@dadado/agent-kit-cli 6.1.1 → 6.3.0

package/dist/chunk-KVY425NM.js

@@ -0,0 +1,519 @@
+import {
+  ensurePathIgnored
+} from "./chunk-MUTTNRX4.js";
+import {
+  claudeRedactions,
+  findHitlGateInText,
+  redactSecrets
+} from "./chunk-JEI6HACW.js";
+import {
+  findOnPath
+} from "./chunk-WGLPZXNU.js";
+
+// src/plan-loop/gate-exit.ts
+import { execFile } from "child_process";
+import { mkdir, mkdtemp, readFile, rename, rm, writeFile } from "fs/promises";
+import { tmpdir } from "os";
+import path from "path";
+var GATE_EXIT_BRANCH_PREFIX = "gate-exit/";
+var GATE_EXIT_MARKER_RELPATH = ".cursor/context/gate-exit.json";
+var GATE_EXIT_NOTE_DIR = ".cursor/gate-exit";
+var GATE_EXIT_DEFAULT_BASE = "staging";
+var GATE_EXIT_MARKER_SCHEMA = 1;
+var GATE_EXIT_STAMP_RE = /^\d{8}T\d{6}Z$/;
+var GATE_EXIT_SUMMARY_MAX_CHARS = 8 * 1024;
+var GATE_EXIT_FINDINGS_MAX_CHARS = 32 * 1024;
+var SAFE_REF_RE = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+var FALLBACK_GIT_IDENTITY = [
+  "-c",
+  "user.name=agent-kit",
+  "-c",
+  "user.email=agent-kit@noreply.invalid"
+];
+var LAND_ON_GATE_DESCRIPTION = "Gate exit: when the run stops at an unanswered gate, is stopped by the operator, or fails, push the outcome note to a gate-exit/<UTC stamp> branch from a temporary worktree and open a PR/MR when gh/glab is authenticated (root tree untouched; off by default)";
+function gateExitStamp(now = /* @__PURE__ */ new Date()) {
+  return now.toISOString().replace(/\.\d{3}Z$/, "Z").replace(/[-:]/g, "");
+}
+function isGateExitStamp(value) {
+  return GATE_EXIT_STAMP_RE.test(value);
+}
+function gateExitBranch(stamp) {
+  if (!isGateExitStamp(stamp)) throw new Error(`invalid gate-exit stamp: ${stamp}`);
+  return `${GATE_EXIT_BRANCH_PREFIX}${stamp}`;
+}
+function isSafeBaseRef(ref) {
+  return SAFE_REF_RE.test(ref) && !ref.includes("..") && !ref.endsWith("/") && !ref.endsWith(".lock");
+}
+function classifyGateExit(input) {
+  if (input.stop) {
+    return input.stop.message.startsWith("stopped-by-operator") ? "stopped-by-operator" : "gate";
+  }
+  return input.failed ? "failure" : null;
+}
+function gateExitMarkerPath(root) {
+  return path.join(root, GATE_EXIT_MARKER_RELPATH);
+}
+async function readGateExitMarker(root) {
+  let raw;
+  try {
+    raw = await readFile(gateExitMarkerPath(root), "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "absent" };
+    return { kind: "invalid", detail: String(err) };
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed?.schema !== GATE_EXIT_MARKER_SCHEMA || !Array.isArray(parsed.pending) || !Array.isArray(parsed.skipped)) {
+      return { kind: "invalid", detail: "unexpected marker shape" };
+    }
+    const pending = parsed.pending.filter(
+      (e) => typeof e?.stamp === "string" && isGateExitStamp(e.stamp)
+    );
+    return {
+      kind: "ok",
+      marker: { schema: GATE_EXIT_MARKER_SCHEMA, pending, skipped: parsed.skipped.map(String) }
+    };
+  } catch (err) {
+    return { kind: "invalid", detail: String(err) };
+  }
+}
+async function writeGateExitMarker(root, marker) {
+  const file = gateExitMarkerPath(root);
+  await mkdir(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.tmp`;
+  await writeFile(tmp, `${JSON.stringify(marker, null, 2)}
+`, "utf8");
+  await rename(tmp, file);
+}
+function gateExitRedactions(env) {
+  return claudeRedactions(env);
+}
+function gateExitHeadline(stamp, outcome) {
+  const what = outcome.trigger === "failure" ? "run failed" : outcome.trigger === "review" ? "review findings" : outcome.trigger === "stopped-by-operator" ? `stopped by operator at gate \`${outcome.askId ?? "none"}\`` : `unanswered gate \`${outcome.askId ?? "none"}\``;
+  return `# Gate exit ${stamp}: ${what}`;
+}
+function buildGateExitNote(input) {
+  const { outcome } = input;
+  const gateLine = outcome.askId && input.labels.length > 0 ? `\`HITL_GATE: ${outcome.askId} | ${input.labels.join(" | ")}\`` : "(no `HITL_GATE:` line recorded)";
+  const plan = outcome.plan !== void 0 ? `${outcome.plan} (ticks: ${outcome.ticks ?? 0}, pending to-dos: ${outcome.pending ?? "unknown"})` : "(none)";
+  const review = outcome.trigger === "review";
+  const lines = [
+    gateExitHeadline(input.stamp, outcome),
+    "",
+    review ? "- **Provenance:** agent-inferred. Written by `agent-kit` at the end of a headless review-only run (no tools, no edits, no commits to the reviewed branches); the findings below are the reviewer's output, not an operator decision." : "- **Provenance:** agent-inferred. Written by `agent-kit` at the end of a headless run; no operator reply exists for this gate and none was inferred.",
+    `- **Trigger:** ${outcome.trigger}`,
+    `- **Ask id:** ${outcome.askId ? `\`${outcome.askId}\`` : "(none)"}`,
+    `- **Gate:** ${gateLine}`,
+    `- **Stop:** ${outcome.reason}`,
+    `- **Exit code:** ${outcome.exitCode}`,
+    `- **Command:** \`agent-kit ${outcome.command}\` (backend ${outcome.backend})`,
+    `- **Plan:** ${plan}`,
+    `- **Log:** ${input.logRel ? `\`${input.logRel}\` (on the machine that ran; not pushed)` : "(none)"}`,
+    `- **Root tree:** ${input.dirtyPaths > 0 ? `dirty (${input.dirtyPaths} path(s)), reported and not cleaned` : "clean"}`,
+    `- **Base:** \`${input.base}\``,
+    "",
+    review ? "Next: read the findings, act on any of them in a live session, then accept or discard this ticket (`agent-kit ground-control`). Never `/git-prod` from a headless run." : "Next: answer the gate in a live session (`/continue-plan` or `/run-plan`), then accept or discard this ticket (`agent-kit ground-control`). Never `/git-prod` from a headless run."
+  ];
+  const summary = outcome.summary?.trim();
+  if (summary) {
+    const max = review ? GATE_EXIT_FINDINGS_MAX_CHARS : GATE_EXIT_SUMMARY_MAX_CHARS;
+    const what = review ? "findings" : "summary";
+    const capped = summary.length > max ? `${summary.slice(0, max)}
+
+(${what} truncated at ${max} characters)` : summary;
+    lines.push(
+      "",
+      review ? "## Findings" : "## Run summary",
+      "",
+      "```text",
+      capped.replaceAll("```", "'''"),
+      "```"
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+function collectStrings(value, out, depth) {
+  if (depth > 8) return;
+  if (typeof value === "string") out.push(value);
+  else if (Array.isArray(value)) for (const v of value) collectStrings(v, out, depth + 1);
+  else if (value && typeof value === "object") {
+    for (const v of Object.values(value)) collectStrings(v, out, depth + 1);
+  }
+}
+function decodeRunLog(raw) {
+  const out = [];
+  for (const line of raw.split(/\r?\n/)) {
+    out.push(line);
+    if (!line.startsWith("{")) continue;
+    try {
+      collectStrings(JSON.parse(line), out, 0);
+    } catch {
+    }
+  }
+  return out.join("\n");
+}
+async function findGateLabels(askId, sources) {
+  const fromText = sources.gateText ? findHitlGateInText(sources.gateText) : null;
+  if (fromText?.askId === askId) return fromText.labels;
+  if (!sources.logPath) return [];
+  try {
+    const gate = findHitlGateInText(decodeRunLog(await readFile(sources.logPath, "utf8")));
+    return gate?.askId === askId ? gate.labels : [];
+  } catch {
+    return [];
+  }
+}
+var defaultExec = (bin, args, opts) => new Promise((resolve) => {
+  execFile(
+    bin,
+    [...args],
+    {
+      cwd: opts.cwd,
+      env: { ...opts.env ?? process.env, GIT_TERMINAL_PROMPT: "0" },
+      encoding: "utf8",
+      maxBuffer: 4 * 1024 * 1024,
+      timeout: 12e4
+    },
+    (err, stdout, stderr) => {
+      const code = err ? typeof err.code === "number" ? err.code : 1 : 0;
+      resolve({
+        code,
+        stdout: String(stdout ?? ""),
+        stderr: String(stderr ?? err?.message ?? "")
+      });
+    }
+  );
+});
+async function resolveGateExitRefs(git, hasOrigin, requestedBase = GATE_EXIT_DEFAULT_BASE) {
+  let base = isSafeBaseRef(requestedBase) ? requestedBase : GATE_EXIT_DEFAULT_BASE;
+  const verify = (ref) => git(["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]);
+  if (hasOrigin) {
+    const scope2 = `refs/remotes/origin/${GATE_EXIT_BRANCH_PREFIX}`;
+    if ((await verify(`refs/remotes/origin/${base}`)).code === 0) {
+      return { base, baseRef: `refs/remotes/origin/${base}`, scope: scope2 };
+    }
+    const head = await git(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"]);
+    const fallback = head.stdout.trim().replace(/^origin\//, "");
+    if (head.code === 0 && isSafeBaseRef(fallback)) {
+      base = fallback;
+      return { base, baseRef: `refs/remotes/origin/${fallback}`, scope: scope2 };
+    }
+    return { base, baseRef: "HEAD", scope: scope2 };
+  }
+  const scope = `refs/heads/${GATE_EXIT_BRANCH_PREFIX}`;
+  if ((await verify(`refs/heads/${base}`)).code === 0) {
+    return { base, baseRef: `refs/heads/${base}`, scope };
+  }
+  return { base, baseRef: "HEAD", scope };
+}
+async function listGateExitBranches(git, refs, opts = {}) {
+  const listed = await git([
+    "for-each-ref",
+    "--format=%(refname:short)",
+    ...opts.unmergedOnly ? [`--no-merged=${refs.baseRef}`] : [],
+    refs.scope
+  ]);
+  return {
+    ok: listed.code === 0,
+    branches: listed.stdout.split("\n").filter((l) => l.trim())
+  };
+}
+function gateExitNotePath(stamp) {
+  if (!isGateExitStamp(stamp)) throw new Error(`invalid gate-exit stamp: ${stamp}`);
+  return `${GATE_EXIT_NOTE_DIR}/${stamp}.md`;
+}
+function isOutside(parent, child) {
+  const rel = path.relative(parent, child);
+  return rel.startsWith("..") || path.isAbsolute(rel);
+}
+async function landGateExit(opts) {
+  const env = opts.env ?? process.env;
+  const exec = opts.exec ?? defaultExec;
+  const which = opts.which ?? ((bin) => findOnPath(bin, { env }));
+  const redactions = gateExitRedactions(env);
+  const red = (text) => redactSecrets(text, redactions);
+  const log = (line) => opts.log?.(red(`gate-exit: ${line}`));
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  const stamp = gateExitStamp(now);
+  const branch = gateExitBranch(stamp);
+  const outcome = opts.outcome;
+  const requestedBase = opts.base ?? GATE_EXIT_DEFAULT_BASE;
+  const result = {
+    stamp,
+    branch: null,
+    committed: false,
+    pushed: false,
+    url: null,
+    markerWritten: false,
+    note: ""
+  };
+  const git = (args, cwd) => exec("git", args, { cwd, env });
+  const labels = outcome.askId ? await findGateLabels(outcome.askId, { gateText: outcome.gateText, logPath: outcome.logPath }) : [];
+  const top = await git(["rev-parse", "--show-toplevel"], opts.root);
+  const repo = top.code === 0 ? top.stdout.trim() : null;
+  let dirtyPaths = 0;
+  if (repo) {
+    const status = await git(["status", "--porcelain"], repo);
+    dirtyPaths = status.stdout.split("\n").filter((l) => l.trim()).length;
+    if (dirtyPaths > 0) {
+      log(`root tree is dirty (${dirtyPaths} path(s)); reported, not cleaned`);
+    }
+  }
+  let base = isSafeBaseRef(requestedBase) ? requestedBase : GATE_EXIT_DEFAULT_BASE;
+  const logRel = outcome.logPath ? path.relative(opts.root, outcome.logPath) : null;
+  const buildNote = () => red(buildGateExitNote({ stamp, outcome, labels, base, logRel, dirtyPaths }));
+  const writeMarker = async () => {
+    const entry = {
+      stamp,
+      openedAt: now.toISOString(),
+      trigger: outcome.trigger,
+      askId: outcome.askId ?? null,
+      labels: labels.map(red),
+      base,
+      branch: result.branch,
+      pushed: result.pushed,
+      url: result.url
+    };
+    const current = await readGateExitMarker(opts.root);
+    if (current.kind === "invalid") {
+      log(
+        `${GATE_EXIT_MARKER_RELPATH} is unreadable (${current.detail}); left as is, entry ${stamp} not recorded`
+      );
+      return;
+    }
+    const marker = current.kind === "ok" ? { ...current.marker, pending: [...current.marker.pending, entry] } : { schema: GATE_EXIT_MARKER_SCHEMA, pending: [entry], skipped: [] };
+    if (repo && !await ensurePathIgnored(
+      (args) => git(args, opts.root),
+      opts.root,
+      GATE_EXIT_MARKER_RELPATH
+    )) {
+      log(
+        `${GATE_EXIT_MARKER_RELPATH} is not gitignored here; add it to .gitignore (agent-kit update adds it)`
+      );
+    }
+    try {
+      await writeGateExitMarker(opts.root, marker);
+      result.markerWritten = true;
+    } catch (err) {
+      log(`could not write ${GATE_EXIT_MARKER_RELPATH}: ${String(err)}`);
+      return;
+    }
+  };
+  if (!repo) {
+    log("not a git repository; no branch landed");
+    result.note = buildNote();
+    await writeMarker();
+    return result;
+  }
+  const origin = await git(["remote", "get-url", "origin"], repo);
+  const hasOrigin = origin.code === 0 && origin.stdout.trim().length > 0;
+  const originUrl = hasOrigin ? origin.stdout.trim() : "";
+  let startRef = null;
+  if (hasOrigin) {
+    const fetched = await git(["fetch", "--quiet", "origin", base], repo);
+    if (fetched.code !== 0)
+      log(`fetch origin ${base} failed: ${fetched.stderr.trim().split("\n")[0] ?? ""}`);
+    const verify = await git(
+      ["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${base}^{commit}`],
+      repo
+    );
+    if (verify.code === 0) {
+      startRef = `refs/remotes/origin/${base}`;
+    } else {
+      const head = await git(
+        ["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"],
+        repo
+      );
+      const fallback = head.stdout.trim().replace(/^origin\//, "");
+      if (head.code === 0 && isSafeBaseRef(fallback)) {
+        log(`origin/${base} not found; using the remote default branch ${fallback}`);
+        base = fallback;
+        startRef = `refs/remotes/origin/${fallback}`;
+      }
+    }
+  } else {
+    log("no `origin` remote: the branch stays local, nothing is pushed");
+    const local = await git(
+      ["rev-parse", "--verify", "--quiet", `refs/heads/${base}^{commit}`],
+      repo
+    );
+    startRef = local.code === 0 ? `refs/heads/${base}` : "HEAD";
+  }
+  result.note = buildNote();
+  if (!startRef) {
+    log(`no base to branch from (origin/${base} missing); note not landed`);
+    await writeMarker();
+    return result;
+  }
+  let tmp = null;
+  let wt = null;
+  try {
+    tmp = await mkdtemp(path.join(opts.tmpRoot ?? tmpdir(), "agent-kit-gate-exit-"));
+    if (!isOutside(repo, tmp)) {
+      log("temporary directory resolves inside the repository; refusing to land there");
+      return result;
+    }
+    wt = path.join(tmp, "wt");
+    const added = await git(["worktree", "add", "--detach", "--quiet", wt, startRef], repo);
+    if (added.code !== 0) {
+      wt = null;
+      log(`worktree add failed: ${added.stderr.trim().split("\n")[0] ?? ""}`);
+      return result;
+    }
+    const noteRel = gateExitNotePath(stamp);
+    await mkdir(path.join(wt, GATE_EXIT_NOTE_DIR), { recursive: true });
+    await writeFile(path.join(wt, noteRel), result.note, "utf8");
+    const add = await git(["add", "-f", "--", noteRel], wt);
+    if (add.code !== 0) {
+      log(`git add failed: ${add.stderr.trim().split("\n")[0] ?? ""}`);
+      return result;
+    }
+    const email = await git(["config", "user.email"], wt);
+    const identity = email.code === 0 && email.stdout.trim() ? [] : FALLBACK_GIT_IDENTITY;
+    const subject = `docs(gate-exit): record the ${outcome.trigger} of ${stamp}`;
+    const body = `Ask id: ${outcome.askId ?? "none"}. Provenance: agent-inferred.`;
+    const commit = await git([...identity, "commit", "--quiet", "-m", subject, "-m", body], wt);
+    if (commit.code !== 0) {
+      log(`commit failed: ${commit.stderr.trim().split("\n")[0] ?? ""}`);
+      return result;
+    }
+    result.committed = true;
+    if (hasOrigin) {
+      const push = await git(["push", "--quiet", "origin", `HEAD:refs/heads/${branch}`], wt);
+      if (push.code === 0) {
+        result.pushed = true;
+        result.branch = branch;
+        log(`pushed ${branch}`);
+      } else {
+        log(`push failed: ${push.stderr.trim().split("\n")[0] ?? ""}`);
+      }
+    }
+    if (!result.pushed) {
+      const keep = await git(["branch", branch, "HEAD"], wt);
+      if (keep.code === 0) {
+        result.branch = branch;
+        log(`branch ${branch} kept locally; push it with: git push origin ${branch}`);
+      }
+    }
+    if (result.pushed) {
+      result.url = await openReview({
+        branch,
+        base,
+        title: `${outcome.trigger === "failure" ? "Gate exit: run failed" : outcome.trigger === "review" ? "Gate exit: review findings" : `Gate exit: ${outcome.askId ?? "gate"}`} (${stamp})`,
+        body: result.note,
+        cwd: wt,
+        tmp,
+        originUrl,
+        exec,
+        which,
+        env,
+        log
+      });
+    }
+  } catch (err) {
+    log(`landing failed: ${String(err)}`);
+  } finally {
+    if (wt) await git(["worktree", "remove", "--force", wt], repo);
+    if (tmp) await rm(tmp, { recursive: true, force: true }).catch(() => void 0);
+    await git(["worktree", "prune"], repo);
+    await writeMarker();
+  }
+  return result;
+}
+function lastUrl(text) {
+  const urls = text.match(/https?:\/\/\S+/g);
+  return urls?.at(-1) ?? null;
+}
+async function findAuthenticatedForge(input) {
+  const forges = /gitlab/i.test(input.originUrl) ? ["glab", "gh"] : ["gh", "glab"];
+  for (const forge of forges) {
+    const bin = await input.which(forge);
+    if (!bin) continue;
+    const auth = await input.exec(bin, ["auth", "status"], { cwd: input.cwd, env: input.env });
+    if (auth.code !== 0) {
+      input.log(`${forge} is not authenticated; skipping the ${forge === "gh" ? "PR" : "MR"}`);
+      continue;
+    }
+    return { forge, bin };
+  }
+  return null;
+}
+async function openReview(input) {
+  const found = await findAuthenticatedForge(input);
+  if (found) {
+    const { forge, bin } = found;
+    let created;
+    if (forge === "gh") {
+      const bodyFile = path.join(input.tmp, "pr-body.md");
+      await writeFile(bodyFile, input.body, "utf8");
+      created = await input.exec(
+        bin,
+        [
+          "pr",
+          "create",
+          "--base",
+          input.base,
+          "--head",
+          input.branch,
+          "--title",
+          input.title,
+          "--body-file",
+          bodyFile
+        ],
+        { cwd: input.cwd, env: input.env }
+      );
+    } else {
+      created = await input.exec(
+        bin,
+        [
+          "mr",
+          "create",
+          "--source-branch",
+          input.branch,
+          "--target-branch",
+          input.base,
+          "--title",
+          input.title,
+          "--description",
+          input.body,
+          "--yes"
+        ],
+        { cwd: input.cwd, env: input.env }
+      );
+    }
+    if (created.code === 0) {
+      const url = lastUrl(created.stdout);
+      input.log(`${forge === "gh" ? "PR" : "MR"} opened${url ? `: ${url}` : ""}`);
+      return url;
+    }
+    input.log(`${forge} could not open the review: ${created.stderr.trim().split("\n")[0] ?? ""}`);
+    return null;
+  }
+  input.log(
+    `no authenticated gh/glab; open the review by hand: gh pr create --base ${input.base} --head ${input.branch} (or glab mr create --source-branch ${input.branch} --target-branch ${input.base})`
+  );
+  return null;
+}
+
+export {
+  GATE_EXIT_BRANCH_PREFIX,
+  GATE_EXIT_MARKER_RELPATH,
+  GATE_EXIT_NOTE_DIR,
+  LAND_ON_GATE_DESCRIPTION,
+  gateExitStamp,
+  isGateExitStamp,
+  gateExitBranch,
+  isSafeBaseRef,
+  classifyGateExit,
+  readGateExitMarker,
+  writeGateExitMarker,
+  gateExitRedactions,
+  defaultExec,
+  resolveGateExitRefs,
+  listGateExitBranches,
+  gateExitNotePath,
+  isOutside,
+  landGateExit,
+  findAuthenticatedForge
+};

package/dist/{chunk-WUWRGOUV.js → chunk-L5V3W3DY.js}

@@ -1,6 +1,10 @@
+import {
+  ensurePathIgnored,
+  gitAt
+} from "./chunk-MUTTNRX4.js";
 import {
   HANDOFF_REL
-} from "./chunk-C26I6HTO.js";
+} from "./chunk-C4Q77GGJ.js";
 import {
   ensureDir
 } from "./chunk-5B4DVO6C.js";
@@ -24,6 +28,9 @@ function defaultPlanIndexIo() {
     async writeFile(absPath, body) {
       await ensureDir(path.dirname(absPath));
       await writeFile(absPath, body, "utf8");
+    },
+    ensureIgnored(root, relPath) {
+      return ensurePathIgnored(gitAt(root), root, relPath);
     }
   };
 }
@@ -127,7 +134,12 @@ async function writePlanIndex(root, io = defaultPlanIndexIo(), now = () => /* @_
   const index = await buildPlanIndex(root, io, now);
   const dest = path.join(root, PLAN_INDEX_REL);
   const write = io.writeFile ?? defaultPlanIndexIo().writeFile;
+  const ensureIgnored = io.ensureIgnored ?? (io.writeFile ? void 0 : defaultPlanIndexIo().ensureIgnored);
   if (write) {
+    try {
+      await ensureIgnored?.(root, PLAN_INDEX_REL);
+    } catch {
+    }
     await write(dest, `${JSON.stringify(index, null, 2)}
 `);
   }