@galaxyproject/orbit 0.0.0 → 0.9.0

package/extensions/orbit/execution-commands.ts

@@ -0,0 +1,134 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { getNotebookPath, setCurrentStepAnchor } from "./state.js";
+import { checkPreconditions, renderFailures } from "./init-gate.js";
+import { buildStepLessonNote } from "./lesson-hint.js";
+
+/**
+ * Plan/execution commands. Plans live as markdown sections in `notebook.md`;
+ * these commands send the agent an instruction to read the notebook and act.
+ *
+ * Before sending the agent off, run a precondition check (see init-gate.ts):
+ * - hard failures (no notebook; plan needs Galaxy but disconnected) refuse
+ *   to send the agent prompt at all
+ * - soft failures (no plan; weak acceptance criteria; no history selected
+ *   for a Galaxy plan) still prompt, but the prompt carries the failure
+ *   list so the agent resolves with the user before invoking anything
+ *
+ * A passing gate also points `state.currentStepAnchor` at the step it found,
+ * so any Galaxy submission the agent makes in the run that follows is
+ * attributed to that step without the agent having to say so. The pointer is
+ * cleared when the run settles.
+ */
+
+export function registerExecutionCommands(pi: ExtensionAPI): void {
+  // The anchor is ARMED by /execute and only goes live when a run actually
+  // starts. Setting it directly was wrong in two reachable ways.
+  //
+  // pi dispatches a slash command while a previous run is still streaming, but
+  // then rejects the `sendUserMessage` /execute makes (it passes no
+  // deliverAs), and that rejection is swallowed. So /execute during an active
+  // run repointed the anchor at a step whose run never began, and the RUNNING
+  // run's next Galaxy submission was filed under it. Separately, a send that
+  // fails for any other reason -- no model configured, auth -- left an anchor
+  // set with no agent_end coming to clear it.
+  //
+  // Arming means an anchor is only ever consumed by a run that really started,
+  // and every anchor that goes live has an agent_end to clear it.
+  let pendingAnchor: string | null = null;
+  let runActive = false;
+
+  const executeHandler = async (_args: string | undefined, ctx: ExtensionContext) => {
+    const nbPath = getNotebookPath();
+    const gate = await checkPreconditions();
+
+    if (gate.hardFailed) {
+      ctx.ui.notify(renderFailures(gate.failures), "warning");
+      return;
+    }
+
+    if (!gate.ok) {
+      // A soft-failed gate still sends the agent off, but it has no step worth
+      // binding to -- most soft failures ARE "there is no usable next step".
+      // Only the armed anchor is dropped; a live one belongs to a run that is
+      // already going and is not ours to clear.
+      pendingAnchor = null;
+      ctx.ui.notify(renderFailures(gate.failures), "info");
+      pi.sendUserMessage(
+        `The user typed /execute (or /run) but the precondition check did not pass:\n\n${renderFailures(
+          gate.failures,
+        )}\n\nResolve these with the user first. Do NOT invoke Galaxy workflows or run local pipeline steps until the gate passes.`,
+      );
+      return;
+    }
+
+    // While a run is streaming pi rejects the message below, so there is no run
+    // to attribute and arming would only strand the anchor.
+    pendingAnchor = runActive ? null : (gate.plan?.nextStep?.anchor ?? null);
+
+    // Recorded lessons matching the next step's wording, framed as data and
+    // placed last. Not built while a run is streaming: pi drops that message,
+    // and a surfacing the model never saw shouldn't be counted.
+    const lessonNote = runActive ? "" : buildStepLessonNote(gate.plan?.nextStep?.raw ?? "");
+
+    pi.sendUserMessage(
+      `The user typed /execute (or /run). Read \`${nbPath}\`, locate the most ` +
+        `recent plan section that has unchecked steps (\`- [ ]\`), and execute ` +
+        `the next pending step, then continue the authorized plan as prerequisites are verified. ` +
+        `This is an execution request, not a request for another plan draft or status-only response. For each step:\n` +
+        `1. Decide local vs Galaxy per the plan's routing tag (see [local|hybrid|remote] in the section header).\n` +
+        `2. **Galaxy steps run in the BACKGROUND — this is the default.** Propose the run with loom_propose ` +
+        `and wait for the user's /approve, then invoke exactly that with the Galaxy tools and call ` +
+        `galaxy_invocation_record({ invocationId, notebookAnchor, label, proposalId }) — or, for a single tool run, ` +
+        `galaxy_job_record({ jobId, notebookAnchor, label, proposalId }). Continue other ready, authorized work. ` +
+        `If no work is ready because a prerequisite is still running, report that and yield; ` +
+        `the background poller queues automatic follow-up by default. Do NOT sit in this turn polling the invocation to completion. ` +
+        `Leave unverified steps unchecked. Respect an explicit automatic-follow-up opt-out and report it honestly.\n` +
+        `3. For local steps: run via bash synchronously; capture results into the notebook.\n` +
+        `4. **Verify before claiming done — but only for work that has actually finished.** A *local* result: verify now ` +
+        `(read/parse/lint/smoke-test; use the step's \`Verification:\` sub-bullet). For a Galaxy run, ` +
+        `verification happens automatically once it is terminal: inspect current job/invocation state and the output datasets, ` +
+        `record evidence, then flip the checkbox. If the run already finished, verify it in this turn, including immediately after submission. ` +
+        `Do not wait for the user to ask again.\n` +
+        `5. Write the verification evidence into the notebook before changing status.\n` +
+        `6. Only after verification succeeds, edit the markdown checkbox to \`- [x]\` (or \`- [!]\` on failure). ` +
+        `If verification is blocked or inconclusive, leave the step pending and record the actual blocker; ` +
+        `say "created but not verified" for created artifacts. Resolve it within existing authorization, ` +
+        `and ask only when a necessary decision, information or authorization is missing.\n` +
+        `Give concise progress updates while executing; status questions do not revoke authorization to continue. ` +
+        `Do NOT claim the artifact or step is done in chat unless verification evidence is recorded. ` +
+        `On failure, stop dependent work and investigate; do not advance past errors or unverified results. ` +
+        `Respect explicit pause/stop requests.` +
+        (lessonNote ? `\n\n${lessonNote}` : ""),
+    );
+  };
+
+  // Promote the armed anchor when a run actually starts.
+  pi.on("agent_start", async () => {
+    runActive = true;
+    if (pendingAnchor !== null) {
+      setCurrentStepAnchor(pendingAnchor);
+      pendingAnchor = null;
+    }
+  });
+
+  // Clear the pointer when the agent run settles, not on `turn_end`.
+  // pi's agentic loop emits turn_end after every model round trip inside one
+  // run (agent-loop.js emits turn_end at :131 and loops back to turn_start at
+  // :90), so clearing there would drop the anchor between the turn that reads
+  // the notebook and the turn that actually submits -- which is the normal
+  // shape of an /execute. `agent_end` fires once, when the run is over.
+  pi.on("agent_end", async () => {
+    runActive = false;
+    setCurrentStepAnchor(null);
+  });
+
+  pi.registerCommand("execute", {
+    description: "Execute authorized work in the latest plan section",
+    handler: executeHandler,
+  });
+
+  pi.registerCommand("run", {
+    description: "Alias for /execute",
+    handler: executeHandler,
+  });
+}

package/extensions/orbit/feedback-command.ts

@@ -0,0 +1,81 @@
+import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { submitFeedback, buildBrainSysinfo, appendToOutbox, readOrbitVersion } from "./feedback.js";
+import { getRecentActivityEvents } from "./activity.js";
+import { loadConfig } from "./config.js";
+import {
+  CLI_FEEDBACK_SOURCE,
+  SCHEMA_VERSION,
+  formatActivityTail,
+  capFeedbackPayload,
+} from "../../shared/feedback-contract.js";
+import type { FeedbackPayload } from "../../shared/feedback-contract.js";
+import { readEnv } from "../../shared/orbit-env.js";
+
+/**
+ * /feedback -- gather feedback inline via ctx.ui and POST it to the capture
+ * worker. Cross-shell: ctx.ui renders in Orbit desktop and the Orbit CLI alike. The
+ * brain cannot open Orbit's HTML modal (no plumbing), so this is the brain's
+ * own capture path. Guards on ctx.hasUI so it never POSTs an empty payload in
+ * non-interactive/RPC mode.
+ */
+export function registerFeedbackCommand(pi: ExtensionAPI): void {
+  pi.registerCommand("feedback", {
+    description: "Send feedback about Orbit to the team (captures optional diagnostics).",
+    handler: async (args: string | undefined, ctx: ExtensionContext) => {
+      if (!ctx.hasUI) {
+        ctx.ui.notify(
+          "/feedback needs interactive mode. Re-run it in Orbit or an interactive CLI session.",
+          "warning",
+        );
+        return;
+      }
+
+      const title =
+        (args && args.trim()) || (await ctx.ui.input("Feedback -- short title", "Summarize it"));
+      if (!title || !title.trim()) return;
+
+      const body = (await ctx.ui.editor("What's the feedback?", "")) ?? "";
+
+      const includeDiagnostics = await ctx.ui.confirm(
+        "Include diagnostics?",
+        "Attach system info + a summary of recent activity (tool names, arguments, and truncated results), sent to the Orbit team's private feedback store. Credentials and API keys are redacted.",
+      );
+
+      // Opaque tester code (config, env override) -- non-secret; lets the team
+      // attribute the report. Omitted from the payload when unset.
+      const testerId = loadConfig().testerId || readEnv("TESTER_ID");
+
+      // The app version always rides along (non-sensitive build metadata) so every
+      // loom-cli row is filterable by release in triage, even without diagnostics.
+      const payload: FeedbackPayload = {
+        schemaVersion: SCHEMA_VERSION,
+        source: CLI_FEEDBACK_SOURCE,
+        title: title.trim(),
+        body: body.trim(),
+        clientTs: new Date().toISOString(),
+        ...(testerId ? { testerId } : {}),
+        ...(includeDiagnostics
+          ? {
+              sysinfo: buildBrainSysinfo(),
+              activityTail: formatActivityTail(getRecentActivityEvents(60)),
+            }
+          : { sysinfo: { appVersion: readOrbitVersion() } }),
+      };
+
+      const capped = capFeedbackPayload(payload);
+      const res = await submitFeedback(capped);
+      if (res.ok) {
+        ctx.ui.notify("Thanks -- your feedback was sent.", "info");
+        return;
+      }
+      // Durability: never lose the user's note if the store is unreachable.
+      const saved = appendToOutbox(capped);
+      ctx.ui.notify(
+        saved
+          ? `Couldn't reach the feedback service (${res.error ?? "unknown error"}) -- saved locally, we'll pick it up later.`
+          : `Couldn't reach the feedback service (${res.error ?? "unknown error"}). Please try again later.`,
+        saved ? "warning" : "error",
+      );
+    },
+  });
+}

package/extensions/orbit/feedback.ts

@@ -0,0 +1,96 @@
+import {
+  FEEDBACK_ROUTE,
+  FEEDBACK_ENDPOINT_URL,
+  FEEDBACK_KEY_HEADER,
+  SCHEMA_VERSION,
+} from "../../shared/feedback-contract.js";
+import type { FeedbackPayload, FeedbackSysinfo } from "../../shared/feedback-contract.js";
+import { loadConfig, getConfigDir } from "./config.js";
+import { loadProfiles } from "./profiles.js";
+import { appendFileSync, readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { dirname, join } from "path";
+import { release } from "os";
+import { isWsl } from "../../shared/wsl.js";
+import { readEnv } from "../../shared/orbit-env.js";
+
+// Endpoint base is the shared constant; LOOM_FEEDBACK_URL overrides it for local
+// dev (point at http://localhost:8787 while running `wrangler dev`).
+const ENDPOINT = (readEnv("FEEDBACK_URL") || FEEDBACK_ENDPOINT_URL) + FEEDBACK_ROUTE;
+const TIMEOUT_MS = 10_000;
+
+export interface FeedbackResult {
+  ok: boolean;
+  status?: number;
+  id?: string;
+  error?: string;
+}
+
+/**
+ * Best-effort read of the Orbit package version so loom-cli rows carry a build for
+ * triage. Resolves the repo-root package.json the same way the brain resolves
+ * ../../shared at runtime. Returns undefined if it can't be read (safe fallback).
+ */
+export function readOrbitVersion(): string | undefined {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(readFileSync(join(here, "../../package.json"), "utf-8")) as {
+      version?: string;
+    };
+    return pkg.version;
+  } catch {
+    return undefined;
+  }
+}
+
+/** Brain-side sysinfo. No Electron here (the brain is a Node child), no secrets. */
+export function buildBrainSysinfo(): FeedbackSysinfo {
+  const cfg = loadConfig() as {
+    llm?: { active?: string; providers?: Record<string, { model?: string }> };
+  };
+  const active = cfg.llm?.active;
+  return {
+    appVersion: readOrbitVersion(),
+    platform: process.platform,
+    arch: process.arch,
+    wsl: isWsl({ platform: process.platform, env: process.env, release: release() }),
+    node: process.versions.node,
+    llmProvider: active,
+    llmModel: active ? cfg.llm?.providers?.[active]?.model : undefined,
+    galaxyConfigured: Boolean(loadProfiles().active),
+  };
+}
+
+export async function submitFeedback(payload: FeedbackPayload): Promise<FeedbackResult> {
+  try {
+    const headers: Record<string, string> = { "Content-Type": "application/json" };
+    const feedbackKey = readEnv("FEEDBACK_KEY");
+    if (feedbackKey) headers[FEEDBACK_KEY_HEADER] = feedbackKey;
+    const res = await fetch(ENDPOINT, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload),
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+    const data = (await res.json().catch(() => ({}))) as { id?: string; error?: string };
+    return { ok: res.ok, status: res.status, id: data.id, error: data.error };
+  } catch (err) {
+    return { ok: false, error: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/**
+ * Durability backstop: when a POST fails, append the payload to a local outbox so
+ * the feedback isn't lost. Returns the outbox path on success, null on failure.
+ */
+export function appendToOutbox(payload: FeedbackPayload): string | null {
+  try {
+    const outbox = join(getConfigDir(), "feedback-outbox.jsonl");
+    appendFileSync(outbox, JSON.stringify(payload) + "\n", "utf-8");
+    return outbox;
+  } catch {
+    return null;
+  }
+}
+
+export const FEEDBACK_SCHEMA_VERSION = SCHEMA_VERSION;

package/extensions/orbit/galaxy-api.test.ts

@@ -0,0 +1,122 @@
+import { describe, it, expect, vi, beforeAll, afterAll, beforeEach, afterEach } from "vitest";
+import { galaxyGetMostRecentHistory } from "./galaxy-api.js";
+
+describe("galaxyGetMostRecentHistory", () => {
+  const origFetch = global.fetch;
+  beforeEach(() => {
+    process.env.GALAXY_URL = "https://g.example";
+    process.env.GALAXY_API_KEY = "k";
+  });
+  afterEach(() => {
+    global.fetch = origFetch;
+    delete process.env.GALAXY_URL;
+    delete process.env.GALAXY_API_KEY;
+    vi.restoreAllMocks();
+  });
+
+  it("calls most_recently_used with the api key and returns the history", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValue({ ok: true, json: async () => ({ id: "h1", name: "My History" }) });
+    global.fetch = fetchMock as unknown as typeof fetch;
+    const h = await galaxyGetMostRecentHistory();
+    expect(h?.id).toBe("h1");
+    expect(fetchMock).toHaveBeenCalledWith(
+      "https://g.example/api/histories/most_recently_used",
+      expect.objectContaining({ headers: { "x-api-key": "k" } }),
+    );
+  });
+
+  it("returns null when Galaxy returns an empty body", async () => {
+    global.fetch = vi
+      .fn()
+      .mockResolvedValue({ ok: true, json: async () => null }) as unknown as typeof fetch;
+    expect(await galaxyGetMostRecentHistory()).toBeNull();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Redirects. Two real servers, because the thing being tested is what undici
+// does with a credential header on a hop the mock layer never models.
+// ---------------------------------------------------------------------------
+
+import http from "node:http";
+import type { AddressInfo } from "node:net";
+import { galaxyGet, galaxyPost } from "./galaxy-api.js";
+
+describe("galaxy API redirect handling", () => {
+  const KEY = "SEKRET-CANARY-123";
+  let target: http.Server;
+  let configured: http.Server;
+  let targetOrigin: string;
+  let configuredOrigin: string;
+  let keysSeenByTarget: (string | null)[] = [];
+  let keysSeenByConfigured: (string | null)[] = [];
+  let mode: "cross" | "same" | "plain" = "cross";
+
+  beforeAll(async () => {
+    target = http.createServer((req, res) => {
+      keysSeenByTarget.push((req.headers["x-api-key"] as string | undefined) ?? null);
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ id: "leaked" }));
+    });
+    await new Promise<void>((r) => target.listen(0, "127.0.0.1", r));
+    targetOrigin = `http://127.0.0.1:${(target.address() as AddressInfo).port}`;
+
+    configured = http.createServer((req, res) => {
+      keysSeenByConfigured.push((req.headers["x-api-key"] as string | undefined) ?? null);
+      if (mode === "plain" || req.url?.endsWith("/settled")) {
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify({ id: "h1" }));
+        return;
+      }
+      const location =
+        mode === "cross" ? `${targetOrigin}${req.url}` : `${configuredOrigin}/api/settled`;
+      res.writeHead(302, { location });
+      res.end();
+    });
+    await new Promise<void>((r) => configured.listen(0, "127.0.0.1", r));
+    configuredOrigin = `http://127.0.0.1:${(configured.address() as AddressInfo).port}`;
+  });
+
+  afterAll(async () => {
+    await new Promise<void>((r) => target.close(() => r()));
+    await new Promise<void>((r) => configured.close(() => r()));
+  });
+
+  beforeEach(() => {
+    keysSeenByTarget = [];
+    keysSeenByConfigured = [];
+    process.env.GALAXY_URL = configuredOrigin;
+    process.env.GALAXY_API_KEY = KEY;
+  });
+
+  afterEach(() => {
+    delete process.env.GALAXY_URL;
+    delete process.env.GALAXY_API_KEY;
+  });
+
+  it("does not hand the API key to a host the configured server redirects to", async () => {
+    mode = "cross";
+    const err = await galaxyGet("/histories/most_recently_used").catch((e: Error) => e);
+    expect(err).toBeInstanceOf(Error);
+    expect((err as Error).message).toContain("GALAXY_URL");
+    expect((err as Error).message).toContain(targetOrigin);
+    expect(keysSeenByTarget).toEqual([]);
+  });
+
+  it("does not hand the key over on a POST either, nor replay the body", async () => {
+    mode = "cross";
+    const err = await galaxyPost("/tools/fetch", { history_id: "h1" }).catch((e: Error) => e);
+    expect((err as Error).message).toContain(targetOrigin);
+    expect(keysSeenByTarget).toEqual([]);
+  });
+
+  it("still follows a redirect that stays on the configured server", async () => {
+    mode = "same";
+    await expect(galaxyGet("/histories/most_recently_used")).resolves.toEqual({ id: "h1" });
+    // Both hops went to the configured server, both carrying the key.
+    expect(keysSeenByConfigured).toEqual([KEY, KEY]);
+    expect(keysSeenByTarget).toEqual([]);
+  });
+});