@fitlab-ai/agent-infra 0.9.0 → 0.9.2

package/dist/lib/platform/verification-required.js

@@ -1,8 +1,10 @@
 import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+import { hasPlatformCapability } from "./adapters.js";
 import { inspectRequiredChecks } from "./pr-checks.js";
 import { resolvePlatformContext } from "./context.js";
+import { resolveReviewedHeadRelation } from "./merged-pr-equivalence.js";
 const CHECK_TYPE = "required-checks";
 const SHA_PATTERN = /^[0-9a-f]{7,40}$/i;
 function validPrNumber(value) {
@@ -44,13 +46,27 @@ export function evaluateRequiredChecks(context, shared) {
     if (inspection.status === "failed") {
         return shared.failResult(CHECK_TYPE, inspection.error?.message || "Required checks are unavailable", "check_failed");
     }
-    const prHead = inspection.pullRequest?.headSha;
-    if (!prHead || localHead !== reviewedHead || localHead !== prHead) {
-        return shared.failResult(CHECK_TYPE, "Local HEAD, last reviewed commit, and PR head must match", "check_failed");
+    const prHead = inspection.pullRequest?.head?.sha || inspection.pullRequest?.headSha;
+    const relation = context.relation || (context.gitRoot && inspection.pullRequest?.head
+        ? resolveReviewedHeadRelation({
+            gitRoot: context.gitRoot,
+            comparisonHead: localHead,
+            lastReviewedCommit: reviewedHead,
+            pullRequest: inspection.pullRequest
+        })
+        : localHead === reviewedHead && localHead === prHead
+            ? { status: "strict" }
+            : { status: "failed" });
+    if (relation.status !== "strict" && relation.status !== "merged-equivalent") {
+        const message = relation.message || "Local HEAD, last reviewed commit, and PR head must match";
+        return relation.status === "blocked"
+            ? shared.blockedResult(CHECK_TYPE, message, "dependency_error")
+            : shared.failResult(CHECK_TYPE, message, "check_failed");
     }
     const state = inspection.checks?.state;
     if (state === "passed" || state === "no-required") {
-        return shared.passResult(CHECK_TYPE, `Required checks are ${state} for PR head ${prHead}`);
+        const suffix = relation.status === "merged-equivalent" ? " via verified squash merge equivalence" : "";
+        return shared.passResult(CHECK_TYPE, `Required checks are ${state} for PR head ${prHead}${suffix}`);
     }
     if (state === "pending") {
         return shared.blockedResult(CHECK_TYPE, inspection.error?.message || "Required checks are pending", "check_pending");
@@ -61,18 +77,24 @@ export function check({ taskDir }, shared) {
     const task = shared.loadTask(taskDir);
     if (!task.ok)
         return shared.failResult(CHECK_TYPE, task.message);
-    const platform = resolvePlatformContext({ cwd: shared.repoRoot });
-    if (platform.platform.type !== "github") {
-        return shared.passResult(CHECK_TYPE, "Skipped: this code platform does not provide required checks");
-    }
     const prFlow = readPrFlow(shared.repoRoot);
     if (prFlow === "disabled" || task.metadata.pr_status === "skipped" || !validPrNumber(task.metadata.pr_number)) {
         return evaluateRequiredChecks({ metadata: task.metadata, localHead: null, inspection: null, prFlow }, shared);
     }
+    const platform = resolvePlatformContext({ cwd: shared.repoRoot });
+    if (!hasPlatformCapability(platform.platform.type, "required-checks")) {
+        return shared.blockedResult(CHECK_TYPE, `Platform '${platform.platform.type || "none"}' does not provide required-checks inspection`, "dependency_error");
+    }
     const localHead = readHead(shared.repoRoot);
     if (!localHead)
         return evaluateRequiredChecks({ metadata: task.metadata, localHead, inspection: null, prFlow }, shared);
     const inspection = inspectRequiredChecks(task.metadata.id, { cwd: shared.repoRoot });
-    return evaluateRequiredChecks({ metadata: task.metadata, localHead, inspection, prFlow }, shared);
+    return evaluateRequiredChecks({
+        metadata: task.metadata,
+        localHead,
+        inspection,
+        prFlow,
+        gitRoot: shared.repoRoot
+    }, shared);
 }
 //# sourceMappingURL=verification-required.js.map

package/dist/lib/prompt.js

@@ -74,18 +74,30 @@ async function select(question, choices, defaultValue) {
     }
     return trimmed;
 }
-async function multiSelect(question, choices) {
+async function multiSelect(question, choices, defaultIds = choices.map((choice) => choice.id)) {
+    const choiceIds = new Set(choices.map((choice) => choice.id));
+    if (defaultIds.some((id) => !choiceIds.has(id))) {
+        throw new Error('Default selection contains an unknown id');
+    }
+    const normalizedDefaults = choices
+        .map((choice) => choice.id)
+        .filter((id) => defaultIds.includes(id));
     process.stdout.write(`  ${question}:\n`);
     const idWidth = Math.max(...choices.map((c) => c.id.length));
     choices.forEach((c, i) => {
         process.stdout.write(`      ${i + 1}) ${c.id.padEnd(idWidth)}  (${c.label})\n`);
     });
-    ask('Enter comma-separated numbers or ids to keep, or "none" to select nothing [default: all]: ');
+    const defaultLabel = normalizedDefaults.length === choices.length
+        ? 'all'
+        : normalizedDefaults.length === 0
+            ? 'none'
+            : normalizedDefaults.join(',');
+    ask(`Enter comma-separated numbers or ids to keep, or "none" to select nothing [default: ${defaultLabel}]: `);
     setupInterface();
     const line = await nextLine();
     // Strictly distinguish bare Enter (null/empty string) from whitespace input.
     if (line === null || line === '')
-        return choices.map((c) => c.id);
+        return normalizedDefaults;
     // Explicit empty selection: "none" means deliberately zero built-in choices.
     if (line.trim().toLowerCase() === 'none')
         return [];

package/dist/lib/release/channels.js

@@ -21,7 +21,10 @@ async function inspectHomebrewChannel(url, version, fetcher = fetch) {
             return { status: 'blocked', published: null, version, error: { code: 'HOMEBREW_UNAVAILABLE', message: `formula endpoint returned ${response.status}` } };
         const formula = await response.text();
         const escaped = version.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-        return { status: 'no-op', published: new RegExp(`(?:version\\s+["']${escaped}["']|/v?${escaped}\\.)`).test(formula), version, error: null };
+        const formulaUrl = /^\s*url\s+["']([^"']+)["']\s*$/m.exec(formula)?.[1] ?? '';
+        const npmTarball = new RegExp(`^https://registry\\.npmjs\\.org/.+/-/[^/]+-${escaped}\\.tgz$`).test(formulaUrl);
+        const bottle = /^\s*bottle do\s*$/m.test(formula);
+        return { status: 'no-op', published: npmTarball && bottle, version, error: null };
     }
     catch (error) {
         return { status: 'blocked', published: null, version, error: { code: 'HOMEBREW_UNAVAILABLE', message: error instanceof Error ? error.message : String(error) } };

package/dist/lib/release/workflow.js

@@ -1,5 +1,5 @@
 function deriveReleasePhase(facts) {
-    if (!facts.localTag)
+    if (!facts.localTag && !facts.localTagAncestor)
         return 'unprepared';
     if (!facts.remoteBranch && !facts.remoteTag)
         return 'prepared';
@@ -18,8 +18,10 @@ async function runReleaseAction(input) {
     const before = releaseSnapshot(input.version, await input.inspect());
     if (input.action === 'inspect')
         return { status: 'no-op', changed: false, before, snapshot: before, error: null };
+    if (before.facts.localTagConflict)
+        return { status: 'failed', changed: false, before, snapshot: before, error: { code: 'GIT_TAG_CONFLICT', message: `Tag ${before.tag} is not reachable from HEAD` } };
     const allowed = input.action === 'prepare' ? before.phase === 'unprepared'
-        : input.action === 'publish' ? ['prepared', 'partially-published'].includes(before.phase)
+        : input.action === 'publish' ? before.facts.localTag && ['prepared', 'partially-published'].includes(before.phase)
             : ['published', 'post-pending'].includes(before.phase);
     if (!allowed)
         return { status: before.phase === 'complete' ? 'no-op' : 'failed', changed: false, before, snapshot: before, error: before.phase === 'complete' ? null : { code: 'RELEASE_PHASE_INVALID', message: `Cannot ${input.action} from ${before.phase}` } };

package/dist/lib/remove-dir.js

@@ -0,0 +1,25 @@
+import fs from 'node:fs';
+import path from 'node:path';
+export function removeDirRecursive(dir) {
+    if (!fs.existsSync(dir)) {
+        return;
+    }
+    const pending = [dir];
+    const directories = [];
+    while (pending.length > 0) {
+        const current = pending.pop();
+        const stat = fs.lstatSync(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink()) {
+            fs.unlinkSync(current);
+            continue;
+        }
+        directories.push(current);
+        for (const entry of fs.readdirSync(current)) {
+            pending.push(path.join(current, entry));
+        }
+    }
+    for (const directory of directories.reverse()) {
+        fs.rmdirSync(directory);
+    }
+}
+//# sourceMappingURL=remove-dir.js.map

package/dist/lib/run/tui.js

@@ -1,3 +1,5 @@
+import { renderAgentClientInvocation } from '../agent-clients/invocation.js';
+import { getAgentClientAdapter } from '../agent-clients/registry.js';
 const TUI_NAMES = new Set(['claude', 'codex', 'gemini', 'opencode']);
 function isTuiName(value) {
     return typeof value === 'string' && TUI_NAMES.has(value);
@@ -17,8 +19,12 @@ export function selectTui(skill, options) {
 }
 export function renderPrompt(params) {
     const suffix = [params.skill, ...params.args].join(' ').trim();
-    if (params.tui === 'codex')
-        return `$${suffix}`;
+    if (params.tui === 'codex') {
+        return renderAgentClientInvocation(getAgentClientAdapter('codex').invocation, {
+            skillName: params.skill,
+            args: params.args
+        });
+    }
     if (params.tui === 'gemini')
         return `/agent-infra:${suffix}`;
     return `/${suffix}`;

package/dist/lib/sandbox/agent-client-reconciler.js

@@ -0,0 +1,234 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { isAgentClientId } from '../agent-clients/types.js';
+import { listAgentClientAdapters, listInstalledAgentClientAdapters } from '../agent-clients/registry.js';
+import { hostJoin } from './engines/wsl2-paths.js';
+const DEFAULT_SANDBOX_HOOK_TIMEOUT_MS = 30_000;
+function agentInfraTool(home) {
+    return {
+        id: 'agent-infra',
+        name: 'agent-infra CLI',
+        install: { type: 'npm', cmd: '@fitlab-ai/agent-infra@latest' },
+        sandboxBase: hostJoin(home, '.agent-infra', 'sandboxes', 'agent-infra'),
+        containerMount: '/home/devuser/.agent-infra-cli',
+        versionCmd: 'ai version --raw',
+        setupHint: 'Provides the ai and agent-infra CLI commands inside the sandbox.'
+    };
+}
+function compatAgentClientState(tools) {
+    return Object.fromEntries(listAgentClientAdapters().map((adapter) => [
+        adapter.id,
+        {
+            enabled: true,
+            installInSandbox: tools.includes(adapter.id)
+        }
+    ]));
+}
+function stableValue(value) {
+    if (Array.isArray(value)) {
+        return value.map(stableValue);
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, nested]) => [key, stableValue(nested)]));
+    }
+    return value;
+}
+function runtimeToolProjection(tool) {
+    return stableValue({
+        id: tool.id,
+        install: tool.install,
+        containerMount: tool.containerMount,
+        versionCmd: tool.versionCmd,
+        envVars: tool.envVars ?? {},
+        hostPreSeedFiles: (tool.hostPreSeedFiles ?? []).map(({ sandboxName }) => ({ sandboxName })),
+        hostPreSeedDirs: (tool.hostPreSeedDirs ?? []).map(({ sandboxSubdir }) => ({ sandboxSubdir })),
+        pathRewriteFiles: tool.pathRewriteFiles ?? [],
+        hostLiveMounts: (tool.hostLiveMounts ?? []).map(({ containerSubpath }) => ({ containerSubpath })),
+        postSetupCmds: tool.postSetupCmds ?? [],
+        tmpfs: tool.tmpfs ?? null
+    });
+}
+function hash(value) {
+    return createHash('sha256').update(JSON.stringify(stableValue(value))).digest('hex');
+}
+function assertUniqueTools(tools) {
+    const seen = new Set();
+    for (const tool of tools) {
+        if (seen.has(tool.id)) {
+            throw new Error(`Duplicate sandbox tool id "${tool.id}"`);
+        }
+        seen.add(tool.id);
+    }
+}
+function hooksByPhase(adapters) {
+    const phases = [
+        'prepare',
+        'before-container-create',
+        'after-container-start',
+        'before-enter'
+    ];
+    return Object.freeze(Object.fromEntries(phases.map((phase) => [
+        phase,
+        Object.freeze(adapters.flatMap((adapter) => adapter.sandbox.hooks.filter((hook) => hook.phase === phase)))
+    ])));
+}
+function createSandboxCapabilityPlan(config) {
+    const state = config.agentClientState ?? compatAgentClientState(config.tools);
+    const selectedAgentClients = listInstalledAgentClientAdapters(state);
+    const context = { home: config.home, project: config.project };
+    const selectedTools = selectedAgentClients.map((adapter) => adapter.sandbox.createTool(context));
+    const allClientTools = listAgentClientAdapters().map((adapter) => adapter.sandbox.createTool(context));
+    const customById = new Map((config.customTools ?? []).map((tool) => [tool.id, tool]));
+    if (customById.size !== (config.customTools ?? []).length) {
+        throw new Error('Duplicate sandbox tool id in customTools');
+    }
+    for (const id of customById.keys()) {
+        if (id === 'agent-infra' || isAgentClientId(id)) {
+            throw new Error(`Custom sandbox tool id "${id}" collides with a built-in tool`);
+        }
+    }
+    const nonClientTools = [];
+    const selectedCustomTools = [];
+    for (const id of config.tools) {
+        if (isAgentClientId(id))
+            continue;
+        if (id === 'agent-infra') {
+            if (!nonClientTools.some((tool) => tool.id === id)) {
+                nonClientTools.push(agentInfraTool(config.home));
+            }
+            continue;
+        }
+        const custom = customById.get(id);
+        if (!custom) {
+            throw new Error(`Unknown sandbox tool: ${id}`);
+        }
+        selectedCustomTools.push(custom);
+    }
+    const tools = Object.freeze([...nonClientTools, ...selectedTools, ...selectedCustomTools]);
+    assertUniqueTools(tools);
+    const phaseHooks = hooksByPhase(selectedAgentClients);
+    const hookProjection = selectedAgentClients.flatMap((adapter) => adapter.sandbox.hooks.map((hook) => ({
+        adapterId: adapter.id,
+        id: hook.id,
+        phase: hook.phase,
+        timeoutMs: hook.timeoutMs ?? DEFAULT_SANDBOX_HOOK_TIMEOUT_MS
+    })));
+    const recoveryChecks = Object.freeze(selectedAgentClients.flatMap((adapter) => (adapter.sandbox.recoveryChecks ?? []).map((check) => Object.freeze({
+        adapterId: adapter.id,
+        check
+    }))));
+    const recoveryCheckProjection = Object.freeze(recoveryChecks.map(({ adapterId, check }) => Object.freeze({
+        adapterId,
+        id: check.id,
+        ...(check.when === undefined ? {} : { when: check.when }),
+        probe: check.probe,
+        finding: Object.freeze({
+            repairKind: check.finding.repairKind,
+            ...(check.finding.path === undefined ? {} : { path: check.finding.path })
+        }),
+        ...(check.repair === undefined ? {} : { repair: check.repair })
+    })));
+    const runtimeProjection = Object.freeze({
+        tools: Object.freeze(tools.map(runtimeToolProjection)),
+        selectedAgentClients: Object.freeze(selectedAgentClients.map((adapter) => adapter.id)),
+        hooks: Object.freeze(hookProjection),
+        recoveryChecks: recoveryCheckProjection
+    });
+    const cleanupInventory = Object.freeze([
+        agentInfraTool(config.home),
+        ...allClientTools,
+        ...customById.values()
+    ]);
+    assertUniqueTools(cleanupInventory);
+    return Object.freeze({
+        tools,
+        selectedAgentClients,
+        hooksByPhase: phaseHooks,
+        recoveryChecks,
+        aliases: Object.freeze(listAgentClientAdapters().flatMap((adapter) => adapter.sandbox.aliases)),
+        imageSignature: hash(tools.map(({ id, install }) => ({ id, install }))),
+        runtimeSignature: hash(runtimeProjection),
+        runtimeProjection,
+        cleanupInventory
+    });
+}
+function timeoutStatus(phase) {
+    if (phase === 'before-enter')
+        return 'warning';
+    return 'fatal';
+}
+async function runSandboxHooks({ hooks, phase, context, runCommand = async () => {
+    throw new Error('Sandbox hook command runner is unavailable');
+}, scheduleTimeout = (callback, timeoutMs) => setTimeout(callback, timeoutMs), clearScheduledTimeout = (handle) => clearTimeout(handle) }) {
+    const results = [];
+    for (const hook of hooks) {
+        if (hook.phase !== phase)
+            continue;
+        const timeoutMs = hook.timeoutMs ?? DEFAULT_SANDBOX_HOOK_TIMEOUT_MS;
+        const controller = new AbortController();
+        let timedOut = false;
+        let timer;
+        const timeout = new Promise((resolve) => {
+            timer = scheduleTimeout(() => {
+                timedOut = true;
+                controller.abort();
+                resolve({
+                    status: timeoutStatus(phase),
+                    message: `Sandbox hook '${hook.id}' timed out after ${timeoutMs}ms.`
+                });
+            }, timeoutMs);
+        });
+        let result;
+        try {
+            const execution = Promise.resolve().then(() => hook.run({
+                ...context,
+                signal: controller.signal,
+                runCommand: (command) => runCommand(command, {
+                    signal: controller.signal,
+                    timeoutMs
+                })
+            }));
+            result = await Promise.race([execution, timeout]);
+        }
+        catch (error) {
+            result = {
+                status: timeoutStatus(phase),
+                message: error instanceof Error ? error.message : String(error)
+            };
+        }
+        finally {
+            clearScheduledTimeout(timer);
+        }
+        results.push({
+            hookId: hook.id,
+            phase,
+            status: result.status,
+            ...(result.message ? { message: result.message } : {})
+        });
+        if (timedOut || result.status === 'fatal' || result.status === 'hard-failure') {
+            break;
+        }
+    }
+    return results;
+}
+function runBoundedSandboxHookCommand(command, options) {
+    return new Promise((resolve, reject) => {
+        execFile(command.command, [...(command.args ?? [])], {
+            cwd: command.cwd,
+            env: command.env,
+            encoding: 'utf8',
+            signal: options.signal,
+            timeout: options.timeoutMs
+        }, (error, stdout) => {
+            if (error) {
+                reject(error);
+                return;
+            }
+            resolve({ stdout: stdout.trim() });
+        });
+    });
+}
+export { DEFAULT_SANDBOX_HOOK_TIMEOUT_MS, createSandboxCapabilityPlan, runBoundedSandboxHookCommand, runSandboxHooks };
+//# sourceMappingURL=agent-client-reconciler.js.map

package/dist/lib/sandbox/build-proxy.js

@@ -0,0 +1,63 @@
+import semver from 'semver';
+import { engineDisplayName } from './engine.js';
+import { runSafeEngine } from './shell.js';
+export const BUILD_PROXY_ENV_KEYS = ['HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY'];
+export const MIN_BUILD_PROXY_DOCKER_VERSION = '20.10.0';
+export const MIN_BUILD_PROXY_BUILDKIT_VERSION = '0.9.0';
+export function prepareBuildProxy(enabled, hostEnv, engine) {
+    const env = { ...hostEnv };
+    if (!enabled) {
+        return { args: [], env, redactionValues: [] };
+    }
+    const entries = BUILD_PROXY_ENV_KEYS.flatMap((key) => {
+        const value = hostEnv[key]?.trim();
+        return value ? [[key, value]] : [];
+    });
+    if (entries.length === 0) {
+        throw new Error(`No non-empty build proxy variables are set. Configure one of: ${BUILD_PROXY_ENV_KEYS.join(', ')}.`);
+    }
+    for (const [key, value] of entries)
+        env[key] = value;
+    if (engine === 'wsl2') {
+        const existing = (env.WSLENV ?? '').split(':').filter(Boolean);
+        env.WSLENV = [...new Set([...existing, ...entries.map(([key]) => key)])].join(':');
+    }
+    return {
+        args: entries.flatMap(([key]) => ['--secret', `id=${key},env=${key}`]),
+        env,
+        redactionValues: entries.map(([, value]) => value)
+    };
+}
+function parsedVersion(raw) {
+    return semver.coerce(raw.trim())?.version ?? null;
+}
+export function assertBuildProxyCompatibility(engine, runSafeEngineFn = runSafeEngine) {
+    const dockerRaw = runSafeEngineFn(engine, 'docker', ['version', '--format', '{{.Server.Version}}']);
+    const dockerVersion = parsedVersion(dockerRaw);
+    if (!dockerVersion || !semver.gte(dockerVersion, MIN_BUILD_PROXY_DOCKER_VERSION)) {
+        throw new Error(`Build proxy requires Docker Engine ${MIN_BUILD_PROXY_DOCKER_VERSION} or newer; `
+            + `observed ${dockerVersion ?? 'an unparseable version'}.`);
+    }
+    const buildxRaw = runSafeEngineFn(engine, 'docker', ['buildx', 'inspect', '--bootstrap']);
+    const versions = [...buildxRaw.matchAll(/BuildKit(?:\s+version)?:\s*v?(\d+\.\d+\.\d+(?:[-+][^\s]+)?)/gi)]
+        .map((match) => parsedVersion(match[1] ?? ''))
+        .filter((version) => version !== null);
+    if (versions.length === 0) {
+        throw new Error(`Build proxy requires BuildKit ${MIN_BUILD_PROXY_BUILDKIT_VERSION} or newer, `
+            + 'but the active builder version could not be determined.');
+    }
+    const oldVersion = versions.find((version) => !semver.gte(version, MIN_BUILD_PROXY_BUILDKIT_VERSION));
+    if (oldVersion) {
+        throw new Error(`Build proxy observed BuildKit ${oldVersion}; version ${MIN_BUILD_PROXY_BUILDKIT_VERSION} or newer is required.`);
+    }
+}
+export function redactBuildProxyValues(text, values) {
+    return [...new Set(values.filter(Boolean))]
+        .sort((left, right) => right.length - left.length)
+        .reduce((result, value) => result.replaceAll(value, '[REDACTED_BUILD_PROXY]'), text);
+}
+export function buildProxyFailureHint(engine) {
+    return `Build-step proxy inheritance is enabled for ${engineDisplayName(engine)}. `
+        + 'Image pulls and Dockerfile FROM resolution use the Docker daemon or builder proxy configuration.';
+}
+//# sourceMappingURL=build-proxy.js.map

package/dist/lib/sandbox/clipboard/linux.js

@@ -2,10 +2,11 @@ import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { removeDirRecursive } from '../../remove-dir.js';
 const PROBE_TIMEOUT_MS = 2_000;
 const READ_IMAGE_TIMEOUT_MS = 5_000;
 const PNG_MAGIC = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
-export function createLinuxClipboardAdapter({ env = process.env, execFn = execFileSync, execToFileFn = execToFile, mkdtempFn = fs.mkdtempSync, readFileFn = fs.readFileSync, rmFn = fs.rmSync } = {}) {
+export function createLinuxClipboardAdapter({ env = process.env, execFn = execFileSync, execToFileFn = execToFile, mkdtempFn = fs.mkdtempSync, readFileFn = fs.readFileSync, rmFn = removeDirRecursive } = {}) {
     return {
         available() {
             const backend = selectBackend(env);