@defrex/autobuild 0.10.1 → 0.12.0

package/packages/core/src/cli/project-credentials.ts

@@ -0,0 +1,132 @@
+import { createHash, randomUUID } from 'node:crypto'
+import {
+  constants,
+  fstatSync,
+  chmodSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  closeSync,
+  readFileSync,
+  writeFileSync,
+  renameSync,
+  unlinkSync,
+} from 'node:fs'
+import { homedir } from 'node:os'
+import { isAbsolute, join } from 'node:path'
+import { normalizeServiceURL } from '../connection'
+import { normalizeGitRemoteUrl } from '../kernel/origin'
+
+export interface ProjectCredential {
+  service: string
+  repo: string
+  id: string
+  token: string
+}
+export class ProjectCredentials {
+  readonly directory: string
+  constructor(env: Record<string, string | undefined> = process.env) {
+    const root = env.XDG_CONFIG_HOME
+    if (root && !isAbsolute(root))
+      throw new Error('XDG_CONFIG_HOME must be absolute for project credentials')
+    this.directory = join(
+      root ||
+        (env.HOME && isAbsolute(env.HOME) ? join(env.HOME, '.config') : join(homedir(), '.config')),
+      'autobuild',
+      'credentials',
+    )
+  }
+  private path(service: string, repo: string): string {
+    return join(
+      this.directory,
+      `${createHash('sha256')
+        .update(JSON.stringify([normalizeServiceURL(service), normalizeGitRemoteUrl(repo)]))
+        .digest('hex')}.json`,
+    )
+  }
+  private guard(path: string): boolean {
+    try {
+      const info = lstatSync(path)
+      if (!info.isFile() || info.isSymbolicLink()) throw new Error('unsafe credential file')
+      return true
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return false
+      throw error
+    }
+  }
+  load(service: string, repo: string): ProjectCredential | undefined {
+    try {
+      const path = this.path(service, repo)
+      if (!this.guard(path)) return undefined
+      const directory = lstatSync(this.directory)
+      if (directory.isSymbolicLink() || (directory.mode & 0o777) !== 0o700) throw new Error()
+      const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW)
+      let entry: ProjectCredential
+      try {
+        if ((fstatSync(fd).mode & 0o777) !== 0o600) throw new Error()
+        entry = JSON.parse(readFileSync(fd, 'utf8'))
+      } finally {
+        closeSync(fd)
+      }
+      if (
+        entry.service !== normalizeServiceURL(service) ||
+        entry.repo !== normalizeGitRemoteUrl(repo) ||
+        typeof entry.id !== 'string' ||
+        typeof entry.token !== 'string' ||
+        !/^[a-f0-9]{32}$/.test(entry.id) ||
+        !new RegExp(`^abp_1_${entry.id}_[a-f0-9]{64}$`).test(entry.token)
+      )
+        throw new Error()
+      return entry
+    } catch {
+      throw new Error(
+        'Cannot read project credential; repair user credential storage and run ab connect',
+      )
+    }
+  }
+  save(entry: ProjectCredential): void {
+    const path = this.path(entry.service, entry.repo)
+    let temporary: string | undefined
+    try {
+      mkdirSync(this.directory, { recursive: true, mode: 0o700 })
+      if (lstatSync(this.directory).isSymbolicLink()) throw new Error()
+      chmodSync(this.directory, 0o700)
+      this.guard(path)
+      temporary = `${path}.${randomUUID()}`
+      const fd = openSync(temporary, 'wx', 0o600)
+      try {
+        writeFileSync(fd, `${JSON.stringify(entry)}\n`)
+      } finally {
+        closeSync(fd)
+      }
+      renameSync(temporary, path)
+    } catch {
+      throw new Error('Cannot save project credential; check user credential directory permissions')
+    } finally {
+      if (temporary) {
+        try {
+          unlinkSync(temporary)
+        } catch {
+          /* renamed or absent */
+        }
+      }
+    }
+  }
+  remove(service: string, repo: string): void {
+    const path = this.path(service, repo)
+    if (this.guard(path)) unlinkSync(path)
+  }
+}
+export function projectToken(
+  service: string,
+  repo: string,
+  env: Record<string, string | undefined>,
+): string | undefined {
+  if (env.AB_TOKEN !== undefined && env.AB_TOKEN !== '') return env.AB_TOKEN
+  try {
+    normalizeServiceURL(service)
+  } catch {
+    return undefined
+  }
+  return new ProjectCredentials(env).load(service, repo)?.token
+}

package/packages/core/src/cli/repo-state.ts

@@ -20,6 +20,7 @@
  * normalized against that checkout so the dispatcher and agents cannot
  * interpret a relative path from different working directories.
  */
+import { configuredStore } from './configured-store'
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path'
 import type { Exec } from '../ports/workspace/git-worktree'
 import type { BuildRecord } from '../store/types'
@@ -92,6 +93,8 @@ export async function resolveMainRepo(targetRepo: string, exec: Exec): Promise<s
 }
 
 export interface RepoStatePaths {
+  /** Validated repository setting used for this selection, when present. */
+  configStore?: string
   /** Repository identity in BuildStore records/journals: the checkout's
    * normalized origin URL, falling back to the resolved checkout path only
    * when the checkout has no origin remote. Opaque to the store schema. */
@@ -116,7 +119,7 @@ function nonBlank(value: string | undefined): string | undefined {
 
 /**
  * Select state with one precedence rule for every sessionless command:
- * non-blank explicit `--store` > non-blank `AB_STORE` > repository-local default.
+ * non-blank explicit `--store` > non-blank `AB_STORE` > `[store] url` > local default.
  *
  * A local selection relocates the whole local tree, including worktrees. A
  * remote store has no filesystem root, so its worktrees remain local beneath
@@ -130,14 +133,20 @@ export function resolveRepoStatePaths(opts: {
   checkout?: string
   storeRef?: string
   envStore?: string
+  configStore?: string
 }): RepoStatePaths {
   const checkout = resolve(opts.checkout ?? opts.repo)
   const defaultLocalRoot = join(checkout, LOCAL_STATE_DIR)
-  const selected = nonBlank(opts.storeRef) ?? nonBlank(opts.envStore) ?? defaultLocalRoot
+  const selected =
+    nonBlank(opts.storeRef) ??
+    nonBlank(opts.envStore) ??
+    nonBlank(opts.configStore) ??
+    defaultLocalRoot
   const remote = isRemoteStoreRef(selected)
   const storeRef = remote ? selected : resolve(checkout, selected)
   const localStateRoot = remote ? defaultLocalRoot : storeRef
   return {
+    ...(opts.configStore !== undefined ? { configStore: opts.configStore } : {}),
     repo: opts.repo,
     checkout,
     defaultLocalRoot,
@@ -223,10 +232,14 @@ export async function resolveRepoState(opts: {
   exec: Exec
   storeRef?: string
   envStore?: string
+  configStore?: string
 }): Promise<RepoStatePaths> {
   const checkout = await resolveMainRepo(opts.targetRepo, opts.exec)
   const origin = await resolveRepoOrigin(checkout, opts.exec)
   return resolveRepoStatePaths({
+    configStore:
+      opts.configStore ??
+      (nonBlank(opts.storeRef) || nonBlank(opts.envStore) ? undefined : configuredStore(checkout)),
     repo: origin ?? checkout,
     checkout,
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),

package/packages/core/src/cli/repository-status.ts

@@ -1,3 +1,13 @@
+import {
+  formatDispatcherIdentity,
+  projectDispatcherLiveness,
+  type DispatcherLiveness,
+} from '../kernel/dispatcher-liveness'
+import { readDispatcherLiveness } from './dispatcher-liveness'
+import {
+  reduceTicketSourceHealth,
+  type TicketSourceDegradation,
+} from '../kernel/ticket-source-health'
 import type { RepositoryEvent } from '../events/repository'
 import { reduceDispatchSettings, type DispatchSettings } from '../kernel/dispatch-settings'
 import { sandboxStates } from '../processes/sandbox-state'
@@ -7,6 +17,8 @@ import { withSessionlessStore, type StoreOpener } from './store-opening'
 /** Script-facing projection returned by `ab repository status`. */
 export interface RepositoryStatus extends DispatchSettings {
   repo: string
+  dispatcher: DispatcherLiveness
+  ticketSourceDegradation?: TicketSourceDegradation
   /** Live operator sandboxes (AUT-340); released environments are omitted. */
   sandboxes: Array<{
     operator: string
@@ -38,10 +50,15 @@ export interface RepositoryStatusOpts {
   json?: boolean
   /** Explicit --store reference; precedence is owned by repo-state.ts. */
   storeRef?: string
+  now?: () => Date
   openStore?: StoreOpener
 }
 
-export function projectRepositoryStatus(repo: string, events: RepositoryEvent[]): RepositoryStatus {
+export function projectRepositoryStatus(
+  repo: string,
+  events: RepositoryEvent[],
+  dispatcher = projectDispatcherLiveness(null, [], new Date()),
+): RepositoryStatus {
   const publications: RepositoryStatus['publications'] = []
   for (const event of events) {
     if (event.type !== 'orchestrator.sandbox.published') continue
@@ -63,8 +80,11 @@ export function projectRepositoryStatus(repo: string, events: RepositoryEvent[])
     })
   }
   publications.reverse()
+  const active = reduceTicketSourceHealth(events)
   return {
+    ...(active === undefined ? {} : { ticketSourceDegradation: active }),
     repo,
+    dispatcher,
     ...reduceDispatchSettings(events),
     sandboxes: sandboxStates(events)
       .filter((state) => state.state !== 'released')
@@ -81,8 +101,30 @@ export function projectRepositoryStatus(repo: string, events: RepositoryEvent[])
 
 export function renderRepositoryStatus(status: RepositoryStatus): string[] {
   const setting = (enabled: boolean): string => (enabled ? 'ON' : 'OFF')
+  const active = status.ticketSourceDegradation
   return [
+    ...(active === undefined
+      ? []
+      : [
+          `ticket source ${active.source}: ${active.cause} (${active.operation}) — ${active.message}${'resetAt' in active ? `; reset ${active.resetAt}` : ''}`,
+        ]),
     `repository: ${status.repo}`,
+    `dispatcher: ${status.dispatcher.state}${status.dispatcher.holder ? ` — ${formatDispatcherIdentity(status.dispatcher.holder)}` : ' — no dispatcher holds the repository'}`,
+    ...(status.dispatcher.expiredHolder
+      ? [`expired dispatcher: ${formatDispatcherIdentity(status.dispatcher.expiredHolder)}`]
+      : []),
+    ...[status.dispatcher.holder ?? status.dispatcher.expiredHolder].flatMap((run) =>
+      run
+        ? [
+            `last tick: ${run.lastTickAt ?? 'unknown'} (${run.lastTickAgeMs ?? 'unknown'}ms ago); ${JSON.stringify(run.lastTick)}`,
+          ]
+        : [],
+    ),
+    ...(status.dispatcher.latestStoppedRun
+      ? [
+          `last dispatcher stop: ${status.dispatcher.latestStoppedRun.stoppedAt}; ${status.dispatcher.latestStoppedRun.stop?.outcome}; signal ${status.dispatcher.latestStoppedRun.stop?.signal ?? 'none'}`,
+        ]
+      : []),
     `intake: ${setting(status.intake)}`,
     `repository pause: ${setting(status.paused)}`,
     `default auto-merge: ${setting(status.defaultAutoMerge)}`,
@@ -105,10 +147,8 @@ export async function abRepositoryStatus(opts: RepositoryStatusOpts): Promise<vo
   await withSessionlessStore(opts, async ({ store, repo }) => {
     // A fresh store has no repository row. Do not call ensureRepo: this query's
     // empty-stream defaults must remain a genuinely read-only operation.
-    const record = await store.getRepo(repo)
-    // Bounded read (AUT-489): projectRepositoryStatus reduces durable types only.
-    const events = record === null ? [] : await store.getRepoStateEvents(repo)
-    const status = projectRepositoryStatus(repo, events)
+    const { events, dispatcher } = await readDispatcherLiveness(store, repo, opts.now?.())
+    const status = projectRepositoryStatus(repo, events, dispatcher)
     if (opts.json === true) {
       opts.stdout(JSON.stringify(status, null, 2))
       return

package/packages/core/src/cli/self-update.ts

@@ -1,3 +1,4 @@
+import { checkUpgradeCompatibility, type CompatibilityFetch } from './upgrade-compatibility'
 import { readFile, writeFile } from 'node:fs/promises'
 import semver from 'semver'
 import type { ExecResult } from '../ports/workspace/git-worktree'
@@ -71,6 +72,7 @@ export function registryVersion(response: { status: number; body: string }): str
 
 export interface SelfUpdateOptions {
   targetRepo: string
+  compatibilityFetch?: CompatibilityFetch
   version?: string
   distRoot?: string
   env?: Record<string, string | undefined>
@@ -393,6 +395,14 @@ export async function selfUpdate(options: SelfUpdateOptions): Promise<SelfUpdate
     return { kind: 'continue' }
   }
 
+  await checkUpgradeCompatibility({
+    targetRepo: options.targetRepo,
+    version: resolved,
+    env: options.env,
+    stderr: options.stderr,
+    fetch: options.compatibilityFetch,
+  })
+
   const dependency = updateDependency(install, resolved)
   let updateCommand: string[]
   if (install.scope === 'global') {

package/packages/core/src/cli/store-opening.ts

@@ -6,6 +6,8 @@
  * joins those seams to the production remote adapter and owns finite-command
  * store lifecycle.
  */
+import { projectToken } from './project-credentials'
+import { isRemoteStoreRef } from './repo-state'
 import type { Exec } from '../ports/workspace/git-worktree'
 import { RemoteBuildStore } from '../store/remote/client'
 import { scopeLocalStoreToPhaseSession } from '../store/phase-session'
@@ -16,7 +18,7 @@ import {
   type CliEnv,
   type HarvestCliEnv,
 } from './env'
-import { isRemoteStoreRef, resolveRepoState, type RepoStatePaths } from './repo-state'
+import { resolveRepoState, type RepoStatePaths } from './repo-state'
 import { resolveStore } from './store-ref'
 
 /** Shared injection seam used by every command that opens a BuildStore. */
@@ -39,15 +41,14 @@ export const openProductionStore: StoreOpener = (ref, token) => {
 }
 
 /** Apply validated ambient authority to a selected Store handle. Remote
- * handles retain token-backed server authorization; filesystem handles receive
- * the equivalent in-process scope. Keeping this primitive shared prevents
+ * handles retain server-side project authorization; every handle receives
+ * the same in-process build/session scope. Keeping this primitive shared prevents
  * phase commands and ambient-aware query commands from drifting. */
 function scopeSelectedStoreToPhaseSession(
   store: BuildStore,
-  ref: string,
+  _ref: string,
   env: AmbientReadSession,
 ): BuildStore {
-  if (isRemoteStoreRef(ref)) return store
   return scopeLocalStoreToPhaseSession(
     store,
     'build' in env
@@ -65,15 +66,15 @@ export interface OpenedStoreContext extends RepoStatePaths {
   store: BuildStore
   token?: string
   /** The validated ambient phase/Harvest identity this invocation carries, if
-   * any — the same value that scoped `store` on the local path. Exposed so a
-   * command core can extend own-resource authority to remote handles too,
-   * where no session wrapper exists. */
+   * any — the same value that scoped `store`. Exposed for commands whose
+   * repository selection also depends on ambient own-build authority. */
   ambient?: AmbientReadSession
 }
 
 export interface OpenStoreForRepoStateOpts {
   env: Record<string, string | undefined>
   openStore?: StoreOpener
+  useProjectCredential?: boolean
 }
 
 /** Open from an already canonicalized state selection. Dispatch uses this form
@@ -82,7 +83,13 @@ export function openStoreForRepoState(
   state: RepoStatePaths,
   opts: OpenStoreForRepoStateOpts,
 ): OpenedStoreContext {
-  const token = optionalToken(opts.env.AB_TOKEN)
+  const token =
+    opts.useProjectCredential !== false && isRemoteStoreRef(state.storeRef)
+      ? projectToken(state.storeRef, state.repo, opts.env)
+      : optionalToken(opts.env.AB_TOKEN)
+  if (!token && isRemoteStoreRef(state.storeRef) && state.configStore === state.storeRef) {
+    throw new Error('No project credential for this service; run ab connect')
+  }
   const store = (opts.openStore ?? openProductionStore)(state.storeRef, token)
   return {
     ...state,
@@ -115,10 +122,8 @@ export async function openSessionlessStore(
 /** Finite command ownership boundary. Opening failures occur before the
  * try/finally, so only a successfully returned handle is ever closed.
  *
- * Remote store handles do not session-scope (bearer authorization is the
- * server's concern), so a command core that needs own-build authority must
- * consume `ambient` from the context directly rather than rely on the handle
- * enforcing a scope. */
+ * Ambient query openers apply in-process build/session scope to both local
+ * and remote handles; the server additionally enforces project authority. */
 export async function withSessionlessStore<T>(
   opts: SessionlessStoreOpts,
   use: (context: OpenedStoreContext) => Promise<T> | T,
@@ -145,7 +150,10 @@ export async function openAmbientReadStore(
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
     ...(opts.env.AB_STORE !== undefined ? { envStore: opts.env.AB_STORE } : {}),
   })
-  const context = openStoreForRepoState(state, opts)
+  const context = openStoreForRepoState(state, {
+    ...opts,
+    useProjectCredential: ambient === undefined,
+  })
   if (ambient === undefined) return context
   return {
     ...context,

package/packages/core/src/cli/terminals.ts

@@ -50,7 +50,6 @@ import type { ArtifactMeta, BuildStore } from '../store/types'
 import { textContent } from '../store/types'
 import { expandIssues } from '../zod-issues'
 import { preparePrAttachments } from './pr-attachments'
-import { renderPrSummary } from './pr-summary'
 import type { CliEnv } from './env'
 
 /** Structural subset of CliDeps (src/cli/main.ts) — what terminals need. */
@@ -441,15 +440,6 @@ export async function completeFinalizePr(
     }
   }
 
-  try {
-    await deps.forge.commentOnPr(
-      deps.workspacePath,
-      pr.number,
-      renderPrSummary(env, await store.getEvents(env.build)),
-    )
-  } catch {
-    // The durable audit trail remains authoritative.
-  }
   return event
 }
 

package/packages/core/src/cli/ticket.ts

@@ -199,13 +199,20 @@ export async function openTicketSource(
   const plugins = await loadPlugins(config.plugins, targetRepo)
   const repoState = resolveRepoStatePaths({
     repo: targetRepo,
+    configStore: config.store?.url,
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
     ...(opts.env.AB_STORE !== undefined ? { envStore: opts.env.AB_STORE } : {}),
   })
   const factory = opts.sourceFactory ?? createTicketSource
   return {
     config,
-    source: await factory(config.tickets, opts.env, targetRepo, repoState.localStateRoot, plugins),
+    source: await factory(
+      config.tickets,
+      config.tickets.source === 'hosted' ? { ...opts.env, AB_STORE: repoState.storeRef } : opts.env,
+      targetRepo,
+      repoState.localStateRoot,
+      plugins,
+    ),
   }
 }
 

package/packages/core/src/cli/upgrade-compatibility.ts

@@ -0,0 +1,80 @@
+import { spawnExec } from '../ports/workspace/git-worktree'
+import { readDistributionIdentity } from './installation'
+import { isRemoteStoreRef, resolveRepoState } from './repo-state'
+import {
+  classifyClient,
+  compatibilityAdvice,
+  stableVersion,
+  supportedClientRangeSchema,
+} from '../store/remote/compatibility'
+
+export type CompatibilityFetch = (url: string, init: RequestInit) => Promise<Response>
+
+/** Read-only, advisory, and deliberately credential-free. Never expose a store URL. */
+export async function checkUpgradeCompatibility(options: {
+  targetRepo: string
+  version?: string
+  distRoot?: string
+  env?: Record<string, string | undefined>
+  stderr: (line: string) => void
+  fetch?: CompatibilityFetch
+  timeoutMs?: number
+}): Promise<void> {
+  const paths = await resolveRepoState({
+    targetRepo: options.targetRepo,
+    exec: spawnExec,
+    envStore: (options.env ?? process.env).AB_STORE,
+  })
+  if (!isRemoteStoreRef(paths.storeRef)) return
+  const unknown = () =>
+    options.stderr(
+      'warning: hosted service compatibility could not be verified; the upgraded project may fail to connect',
+    )
+  try {
+    const targetVersion =
+      options.version ?? (await readDistributionIdentity(options.distRoot)).version
+    const url = new URL(paths.storeRef)
+    url.username = ''
+    url.password = ''
+    url.search = ''
+    url.hash = ''
+    url.pathname = `${url.pathname.replace(/\/$/, '')}/health`
+    const controller = new AbortController()
+    let timeout: ReturnType<typeof setTimeout> | undefined
+    const expired = new Promise<never>((_, reject) => {
+      timeout = setTimeout(() => {
+        controller.abort()
+        reject(new Error('timeout'))
+      }, options.timeoutMs ?? 3000)
+    })
+    const response = await Promise.race([
+      (async () => {
+        const response = await (options.fetch ?? fetch)(url.toString(), {
+          signal: controller.signal,
+          redirect: 'error',
+        })
+        if (response.status !== 200) throw new Error('health failed')
+        return (await response.json()) as Record<string, unknown>
+      })(),
+      expired,
+    ]).finally(() => clearTimeout(timeout))
+    if (!response || !stableVersion(response.autobuildVersion)) return unknown()
+    const serviceVersion = response.autobuildVersion as string
+    if (!Object.hasOwn(response, 'supportedClientRange')) {
+      if (targetVersion !== serviceVersion)
+        options.stderr(
+          `warning: service Autobuild ${serviceVersion} requires an exact client version; target ${targetVersion} differs. Upgrade the service to the compatibility-window release first to publish a supported client range; the upgraded project may fail to connect`,
+        )
+      return
+    }
+    const range = supportedClientRangeSchema.safeParse(response.supportedClientRange)
+    if (!range.success || classifyClient(targetVersion, range.data) === 'invalid') return unknown()
+    const advice = compatibilityAdvice(targetVersion, serviceVersion, range.data)
+    if (advice)
+      options.stderr(
+        `warning: target Autobuild ${targetVersion}: ${advice}; the upgraded project may fail to connect`,
+      )
+  } catch {
+    unknown()
+  }
+}