@blogic-cz/agent-tools 1.12.0 → 1.13.1

package/src/gh-tool/read/porcelain.ts

@@ -29,6 +29,7 @@ export const WorkflowRun = Schema.Struct({
   event: Schema.String,
   url: Schema.String,
   workflowName: Schema.String,
+  workflowDatabaseId: Schema.optionalKey(Schema.NullOr(Schema.Number)),
 });
 export const WorkflowRunDetail = Schema.Struct({
   ...WorkflowRun.fields,
@@ -39,7 +40,7 @@ export type WorkflowJob = typeof WorkflowJob.Type;
 export type WorkflowRun = typeof WorkflowRun.Type;
 export type WorkflowRunDetail = typeof WorkflowRunDetail.Type;
 export const RUN_LIST_FIELDS =
-  "databaseId,displayTitle,status,conclusion,headBranch,headSha,createdAt,event,url,workflowName";
+  "databaseId,displayTitle,status,conclusion,headBranch,headSha,createdAt,event,url,workflowName,workflowDatabaseId";
 export const RUN_VIEW_FIELDS = `${RUN_LIST_FIELDS},jobs,attempt`;
 
 export const parsePreserving =

package/src/gh-tool/read/pulls.ts

@@ -101,6 +101,25 @@ export const prHead = Effect.fn("reads.prHead")(function* (
   return { headSha: head.head.sha, baseSha: head.base.sha, signature: snapshotDigest(snapshot) };
 });
 
+const PRBody = Schema.Struct({ body: Schema.NullOr(Schema.String) });
+
+export const prBody = Effect.fn("reads.prBody")(function* (repo: RepoRef, pr: number) {
+  const gh = yield* GitHubService;
+  const path = `repos/${repoSlug(repo)}/pulls/${pr}`;
+  const response = yield* gh.apiRequest<unknown>({ path });
+  const parsed = yield* Effect.try({
+    try: () => Schema.decodeUnknownSync(PRBody)(response.body),
+    catch: (error) =>
+      new GitHubCommandError({
+        command: `GET ${path}`,
+        exitCode: 0,
+        message: `GitHub returned an invalid PR body: ${String(error)}`,
+        stderr: `GitHub returned an invalid PR body: ${String(error)}`,
+      }),
+  });
+  return parsed.body ?? "";
+});
+
 export const checkSignal = Effect.fn("reads.checkSignal")(function* (repo: RepoRef, sha: string) {
   const snapshot = yield* restSnapshot({ op: "checkSignal", repo, sha }, [
     {

package/src/gh-tool/read/reads.ts

@@ -6,7 +6,7 @@ import { cachedRead, ReadCache } from "./cache";
 import { OPS } from "./classes";
 import { repoSlug } from "./keys";
 import { issueView, issueList, issueComments } from "./issues";
-import { prView, prList, prChecks, prHead, checkSignal } from "./pulls";
+import { prView, prList, prChecks, prHead, prBody, checkSignal } from "./pulls";
 import { prComments, prReviews, reviewThreads, lastHumanReviewer } from "./reviews";
 import { reviewGuards } from "./review-guards";
 import type { RepoRef, RunFilter } from "./keys";
@@ -376,6 +376,7 @@ export const reads = {
   prList,
   prChecks,
   prHead,
+  prBody,
   checkSignal,
   runList,
   runView,

package/src/gh-tool/read/transport.ts

@@ -1,11 +1,16 @@
 import { ghSubprocessEvent, recordRequest } from "./telemetry";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { Context, Effect, Layer, Stream } from "effect";
+import { Context, Effect, Layer, Schema, Stream } from "effect";
 
 import type { GitHubRepoConfig } from "#config";
 import type { RepoInfo } from "#gh/types";
 import type { RepoRef } from "./keys";
 
+import {
+  bunMarkdownOutline,
+  findCheckboxLines,
+  validateCheckboxEdit,
+} from "#gh/pr/checkbox-markdown";
 import { GH_BINARY } from "#gh/config";
 import { ghEnvironment } from "#gh/environment";
 import { GitHubAuthError, GitHubCommandError, GitHubNotFoundError } from "#gh/errors";
@@ -80,11 +85,20 @@ export type GhResult = {
 };
 
 export type GhError = GitHubCommandError | GitHubAuthError | GitHubNotFoundError;
+export type PRCheckboxWrite = {
+  readonly repo: RepoRef;
+  readonly pr: number;
+  readonly expectedBody: string;
+  readonly boxOffset: number;
+  readonly replacement: " " | "x";
+  readonly selectionText: readonly string[];
+};
 
 export class GitHubService extends Context.Service<
   GitHubService,
   {
     readonly runGh: (args: string[]) => Effect.Effect<GhResult, GhError>;
+    readonly writePRCheckbox?: (opts: PRCheckboxWrite) => Effect.Effect<GhResult, GhError>;
     readonly runGhJson: <T>(args: string[]) => Effect.Effect<T, GhError>;
     readonly runGraphQL: (
       query: string,
@@ -325,6 +339,75 @@ export class GitHubService extends Context.Service<
           });
         };
 
+        const writePRCheckbox = Effect.fn("GitHubService.writePRCheckbox")(function* (
+          opts: PRCheckboxWrite,
+        ) {
+          const path = `repos/${opts.repo.owner}/${opts.repo.name}/pulls/${opts.pr}`;
+          const response = yield* githubApi<unknown>({ path });
+          const parsed = yield* Effect.try({
+            try: () =>
+              Schema.decodeUnknownSync(Schema.Struct({ body: Schema.NullOr(Schema.String) }))(
+                response.body,
+              ),
+            catch: (error) =>
+              new GitHubCommandError({
+                command: `GET ${path}`,
+                exitCode: 0,
+                message: `GitHub returned an invalid PR body: ${String(error)}`,
+                stderr: `GitHub returned an invalid PR body: ${String(error)}`,
+              }),
+          });
+          const body = parsed.body ?? "";
+          if (body !== opts.expectedBody) {
+            return yield* new GitHubCommandError({
+              command: "gh-tool pr checkbox",
+              exitCode: 1,
+              stderr: `PR #${opts.pr} body changed before the checkbox update`,
+              message: `Refusing to update PR #${opts.pr}: its body changed after the first read`,
+              hint: "Re-read the pull request and retry with the current task text.",
+            });
+          }
+
+          const checkboxes = findCheckboxLines(
+            body,
+            opts.selectionText[0] ?? "",
+            null,
+            bunMarkdownOutline,
+          );
+          if (
+            !checkboxes.some((checkbox) => checkbox.offset === opts.boxOffset) ||
+            body[opts.boxOffset] === opts.replacement
+          ) {
+            return yield* new GitHubCommandError({
+              command: "gh-tool pr checkbox",
+              exitCode: 1,
+              stderr: "Refusing an invalid PR checkbox position",
+              message: "Refusing to update a character that is not a task checkbox",
+            });
+          }
+
+          yield* Effect.try({
+            try: () => validateCheckboxEdit(body, opts.boxOffset, opts.replacement),
+            catch: () =>
+              new GitHubCommandError({
+                command: "gh-tool pr checkbox",
+                exitCode: 1,
+                stderr: "PR body structure is ambiguous; tick this item in the GitHub UI",
+                message: "Refusing to update the PR checkbox because its source is ambiguous",
+                hint: "PR body structure is ambiguous; tick this item in the GitHub UI.",
+              }),
+          });
+
+          const updatedBody =
+            body.slice(0, opts.boxOffset) + opts.replacement + body.slice(opts.boxOffset + 1);
+          const args = ["api", "--method", "PATCH", path, "-f", `body=${updatedBody}`];
+          const outboundText = [...args];
+          outboundText[5] = "body=[GitHub PR body]";
+          outboundText.push(...opts.selectionText);
+          yield* validateOutboundText(outboundText.join("\n"), "gh-tool pr checkbox");
+          return yield* runGhAttempt(args);
+        });
+
         const runGhJson = <T>(args: string[]) =>
           Effect.gen(function* () {
             const result = yield* runGh(args);
@@ -415,6 +498,7 @@ export class GitHubService extends Context.Service<
 
         return {
           runGh,
+          writePRCheckbox,
           runGhJson,
           runGraphQL,
           apiRequest: githubApi,

package/src/gh-tool/read/writes.ts

@@ -1,8 +1,9 @@
 import { Effect } from "effect";
+import { GitHubCommandError } from "#gh/errors";
 import { GitHubService } from "#gh/read/transport";
 import { invalidate } from "./cache";
 import type { Tag } from "./keys";
-import type { GhError } from "#gh/read/transport";
+import type { GhError, PRCheckboxWrite } from "#gh/read/transport";
 import type { GitHubApiRequest } from "#gh/read/api";
 
 const mutate = <A, R>(effect: Effect.Effect<A, GhError, R>, touched: readonly Tag[]) =>
@@ -15,6 +16,22 @@ const run = Effect.fn("writes.run")(function* (argv: string[], touched: readonly
   const gh = yield* GitHubService;
   return yield* mutate(gh.runGh(argv), touched);
 });
+const prCheckbox = Effect.fn("writes.prCheckbox")(function* (
+  opts: PRCheckboxWrite,
+  touched: readonly Tag[],
+) {
+  const gh = yield* GitHubService;
+  if (gh.writePRCheckbox === undefined) {
+    return yield* new GitHubCommandError({
+      command: "gh-tool pr checkbox",
+      exitCode: 1,
+      stderr: "PR checkbox writes are unavailable",
+      message:
+        "Refusing to update the PR checkbox because the GitHub service cannot verify the body",
+    });
+  }
+  return yield* mutate(gh.writePRCheckbox(opts), touched);
+});
 const json = <A>(argv: string[], touched: readonly Tag[]) =>
   Effect.gen(function* () {
     const gh = yield* GitHubService;
@@ -34,4 +51,4 @@ const api = <A>(request: GitHubApiRequest, touched: readonly Tag[]) =>
     const gh = yield* GitHubService;
     return yield* mutate(gh.apiRequest<A>(request), touched);
   });
-export const writes = { run, json, graphql, api };
+export const writes = { run, prCheckbox, json, graphql, api };

package/src/gh-tool/types.ts

@@ -192,6 +192,7 @@ export type RerunCheckAttempt = {
   attempt?: number | null;
   jobs: readonly RerunCheckJob[];
   status?: string;
+  conclusion?: string | null;
 };
 
 export type RerunChecksRun = {
@@ -210,7 +211,14 @@ export type RerunChecksReport = {
   rerun: number;
   failed?: number;
   message: string;
-  status?: "evidence_unavailable" | "escalation_required" | "failed" | "rerun_started";
+  status?:
+    | "evidence_unavailable"
+    | "escalation_required"
+    | "failed"
+    | "rerun_started"
+    | "completed"
+    | "watch_timeout"
+    | "discovery_timeout";
   runs?: RerunChecksRun[];
 };
 

package/src/gh-tool/workflow.ts

@@ -3,7 +3,7 @@ import { Effect, Option } from "effect";
 
 import { formatOption, logFormatted, logText } from "#shared";
 import { CI_CHECK_WATCH_TIMEOUT_MS } from "#gh/config";
-import { GitHubCommandError, GitHubNotFoundError } from "./errors";
+import { GitHubCommandError, GitHubNotFoundError, GitHubTimeoutError } from "./errors";
 import { GitHubService } from "./read/transport";
 import { reads, resolveRepo, waits, writes } from "./read";
 import { rawJobLog } from "./read/reads";
@@ -57,13 +57,54 @@ const listRuns = Effect.fn("workflow.listRuns")(function* (opts: {
     event: null,
     limit: opts.limit,
   });
-  return runs.map(({ headSha: _headSha, ...run }) => run);
+  return runs.map(({ headSha: _headSha, workflowDatabaseId, ...run }) => {
+    if (run.conclusion !== "cancelled") return run;
+    const newer = runs
+      .filter(
+        (candidate) =>
+          workflowDatabaseId !== undefined &&
+          workflowDatabaseId !== null &&
+          workflowDatabaseId > 0 &&
+          candidate.workflowDatabaseId === workflowDatabaseId &&
+          run.headBranch.length > 0 &&
+          candidate.headBranch === run.headBranch &&
+          candidate.event === run.event &&
+          candidate.databaseId !== run.databaseId &&
+          Date.parse(candidate.createdAt) > Date.parse(run.createdAt),
+      )
+      .toSorted(
+        (left, right) =>
+          Date.parse(right.createdAt) - Date.parse(left.createdAt) ||
+          right.databaseId - left.databaseId,
+      )[0];
+    return Object.assign(
+      run,
+      { cancellationReason: "unknown" },
+      newer === undefined
+        ? {}
+        : {
+            newerRun: {
+              databaseId: newer.databaseId,
+              status: newer.status,
+              conclusion: newer.conclusion,
+              url: newer.url,
+              context:
+                "Newer run in this list with the same workflow, branch and event. The cancellation reason is unknown.",
+            },
+          },
+    );
+  });
 });
 
 const viewRun = Effect.fn("workflow.viewRun")(function* (runId: number, repo: string | null) {
   const target = yield* resolveRepo(repo);
   const detail = yield* reads.runView(target, runId);
-  const { attempt: _attempt, headSha: _headSha, ...snapshot } = detail;
+  const {
+    attempt: _attempt,
+    headSha: _headSha,
+    workflowDatabaseId: _workflowDatabaseId,
+    ...snapshot
+  } = detail;
   return snapshot;
 });
 
@@ -276,13 +317,16 @@ const watchRun = Effect.fn("workflow.watchRun")(function* (
   );
   const finalState = outcome.kind === "done" ? outcome.value : outcome.last;
 
-  return buildWatchResult(
-    runId,
-    finalState,
-    outcome.kind === "timedOut" ? null : progress.join("\n"),
-    frames,
-    timeoutSeconds,
-  );
+  return {
+    kind: outcome.kind,
+    result: buildWatchResult(
+      runId,
+      finalState,
+      outcome.kind === "timedOut" ? null : progress.join("\n"),
+      frames,
+      timeoutSeconds,
+    ),
+  };
 });
 
 const fetchAnnotations = Effect.fn("workflow.fetchAnnotations")(function* (opts: {
@@ -864,8 +908,16 @@ export const workflowWatchCommand = Command.make(
   ({ format, frames, repo, run, timeout }) =>
     Effect.gen(function* () {
       const resolvedRepo = yield* resolveRepoArg(repo);
-      const result = yield* watchRun(run, resolvedRepo, timeout, frames);
+      const { kind, result } = yield* watchRun(run, resolvedRepo, timeout, frames);
       yield* logFormatted(result, format);
+      if (kind === "timedOut") {
+        return yield* new GitHubTimeoutError({
+          message: `Workflow run ${run} timed out after ${timeout}s with status ${result.status}`,
+          timeoutMs: timeout * 1000,
+          hint: "The snapshot shows an unfinished run. Run workflow watch again to keep watching.",
+          nextCommand: `agent-tools-gh workflow watch --run ${run}${resolvedRepo === null ? "" : ` --repo ${resolvedRepo}`}`,
+        });
+      }
     }),
 ).pipe(Command.withDescription("Watch a workflow run until it completes, then show final status"));
 

package/src/shared/content-security.ts

@@ -6,6 +6,7 @@ const isSensitiveEnvironmentName = (name: string) =>
   name !== "PWD" &&
   name !== "OLDPWD" &&
   name !== "CODEX_SESSION_ID" &&
+  name !== "GITHUB_AUTH_USER" &&
   SENSITIVE_ENV_NAME.test(name);
 
 const MIN_SECRET_LENGTH = 8;