@defrex/autobuild 0.8.0 → 0.9.0

package/packages/core/src/cli/status.ts

@@ -39,10 +39,13 @@ import { loadConfig } from '../config/load'
 import type { Config } from '../config/schema'
 import {
   BUILD_EFFECTIVE_CONFIG_ARTIFACT,
+  parseBuildConfigMetadata,
   parseEffectiveBuildConfig,
 } from '../processes/build-execution-state'
+import type { PipelineSourceMeta } from '../config/pipeline-source'
 import { openExecution } from '../processes/execution-settlement'
 import { currentAutoMergeDeferral } from '../kernel/auto-merge'
+import { autoMergeDisplay, type AutoMergeDisplay } from './dashboard/model'
 import { decideNext } from '../kernel/engine'
 import {
   reduceBuild,
@@ -64,6 +67,7 @@ import type { BuildRecord, BuildStore, StreamRecord, StreamScope } from '../stor
 import { buildProgress, isDiverged, type BuildProgress } from './build-progress'
 import { normalizeGitRemoteUrl } from '../kernel/origin'
 import { buildInRepository, resolveMainRepo } from './repo-state'
+import { writeAssetTo } from './ticket-assets'
 import { withAmbientReadStore, type StoreOpener } from './store-opening'
 
 /** Backward-compatible name for callers/tests; repository resolution is shared. */
@@ -135,6 +139,10 @@ export interface BuildDetail extends BuildSummary {
   /** Current work-owner decision. Open PRs use the build-owned config; ended
    * PRs project the repository completion path directly from durable state. */
   decision?: BuildDecisionProjection
+  /** The build's effective auto-merge display state (off, requested, enabled,
+   * cancelling) — the same projection the dashboards render, so `--json` and
+   * the text agree and `waiting: on PR` can say why it is waiting. */
+  autoMerge: AutoMergeDisplay
   openEscalations: OpenEscalation[]
   /** Per-loop review overrides for the current spec; omitted when none are set. */
   reviewRoundCeilings?: { plan?: number; code?: number }
@@ -155,6 +163,11 @@ export interface BuildDetail extends BuildSummary {
   lastEvent?: { type: string; seq: number; ts: string; actor: Actor }
   /** Present only with `--events <n>`: the newest n, chronological. */
   events?: AbEvent[]
+  /** Which `autobuild.toml` the build's pinned pipeline was read from, and the
+   * effective-config artifact revision it was deposited under (SPEC §16.1).
+   * Absent when no effective-config artifact has been deposited. */
+  pipelineSource?: PipelineSourceMeta
+  effectiveConfigRev?: number
   outcome?: BuildOutcome
 }
 
@@ -287,6 +300,7 @@ export function detail(
     }))
   return {
     ...summary,
+    autoMerge: autoMergeDisplay(state),
     ...(decision !== undefined ? { decision } : {}),
     openEscalations: state.openEscalations,
     ...(state.reviewRoundCeilings.plan !== undefined || state.reviewRoundCeilings.code !== undefined
@@ -493,6 +507,16 @@ export function renderDetail(d: BuildDetail, now: Date): string[] {
     lines.push(`  review round ceiling: ${ceilings.join(', ')}`)
   }
   lines.push(`  updated:  ${d.updatedAt} (${relativeTime(d.updatedAt, now)})`)
+  if (d.pipelineSource !== undefined || d.effectiveConfigRev !== undefined) {
+    const source =
+      d.pipelineSource !== undefined
+        ? `autobuild.toml@${
+            d.pipelineSource.commit !== undefined ? d.pipelineSource.commit.slice(0, 7) : 'unknown'
+          } (${d.pipelineSource.ref})`
+        : 'autobuild.toml@unknown (pre-pin)'
+    const rev = d.effectiveConfigRev !== undefined ? `  config rev ${d.effectiveConfigRev}` : ''
+    lines.push(`  pipeline: ${source}${rev}`)
+  }
 
   // Its own line, never folded into status: a running build with an expired
   // lease is the case this exists to make visible.
@@ -548,9 +572,11 @@ export function renderDetail(d: BuildDetail, now: Date): string[] {
     )
   }
   if (d.decision?.kind === 'awaiting-pr') {
-    lines.push(
-      `  waiting:  on PR${d.decision.reason !== undefined ? ` — ${d.decision.reason}` : ''}`,
-    )
+    // The deferral reason (a durable observation about WHY consent could not
+    // be applied) takes precedence; otherwise the auto-merge state itself is
+    // what the parked operator needs — off names the missing consent.
+    const consent = d.decision.reason ?? `auto merge ${d.autoMerge}`
+    lines.push(`  waiting:  on PR — ${consent}`)
   } else if (d.decision?.kind === 'repository-completion') {
     lines.push(
       `  waiting:  repository-level completion after the PR was ${d.decision.prState}; no runner re-attachment is pending`,
@@ -703,9 +729,43 @@ export async function abBuilds(opts: AbBuildsOpts): Promise<void> {
     const wanted = new Set(statusFilter(opts.all, opts.queued))
     // Cross-repo aggregation is out of scope (§12: one dispatcher per repo,
     // one repo's builds per answer).
+    // Records are read and held before the digest read: builds are never
+    // deleted, so every identity-keyed record iterated below is guaranteed an
+    // entry in the digest map fetched after it — a build created between the
+    // two reads appears only in the digest map, which is harmless — and the
+    // completeness check can only ever catch a genuine adapter bug, never a
+    // concurrent dispatch (AUT-488 finding f_3cb67aba).
     const records = (await store.listBuilds()).filter(mine)
+    // One digest read gates the per-build history reads (AUT-488): the active
+    // and queued scopes never show a terminal build, so an identity-keyed
+    // build whose digest already carries a terminal fact skips its `getEvents`
+    // round trip and the listing's store cost stays flat as finished builds
+    // accumulate. The `--all` scope includes terminal statuses, so it takes no
+    // digest read and skips nothing — byte-for-byte the old loop.
+    const digests = opts.all === true ? undefined : await store.getRepoBuildDigests(identity)
     const summaries: BuildSummary[] = []
     for (const record of records) {
+      if (digests !== undefined && record.repo === identity) {
+        // Completeness is contractual (one entry per repo build); a missing
+        // entry is an adapter bug and must fail loudly rather than silently
+        // drop the build from the listing.
+        const digest = digests.get(record.slug)
+        if (digest === undefined) {
+          throw new Error(`getRepoBuildDigests is missing an entry for build "${record.slug}"`)
+        }
+        // The digest's `terminal` follows `reduceBuild`'s terminal rule
+        // exactly (in-order overwrite of `build.completed`/`build.aborted`,
+        // never cleared — pinned against `reduceBuild` in
+        // store/digest.test.ts), so `terminal !== undefined` is exactly
+        // reduced status `done`/`aborted`, which the active and queued status
+        // sets never include. Skipping the history read therefore cannot
+        // change the emitted summaries.
+        if (digest.terminal !== undefined) continue
+      }
+      // A record matched only through the legacy `repoOrigin` path has no
+      // entry under `identity` — `getRepoBuildDigests` groups by `record.repo`
+      // exactly — so it keeps its per-build history read (correct, just not
+      // accelerated).
       const summary = summarize(record, await store.getEvents(record.slug), now)
       if (wanted.has(summary.status)) summaries.push(summary)
     }
@@ -830,6 +890,40 @@ async function projectBuildDecision(
   }
 }
 
+type AmbientReadContext = Parameters<Parameters<typeof withAmbientReadStore>[1]>[0]
+
+/** The build record, after the repository gate every single-build read shares
+ * (see `abBuildStatus`). */
+async function requireReadableBuild(
+  opts: AbBuildStatusOpts,
+  context: AmbientReadContext,
+): Promise<BuildRecord> {
+  const record = await context.store.getBuild(opts.slug)
+  if (record === null) {
+    throw new Error(
+      `no build "${opts.slug}" in this store — run 'ab builds --all' to list ` +
+        "this repo's builds, or pass --store <ref> if it lives in another store",
+    )
+  }
+  // Own-session authority: slug equality bounds the read to the session's
+  // own build, and an explicit --store must name the session's own store for
+  // the bypass to apply. Every other combination falls through to the
+  // ordinary repository gate, unchanged — which now keys on the checkout's
+  // normalized origin identity (`context.checkout` is the physical path;
+  // `buildInRepository` derives the identity from it).
+  const ownSession =
+    context.ambient !== undefined &&
+    'build' in context.ambient &&
+    context.ambient.build === opts.slug &&
+    (opts.storeRef === undefined || opts.storeRef === context.ambient.store)
+  if (!(ownSession || (await buildInRepository(record, context.checkout, opts.exec)))) {
+    throw new Error(
+      `build "${opts.slug}" belongs to repository "${record.repo}", not "${context.repo}"`,
+    )
+  }
+  return record
+}
+
 /** `ab build status <slug>` — one build in detail. Read-only.
  *
  * Repository authority mirrors the other ambient reads: an operator invocation
@@ -849,29 +943,7 @@ async function projectBuildDecision(
 export async function abBuildStatus(opts: AbBuildStatusOpts): Promise<void> {
   const now = (opts.now ?? (() => new Date()))()
   await withAmbientReadStore(opts, async (context) => {
-    const record = await context.store.getBuild(opts.slug)
-    if (record === null) {
-      throw new Error(
-        `no build "${opts.slug}" in this store — run 'ab builds --all' to list ` +
-          "this repo's builds, or pass --store <ref> if it lives in another store",
-      )
-    }
-    // Own-session authority: slug equality bounds the read to the session's
-    // own build, and an explicit --store must name the session's own store for
-    // the bypass to apply. Every other combination falls through to the
-    // ordinary repository gate, unchanged — which now keys on the checkout's
-    // normalized origin identity (`context.checkout` is the physical path;
-    // `buildInRepository` derives the identity from it).
-    const ownSession =
-      context.ambient !== undefined &&
-      'build' in context.ambient &&
-      context.ambient.build === opts.slug &&
-      (opts.storeRef === undefined || opts.storeRef === context.ambient.store)
-    if (!(ownSession || (await buildInRepository(record, context.checkout, opts.exec)))) {
-      throw new Error(
-        `build "${opts.slug}" belongs to repository "${record.repo}", not "${context.repo}"`,
-      )
-    }
+    const record = await requireReadableBuild(opts, context)
     const events = await context.store.getEvents(opts.slug)
     const decision = await projectBuildDecision(opts.slug, events, context.store)
     // Stream enrichment is presentation (SPEC §9): an unavailable read
@@ -885,7 +957,22 @@ export async function abBuildStatus(opts: AbBuildStatusOpts): Promise<void> {
     } catch {
       streams = undefined
     }
-    const d = detail(record, events, now, opts.events, decision, streams)
+    const projected = detail(record, events, now, opts.events, decision, streams)
+    // Operator visibility (SPEC §16.1): which autobuild.toml the build's
+    // pinned pipeline came from, alongside the effective-config revision.
+    const configArtifact = await context.store.getArtifact(
+      opts.slug,
+      BUILD_EFFECTIVE_CONFIG_ARTIFACT,
+    )
+    const configMeta =
+      configArtifact !== null ? parseBuildConfigMetadata(configArtifact) : undefined
+    const d: BuildDetail = {
+      ...projected,
+      ...(configMeta?.revision !== undefined ? { effectiveConfigRev: configMeta.revision } : {}),
+      ...(configMeta?.pipelineSource !== undefined
+        ? { pipelineSource: configMeta.pipelineSource }
+        : {}),
+    }
     if (opts.json === true) {
       opts.stdout(JSON.stringify(d, null, 2))
       return
@@ -893,3 +980,38 @@ export async function abBuildStatus(opts: AbBuildStatusOpts): Promise<void> {
     for (const line of renderDetail(d, now)) opts.stdout(line)
   })
 }
+
+export interface AbBuildAssetGetOpts extends AbBuildStatusOpts {
+  kind: string
+  name: string
+  dest: string
+  rev?: number
+}
+
+/** `ab build asset get <slug> <kind> <name> <dest>` — the exact bytes a build
+ * froze at its claim (SPEC §6.3), available after the build has finished. */
+export async function abBuildAssetGet(opts: AbBuildAssetGetOpts): Promise<void> {
+  await withAmbientReadStore(opts, async (context) => {
+    await requireReadableBuild(opts, context)
+    const asset = await context.store.getPinnedTicketAsset(
+      opts.slug,
+      opts.kind,
+      opts.name,
+      opts.rev,
+    )
+    if (asset === null) {
+      const revision = opts.rev === undefined ? '' : ` revision ${opts.rev}`
+      throw new Error(
+        `build "${opts.slug}" pinned no ticket asset ${opts.kind}/${opts.name}${revision}`,
+      )
+    }
+    const written = await writeAssetTo(asset, opts.dest)
+    if (opts.json === true) {
+      opts.stdout(JSON.stringify({ ...asset.meta, path: written }, null, 2))
+      return
+    }
+    opts.stdout(
+      `build asset downloaded: ${opts.slug} ${opts.kind}/${opts.name} revision ${asset.meta.revision} → ${written}`,
+    )
+  })
+}

package/packages/core/src/cli/terminals.ts

@@ -20,6 +20,7 @@ import { z } from 'zod'
 import { loadConfig } from '../config/load'
 import type { AbEvent, EventEnvelope } from '../events/catalog'
 import { agentActor, KERNEL } from '../events/envelope'
+import { isRemoteWorkspace } from '../events/workspace-remote'
 import type { IdSource } from '../ids'
 import {
   autoMergeApplicationType,
@@ -258,7 +259,7 @@ function requireImplementationProvisioning(events: AbEvent[]): void {
 function remotePublication(events: readonly AbEvent[]): boolean {
   let remote = false
   for (const event of events) {
-    if (event.type === 'workspace.provisioned') remote = event.payload.provider === 'vercel-sandbox'
+    if (event.type === 'workspace.provisioned') remote = isRemoteWorkspace(event.payload)
     else if (event.type === 'workspace.released') remote = false
   }
   return remote

package/packages/core/src/cli/ticket-assets.ts

@@ -0,0 +1,247 @@
+/**
+ * Filesystem and note plumbing for `ab ticket attach` / `asset get` /
+ * `asset rm` (SPEC §8.8). The store owns the bytes and the validation
+ * (store/ticket-assets.ts); this module owns the two edges that touch the
+ * local filesystem and the one outward projection: the note left on the
+ * ticket in its source (SPEC §13).
+ */
+import { lstat, mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises'
+import { basename, dirname, join, resolve, sep } from 'node:path'
+import {
+  ticketAssetEntriesError,
+  ticketAssetSizeError,
+  validateTicketAssetPath,
+  validateTicketAssetStructure,
+  type TicketAsset,
+  type TicketAssetEntryInput,
+  type TicketAssetInput,
+  type TicketAssetLayout,
+  type TicketAssetLimits,
+  type TicketAssetMeta,
+} from '../store/ticket-assets'
+
+export type TicketAssetNoteEvent = 'attached' | 'replaced' | 'removed'
+
+export function formatAssetSize(bytes: number): string {
+  if (bytes < 1024) return `${bytes} B`
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KiB`
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MiB`
+}
+
+function plural(count: number, word: string): string {
+  return `${count} ${word}${count === 1 ? '' : 's'}`
+}
+
+/**
+ * The note left on the ticket in its source. Plain Markdown with backticks
+ * (no bold, no source-specific syntax) so every source and plugin renders it.
+ * It names the asset and how to fetch it, and states that the contents are in
+ * the Autobuild store, not in this ticket.
+ */
+export function ticketAssetNote(
+  event: TicketAssetNoteEvent,
+  meta: TicketAssetMeta,
+  cli = 'ab',
+): string {
+  const fileCount = meta.entries.filter((entry) => entry.type === 'file').length
+  const label = `\`${meta.kind}/${meta.name}\``
+  const get = `${cli} ticket asset get ${meta.ticketId} ${meta.kind} ${meta.name} <dest>`
+  const contents = `${plural(fileCount, 'file')}, ${formatAssetSize(meta.size)}`
+  switch (event) {
+    case 'attached':
+      return [
+        `Ticket asset attached: ${label} (revision ${meta.revision}, ${contents}).`,
+        '',
+        'The contents live in the Autobuild store, not in this ticket.',
+        `Download the latest revision: \`${get}\``,
+        `Download this exact revision: \`${get} --rev ${meta.revision}\``,
+      ].join('\n')
+    case 'replaced':
+      return [
+        `Ticket asset replaced: ${label} is now revision ${meta.revision} (${contents}).`,
+        '',
+        'The contents live in the Autobuild store, not in this ticket. Earlier revisions stay retrievable.',
+        `Download the latest revision: \`${get}\``,
+        `Download this exact revision: \`${get} --rev ${meta.revision}\``,
+      ].join('\n')
+    case 'removed':
+      return [
+        `Ticket asset removed: ${label} is no longer one of this ticket's current assets (last revision ${meta.revision}).`,
+        '',
+        'The contents live in the Autobuild store, not in this ticket. That revision stays retrievable by number.',
+        `Download it: \`${get} --rev ${meta.revision}\``,
+      ].join('\n')
+  }
+}
+
+export interface AssetWalk {
+  layout: TicketAssetLayout
+  /** Default asset name: the path's basename. */
+  basename: string
+  files: { path: string; abs: string; size: number }[]
+  dirs: string[]
+}
+
+/**
+ * Walk a file or folder for attachment. Symlinks and non-regular files are
+ * refused. The folder root is never an entry — it is represented only by the
+ * `tree` layout — so every entry path is relative, with no empty or `.`
+ * segment, and an empty folder walks to zero entries.
+ */
+export async function walkAssetPath(path: string): Promise<AssetWalk> {
+  const root = resolve(path)
+  const info = await lstat(root).catch((error: NodeJS.ErrnoException) => {
+    if (error.code === 'ENOENT') throw new Error(`${path}: no such file or directory`)
+    throw error
+  })
+  if (info.isSymbolicLink()) {
+    throw new Error(`${path}: symbolic links cannot be attached — attach the real file or folder`)
+  }
+  if (info.isFile()) {
+    return {
+      layout: 'file',
+      basename: basename(root),
+      files: [{ path: basename(root), abs: root, size: info.size }],
+      dirs: [],
+    }
+  }
+  if (!info.isDirectory()) {
+    throw new Error(`${path}: only regular files and folders can be attached`)
+  }
+  const files: AssetWalk['files'] = []
+  const dirs: string[] = []
+  const visit = async (abs: string, rel: string): Promise<void> => {
+    const names = (await readdir(abs)).sort()
+    for (const name of names) {
+      const childAbs = join(abs, name)
+      const childRel = rel === '' ? name : `${rel}/${name}`
+      const child = await lstat(childAbs)
+      if (child.isSymbolicLink()) {
+        throw new Error(
+          `${childAbs}: symbolic links cannot be attached — remove it or attach its target`,
+        )
+      }
+      if (child.isDirectory()) {
+        dirs.push(childRel)
+        await visit(childAbs, childRel)
+      } else if (child.isFile()) {
+        files.push({ path: childRel, abs: childAbs, size: child.size })
+      } else {
+        throw new Error(`${childAbs}: only regular files and folders can be attached`)
+      }
+    }
+  }
+  await visit(root, '')
+  return { layout: 'tree', basename: basename(root), files, dirs }
+}
+
+/**
+ * Build the put input from a walk. Everything the stat sizes can refuse —
+ * names, paths, structure, entry count, total bytes — is refused here, before
+ * any file's bytes are read.
+ */
+export async function buildAssetInput(
+  walk: AssetWalk,
+  asset: { kind: string; name: string },
+  limits: TicketAssetLimits,
+): Promise<TicketAssetInput> {
+  const entryCount = walk.files.length + walk.dirs.length
+  if (entryCount > limits.maxEntries) throw ticketAssetEntriesError(entryCount, limits.maxEntries)
+  const total = walk.files.reduce((sum, file) => sum + file.size, 0)
+  if (total > limits.maxBytes) throw ticketAssetSizeError(total, limits.maxBytes)
+  validateTicketAssetStructure(
+    {
+      kind: asset.kind,
+      name: asset.name,
+      layout: walk.layout,
+      entries: [
+        ...walk.dirs.map((path) => ({ type: 'dir' as const, path })),
+        ...walk.files.map((file) => ({ type: 'file' as const, path: file.path, size: file.size })),
+      ],
+    },
+    limits,
+  )
+  const entries: TicketAssetEntryInput[] = walk.dirs.map((path) => ({ type: 'dir', path }))
+  for (const file of walk.files) {
+    entries.push({
+      type: 'file',
+      path: file.path,
+      content: new Uint8Array(await readFile(file.abs)),
+    })
+  }
+  return { kind: asset.kind, name: asset.name, layout: walk.layout, entries }
+}
+
+/** Resolve a stored entry path under `root`, refusing anything that would land
+ * outside it. Stored paths are never trusted, even though upload validates. */
+function guardedTarget(root: string, path: string): string {
+  validateTicketAssetPath(path)
+  const target = resolve(root, path)
+  if (target !== root && !target.startsWith(`${root}${sep}`)) {
+    throw new Error(`ticket asset path "${path}" escapes the destination`)
+  }
+  return target
+}
+
+/** Refuse to write through a symlink: every existing component of `target`
+ * below `root`, and `target` itself, must not be one. Containment is checked
+ * against the real filesystem, since mkdir and writeFile follow links. */
+async function assertNoSymlinks(root: string, target: string): Promise<void> {
+  const rel = target === root ? '' : target.slice(root.length + 1)
+  let current = root
+  const parts = rel === '' ? [] : rel.split(sep)
+  for (const part of ['', ...parts]) {
+    if (part !== '') current = join(current, part)
+    if (current === root) continue
+    const info = await lstat(current).catch(() => null)
+    if (info === null) return
+    if (info.isSymbolicLink()) {
+      throw new Error(`${current}: refusing to write through a symbolic link in the destination`)
+    }
+  }
+}
+
+/**
+ * Write a downloaded asset to `dest`. A `file` asset becomes the file `dest`
+ * (or `dest/<filename>` when `dest` is an existing directory); a `tree` asset
+ * becomes the directory `dest` itself — created even when empty — with every
+ * `dir` entry made, then every file written.
+ */
+export async function writeAssetTo(asset: TicketAsset, dest: string): Promise<string> {
+  const root = resolve(dest)
+  if (asset.meta.layout === 'file') {
+    const file = asset.entries.find((entry) => entry.type === 'file')
+    if (file === undefined || file.type !== 'file') {
+      throw new Error(`ticket asset ${asset.meta.kind}/${asset.meta.name} holds no file`)
+    }
+    const isDir = await stat(root)
+      .then((info) => info.isDirectory())
+      .catch(() => false)
+    const target = isDir ? guardedTarget(root, file.path) : root
+    if (isDir) await assertNoSymlinks(root, target)
+    else {
+      const existing = await lstat(target).catch(() => null)
+      if (existing?.isSymbolicLink()) {
+        throw new Error(`${target}: refusing to write through a symbolic link`)
+      }
+    }
+    await mkdir(dirname(target), { recursive: true })
+    await writeFile(target, file.content)
+    return target
+  }
+  await mkdir(root, { recursive: true })
+  for (const entry of asset.entries) {
+    if (entry.type !== 'dir') continue
+    const target = guardedTarget(root, entry.path)
+    await assertNoSymlinks(root, target)
+    await mkdir(target, { recursive: true })
+  }
+  for (const entry of asset.entries) {
+    if (entry.type !== 'file') continue
+    const target = guardedTarget(root, entry.path)
+    await assertNoSymlinks(root, target)
+    await mkdir(dirname(target), { recursive: true })
+    await writeFile(target, entry.content)
+  }
+  return root
+}