@delegance/claude-autopilot 5.5.2 → 7.2.0

package/dist/src/adapters/deploy/vercel.d.ts

@@ -34,6 +34,16 @@ export interface VercelDeployAdapterOptions {
     sleepImpl?: (ms: number) => Promise<void>;
     /** Wall-clock source — tests pass a controllable counter. */
     nowImpl?: () => number;
+    /**
+     * Optional caller-supplied redaction patterns (in addition to the
+     * built-in default set in `core/logging/redaction.ts`). Typically wired
+     * from `config.persistence.redactionPatterns` by the CLI; tests omit it.
+     *
+     * Phase 5 of v5.6 brought Vercel into parity with Fly/Render — the v5.4
+     * adapter previously emitted `output` lines verbatim, which was a real
+     * leak hazard for any build that echoed an env var into stdout.
+     */
+    redactionPatterns?: readonly string[];
 }
 /**
  * Vercel deploy adapter.
@@ -52,6 +62,7 @@ export declare class VercelDeployAdapter implements DeployAdapter {
     private readonly fetchImpl;
     private readonly sleep;
     private readonly now;
+    private readonly redactionPatterns;
     constructor(opts: VercelDeployAdapterOptions);
     deploy(input: DeployInput): Promise<DeployResult>;
     status(input: DeployStatusInput): Promise<DeployStatusResult>;
@@ -95,6 +106,12 @@ export declare class VercelDeployAdapter implements DeployAdapter {
      * display (defaults to 5).
      */
     listDeployments(limit?: number, signal?: AbortSignal): Promise<VercelDeployListItem[]>;
+    /**
+     * Apply the adapter's redaction patterns to a streamed log line's `text`.
+     * Mirrors the Fly/Render redactLine helpers introduced in v5.6 so secrets
+     * never escape the adapter via streamed log entries.
+     */
+    private redactLine;
     /**
      * Returns the deployment immediately preceding the current production
      * deployment, or `null` if no rollback target exists.
@@ -111,7 +128,6 @@ export declare class VercelDeployAdapter implements DeployAdapter {
     private urlWithTeam;
     private buildLogsUrl;
     private assertOkOrThrow;
-    private fetchWithRetry;
     /**
      * Like `fetchWithRetry` but tuned for the events endpoint:
      * - 404 right after a deploy POST is a known race (the deploy hasn't yet

package/dist/src/adapters/deploy/vercel.js

@@ -10,6 +10,8 @@
 //
 // Spec: docs/specs/v5.4-vercel-adapter.md
 import { GuardrailError } from "../../core/errors.js";
+import { redactLogLines } from "../../core/logging/redaction.js";
+import { fetchWithRetry, safeReadBody } from "./_http.js";
 const VERCEL_API_BASE = 'https://api.vercel.com';
 /**
  * Vercel deploy adapter.
@@ -28,6 +30,7 @@ export class VercelDeployAdapter {
     fetchImpl;
     sleep;
     now;
+    redactionPatterns;
     constructor(opts) {
         const token = opts.token ?? process.env.VERCEL_TOKEN;
         if (!token) {
@@ -45,6 +48,7 @@ export class VercelDeployAdapter {
         this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
         this.sleep = opts.sleepImpl ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
         this.now = opts.nowImpl ?? Date.now;
+        this.redactionPatterns = opts.redactionPatterns;
     }
     async deploy(input) {
         const start = this.now();
@@ -65,12 +69,12 @@ export class VercelDeployAdapter {
         else if (input.ref) {
             body.gitSource = { type: 'github', ref: input.ref };
         }
-        const res = await this.fetchWithRetry(url, {
+        const res = await fetchWithRetry(this.fetchImpl, url, {
             method: 'POST',
             headers: this.headers(),
             body: JSON.stringify(body),
             signal: input.signal,
-        });
+        }, { sleepImpl: this.sleep, provider: 'vercel' });
         await this.assertOkOrThrow(res, 'create deployment');
         const created = (await res.json());
         if (!created.id) {
@@ -90,11 +94,11 @@ export class VercelDeployAdapter {
     async status(input) {
         const start = this.now();
         const url = this.urlWithTeam(`${VERCEL_API_BASE}/v13/deployments/${encodeURIComponent(input.deployId)}`);
-        const res = await this.fetchWithRetry(url, {
+        const res = await fetchWithRetry(this.fetchImpl, url, {
             method: 'GET',
             headers: this.headers(),
             signal: input.signal,
-        });
+        }, { sleepImpl: this.sleep, provider: 'vercel' });
         await this.assertOkOrThrow(res, 'get deployment');
         const data = (await res.json());
         const state = data.readyState ?? data.state;
@@ -133,7 +137,7 @@ export class VercelDeployAdapter {
                     if (buf.length > 0) {
                         const line = parseEventLine(buf);
                         if (line)
-                            yield line;
+                            yield this.redactLine(line);
                     }
                     return;
                 }
@@ -144,7 +148,7 @@ export class VercelDeployAdapter {
                     buf = buf.slice(nl + 1);
                     const line = parseEventLine(raw);
                     if (line)
-                        yield line;
+                        yield this.redactLine(line);
                     nl = buf.indexOf('\n');
                 }
             }
@@ -181,12 +185,12 @@ export class VercelDeployAdapter {
             targetId = prev.id;
         }
         const url = this.urlWithTeam(`${VERCEL_API_BASE}/v13/deployments/${encodeURIComponent(targetId)}/promote`);
-        const res = await this.fetchWithRetry(url, {
+        const res = await fetchWithRetry(this.fetchImpl, url, {
             method: 'POST',
             headers: this.headers(),
             body: '{}',
             signal: input.signal,
-        });
+        }, { sleepImpl: this.sleep, provider: 'vercel' });
         await this.assertOkOrThrow(res, 'promote deployment');
         // Promote responses are typically empty (204) or echo the deployment.
         // Be defensive — parse if there's a body, otherwise carry on with the
@@ -205,7 +209,7 @@ export class VercelDeployAdapter {
             deployUrl: data?.url ? `https://${data.url}` : undefined,
             buildLogsUrl: this.buildLogsUrl(targetId),
             durationMs: this.now() - start,
-            output: `Vercel deployment ${targetId} promoted to production`,
+            output: redactLogLines(`Vercel deployment ${targetId} promoted to production`, this.redactionPatterns),
         };
     }
     /**
@@ -224,11 +228,11 @@ export class VercelDeployAdapter {
             `?projectId=${encodeURIComponent(this.project)}` +
             `&limit=${encodeURIComponent(String(limit))}` +
             `&target=production`);
-        const res = await this.fetchWithRetry(url, {
+        const res = await fetchWithRetry(this.fetchImpl, url, {
             method: 'GET',
             headers: this.headers(),
             signal,
-        });
+        }, { sleepImpl: this.sleep, provider: 'vercel' });
         await this.assertOkOrThrow(res, 'list deployments');
         const data = (await res.json());
         return Array.isArray(data.deployments) ? data.deployments : [];
@@ -236,6 +240,14 @@ export class VercelDeployAdapter {
     // ─────────────────────────────────────────────────────────────────────────────
     // private helpers
     // ─────────────────────────────────────────────────────────────────────────────
+    /**
+     * Apply the adapter's redaction patterns to a streamed log line's `text`.
+     * Mirrors the Fly/Render redactLine helpers introduced in v5.6 so secrets
+     * never escape the adapter via streamed log entries.
+     */
+    redactLine(line) {
+        return { ...line, text: redactLogLines(line.text, this.redactionPatterns) };
+    }
     /**
      * Returns the deployment immediately preceding the current production
      * deployment, or `null` if no rollback target exists.
@@ -265,14 +277,14 @@ export class VercelDeployAdapter {
                     deployId,
                     durationMs: this.now() - start,
                     buildLogsUrl: this.buildLogsUrl(deployId),
-                    output: `Deployment still in progress after ${this.maxPollMs}ms — check ${this.buildLogsUrl(deployId)}`,
+                    output: redactLogLines(`Deployment still in progress after ${this.maxPollMs}ms — check ${this.buildLogsUrl(deployId)}`, this.redactionPatterns),
                 };
             }
-            const res = await this.fetchWithRetry(url, {
+            const res = await fetchWithRetry(this.fetchImpl, url, {
                 method: 'GET',
                 headers: this.headers(),
                 signal,
-            });
+            }, { sleepImpl: this.sleep, provider: 'vercel' });
             await this.assertOkOrThrow(res, 'poll deployment');
             const data = (await res.json());
             const state = data.readyState ?? data.state;
@@ -290,7 +302,9 @@ export class VercelDeployAdapter {
             deployUrl: data.url ? `https://${data.url}` : undefined,
             buildLogsUrl: this.buildLogsUrl(deployId),
             durationMs,
-            output: state ? `Vercel deployment ${deployId}: state=${state}` : undefined,
+            output: state
+                ? redactLogLines(`Vercel deployment ${deployId}: state=${state}`, this.redactionPatterns)
+                : undefined,
         };
     }
     headers() {
@@ -321,32 +335,6 @@ export class VercelDeployAdapter {
         }
         throw new GuardrailError(`Vercel API error (${res.status}) on ${step}: ${bodyText}`, { code: 'adapter_bug', provider: 'vercel', step, details: { status: res.status } });
     }
-    async fetchWithRetry(url, init, attempts = 3, baseMs = 500) {
-        let lastErr;
-        for (let i = 0; i < attempts; i++) {
-            try {
-                const res = await this.fetchImpl(url, init);
-                // 5xx is transient — retry. 4xx is the caller's problem — fail fast.
-                if (res.status >= 500 && res.status < 600 && i < attempts - 1) {
-                    lastErr = new Error(`HTTP ${res.status}`);
-                    await this.sleep(baseMs * 2 ** i);
-                    continue;
-                }
-                return res;
-            }
-            catch (err) {
-                lastErr = err;
-                // AbortError is intentional cancellation — surface it directly without retry.
-                if (err instanceof Error && err.name === 'AbortError')
-                    throw err;
-                if (i < attempts - 1) {
-                    await this.sleep(baseMs * 2 ** i);
-                    continue;
-                }
-            }
-        }
-        throw new GuardrailError(`Vercel API unreachable after ${attempts} attempts: ${lastErr?.message ?? String(lastErr)}`, { code: 'transient_network', provider: 'vercel' });
-    }
     /**
      * Like `fetchWithRetry` but tuned for the events endpoint:
      * - 404 right after a deploy POST is a known race (the deploy hasn't yet
@@ -392,14 +380,6 @@ export class VercelDeployAdapter {
         return lastRes;
     }
 }
-async function safeReadBody(res) {
-    try {
-        return (await res.text()).slice(0, 500);
-    }
-    catch {
-        return '<no body>';
-    }
-}
 /**
  * Parse a single line from Vercel's events endpoint into a `DeployLogLine`.
  *

package/dist/src/adapters/pricing.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Canonical per-model pricing for cost-ledger / cost-estimate / cost-cap features.
+ *
+ * Computed client-side because the OpenAI Responses API and most provider APIs
+ * return token counts but no $-cost field. Without these constants every codex
+ * run logged costUSD=0 even though tokens were tracked correctly.
+ *
+ * Units: USD per 1,000,000 tokens.
+ *
+ * `cachedInputPer1M` is the price for cached-input tokens (OpenAI's prompt-cache
+ * read tier — typically ~1/8 of `inputPer1M`). Set to `null` when the provider
+ * doesn't surface a cached tier or we don't have a confirmed published number.
+ *
+ * Adding a model here does NOT auto-wire it into any adapter — the per-adapter
+ * COST_PER_M_INPUT/OUTPUT constants in src/adapters/{council,review-engine}/*.ts
+ * remain the actual source of truth for runtime cost computation, and stay
+ * env-overridable. This table is the documentation/single-source-of-truth for
+ * "what should the defaults be" + drives the cost-ledger config defaults.
+ *
+ * Keep entries sorted: oldest → newest within each provider, providers
+ * alphabetical.
+ */
+export interface ModelPricing {
+    inputPer1M: number;
+    outputPer1M: number;
+    cachedInputPer1M: number | null;
+}
+export declare const MODEL_PRICING: Record<string, ModelPricing>;
+/**
+ * Look up canonical pricing for a model. Returns `undefined` for unknown
+ * models — callers should fall back to env-var defaults rather than throwing,
+ * because this table is intentionally non-exhaustive (adapters work with any
+ * model the underlying SDK accepts).
+ */
+export declare function getModelPricing(model: string): ModelPricing | undefined;
+//# sourceMappingURL=pricing.d.ts.map

package/dist/src/adapters/pricing.js

@@ -0,0 +1,40 @@
+export const MODEL_PRICING = {
+    // OpenAI ----------------------------------------------------------------
+    // gpt-5.3-codex: legacy default (pre-2026-04-23). Kept for back-compat —
+    // users may have pinned via CODEX_MODEL env var.
+    'gpt-5.3-codex': {
+        inputPer1M: 1.25,
+        outputPer1M: 10.0,
+        cachedInputPer1M: null,
+    },
+    // gpt-5.4: superseded by gpt-5.5 on 2026-04-23. Kept for back-compat.
+    'gpt-5.4': {
+        inputPer1M: 2.5,
+        outputPer1M: 15.0,
+        cachedInputPer1M: null,
+    },
+    // gpt-5.5 (codename Spud, released 2026-04-23): current default for codex
+    // adapter + council openai adapter. Better at coding than 5.4 with fewer
+    // tokens, but ~2× more expensive per token. Available via standard
+    // Responses/Chat Completions API at `gpt-5.5` (no `-codex` suffix).
+    // Bugbot MEDIUM PR #93: `cachedInputPer1M` is `null` (NOT 0) until we have
+    // a confirmed published number. The interface contract treats `0` as
+    // "cached tokens are free" — using it would make consumers silently
+    // compute $0 for cached usage. Heuristic is ~1/8 of input (~$0.625/1M)
+    // per OpenAI's prompt-cache pattern, but no definitive source yet.
+    'gpt-5.5': {
+        inputPer1M: 5.0,
+        outputPer1M: 30.0,
+        cachedInputPer1M: null,
+    },
+};
+/**
+ * Look up canonical pricing for a model. Returns `undefined` for unknown
+ * models — callers should fall back to env-var defaults rather than throwing,
+ * because this table is intentionally non-exhaustive (adapters work with any
+ * model the underlying SDK accepts).
+ */
+export function getModelPricing(model) {
+    return MODEL_PRICING[model];
+}
+//# sourceMappingURL=pricing.js.map

package/dist/src/adapters/review-engine/codex.js

@@ -2,14 +2,17 @@ import { parseReviewOutput } from "./parse-output.js";
 import { GuardrailError } from "../../core/errors.js";
 import { buildSystemPrompt, classifyError } from "./prompt-builder.js";
 import { loadOpenAI } from "../sdk-loader.js";
-const DEFAULT_MODEL = process.env.CODEX_MODEL ?? 'gpt-5.3-codex';
+import { getModelPricing } from "../pricing.js";
+const DEFAULT_MODEL = process.env.CODEX_MODEL ?? 'gpt-5.5';
 const MAX_OUTPUT_TOKENS = 4096;
-// Per-million-token rates for gpt-5.3-codex (override via env for other models).
-// Computed client-side because the OpenAI Responses API returns token counts
-// but no $-cost field. Without this, every codex run logged costUSD=0 even
-// though tokens were tracked correctly.
-const COST_PER_M_INPUT = Number(process.env.CODEX_COST_INPUT_PER_M ?? 1.25);
-const COST_PER_M_OUTPUT = Number(process.env.CODEX_COST_OUTPUT_PER_M ?? 10.0);
+// Per-million-token rates. Bugbot LOW PR #93: wired to read from the
+// canonical MODEL_PRICING table so the table is no longer dead code.
+// Resolution order: env override → MODEL_PRICING entry for DEFAULT_MODEL →
+// numeric fallback (gpt-5.5 published rates). Costs are computed client-side
+// because the OpenAI Responses API returns token counts but no $-cost field.
+const _pricing = getModelPricing(DEFAULT_MODEL);
+const COST_PER_M_INPUT = Number(process.env.CODEX_COST_INPUT_PER_M ?? _pricing?.inputPer1M ?? 5.0);
+const COST_PER_M_OUTPUT = Number(process.env.CODEX_COST_OUTPUT_PER_M ?? _pricing?.outputPer1M ?? 30.0);
 const SYSTEM_PROMPT_TEMPLATE = `You are a senior software architect providing feedback on designs, proposals, and ideas.
 
 The codebase context:

package/dist/src/cli/autopilot.d.ts

@@ -0,0 +1,75 @@
+import { PHASE_REGISTRY, DEFAULT_FULL_PHASES, type PhaseName } from '../core/run-state/phase-registry.ts';
+export type AutopilotMode = 'full';
+export interface AutopilotOptions {
+    cwd?: string;
+    configPath?: string;
+    /** Pipeline mode. v6.2.0 supports `'full'` only (scan → spec → plan →
+     *  implement). Defaults to `'full'` when neither `mode` nor `phases`
+     *  is supplied. */
+    mode?: AutopilotMode;
+    /** Explicit phase list (overrides `mode`). Validated against
+     *  PHASE_REGISTRY before any run dir is created — unknown names exit 1
+     *  with `invalid_config`. */
+    phases?: readonly string[];
+    /** Run-scope budget (USD). When set, every phase passes through the
+     *  shared `BudgetConfig` with `scope: 'run'` so `actualSoFar` accumulates
+     *  across phases. */
+    budgetUSD?: number;
+    /** v6.0.x — engine knob. The orchestrator REJECTS engine-off explicitly
+     *  (per spec "Engine-off"); these fields exist so the dispatcher can pass
+     *  them through and the orchestrator can produce a clear error message. */
+    cliEngine?: boolean;
+    envEngine?: string;
+    /** Test seam — keep stdout banners suppressed. Production callers MUST
+     *  NOT pass this; the dispatcher does not surface a flag for it. */
+    __silent?: boolean;
+    /** v7.0 Phase 2.3 — opt out of auto-upload at run.complete. Surfaced by
+     *  the CLI as `--no-upload`. Equivalent to `CLAUDE_AUTOPILOT_UPLOAD=off`
+     *  but scoped per-invocation. */
+    noUpload?: boolean;
+}
+export interface AutopilotPhaseSummary {
+    name: string;
+    status: 'success' | 'failed' | 'skipped' | 'not-run';
+    errorCode?: string;
+    errorMessage?: string;
+    costUSD: number;
+    durationMs: number;
+}
+export interface AutopilotResult {
+    runId: string | null;
+    runDir: string | null;
+    exitCode: number;
+    errorCode?: string;
+    errorMessage?: string;
+    phases: AutopilotPhaseSummary[];
+    totalCostUSD: number;
+    durationMs: number;
+}
+export declare function runAutopilot(options?: AutopilotOptions): Promise<AutopilotResult>;
+export interface AutopilotJsonOptions extends AutopilotOptions {
+    /** Test seam — install process-level uncaughtException / unhandledRejection
+     *  handlers that emit a fallback envelope if the orchestrator throws past
+     *  our try/catch. Default: true (production behavior). Tests pass false to
+     *  avoid leaking handlers across the suite. */
+    __testInstallProcessHandlers?: boolean;
+    /** Test seam — when set, the orchestrator throws AFTER the success
+     *  envelope is written. Used to verify the single-write latch suppresses
+     *  the uncaughtException handler's fallback envelope. Production code
+     *  never sets this. */
+    __testThrowAfterEnvelope?: () => never;
+}
+/** v6.2.2 entrypoint for `claude-autopilot autopilot --json`.
+ *
+ *  Wraps `runAutopilot` (which already handles pre-run failures inline by
+ *  returning an `AutopilotResult` with `runId: null` + populated
+ *  `errorCode` / `errorMessage`) and emits exactly one envelope on stdout.
+ *  Process-level fatal handlers (codex WARNING #2) catch async failures
+ *  that would otherwise bypass our try/catch.
+ *
+ *  Returns the exit code the dispatcher should propagate via
+ *  `process.exit`. */
+export declare function runAutopilotWithJsonEnvelope(options?: AutopilotJsonOptions): Promise<number>;
+export { PHASE_REGISTRY, DEFAULT_FULL_PHASES };
+export type { PhaseName };
+//# sourceMappingURL=autopilot.d.ts.map