@defrex/autobuild 0.11.0 → 0.13.0

package/packages/core/src/cli/dashboard/model.ts

@@ -116,11 +116,9 @@ export interface PipelineStep {
   /** Absent ⇒ the step has never run in the current spec scope ⇒ no time is
    * shown (AC 6). The renderer composes the elapsed segment from this. */
   timing?: StepTiming
-  /** Display-only, like `qualifier`, and never consulted for routing: the
-   * parked merge step's no-consent explanation — why nothing will happen
-   * without operator action, and which control unblocks it. Attached when the
-   * build is current at merge with effective auto-merge off; the terminal
-   * row/detail and the web row/detail render the same words. */
+  /** Display-only policy skip reason or parked merge explanation. The shared
+   * row/detail renderers use this wrapping prose segment for longer reasons;
+   * it is never consulted for routing. */
   reason?: string
 }
 
@@ -752,6 +750,7 @@ export function projectBuildFromFacts(
           : stepResults.some((r) => r.outcome === 'skipped')
             ? 'skipped'
             : undefined,
+        reason: stepResults.find((r) => r.skipCause === 'post-reconcile-policy')?.reason,
         count,
         timing: timingFor(intervals, phase, cycleSince, frozenNow),
       }),

package/packages/core/src/cli/dashboard/poll.ts

@@ -211,7 +211,7 @@ export class DashboardBuildPollCache {
         // both the cached reduction and projected row untouched.
         next.set(
           record.slug,
-          configChanged
+          configChanged || current.build?.ticketId !== record.ticket?.id
             ? {
                 ...current,
                 build: await this.projectRow(record, current.state, current.events, config),

package/packages/core/src/cli/dispatch.ts

@@ -1,3 +1,9 @@
+import { issueTicketGrant, ticketGrantRequest } from '../ports/tickets/grants'
+import { RemoteBuildStore } from '../store/remote/client'
+import { delegateCredential } from '../store/remote/credentials'
+import { isRemoteStoreRef } from './repo-state'
+import { projectToken } from './project-credentials'
+import { settleSummaryRequests } from './pr-summary-publication'
 import { readDispatcherLiveness, StandbyIdentityResolver } from './dispatcher-liveness'
 import { formatDispatcherIdentity } from '../kernel/dispatcher-liveness'
 /**
@@ -182,18 +188,6 @@ export { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT } from '../store/retention'
 // Local uses within this module.
 import { DISPATCHER_EFFECTIVE_CONFIG_ARTIFACT as _effectiveConfigKind } from '../store/retention'
 
-/** JSON encoding in the config schema's declarative input shape. Parsed Config
- * has normalized `{steps, stepConfigs}` sections; flattening named step tables
- * lets the frontend validate the artifact with the same strict configSchema. */
-function effectiveConfigContent(config: Config): string {
-  const { verify, finalize, ...root } = config
-  return JSON.stringify({
-    ...root,
-    verify: { steps: verify.steps, ...verify.stepConfigs },
-    finalize: { steps: finalize.steps, ...finalize.stepConfigs },
-  })
-}
-
 /** The pre-build naming prompt. Its output is only a proposal: dispatcher.ts
  * owns strict validation, timeout/failure fallback, and store-wide uniqueness. */
 export function slugNamingPrompt(spec: string): string {
@@ -212,7 +206,8 @@ export function slugNamingPrompt(spec: string): string {
 function definedEnv(env: Record<string, string | undefined>): Record<string, string> {
   const defined: Record<string, string> = {}
   for (const [key, value] of Object.entries(env)) {
-    if (value !== undefined) defined[key] = value
+    if (value !== undefined && !['AB_TOKEN', 'AB_TICKET_TOKEN', 'AB_TICKET_URL'].includes(key))
+      defined[key] = value
   }
   return defined
 }
@@ -264,6 +259,7 @@ interface ResumePrompt {
 /** The real adapters the loop drives — resolved by `wire` (default: the
  * production ports; tests inject fakes). */
 export interface DispatchWiring {
+  credentialIssuer?: typeof delegateCredential
   store: BuildStore
   tickets: TicketSource
   forge: Forge
@@ -282,7 +278,7 @@ export interface DispatchWiring {
    * same store as `store`, so an agent's `ab` commands write where the
    * dispatcher reads. */
   storeRef: string
-  /** Scoped token for a remote store (D8, `AB_TOKEN`); passed to sessions. */
+  /** Private parent authority for remote exchange; never passed to execution. */
   token?: string
   ids: IdSource
   uuids: UuidSource
@@ -817,6 +813,7 @@ class DispatchLoop {
       forge: wiring.forge,
       config,
       getConfig: () => this.liveConfig.current().config,
+      repairBuildConfig: (slug) => this.publishBuildConfig(slug),
       repo: this.repoIdentity,
       // Origin mode: the forge answers remote base-branch questions; no
       // checkout git is probed for the served repository's origin.
@@ -2231,7 +2228,7 @@ class DispatchLoop {
     }
 
     const { store, tickets, runtimes, ids, uuids, clock, storeRef, token } = this.wiring
-    const runner = new HarvestRunner({
+    const harvestDeps = {
       store,
       tickets,
       config: this.currentConfig().config,
@@ -2246,16 +2243,175 @@ class DispatchLoop {
       ...(this.repoLeaseHolder !== undefined ? { leaseHolder: this.repoLeaseHolder } : {}),
       sessionEnv: {
         AB_STORE: storeRef,
-        ...(token !== undefined ? { AB_TOKEN: token } : {}),
       },
       opts: {
         maxRecoveryAttempts: this.maxHarvestRecoveryAttempts,
       },
-    })
+    }
 
     let tracked: Promise<void>
-    tracked = runner
-      .run()
+    tracked = (async () => {
+      const ticketUrl =
+        harvestDeps.config.tickets.source === 'hosted'
+          ? (harvestDeps.config.tickets.url ?? (/^https?:/i.test(storeRef) ? storeRef : undefined))
+          : undefined
+      if (ticketUrl && ticketUrl.replace(/\/+$/, '') !== storeRef.replace(/\/+$/, '')) {
+        const ticketToken = projectToken(ticketUrl, this.repoIdentity, {
+          ...this.opts.env,
+          AB_TOKEN: undefined,
+        })
+        if (!ticketToken)
+          throw new Error('Independent hosted harvest requires a ticket-service project credential')
+        const issued = await issueTicketGrant(
+          ticketUrl,
+          ticketToken,
+          this.repoIdentity,
+          harvestDeps.instance,
+          'runner',
+        )
+        let remoteRunnerStore: RemoteBuildStore | undefined
+        let preparedRun: { run: string } | undefined
+        let buildScoped: string | undefined
+        let renew: ReturnType<typeof setInterval> | undefined
+        try {
+          if (/^https?:/i.test(storeRef)) {
+            const prepared = await new HarvestRunner(harvestDeps).run(true)
+            if (prepared.outcome !== 'prepared') {
+              return prepared
+            }
+            preparedRun = { run: prepared.run }
+            await this.repoView.appendRepo(this.repoIdentity, {
+              actor: DISPATCHER,
+              type: 'harvest.execution.authorized',
+              payload: {
+                execution: harvestDeps.instance,
+                run: prepared.run,
+                launch: prepared.launch,
+                leaseHolder: this.repoLeaseHolder ?? harvestDeps.instance,
+              },
+            })
+            buildScoped = await (this.wiring.credentialIssuer ?? delegateCredential)(
+              storeRef,
+              token,
+              {
+                kind: 'harvest-runner',
+                execution: harvestDeps.instance,
+                repo: this.repoIdentity,
+                id: prepared.run,
+                leaseHolder: this.repoLeaseHolder ?? harvestDeps.instance,
+              },
+            )
+            remoteRunnerStore = new RemoteBuildStore({ url: storeRef, token: buildScoped })
+          }
+          const sessionEnv = {
+            ...harvestDeps.sessionEnv,
+            ...(buildScoped ? { AB_TOKEN: buildScoped } : {}),
+            AB_TICKET_URL: ticketUrl,
+            AB_TICKET_TOKEN: issued.token,
+          }
+          let renewalFailure: unknown
+          renew = setInterval(() => {
+            void ticketGrantRequest(ticketUrl, issued.token, {
+              action: 'renew',
+              repo: this.repoIdentity,
+              id: issued.grant.id,
+            }).catch((error) => {
+              renewalFailure = error
+            })
+          }, 60_000)
+          const runnerTickets = await createTicketSource(
+            harvestDeps.config.tickets,
+            { ...this.opts.env, ...sessionEnv, AB_TOKEN: undefined },
+            this.opts.targetRepo,
+            undefined,
+            this.wiring.plugins,
+          )
+          const result = await new HarvestRunner({
+            ...harvestDeps,
+            ...(remoteRunnerStore ? { store: remoteRunnerStore } : {}),
+            ...(preparedRun ? { preparedRun } : {}),
+            tickets: runnerTickets,
+            sessionEnv,
+          }).run()
+          if (renewalFailure) throw renewalFailure
+          return result
+        } finally {
+          if (renew) clearInterval(renew)
+          try {
+            if (remoteRunnerStore && preparedRun) {
+              await remoteRunnerStore.appendRepo(this.repoIdentity, {
+                actor: DISPATCHER,
+                type: 'harvest.execution.ended',
+                payload: { execution: harvestDeps.instance, run: preparedRun.run },
+              })
+              await remoteRunnerStore.close()
+            }
+          } finally {
+            await ticketGrantRequest(ticketUrl, ticketToken, {
+              action: 'revoke',
+              repo: this.repoIdentity,
+              id: issued.grant.id,
+            })
+          }
+        }
+      }
+      if (!/^https?:/i.test(storeRef)) return new HarvestRunner(harvestDeps).run()
+      const prepared = await new HarvestRunner(harvestDeps).run(true)
+      if (prepared.outcome !== 'prepared') return prepared
+      await this.repoView.appendRepo(this.repoIdentity, {
+        actor: DISPATCHER,
+        type: 'harvest.execution.authorized',
+        payload: {
+          execution: harvestDeps.instance,
+          run: prepared.run,
+          launch: prepared.launch,
+          leaseHolder: this.repoLeaseHolder ?? harvestDeps.instance,
+        },
+      })
+      const scoped = await (this.wiring.credentialIssuer ?? delegateCredential)(storeRef, token, {
+        kind: 'harvest-runner',
+        execution: harvestDeps.instance,
+        repo: this.repoIdentity,
+        id: prepared.run,
+        leaseHolder: this.repoLeaseHolder ?? harvestDeps.instance,
+      })
+      const runnerStore = new RemoteBuildStore({ url: storeRef, token: scoped })
+      try {
+        const runnerTickets =
+          harvestDeps.config.tickets.source === 'hosted'
+            ? await createTicketSource(
+                harvestDeps.config.tickets,
+                {
+                  ...this.opts.env,
+                  AB_STORE: storeRef,
+                  AB_TOKEN: scoped,
+                  AB_HARVEST: prepared.run,
+                },
+                this.opts.targetRepo,
+                resolveRepoStatePaths({
+                  repo: this.repoIdentity,
+                  checkout: this.opts.targetRepo,
+                  storeRef,
+                }).localStateRoot,
+                this.wiring.plugins,
+              )
+            : harvestDeps.tickets
+        return await new HarvestRunner({
+          ...harvestDeps,
+          store: runnerStore,
+          tickets: runnerTickets,
+          preparedRun: { run: prepared.run },
+          sessionEnv: { AB_STORE: storeRef, AB_TOKEN: scoped },
+        }).run()
+      } finally {
+        await runnerStore.appendRepo(this.repoIdentity, {
+          actor: DISPATCHER,
+          type: 'harvest.execution.ended',
+          payload: { execution: harvestDeps.instance, run: prepared.run },
+        })
+        await runnerStore.close()
+      }
+    })()
       .then((result) => {
         this.recordHarvestResult(result)
         if (
@@ -2299,6 +2455,24 @@ class DispatchLoop {
    * contract: provisioning takes minutes and must never stall a tick; the
    * single-flight guard covers the whole span. Every failure is contained
    * and retried on a later threshold tick. */
+  private async prepareHarvest(instance: string): Promise<HarvestRunnerResult> {
+    return new HarvestRunner({
+      store: this.wiring.store,
+      tickets: this.wiring.tickets,
+      config: this.currentConfig().config,
+      getConfig: () => this.currentConfig().config,
+      runtimes: this.wiring.runtimes,
+      repo: this.repoIdentity,
+      workspacePath: this.opts.targetRepo,
+      ids: this.wiring.ids,
+      uuids: this.wiring.uuids,
+      clock: this.wiring.clock,
+      instance,
+      ...(this.repoLeaseHolder ? { leaseHolder: this.repoLeaseHolder } : {}),
+      opts: { maxRecoveryAttempts: this.maxHarvestRecoveryAttempts },
+    }).run(true)
+  }
+
   private async launchHostedHarvest(
     harvestExecution: HarvestExecution,
     execution: string,
@@ -2307,6 +2481,8 @@ class DispatchLoop {
     const repo = this.repoIdentity
     let handle: BuildExecutionHandle | undefined
     let startedSeq: number | undefined
+    let ticketAuthority: { url: string; token: string; id: string } | undefined
+    let renewTickets: ReturnType<typeof setInterval> | undefined
     // Shared with `stopHostedHarvest` through the `hostedHarvest` entry: a
     // detach must stay observable to the completion chain even after the
     // entry is cleared, or the chain would classify and reap a live guest.
@@ -2349,13 +2525,76 @@ class DispatchLoop {
         if (pressure.trigger === undefined) return
       }
 
-      handle = await harvestExecution.start({
-        storeRef,
-        repo,
-        instance: execution,
-        baseBranch: this.currentConfig().config.baseBranch,
-        ...(this.repoLeaseHolder !== undefined ? { leaseHolder: this.repoLeaseHolder } : {}),
+      const prepared = await this.prepareHarvest(execution)
+      if (prepared.outcome !== 'prepared') return
+      await this.repoView.appendRepo(repo, {
+        actor: DISPATCHER,
+        type: 'harvest.execution.authorized',
+        payload: {
+          execution,
+          run: prepared.run,
+          launch: prepared.launch,
+          leaseHolder: this.repoLeaseHolder ?? execution,
+        },
       })
+      const launchAuth = /^https?:/i.test(storeRef)
+        ? {
+            token: await (this.wiring.credentialIssuer ?? delegateCredential)(
+              storeRef,
+              this.wiring.token,
+              {
+                kind: 'harvest-runner',
+                execution,
+                repo,
+                id: prepared.run,
+                leaseHolder: this.repoLeaseHolder ?? execution,
+              },
+            ),
+          }
+        : undefined
+      const ticketConfig = this.currentConfig().config.tickets
+      if (
+        ticketConfig.source === 'hosted' &&
+        ticketConfig.url &&
+        ticketConfig.url.replace(/\/+$/, '') !== storeRef.replace(/\/+$/, '')
+      ) {
+        const ticketToken = projectToken(ticketConfig.url, repo, {
+          ...this.opts.env,
+          AB_TOKEN: undefined,
+        })
+        if (!ticketToken || !launchAuth)
+          throw new Error('Independent harvest requires scoped build and ticket credentials')
+        const issued = await issueTicketGrant(
+          ticketConfig.url,
+          ticketToken,
+          repo,
+          execution,
+          'runner',
+        )
+        ticketAuthority = { url: ticketConfig.url, token: issued.token, id: issued.grant.id }
+        renewTickets = setInterval(() => {
+          void ticketGrantRequest(ticketConfig.url!, issued.token, {
+            action: 'renew',
+            repo,
+            id: issued.grant.id,
+          }).catch(() => {
+            // Expiry fails subsequent reads closed; the guest cannot regain project authority.
+          })
+        }, 60_000)
+      }
+      handle = await harvestExecution.start(
+        {
+          preparedRun: { run: prepared.run },
+          storeRef,
+          repo,
+          instance: execution,
+          baseBranch: this.currentConfig().config.baseBranch,
+          ...(this.repoLeaseHolder !== undefined ? { leaseHolder: this.repoLeaseHolder } : {}),
+        },
+        launchAuth && ticketAuthority
+          ? { ...launchAuth, tickets: { url: ticketAuthority.url, token: ticketAuthority.token } }
+          : launchAuth,
+      )
       const identity = handle.identity
       if (
         identity === undefined ||
@@ -2432,6 +2671,13 @@ class DispatchLoop {
         )
       }
     } finally {
+      if (renewTickets) clearInterval(renewTickets)
+      if (ticketAuthority && !detached.value)
+        await ticketGrantRequest(ticketAuthority.url, ticketAuthority.token, {
+          action: 'revoke',
+          repo,
+          id: ticketAuthority.id,
+        })
       this.hostedHarvest = undefined
     }
   }
@@ -2628,7 +2874,7 @@ class DispatchLoop {
     return null
   }
 
-  private async settlePendingPublication(slug: string): Promise<void> {
+  private async settlePendingPublication(slug: string, reservation?: string): Promise<void> {
     // The guest appended through its own handle; settle against fresh state.
     await this.repoView.refreshBuild(slug)
     await settleWorkspacePublication(
@@ -2645,6 +2891,16 @@ class DispatchLoop {
       },
       slug,
     )
+    await settleSummaryRequests({
+      store: this.repoView,
+      forge: this.wiring.forge,
+      slug,
+      workspacePath: this.opts.targetRepo,
+      storeRef: this.wiring.storeRef,
+      clock: this.wiring.clock,
+      holder: `summary:${this.runId}`,
+      ...(reservation === undefined ? {} : { reservation }),
+    })
   }
 
   private async recordInfrastructureFailure(input: {
@@ -2736,13 +2992,25 @@ class DispatchLoop {
       // A prior publication acknowledgement may have been lost after its push
       // reached the durable branch. Reconcile that fact before a replacement
       // runner can rerun the phase and create a non-fast-forward successor.
-      await this.settlePendingPublication(slug)
-      const handle = await owning.execution.start({
-        slug,
-        storeRef: this.wiring.storeRef,
-        instance,
-        workspaceRef,
-      })
+      await this.settlePendingPublication(slug, instance)
+      const launchAuth = /^https?:/i.test(this.wiring.storeRef)
+        ? {
+            token: await (this.wiring.credentialIssuer ?? delegateCredential)(
+              this.wiring.storeRef,
+              this.wiring.token,
+              { kind: 'build-runner', id: slug },
+            ),
+          }
+        : undefined
+      const handle = await owning.execution.start(
+        {
+          slug,
+          storeRef: this.wiring.storeRef,
+          instance,
+          workspaceRef,
+        },
+        launchAuth,
+      )
       active.handle = handle
       const identity = handle.identity ?? {
         provider: owning.name,
@@ -3694,16 +3962,21 @@ function acceptableOriginModeStore(storeRef: string): boolean {
  * names the operator's own machine (local development, integration harnesses).
  * Requirements are validated here so a misconfigured origin-mode launch fails
  * before any side effect. */
-async function resolveOriginModeState(opts: DispatchOpts): Promise<RepoStatePaths> {
+async function resolveOriginModeState(
+  opts: DispatchOpts,
+  configStore?: string,
+): Promise<RepoStatePaths> {
   const identity = normalizeGitRemoteUrl(opts.repository!)
-  const selectedStore = opts.storeRef ?? opts.env.AB_STORE
+  const selectedStore = opts.storeRef?.trim() || opts.env.AB_STORE?.trim() || configStore
   if (selectedStore === undefined || !acceptableOriginModeStore(selectedStore)) {
     throw new Error(
       'origin-mode dispatch requires an HTTPS BuildStore — set AB_STORE (or --store) to the hosted Store URL',
     )
   }
-  if (opts.env.AB_TOKEN === undefined || opts.env.AB_TOKEN === '') {
-    throw new Error('origin-mode dispatch requires AB_TOKEN for the remote Store')
+  if (!projectToken(selectedStore, identity, opts.env)) {
+    throw new Error(
+      'origin-mode dispatch requires a project credential; run ab connect or set AB_TOKEN',
+    )
   }
   // Checkout-less hosts (serverless functions, sandboxes) have no gh CLI and
   // no keyring, and the only workspace provider origin mode can run —
@@ -3721,6 +3994,7 @@ async function resolveOriginModeState(opts: DispatchOpts): Promise<RepoStatePath
   await mkdir(scratch, { recursive: true })
   return resolveRepoStatePaths({
     repo: identity,
+    configStore,
     checkout: scratch,
     ...(opts.storeRef !== undefined ? { storeRef: opts.storeRef } : {}),
     ...(opts.env.AB_STORE !== undefined ? { envStore: opts.env.AB_STORE } : {}),
@@ -3743,9 +4017,23 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   if (opts.wire !== undefined && opts.nonStoreWire !== undefined) {
     throw new Error('dispatch wire and nonStoreWire are mutually exclusive')
   }
+  const explicitOriginStore = opts.storeRef?.trim() || opts.env.AB_STORE?.trim()
+  if (
+    opts.repository !== undefined &&
+    explicitOriginStore &&
+    !acceptableOriginModeStore(explicitOriginStore)
+  ) {
+    throw new Error(
+      'origin-mode dispatch requires an HTTPS BuildStore — set AB_STORE (or --store) to the hosted Store URL',
+    )
+  }
+  const originConfig =
+    opts.repository !== undefined
+      ? await fetchOriginModeConfig(opts, opts.originConfigTransport)
+      : undefined
   const state =
     opts.repository !== undefined
-      ? await resolveOriginModeState(opts)
+      ? await resolveOriginModeState(opts, originConfig?.config.store?.url)
       : await resolveRepoState({
           targetRepo: opts.targetRepo,
           exec: opts.exec,
@@ -3759,6 +4047,13 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   const resolvedOpts: DispatchOpts = {
     ...opts,
     targetRepo: state.checkout,
+    env: {
+      ...opts.env,
+      AB_STORE: state.storeRef,
+      ...(isRemoteStoreRef(state.storeRef)
+        ? { AB_TOKEN: projectToken(state.storeRef, state.repo, opts.env) }
+        : {}),
+    },
     storeRef: state.storeRef,
     repo: opts.repo ?? state.repo,
   }
@@ -3816,7 +4111,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
   if (opts.repository !== undefined) {
     // Origin mode startup config: the base branch's autobuild.toml, fetched
     // through the forge (default branch first — baseBranch itself is config).
-    const fetched = await fetchOriginModeConfig(opts, opts.originConfigTransport)
+    const fetched = originConfig!
     configContent = fetched.content
     config = fetched.config
     if (config.forge !== 'github') {
@@ -3930,7 +4225,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
           },
           {
             kind: _effectiveConfigKind,
-            content: effectiveConfigContent(effectiveConfig),
+            content: effectiveBuildConfigContent(effectiveConfig),
             metadata: { run: runId, effectiveChanged },
           },
         ],
@@ -3995,7 +4290,7 @@ export async function abDispatch(opts: DispatchOpts): Promise<void> {
     [
       {
         kind: _effectiveConfigKind,
-        content: effectiveConfigContent(config),
+        content: effectiveBuildConfigContent(config),
         metadata: { run: runId, revision: 0 },
       },
     ],

package/packages/core/src/cli/harvest.ts

@@ -184,10 +184,20 @@ export async function buildHarvestContext(deps: HarvestCliDeps): Promise<Harvest
 }
 
 async function readJsonFile(path: string): Promise<unknown> {
-  const file = Bun.file(path)
-  if (!(await file.exists())) throw new Error(`file not found: ${path}`)
+  let text: string
   try {
-    return JSON.parse(await file.text())
+    text = await Bun.file(path).text()
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') {
+      throw new Error(`file not found: ${path}`, { cause: error })
+    }
+    throw new Error(
+      `cannot read ${path}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error },
+    )
+  }
+  try {
+    return JSON.parse(text)
   } catch (error) {
     throw new Error(
       `${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,