@defrex/autobuild 0.8.0 → 0.10.0

package/packages/core/src/cli/repository-status.ts

@@ -15,6 +15,17 @@ export interface RepositoryStatus extends DispatchSettings {
     state: 'live' | 'stopped'
     lastEvidenceAt: string
   }>
+  /** PR-only publications from operator sandboxes (AUT-343), newest first,
+   * latest per (operator, branch). */
+  publications: Array<{
+    operator: string
+    branch: string
+    sha: string
+    prNumber: number
+    prUrl: string
+    session?: string
+    at: string
+  }>
 }
 
 export interface RepositoryStatusOpts {
@@ -31,6 +42,27 @@ export interface RepositoryStatusOpts {
 }
 
 export function projectRepositoryStatus(repo: string, events: RepositoryEvent[]): RepositoryStatus {
+  const publications: RepositoryStatus['publications'] = []
+  for (const event of events) {
+    if (event.type !== 'orchestrator.sandbox.published') continue
+    const payload = event.payload
+    // Latest per (operator, branch): a later fact for the same pair
+    // supersedes the earlier one.
+    const index = publications.findIndex(
+      (entry) => entry.operator === payload.operator && entry.branch === payload.branch,
+    )
+    if (index !== -1) publications.splice(index, 1)
+    publications.push({
+      operator: payload.operator,
+      branch: payload.branch,
+      sha: payload.sha,
+      prNumber: payload.pr.number,
+      prUrl: payload.pr.url,
+      ...(payload.session !== undefined ? { session: payload.session } : {}),
+      at: event.ts,
+    })
+  }
+  publications.reverse()
   return {
     repo,
     ...reduceDispatchSettings(events),
@@ -43,6 +75,7 @@ export function projectRepositoryStatus(repo: string, events: RepositoryEvent[])
         state: state.state === 'stopped' ? ('stopped' as const) : ('live' as const),
         lastEvidenceAt: state.lastEvidenceTs,
       })),
+    publications,
   }
 }
 
@@ -57,6 +90,10 @@ export function renderRepositoryStatus(status: RepositoryStatus): string[] {
       (sandbox) =>
         `operator sandbox ${sandbox.environmentId} (${sandbox.provider}) — ${sandbox.state}, idle since ${sandbox.lastEvidenceAt}`,
     ),
+    ...status.publications.map(
+      (publication) =>
+        `publication by ${publication.operator} — ${publication.branch} at ${publication.sha.slice(0, 8)} → PR #${publication.prNumber} (${publication.prUrl})`,
+    ),
   ]
 }
 
@@ -69,7 +106,8 @@ export async function abRepositoryStatus(opts: RepositoryStatusOpts): Promise<vo
     // A fresh store has no repository row. Do not call ensureRepo: this query's
     // empty-stream defaults must remain a genuinely read-only operation.
     const record = await store.getRepo(repo)
-    const events = record === null ? [] : await store.getRepoEvents(repo)
+    // Bounded read (AUT-489): projectRepositoryStatus reduces durable types only.
+    const events = record === null ? [] : await store.getRepoStateEvents(repo)
     const status = projectRepositoryStatus(repo, events)
     if (opts.json === true) {
       opts.stdout(JSON.stringify(status, null, 2))

package/packages/core/src/cli/self-update.ts

@@ -1,3 +1,4 @@
+import { readFile, writeFile } from 'node:fs/promises'
 import semver from 'semver'
 import type { ExecResult } from '../ports/workspace/git-worktree'
 import { registryBaseUrl, registryVersionUrl } from '../registry'
@@ -230,6 +231,36 @@ export function updateDependency(install: ManagedInstallation, version: string):
     : `${install.packageName}@${version}`
 }
 
+/** The specifier written into package.json for a resolved version: what
+ * `bun add <pkg>@<version>` writes (the exact version) for the registry, the tag for a forge. */
+function manifestSpecifier(install: ManagedInstallation, version: string): string {
+  return install.channel === 'github'
+    ? `github:${install.owner}/${install.repository}#v${version}`
+    : version
+}
+
+/** Set the package's specifier in every section that declares it, preserving
+ * key order, indentation, and the trailing newline. Returns the new bytes. */
+export function rewriteDeclaredSpecifiers(
+  manifestText: string,
+  packageName: string,
+  specifier: string,
+): string {
+  const manifest = JSON.parse(manifestText) as Record<string, unknown>
+  for (const section of ['dependencies', 'devDependencies']) {
+    const entries = manifest[section]
+    if (
+      typeof entries === 'object' &&
+      entries !== null &&
+      typeof (entries as Record<string, unknown>)[packageName] === 'string'
+    ) {
+      ;(entries as Record<string, unknown>)[packageName] = specifier
+    }
+  }
+  const indent = /^([ \t]+)"/m.exec(manifestText)?.[1] ?? 2
+  return JSON.stringify(manifest, null, indent) + (manifestText.endsWith('\n') ? '\n' : '')
+}
+
 /** Silently determine whether this installation has a newer published release.
  * This read-only courtesy intentionally collapses every unsupported install,
  * command failure, malformed response, and cancellation to no result. */
@@ -244,7 +275,9 @@ export async function availableRelease(
     const identity = await readDistributionIdentity(distRoot)
     if (identity.sourceCheckout || signalAborted(options.signal)) return undefined
 
-    const globalBin = await command(['bun', 'pm', 'bin', '-g'], { signal: options.signal })
+    const globalBin = await command(['bun', 'pm', 'bin', '-g'], {
+      signal: options.signal,
+    })
     if (
       globalBin.exitCode !== 0 ||
       globalBin.stdout.trim() === '' ||
@@ -369,11 +402,53 @@ export async function selfUpdate(options: SelfUpdateOptions): Promise<SelfUpdate
     options.stdout(
       `Updating Autobuild to v${resolved} in ${install.ownerRoot}; Bun will rewrite ${install.ownerManifest} and ${install.ownerLock}.`,
     )
-    updateCommand = ['bun', 'add', '--cwd', install.ownerRoot, dependency]
+    if (install.dual) {
+      // Bun cannot reconcile two differing specifiers through `bun add`: it
+      // exits 0 yet keeps the old version. Bring both entries to the new
+      // specifier and let `bun install` apply it.
+      options.stdout(
+        `${install.packageName} is declared in both dependencies and devDependencies; updating both entries.`,
+      )
+      updateCommand = ['bun', 'install', '--cwd', install.ownerRoot]
+    } else {
+      updateCommand = [
+        'bun',
+        'add',
+        '--cwd',
+        install.ownerRoot,
+        ...(install.section === 'devDependencies' ? ['-d'] : []),
+        dependency,
+      ]
+    }
+  }
+
+  let originalManifest: string | undefined
+  if (install.scope === 'local' && install.dual) {
+    try {
+      originalManifest = await readFile(install.ownerManifest, 'utf8')
+      await writeFile(
+        install.ownerManifest,
+        rewriteDeclaredSpecifiers(
+          originalManifest,
+          install.packageName,
+          manifestSpecifier(install, resolved),
+        ),
+      )
+    } catch (error) {
+      const reason = `rewriting ${install.ownerManifest}: ${error instanceof Error ? error.message : String(error)}`
+      if (explicit) {
+        options.stderr(`self-update failed: ${reason}`)
+        return { kind: 'failed' }
+      }
+      return warn(options, reason)
+    }
   }
 
   const update = await invoke(updateCommand, {})
   if (update.exitCode !== 0) {
+    if (originalManifest !== undefined) {
+      await writeFile(install.ownerManifest, originalManifest).catch(() => undefined)
+    }
     const reason = commandFailure(`installing v${resolved}`, update)
     if (explicit) {
       options.stderr(`self-update failed: ${reason}`)

package/packages/core/src/cli/status.ts

@@ -39,10 +39,13 @@ import { loadConfig } from '../config/load'
 import type { Config } from '../config/schema'
 import {
   BUILD_EFFECTIVE_CONFIG_ARTIFACT,
+  parseBuildConfigMetadata,
   parseEffectiveBuildConfig,
 } from '../processes/build-execution-state'
+import type { PipelineSourceMeta } from '../config/pipeline-source'
 import { openExecution } from '../processes/execution-settlement'
 import { currentAutoMergeDeferral } from '../kernel/auto-merge'
+import { autoMergeDisplay, type AutoMergeDisplay } from './dashboard/model'
 import { decideNext } from '../kernel/engine'
 import {
   reduceBuild,
@@ -64,6 +67,7 @@ import type { BuildRecord, BuildStore, StreamRecord, StreamScope } from '../stor
 import { buildProgress, isDiverged, type BuildProgress } from './build-progress'
 import { normalizeGitRemoteUrl } from '../kernel/origin'
 import { buildInRepository, resolveMainRepo } from './repo-state'
+import { writeAssetTo } from './ticket-assets'
 import { withAmbientReadStore, type StoreOpener } from './store-opening'
 
 /** Backward-compatible name for callers/tests; repository resolution is shared. */
@@ -135,6 +139,10 @@ export interface BuildDetail extends BuildSummary {
   /** Current work-owner decision. Open PRs use the build-owned config; ended
    * PRs project the repository completion path directly from durable state. */
   decision?: BuildDecisionProjection
+  /** The build's effective auto-merge display state (off, requested, enabled,
+   * cancelling) — the same projection the dashboards render, so `--json` and
+   * the text agree and `waiting: on PR` can say why it is waiting. */
+  autoMerge: AutoMergeDisplay
   openEscalations: OpenEscalation[]
   /** Per-loop review overrides for the current spec; omitted when none are set. */
   reviewRoundCeilings?: { plan?: number; code?: number }
@@ -155,6 +163,11 @@ export interface BuildDetail extends BuildSummary {
   lastEvent?: { type: string; seq: number; ts: string; actor: Actor }
   /** Present only with `--events <n>`: the newest n, chronological. */
   events?: AbEvent[]
+  /** Which `autobuild.toml` the build's pinned pipeline was read from, and the
+   * effective-config artifact revision it was deposited under (SPEC §16.1).
+   * Absent when no effective-config artifact has been deposited. */
+  pipelineSource?: PipelineSourceMeta
+  effectiveConfigRev?: number
   outcome?: BuildOutcome
 }
 
@@ -192,7 +205,7 @@ function leaseInfo(record: BuildRecord, now: Date): LeaseInfo {
  * The summary over an ALREADY-reduced state — so `detail` reduces the log
  * once and builds both projections from it, rather than reducing twice.
  */
-function summarizeFrom(record: BuildRecord, state: BuildState, now: Date): BuildSummary {
+export function summarizeFrom(record: BuildRecord, state: BuildState, now: Date): BuildSummary {
   // `phase`, `round`, and `attempt` describe ONE phase occurrence, so they come
   // from ONE source: the in-flight phase, else the last completed one — the
   // same `currentPhase ?? lastCompletedPhase` the reducer uses to derive
@@ -287,6 +300,7 @@ export function detail(
     }))
   return {
     ...summary,
+    autoMerge: autoMergeDisplay(state),
     ...(decision !== undefined ? { decision } : {}),
     openEscalations: state.openEscalations,
     ...(state.reviewRoundCeilings.plan !== undefined || state.reviewRoundCeilings.code !== undefined
@@ -493,6 +507,16 @@ export function renderDetail(d: BuildDetail, now: Date): string[] {
     lines.push(`  review round ceiling: ${ceilings.join(', ')}`)
   }
   lines.push(`  updated:  ${d.updatedAt} (${relativeTime(d.updatedAt, now)})`)
+  if (d.pipelineSource !== undefined || d.effectiveConfigRev !== undefined) {
+    const source =
+      d.pipelineSource !== undefined
+        ? `autobuild.toml@${
+            d.pipelineSource.commit !== undefined ? d.pipelineSource.commit.slice(0, 7) : 'unknown'
+          } (${d.pipelineSource.ref})`
+        : 'autobuild.toml@unknown (pre-pin)'
+    const rev = d.effectiveConfigRev !== undefined ? `  config rev ${d.effectiveConfigRev}` : ''
+    lines.push(`  pipeline: ${source}${rev}`)
+  }
 
   // Its own line, never folded into status: a running build with an expired
   // lease is the case this exists to make visible.
@@ -548,9 +572,11 @@ export function renderDetail(d: BuildDetail, now: Date): string[] {
     )
   }
   if (d.decision?.kind === 'awaiting-pr') {
-    lines.push(
-      `  waiting:  on PR${d.decision.reason !== undefined ? ` — ${d.decision.reason}` : ''}`,
-    )
+    // The deferral reason (a durable observation about WHY consent could not
+    // be applied) takes precedence; otherwise the auto-merge state itself is
+    // what the parked operator needs — off names the missing consent.
+    const consent = d.decision.reason ?? `auto merge ${d.autoMerge}`
+    lines.push(`  waiting:  on PR — ${consent}`)
   } else if (d.decision?.kind === 'repository-completion') {
     lines.push(
       `  waiting:  repository-level completion after the PR was ${d.decision.prState}; no runner re-attachment is pending`,
@@ -703,9 +729,43 @@ export async function abBuilds(opts: AbBuildsOpts): Promise<void> {
     const wanted = new Set(statusFilter(opts.all, opts.queued))
     // Cross-repo aggregation is out of scope (§12: one dispatcher per repo,
     // one repo's builds per answer).
+    // Records are read and held before the digest read: builds are never
+    // deleted, so every identity-keyed record iterated below is guaranteed an
+    // entry in the digest map fetched after it — a build created between the
+    // two reads appears only in the digest map, which is harmless — and the
+    // completeness check can only ever catch a genuine adapter bug, never a
+    // concurrent dispatch (AUT-488 finding f_3cb67aba).
     const records = (await store.listBuilds()).filter(mine)
+    // One digest read gates the per-build history reads (AUT-488): the active
+    // and queued scopes never show a terminal build, so an identity-keyed
+    // build whose digest already carries a terminal fact skips its `getEvents`
+    // round trip and the listing's store cost stays flat as finished builds
+    // accumulate. The `--all` scope includes terminal statuses, so it takes no
+    // digest read and skips nothing — byte-for-byte the old loop.
+    const digests = opts.all === true ? undefined : await store.getRepoBuildDigests(identity)
     const summaries: BuildSummary[] = []
     for (const record of records) {
+      if (digests !== undefined && record.repo === identity) {
+        // Completeness is contractual (one entry per repo build); a missing
+        // entry is an adapter bug and must fail loudly rather than silently
+        // drop the build from the listing.
+        const digest = digests.get(record.slug)
+        if (digest === undefined) {
+          throw new Error(`getRepoBuildDigests is missing an entry for build "${record.slug}"`)
+        }
+        // The digest's `terminal` follows `reduceBuild`'s terminal rule
+        // exactly (in-order overwrite of `build.completed`/`build.aborted`,
+        // never cleared — pinned against `reduceBuild` in
+        // store/digest.test.ts), so `terminal !== undefined` is exactly
+        // reduced status `done`/`aborted`, which the active and queued status
+        // sets never include. Skipping the history read therefore cannot
+        // change the emitted summaries.
+        if (digest.terminal !== undefined) continue
+      }
+      // A record matched only through the legacy `repoOrigin` path has no
+      // entry under `identity` — `getRepoBuildDigests` groups by `record.repo`
+      // exactly — so it keeps its per-build history read (correct, just not
+      // accelerated).
       const summary = summarize(record, await store.getEvents(record.slug), now)
       if (wanted.has(summary.status)) summaries.push(summary)
     }
@@ -830,6 +890,40 @@ async function projectBuildDecision(
   }
 }
 
+type AmbientReadContext = Parameters<Parameters<typeof withAmbientReadStore>[1]>[0]
+
+/** The build record, after the repository gate every single-build read shares
+ * (see `abBuildStatus`). */
+async function requireReadableBuild(
+  opts: AbBuildStatusOpts,
+  context: AmbientReadContext,
+): Promise<BuildRecord> {
+  const record = await context.store.getBuild(opts.slug)
+  if (record === null) {
+    throw new Error(
+      `no build "${opts.slug}" in this store — run 'ab builds --all' to list ` +
+        "this repo's builds, or pass --store <ref> if it lives in another store",
+    )
+  }
+  // Own-session authority: slug equality bounds the read to the session's
+  // own build, and an explicit --store must name the session's own store for
+  // the bypass to apply. Every other combination falls through to the
+  // ordinary repository gate, unchanged — which now keys on the checkout's
+  // normalized origin identity (`context.checkout` is the physical path;
+  // `buildInRepository` derives the identity from it).
+  const ownSession =
+    context.ambient !== undefined &&
+    'build' in context.ambient &&
+    context.ambient.build === opts.slug &&
+    (opts.storeRef === undefined || opts.storeRef === context.ambient.store)
+  if (!(ownSession || (await buildInRepository(record, context.checkout, opts.exec)))) {
+    throw new Error(
+      `build "${opts.slug}" belongs to repository "${record.repo}", not "${context.repo}"`,
+    )
+  }
+  return record
+}
+
 /** `ab build status <slug>` — one build in detail. Read-only.
  *
  * Repository authority mirrors the other ambient reads: an operator invocation
@@ -849,29 +943,7 @@ async function projectBuildDecision(
 export async function abBuildStatus(opts: AbBuildStatusOpts): Promise<void> {
   const now = (opts.now ?? (() => new Date()))()
   await withAmbientReadStore(opts, async (context) => {
-    const record = await context.store.getBuild(opts.slug)
-    if (record === null) {
-      throw new Error(
-        `no build "${opts.slug}" in this store — run 'ab builds --all' to list ` +
-          "this repo's builds, or pass --store <ref> if it lives in another store",
-      )
-    }
-    // Own-session authority: slug equality bounds the read to the session's
-    // own build, and an explicit --store must name the session's own store for
-    // the bypass to apply. Every other combination falls through to the
-    // ordinary repository gate, unchanged — which now keys on the checkout's
-    // normalized origin identity (`context.checkout` is the physical path;
-    // `buildInRepository` derives the identity from it).
-    const ownSession =
-      context.ambient !== undefined &&
-      'build' in context.ambient &&
-      context.ambient.build === opts.slug &&
-      (opts.storeRef === undefined || opts.storeRef === context.ambient.store)
-    if (!(ownSession || (await buildInRepository(record, context.checkout, opts.exec)))) {
-      throw new Error(
-        `build "${opts.slug}" belongs to repository "${record.repo}", not "${context.repo}"`,
-      )
-    }
+    const record = await requireReadableBuild(opts, context)
     const events = await context.store.getEvents(opts.slug)
     const decision = await projectBuildDecision(opts.slug, events, context.store)
     // Stream enrichment is presentation (SPEC §9): an unavailable read
@@ -885,7 +957,22 @@ export async function abBuildStatus(opts: AbBuildStatusOpts): Promise<void> {
     } catch {
       streams = undefined
     }
-    const d = detail(record, events, now, opts.events, decision, streams)
+    const projected = detail(record, events, now, opts.events, decision, streams)
+    // Operator visibility (SPEC §16.1): which autobuild.toml the build's
+    // pinned pipeline came from, alongside the effective-config revision.
+    const configArtifact = await context.store.getArtifact(
+      opts.slug,
+      BUILD_EFFECTIVE_CONFIG_ARTIFACT,
+    )
+    const configMeta =
+      configArtifact !== null ? parseBuildConfigMetadata(configArtifact) : undefined
+    const d: BuildDetail = {
+      ...projected,
+      ...(configMeta?.revision !== undefined ? { effectiveConfigRev: configMeta.revision } : {}),
+      ...(configMeta?.pipelineSource !== undefined
+        ? { pipelineSource: configMeta.pipelineSource }
+        : {}),
+    }
     if (opts.json === true) {
       opts.stdout(JSON.stringify(d, null, 2))
       return
@@ -893,3 +980,38 @@ export async function abBuildStatus(opts: AbBuildStatusOpts): Promise<void> {
     for (const line of renderDetail(d, now)) opts.stdout(line)
   })
 }
+
+export interface AbBuildAssetGetOpts extends AbBuildStatusOpts {
+  kind: string
+  name: string
+  dest: string
+  rev?: number
+}
+
+/** `ab build asset get <slug> <kind> <name> <dest>` — the exact bytes a build
+ * froze at its claim (SPEC §6.3), available after the build has finished. */
+export async function abBuildAssetGet(opts: AbBuildAssetGetOpts): Promise<void> {
+  await withAmbientReadStore(opts, async (context) => {
+    await requireReadableBuild(opts, context)
+    const asset = await context.store.getPinnedTicketAsset(
+      opts.slug,
+      opts.kind,
+      opts.name,
+      opts.rev,
+    )
+    if (asset === null) {
+      const revision = opts.rev === undefined ? '' : ` revision ${opts.rev}`
+      throw new Error(
+        `build "${opts.slug}" pinned no ticket asset ${opts.kind}/${opts.name}${revision}`,
+      )
+    }
+    const written = await writeAssetTo(asset, opts.dest)
+    if (opts.json === true) {
+      opts.stdout(JSON.stringify({ ...asset.meta, path: written }, null, 2))
+      return
+    }
+    opts.stdout(
+      `build asset downloaded: ${opts.slug} ${opts.kind}/${opts.name} revision ${asset.meta.revision} → ${written}`,
+    )
+  })
+}

package/packages/core/src/cli/terminals.ts

@@ -20,6 +20,7 @@ import { z } from 'zod'
 import { loadConfig } from '../config/load'
 import type { AbEvent, EventEnvelope } from '../events/catalog'
 import { agentActor, KERNEL } from '../events/envelope'
+import { isRemoteWorkspace } from '../events/workspace-remote'
 import type { IdSource } from '../ids'
 import {
   autoMergeApplicationType,
@@ -258,7 +259,7 @@ function requireImplementationProvisioning(events: AbEvent[]): void {
 function remotePublication(events: readonly AbEvent[]): boolean {
   let remote = false
   for (const event of events) {
-    if (event.type === 'workspace.provisioned') remote = event.payload.provider === 'vercel-sandbox'
+    if (event.type === 'workspace.provisioned') remote = isRemoteWorkspace(event.payload)
     else if (event.type === 'workspace.released') remote = false
   }
   return remote