@blogic-cz/agent-tools 1.10.0 → 1.11.1

package/src/gh-tool/read/review-model.ts

@@ -9,7 +9,7 @@ export const REVIEW_THREADS_QUERY = `
             comments(first: 100) {
               nodes {
                 id
-                databaseId
+                databaseId: fullDatabaseId
                 path
                 line
                 body
@@ -36,7 +36,7 @@ export const REVIEW_THREAD_COMMENTS_QUERY = `
         comments(first: 100, after: $after) {
           nodes {
             id
-            databaseId
+            databaseId: fullDatabaseId
             path
             line
             body
@@ -136,15 +136,15 @@ export const LAST_HUMAN_REVIEWER_QUERY = `
 // Internal types
 // ---------------------------------------------------------------------------
 
-export type ThreadNode = {
+export type ThreadNode<DatabaseId = number> = {
   id: string;
   isResolved: boolean;
   comments: {
     nodes: Array<{
       id: string;
-      databaseId: number;
+      databaseId: DatabaseId;
       path: string;
-      line: number;
+      line: number | null;
       body: string;
       author: { login: string };
       commit: { oid: string } | null;
@@ -154,14 +154,14 @@ export type ThreadNode = {
 };
 
 export type ThreadCommentsQueryResult = {
-  node: { comments: ThreadNode["comments"] } | null;
+  node: { comments: ThreadNode<string | null>["comments"] } | null;
 };
 
 export type ThreadsQueryResult = {
   repository: {
     pullRequest: {
       reviewThreads: {
-        nodes: ThreadNode[];
+        nodes: ThreadNode<string | null>[];
         pageInfo: {
           hasNextPage: boolean;
           endCursor: string | null;
@@ -243,7 +243,10 @@ export type RawReviewComment = {
   user: { login: string };
   body: string;
   path: string;
-  line: number;
+  line: number | null;
+  original_line?: number | null;
+  original_commit_id?: string | null;
+  diff_hunk?: string | null;
   created_at: string;
   updated_at: string;
   pull_request_review_id?: number | null;

package/src/gh-tool/read/reviews.ts

@@ -1,5 +1,6 @@
 import { Effect, Schema } from "effect";
 import { GitHubService } from "#gh/read/transport";
+import { GitHubCommandError } from "#gh/errors";
 import { cachedRead } from "./cache";
 import { gatedRead } from "./gated";
 import { restSnapshot, snapshotDigest } from "./rest";
@@ -20,6 +21,28 @@ import type {
   RawPullRequestReview,
 } from "./review-model";
 
+const CachedThreads = Schema.Array(
+  Schema.Struct({
+    id: Schema.String,
+    isResolved: Schema.Boolean,
+    comments: Schema.Struct({
+      nodes: Schema.Array(
+        Schema.Struct({
+          id: Schema.String,
+          databaseId: Schema.Number.check(
+            Schema.makeFilter((id) => Number.isSafeInteger(id) && id > 0),
+          ),
+          path: Schema.String,
+          line: Schema.NullOr(Schema.Number),
+          body: Schema.String,
+          author: Schema.Struct({ login: Schema.String }),
+          commit: Schema.NullOr(Schema.Struct({ oid: Schema.String })),
+        }),
+      ),
+    }),
+  }),
+);
+
 const originThreads = Effect.fn("pr.fetchAllThreadNodes")(function* (
   repoInfo: RepoRef,
   pr: number,
@@ -50,7 +73,27 @@ const originThreads = Effect.fn("pr.fetchAllThreadNodes")(function* (
         node.comments.pageInfo = commentsResponse.node.comments.pageInfo;
         commentsAfter = commentsResponse.node.comments.pageInfo?.endCursor ?? null;
       }
-      nodes.push(node);
+      const comments: ThreadNode["comments"]["nodes"] = [];
+      for (const comment of node.comments.nodes) {
+        // fullDatabaseId is a GraphQL BigInt string, aliased to the existing internal key.
+        const rawId: unknown = comment.databaseId;
+        const databaseId = typeof rawId === "string" ? Number(rawId) : rawId;
+        if (
+          typeof databaseId !== "number" ||
+          !Number.isSafeInteger(databaseId) ||
+          databaseId < 1 ||
+          (typeof rawId === "string" && String(databaseId) !== rawId)
+        ) {
+          return yield* new GitHubCommandError({
+            command: "gh api graphql",
+            exitCode: 1,
+            message: "GitHub returned a missing or unsafe review comment ID",
+            stderr: "Cannot represent fullDatabaseId as a positive safe integer",
+          });
+        }
+        comments.push({ ...comment, databaseId });
+      }
+      nodes.push({ ...node, comments: { ...node.comments, nodes: comments } });
     }
 
     if (!page.pageInfo.hasNextPage || page.pageInfo.endCursor === null) {
@@ -86,7 +129,10 @@ export const reviewThreads = Effect.fn("reads.reviewThreads")(function* (
   return yield* gatedRead({
     key: { op: "reviewThreads", repo, pr },
     consistency,
-    decode: (raw) => Schema.decodeUnknownSync(Schema.Array(Schema.Unknown))(raw) as ThreadNode[],
+    decode: (raw): ThreadNode[] => {
+      Schema.decodeUnknownSync(CachedThreads)(raw);
+      return raw as ThreadNode[];
+    },
     fetch: originThreads(repo, pr),
     signal: reviewPages(repo, pr, "prComments").pipe(Effect.map(snapshotDigest)),
     maxAgeMs: () => OPS.reviewThreads.maxAgeMs,

package/src/gh-tool/read/waits.ts

@@ -7,7 +7,7 @@ const until = <A, E, R>(
   read: Effect.Effect<A, E, R>,
   done: (value: A) => boolean,
   opts: {
-    readonly intervalMs: number;
+    readonly intervalMs: number | ((value: A) => number);
     readonly timeoutMs: number;
     readonly initial?: { readonly value: A };
     readonly readAtDeadline?: boolean;
@@ -31,7 +31,17 @@ const until = <A, E, R>(
             return;
           }
           yield* Effect.sleep(
-            Duration.millis(Math.min(Math.max(5000, opts.intervalMs), remaining)),
+            Duration.millis(
+              Math.min(
+                Math.max(
+                  5000,
+                  typeof opts.intervalMs === "number"
+                    ? opts.intervalMs
+                    : opts.intervalMs(state.value),
+                ),
+                remaining,
+              ),
+            ),
           );
           if (
             Number(yield* Clock.currentTimeMillis) >= deadline &&

package/src/gh-tool/types.ts

@@ -35,7 +35,10 @@ export type ReviewThread = {
   feedbackOrigin: FeedbackOrigin;
   commentId: number;
   path: string;
-  line: number;
+  line: number | null;
+  originalLine: number | null;
+  originalCommitSha: string | null;
+  diffHunk: string | null;
   body: string;
   isResolved: boolean;
   hasReply: boolean;
@@ -58,7 +61,10 @@ export type ReviewComment = {
   author: string;
   body: string;
   path: string;
-  line: number;
+  line: number | null;
+  originalLine: number | null;
+  originalCommitSha: string | null;
+  diffHunk: string | null;
   createdAt: string;
   reviewId: number | null;
   /**
@@ -340,7 +346,13 @@ export type StackView = {
 
 export type StackMergeBlocker = {
   number: number;
-  reason: "draft" | "not_mergeable" | "mergeability_unknown" | "checks_failing" | "checks_pending";
+  reason:
+    | "draft"
+    | "not_mergeable"
+    | "mergeability_unknown"
+    | "checks_failing"
+    | "checks_pending"
+    | "checks_none_reported";
   detail: string;
 };
 

package/src/observability-tool/main.ts

@@ -7,6 +7,7 @@ import { Command } from "effect/cli";
 import { ConfigServiceLayer } from "#config";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
 import { withRedactedOutput } from "#shared/output-boundary";
+import { SecretEnvResolver } from "#shared/secret-env";
 import { makeSchemaCommand, renderCauseToStderr, VERSION } from "#shared";
 
 import { metricsCommand } from "./metrics";
@@ -24,7 +25,12 @@ const mainCommand = Command.make("observability-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, { version: VERSION, renderErrors: false });
 
-const MainLayer = Layer.mergeAll(BunServices.layer, ConfigServiceLayer, AuditServiceLayer);
+const MainLayer = Layer.mergeAll(
+  BunServices.layer,
+  ConfigServiceLayer,
+  AuditServiceLayer,
+  SecretEnvResolver.liveLayer,
+);
 
 const program = withRedactedOutput(withAudit("observability", cli)).pipe(
   Effect.provide(MainLayer),

package/src/observability-tool/shared.ts

@@ -5,7 +5,8 @@ import { ConfigService, getToolConfig } from "#config";
 import type { ObservabilityConfig } from "#config";
 
 import { ObservabilityToolError } from "./errors";
-import { registerResolvedSecret, unsafeOutboundTextReason } from "#shared/content-security";
+import { redactSensitiveText, unsafeOutboundTextReason } from "#shared/content-security";
+import { SecretEnvResolver } from "#shared/secret-env";
 import type {
   DsQueryOpts,
   DsQueryResponse,
@@ -48,18 +49,15 @@ export const profileOption = Flag.optional(
   ),
 );
 
-function resolveToken(tokenEnvVar?: string): string | undefined {
+function resolveToken(
+  resolver: SecretEnvResolver["Service"],
+  tokenEnvVar?: string,
+): Promise<string | undefined> {
   if (!tokenEnvVar) {
-    return undefined;
-  }
-
-  const token = process.env[tokenEnvVar];
-  if (!token) {
-    throw new Error(`${tokenEnvVar} environment variable is not set`);
+    return Promise.resolve(undefined);
   }
 
-  registerResolvedSecret(token);
-  return token;
+  return resolver.resolveSecretEnv(tokenEnvVar);
 }
 
 async function discoverDatasources(url: string, token?: string): Promise<GrafanaDatasource[]> {
@@ -68,7 +66,9 @@ async function discoverDatasources(url: string, token?: string): Promise<Grafana
 
   if (!response.ok) {
     const body = await response.text().catch(() => "");
-    throw new Error(`Grafana API ${response.status}: /api/datasources — ${body}`);
+    throw new Error(
+      redactSensitiveText(`Grafana API ${response.status}: /api/datasources — ${body}`),
+    );
   }
 
   return (await response.json()) as GrafanaDatasource[];
@@ -102,13 +102,14 @@ export function requireTempoUid(
 async function resolveFromProfile(
   profile: ObservabilityConfig | undefined,
   env: string,
+  resolver: SecretEnvResolver["Service"],
 ): Promise<ObservabilityEnvConfig | undefined> {
   const environment = profile?.environments[env];
   if (!environment) {
     return undefined;
   }
 
-  const token = resolveToken(environment.tokenEnvVar);
+  const token = await resolveToken(resolver, environment.tokenEnvVar);
   const datasources = await discoverDatasources(environment.url, token);
 
   // Tempo is optional: metrics/logs work on Grafana instances without it (e.g. Percona PMM).
@@ -157,6 +158,7 @@ function resolveFromEnv(
 export const resolveConfig = (env: string, profile: Option.Option<string>) =>
   Effect.gen(function* () {
     const config = yield* ConfigService;
+    const secretEnvResolver = yield* SecretEnvResolver;
     const profileName = Option.getOrUndefined(profile);
     const observabilityConfig = getToolConfig<ObservabilityConfig>(
       config,
@@ -166,7 +168,11 @@ export const resolveConfig = (env: string, profile: Option.Option<string>) =>
 
     return yield* Effect.tryPromise({
       try: async () => {
-        const profileResolved = await resolveFromProfile(observabilityConfig, env);
+        const profileResolved = await resolveFromProfile(
+          observabilityConfig,
+          env,
+          secretEnvResolver,
+        );
         if (profileResolved) {
           return profileResolved;
         }
@@ -258,7 +264,7 @@ export function observabilityFetch<T>(
 
       if (!response.ok) {
         const body = await response.text().catch(() => "");
-        throw new Error(`Grafana API ${response.status}: ${path} — ${body}`);
+        throw new Error(redactSensitiveText(`Grafana API ${response.status}: ${path} — ${body}`));
       }
 
       return (await response.json()) as T;

package/src/shared/content-security.ts

@@ -12,8 +12,13 @@ const MIN_SECRET_LENGTH = 8;
 const resolvedSecrets = new Set<string>();
 
 /** Redact a credential a tool resolved outside a sensitively named environment variable. */
-export const registerResolvedSecret = (value: string) => {
-  if (value.length >= MIN_SECRET_LENGTH) resolvedSecrets.add(value);
+export const registerResolvedSecret = (
+  value: string,
+  options: { readonly allowShort?: boolean } = {},
+) => {
+  if (value.length > 0 && (options.allowShort === true || value.length >= MIN_SECRET_LENGTH)) {
+    resolvedSecrets.add(value);
+  }
 };
 
 const sensitiveEnvironmentValues = (environment: Record<string, string | undefined>) =>

package/src/shared/secret-env.ts

@@ -0,0 +1,230 @@
+import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+import { relative, resolve as resolvePath } from "node:path";
+import { Context, Layer } from "effect";
+
+import { registerResolvedSecret } from "./content-security";
+
+const SECRET_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+const CONFIG_NAME_PATTERN = /^[A-Za-z0-9_]+$/;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const STARTUP_ENV_NAMES = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "TMPDIR",
+  "XDG_CONFIG_HOME",
+  "ZDOTDIR",
+] as const;
+
+export type LookupResult =
+  | { readonly _tag: "found"; readonly value: string }
+  | { readonly _tag: "absent" }
+  | { readonly _tag: "failed"; readonly reason: string };
+
+export type ZshRunner = (name: string, timeoutMs: number) => Promise<LookupResult>;
+
+const failed = (name: string): LookupResult => ({ _tag: "failed", reason: name });
+
+type FrameInspection =
+  | { readonly _tag: "incomplete" }
+  | { readonly _tag: "malformed" }
+  | { readonly _tag: "complete"; readonly result: LookupResult };
+
+const inspectFrame = (frame: Buffer): FrameInspection => {
+  const firstNewline = frame.indexOf(10);
+  if (firstNewline < 0) {
+    const prefix = frame.toString("ascii");
+    return "set".startsWith(prefix) || "unset".startsWith(prefix)
+      ? { _tag: "incomplete" }
+      : { _tag: "malformed" };
+  }
+
+  const state = frame.subarray(0, firstNewline).toString("ascii");
+  if (state === "unset") {
+    return firstNewline === frame.length - 1
+      ? { _tag: "complete", result: { _tag: "absent" } }
+      : { _tag: "malformed" };
+  }
+  if (state !== "set") return { _tag: "malformed" };
+
+  const lengthEnd = frame.indexOf(10, firstNewline + 1);
+  if (lengthEnd < 0) {
+    const lengthPrefix = frame.subarray(firstNewline + 1).toString("ascii");
+    if (/^(0|[1-9][0-9]*)$/.test(lengthPrefix) || lengthPrefix === "") {
+      return { _tag: "incomplete" };
+    }
+    return { _tag: "malformed" };
+  }
+  const lengthText = frame.subarray(firstNewline + 1, lengthEnd).toString("ascii");
+  if (!/^(0|[1-9][0-9]*)$/.test(lengthText)) return { _tag: "malformed" };
+
+  const length = Number(lengthText);
+  const start = lengthEnd + 1;
+  if (!Number.isSafeInteger(length)) return { _tag: "malformed" };
+  if (start + length < frame.length) return { _tag: "malformed" };
+  if (start + length > frame.length) return { _tag: "incomplete" };
+  return {
+    _tag: "complete",
+    result: { _tag: "found", value: frame.subarray(start).toString("utf8") },
+  };
+};
+
+const runInteractiveZsh: ZshRunner = (name, timeoutMs) =>
+  new Promise((resolve) => {
+    if (process.env.VITEST !== undefined) {
+      const home = process.env.HOME;
+      const zdotdir = process.env.ZDOTDIR;
+      const relativeZdotdir = zdotdir ? relative(tmpdir(), resolvePath(zdotdir)) : "..";
+      if (
+        !home ||
+        !zdotdir ||
+        resolvePath(home) !== resolvePath(zdotdir) ||
+        relativeZdotdir === ".." ||
+        relativeZdotdir.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)
+      ) {
+        resolve(failed(name));
+        return;
+      }
+    }
+
+    const childEnv = Object.fromEntries(
+      STARTUP_ENV_NAMES.flatMap((key) => {
+        const value = process.env[key];
+        return value === undefined ? [] : [[key, value]];
+      }),
+    );
+    const script = `export LC_ALL=C; if (( \${+parameters[$1]} )); then value=\${(P)1}; print -ru3 -- "set"; print -ru3 -- "\${#value}"; print -rn -- "$value" >&3; else print -ru3 -- "unset"; fi`;
+
+    let child: ReturnType<typeof spawn>;
+    try {
+      child = spawn("zsh", ["-i", "-c", script, "agent-tools-secret-env", name], {
+        detached: true,
+        env: childEnv,
+        stdio: ["ignore", "ignore", "ignore", "pipe"],
+      });
+    } catch {
+      resolve(failed(name));
+      return;
+    }
+
+    const stream = child.stdio[3];
+    if (!stream || typeof stream === "number") {
+      child.kill("SIGKILL");
+      resolve(failed(name));
+      return;
+    }
+
+    const chunks: Buffer[] = [];
+    let exited = false;
+    let ended = false;
+    let exitCode: number | null = null;
+    let settled = false;
+    const killProcessGroup = () => {
+      if (child.pid === undefined) return;
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        // The process group may already have exited.
+      }
+    };
+    const finish = (result: LookupResult) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      stream.destroy();
+      killProcessGroup();
+      resolve(result);
+    };
+    const checkFrame = () => {
+      if (settled) return;
+      const inspection = inspectFrame(Buffer.concat(chunks));
+      if (inspection._tag === "malformed") return finish(failed(name));
+      if (!exited) return;
+      if (exitCode !== 0) return finish(failed(name));
+      if (inspection._tag === "complete") finish(inspection.result);
+      else if (ended) finish(failed(name));
+    };
+    const timer = setTimeout(() => {
+      finish(failed(name));
+    }, timeoutMs);
+
+    stream.on("data", (chunk: Buffer | string) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      checkFrame();
+    });
+    stream.on("end", () => {
+      ended = true;
+      checkFrame();
+    });
+    stream.on("error", () => finish(failed(name)));
+    child.on("error", () => finish(failed(name)));
+    child.on("exit", (code) => {
+      exited = true;
+      exitCode = code;
+      checkFrame();
+    });
+  });
+
+export class SecretEnvResolver extends Context.Service<
+  SecretEnvResolver,
+  {
+    readonly resolveSecretEnv: (name: string) => Promise<string>;
+    readonly lookupConfigEnv: (name: string) => Promise<LookupResult>;
+  }
+>()("@agent-tools/SecretEnvResolver") {
+  static get liveLayer() {
+    return makeSecretEnvResolverLayer();
+  }
+  static readonly testLayer = (runner: ZshRunner = () => Promise.resolve({ _tag: "absent" })) =>
+    makeSecretEnvResolverLayer(runner);
+}
+
+export function makeSecretEnvResolverLayer(
+  runner: ZshRunner = runInteractiveZsh,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+) {
+  return Layer.sync(SecretEnvResolver, () => {
+    const cache = new Map<string, Promise<LookupResult>>();
+    const lookup = (name: string, emptyProcessValueWins: boolean): Promise<LookupResult> => {
+      const fromProcess = process.env[name];
+      if (fromProcess !== undefined && (emptyProcessValueWins || fromProcess !== "")) {
+        return Promise.resolve({ _tag: "found", value: fromProcess });
+      }
+
+      let result = cache.get(name);
+      if (!result) {
+        result = Promise.resolve()
+          .then(() => runner(name, timeoutMs))
+          .catch(() => failed(name));
+        cache.set(name, result);
+      }
+      return result;
+    };
+    const lookupConfigEnv = (name: string): Promise<LookupResult> => {
+      if (!CONFIG_NAME_PATTERN.test(name)) return Promise.resolve(failed(name));
+      return lookup(name, true);
+    };
+    const resolveSecretEnv = async (name: string): Promise<string> => {
+      if (!SECRET_NAME_PATTERN.test(name)) {
+        throw new Error(`Invalid environment variable name: ${name}`);
+      }
+      const result = await lookup(name, false);
+      if (result._tag !== "found") {
+        throw new Error(`${name} is not in the environment or in the interactive zsh`);
+      }
+      if (result.value.length < 4) {
+        throw new Error(`${name} is too short to redact safely`);
+      }
+      registerResolvedSecret(result.value, { allowShort: true });
+      return result.value;
+    };
+
+    return SecretEnvResolver.of({ resolveSecretEnv, lookupConfigEnv });
+  });
+}