@fitlab-ai/agent-infra 0.9.1 → 0.9.3

package/lib/benchmark/schemas/v1.0.0/subject.schema.json

@@ -0,0 +1,227 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://github.com/fitlab-ai/agent-infra/lib/benchmark/schemas/v1.0.0/subject.schema.json",
+  "title": "agent-infra benchmark subject",
+  "description": "The evaluated Agent configuration and its declared runtime conditions.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "contractVersion",
+    "subjectId",
+    "model",
+    "agentClient",
+    "executionMode",
+    "tools",
+    "permissions",
+    "networkPolicy"
+  ],
+  "properties": {
+    "contractVersion": {
+      "$ref": "common.schema.json#/definitions/contractVersion"
+    },
+    "subjectId": {
+      "type": "string",
+      "minLength": 1
+    },
+    "model": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "provider",
+        "modelId"
+      ],
+      "properties": {
+        "provider": {
+          "type": "string",
+          "minLength": 1
+        },
+        "modelId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "agentClient": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "clientId",
+        "version"
+      ],
+      "properties": {
+        "clientId": {
+          "type": "string",
+          "minLength": 1
+        },
+        "version": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "executionMode": {
+      "enum": [
+        "direct-repair",
+        "agent-infra-workflow",
+        "custom"
+      ]
+    },
+    "workflowRef": {
+      "type": "string",
+      "minLength": 1
+    },
+    "tools": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "toolId",
+          "version"
+        ],
+        "properties": {
+          "toolId": {
+            "type": "string",
+            "minLength": 1
+          },
+          "version": {
+            "type": "string",
+            "minLength": 1
+          },
+          "capabilities": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "minLength": 1
+            },
+            "uniqueItems": true
+          }
+        }
+      }
+    },
+    "permissions": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "filesystem",
+        "credentials"
+      ],
+      "properties": {
+        "filesystem": {
+          "enum": [
+            "challenge-workspace-write",
+            "challenge-workspace-read-only",
+            "none"
+          ]
+        },
+        "credentials": {
+          "enum": [
+            "none",
+            "scoped"
+          ]
+        },
+        "commands": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "uniqueItems": true
+        }
+      }
+    },
+    "networkPolicy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "mode"
+      ],
+      "properties": {
+        "mode": {
+          "enum": [
+            "none",
+            "allowlist",
+            "unrestricted"
+          ]
+        },
+        "allowlist": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          },
+          "minItems": 1,
+          "uniqueItems": true
+        },
+        "enforcementEvidence": {
+          "type": "string",
+          "minLength": 1
+        }
+      },
+      "allOf": [
+        {
+          "if": {
+            "properties": {
+              "mode": {
+                "const": "allowlist"
+              }
+            }
+          },
+          "then": {
+            "required": [
+              "allowlist"
+            ]
+          }
+        }
+      ]
+    },
+    "budget": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "timeLimitMs": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "tokenLimit": {
+          "type": "integer",
+          "minimum": 1
+        },
+        "costLimit": {
+          "type": "number",
+          "minimum": 0
+        },
+        "costCurrency": {
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "extensions": {
+      "$ref": "common.schema.json#/definitions/extensions"
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "executionMode": {
+            "enum": [
+              "agent-infra-workflow",
+              "custom"
+            ]
+          }
+        }
+      },
+      "then": {
+        "required": [
+          "workflowRef"
+        ]
+      }
+    }
+  ]
+}

package/lib/builtin-tuis.ts

@@ -1,22 +1,23 @@
-const BUILTIN_TUI_IDS = ['claude-code', 'codex', 'gemini-cli', 'opencode'] as const;
-type BuiltinTUIId = (typeof BUILTIN_TUI_IDS)[number];
+import { AGENT_CLIENT_IDS, isAgentClientId } from './agent-clients/types.ts';
+import type { AgentClientId } from './agent-clients/types.ts';
+import { listAgentClientAdapters } from './agent-clients/registry.ts';
 
-const BUILTIN_TUI_DISPLAY: Record<BuiltinTUIId, string> = {
-  'claude-code': 'Claude Code',
-  'codex': 'Codex',
-  'gemini-cli': 'Gemini CLI',
-  'opencode': 'OpenCode'
-};
+const BUILTIN_TUI_IDS = AGENT_CLIENT_IDS;
+type BuiltinTUIId = AgentClientId;
 
-const BUILTIN_TUI_OWNED_PATH_PREFIXES: Record<BuiltinTUIId, string[]> = {
-  'claude-code': ['.claude/'],
-  'codex': ['.codex/'],
-  'gemini-cli': ['.gemini/'],
-  'opencode': ['.opencode/']
-};
+const BUILTIN_TUI_DISPLAY = Object.fromEntries(
+  listAgentClientAdapters().map((adapter) => [adapter.id, adapter.displayName])
+) as Record<BuiltinTUIId, string>;
+
+const BUILTIN_TUI_OWNED_PATH_PREFIXES = Object.fromEntries(
+  listAgentClientAdapters().map((adapter) => [
+    adapter.id,
+    [...adapter.project.ownedPathPrefixes]
+  ])
+) as Record<BuiltinTUIId, string[]>;
 
 function isBuiltinTUIId(value: unknown): value is BuiltinTUIId {
-  return typeof value === 'string' && (BUILTIN_TUI_IDS as readonly string[]).includes(value);
+  return isAgentClientId(value);
 }
 
 function resolveEnabledTUIs(value: unknown): Set<BuiltinTUIId> {

package/lib/defaults.json

@@ -2,17 +2,35 @@
   "platform": {
     "type": "github"
   },
+  "agentClients": [
+    {
+      "id": "claude-code",
+      "enabled": true,
+      "installInSandbox": true
+    },
+    {
+      "id": "codex",
+      "enabled": true,
+      "installInSandbox": true
+    },
+    {
+      "id": "antigravity-cli",
+      "enabled": true,
+      "installInSandbox": true
+    },
+    {
+      "id": "opencode",
+      "enabled": true,
+      "installInSandbox": true
+    }
+  ],
   "sandbox": {
     "engine": null,
     "runtimes": [
       "node22"
     ],
     "tools": [
-      "agent-infra",
-      "claude-code",
-      "codex",
-      "gemini-cli",
-      "opencode"
+      "agent-infra"
     ],
     "refreshIntervalDays": 7,
     "dockerfile": null,
@@ -39,16 +57,12 @@
       ".agents/templates/",
       ".agents/workflows/",
       ".agents/workspace/README.md",
-      ".claude/commands/",
-      ".codex/hooks.json",
-      ".gemini/commands/",
       ".git-hooks/check-large-files.cjs",
       ".git-hooks/check-version-format.sh",
       ".github/scripts/",
       ".github/workflows/metadata-sync.yml",
       ".github/workflows/pr-label.yml",
-      ".github/workflows/status-label.yml",
-      ".opencode/commands/"
+      ".github/workflows/status-label.yml"
     ],
     "guardedManaged": [
       ".github/workflows/metadata-sync.yml",
@@ -67,8 +81,6 @@
       ".agents/skills/test-integration/SKILL.*",
       ".agents/skills/test/SKILL.*",
       ".agents/skills/upgrade-dependency/SKILL.*",
-      ".claude/settings.json",
-      ".gemini/settings.json",
       ".git-hooks/pre-commit",
       ".gitignore"
     ],

package/lib/git/review-snapshot.ts

@@ -40,21 +40,51 @@ function projectStaged(repoRoot: string, baseline: string, globs: string[], env:
   }
 }
 
-function snapshotReview(input: { cwd: string; mode: 'worktree' | 'staged'; baseline: string; globs: string[] }) {
-  const repoRoot = String(git(input.cwd, ['rev-parse', '--show-toplevel'])).trim();
-  const resolvedBaseline = String(git(repoRoot, ['rev-parse', '--verify', `${input.baseline}^{commit}`])).trim();
-  return withTemporaryIndex(repoRoot, resolvedBaseline, (env) => {
-    if (input.mode === 'worktree') projectWorktree(repoRoot, resolvedBaseline, input.globs, env);
-    else projectStaged(repoRoot, resolvedBaseline, input.globs, env);
-    const diff = execFileSync('git', ['diff', '--cached', '--binary', resolvedBaseline, '--', ...input.globs], { cwd: repoRoot, encoding: 'buffer', env });
+function projectSnapshot(
+  repoRoot: string,
+  mode: 'worktree' | 'staged',
+  baseline: string,
+  globs: string[]
+) {
+  return withTemporaryIndex(repoRoot, baseline, (env) => {
+    if (mode === 'worktree') projectWorktree(repoRoot, baseline, globs, env);
+    else projectStaged(repoRoot, baseline, globs, env);
     return {
-      baseline: resolvedBaseline,
-      fingerprint: `sha256:${crypto.createHash('sha256').update(diff).digest('hex')}`,
+      diff: execFileSync('git', ['diff', '--cached', '--binary', baseline, '--', ...globs], {
+        cwd: repoRoot,
+        encoding: 'buffer',
+        env
+      }),
       tree: String(git(repoRoot, ['write-tree'], { env })).trim()
     };
   });
 }
 
+function snapshotReview(input: {
+  cwd: string;
+  mode: 'worktree' | 'staged';
+  baseline: string;
+  diffBase?: string;
+  globs: string[];
+}) {
+  const repoRoot = String(git(input.cwd, ['rev-parse', '--show-toplevel'])).trim();
+  const resolvedBaseline = String(git(repoRoot, ['rev-parse', '--verify', `${input.baseline}^{commit}`])).trim();
+  const resolvedDiffBase = String(git(
+    repoRoot,
+    ['rev-parse', '--verify', `${input.diffBase || resolvedBaseline}^{commit}`]
+  )).trim();
+  const reviewed = projectSnapshot(repoRoot, input.mode, resolvedBaseline, input.globs);
+  const fingerprintSource = resolvedDiffBase === resolvedBaseline
+    ? reviewed.diff
+    : projectSnapshot(repoRoot, input.mode, resolvedDiffBase, input.globs).diff;
+  return {
+    baseline: resolvedBaseline,
+    diffBase: resolvedDiffBase,
+    fingerprint: `sha256:${crypto.createHash('sha256').update(fingerprintSource).digest('hex')}`,
+    tree: reviewed.tree
+  };
+}
+
 function compareReviewTrees(input: { cwd: string; expected: string; actual: string }) {
   const repoRoot = String(git(input.cwd, ['rev-parse', '--show-toplevel'])).trim();
   git(repoRoot, ['rev-parse', '--verify', `${input.expected}^{tree}`]);

package/lib/git/reviewed-commit-equivalence.ts

@@ -0,0 +1,135 @@
+import { execFileSync, spawnSync } from "node:child_process";
+
+const SHA_PATTERN = /^[0-9a-f]{40}$/i;
+
+type LocalReviewedCommitRelation =
+  | {
+      status: "local-equivalent";
+      reviewedHead: string;
+      rewrittenCommit: string;
+    }
+  | {
+      status: "failed" | "blocked";
+      code: string;
+      message: string;
+    };
+
+function git(cwd: string, args: string[]): string {
+  return execFileSync("git", args, { cwd, encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+}
+
+function commitExists(gitRoot: string, sha: string): boolean {
+  try {
+    git(gitRoot, ["cat-file", "-e", `${sha}^{commit}`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function isAncestor(gitRoot: string, ancestor: string, descendant: string): boolean | null {
+  const result = spawnSync("git", ["merge-base", "--is-ancestor", ancestor, descendant], {
+    cwd: gitRoot,
+    encoding: "utf8"
+  });
+  if (result.status === 0) return true;
+  if (result.status === 1) return false;
+  return null;
+}
+
+export function resolveLocalReviewedCommitRelation(input: {
+  gitRoot: string;
+  localHead: string;
+  lastReviewedCommit: string;
+  rewrittenCommit: string;
+  pathspecs: string[];
+}): LocalReviewedCommitRelation {
+  const { gitRoot, localHead, lastReviewedCommit, rewrittenCommit, pathspecs } = input;
+  const shas = [localHead, lastReviewedCommit, rewrittenCommit];
+  if (shas.some((sha) => !SHA_PATTERN.test(sha) || !commitExists(gitRoot, sha))) {
+    return {
+      status: "blocked",
+      code: "LOCAL_REWRITE_OBJECT_MISSING",
+      message: "Required local rewrite Git objects are unavailable"
+    };
+  }
+
+  const ancestor = isAncestor(gitRoot, rewrittenCommit, localHead);
+  if (ancestor === false) {
+    return {
+      status: "failed",
+      code: "LOCAL_REWRITE_TOPOLOGY_INVALID",
+      message: "Local rewritten commit is not in the current HEAD history"
+    };
+  }
+  if (ancestor === null) {
+    return {
+      status: "blocked",
+      code: "LOCAL_REWRITE_GIT_EVIDENCE_UNAVAILABLE",
+      message: "Unable to verify local rewrite ancestry"
+    };
+  }
+
+  try {
+    const parents = git(gitRoot, ["rev-parse", `${rewrittenCommit}^@`])
+      .split(/\r?\n/)
+      .filter((line) => line.trim() !== "");
+    if (parents.length !== 1) {
+      return {
+        status: "failed",
+        code: "LOCAL_REWRITE_TOPOLOGY_INVALID",
+        message: "Local rewritten commit is not a single-parent commit"
+      };
+    }
+
+    const reviewedTree = git(gitRoot, ["rev-parse", `${lastReviewedCommit}^{tree}`]).trim();
+    const rewrittenTree = git(gitRoot, ["rev-parse", `${rewrittenCommit}^{tree}`]).trim();
+    if (reviewedTree !== rewrittenTree) {
+      const protectedDiff = git(gitRoot, [
+        "diff",
+        "--no-renames",
+        "--binary",
+        "--full-index",
+        lastReviewedCommit,
+        rewrittenCommit,
+        "--",
+        ...pathspecs
+      ]);
+      if (protectedDiff !== "") {
+        return {
+          status: "failed",
+          code: "LOCAL_REWRITE_CONTENT_MISMATCH",
+          message: "Local rewritten commit differs from the reviewed protected content"
+        };
+      }
+    }
+
+    const postRewrite = git(gitRoot, [
+      "rev-list",
+      `${rewrittenCommit}..${localHead}`,
+      "--",
+      ...pathspecs
+    ]).trim();
+    if (postRewrite) {
+      return {
+        status: "failed",
+        code: "POST_LOCAL_REWRITE_CHANGES",
+        message: "Protected paths changed after the equivalent local rewrite"
+      };
+    }
+  } catch {
+    return {
+      status: "blocked",
+      code: "LOCAL_REWRITE_GIT_EVIDENCE_UNAVAILABLE",
+      message: "Unable to verify local rewrite topology or content"
+    };
+  }
+
+  return {
+    status: "local-equivalent",
+    reviewedHead: lastReviewedCommit,
+    rewrittenCommit
+  };
+}
+
+export type { LocalReviewedCommitRelation };

package/lib/git/workflow.ts

@@ -1,4 +1,6 @@
 import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
 
 type CommandResult = { status: number | null; stdout: string; stderr: string };
 type GitRunner = (args: readonly string[], cwd: string) => CommandResult;
@@ -18,6 +20,10 @@ function value(runner: GitRunner, cwd: string, args: readonly string[], trim = t
   return result.status === 0 ? (trim ? result.stdout.trim() : result.stdout.replace(/\n$/, '')) : null;
 }
 
+function cleanMessage(message: string): string {
+  return message.replace(/(https?:\/\/)[^\s/@:]+(?::[^\s/@]*)?@/gi, '$1***@').trim();
+}
+
 function inspectGitWorkflow(cwd: string, runner: GitRunner = defaultRunner, remoteInput?: { remote: string; refs: readonly string[] }) {
   const head = value(runner, cwd, ['rev-parse', 'HEAD']);
   const branch = value(runner, cwd, ['branch', '--show-current']);
@@ -97,5 +103,63 @@ function pushGitRefs(input: { cwd: string; remote: string; refs: readonly string
   return { status: failures === 0 ? 'applied' as const : failures === operations.length ? 'failed' as const : 'degraded' as const, changed: failures < operations.length, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations, error: failures ? { code: 'GIT_PUSH_PARTIAL', message: `${failures} ref push operation(s) failed` } : null };
 }
 
-export { commitExplicitPaths, inspectGitWorkflow, pushGitRefs };
-export type { CommandResult, GitRunner };
+type PushRebasedInput = {
+  cwd: string;
+  remote: string;
+  branch: string;
+  expectedOldHead: string;
+  newHead: string;
+  baseBranch: string;
+  expectedBaseHead: string;
+};
+
+function pushRebasedBranch(input: PushRebasedInput, runner: GitRunner = defaultRunner) {
+  const sha = /^[0-9a-f]{40}$/i;
+  const refName = /^(?!-)(?!.*\.\.)(?!.*(?:^|\/)\.)(?!.*[~^:?*\[\\\s])(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+  if (!input.remote || !refName.test(input.remote) || !refName.test(input.branch) || !refName.test(input.baseBranch) ||
+      !sha.test(input.expectedOldHead) || !sha.test(input.newHead) || !sha.test(input.expectedBaseHead)) {
+    return { status: 'failed' as const, changed: false, snapshot: null, operations: [], error: { code: 'GIT_REBASED_INPUT_INVALID', message: 'Remote, branches, and full 40-character SHAs are required' } };
+  }
+  const snapshot = inspectGitWorkflow(input.cwd, runner).snapshot;
+  if (!snapshot) return { status: 'failed' as const, changed: false, snapshot: null, operations: [], error: { code: 'GIT_INSPECT_FAILED', message: 'Unable to inspect Git repository' } };
+  if (snapshot.branch !== input.branch || snapshot.head !== input.newHead) {
+    return { status: 'failed' as const, changed: false, snapshot, operations: [], error: { code: 'GIT_LOCAL_IDENTITY_MISMATCH', message: 'Current branch or HEAD does not match the rebased intent' } };
+  }
+  const rebasePaths = ['rebase-merge', 'rebase-apply']
+    .map((name) => value(runner, input.cwd, ['rev-parse', '--git-path', name]))
+    .filter((candidate): candidate is string => Boolean(candidate));
+  if (snapshot.worktree.length > 0 || snapshot.staged.length > 0 ||
+      run(runner, input.cwd, ['rev-parse', '-q', '--verify', 'REBASE_HEAD']).status === 0 ||
+      rebasePaths.some((candidate) => fs.existsSync(path.isAbsolute(candidate) ? candidate : path.join(input.cwd, candidate)))) {
+    return { status: 'failed' as const, changed: false, snapshot, operations: [], error: { code: 'GIT_LOCAL_STATE_UNSAFE', message: 'Working tree must be clean with no rebase in progress' } };
+  }
+  const remoteRef = `refs/heads/${input.branch}`;
+  const baseRef = `refs/heads/${input.baseBranch}`;
+  const remoteHead = value(runner, input.cwd, ['ls-remote', '--exit-code', input.remote, remoteRef])?.split(/\s+/)[0] ?? null;
+  if (remoteHead !== input.expectedOldHead) {
+    return { status: 'failed' as const, changed: false, snapshot, operations: [], error: { code: 'GIT_REMOTE_HEAD_MISMATCH', message: `Expected remote head ${input.expectedOldHead}, received ${remoteHead ?? 'unavailable'}` } };
+  }
+  const baseHead = value(runner, input.cwd, ['ls-remote', '--exit-code', input.remote, baseRef])?.split(/\s+/)[0] ?? null;
+  if (baseHead !== input.expectedBaseHead) {
+    return { status: 'failed' as const, changed: false, snapshot, operations: [], error: { code: 'GIT_REMOTE_BASE_MISMATCH', message: `Expected base head ${input.expectedBaseHead}, received ${baseHead ?? 'unavailable'}` } };
+  }
+  if (run(runner, input.cwd, ['merge-base', '--is-ancestor', input.expectedBaseHead, input.newHead]).status !== 0) {
+    return { status: 'failed' as const, changed: false, snapshot, operations: [], error: { code: 'GIT_REBASED_ANCESTOR_MISMATCH', message: 'Rebased head does not contain the expected base head' } };
+  }
+  const pushed = run(runner, input.cwd, [
+    'push', `--force-with-lease=${remoteRef}:${input.expectedOldHead}`,
+    input.remote, `${input.newHead}:${remoteRef}`
+  ]);
+  if (pushed.status !== 0) {
+    const message = cleanMessage(pushed.stderr) || 'Rebased branch push was rejected';
+    return { status: 'failed' as const, changed: false, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'push-rebased', status: 'failed' as const, ref: input.branch, message }], error: { code: 'GIT_REBASED_PUSH_REJECTED', message } };
+  }
+  const verified = value(runner, input.cwd, ['ls-remote', '--exit-code', input.remote, remoteRef])?.split(/\s+/)[0] ?? null;
+  if (verified !== input.newHead) {
+    return { status: 'failed' as const, changed: true, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'push-rebased', status: 'failed' as const, ref: input.branch, message: 'Remote ref verification failed' }], error: { code: 'GIT_REBASED_VERIFY_FAILED', message: `Expected pushed head ${input.newHead}, received ${verified ?? 'unavailable'}` } };
+  }
+  return { status: 'applied' as const, changed: true, snapshot: inspectGitWorkflow(input.cwd, runner).snapshot, operations: [{ name: 'push-rebased', status: 'applied' as const, ref: input.branch }], error: null };
+}
+
+export { commitExplicitPaths, inspectGitWorkflow, pushGitRefs, pushRebasedBranch };
+export type { CommandResult, GitRunner, PushRebasedInput };