@cxi-lmai/ci-agent-platform 3.1.3 → 3.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cxi-lmai/ci-agent-platform",
-  "version": "3.1.3",
+  "version": "3.1.5",
   "description": "Autonomous dev pipeline on plain GitLab CI or GitHub Actions, driven by Claude Code. A labeled issue goes in, an open merge request comes out.",
   "keywords": [
     "claude",

package/payload/ci-templates/claude-pipeline.gitlab-ci.yml

@@ -79,6 +79,18 @@ variables:
   PIPE_ORCHESTRATE: "0"                          # set to "1" in the schedule to run orchestrate
   PIPE_SPEC_TEMPLATE_PATH: ".gitlab/issue_templates/Spec.md"
 
+  # --- Agent deadline (omp harness) -----------------------------------------
+  # A job `timeout:` is a hard kill — the runner SIGKILLs the process tree and
+  # the runner script never posts its comment, metrics or marker file. So
+  # `pipe_run_omp` bounds the agent itself with `omp --max-time`, derived from
+  # GitLab's own CI_JOB_TIMEOUT minus the time already spent minus the reserve
+  # below, which leaves room for the post-agent steps. An overrun then takes
+  # the normal degraded path (failure-notice comment + metrics) instead of
+  # dying silently. Set PIPE_AGENT_MAX_TIME (e.g. "20m") to override the
+  # derivation for every job; GitHub Actions exposes no job-timeout variable,
+  # so there the flag is omitted and timeout-minutes stays the only bound.
+  PIPE_AGENT_TIME_RESERVE: "180"        # seconds of the job budget kept for the post-agent steps
+
   # --- Build / verify --------------------------------------------------------
   PIPE_VERIFY_CMD: ""                   # compile + unit tests, run after a fix
   PIPE_COMPILE_CMD: ""                  # compile only (defaults to PIPE_VERIFY_CMD)
@@ -212,11 +224,15 @@ variables:
 
 # =============================================================================
 # review: run the automated review on a non-draft MR that changes code.
+# The 45m budget matches `code` and is not generous: the skill fans out to the
+# code-reviewer plus up to three specialist subagents, and observed runs on a
+# real project spread from 1m to over 20m with diff size. It was 20m until
+# three consecutive cap-outs on large MRs were measured in production.
 # =============================================================================
 review:
   extends: .claude-base
   stage: review
-  timeout: 20m
+  timeout: 45m
   script:
     - bash "$PIPE_SCRIPTS_DIR/review.sh"
   artifacts:

package/payload/ci-templates/scripts/lib/pipeline-common.sh

@@ -277,10 +277,16 @@ pipe_run_claude() {
   # $3 = allowed tools (optional), $4 = model for the main loop (optional,
   # e.g. $PIPE_MODEL_REVIEW; subagents keep their frontmatter models),
   # stdin = extra prompt (optional, usually empty)
+  #
+  # Always returns 0, so a caller running under `set -e` keeps control over what
+  # a failed agent means for its job. The agent's real exit code lands in
+  # PIPE_AGENT_RC. A caller that must not read a crashed agent as a clean run
+  # checks that variable, or calls pipe_require_agent_ran below.
   local label="$1" skill="$2" tools="${3:-Agent,Read,Write,Edit,Glob,Grep,Bash}" model="${4:-}"
   pipe_require_harness claude
   local stdin_file; stdin_file=$(mktemp)
   cat > "$stdin_file" || true
+  PIPE_AGENT_RC=0
 
   if [ "$(id -u)" -eq 0 ]; then
     local runuser="pipelinebot"
@@ -315,7 +321,7 @@ pipe_run_claude() {
     } > "$runner"
     chmod +x "$runner"
     chown "$runuser:$runuser" "$runner"
-    su -m "$runuser" -s /bin/bash "$runner" || true
+    su -m "$runuser" -s /bin/bash "$runner" || PIPE_AGENT_RC=$?
     chown -R root:root "$PWD" 2>/dev/null || true
     rm -f "$runner"
   else
@@ -327,9 +333,32 @@ pipe_run_claude() {
       else
         capture_claude "$label" -- --dangerously-skip-permissions --allowedTools "$tools" -p "$skill" < "$stdin_file"
       fi
-    ) || true
+    ) || PIPE_AGENT_RC=$?
   fi
   rm -f "$stdin_file"
+  [ "$PIPE_AGENT_RC" -eq 0 ] || pipe_log "agent exited with code $PIPE_AGENT_RC"
+  return 0
+}
+
+pipe_require_agent_ran() {
+  # $1 = file the skill was supposed to write (empty to check the exit code
+  # only, for skills whose marker is legitimately optional), $2 = human label.
+  # Fails the job when the agent crashed or wrote nothing. Without this an
+  # agent that never started is indistinguishable from one that ran and found
+  # nothing: every caller reads its marker file, misses it, and falls back to
+  # the "all clear" default, so the job goes green without a review, fix, or
+  # triage having happened.
+  local marker="$1" what="${2:-agent}"
+  if [ "${PIPE_AGENT_RC:-0}" -ne 0 ]; then
+    pipe_log "ERROR: $what did not complete (exit code $PIPE_AGENT_RC). See the job log above."
+    return 1
+  fi
+  [ -n "$marker" ] || return 0
+  if [ ! -s "$marker" ]; then
+    pipe_log "ERROR: $what produced no output ($marker is missing or empty)."
+    return 1
+  fi
+  return 0
 }
 
 # --- omp invocation -----------------------------------------------------
@@ -369,17 +398,72 @@ pipe_translate_tools_to_omp() {
   echo "${result#,}"
 }
 
+# --- Agent deadline -----------------------------------------------------
+# A CI job timeout is a hard kill: the runner SIGKILLs the whole process tree,
+# so the runner script never reaches the steps that post the comment, write
+# the metrics record and emit the marker file. An agent that overruns
+# therefore leaves a red job with no output at all (observed in production:
+# three review timeouts in one week, each at the cap with the agent mid-run).
+# Bounding the agent itself with `omp --max-time` turns an overrun into the
+# platform's normal degraded path — failure-notice comment plus metrics —
+# instead of a hard kill.
+
+pipe_agent_max_time() {
+  # Echoes the --max-time value to pass to omp, or nothing when no deadline
+  # can be derived (GitHub Actions exposes no CI_JOB_TIMEOUT equivalent;
+  # there the workflow's timeout-minutes stays the only bound). An explicit
+  # PIPE_AGENT_MAX_TIME wins and is passed through verbatim, so a project can
+  # set "20m" or "1h" by hand. Otherwise the budget is the job timeout, minus
+  # the time already spent (image pull, checkout, before_script, API prep),
+  # minus PIPE_AGENT_TIME_RESERVE for the post-agent steps.
+  if [ -n "${PIPE_AGENT_MAX_TIME:-}" ]; then
+    printf '%s' "$PIPE_AGENT_MAX_TIME"
+    return 0
+  fi
+  local budget="${CI_JOB_TIMEOUT:-}"
+  case "$budget" in ''|*[!0-9]*) return 0 ;; esac
+  local reserve="${PIPE_AGENT_TIME_RESERVE:-180}" elapsed=0 started now
+  # Guard the emptiness explicitly: `date -d ""` does not fail, it silently
+  # resolves to midnight today, which would read as a many-hour-old job.
+  if [ -n "${CI_JOB_STARTED_AT:-}" ]; then
+    started=$(date -d "$CI_JOB_STARTED_AT" +%s 2>/dev/null || true)
+    if [ -n "$started" ]; then
+      now=$(date +%s)
+      elapsed=$(( now - started ))
+      [ "$elapsed" -lt 0 ] && elapsed=0
+    fi
+  fi
+  local left=$(( budget - elapsed - reserve ))
+  # A job already out of budget gets no flag: let the agent start and be cut
+  # by the runner exactly as it was before this function existed, rather than
+  # be killed one second in with a nonsensical deadline.
+  [ "$left" -lt 60 ] && return 0
+  printf '%s' "$left"
+}
+
 pipe_run_omp() {
   # $1 = agent label for metrics, $2 = skill invocation (e.g. "/review-mr"),
   # $3 = allowed tools in Claude Code naming (optional, translated
   # internally), $4 = model for the main loop (optional, e.g.
   # $PIPE_MODEL_REVIEW; subagents keep the models from their own
   # frontmatter), stdin = extra prompt (optional, usually empty).
+  #
+  # Same contract as pipe_run_claude: always returns 0 and reports the agent's
+  # real exit code in PIPE_AGENT_RC, which pipe_require_agent_ran checks.
   local label="$1" skill="$2" tools="${3:-Agent,Read,Write,Edit,Glob,Grep,Bash}" model="${4:-}"
   local omp_tools; omp_tools=$(pipe_translate_tools_to_omp "$tools")
+  # Bound the run below the job's own hard kill (see pipe_agent_max_time).
+  local max_time; max_time=$(pipe_agent_max_time)
+  local -a max_time_args=()
+  local max_time_txt=""
+  if [ -n "$max_time" ]; then
+    max_time_args=(--max-time "$max_time")
+    max_time_txt=$(printf ' --max-time %q' "$max_time")
+  fi
   pipe_require_harness omp
   local stdin_file; stdin_file=$(mktemp)
   cat > "$stdin_file" || true
+  PIPE_AGENT_RC=0
 
   if [ "$(id -u)" -eq 0 ]; then
     local runuser="pipelinebot"
@@ -402,17 +486,19 @@ pipe_run_omp() {
       printf 'cd %q\n' "$PWD"
       printf 'source %q\n' "$SCRIPT_LIB_DIR/usage-capture-omp.sh"
       printf 'export PIPE_CAPTURE_MODEL=%q\n' "$model"
+      # The %s after `--` is the optional " --max-time <d>" fragment, already
+      # shell-quoted; it collapses to nothing when no deadline was derived.
       if [ -n "$model" ]; then
-        printf 'capture_omp %q -- --yolo --no-session --no-title --model %q --tools %q -p %q < %q\n' \
-          "$label" "$model" "$omp_tools" "$skill" "$stdin_file"
+        printf 'capture_omp %q --%s --yolo --no-session --no-title --model %q --tools %q -p %q < %q\n' \
+          "$label" "$max_time_txt" "$model" "$omp_tools" "$skill" "$stdin_file"
       else
-        printf 'capture_omp %q -- --yolo --no-session --no-title --tools %q -p %q < %q\n' \
-          "$label" "$omp_tools" "$skill" "$stdin_file"
+        printf 'capture_omp %q --%s --yolo --no-session --no-title --tools %q -p %q < %q\n' \
+          "$label" "$max_time_txt" "$omp_tools" "$skill" "$stdin_file"
       fi
     } > "$runner"
     chmod +x "$runner"
     chown "$runuser:$runuser" "$runner"
-    su -m "$runuser" -s /bin/bash "$runner" || true
+    su -m "$runuser" -s /bin/bash "$runner" || PIPE_AGENT_RC=$?
     chown -R root:root "$PWD" 2>/dev/null || true
     rm -f "$runner"
   else
@@ -420,13 +506,15 @@ pipe_run_omp() {
       pipe_scrub_agent_secrets
       export PIPE_CAPTURE_MODEL="$model"
       if [ -n "$model" ]; then
-        capture_omp "$label" -- --yolo --no-session --no-title --model "$model" --tools "$omp_tools" -p "$skill" < "$stdin_file"
+        capture_omp "$label" -- "${max_time_args[@]}" --yolo --no-session --no-title --model "$model" --tools "$omp_tools" -p "$skill" < "$stdin_file"
       else
-        capture_omp "$label" -- --yolo --no-session --no-title --tools "$omp_tools" -p "$skill" < "$stdin_file"
+        capture_omp "$label" -- "${max_time_args[@]}" --yolo --no-session --no-title --tools "$omp_tools" -p "$skill" < "$stdin_file"
       fi
-    ) || true
+    ) || PIPE_AGENT_RC=$?
   fi
   rm -f "$stdin_file"
+  [ "$PIPE_AGENT_RC" -eq 0 ] || pipe_log "agent exited with code $PIPE_AGENT_RC"
+  return 0
 }
 
 # --- Harness dispatch ---------------------------------------------------

package/payload/ci-templates/scripts/metrics-snapshot.sh

@@ -186,9 +186,13 @@ MRS_VIEW=$(jq -c \
         elif ($body | test($reintroduce; "i")) then "reintroduces"
         else null end
       ),
+      # match/2 with "g", not scan/2: a Debian bookworm based runner image
+      # ships jq 1.6, which has no scan/2 and fails the whole program with
+      # a compile error.
       references: [
         $body
-        | scan("(?:" + $revert + "|" + $regression + "|" + $reintroduce + ")[[:space:]]*[!#]?([0-9]+)"; "i")[]?
+        | match("(?:" + $revert + "|" + $regression + "|" + $reintroduce + ")[[:space:]]*[!#]?([0-9]+)"; "gi")
+        | .captures[].string
         | select(. != null)
         | tonumber
       ]

package/payload/ci-templates/scripts/review-fix.sh

@@ -41,6 +41,9 @@ echo "$NOTES" | jq -r --arg u "${PIPE_BOT_USER:-}" --arg m "$REVIEW_MARKER" \
 #    verifies, writes the result JSON, and the review-fix.env marker. On cap it
 #    runs the shared postmortem flow (writing postmortem.md + postmortem.env).
 pipe_run_agent coder "/fix-review-findings" "Agent,Read,Write,Edit,Glob,Grep,Bash" "$PIPE_MODEL_CODE" < /dev/null
+# A crashed agent writes no marker, which step 6 would read as "nothing changed"
+# and step 7 would report as a completed fix run that had nothing to do.
+pipe_require_agent_ran "" "The review-fix agent" || exit 1
 
 # 6. Read the marker the skill wrote.
 RF_ENV="$PIPE_CONTEXT_DIR/review-fix.env"

package/payload/ci-templates/scripts/review.sh

@@ -87,7 +87,14 @@ pipe_metric_event code-reviewer review_findings \
       --argjson inc "$([ "${PIPE_IS_INCREMENTAL:-false}" = "true" ] && echo true || echo false)" \
       '{findings_total: $t, status: $s, has_fixable_bugs: $b, is_incremental: $inc}')"
 
-# 7. Gate. review.env is exported so the fix job can read REVIEW_HAS_BUGS at
+# 7. Fail the job when no review was produced. The comment above already told
+#    the humans; this tells the pipeline. PIPE_NO_GATE does not apply: it turns
+#    off the verdict gate, and this is a broken run, not a verdict. Without it a
+#    review that never ran (crashed agent, missing ANTHROPIC_API_KEY) reads as a
+#    review that ran and found nothing, and the MR goes green unreviewed.
+pipe_require_agent_ran "$PIPE_RESULT_REVIEW" "The review agent" || exit 1
+
+# 8. Gate. review.env is exported so the fix job can read REVIEW_HAS_BUGS at
 #    runtime. On GitLab the job exits non-zero to block the pipeline. On GitHub
 #    the workflow step owns the gate (it reads the output first), so it sets
 #    PIPE_NO_GATE=1 and this script leaves the exit to the workflow.

package/payload/ci-templates/scripts/test-fix.sh

@@ -27,6 +27,9 @@ COVERAGE_BEFORE=$(pipe_count_fix_commits "$PIPE_COMMIT_COVERAGE")
 #    test-writer, verifies, and writes fix-tests.env. On cap it runs the shared
 #    postmortem flow (writing postmortem.md + postmortem.env).
 pipe_run_agent test-fix "/fix-tests" "Agent,Read,Write,Edit,Glob,Grep,Bash" "$PIPE_MODEL_CODE" < /dev/null
+# A crashed agent writes no marker, which step 4 would read as FIX_BRANCH=none
+# and report as a false-alarm trigger, hiding the failure behind a green job.
+pipe_require_agent_ran "" "The test-fix agent" || exit 1
 
 # 4. Read the marker the skill wrote.
 FT_ENV="$PIPE_CONTEXT_DIR/fix-tests.env"