@blogic-cz/agent-tools 0.18.0 → 1.0.0

package/src/gh-tool/pr/core.ts

@@ -702,6 +702,99 @@ export const createPR = Effect.fn("pr.createPR")(function* (opts: {
   );
 });
 
+// GitHub rejects GraphQL `mergePullRequest` for a PR that belongs to a native stack and points at
+// the asynchronous REST merge instead. `gh pr merge` only speaks GraphQL.
+const ASYNC_MERGE_REQUIRED_RE = /asynchronous merge/i;
+const ASYNC_MERGE_POLL_INTERVAL_MS = 2000;
+const MAX_ASYNC_MERGE_WAIT_SECONDS = 120;
+
+type AsyncMergeResult = {
+  status: "pending" | "merged" | "enqueued" | "failed";
+  details?: { message?: string; uuid?: string; sha?: string };
+};
+
+const asyncMergeFailure = (
+  pr: number,
+  message: string,
+  hint: string,
+  reason: "merge_queue" | "unknown" = "unknown",
+) =>
+  new GitHubMergeError({
+    message: `Failed to merge PR #${pr} asynchronously: ${message}`,
+    reason,
+    hint,
+    nextCommand: `agent-tools-gh pr view --pr ${pr}`,
+  });
+
+const mergeViaAsyncApi = Effect.fn("pr.mergeViaAsyncApi")(function* (opts: {
+  pr: number;
+  strategy: MergeStrategy;
+}) {
+  const gh = yield* GitHubService;
+  const repo = yield* gh.getRepoInfo();
+  const asyncPath = `repos/${repo.owner}/${repo.name}/pulls/${opts.pr}/merge-async`;
+
+  let latest = yield* gh.runGhJson<AsyncMergeResult>([
+    "api",
+    "--method",
+    "PUT",
+    asyncPath,
+    "-f",
+    `merge_method=${opts.strategy}`,
+  ]);
+
+  const uuid = latest.details?.uuid;
+  if (latest.status === "pending" && uuid !== undefined) {
+    const start = yield* Clock.currentTimeMillis;
+    const deadlineMs = Number(start) + MAX_ASYNC_MERGE_WAIT_SECONDS * 1000;
+    let timedOut = false;
+
+    // Effect.whileLoop (not recursion) so TestClock.adjust can advance Effect.sleep without real waits.
+    yield* Effect.whileLoop({
+      while: () => latest.status === "pending" && !timedOut,
+      body: () =>
+        Effect.gen(function* () {
+          const now = yield* Clock.currentTimeMillis;
+          if (Number(now) >= deadlineMs) {
+            timedOut = true;
+            return;
+          }
+          const remaining = deadlineMs - Number(now);
+          yield* Effect.sleep(Duration.millis(Math.min(ASYNC_MERGE_POLL_INTERVAL_MS, remaining)));
+          latest = yield* gh.runGhJson<AsyncMergeResult>(["api", `${asyncPath}/${uuid}`]);
+        }),
+      step: () => undefined,
+    });
+  }
+
+  if (latest.status === "merged") {
+    return latest.details?.sha ?? null;
+  }
+
+  if (latest.status === "enqueued") {
+    return yield* asyncMergeFailure(
+      opts.pr,
+      latest.details?.message ?? "the pull request entered a merge queue",
+      "The merge queue owns the merge from here; it is not merged yet. Watch the PR until the queue drains.",
+      "merge_queue",
+    );
+  }
+
+  if (latest.status === "pending") {
+    return yield* asyncMergeFailure(
+      opts.pr,
+      `still pending after ${MAX_ASYNC_MERGE_WAIT_SECONDS}s`,
+      "The asynchronous merge is still running. Re-check the PR state before retrying so the merge is not requested twice.",
+    );
+  }
+
+  return yield* asyncMergeFailure(
+    opts.pr,
+    latest.details?.message ?? "the merge request failed",
+    "Inspect the PR state and branch protections, then retry.",
+  );
+});
+
 export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
   pr: number;
   strategy: MergeStrategy;
@@ -847,77 +940,92 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
 
   const mergeArgs = ["pr", "merge", String(opts.pr), `--${opts.strategy}`];
 
-  const mergeResult = yield* gh.runGh(mergeArgs).pipe(
-    Effect.catch((error) =>
-      rollbackRetargets.pipe(
-        Effect.andThen(
-          (
-            rollbackFailed,
-          ): Effect.Effect<never, GitHubNotFoundError | GitHubAuthError | GitHubMergeError> => {
-            const rollbackNote =
-              rollbackFailed.length > 0
-                ? ` ROLLBACK INCOMPLETE: dependent PR(s) ${rollbackFailed
-                    .map((child) => `#${child}`)
-                    .join(", ")} are still retargeted to \`${info.baseRefName}\`; ` +
-                  `manually restore their base to \`${info.headRefName}\`.`
-                : "";
-
-            if (error._tag !== "GitHubCommandError") {
-              return rollbackNote === ""
-                ? Effect.fail(error)
-                : Console.error(rollbackNote.trim()).pipe(Effect.andThen(Effect.fail(error)));
-            }
-
-            const stderr = error.stderr.toLowerCase();
-
-            if (stderr.includes("merge conflict") || stderr.includes("conflicts")) {
-              return Effect.fail(
-                new GitHubMergeError({
-                  message: `PR #${opts.pr} has merge conflicts`,
-                  reason: "conflicts",
-                  hint: `Resolve merge conflicts locally, push the fix, then retry the merge.${rollbackNote}`,
-                  nextCommand: `gh pr diff ${opts.pr}`,
-                }),
-              );
-            }
-
-            if (stderr.includes("required status check") || stderr.includes("checks")) {
-              return Effect.fail(
-                new GitHubMergeError({
-                  message: `PR #${opts.pr} has failing required checks`,
-                  reason: "checks_failing",
-                  hint: `Wait for CI checks to pass or investigate failures before merging.${rollbackNote}`,
-                  nextCommand: `agent-tools-gh pr checks --pr ${opts.pr}`,
-                  retryable: true,
-                }),
-              );
-            }
-
-            if (stderr.includes("protected branch")) {
-              return Effect.fail(
-                new GitHubMergeError({
-                  message: `PR #${opts.pr} targets a protected branch`,
-                  reason: "branch_protected",
-                  hint: `This branch has protection rules. Ensure required reviews and checks are satisfied, or ask a repo admin.${rollbackNote}`,
-                }),
-              );
-            }
-
-            return Effect.fail(
-              new GitHubMergeError({
-                message: `Failed to merge PR #${opts.pr}: ${error.stderr}`,
-                reason: "unknown",
-                hint: `Check the PR state and branch protections. The PR may already be merged or closed.${rollbackNote}`,
-                nextCommand: `agent-tools-gh pr view --pr ${opts.pr}`,
-              }),
-            );
-          },
-        ),
+  const mergedSha = yield* gh
+    .runGh(mergeArgs)
+    .pipe(
+      Effect.map((result) => result.stdout.match(/([0-9a-f]{7,40})/)?.[1] ?? null),
+      Effect.catchTag("GitHubCommandError", (error) =>
+        ASYNC_MERGE_REQUIRED_RE.test(error.stderr)
+          ? mergeViaAsyncApi({ pr: opts.pr, strategy: opts.strategy })
+          : Effect.fail(error),
       ),
-    ),
-  );
-
-  const shaMatch = mergeResult.stdout.match(/([0-9a-f]{7,40})/);
+    )
+    .pipe(
+      Effect.catch((error) =>
+        // A queued merge still lands, and its head branch disappears with it. Rolling the
+        // dependents back onto that branch would close them (cli/cli#1168), so keep the retargets.
+        error._tag === "GitHubMergeError" && error.reason === "merge_queue"
+          ? Effect.fail(error)
+          : rollbackRetargets.pipe(
+              Effect.andThen(
+                (
+                  rollbackFailed,
+                ): Effect.Effect<
+                  never,
+                  GitHubNotFoundError | GitHubAuthError | GitHubMergeError
+                > => {
+                  const rollbackNote =
+                    rollbackFailed.length > 0
+                      ? ` ROLLBACK INCOMPLETE: dependent PR(s) ${rollbackFailed
+                          .map((child) => `#${child}`)
+                          .join(", ")} are still retargeted to \`${info.baseRefName}\`; ` +
+                        `manually restore their base to \`${info.headRefName}\`.`
+                      : "";
+
+                  if (error._tag !== "GitHubCommandError") {
+                    return rollbackNote === ""
+                      ? Effect.fail(error)
+                      : Console.error(rollbackNote.trim()).pipe(Effect.andThen(Effect.fail(error)));
+                  }
+
+                  const stderr = error.stderr.toLowerCase();
+
+                  if (stderr.includes("merge conflict") || stderr.includes("conflicts")) {
+                    return Effect.fail(
+                      new GitHubMergeError({
+                        message: `PR #${opts.pr} has merge conflicts`,
+                        reason: "conflicts",
+                        hint: `Resolve merge conflicts locally, push the fix, then retry the merge.${rollbackNote}`,
+                        nextCommand: `gh pr diff ${opts.pr}`,
+                      }),
+                    );
+                  }
+
+                  if (stderr.includes("required status check") || stderr.includes("checks")) {
+                    return Effect.fail(
+                      new GitHubMergeError({
+                        message: `PR #${opts.pr} has failing required checks`,
+                        reason: "checks_failing",
+                        hint: `Wait for CI checks to pass or investigate failures before merging.${rollbackNote}`,
+                        nextCommand: `agent-tools-gh pr checks --pr ${opts.pr}`,
+                        retryable: true,
+                      }),
+                    );
+                  }
+
+                  if (stderr.includes("protected branch")) {
+                    return Effect.fail(
+                      new GitHubMergeError({
+                        message: `PR #${opts.pr} targets a protected branch`,
+                        reason: "branch_protected",
+                        hint: `This branch has protection rules. Ensure required reviews and checks are satisfied, or ask a repo admin.${rollbackNote}`,
+                      }),
+                    );
+                  }
+
+                  return Effect.fail(
+                    new GitHubMergeError({
+                      message: `Failed to merge PR #${opts.pr}: ${error.stderr}`,
+                      reason: "unknown",
+                      hint: `Check the PR state and branch protections. The PR may already be merged or closed.${rollbackNote}`,
+                      nextCommand: `agent-tools-gh pr view --pr ${opts.pr}`,
+                    }),
+                  );
+                },
+              ),
+            ),
+      ),
+    );
 
   // `gh pr merge --delete-branch` aborts its remote delete when the head branch is checked out in a
   // worktree; deleting the remote ref explicitly is worktree-independent. Local cleanup is separate.
@@ -944,7 +1052,7 @@ export const mergePR = Effect.fn("pr.mergePR")(function* (opts: {
     merged: true,
     strategy: opts.strategy,
     branchDeleted: willDeleteBranch,
-    sha: shaMatch?.[1] ?? null,
+    sha: mergedSha,
     retargetedChildren: retargetedChildren.length > 0 ? retargetedChildren : undefined,
     branchDeleteSkipped: branchDeleteSkipped ? true : undefined,
   };

package/src/shared/azure-credentials.ts

@@ -0,0 +1,50 @@
+/**
+ * Azure CLI surfaces that return credential material.
+ *
+ * Shared because two tools reach the Azure CLI: az-tool for the platform, and
+ * azdo-tool for the `acr`/`account` groups it still passes through for
+ * backwards compatibility. Both must refuse the same commands — a term added
+ * to one list and not the other reopens a credential read through whichever
+ * tool was missed.
+ */
+
+/** Read-shaped verbs that return credential material, in any command group. */
+export const CREDENTIAL_BLOCKED_VERBS = [
+  "get-access-token",
+  "get-credentials",
+  "get-secrets",
+  "list-account-keys",
+  "list-connection-strings",
+  "list-keys",
+  "list-publishing-credentials",
+  "list-publishing-profiles",
+  "list-secrets",
+  "show-connection-string",
+  "show-secret",
+] as const;
+
+/**
+ * Command group segments that carry credential material. For these the listing
+ * itself returns values — `az storage account keys list` and
+ * `az webapp config appsettings list` both print secrets.
+ */
+export const CREDENTIAL_BLOCKED_SEGMENTS = [
+  "admin-key",
+  "appsettings",
+  "connection-string",
+  "credential",
+  "credentials",
+  "key",
+  "keys",
+  "password",
+  "query-key",
+  "sas",
+  "secret",
+  "secrets",
+] as const;
+
+export const isCredentialBlockedVerb = (word: string): boolean =>
+  (CREDENTIAL_BLOCKED_VERBS as readonly string[]).includes(word);
+
+export const isCredentialBlockedSegment = (word: string): boolean =>
+  (CREDENTIAL_BLOCKED_SEGMENTS as readonly string[]).includes(word);

package/src/shared/binary-preflight.ts

@@ -1,6 +1,6 @@
 export const REQUIRED_BINARIES = {
   az: {
-    tools: "az-tool",
+    tools: "az-tool and azdo-tool",
     install:
       "Install it with `brew install azure-cli` (macOS) or see https://learn.microsoft.com/cli/azure/install-azure-cli.",
   },

package/dist/az-tool/build.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/az-tool/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3F,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC;;GAEG;AACH,eAAO,MAAM,gBAAgB,yLAuD3B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,YAAY;UAOP,QAAQ,EAAE;YACN,QAAQ,EAAE;wIAE9B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,YAAY,qLAkCvB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB,iMAwC7B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB,wLAgC7B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;;0IAazB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB;aAClB,MAAM;iBACF,MAAM;UACb,MAAM;oLAwDZ,CAAC"}

package/dist/az-tool/extract-option-value.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"extract-option-value.d.ts","sourceRoot":"","sources":["../../src/az-tool/extract-option-value.ts"],"names":[],"mappings":"AAAA,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,SAAS,CAQpB"}

package/dist/az-tool/transformers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"transformers.d.ts","sourceRoot":"","sources":["../../src/az-tool/transformers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,KAAK,WAAW,GAAG;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CAChC,CAAC;AAwCF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAoC/D;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,WAAW,CA6B5D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAQjE"}