@defrex/autobuild 0.11.0 → 0.12.0

package/packages/core/src/cli/repo-state.ts

@@ -20,6 +20,7 @@
  * normalized against that checkout so the dispatcher and agents cannot
  * interpret a relative path from different working directories.
  */
+import { configuredStore } from './configured-store'
 import { basename, dirname, isAbsolute, join, resolve } from 'node:path'
 import type { Exec } from '../ports/workspace/git-worktree'
 import type { BuildRecord } from '../store/types'
@@ -92,6 +93,8 @@ export async function resolveMainRepo(targetRepo: string, exec: Exec): Promise<s
 }
 
 export interface RepoStatePaths {
+  /** Validated repository setting used for this selection, when present. */
+  configStore?: string
   /** Repository identity in BuildStore records/journals: the checkout's
    * normalized origin URL, falling back to the resolved checkout path only
    * when the checkout has no origin remote. Opaque to the store schema. */
@@ -116,7 +119,7 @@ function nonBlank(value: string | undefined): string | undefined {
 
 /**
  * Select state with one precedence rule for every sessionless command:
- * non-blank explicit `--store` > non-blank `AB_STORE` > repository-local default.
+ * non-blank explicit `--store` > non-blank `AB_STORE` > `[store] url` > local default.
  *
  * A local selection relocates the whole local tree, including worktrees. A
  * remote store has no filesystem root, so its worktrees remain local beneath
@@ -130,14 +133,20 @@ export function resolveRepoStatePaths(opts: {
   checkout?: string
   storeRef?: string
   envStore?: string
+  configStore?: string
 }): RepoStatePaths {
   const checkout = resolve(opts.checkout ?? opts.repo)
   const defaultLocalRoot = join(checkout, LOCAL_STATE_DIR)
-  const selected = nonBlank(opts.storeRef) ?? nonBlank(opts.envStore) ?? defaultLocalRoot
+  const selected =
+    nonBlank(opts.storeRef) ??
+    nonBlank(opts.envStore) ??
+    nonBlank(opts.configStore) ??
+    defaultLocalRoot
   const remote = isRemoteStoreRef(selected)
   const storeRef = remote ? selected : resolve(checkout, selected)
   const localStateRoot = remote ? defaultLocalRoot : storeRef
   return {
+    ...(opts.configStore !== undefined ? { configStore: opts.configStore } : {}),
     repo: opts.repo,
     checkout,
     defaultLocalRoot,
@@ -223,10 +232,14 @@ export async function resolveRepoState(opts: {
   exec: Exec
   storeRef?: string
   envStore?: string
+  configStore?: string
 }): Promise<RepoStatePaths> {
   const checkout = await resolveMainRepo(opts.targetRepo, opts.exec)
   const origin = await resolveRepoOrigin(checkout, opts.exec)
   return resolveRepoStatePaths({
+    configStore:
+      opts.configStore ??
+      (nonBlank(opts.storeRef) || nonBlank(opts.envStore) ? undefined : configuredStore(checkout)),
     repo: origin ?? checkout,
     checkout,
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),

package/packages/core/src/cli/self-update.ts

@@ -1,3 +1,4 @@
+import { checkUpgradeCompatibility, type CompatibilityFetch } from './upgrade-compatibility'
 import { readFile, writeFile } from 'node:fs/promises'
 import semver from 'semver'
 import type { ExecResult } from '../ports/workspace/git-worktree'
@@ -71,6 +72,7 @@ export function registryVersion(response: { status: number; body: string }): str
 
 export interface SelfUpdateOptions {
   targetRepo: string
+  compatibilityFetch?: CompatibilityFetch
   version?: string
   distRoot?: string
   env?: Record<string, string | undefined>
@@ -393,6 +395,14 @@ export async function selfUpdate(options: SelfUpdateOptions): Promise<SelfUpdate
     return { kind: 'continue' }
   }
 
+  await checkUpgradeCompatibility({
+    targetRepo: options.targetRepo,
+    version: resolved,
+    env: options.env,
+    stderr: options.stderr,
+    fetch: options.compatibilityFetch,
+  })
+
   const dependency = updateDependency(install, resolved)
   let updateCommand: string[]
   if (install.scope === 'global') {

package/packages/core/src/cli/store-opening.ts

@@ -6,6 +6,8 @@
  * joins those seams to the production remote adapter and owns finite-command
  * store lifecycle.
  */
+import { projectToken } from './project-credentials'
+import { isRemoteStoreRef } from './repo-state'
 import type { Exec } from '../ports/workspace/git-worktree'
 import { RemoteBuildStore } from '../store/remote/client'
 import { scopeLocalStoreToPhaseSession } from '../store/phase-session'
@@ -16,7 +18,7 @@ import {
   type CliEnv,
   type HarvestCliEnv,
 } from './env'
-import { isRemoteStoreRef, resolveRepoState, type RepoStatePaths } from './repo-state'
+import { resolveRepoState, type RepoStatePaths } from './repo-state'
 import { resolveStore } from './store-ref'
 
 /** Shared injection seam used by every command that opens a BuildStore. */
@@ -39,15 +41,14 @@ export const openProductionStore: StoreOpener = (ref, token) => {
 }
 
 /** Apply validated ambient authority to a selected Store handle. Remote
- * handles retain token-backed server authorization; filesystem handles receive
- * the equivalent in-process scope. Keeping this primitive shared prevents
+ * handles retain server-side project authorization; every handle receives
+ * the same in-process build/session scope. Keeping this primitive shared prevents
  * phase commands and ambient-aware query commands from drifting. */
 function scopeSelectedStoreToPhaseSession(
   store: BuildStore,
-  ref: string,
+  _ref: string,
   env: AmbientReadSession,
 ): BuildStore {
-  if (isRemoteStoreRef(ref)) return store
   return scopeLocalStoreToPhaseSession(
     store,
     'build' in env
@@ -65,15 +66,15 @@ export interface OpenedStoreContext extends RepoStatePaths {
   store: BuildStore
   token?: string
   /** The validated ambient phase/Harvest identity this invocation carries, if
-   * any — the same value that scoped `store` on the local path. Exposed so a
-   * command core can extend own-resource authority to remote handles too,
-   * where no session wrapper exists. */
+   * any — the same value that scoped `store`. Exposed for commands whose
+   * repository selection also depends on ambient own-build authority. */
   ambient?: AmbientReadSession
 }
 
 export interface OpenStoreForRepoStateOpts {
   env: Record<string, string | undefined>
   openStore?: StoreOpener
+  useProjectCredential?: boolean
 }
 
 /** Open from an already canonicalized state selection. Dispatch uses this form
@@ -82,7 +83,13 @@ export function openStoreForRepoState(
   state: RepoStatePaths,
   opts: OpenStoreForRepoStateOpts,
 ): OpenedStoreContext {
-  const token = optionalToken(opts.env.AB_TOKEN)
+  const token =
+    opts.useProjectCredential !== false && isRemoteStoreRef(state.storeRef)
+      ? projectToken(state.storeRef, state.repo, opts.env)
+      : optionalToken(opts.env.AB_TOKEN)
+  if (!token && isRemoteStoreRef(state.storeRef) && state.configStore === state.storeRef) {
+    throw new Error('No project credential for this service; run ab connect')
+  }
   const store = (opts.openStore ?? openProductionStore)(state.storeRef, token)
   return {
     ...state,
@@ -115,10 +122,8 @@ export async function openSessionlessStore(
 /** Finite command ownership boundary. Opening failures occur before the
  * try/finally, so only a successfully returned handle is ever closed.
  *
- * Remote store handles do not session-scope (bearer authorization is the
- * server's concern), so a command core that needs own-build authority must
- * consume `ambient` from the context directly rather than rely on the handle
- * enforcing a scope. */
+ * Ambient query openers apply in-process build/session scope to both local
+ * and remote handles; the server additionally enforces project authority. */
 export async function withSessionlessStore<T>(
   opts: SessionlessStoreOpts,
   use: (context: OpenedStoreContext) => Promise<T> | T,
@@ -145,7 +150,10 @@ export async function openAmbientReadStore(
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
     ...(opts.env.AB_STORE !== undefined ? { envStore: opts.env.AB_STORE } : {}),
   })
-  const context = openStoreForRepoState(state, opts)
+  const context = openStoreForRepoState(state, {
+    ...opts,
+    useProjectCredential: ambient === undefined,
+  })
   if (ambient === undefined) return context
   return {
     ...context,

package/packages/core/src/cli/terminals.ts

@@ -50,7 +50,6 @@ import type { ArtifactMeta, BuildStore } from '../store/types'
 import { textContent } from '../store/types'
 import { expandIssues } from '../zod-issues'
 import { preparePrAttachments } from './pr-attachments'
-import { renderPrSummary } from './pr-summary'
 import type { CliEnv } from './env'
 
 /** Structural subset of CliDeps (src/cli/main.ts) — what terminals need. */
@@ -441,15 +440,6 @@ export async function completeFinalizePr(
     }
   }
 
-  try {
-    await deps.forge.commentOnPr(
-      deps.workspacePath,
-      pr.number,
-      renderPrSummary(env, await store.getEvents(env.build)),
-    )
-  } catch {
-    // The durable audit trail remains authoritative.
-  }
   return event
 }
 

package/packages/core/src/cli/ticket.ts

@@ -199,13 +199,20 @@ export async function openTicketSource(
   const plugins = await loadPlugins(config.plugins, targetRepo)
   const repoState = resolveRepoStatePaths({
     repo: targetRepo,
+    configStore: config.store?.url,
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
     ...(opts.env.AB_STORE !== undefined ? { envStore: opts.env.AB_STORE } : {}),
   })
   const factory = opts.sourceFactory ?? createTicketSource
   return {
     config,
-    source: await factory(config.tickets, opts.env, targetRepo, repoState.localStateRoot, plugins),
+    source: await factory(
+      config.tickets,
+      config.tickets.source === 'hosted' ? { ...opts.env, AB_STORE: repoState.storeRef } : opts.env,
+      targetRepo,
+      repoState.localStateRoot,
+      plugins,
+    ),
   }
 }
 

package/packages/core/src/cli/upgrade-compatibility.ts

@@ -0,0 +1,80 @@
+import { spawnExec } from '../ports/workspace/git-worktree'
+import { readDistributionIdentity } from './installation'
+import { isRemoteStoreRef, resolveRepoState } from './repo-state'
+import {
+  classifyClient,
+  compatibilityAdvice,
+  stableVersion,
+  supportedClientRangeSchema,
+} from '../store/remote/compatibility'
+
+export type CompatibilityFetch = (url: string, init: RequestInit) => Promise<Response>
+
+/** Read-only, advisory, and deliberately credential-free. Never expose a store URL. */
+export async function checkUpgradeCompatibility(options: {
+  targetRepo: string
+  version?: string
+  distRoot?: string
+  env?: Record<string, string | undefined>
+  stderr: (line: string) => void
+  fetch?: CompatibilityFetch
+  timeoutMs?: number
+}): Promise<void> {
+  const paths = await resolveRepoState({
+    targetRepo: options.targetRepo,
+    exec: spawnExec,
+    envStore: (options.env ?? process.env).AB_STORE,
+  })
+  if (!isRemoteStoreRef(paths.storeRef)) return
+  const unknown = () =>
+    options.stderr(
+      'warning: hosted service compatibility could not be verified; the upgraded project may fail to connect',
+    )
+  try {
+    const targetVersion =
+      options.version ?? (await readDistributionIdentity(options.distRoot)).version
+    const url = new URL(paths.storeRef)
+    url.username = ''
+    url.password = ''
+    url.search = ''
+    url.hash = ''
+    url.pathname = `${url.pathname.replace(/\/$/, '')}/health`
+    const controller = new AbortController()
+    let timeout: ReturnType<typeof setTimeout> | undefined
+    const expired = new Promise<never>((_, reject) => {
+      timeout = setTimeout(() => {
+        controller.abort()
+        reject(new Error('timeout'))
+      }, options.timeoutMs ?? 3000)
+    })
+    const response = await Promise.race([
+      (async () => {
+        const response = await (options.fetch ?? fetch)(url.toString(), {
+          signal: controller.signal,
+          redirect: 'error',
+        })
+        if (response.status !== 200) throw new Error('health failed')
+        return (await response.json()) as Record<string, unknown>
+      })(),
+      expired,
+    ]).finally(() => clearTimeout(timeout))
+    if (!response || !stableVersion(response.autobuildVersion)) return unknown()
+    const serviceVersion = response.autobuildVersion as string
+    if (!Object.hasOwn(response, 'supportedClientRange')) {
+      if (targetVersion !== serviceVersion)
+        options.stderr(
+          `warning: service Autobuild ${serviceVersion} requires an exact client version; target ${targetVersion} differs. Upgrade the service to the compatibility-window release first to publish a supported client range; the upgraded project may fail to connect`,
+        )
+      return
+    }
+    const range = supportedClientRangeSchema.safeParse(response.supportedClientRange)
+    if (!range.success || classifyClient(targetVersion, range.data) === 'invalid') return unknown()
+    const advice = compatibilityAdvice(targetVersion, serviceVersion, range.data)
+    if (advice)
+      options.stderr(
+        `warning: target Autobuild ${targetVersion}: ${advice}; the upgraded project may fail to connect`,
+      )
+  } catch {
+    unknown()
+  }
+}

package/packages/core/src/cli/wait.ts

@@ -31,6 +31,7 @@
  * Read-only: it appends no event, claims or renews no lease, and creates no
  * build or repository record. Output carries no ANSI, ever, in either form.
  */
+import { buildNeedsAttention, mergeDecision, mergeIdentity } from './attention'
 import type { AbEvent } from '../events/catalog'
 import type { EventType } from '../events/payloads'
 import type { BuildState, PrLifecycle } from '../kernel/reducer'
@@ -54,6 +55,8 @@ import {
   encodeCursor,
   parseDurationMs,
   projectRecord,
+  projectAttentionRecord,
+  renderAttentionLine,
   renderWatchLine,
   watchSelection,
 } from './watch'
@@ -153,8 +156,8 @@ export function parseConditions(
   return { conditions, globs }
 }
 
-/** Does one condition body hold over a reduction? Attention is event-only. */
-function stateSatisfies(cond: ConditionBody, state: BuildState): boolean {
+/** Does one condition body hold over a reduction? Attention includes current escalation and merge state. */
+function stateSatisfies(cond: ConditionBody, state: BuildState, events: AbEvent[] = []): boolean {
   switch (cond.kind) {
     case 'status':
       return state.status === cond.status
@@ -165,7 +168,7 @@ function stateSatisfies(cond: ConditionBody, state: BuildState): boolean {
     case 'phase':
       return (state.phase ?? null) === cond.phase
     case 'attention':
-      return false
+      return buildNeedsAttention(events, state)
   }
 }
 
@@ -174,9 +177,13 @@ function stateSatisfies(cond: ConditionBody, state: BuildState): boolean {
  * the start-of-command and start-of-registration checks — never during a
  * backlog replay, where only event conditions may fire.
  */
-export function matchState(conditions: readonly WaitCondition[], state: BuildState): string | null {
+export function matchState(
+  conditions: readonly WaitCondition[],
+  state: BuildState,
+  events: AbEvent[] = [],
+): string | null {
   for (const { text, cond } of conditions) {
-    if (stateSatisfies(cond, state)) return text
+    if (stateSatisfies(cond, state, events)) return text
   }
   return null
 }
@@ -188,9 +195,15 @@ export function matchEvent(
   event: Pick<AbEvent, 'type'>,
   conditions: readonly WaitCondition[],
   globs: readonly EventGlob[],
+  events: AbEvent[] = [],
 ): string | null {
   for (const { text, cond } of conditions) {
-    if (cond.kind === 'attention' && isAttentionEvent(event.type)) return text
+    if (
+      cond.kind === 'attention' &&
+      (isAttentionEvent(event.type) ||
+        (events.length > 0 && mergeDecision(events, new Date(0)) !== null))
+    )
+      return text
   }
   for (const { regex, text } of globs) {
     if (regex.test(event.type)) return text
@@ -209,10 +222,16 @@ function matchFirst(
   state: BuildState,
   conditions: readonly WaitCondition[],
   globs: readonly EventGlob[],
+  events: AbEvent[] = [],
 ): string | null {
   for (const { text, cond } of conditions) {
-    if (stateSatisfies(cond, state)) return text
-    if (cond.kind === 'attention' && isAttentionEvent(event.type)) return text
+    if (stateSatisfies(cond, state, events)) return text
+    if (
+      cond.kind === 'attention' &&
+      (isAttentionEvent(event.type) ||
+        (events.length > 0 && mergeDecision(events, new Date(0)) !== null))
+    )
+      return text
   }
   for (const { regex, text } of globs) {
     if (regex.test(event.type)) return text
@@ -305,11 +324,12 @@ export async function abWait(opts: AbWaitOpts): Promise<number> {
       const interval = intervalMs ?? watchSelection(storeRef).intervalMs
 
       // Decode --since before any read: a foreign cursor is rejected outright.
-      const sinceStreams =
+      const resumedCursor =
         opts.since !== undefined
           ? decodeCursor(opts.since, { store: storeRef, repo }, { verb: 'wait', usage: WAIT_USAGE })
-              .streams
-          : {}
+          : undefined
+      const sinceStreams = resumedCursor?.streams ?? {}
+      const deliveredAttention = new Set(resumedCursor?.deliveredAttention ?? [])
 
       const identity = normalizeGitRemoteUrl(repo)
       const mine = (record: BuildRecord): boolean =>
@@ -322,17 +342,40 @@ export async function abWait(opts: AbWaitOpts): Promise<number> {
       const positions: Record<string, number> = { ...sinceStreams }
 
       const encodeCurrent = (): string =>
-        encodeCursor({ v: 1, store: storeRef, repo, streams: { ...positions } })
+        encodeCursor({
+          v: 1,
+          store: storeRef,
+          repo,
+          streams: { ...positions },
+          ...(resumedCursor?.lostRuns ? { lostRuns: resumedCursor.lostRuns } : {}),
+          deliveredAttention: [...deliveredAttention],
+        })
 
       /** The one success/terminal record. Exit 0 is contractually tied to
        * exactly one condition-satisfying record; the exit-2 record carries
        * `condition` null so the caller can see how the build ended. */
       const finish = (condition: string | null, event: AbEvent, state: BuildState): number => {
-        const record = { ...projectRecord(event, state, encodeCurrent()), condition }
+        const observation =
+          condition === 'attention' && event.type !== 'escalation.raised'
+            ? mergeDecision(
+                streams.get(event.build)?.events.filter((e) => e.seq <= event.seq) ?? [],
+                now(),
+                state,
+              )
+            : null
+        if (observation) deliveredAttention.add(mergeIdentity(event.build, observation.pr.number))
+        const record = {
+          ...(observation
+            ? projectAttentionRecord(observation, state, encodeCurrent(), { build: event.build })
+            : projectRecord(event, state, encodeCurrent())),
+          condition,
+        }
         if (json) {
           opts.stdout(JSON.stringify(record))
         } else {
-          const line = renderWatchLine(event, state)
+          const line = observation
+            ? renderAttentionLine(observation, event.build)
+            : renderWatchLine(event, state)
           opts.stdout(condition === null ? line : `${line} (${condition})`)
         }
         return condition === null ? 2 : 0
@@ -351,6 +394,15 @@ export async function abWait(opts: AbWaitOpts): Promise<number> {
         if (satisfied === null) satisfied = { event, state, condition }
       }
 
+      const eventConditions = (event: AbEvent, prefix: AbEvent[]): readonly WaitCondition[] => {
+        if (event.type === 'escalation.raised') return conditions
+        const observation = mergeDecision(prefix, now())
+        return observation &&
+          !deliveredAttention.has(mergeIdentity(event.build, observation.pr.number))
+          ? conditions
+          : conditions.filter(({ cond }) => cond.kind !== 'attention')
+      }
+
       const registerStream = (slug: string, events: AbEvent[], named: boolean): WaitStream => {
         const state = reduceBuild(events)
         const stream: WaitStream = {
@@ -370,7 +422,7 @@ export async function abWait(opts: AbWaitOpts): Promise<number> {
        * latest event. Not cursor-relative — `--since` does not suppress it. */
       const checkRegistrationState = (stream: WaitStream): void => {
         const state = reduceBuild(stream.events)
-        const condition = matchState(conditions, state)
+        const condition = matchState(conditions, state, stream.events)
         if (condition !== null && stream.events.length > 0) {
           match(stream.events.at(-1)!, state, condition)
         }
@@ -401,12 +453,20 @@ export async function abWait(opts: AbWaitOpts): Promise<number> {
           // the reduction of the prefix ENDING at that event, never the
           // reduction of the full loaded prefix.
           const replay: AbEvent[] = events.filter((event) => event.seq <= resumeSeq)
+          if (resumedCursor?.deliveredAttention === undefined) {
+            const historical: AbEvent[] = []
+            for (const event of replay) {
+              historical.push(event)
+              const observation = mergeDecision(historical, now())
+              if (observation) deliveredAttention.add(mergeIdentity(slug, observation.pr.number))
+            }
+          }
           for (const event of events) {
             if (event.seq <= resumeSeq) continue
             replay.push(event)
             stream.lastSeq = event.seq
             positions[slug] = event.seq
-            const condition = matchEvent(event, conditions, globs)
+            const condition = matchEvent(event, eventConditions(event, replay), globs, replay)
             if (condition !== null) {
               match(event, reduceBuild(replay), condition)
               break
@@ -470,7 +530,13 @@ export async function abWait(opts: AbWaitOpts): Promise<number> {
           positions[stream.slug] = event.seq
           const state = reduceBuild(stream.events)
           stream.status = state.status
-          const condition = matchFirst(event, state, conditions, globs)
+          const condition = matchFirst(
+            event,
+            state,
+            eventConditions(event, stream.events),
+            globs,
+            stream.events,
+          )
           if (condition !== null) {
             match(event, state, condition)
             return
@@ -564,6 +630,7 @@ export async function abWait(opts: AbWaitOpts): Promise<number> {
       // Cursor streams that are no longer named resume anyway: finishing
       // their backlog is what makes a resumed wait lossless.
       for (const key of Object.keys(sinceStreams)) {
+        if (key === '#repo') continue
         await trackBuild(key, sinceStreams[key])
         if (hasMatch()) return finishSatisfied()
       }