@doist/doistbot-cli 1.0.14 → 1.0.15

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@doist/doistbot-cli",
-    "version": "1.0.14",
+    "version": "1.0.15",
     "description": "Local self-review CLI for Doistbot",
     "type": "module",
     "main": "dist/index.js",
@@ -51,7 +51,7 @@
         "commander": "14.0.3",
         "js-yaml": "4.3.2",
         "octokit": "5.0.5",
-        "undici": "8.10.2",
+        "undici": "8.11.2",
         "yocto-spinner": "1.2.2"
     },
     "devDependencies": {

package/sandbox/_node_modules/doistbot-logging/dist/index.d.ts

@@ -7,6 +7,8 @@ export type LoggerOptions = {
     suppressLogs?: (level: LogLevel) => boolean;
     suppressInfoLogs?: () => boolean;
     includeLogField?: boolean;
+    /** Receives serialized JSON without a trailing newline. The writer must add one. */
+    write?: (line: string) => void;
     buildInfo?: {
         version: number;
         commit: string;

package/sandbox/_node_modules/doistbot-logging/dist/index.js

@@ -33,8 +33,14 @@ export function createLogger(options = {}) {
         }
         Object.assign(payload, traceInfo);
         payload.meta = metaInfo;
-        // eslint-disable-next-line no-console
-        console.log(JSON.stringify(payload));
+        const line = JSON.stringify(payload);
+        if (options.write) {
+            options.write(line);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.log(line);
+        }
     }
     return {
         info: (message, meta) => log('info', message, meta),

package/sandbox/dist/core/pi-tool-output-filter-extension.js

@@ -0,0 +1,59 @@
+import { writeSync } from 'node:fs';
+import { scrubPii } from './pii-scrubber.js';
+// Pi applies tool_result changes before sending the result to the model. Filter
+// all text tools so redirecting CLI output to a file cannot bypass filtering.
+// eslint-disable-next-line import/no-default-export
+export default function toolOutputFilterExtension(pi) {
+    const secrets = Object.entries(process.env)
+        .filter(([key, value]) => /(?:KEY|TOKEN|PASSWORD|SECRET)$/.test(key) && value && value.length >= 8)
+        .map(([, value]) => value);
+    function filterText(value) {
+        for (const secret of secrets)
+            value = value.split(secret).join('[REDACTED_SECRET]');
+        return scrubPii(value);
+    }
+    function filterValue(value) {
+        if (typeof value === 'string')
+            return filterText(value);
+        if (Array.isArray(value))
+            return value.map(filterValue);
+        if (value && typeof value === 'object')
+            return Object.fromEntries(Object.entries(value).map(([key, entry]) => [filterText(key), filterValue(entry)]));
+        return value;
+    }
+    pi.on('tool_call', (event) => {
+        try {
+            // Pi redirects process.stdout writes to stderr in JSON mode.
+            // Write this protocol record directly to its stdout pipe.
+            writeSync(1, `${JSON.stringify({
+                type: 'doistbot_tool_audit',
+                tool: event.toolName,
+                // Audit queries/commands, never service response bodies.
+                input: JSON.stringify(filterValue(event.input)).slice(0, 8_000),
+            })}\n`);
+        }
+        catch {
+            return { block: true, reason: 'Tool query could not be safely recorded.' };
+        }
+        return undefined;
+    });
+    pi.on('tool_result', (event) => {
+        try {
+            return {
+                content: event.content.map((item) => item.type === 'text' ? { ...item, text: filterText(item.text) } : item),
+                details: filterValue(event.details ?? null),
+            };
+        }
+        catch {
+            // Pi otherwise ignores extension errors and keeps the original
+            // result. Explicitly replace it so a filter failure cannot leak text.
+            return {
+                content: [
+                    { type: 'text', text: 'Tool output withheld: filtering failed.' },
+                ],
+                details: null,
+                isError: true,
+            };
+        }
+    });
+}

package/sandbox/dist/core/pi.js

@@ -3,7 +3,9 @@ import { mkdtempSync, rmSync, writeFileSync } from 'fs';
 import { tmpdir } from 'os';
 import path from 'path';
 import { fileURLToPath } from 'url';
+import { logger } from './logging.js';
 import { PI_EXECUTION_LIMIT_ENV } from './pi-execution-limits-extension.js';
+import { approvedSkillArgs, buildToolEnvironment } from './tool-environment.js';
 export function toPiInvocationTelemetryFields(telemetry) {
     return {
         turn_count: telemetry.turnCount,
@@ -54,7 +56,7 @@ export const DEFAULT_PI_MODELS = {
     gemini: 'gemini-3.1-pro-preview',
     grok: 'grok-4.6',
     zai: 'glm5.2',
-    openai: 'gpt-6-sol',
+    openai: 'gpt-6.1-sol',
 };
 export const DEFAULT_OPENROUTER_MODELS = {
     deepseek: 'deepseek/deepseek-v4-pro-0813',
@@ -95,6 +97,7 @@ function resolvePiCliPath() {
 }
 const PI_CLI_PATH = resolvePiCliPath();
 const PI_EXECUTION_LIMIT_EXTENSION_PATH = fileURLToPath(new URL('./pi-execution-limits-extension.js', import.meta.url));
+const PI_TOOL_OUTPUT_FILTER_EXTENSION_PATH = fileURLToPath(new URL('./pi-tool-output-filter-extension.js', import.meta.url));
 let cachedNodeExecutable;
 let cachedOpenRouterSessionExtensionPath;
 export function resolveNodeExecutable({ execPath = process.execPath, argv0 = process.argv0, canExecute = canExecuteNode, } = {}) {
@@ -416,7 +419,11 @@ export function createPiInvoker({ provider, apiKey, piProviderId, cwd, extraEnv,
                 'json',
                 '--no-session',
                 '--no-extensions',
+                ...(process.env.SANDBOX_PROFILE
+                    ? ['--extension', PI_TOOL_OUTPUT_FILTER_EXTENSION_PATH]
+                    : []),
                 '--no-skills',
+                ...approvedSkillArgs(),
                 '--no-prompt-templates',
                 ...(noContextFiles ? ['--no-context-files'] : []),
                 '--model',
@@ -428,21 +435,11 @@ export function createPiInvoker({ provider, apiKey, piProviderId, cwd, extraEnv,
                 ...executionLimitExtension.args,
                 ...imageArgs,
             ];
-            const inheritedEnv = {
-                ...process.env,
-            };
-            // Repository-scoped credentials must be passed explicitly through
-            // extraEnv by an authorized task invocation.
-            delete inheritedEnv.GH_PACKAGES_TOKEN;
-            const childEnv = {
-                ...inheritedEnv,
-                HOME: process.env.HOME,
-                PATH: process.env.PATH,
-                GIT_TERMINAL_PROMPT: '0',
+            const childEnv = buildToolEnvironment({
                 ...extraEnv,
                 ...openRouterSessionExtension.extraEnv,
                 ...executionLimitExtension.extraEnv,
-            };
+            });
             const apiKeyEnvVar = PI_API_KEY_ENV_VAR_BY_PI_PROVIDER[resolvedPiProviderId];
             if (piAuthProviderId) {
                 delete childEnv[apiKeyEnvVar];
@@ -450,7 +447,6 @@ export function createPiInvoker({ provider, apiKey, piProviderId, cwd, extraEnv,
             else {
                 childEnv[apiKeyEnvVar] = apiKey;
             }
-            delete childEnv.GITHUB_TOKEN;
             try {
                 const child = spawn(resolveNodeExecutable(), args, {
                     cwd,
@@ -576,6 +572,13 @@ export function createPiInvoker({ provider, apiKey, piProviderId, cwd, extraEnv,
                         }
                         try {
                             const parsed = JSON.parse(trimmed);
+                            if (parsed.type === 'doistbot_tool_audit') {
+                                logger.info('Sandbox tool query', {
+                                    tool: parsed.tool,
+                                    input: parsed.input,
+                                });
+                                continue;
+                            }
                             if (parsed.type === 'session') {
                                 sessionHeaderSeen = true;
                                 continue;

package/sandbox/dist/core/tool-environment.js

@@ -0,0 +1,22 @@
+/** Prepare credentials for Pi shell tools. */
+export function buildToolEnvironment(extraEnv = {}, inherited = process.env) {
+    const env = { ...inherited };
+    delete env.GH_PACKAGES_TOKEN;
+    Object.assign(env, extraEnv);
+    delete env.GITHUB_TOKEN;
+    delete env.PRIVATE_KEY;
+    env.GIT_TERMINAL_PROMPT = '0';
+    env.DD_API_KEY = env.DD_API_KEY ?? env.DATADOG_API_KEY;
+    env.DD_APP_KEY = env.DD_APP_KEY ?? env.DATADOG_APP_KEY;
+    env.DD_SITE = env.DD_SITE?.trim() || env.DATADOG_SITE?.trim() || 'datadoghq.com';
+    return env;
+}
+export function approvedSkillArgs(env = process.env) {
+    if (!env.SANDBOX_PROFILE)
+        return [];
+    const skills = ['/app/apps/sandbox/skills/investigation/SKILL.md'];
+    if (env.SANDBOX_PROFILE === 'android') {
+        skills.push('/app/apps/sandbox/skills/agent-device/SKILL.md');
+    }
+    return skills.flatMap((skill) => ['--skill', skill]);
+}

package/sandbox/dist/tasks/issue-triage/fix-attempt.js

@@ -9,6 +9,7 @@ import { CX_HERO_MANUAL_HANDLE, resolveHeroGroup } from './hero-group-map.js';
 import { AUTOFIX_FAILURE_MARKER, FIX_LOOP_START_MARKER, HERO_AUTOFIX_MARKER } from './markers.js';
 import { invokeTriageModel } from './model.js';
 import { commitAndPushFix, findPRTemplate, openDraftFixPR } from './pr-creator.js';
+import { sandboxEnvironmentError } from './sandbox-environment.js';
 const FIX_PROMPT_FILE = 'issue-triage-fix-prompt.md';
 // Maximum time allowed for the Codex fix-generation invocation before we abort
 const AUTO_FIX_CODEX_TIMEOUT_MS = 45 * 60 * 1000;
@@ -330,6 +331,9 @@ export async function runFixCore(input) {
             reason: buildFixAssessmentSkipReason(fixAssessment),
         };
     }
+    const environmentError = sandboxEnvironmentError(targetRepo.repository.fullName);
+    if (environmentError)
+        return { ok: false, reason: environmentError };
     const capabilityEnvResult = resolveAutofixCapabilityEnv(targetRepo.repository.fullName);
     if (!capabilityEnvResult.ok) {
         return capabilityEnvResult;

package/sandbox/dist/tasks/issue-triage/sandbox-environment.js

@@ -0,0 +1,53 @@
+import { repositorySandboxProfile, SANDBOX_PROFILES } from 'doistbot-issue-routing';
+function readSelection() {
+    if (!process.env.SANDBOX_SELECTION)
+        return undefined;
+    const selection = JSON.parse(process.env.SANDBOX_SELECTION);
+    function strings(value) {
+        return Array.isArray(value) && value.every((item) => typeof item === 'string');
+    }
+    if (!selection ||
+        !strings(selection.repositories) ||
+        !strings(selection.labels) ||
+        !strings(selection.verificationLimits) ||
+        typeof selection.reason !== 'string' ||
+        (selection.profile !== 'legacy' &&
+            (!SANDBOX_PROFILES.includes(selection.profile) || typeof selection.image !== 'string')))
+        throw new Error('Invalid sandbox selection.');
+    return selection;
+}
+/** Check image identity only. Repo setup and required checks belong to issue #524. */
+export function sandboxEnvironmentError(repository) {
+    let selection;
+    try {
+        selection = readSelection();
+    }
+    catch {
+        return 'Invalid sandbox selection.';
+    }
+    if (!selection)
+        return undefined;
+    if (!selection.repositories.some((candidate) => candidate.toLowerCase() === repository.toLowerCase()))
+        return 'Fix target is outside the recorded sandbox scope.';
+    // Mixed scopes deliberately retain the existing image and autofix behavior.
+    if (selection.profile === 'legacy')
+        return undefined;
+    const profile = repositorySandboxProfile(repository, selection.labels);
+    if (selection.profile !== profile ||
+        process.env.SANDBOX_PROFILE !== profile ||
+        process.env.SANDBOX_IMAGE_ID !== selection.image)
+        return 'Unsupported fix environment: target needs a different image. Cross-image fix dispatch is not enabled.';
+    return undefined;
+}
+export function describeSandboxEnvironment() {
+    let selection;
+    try {
+        selection = readSelection();
+    }
+    catch {
+        return '\n\nSandbox selection is invalid; automatic fixes are unavailable.';
+    }
+    if (!selection)
+        return '';
+    return `\n\n## Sandbox environment\nProfile: ${selection.profile}. ${selection.reason}\n${selection.verificationLimits.join('\n')}\nInstalled tools do not prove that repository builds or tests passed. Report only checks actually performed.`;
+}

package/sandbox/dist/tasks/issue-triage/triage.js

@@ -17,6 +17,7 @@ import { fillTemplate, loadPromptTemplate } from './prompt.js';
 import { allRepositoriesAllow, createRepoConfigLoader, isAutoFixEnabled, isAutoTriageEnabled, } from './repo-config.js';
 import { resolveTriageScope } from './resolution.js';
 import { buildHeroRoutingComment, postTriageRouting, shouldPostHeroRoutingComment, } from './routing.js';
+import { describeSandboxEnvironment } from './sandbox-environment.js';
 import { createGitHubClients, getIssueUrl, prepareWorkspaceReposDirectory } from './shared.js';
 import { deleteAutoTriagePlaceholder, postTriageOutput } from './side-effects.js';
 const MAX_ISSUE_BODY_CHARS = 8_000;
@@ -238,7 +239,7 @@ async function runIssueTriagePipeline(ctx, mode) {
                 type: 'installation',
                 installationId: ctx.installationId,
             }));
-            const prompt = buildPrompt({
+            let prompt = buildPrompt({
                 ctx,
                 issue,
                 comments,
@@ -247,6 +248,7 @@ async function runIssueTriagePipeline(ctx, mode) {
                 decisionPath: resolution.decisionPath,
                 enableAutoFix,
             });
+            prompt += describeSandboxEnvironment();
             const triageResult = await invokeTriageModel({
                 prompt,
                 apiKey: ctx.openaiApiKey,

package/sandbox/node_modules/doistbot-logging/dist/index.d.ts

@@ -7,6 +7,8 @@ export type LoggerOptions = {
     suppressLogs?: (level: LogLevel) => boolean;
     suppressInfoLogs?: () => boolean;
     includeLogField?: boolean;
+    /** Receives serialized JSON without a trailing newline. The writer must add one. */
+    write?: (line: string) => void;
     buildInfo?: {
         version: number;
         commit: string;

package/sandbox/node_modules/doistbot-logging/dist/index.js

@@ -33,8 +33,14 @@ export function createLogger(options = {}) {
         }
         Object.assign(payload, traceInfo);
         payload.meta = metaInfo;
-        // eslint-disable-next-line no-console
-        console.log(JSON.stringify(payload));
+        const line = JSON.stringify(payload);
+        if (options.write) {
+            options.write(line);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.log(line);
+        }
     }
     return {
         info: (message, meta) => log('info', message, meta),

package/sandbox/src/review/prompts/service-production-readiness.md

@@ -73,6 +73,8 @@ Any state that must survive restarts must be stored externally, e.g.:
 
 Local disk may be used only for temporary data.
 
+Durable state must be backed up. DynamoDB tables must have [point-in-time recovery](https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/Point-in-time-recovery.html) enabled and carry the account's `Backup` tag so the AWS Backup plan selects them. Caches, lock tables and short-lived session tables with a TTL are exempt.
+
 ## Resource Limits
 
 Define expected CPU, memory, network, and local disk usage.