dir, execFn);
+    if (changedFiles2.length === 0) {
+      return { status: "ok", findings: [] };
+    }
+    mkdirSync(SKYLOS_REPORT_DIR, { recursive: true });
+    workDir = realpathSync(mkdtempSync(path.join(SKYLOS_REPORT_DIR, "scan-")));
+    outputPath = path.join(workDir, "report.json");
+    try {
+      await execFn(SKYLOS_BIN, buildSkylosArgs({ dir, baseRef, outputPath }), {
+        cwd: dir,
+        timeout: SKYLOS_TIMEOUT_MS,
+        maxBuffer: 32 * 1024 * 1024
+      });
+    } catch (err) {
+      if (isMissingCommand(err)) {
+        return {
+          status: "unavailable",
+          reason: `skylos executable '${SKYLOS_BIN}' not found on PATH`
+        };
+      }
+      if (!existsSync(outputPath)) {
+        return {
+          status: "failed",
+          reason: `skylos run failed: ${err instanceof Error ? err.message : String(err)}`
+        };
+      }
+    }
+    if (!existsSync(outputPath)) {
+      return { status: "failed", reason: "skylos produced no report file" };
+    }
+    const { stdout: diffOut } = await execFn("git", ["-C", dir, "diff", "-U0", "HEAD"], {});
+    return parseSkylosReport(readFileSync(outputPath, "utf8"), {
+      repoDir: dir,
+      changedFiles: changedFiles2,
+      changedLines: parseChangedLines(diffOut)
+    });
+  } catch (err) {
+    return {
+      status: "failed",
+      reason: err instanceof Error ? err.message : String(err)
+    };
+  } finally {
+    try {
+      if (outputPath && existsSync(outputPath)) unlinkSync(outputPath);
+      if (workDir && existsSync(workDir)) rmSync(workDir, { recursive: true, force: true });
+      if (!skylosCachePreexisted && existsSync(skylosCacheDir)) {
+        rmSync(skylosCacheDir, { recursive: true, force: true });
+      }
+    } catch {
+    }
+  }
+}
+var TEST_WEAKENING_PATTERNS = [
+  /^\+.*\b(?:it|test|describe)\.(?:skip|todo)\(/m,
+  /^\+.*\bx(?:it|describe|test)\(/m,
+  /^\+.*@ts-nocheck\b/m,
+  // REGRESSION — codex-review P1, round 10: this used to only match
+  // it.only/describe.only, missing `test.only(...)` — an unattended fixer
+  // could add that and potentially make CI run only its own focused test,
+  // the exact narrowing the "no .only markers" rule exists to forbid.
+  /^\+.*\b(?:it|test|describe)\.only\(/m
+];
+function diffWeakensTests(diff) {
+  return TEST_WEAKENING_PATTERNS.some((p) => p.test(diff));
+}
+var TEST_FILE_PATTERN = /(^|\/)(tests?|__tests__)\/|\.(?:test|spec)\.[jt]sx?$/i;
+function deletesATestFile(entries) {
+  for (const e of entries) {
+    if (e.status.includes("D") && TEST_FILE_PATTERN.test(e.file)) return e.file;
+    if (e.renamedFrom && TEST_FILE_PATTERN.test(e.renamedFrom) && !TEST_FILE_PATTERN.test(e.file)) {
+      return e.renamedFrom;
+    }
+  }
+  return null;
+}
+async function commitAndPushFix(dir, branch, backend, headOid, secrets = [], execFn = run) {
+  const { stdout: headNow } = await execFn("git", ["-C", dir, "rev-parse", "HEAD"], {});
+  if (headNow.trim() !== headOid) {
+    return {
+      kind: "blocked",
+      reason: `checkout no longer at the triaged head (expected ${headOid.slice(0, 10)}, found ${headNow.trim().slice(0, 10)}) \u2014 refusing to commit on top of an unverified base`,
+      files: []
+    };
+  }
+  const { stdout } = await execFn("git", ["-C", dir, "status", "--porcelain"], {});
+  if (!stdout.trim()) return { kind: "clean" };
+  const entries = stdout.split("\n").filter(Boolean).map((line) => {
+    const status = line.slice(0, 2);
+    const rest = line.slice(3).trim();
+    const arrow = rest.indexOf(" -> ");
+    if (arrow === -1) return { status, file: rest };
+    return { status, file: rest.slice(arrow + 4), renamedFrom: rest.slice(0, arrow) };
+  });
+  const files = entries.flatMap((e) => e.renamedFrom ? [e.renamedFrom, e.file] : [e.file]);
+  if (touchesProtectedPath(files)) {
+    return {
+      kind: "blocked",
+      reason: "fixer touched a protected path (workflows/auth/crypto/keychain/migrations/schema/release)",
+      files
+    };
+  }
+  const deletedTest = deletesATestFile(entries);
+  if (deletedTest) {
+    return {
+      kind: "blocked",
+      reason: `fixer deleted a test file (${deletedTest}) \u2014 the prompt forbids weakening or deleting tests to go green`,
+      files
+    };
+  }
+  await execFn("git", ["-C", dir, "add", "-A"], {});
+  const { stdout: diffOut } = await execFn("git", ["-C", dir, "diff", "--cached"], {});
+  if (diffWeakensTests(diffOut)) {
+    return {
+      kind: "blocked",
+      reason: "fixer's diff adds a skip/todo/only/@ts-nocheck marker \u2014 the prompt forbids weakening tests to go green",
+      files
+    };
+  }
+  const leakedSecret = secrets.find((s) => s.length >= 8 && diffOut.includes(s));
+  if (leakedSecret) {
+    return {
+      kind: "blocked",
+      reason: "fixer's diff contains a value matching a credential this run had access to \u2014 refusing to push a possible secret leak",
+      files
+    };
+  }
+  await execFn(
+    "git",
+    ["-C", dir, "commit", "-m", `fix(cicd): automated fix via ${backend} fixer backend`],
+    {}
+  );
+  await execFn("git", ["-C", dir, "push", "origin", `HEAD:${branch}`], {});
+  return { kind: "pushed" };
+}
+function defaultEscalationDeps(execFn = run) {
+  return {
+    checkout: (repo, branch, headOid) => ensureCheckout(repo, branch, headOid, execFn),
+    runFixer: (backend, prompt, cwd) => runFixerBackend(backend, prompt, cwd, execFn),
+    scanPatch: (dir, baseRef) => runSkylosScan(dir, baseRef, execFn),
+    commitAndPush: (dir, branch, backend, headOid, secrets) => commitAndPushFix(dir, branch, backend, headOid, secrets, execFn)
+  };
+}
+async function runLiveEscalation(repo, branch, headOid, backend, prompt, deps = defaultEscalationDeps()) {
+  try {
+    const dir = await deps.checkout(repo, branch, headOid);
+    const outcome = await deps.runFixer(backend, prompt, dir);
+    if (!outcome.ok) return { ok: false, pushed: false, error: outcome.error };
+    let skylos;
+    try {
+      skylos = await deps.scanPatch(dir, headOid);
+    } catch (err) {
+      skylos = {
+        status: "failed",
+        reason: err instanceof Error ? err.message : String(err)
+      };
+    }
+    const commit = await deps.commitAndPush(dir, branch, backend, headOid, outcome.secrets ?? []);
+    if (commit.kind === "blocked") {
+      return { ok: true, pushed: false, blocked: commit.reason, skylos };
+    }
+    return { ok: true, pushed: commit.kind === "pushed", skylos };
+  } catch (err) {
+    return { ok: false, pushed: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function processRepo(repo, live, fixers = []) {
+  const prs = await listPullRequests(repo);
+  const state = readState();
+  const load = loadavg()[0] ?? 0;
+  for (const pr of prs) {
+    if (pr.isDraft) continue;
+    const key = `${repo}#${pr.number}`;
+    const states = (pr.statusCheckRollup ?? []).map(toCheckState);
+    const verdict = classifyChecks(states, pr.mergeable);
+    if (pr.autoMergeRequest) {
+      log(`DISARM ${key} \u2014 was armed to self-merge on green`);
+      if (live) {
+        await gh(["pr", "merge", String(pr.number), "--repo", `${ORG}/${repo}`, "--disable-auto"]).catch(
+          () => void 0
+        );
+      }
+    }
+    let files = [];
+    let missingRequired = [];
+    let requiredConfigured;
+    if (verdict === "GREEN") {
+      files = await changedFiles(repo, pr.number);
+      const required = await requiredChecks(repo);
+      requiredConfigured = required === null ? void 0 : required.length > 0;
+      if (required === null) {
+        missingRequired = ["<branch protection unreadable>"];
+      } else {
+        const reported = /* @__PURE__ */ new Map();
+        for (const c of pr.statusCheckRollup ?? []) {
+          const name = c.name ?? c.context;
+          if (name) reported.set(name, toCheckState(c));
+        }
+        missingRequired = missingRequiredChecks(reported, required);
+      }
+    }
+    const action = decideAction({
+      verdict,
+      changedFiles: files,
+      missingRequired,
+      requiredChecksConfigured: requiredConfigured,
+      reviewDecision: pr.reviewDecision,
+      // Their head-pinned record, not a mangled key: it also migrates the old
+      // number-only state entries, which key-mangling would have orphaned.
+      attempts: attemptsForHead(state[key], pr.headRefOid),
+      loadAverage: load
+    });
+    switch (action.kind) {
+      case "wait":
+        log(`WAIT   ${key} \u2014 checks running`);
+        break;
+      case "rebase":
+        log(`REBASE ${key} \u2014 conflicting; needs a rebase, not a model-authored fix`);
+        break;
+      case "hold":
+        log(`HOLD   ${key} \u2014 ${action.reason}`);
+        break;
+      case "stop":
+        log(`STOP   ${key} \u2014 ${action.reason}`);
+        break;
+      case "merge": {
+        if (!pr.headRefOid) {
+          log(`HOLD   ${key} \u2014 no head commit to pin the merge to; refusing to merge blind`);
+          break;
+        }
+        log(`MERGE  ${key} \u2014 green, merging at ${pr.headRefOid.slice(0, 10)}`);
+        if (live) {
+          await gh([
+            "pr",
+            "merge",
+            String(pr.number),
+            "--repo",
+            `${ORG}/${repo}`,
+            "--squash",
+            "--delete-branch",
+            "--match-head-commit",
+            pr.headRefOid
+          ]).catch((e) => log(`  merge refused (head moved or gate failed): ${e.message}`));
+        }
+        break;
+      }
+      case "escalate": {
+        const triage = await triageFailedJob(repo, pr);
+        if (!triage.escalate) {
+          log(`HOLD   ${key} \u2014 ${triage.reason} (${triage.cls}); not escalating`);
+          break;
+        }
+        const backend = selectFixer(fixers, action.attempt);
+        if (!backend) {
+          log(`HOLD   ${key} \u2014 real failure but no fixer backend available`);
+          break;
+        }
+        const prompt = buildFixPrompt({
+          repo,
+          prNumber: pr.number,
+          branch: pr.headRefName ?? "unknown",
+          failureClass: triage.cls,
+          evidence: triage.evidence ?? "",
+          changedFiles: await changedFiles(repo, pr.number)
+        });
+        log(
+          `FIX    ${key} \u2014 attempt ${action.attempt} via ${backend} \u2014 ${triage.reason} (prompt ${prompt.length} chars)`
+        );
+        if (live) {
+          if (!pr.headRefOid) {
+            log(`HOLD   ${key} \u2014 no head commit to pin the fixer checkout to; refusing to fix blind`);
+            break;
+          }
+          state[key] = { attempts: action.attempt, headOid: pr.headRefOid };
+          writeState(state);
+          const result = await runLiveEscalation(
+            repo,
+            pr.headRefName ?? "unknown",
+            pr.headRefOid,
+            backend,
+            prompt
+          );
+          if (result.skylos) {
+            for (const line of summarizeSkylosScan(result.skylos, {
+              repo,
+              prNumber: pr.number,
+              backend
+            })) {
+              log(`  ${line}`);
+            }
+          }
+          if (!result.ok) {
+            log(`  FAIL   ${key} \u2014 ${backend} did not produce a usable fix: ${result.error}`);
+          } else if (result.blocked) {
+            log(`  HOLD   ${key} \u2014 ${backend}'s fix was blocked, not pushed: ${result.blocked}`);
+          } else if (!result.pushed) {
+            log(`  HOLD   ${key} \u2014 ${backend} made no changes (declined to fix with confidence)`);
+          } else {
+            log(`  PUSHED ${key} \u2014 ${backend} pushed a fix to ${pr.headRefName}; awaiting next CI run`);
+          }
+        } else {
+          log(`  (dry-run \u2014 would invoke ${backend} in a local checkout)`);
+        }
+        break;
+      }
+    }
+  }
+}
+function codexHasCredentials(home = homedir()) {
+  try {
+    const raw = readFileSync(path.join(home, ".codex", "auth.json"), "utf8");
+    return raw.trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+async function availableFixers() {
+  const out = [];
+  for (const backend of FIXER_BACKENDS) {
+    try {
+      await run("command", ["-v", backend.command]).catch(async () => {
+        await run("which", [backend.command]);
+      });
+    } catch {
+      continue;
+    }
+    if (backend.id === "glm") {
+      if (!resolveGlmAuthToken()) continue;
+    }
+    if (backend.id === "opencode" && !process.env.OPENCODE_API_KEY) continue;
+    if (backend.id === "codex" && !codexHasCredentials()) continue;
+    out.push(backend.id);
+  }
+  return out;
+}
+async function runOnce(repos, live) {
+  log(`=== exe-cicd pass (${live ? "LIVE" : "dry-run"}) load=${(loadavg()[0] ?? 0).toFixed(2)} ===`);
+  const fixers = await availableFixers();
+  log(`fixer backends available: ${fixers.length ? fixers.join(", ") : "none"}`);
+  for (const repo of repos) {
+    await processRepo(repo.trim(), live, fixers);
+  }
+  log("=== exe-cicd pass end ===");
+}
+async function main() {
+  const args = process.argv.slice(2);
+  const live = args.includes("--live");
+  const watch = args.includes("--watch");
+  const repoArg = args.find((a) => a.startsWith("--repos="));
+  const repos = repoArg ? repoArg.slice("--repos=".length).split(",") : DEFAULT_REPOS;
+  const intervalSec = Number(
+    args.find((a) => a.startsWith("--interval="))?.slice("--interval=".length) ?? "300"
+  );
+  if (!watch) {
+    await runOnce(repos, live);
+    return;
+  }
+  log(`watch mode: every ${intervalSec}s over ${repos.length} repo(s)`);
+  for (; ; ) {
+    try {
+      await runOnce(repos, live);
+    } catch (err) {
+      log(`pass failed (continuing): ${err instanceof Error ? err.message : String(err)}`);
+    }
+    await new Promise((r) => setTimeout(r, Math.max(30, intervalSec) * 1e3));
+  }
+}
+var isEntrypoint = process.argv[1] !== void 0 && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (isEntrypoint) {
+  main().catch((err) => {
+    log(`FATAL ${err instanceof Error ? err.message : String(err)}`);
+    process.exitCode = 1;
+  });
+}
+export {
+  attemptsForHead,
+  codexHasCredentials,
+  commitAndPushFix,
+  copyCodexCredentials,
+  defaultCleanupFixerHome,
+  ensureCheckout,
+  runFixerBackend,
+  runLiveEscalation,
+  runSkylosScan
+};