@doist/doistbot-cli 1.0.1 → 1.0.3

package/sandbox/dist/tasks/issue-triage/fix-loop/runners.js

@@ -0,0 +1,227 @@
+import { logger } from '../../../core/logging.js';
+import { isFixLoopTerminal, isTerminal, next, } from './state-machine.js';
+const CI_FAILED_LABEL = 'doistbot:ci-failed';
+const NEEDS_HUMAN_LABEL = 'doistbot:needs-human';
+const AWAITING_CI_LABEL = 'doistbot:awaiting-ci';
+// Stamped on terminal comments so postIssueComment can find-or-update an
+// existing comment instead of double-posting when an earlier dispatch
+// succeeded on GitHub but the response timed out.
+const PROMOTION_COMMENT_MARKER = '<!--doistbot-promotion-comment-->';
+function iterationLabel(iteration) {
+    return `doistbot:iter-${iteration}`;
+}
+function formatFailedChecks(checks) {
+    return checks.map((c) => (c.url ? `- [${c.name}](${c.url})` : `- ${c.name}`)).join('\n');
+}
+const DEFAULT_INITIAL_STATE = {
+    kind: 'AWAITING_FIRST_FIX',
+    intent: 'issue_fix',
+    promotionPolicy: { kind: 'doistbot_fix_ci' },
+    maxIterations: 2,
+};
+function createEventApplier(onTransition) {
+    return (state, event) => {
+        const nextState = next(state, event);
+        onTransition?.({ from: state, event, to: nextState });
+        return nextState;
+    };
+}
+/**
+ * Drives the fix loop state machine to a terminal-for-fix-loop state
+ * (PUSHED_AWAITING_CI, DONE_PR_UPDATED, or DONE_NEEDS_HUMAN). For the
+ * doistbot_fix_ci policy, the promotion flow takes over from
+ * PUSHED_AWAITING_CI on the check_suite webhook; for the `none` policy
+ * (address_review), the workflow terminates in-process at DONE_PR_UPDATED.
+ */
+export async function runFixLoop(input) {
+    const { effects, initial, onTransition } = input;
+    const applyEvent = createEventApplier(onTransition);
+    let state = initial ?? DEFAULT_INITIAL_STATE;
+    while (!isFixLoopTerminal(state)) {
+        if (state.kind === 'AWAITING_FIRST_FIX' || state.kind === 'ITERATING') {
+            const fixInput = state.kind === 'ITERATING'
+                ? {
+                    iteration: state.iteration,
+                    prevHeadSha: state.prevHeadSha,
+                    previousFindings: state.findings,
+                }
+                : { iteration: 0 };
+            const fix = await effects.runFix(fixInput);
+            // runFixCore validates the diff internally and returns ok:false
+            // (with a "Diff validation failed: ..." reason) when invalid; no
+            // need for the runner to re-validate.
+            if (!fix.ok) {
+                state = applyEvent(state, { kind: 'FIX_FAILED', reason: fix.reason });
+                continue;
+            }
+            const pushInput = {
+                iteration: fixInput.iteration,
+                diff: fix.diff,
+                codexOutput: fix.codexOutput,
+                generatedPRTitle: fix.generatedPRTitle,
+                generatedPRBody: fix.generatedPRBody,
+            };
+            if (state.kind === 'ITERATING') {
+                pushInput.branch = state.branch;
+            }
+            const push = await effects.pushCommit(pushInput);
+            const prNumber = state.kind === 'ITERATING' ? state.prNumber : push.prNumber;
+            if (prNumber === undefined) {
+                state = applyEvent(state, {
+                    kind: 'FIX_FAILED',
+                    reason: 'Fix push did not produce a PR number.',
+                });
+                continue;
+            }
+            state = applyEvent(state, {
+                kind: 'FIX_PUSHED',
+                headSha: push.headSha,
+                branch: push.branch,
+                prNumber,
+            });
+            continue;
+        }
+        if (state.kind === 'REVIEWING') {
+            const reviewInput = {
+                iteration: state.iteration,
+            };
+            if (state.reviewBaseSha !== undefined) {
+                reviewInput.reviewBaseSha = state.reviewBaseSha;
+            }
+            const result = await effects.runReview(reviewInput);
+            if (result.kind === 'unverified') {
+                state = applyEvent(state, { kind: 'REVIEW_UNVERIFIED', reason: result.reason });
+            }
+            else {
+                state = applyEvent(state, { kind: 'REVIEW_COMPLETE', findings: result.findings });
+            }
+            continue;
+        }
+        // Defensive: any other intermediate state is a bug.
+        throw new Error(`runFixLoop: unexpected state ${state.kind}`);
+    }
+    if (state.kind === 'PUSHED_AWAITING_CI' &&
+        state.iteration !== undefined &&
+        state.promotionPolicy.kind === 'doistbot_fix_ci') {
+        // Local review accepted the patch; hand off to CI. awaiting-ci is the
+        // contract the webhook handler keys on, so it must NOT appear until
+        // we reach this terminal — otherwise a fast CI suite can promote a
+        // patch the bot is still reviewing (or about to iterate on).
+        await tryApplyLabels(effects, state.prNumber, [
+            AWAITING_CI_LABEL,
+            iterationLabel(state.iteration),
+        ]);
+    }
+    return state;
+}
+async function tryApplyLabels(effects, prNumber, labels) {
+    try {
+        await effects.applyLabels({ prNumber, labels });
+    }
+    catch (error) {
+        logger.error('fix-loop: failed to apply tracking labels to draft PR', {
+            task: 'fix-loop',
+            pr_number: prNumber,
+            labels,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+/**
+ * Drives the promotion flow from PUSHED_AWAITING_CI through CI verification.
+ * Terminates at DONE_PROMOTED or DONE_NEEDS_HUMAN, or returns the unchanged
+ * PUSHED_AWAITING_CI state when CI is still pending (the caller re-invokes
+ * on the next webhook delivery).
+ */
+export async function runPromotionFlow(effects, input) {
+    // Only the doistbot auto-fix workflow ever reaches CI promotion; the
+    // address_review path terminates at DONE_PR_UPDATED in-process and never
+    // invokes this entry point. The upstream webhook handler is responsible
+    // for filtering (e.g. by PR label) so this function is only called for
+    // issue_fix PRs.
+    const initial = {
+        kind: 'PUSHED_AWAITING_CI',
+        headSha: input.headSha,
+        prNumber: input.prNumber,
+        intent: 'issue_fix',
+        promotionPolicy: { kind: 'doistbot_fix_ci' },
+        maxIterations: 2,
+    };
+    // The webhook handler's atomic claim removed AWAITING_CI_LABEL before
+    // dispatching this task. Every exit path from here must either re-arm
+    // the label (pending CI, side-effect failure) or leave it off
+    // intentionally (terminal success / human escalation). Each side effect
+    // below is idempotent on GitHub's side, so a future webhook redelivery
+    // can safely re-enter promotion.
+    try {
+        const ciStatus = await effects.checkCIStatus(input.headSha);
+        const state = next(initial, { kind: 'CI_RESULT', status: ciStatus });
+        if (state.kind === 'PUSHED_AWAITING_CI') {
+            // CI still in flight. Re-arm so the next check_suite event can
+            // re-claim and re-dispatch.
+            await effects.applyLabels({
+                prNumber: input.prNumber,
+                labels: [AWAITING_CI_LABEL],
+            });
+            return state;
+        }
+        if (state.kind === 'DONE_PROMOTED') {
+            // Order matters: promoteToReady flips the PR out of draft and is
+            // effectively irreversible. Run it LAST so any failure on the
+            // reviewer/ask/comment steps re-arms awaiting-ci while the PR
+            // is still a draft — the next delivery re-runs the full sequence
+            // cleanly instead of seeing a half-promoted PR.
+            await effects.requestHeroReview(input.prNumber);
+            await effects.applyAskLabel(input.prNumber);
+            await effects.postIssueComment({
+                prNumber: input.prNumber,
+                marker: PROMOTION_COMMENT_MARKER,
+                body: 'CI passed — promoting this PR out of draft and requesting hero review.',
+            });
+            await effects.promoteToReady(input.prNumber);
+            return state;
+        }
+        if (state.kind === 'DONE_NEEDS_HUMAN') {
+            const labels = ciStatus.kind === 'failed'
+                ? [CI_FAILED_LABEL, NEEDS_HUMAN_LABEL]
+                : [NEEDS_HUMAN_LABEL];
+            await effects.applyLabels({ prNumber: input.prNumber, labels });
+            const body = ciStatus.kind === 'failed'
+                ? `CI failed for this fix attempt. Failing checks:\n${formatFailedChecks(ciStatus.failedChecks)}\n\nMarking this for human review.`
+                : ciStatus.kind === 'no_checks'
+                    ? 'No CI checks ran on this PR — please verify manually before merging.'
+                    : 'This PR needs human review.';
+            await effects.postIssueComment({
+                prNumber: input.prNumber,
+                marker: PROMOTION_COMMENT_MARKER,
+                body,
+            });
+            return state;
+        }
+        if (!isTerminal(state)) {
+            throw new Error(`runPromotionFlow: unexpected non-terminal state ${state.kind}`);
+        }
+        return state;
+    }
+    catch (error) {
+        await reapplyAwaitingCi(effects, input.prNumber, error);
+        throw error;
+    }
+}
+async function reapplyAwaitingCi(effects, prNumber, originalError) {
+    try {
+        await effects.applyLabels({ prNumber, labels: [AWAITING_CI_LABEL] });
+    }
+    catch (rearmError) {
+        // The original error is the primary failure operators need to see;
+        // surface the re-arm failure alongside it so the recovery hint
+        // ("awaiting-ci is still missing, redelivery will not retry") is
+        // visible, but don't replace the cause.
+        logger.error('runPromotionFlow: failed to re-apply awaiting-ci after side-effect failure', {
+            task: 'fix-loop-promotion',
+            pr_number: prNumber,
+            original_error: originalError instanceof Error ? originalError.message : String(originalError),
+            rearm_error: rearmError instanceof Error ? rearmError.message : String(rearmError),
+        });
+    }
+}

package/sandbox/dist/tasks/issue-triage/fix-loop/state-machine.js

@@ -0,0 +1,165 @@
+export function isTerminal(state) {
+    return (state.kind === 'DONE_PROMOTED' ||
+        state.kind === 'DONE_PR_UPDATED' ||
+        state.kind === 'DONE_NEEDS_HUMAN');
+}
+export function isFixLoopTerminal(state) {
+    return isTerminal(state) || state.kind === 'PUSHED_AWAITING_CI';
+}
+function blockers(findings) {
+    return findings.filter((f) => f.severity === 'P0' || f.severity === 'P1');
+}
+function invariant(state, event) {
+    throw new Error(`fix-loop: invalid event ${event.kind} for state ${state.kind}`);
+}
+function withMeta(base, meta) {
+    const out = { ...base };
+    if (meta.prNumber !== undefined)
+        out.prNumber = meta.prNumber;
+    if (meta.branch !== undefined)
+        out.branch = meta.branch;
+    return out;
+}
+function header(state) {
+    return {
+        intent: state.intent,
+        promotionPolicy: state.promotionPolicy,
+        maxIterations: state.maxIterations,
+    };
+}
+export function next(state, event) {
+    switch (state.kind) {
+        case 'AWAITING_FIRST_FIX': {
+            if (event.kind === 'FIX_PUSHED') {
+                return {
+                    kind: 'REVIEWING',
+                    iteration: 0,
+                    headSha: event.headSha,
+                    branch: event.branch,
+                    prNumber: event.prNumber,
+                    ...header(state),
+                };
+            }
+            if (event.kind === 'FIX_FAILED') {
+                return {
+                    kind: 'DONE_NEEDS_HUMAN',
+                    reason: event.reason,
+                    findings: [],
+                    ...header(state),
+                };
+            }
+            return invariant(state, event);
+        }
+        case 'REVIEWING': {
+            if (event.kind === 'REVIEW_UNVERIFIED') {
+                return withMeta({
+                    kind: 'DONE_NEEDS_HUMAN',
+                    reason: `Review unverified: ${event.reason}`,
+                    findings: [],
+                    ...header(state),
+                }, { prNumber: state.prNumber, branch: state.branch });
+            }
+            if (event.kind !== 'REVIEW_COMPLETE')
+                return invariant(state, event);
+            const blocking = blockers(event.findings);
+            if (blocking.length > 0) {
+                if (state.iteration + 1 < state.maxIterations) {
+                    return {
+                        kind: 'ITERATING',
+                        iteration: state.iteration + 1,
+                        findings: blocking,
+                        prevHeadSha: state.headSha,
+                        branch: state.branch,
+                        prNumber: state.prNumber,
+                        ...header(state),
+                    };
+                }
+                return withMeta({
+                    kind: 'DONE_NEEDS_HUMAN',
+                    reason: 'P0/P1 findings persisting after retry — manual review required',
+                    findings: event.findings,
+                    ...header(state),
+                }, { prNumber: state.prNumber, branch: state.branch });
+            }
+            if (state.promotionPolicy.kind === 'doistbot_fix_ci') {
+                return {
+                    kind: 'PUSHED_AWAITING_CI',
+                    iteration: state.iteration,
+                    headSha: state.headSha,
+                    prNumber: state.prNumber,
+                    branch: state.branch,
+                    ...header(state),
+                };
+            }
+            return withMeta({
+                kind: 'DONE_PR_UPDATED',
+                headSha: state.headSha,
+                ...header(state),
+            }, { prNumber: state.prNumber, branch: state.branch });
+        }
+        case 'ITERATING': {
+            if (event.kind === 'FIX_PUSHED') {
+                return {
+                    kind: 'REVIEWING',
+                    iteration: state.iteration,
+                    headSha: event.headSha,
+                    reviewBaseSha: state.prevHeadSha,
+                    branch: event.branch,
+                    prNumber: event.prNumber,
+                    ...header(state),
+                };
+            }
+            if (event.kind === 'FIX_FAILED') {
+                return withMeta({
+                    kind: 'DONE_NEEDS_HUMAN',
+                    reason: event.reason,
+                    findings: state.findings,
+                    ...header(state),
+                }, { prNumber: state.prNumber, branch: state.branch });
+            }
+            return invariant(state, event);
+        }
+        case 'PUSHED_AWAITING_CI': {
+            if (event.kind !== 'CI_RESULT')
+                return invariant(state, event);
+            const status = event.status;
+            // Ignore CI results carrying a SHA other than our current head.
+            // GitHub can deliver a check_suite for an earlier push after we
+            // have already pushed an iter-1 commit, in which case acting on
+            // the stale verdict would promote or escalate based on a SHA we
+            // have already superseded.
+            if (status.headSha !== state.headSha) {
+                return state;
+            }
+            if (status.kind === 'passed') {
+                return withMeta({
+                    kind: 'DONE_PROMOTED',
+                    headSha: status.headSha,
+                    ...header(state),
+                }, { prNumber: state.prNumber, branch: state.branch });
+            }
+            if (status.kind === 'failed') {
+                const failed = status.failedChecks.map((c) => c.name).join(', ');
+                return withMeta({
+                    kind: 'DONE_NEEDS_HUMAN',
+                    reason: `CI failed: ${failed || 'unknown checks'}`,
+                    findings: [],
+                    ...header(state),
+                }, { prNumber: state.prNumber, branch: state.branch });
+            }
+            if (status.kind === 'pending') {
+                return state;
+            }
+            return withMeta({
+                kind: 'DONE_NEEDS_HUMAN',
+                reason: 'No CI checks configured — manual review required',
+                findings: [],
+                ...header(state),
+            }, { prNumber: state.prNumber, branch: state.branch });
+        }
+        case 'DONE_PROMOTED':
+        case 'DONE_PR_UPDATED':
+        case 'DONE_NEEDS_HUMAN':
+            return invariant(state, event);
+    }
+}

package/sandbox/dist/tasks/issue-triage/hero-group-map.js

@@ -1,4 +1,5 @@
 import { normalizeScopedLabelValue, scopedLabelValue } from '../../core/label-parsing.js';
+import { PRODUCT_REPOSITORIES } from '../../core/repository-map.js';
 const HERO_GROUPS = {
     'android-hero': { key: 'android-hero', mention: '@Doist/android-hero' },
     'app-copy-hero': { key: 'app-copy-hero', mention: '@Doist/app-copy-hero' },
@@ -46,6 +47,37 @@ const SURFACE_TO_HERO = {
     web: 'frontend-hero',
 };
 export const CX_HERO_MANUAL_HANDLE = HERO_GROUPS['cx-hero'].mention;
+/**
+ * Looks up a known Doist repository by owner/repo in PRODUCT_REPOSITORIES.
+ * Returns the canonical RepositoryTarget (with surfaces) or undefined when
+ * the repo isn't in the registry. Used at session construction to populate
+ * targetRepo.repository.surfaces accurately, so downstream effects can
+ * reuse the surface map without re-scanning the registry.
+ */
+export function findRepositoryTarget(owner, repo) {
+    for (const list of Object.values(PRODUCT_REPOSITORIES)) {
+        const match = list.find((target) => target.owner === owner && target.repo === repo);
+        if (match) {
+            return match;
+        }
+    }
+    return undefined;
+}
+/**
+ * Derives the GitHub team slug (under the Doist org) for a PR's hero
+ * reviewer from a RepositoryTarget. The target's surfaces decide the team
+ * (web → frontend-hero, etc.). Falls back to cx-hero for unknown surfaces
+ * and for user-mention groups like dateist (`@amix`) that aren't real teams.
+ */
+export function resolveHeroTeamSlug(target) {
+    const group = resolveHeroGroup([], target);
+    if (!group || group.key === 'dateist') {
+        return 'cx-hero';
+    }
+    // The check above excluded `dateist`, so TS narrows group.key from
+    // HeroGroupKey to HeroTeamSlug here.
+    return group.key;
+}
 export function isKnownHeroRoutingLabel(label) {
     const teamValue = scopedLabelValue(label, 'Team');
     if (teamValue && TEAM_LABEL_TO_HERO[normalizeScopedLabelValue(teamValue)]) {

package/sandbox/dist/tasks/issue-triage/markers.js

@@ -1 +1,3 @@
 export const HERO_AUTOFIX_MARKER = '<!--doistbot-autofix-followup-->';
+export const FIX_LOOP_START_MARKER = '<!--doistbot-fixloop-start-->';
+export const AUTOFIX_FAILURE_MARKER = '<!--doistbot-autofix-failure-->';

package/sandbox/dist/tasks/issue-triage/output.js

@@ -25,16 +25,37 @@ function hasHeading(body, heading) {
     const regex = new RegExp(`^${escapedHeading}\\s*$`, 'im');
     return regex.test(body);
 }
+function buildTriageCommentOutput(output) {
+    const findingsMatch = output.match(/^## Findings\s*$/m);
+    if (findingsMatch?.index === undefined) {
+        return output;
+    }
+    const summary = output.slice(0, findingsMatch.index).trim();
+    const details = output.slice(findingsMatch.index).trim();
+    return [
+        summary,
+        '',
+        '<details>',
+        '<summary>Details</summary>',
+        '',
+        details,
+        '',
+        '</details>',
+    ].join('\n');
+}
 export function ensureStructuredTriageOutput(rawOutput) {
-    const missingSections = REQUIRED_HEADINGS.filter((heading) => !hasHeading(rawOutput, heading));
+    const output = rawOutput.trim();
+    const missingSections = REQUIRED_HEADINGS.filter((heading) => !hasHeading(output, heading));
     if (missingSections.length === 0) {
         return {
-            output: rawOutput.trim(),
+            output,
+            commentOutput: buildTriageCommentOutput(output),
             missingSections: [],
         };
     }
     return {
-        output: rawOutput.trim(),
+        output,
+        commentOutput: output,
         missingSections,
     };
 }

package/sandbox/dist/tasks/issue-triage/pr-creator.js

@@ -32,9 +32,15 @@ export function findPRTemplate(repoLocalPath) {
     }
     return null;
 }
+// TODO: extract into a shared module consumed by both `apps/sandbox` and
+// `apps/webhook-handler`. The webhook handler hardcodes the same prefix in
+// `apps/webhook-handler/src/tasks/promotion-ci-gate/index.ts`
+// (`DOISTBOT_BRANCH_PREFIX`) to fast-path filter `check_suite.completed`
+// events before any API call. If this value changes, update both sites.
+const DOISTBOT_BRANCH_PREFIX = 'doistbot/';
 function generateBranchName(issueNumber) {
     const timestamp = Math.floor(Date.now() / 1000);
-    return `doistbot/auto-fix/issue-${issueNumber}-${timestamp}`;
+    return `${DOISTBOT_BRANCH_PREFIX}auto-fix/issue-${issueNumber}-${timestamp}`;
 }
 export async function resolveInstallationIdForRepo({ app, owner, repo, fallbackInstallationId, }) {
     try {
@@ -61,19 +67,6 @@ const GIT_IDENTITY_ENV = {
     GIT_COMMITTER_NAME: 'Doistbot',
     GIT_COMMITTER_EMAIL: 'doistbot@users.noreply.github.com',
 };
-function createBranchAndCommit({ repoLocalPath, branch, issueNumber, issueTitle, prTitle, }) {
-    const titleLine = prTitle ?? `fix: ${issueTitle}`;
-    const commitMessage = `${titleLine} (#${issueNumber})\n\nAutomated fix generated by Doistbot based on triage analysis.\nIssue: #${issueNumber}`;
-    const execOptions = {
-        cwd: repoLocalPath,
-        encoding: 'utf8',
-        stdio: 'pipe',
-        env: { ...process.env, ...GIT_IDENTITY_ENV },
-    };
-    execFileSync('git', ['checkout', '-b', branch], execOptions);
-    // Files are already staged by captureGitDiff in fix-attempt.ts
-    execFileSync('git', ['commit', '-m', commitMessage], execOptions);
-}
 function pushBranch({ repoLocalPath, branch, token, owner, repo, }) {
     const credentials = Buffer.from(`x-access-token:${token}`).toString('base64');
     const remoteUrl = `https://github.com/${owner}/${repo}.git`;
@@ -90,6 +83,29 @@ function pushBranch({ repoLocalPath, branch, token, owner, repo, }) {
         },
     });
 }
+function commitAndPushBranch({ repoLocalPath, checkoutArgs, commitMessage, branch, githubToken, repoOwner, repoName, }) {
+    const execOptions = {
+        cwd: repoLocalPath,
+        encoding: 'utf8',
+        stdio: 'pipe',
+        env: { ...process.env, ...GIT_IDENTITY_ENV },
+    };
+    execFileSync('git', checkoutArgs, execOptions);
+    // Files are already staged by captureGitDiff in fix-attempt.ts
+    execFileSync('git', ['commit', '-m', commitMessage], execOptions);
+    pushBranch({
+        repoLocalPath,
+        branch,
+        token: githubToken,
+        owner: repoOwner,
+        repo: repoName,
+    });
+    return execFileSync('git', ['rev-parse', 'HEAD'], {
+        cwd: repoLocalPath,
+        encoding: 'utf8',
+        stdio: 'pipe',
+    }).trim();
+}
 /**
  * Strips markdown sections whose body contains no meaningful content.
  * A section is considered empty when its body (between this heading and the
@@ -197,31 +213,23 @@ function buildPRBody({ issueNumber, issueUrl, triageAnalysis, fixDescription, fi
 }
 export async function commitAndPushFix(input) {
     const branch = generateBranchName(input.issueNumber);
+    const titleLine = input.prTitle ?? `fix: ${input.issueTitle}`;
+    const commitMessage = `${titleLine} (#${input.issueNumber})\n\nAutomated fix generated by Doistbot based on triage analysis.\nIssue: #${input.issueNumber}`;
     logger.info('Creating fix PR', {
         task: 'issue-triage',
         repository: `${input.repoOwner}/${input.repoName}`,
         issueNumber: input.issueNumber,
         branch,
     });
-    createBranchAndCommit({
-        repoLocalPath: input.repoLocalPath,
-        branch,
-        issueNumber: input.issueNumber,
-        issueTitle: input.issueTitle,
-        prTitle: input.prTitle,
-    });
-    pushBranch({
+    const headSha = commitAndPushBranch({
         repoLocalPath: input.repoLocalPath,
+        checkoutArgs: ['checkout', '-b', branch],
+        commitMessage,
         branch,
-        token: input.githubToken,
-        owner: input.repoOwner,
-        repo: input.repoName,
+        githubToken: input.githubToken,
+        repoOwner: input.repoOwner,
+        repoName: input.repoName,
     });
-    const headSha = execFileSync('git', ['rev-parse', 'HEAD'], {
-        cwd: input.repoLocalPath,
-        encoding: 'utf8',
-        stdio: 'pipe',
-    }).trim();
     logger.info('Fix branch pushed, creating draft PR', {
         task: 'issue-triage',
         repository: `${input.repoOwner}/${input.repoName}`,
@@ -229,6 +237,40 @@ export async function commitAndPushFix(input) {
     });
     return { branch, headSha };
 }
+/**
+ * Commits + pushes a second fix attempt on the EXISTING iter-0 branch. Unlike
+ * commitAndPushFix, this does not create a new branch — callers (the fix loop's
+ * iter-1 path) need the existing draft PR to pick up the new commit, which only
+ * works if we push to the same branch the PR was opened from.
+ *
+ * Assumes the working tree already has the iter-1 changes staged (typically by
+ * runFixCore's captureGitDiff `git add -A`) and that the repo is currently on
+ * `branch` (the case after iter-0 push + iter-1 `git reset --hard <iter0Sha>`).
+ */
+export async function commitAndPushIteration(input) {
+    const titleLine = input.prTitle ?? `fix: ${input.issueTitle}`;
+    const commitMessage = `${titleLine} (iteration) (#${input.issueNumber})\n\nFollow-up fix addressing prior review findings.\nIssue: #${input.issueNumber}`;
+    // Defensive: make sure we are on the iter-0 branch before committing. The
+    // iter-1 codex run does `git reset --hard <iter0Sha>` which preserves the
+    // current branch, so this should be a no-op, but a checkout makes the
+    // invariant explicit.
+    const headSha = commitAndPushBranch({
+        repoLocalPath: input.repoLocalPath,
+        checkoutArgs: ['checkout', input.branch],
+        commitMessage,
+        branch: input.branch,
+        githubToken: input.githubToken,
+        repoOwner: input.repoOwner,
+        repoName: input.repoName,
+    });
+    logger.info('Fix iteration pushed to existing branch', {
+        task: 'issue-triage',
+        repository: `${input.repoOwner}/${input.repoName}`,
+        branch: input.branch,
+        issueNumber: input.issueNumber,
+    });
+    return { headSha };
+}
 export async function openDraftFixPR(input) {
     const prBody = input.prBody
         ? stripEmptySections(input.prBody)

package/sandbox/dist/tasks/issue-triage/repo-config.js

@@ -5,6 +5,19 @@ export function isAutoFixEnabled(config) {
 export function isAutoTriageEnabled(config) {
     return config?.issue_triage?.enable_auto_triage !== false;
 }
+export function getAutoFixMode(config, enableAutoFixOverride) {
+    if (enableAutoFixOverride === false) {
+        return 'disabled';
+    }
+    if (enableAutoFixOverride !== true && !isAutoFixEnabled(config)) {
+        return 'disabled';
+    }
+    const useFixLoop = config?.issue_triage?.use_fix_loop;
+    if (useFixLoop !== undefined && useFixLoop !== true) {
+        return 'one-pass';
+    }
+    return 'fix-loop';
+}
 export function createRepoConfigLoader({ octokit, logger, }) {
     const cache = new Map();
     return async function loadRepoConfig(repository) {