@cxi-lmai/ci-agent-platform 3.1.1 → 3.1.3

package/README.md

@@ -144,6 +144,13 @@ picked, not both. Claude-harness model usage is billed by Anthropic, while
 omp-harness model usage is billed by OpenRouter. GitLab only for now; GitHub
 Actions omp support is not shipped yet.
 
+`omp` is a Bun program, so the GitLab template's `before_script` installs
+`bun` next to it (`npm install -g bun`) — the default `node:22-bookworm` image
+ships no Bun runtime, and without it every agent call fails while the job
+still reports success. A custom `PIPE_CI_IMAGE` needs nothing beyond node +
+npm for that install to work. If the harness binary cannot execute, the job
+now fails immediately instead of going green with no review.
+
 ### What it costs
 
 Every pipeline job spends paid model usage, so the defaults are deliberately

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cxi-lmai/ci-agent-platform",
-  "version": "3.1.1",
+  "version": "3.1.3",
   "description": "Autonomous dev pipeline on plain GitLab CI or GitHub Actions, driven by Claude Code. A labeled issue goes in, an open merge request comes out.",
   "keywords": [
     "claude",

package/payload/ci-templates/claude-pipeline.gitlab-ci.yml

@@ -31,8 +31,9 @@ variables:
   PIPE_SCRIPTS_DIR: ".claude-pipeline/scripts"
 
   # --- CI image (see ci-templates decision note) -----------------------------
-  # Must provide: node + npm, git, curl. jq and claude-code are installed in
-  # before_script when missing. The runner scripts talk to the GitLab API with
+  # Must provide: node + npm, git, curl. jq, claude-code, and (when
+  # PIPE_HARNESS=omp) bun + omp are installed in before_script when missing.
+  # The runner scripts talk to the GitLab API with
   # curl and jq directly, so no glab is needed in the image; glab is only used
   # interactively, by the install wizard.
   # Python caveat (E2E finding N-7): node:22-bookworm ships python3 but NOT
@@ -162,7 +163,7 @@ variables:
 
 # --- Hidden base job: shared config + runtime variable mapping ---------------
 # Maps GitLab's CI_ runtime variables onto the PIPE_ names the scripts read, and
-# installs claude-code if the image does not ship it.
+# installs the selected harness (and its runtime) if the image does not ship it.
 .claude-base:
   image: $PIPE_CI_IMAGE
   variables:
@@ -193,6 +194,12 @@ variables:
       fi
     - |
       if [ "$PIPE_HARNESS" = "omp" ]; then
+        # omp is a Bun program (`#!/usr/bin/env bun`, engines.bun >= 1.3.14)
+        # and node:22-bookworm ships no bun, so the installed `omp` shim is
+        # unrunnable without it. The `bun` npm package postinstalls the real
+        # binary, so no curl|bash and no image change is needed. Deliberately
+        # no `|| true`: a missing harness runtime must fail the job loudly.
+        command -v bun >/dev/null 2>&1 || npm install -g bun
         command -v omp >/dev/null 2>&1 || npm install -g @oh-my-pi/pi-coding-agent
       else
         command -v claude >/dev/null 2>&1 || npm install -g @anthropic-ai/claude-code

package/payload/ci-templates/scripts/lib/issue-loop.sh

@@ -120,6 +120,35 @@ _gli_issue_state() {
   curl -s -H "PRIVATE-TOKEN: $PIPE_TOKEN" "$(_gli_api)/issues/$1" | jq -r '.state // "opened"'
 }
 
+_gli_merged_closer() {
+  # $1=iid. Prints the newest merged MR that closes the issue as compact JSON,
+  # or nothing. A later reopen invalidates an earlier merge.
+  local response closer events merged_at
+  response=$(curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$(_gli_api)/issues/$1/closed_by?per_page=100") || return 1
+  closer=$(jq -c --arg branch "$PIPE_TARGET_BRANCH" '
+    [.[] | select(.state == "merged" and .merged_at != null and .target_branch == $branch)]
+    | max_by(.merged_at)
+    | if . == null then empty else
+        {kind: "MR",
+         reference: (.references.relative // .reference // ("!" + (.iid | tostring))),
+         url: .web_url,
+         merged_at: .merged_at}
+      end
+  ' <<< "$response") || return 1
+  [ -n "$closer" ] || return 0
+
+  events=$(curl -s --fail -H "PRIVATE-TOKEN: $PIPE_TOKEN" \
+    "$(_gli_api)/issues/$1/resource_state_events?per_page=100") || return 1
+  merged_at=$(jq -r '.merged_at' <<< "$closer")
+  if jq -e --arg merged_at "$merged_at" \
+    'any(.[]; .state == "opened" and (.created_at // "") > $merged_at)' \
+    <<< "$events" >/dev/null; then
+    return 0
+  fi
+  printf '%s\n' "$closer"
+}
+
 _gli_blockers_open_count() {
   # $1=iid. Count of open issues that block this one (native links).
   curl -s -H "PRIVATE-TOKEN: $PIPE_TOKEN" "$(_gli_api)/issues/$1/links" \
@@ -168,8 +197,9 @@ _gli_link_blocked_by() {
 }
 
 _gli_set_issue_labels() {
-  # $1=iid $2=add(comma) $3=remove(comma). Returns HTTP-independent (best effort).
-  curl -s -X PUT -H "PRIVATE-TOKEN: $PIPE_TOKEN" -H "Content-Type: application/json" \
+  # $1=iid $2=add(comma) $3=remove(comma). HTTP failures must stop dispatch.
+  curl --fail-with-body -s -X PUT \
+    -H "PRIVATE-TOKEN: $PIPE_TOKEN" -H "Content-Type: application/json" \
     "$(_gli_api)/issues/$1" \
     -d "$(jq -n --arg a "$2" --arg r "$3" '{add_labels:$a, remove_labels:$r}')" > /dev/null
 }
@@ -310,10 +340,57 @@ _ghi_issue_meta() {
 
 _ghi_issue_state() {
   # Prints "opened" or "closed" (normalised to the GitLab vocabulary).
-  local s; s=$(gh api "repos/$PIPE_REPO/issues/$1" --jq '.state // "open"' 2>/dev/null || echo open)
+  local s
+  s=$(gh api "repos/$PIPE_REPO/issues/$1" --jq '.state // "open"' 2>/dev/null) || return 1
   [ "$s" = "closed" ] && echo closed || echo opened
 }
 
+_ghi_merged_closer() {
+  # $1=iid. GitHub's GraphQL closing-reference connection is exact for both
+  # keyword and manually linked PRs. One query also carries reopen events.
+  local owner="${PIPE_REPO%%/*}" repo="${PIPE_REPO#*/}" response
+  response=$(gh api graphql \
+    -f "owner=$owner" -f "name=$repo" -F "number=$1" \
+    -f query='
+      query($owner: String!, $name: String!, $number: Int!) {
+        repository(owner: $owner, name: $name) {
+          issue(number: $number) {
+            closedByPullRequestsReferences(first: 100, includeClosedPrs: true) {
+              nodes {
+                number
+                url
+                merged
+                mergedAt
+                baseRefName
+              }
+            }
+            timelineItems(last: 100, itemTypes: [REOPENED_EVENT]) {
+              nodes {
+                ... on ReopenedEvent {
+                  createdAt
+                }
+              }
+            }
+          }
+        }
+      }
+    ') || return 1
+  jq -c --arg branch "$PIPE_TARGET_BRANCH" '
+    .data.repository.issue as $issue
+    | ([$issue.closedByPullRequestsReferences.nodes[]
+        | select(.merged == true and .mergedAt != null and .baseRefName == $branch)]
+       | max_by(.mergedAt)) as $closer
+    | ([$issue.timelineItems.nodes[]?.createdAt] | max // "") as $reopened_at
+    | if $closer != null and ($reopened_at == "" or $closer.mergedAt > $reopened_at)
+      then {kind: "PR",
+            reference: ("#" + ($closer.number | tostring)),
+            url: $closer.url,
+            merged_at: $closer.mergedAt}
+      else empty
+      end
+  ' <<< "$response"
+}
+
 _ghi_link_blocked_by() {
   # GitHub has no native blocking link. Persist the real issue number in the
   # dependent issue body after all local decomposition keys have been mapped.
@@ -351,8 +428,14 @@ _ghi_set_issue_labels() {
   # $1=iid $2=add(comma) $3=remove(comma)
   local l
   local IFS=','
-  for l in $2; do [ -n "$l" ] && gh api -X POST "repos/$PIPE_REPO/issues/$1/labels" -f "labels[]=$l" > /dev/null 2>&1 || true; done
-  for l in $3; do [ -n "$l" ] && gh api -X DELETE "repos/$PIPE_REPO/issues/$1/labels/$l" > /dev/null 2>&1 || true; done
+  for l in $2; do
+    [ -z "$l" ] || gh api -X POST "repos/$PIPE_REPO/issues/$1/labels" \
+      -f "labels[]=$l" > /dev/null 2>&1 || return 1
+  done
+  for l in $3; do
+    [ -z "$l" ] || gh api -X DELETE "repos/$PIPE_REPO/issues/$1/labels/$l" \
+      > /dev/null 2>&1 || return 1
+  done
 }
 
 _ghi_close_issue() {
@@ -428,6 +511,7 @@ issue_notes()              { case "$PIPE_PLATFORM" in gitlab) _gli_issue_notes "
 issue_body()               { case "$PIPE_PLATFORM" in gitlab) _gli_issue_body "$1" ;; github) _ghi_issue_body "$1" ;; esac; }
 issue_meta()               { case "$PIPE_PLATFORM" in gitlab) _gli_issue_meta "$1" ;; github) _ghi_issue_meta "$1" ;; esac; }
 issue_state()              { case "$PIPE_PLATFORM" in gitlab) _gli_issue_state "$1" ;; github) _ghi_issue_state "$1" ;; esac; }
+issue_merged_closer()      { case "$PIPE_PLATFORM" in gitlab) _gli_merged_closer "$1" ;; github) _ghi_merged_closer "$1" ;; esac; }
 issue_create_file()        { case "$PIPE_PLATFORM" in gitlab) _gli_create_issue_file "$1" "$2" "$3" ;; github) _ghi_create_issue_file "$1" "$2" "$3" ;; esac; }
 issue_set_labels()         { case "$PIPE_PLATFORM" in gitlab) _gli_set_issue_labels "$1" "$2" "$3" ;; github) _ghi_set_issue_labels "$1" "$2" "$3" ;; esac; }
 issue_close()              { case "$PIPE_PLATFORM" in gitlab) _gli_close_issue "$1" ;; github) _ghi_close_issue "$1" ;; esac; }
@@ -442,12 +526,13 @@ issue_blockers_open_count() {
   case "$PIPE_PLATFORM" in
     gitlab) _gli_blockers_open_count "$1" ;;
     github)
-      local body refs n open=0
-      body=$(_ghi_issue_body "$1")
+      local body refs n state open=0
+      body=$(_ghi_issue_body "$1") || return 1
       # Match "Blocked by #12" / "blocked by #12, #13" case-insensitively.
       refs=$(printf '%s' "$body" | grep -ioE 'blocked by[^\n]*' | grep -oE '#[0-9]+' | grep -oE '[0-9]+' | sort -u || true)
       for n in $refs; do
-        [ "$(_ghi_issue_state "$n")" = "opened" ] && open=$((open + 1))
+        state=$(_ghi_issue_state "$n") || return 1
+        [ "$state" = "opened" ] && open=$((open + 1))
       done
       echo "$open"
       ;;

package/payload/ci-templates/scripts/lib/pipeline-common.sh

@@ -246,12 +246,39 @@ pipe_scrub_agent_secrets() {
   done < <(compgen -e | while IFS= read -r v; do pipe_agent_secret_var "$v" && echo "$v"; done)
 }
 
+# --- Harness preflight ------------------------------------------------------
+# Every pipe_run_* invocation ends in `|| true`, so a harness binary that
+# exists but cannot execute used to produce a green job with no review, no
+# marker file and one line on stderr (issue #1: `omp` is a Bun program and the
+# default node:22-bookworm image ships no bun, so `command -v omp` succeeded
+# while every run failed with "/usr/bin/env: 'bun': No such file or
+# directory"). Executing the binary once, before the tolerant invocation,
+# converts any harness-runtime breakage into an immediate job failure.
+
+pipe_require_harness() {
+  # $1 = harness binary name (claude|omp). Exits the job on failure: a
+  # non-runnable harness means no agent can run, so there is nothing left for
+  # the caller to recover from.
+  local bin="$1" out
+  if ! command -v "$bin" >/dev/null 2>&1; then
+    pipe_log "FATAL: harness binary '$bin' not found on PATH (PIPE_HARNESS=${PIPE_HARNESS:-claude}); install it in before_script"
+    exit 1
+  fi
+  if ! out=$("$bin" --version 2>&1); then
+    pipe_log "FATAL: harness binary '$bin' ($(command -v "$bin")) cannot execute: '$bin --version' failed"
+    printf '%s\n' "$out" >&2
+    pipe_log "omp requires bun on PATH (npm install -g bun); claude requires node"
+    exit 1
+  fi
+}
+
 pipe_run_claude() {
   # $1 = agent label for metrics, $2 = skill invocation (e.g. "/review-mr"),
   # $3 = allowed tools (optional), $4 = model for the main loop (optional,
   # e.g. $PIPE_MODEL_REVIEW; subagents keep their frontmatter models),
   # stdin = extra prompt (optional, usually empty)
   local label="$1" skill="$2" tools="${3:-Agent,Read,Write,Edit,Glob,Grep,Bash}" model="${4:-}"
+  pipe_require_harness claude
   local stdin_file; stdin_file=$(mktemp)
   cat > "$stdin_file" || true
 
@@ -350,6 +377,7 @@ pipe_run_omp() {
   # frontmatter), stdin = extra prompt (optional, usually empty).
   local label="$1" skill="$2" tools="${3:-Agent,Read,Write,Edit,Glob,Grep,Bash}" model="${4:-}"
   local omp_tools; omp_tools=$(pipe_translate_tools_to_omp "$tools")
+  pipe_require_harness omp
   local stdin_file; stdin_file=$(mktemp)
   cat > "$stdin_file" || true
 

package/payload/ci-templates/scripts/orchestrate.sh

@@ -87,6 +87,100 @@ emit_decision_metric() {
         '{issue_iid: $i, verdict: $v, decision_type: $dt, reason: $r} + $x')"
 }
 
+dispatch_restore_ready() {
+  # $1=iid. Best-effort recovery back to ready after a mid-dispatch failure.
+  # Nothing further can be attempted from this runner if this also fails, so
+  # it logs loudly and meters a terminal, distinctly countable label-error.
+  if issue_set_labels "$1" "$PIPE_LABEL_READY" "$PIPE_LABEL_WIP"; then
+    return 0
+  fi
+  pipe_log "  ERROR: could not restore $PIPE_LABEL_READY on #$1; lifecycle labels may be inconsistent, manual check required"
+  emit_decision_metric "$1" skipped label-error "Failed to restore ready after a dispatch-time error"
+  return 1
+}
+
+dispatch_queued_issue() {
+  # $1=iid $2=branch. Claim atomically, then re-check repository state at the
+  # last possible point before spending a coder invocation. Every subsequent
+  # label transition is checked: a silently failed transition is exactly how
+  # an issue gets stuck in wip or loses its ready label forever.
+  local iid="$1" branch="$2" open closer kind reference url reason comment_file
+
+  if ! issue_set_labels "$iid" "$PIPE_LABEL_WIP" "$PIPE_LABEL_READY"; then
+    pipe_log "  ERROR: could not claim #$iid, skipping to avoid a double trigger"
+    emit_decision_metric "$iid" skipped claim-failed "Could not atomically claim the ready issue"
+    return 0
+  fi
+
+  if ! open=$(issue_blockers_open_count "$iid"); then
+    reason="Could not verify whether issue prerequisites are still open"
+    pipe_log "  ERROR: $reason for #$iid; restoring $PIPE_LABEL_READY"
+    dispatch_restore_ready "$iid" || return 0
+    emit_decision_metric "$iid" deferred blocker-validation-error "$reason"
+    return 0
+  fi
+  if [ "${open:-1}" != "0" ]; then
+    reason="Issue has ${open:-unknown} open prerequisite(s)"
+    if issue_set_labels "$iid" "$PIPE_LABEL_BLOCKED" "$PIPE_LABEL_WIP,$PIPE_LABEL_READY"; then
+      pipe_log "  #$iid returned to $PIPE_LABEL_BLOCKED: $reason"
+      emit_decision_metric "$iid" deferred blocked-prerequisite "$reason"
+    else
+      pipe_log "  ERROR: could not move #$iid to $PIPE_LABEL_BLOCKED, restoring $PIPE_LABEL_READY: $reason"
+      dispatch_restore_ready "$iid" || return 0
+      emit_decision_metric "$iid" deferred blocked-transition-error "$reason"
+    fi
+    return 0
+  fi
+
+  if ! closer=$(issue_merged_closer "$iid"); then
+    reason="Could not verify whether a closing MR/PR has already merged"
+    pipe_log "  ERROR: $reason for #$iid; restoring $PIPE_LABEL_READY"
+    dispatch_restore_ready "$iid" || return 0
+    emit_decision_metric "$iid" deferred validation-error "$reason"
+    return 0
+  fi
+
+  if [ -n "$closer" ]; then
+    kind=$(jq -r '.kind' <<< "$closer")
+    reference=$(jq -r '.reference' <<< "$closer")
+    url=$(jq -r '.url' <<< "$closer")
+    reason="$kind $reference already merged into $PIPE_TARGET_BRANCH"
+    comment_file="$PIPE_CONTEXT_DIR/orchestrator-already-merged-$iid.md"
+    {
+      printf '**Dispatch skipped:** %s %s has already merged into `%s`.\n\n' \
+        "$kind" "$reference" "$PIPE_TARGET_BRANCH"
+      printf '%s\n\n' "$url"
+      printf 'The pipeline removed `%s`; apply it again only if more work is required.\n' \
+        "$PIPE_LABEL_READY"
+    } > "$comment_file"
+    # Comment before the final label removal: if the comment never lands,
+    # the ready label must survive so the skip is retried and the change is
+    # named next time, instead of silently vanishing off the board.
+    if ! issue_comment_file "$iid" "$comment_file"; then
+      pipe_log "  ERROR: could not comment on #$iid before skipping; restoring $PIPE_LABEL_READY for retry"
+      dispatch_restore_ready "$iid" || return 0
+      emit_decision_metric "$iid" deferred comment-error "$reason"
+      return 0
+    fi
+    pipe_log "  skipping coder for #$iid: $reason ($url)"
+    if ! issue_set_labels "$iid" "" "$PIPE_LABEL_WIP,$PIPE_LABEL_READY"; then
+      pipe_log "  ERROR: could not clear lifecycle labels on #$iid after commenting; restoring $PIPE_LABEL_READY"
+      dispatch_restore_ready "$iid"
+    fi
+    emit_decision_metric "$iid" skipped already-merged "$reason" \
+      "$(jq -n --arg kind "$kind" --arg reference "$reference" --arg url "$url" \
+          '{closer_kind: $kind, closer_reference: $reference, closer_url: $url}')"
+    return 0
+  fi
+
+  if code_trigger "$iid" "$branch"; then
+    pipe_log "  triggered coder for #$iid on $branch"
+  else
+    pipe_log "  ERROR: trigger failed for #$iid, reverting label"
+    dispatch_restore_ready "$iid"
+  fi
+}
+
 while IFS= read -r ISSUE; do
   [ "${#QUEUE[@]}" -ge "$PIPE_CODER_CAP" ] && { pipe_log "Coder cap ($PIPE_CODER_CAP) reached, deferring the rest"; break; }
 
@@ -297,16 +391,5 @@ pipe_log "Triggering ${#QUEUE[@]} coder run(s)"
 for ITEM in "${QUEUE[@]}"; do
   IID="${ITEM%%:*}"
   BRANCH="${ITEM#*:}"
-  # Atomic claim: relabel ready -> wip first, so a concurrent orchestrator does
-  # not double-trigger. Revert on trigger failure.
-  if issue_set_labels "$IID" "$PIPE_LABEL_WIP" "$PIPE_LABEL_READY"; then
-    if code_trigger "$IID" "$BRANCH"; then
-      pipe_log "  triggered coder for #$IID on $BRANCH"
-    else
-      pipe_log "  ERROR: trigger failed for #$IID, reverting label"
-      issue_set_labels "$IID" "$PIPE_LABEL_READY" "$PIPE_LABEL_WIP"
-    fi
-  else
-    pipe_log "  ERROR: could not claim #$IID, skipping to avoid a double trigger"
-  fi
+  dispatch_queued_issue "$IID" "$BRANCH"
 done