@defrex/autobuild 0.8.0 → 0.9.0

package/packages/core/src/operator/sessions.ts

@@ -1,223 +0,0 @@
-/**
- * Operator-session operations behind the operator API (SPEC §7.1.1): the
- * signed-in operator's orchestrator conversations. Every write is attributed
- * to the signed-in operator — the token's user, never a client-supplied
- * identity — and `via` is never set on session events: session events are the
- * delegate's own log, and here the operator IS the actor.
- *
- * Ownership lives here, in the server seam, because the store has no
- * principal concept: a session belongs to its creating operator; other
- * operators of the same repository can read it and cannot write to it. The
- * store stays neutral; the API is the gatekeeper — writes of any kind to an
- * archived session are refusals here, not store errors.
- */
-import { humanActor } from '../events/envelope'
-import type { SessionEventWrite } from '../events/sessions'
-import { reduceSession, type SessionState, type SessionTurn } from '../sessions/reducer'
-import type { StreamRead } from '../store/streams/types'
-import type { BuildStore, SessionRecord } from '../store/types'
-import type { OperatorSandboxService } from './sandbox'
-
-export class OperatorSessionError extends Error {
-  constructor(
-    readonly code: 'not-found' | 'refusal' | 'forbidden',
-    message: string,
-  ) {
-    super(message)
-    this.name = 'OperatorSessionError'
-  }
-}
-
-async function requireSession(
-  store: BuildStore,
-  repo: string,
-  sid: string,
-): Promise<SessionRecord> {
-  const record = await store.getSession(sid)
-  if (record === null || record.repo !== repo) {
-    throw new OperatorSessionError('not-found', `unknown session "${sid}"`)
-  }
-  return record
-}
-
-function requireOwner(record: SessionRecord, user: string, operation: string): void {
-  if (record.operator !== user) {
-    throw new OperatorSessionError(
-      'forbidden',
-      `session "${record.id}" belongs to operator ${JSON.stringify(record.operator)}; ${JSON.stringify(user)} may not ${operation}`,
-    )
-  }
-}
-
-/** Every append funnels through here: one attribution point, one archived
- * gate. The store has no principal concept, so this is where a token's user
- * meets a session's operator. */
-async function appendAs(
-  store: BuildStore,
-  record: SessionRecord,
-  user: string,
-  event: SessionEventWrite,
-): Promise<void> {
-  requireOwner(record, user, `write ${event.type}`)
-  const state = reduceSession(await store.getSessionEvents(record.id))
-  if (state.status === 'archived') {
-    throw new OperatorSessionError('refusal', `session "${record.id}" is archived and read-only`)
-  }
-  await store.appendSessionEvent(record.id, event)
-}
-
-export async function listOperatorSessions(
-  store: BuildStore,
-  repo: string,
-): Promise<SessionRecord[]> {
-  const sessions = await store.listSessions(repo)
-  return sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))
-}
-
-export async function createOperatorSession(
-  store: BuildStore,
-  repo: string,
-  user: string,
-  title?: string,
-): Promise<SessionRecord> {
-  return store.createSession({
-    repo,
-    operator: user,
-    ...(title !== undefined ? { title } : {}),
-  })
-}
-
-export interface OperatorSessionView {
-  session: SessionRecord
-  state: SessionState
-  turns: SessionTurn[]
-}
-
-export async function getOperatorSession(
-  store: BuildStore,
-  repo: string,
-  sid: string,
-): Promise<OperatorSessionView> {
-  const record = await requireSession(store, repo, sid)
-  const state = reduceSession(await store.getSessionEvents(record.id))
-  return { session: record, state, turns: state.turns }
-}
-
-export async function postOperatorMessage(
-  store: BuildStore,
-  repo: string,
-  sid: string,
-  user: string,
-  text: string,
-): Promise<void> {
-  const record = await requireSession(store, repo, sid)
-  await appendAs(store, record, user, {
-    actor: humanActor(user),
-    type: 'message.posted',
-    payload: { text },
-  })
-}
-
-export async function setOperatorWake(
-  store: BuildStore,
-  repo: string,
-  sid: string,
-  user: string,
-  globs: string[],
-): Promise<void> {
-  const record = await requireSession(store, repo, sid)
-  await appendAs(store, record, user, {
-    actor: humanActor(user),
-    type: 'session.wake-set',
-    payload: { globs },
-  })
-}
-
-export async function answerOperatorApproval(
-  store: BuildStore,
-  repo: string,
-  sid: string,
-  user: string,
-  turn: string,
-  toolCallId: string,
-  decision: 'approve' | 'deny',
-): Promise<void> {
-  const record = await requireSession(store, repo, sid)
-  requireOwner(record, user, 'answer an approval')
-  const state = reduceSession(await store.getSessionEvents(record.id))
-  const pending = state.pendingApproval
-  if (
-    state.status === 'archived' ||
-    pending === undefined ||
-    pending.turn !== turn ||
-    pending.toolCallId !== toolCallId
-  ) {
-    throw new OperatorSessionError(
-      'refusal',
-      `session "${record.id}" has no pending approval for turn ${JSON.stringify(turn)} tool call ${JSON.stringify(toolCallId)}`,
-    )
-  }
-  await appendAs(store, record, user, {
-    actor: humanActor(user),
-    type: 'approval.answered',
-    payload: { turn, toolCallId, decision },
-  })
-}
-
-export async function archiveOperatorSession(
-  store: BuildStore,
-  repo: string,
-  sid: string,
-  user: string,
-  sandbox?: OperatorSandboxService,
-): Promise<void> {
-  const record = await requireSession(store, repo, sid)
-  requireOwner(record, user, 'archive')
-  const state = reduceSession(await store.getSessionEvents(record.id))
-  if (state.status === 'archived') {
-    throw new OperatorSessionError('refusal', `session "${record.id}" is already archived`)
-  }
-  await store.appendSessionEvent(record.id, {
-    actor: humanActor(user),
-    type: 'session.archived',
-    payload: {},
-  })
-  // When the archive leaves the operator with no open session for this
-  // repository, their sandbox environment is released (snapshot purge,
-  // journal fact). The service derives the environment via its pure
-  // describe — never provisioning — and a never-provisioned operator is a
-  // no-op. Contained: a release failure must not fail an accepted archive.
-  if (sandbox !== undefined) {
-    const sessions = await store.listSessions(repo)
-    const open: SessionRecord[] = []
-    for (const session of sessions) {
-      if (session.operator !== user) continue
-      const sessionState = reduceSession(await store.getSessionEvents(session.id))
-      if (sessionState.status !== 'archived') open.push(session)
-    }
-    if (open.length === 0) {
-      try {
-        await sandbox.release(user, { repo })
-      } catch {
-        // The archive already succeeded; the environment stays journaled and
-        // the dispatcher's idle settlement stops it later.
-      }
-    }
-  }
-}
-
-export async function readOperatorTurnStream(
-  store: BuildStore,
-  repo: string,
-  sid: string,
-  turn: string,
-  opts?: { since?: number; waitSeconds?: number },
-): Promise<StreamRead> {
-  const record = await requireSession(store, repo, sid)
-  const state = reduceSession(await store.getSessionEvents(record.id))
-  const target = state.turns.find((candidate) => candidate.turn === turn)
-  if (target === undefined) {
-    throw new OperatorSessionError('not-found', `unknown turn "${turn}" in session "${record.id}"`)
-  }
-  return store.readStream(target.stream, opts)
-}

package/packages/core/src/ports/runner/live-contract-fixture.ts

@@ -1,176 +0,0 @@
-import { expect } from 'bun:test'
-import { chmod, copyFile, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import type { AgentRunner, AgentTurnResult, Transcript } from '../types'
-import type { OneShotCompletion } from './one-shot'
-import { AGENT_BIN_DIR } from './session-env'
-
-interface LiveFixture {
-  cwd: string
-  evidencePath: string
-  cleanup: () => Promise<void>
-}
-
-interface ProbeEvidence {
-  phase: string
-  retained: string
-  collide: string
-  abPath: string
-  helpStatus: string
-}
-
-async function createLiveFixture(): Promise<LiveFixture> {
-  const cwd = await mkdtemp(join(tmpdir(), 'ab-runner-live-contract-'))
-  const skillDir = join(cwd, '.agents', 'skills', 'ab-runner-contract')
-  const claudeSkills = join(cwd, '.claude', 'skills')
-  await mkdir(skillDir, { recursive: true })
-  await mkdir(claudeSkills, { recursive: true })
-  const skillPath = join(skillDir, 'SKILL.md')
-  await writeFile(
-    skillPath,
-    `---\nname: ab-runner-contract\ndescription: Live AgentRunner contract probe.\ndisable-model-invocation: true\n---\n\n# Runner contract probe\n\nImmediately use the bash tool to execute \`./contract-probe\` exactly once.\nWait for it to finish, then reply with the single word \`probed\`.\n`,
-  )
-  const claudeSkill = join(claudeSkills, 'ab-runner-contract')
-  try {
-    await symlink(skillDir, claudeSkill, 'dir')
-  } catch {
-    await mkdir(claudeSkill, { recursive: true })
-    await copyFile(skillPath, join(claudeSkill, 'SKILL.md'))
-  }
-
-  const evidencePath = join(cwd, 'contract-evidence.tsv')
-  const probePath = join(cwd, 'contract-probe')
-  await writeFile(
-    probePath,
-    `#!/bin/sh\nset -eu\nab_path="$(command -v ab)"\nif ab --help >/dev/null 2>&1; then help=0; else help=$?; fi\nprintf '%s\\t%s\\t%s\\t%s\\t%s\\n' "\${AB_CONTRACT_PHASE:-}" "\${AB_CONTRACT_RETAINED:-}" "\${AB_CONTRACT_COLLIDE:-}" "$ab_path" "$help" >> ${JSON.stringify(evidencePath)}\n`,
-  )
-  await chmod(probePath, 0o755)
-  return {
-    cwd,
-    evidencePath,
-    cleanup: () => rm(cwd, { recursive: true, force: true }),
-  }
-}
-
-async function evidence(path: string): Promise<ProbeEvidence[]> {
-  const content = await readFile(path, 'utf8')
-  return content
-    .trim()
-    .split('\n')
-    .filter((line) => line !== '')
-    .map((line) => {
-      const [phase = '', retained = '', collide = '', abPath = '', helpStatus = ''] =
-        line.split('\t')
-      return { phase, retained, collide, abPath, helpStatus }
-    })
-}
-
-function expectCompleted(result: AgentTurnResult): void {
-  expect(result.kind).toBe('completed')
-  expect(Number.isInteger(result.usage.inputTokens)).toBe(true)
-  expect(Number.isInteger(result.usage.outputTokens)).toBe(true)
-  expect(result.usage.turns).toBeGreaterThan(0)
-}
-
-function expectTranscript(transcript: Transcript, runner: AgentRunner, model: string): void {
-  expect(transcript.content.trim()).not.toBe('')
-  expect(transcript.metadata.runner).toBe(runner.name)
-  expect(transcript.metadata.model).toBe(model)
-  expect(transcript.metadata.usage.turns).toBeGreaterThanOrEqual(2)
-}
-
-/** Successful real-provider smoke coverage. Deterministic failure taxonomy is
- * deliberately covered by the full injected adapter contract instead. */
-export async function runLiveAgentRunnerContract(
-  runner: AgentRunner & OneShotCompletion,
-  model: string,
-): Promise<void> {
-  const fixture = await createLiveFixture()
-  let failure: unknown
-  try {
-    const started = await runner.start({
-      skill: 'ab-runner-contract',
-      invocation: 'live-contract',
-      workspacePath: fixture.cwd,
-      model,
-      env: {
-        AB_CONTRACT_PHASE: 'start',
-        AB_CONTRACT_RETAINED: 'retained',
-        AB_CONTRACT_COLLIDE: 'start-value',
-      },
-    })
-    let transcript: Transcript | undefined
-    try {
-      expect(started.session.id.trim()).not.toBe('')
-      expect(started.session.runner).toBe(runner.name)
-      expect(started.session.model).toBe(model)
-      expectCompleted(started.result)
-      expect(await evidence(fixture.evidencePath)).toEqual([
-        {
-          phase: 'start',
-          retained: 'retained',
-          collide: 'start-value',
-          abPath: join(AGENT_BIN_DIR, 'ab'),
-          helpStatus: '0',
-        },
-      ])
-
-      const continued = await runner.continue(
-        started.session,
-        'Use the bash tool to execute `./contract-probe` exactly once, wait for it, then reply with exactly the same single word as your previous response.',
-        {
-          env: {
-            AB_CONTRACT_PHASE: 'continue',
-            AB_CONTRACT_COLLIDE: 'continue-value',
-          },
-        },
-      )
-      expectCompleted(continued)
-      expect(continued.text.trim()).toBe('probed')
-      expect(await evidence(fixture.evidencePath)).toEqual([
-        {
-          phase: 'start',
-          retained: 'retained',
-          collide: 'start-value',
-          abPath: join(AGENT_BIN_DIR, 'ab'),
-          helpStatus: '0',
-        },
-        {
-          phase: 'continue',
-          retained: 'retained',
-          collide: 'continue-value',
-          abPath: join(AGENT_BIN_DIR, 'ab'),
-          helpStatus: '0',
-        },
-      ])
-    } catch (error) {
-      failure = error
-    }
-
-    try {
-      transcript = await runner.end(started.session)
-    } catch (endError) {
-      if (failure !== undefined) {
-        throw new AggregateError(
-          [failure, endError],
-          'live AgentRunner assertion and session end both failed',
-        )
-      }
-      throw endError
-    }
-    if (failure !== undefined) throw failure
-    expectTranscript(transcript, runner, model)
-
-    const nonce = crypto.randomUUID()
-    const oneShot = await runner.complete({
-      prompt: `Reply with exactly this token and no other text: ${nonce}`,
-      cwd: fixture.cwd,
-      env: { AB_CONTRACT_ONE_SHOT: nonce },
-      model,
-    })
-    expect(oneShot.text.trim()).toContain(nonce)
-  } finally {
-    await fixture.cleanup()
-  }
-}

package/packages/core/src/ports/tickets/remote-server.ts

@@ -1,185 +0,0 @@
-import type { TicketSource } from '../types'
-import { systemClock, type Clock } from '../../store/types'
-import type { ErrorBody, ErrorKind } from '../../store/remote/protocol'
-import { tokenResource, verifyToken } from '../../store/remote/token'
-import {
-  AUTOBUILD_VERSION,
-  AUTOBUILD_VERSION_HEADER,
-  REMOTE_STORE_PROTOCOL_VERSION,
-  REMOTE_STORE_PROTOCOL_VERSION_HEADER,
-} from '../../store/remote/version'
-import {
-  hostedTicketRequestSchemas,
-  type HostedTicketContext,
-  type HostedTicketOperation,
-} from './remote-protocol'
-
-export interface TicketServerOptions {
-  secret: string
-  sourceFor(context: HostedTicketContext): TicketSource | Promise<TicketSource>
-  clock?: Clock
-  /** Observes unexpected source failures without changing their wire response. */
-  onInternalError?: (error: unknown, request: Request) => unknown | Promise<unknown>
-}
-
-class TicketRequestError extends Error {
-  constructor(
-    readonly status: number,
-    readonly kind: ErrorKind,
-    message: string,
-  ) {
-    super(message)
-  }
-}
-
-function json(status: number, body: unknown): Response {
-  return Response.json(body, { status })
-}
-
-function failure(status: number, kind: ErrorKind, error: string): Response {
-  return json(status, { error, kind } satisfies ErrorBody)
-}
-
-/** HTTP face of the TicketSource port. Authentication deliberately runs before
- * JSON parsing and source construction, so denied callers cannot probe either. */
-export function createTicketServer(options: TicketServerOptions): {
-  fetch(req: Request): Promise<Response>
-} {
-  const clock = options.clock ?? systemClock
-
-  function identify(req: Request): void {
-    const autobuild = req.headers.get(AUTOBUILD_VERSION_HEADER)
-    const protocol = req.headers.get(REMOTE_STORE_PROTOCOL_VERSION_HEADER)
-    if (autobuild !== AUTOBUILD_VERSION || protocol !== REMOTE_STORE_PROTOCOL_VERSION) {
-      throw new TicketRequestError(
-        409,
-        'conflict',
-        `remote store version mismatch: client Autobuild ${autobuild ?? '(missing)'} protocol ${protocol ?? '(missing)'}; server Autobuild ${AUTOBUILD_VERSION} protocol ${REMOTE_STORE_PROTOCOL_VERSION}`,
-      )
-    }
-  }
-
-  function authorize(req: Request): void {
-    const match = /^Bearer\s+(.+)$/i.exec(req.headers.get('authorization') ?? '')
-    if (!match) throw new TicketRequestError(401, 'auth', 'missing bearer token')
-    const scope = verifyToken(options.secret, match[1]!, clock())
-    if (scope === null) throw new TicketRequestError(401, 'auth', 'invalid or expired token')
-    const resource = tokenResource(scope)
-    if (resource.kind !== 'deployment') {
-      throw new TicketRequestError(
-        403,
-        'auth',
-        `token scoped to ${resource.kind} "${resource.id}" may not access ticket operations`,
-      )
-    }
-  }
-
-  async function body(req: Request): Promise<unknown> {
-    try {
-      return await req.json()
-    } catch {
-      throw new TicketRequestError(400, 'validation', 'request body is not valid JSON')
-    }
-  }
-
-  async function route(req: Request, operation: HostedTicketOperation): Promise<Response> {
-    const raw = await body(req)
-    const parsed = hostedTicketRequestSchemas[operation].safeParse(raw)
-    if (!parsed.success) {
-      throw new TicketRequestError(
-        400,
-        'validation',
-        `invalid request body: ${parsed.error.message}`,
-      )
-    }
-    const context = parsed.data.context
-    const source = await options.sourceFor(context)
-
-    // Parse again through the operation-specific schema to preserve precise
-    // inference in each branch while keeping the shared pre-source validation.
-    switch (operation) {
-      case 'list-ready': {
-        const request = hostedTicketRequestSchemas['list-ready'].parse(raw)
-        return json(200, await source.listReady(request.input))
-      }
-      case 'get': {
-        const request = hostedTicketRequestSchemas.get.parse(raw)
-        return json(200, await source.get(request.input.id))
-      }
-      case 'claim': {
-        const request = hostedTicketRequestSchemas.claim.parse(raw)
-        return json(200, { claimed: await source.claim(request.input.id) })
-      }
-      case 'comment': {
-        const request = hostedTicketRequestSchemas.comment.parse(raw)
-        await source.comment(request.input.id, request.input.body)
-        return json(200, { ok: true })
-      }
-      case 'transition': {
-        const request = hostedTicketRequestSchemas.transition.parse(raw)
-        await source.transition(request.input.id, request.input.state)
-        return json(200, { ok: true })
-      }
-      case 'create': {
-        const request = hostedTicketRequestSchemas.create.parse(raw)
-        return json(201, await source.create(request.input.draft, request.input.options))
-      }
-      case 'update': {
-        const request = hostedTicketRequestSchemas.update.parse(raw)
-        await source.update(request.input.id, request.input.patch)
-        return json(200, { ok: true })
-      }
-      case 'add-blocker': {
-        const request = hostedTicketRequestSchemas['add-blocker'].parse(raw)
-        await source.addBlocker(request.input.id, request.input.blockerId)
-        return json(200, { ok: true })
-      }
-      case 'remove-blocker': {
-        const request = hostedTicketRequestSchemas['remove-blocker'].parse(raw)
-        await source.removeBlocker(request.input.id, request.input.blockerId)
-        return json(200, { ok: true })
-      }
-      case 'dependency-states': {
-        const request = hostedTicketRequestSchemas['dependency-states'].parse(raw)
-        return json(200, await source.dependencyStates(request.input.ids))
-      }
-    }
-  }
-
-  return {
-    async fetch(req: Request): Promise<Response> {
-      try {
-        const url = new URL(req.url)
-        if (req.method !== 'POST' || !url.pathname.startsWith('/tickets/')) {
-          return failure(404, 'not-found', `no route: ${req.method} ${url.pathname}`)
-        }
-        identify(req)
-        authorize(req)
-        const operation = url.pathname.slice('/tickets/'.length) as HostedTicketOperation
-        if (!Object.hasOwn(hostedTicketRequestSchemas, operation)) {
-          return failure(404, 'not-found', `no route: ${req.method} ${url.pathname}`)
-        }
-        return await route(req, operation)
-      } catch (error) {
-        if (error instanceof TicketRequestError) {
-          return failure(error.status, error.kind, error.message)
-        }
-        // Only the message crosses the trust boundary; causes and stacks never do.
-        const message = error instanceof Error ? error.message : 'ticket backend failed'
-        const notFound = /unknown (?:ticket|issue)|not found/i.test(message)
-        // These are intentional domain feedback from TicketSource implementations.
-        // Their historical standalone mapping remains unchanged.
-        const expectedDomainFailure =
-          message.startsWith('invalid ticket update') || message.includes('cannot block itself')
-        if (!notFound && !expectedDomainFailure && options.onInternalError !== undefined) {
-          try {
-            await options.onInternalError(error, req)
-          } catch {
-            // Diagnostics must never replace the protocol response.
-          }
-        }
-        return failure(notFound ? 404 : 500, notFound ? 'not-found' : 'internal', message)
-      }
-    },
-  }
-}