@gredescerber/agent-crew 0.0.0-stage → 0.5.0

package/src/commands/check.js

@@ -0,0 +1,130 @@
+// crew check — runs the check steps from crew.config.json and reports errors concisely;
+// the full log goes to .crew/logs/, the result to .crew/last-check.json (required by crew pr open).
+import { existsSync, mkdirSync, readdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ok, fail } from '../core/output.js';
+import { runShell, git, currentBranch } from '../core/exec.js';
+import { loadConfig, agentId } from '../core/config.js';
+import { checkLease } from '../core/lease.js';
+
+const tail = (s, n = 20) => s.trim().split('\n').slice(-n).join('\n');
+
+/** Default step timeout, in seconds (step field timeout_s). */
+export const DEFAULT_TIMEOUT_S = 600;
+
+/** Default test file names: pytest, jest/vitest/playwright, node --test. */
+export const DEFAULT_TESTS_PATTERN = '(^test_.*\\.py$)|(_test\\.py$)|(\\.(test|spec)\\.[cm]?[jt]sx?$)';
+
+/** How many test files are in a folder (recursive, excluding node_modules). */
+export function countTests(dir, pattern = DEFAULT_TESTS_PATTERN) {
+  if (!existsSync(dir)) return 0;
+  const re = new RegExp(pattern);
+  let n = 0;
+  for (const e of readdirSync(dir, { withFileTypes: true, recursive: true })) {
+    const parent = (e.parentPath ?? e.path ?? '').replace(/\\/g, '/');
+    if (e.isFile() && re.test(e.name) && !parent.includes('/node_modules')) n++;
+  }
+  return n;
+}
+
+/**
+ * Whether the run counts for crew pr open: all config steps passed (or were skipped by the rules).
+ * A partial run (--only) does not count as green.
+ */
+export function isFullRun(results = [], steps = []) {
+  const names = new Set(results.map((r) => r.name));
+  return steps.length > 0 && steps.every((s) => names.has(s.name)) && results.every((r) => r.ok);
+}
+
+export default {
+  name: 'check',
+  summary: 'Run the checks (linter, types, tests) from crew.config.json',
+  usesCwd: true,
+  args: [{ name: 'only', type: 'string', description: 'run only the step with this name' }],
+  run({ only, cwd }, deps = {}) {
+    const { config, root } = loadConfig(cwd);
+    const all = config.check ?? [];
+    const steps = all.filter((s) => !only || s.name === only);
+    if (!steps.length) {
+      return fail('no_checks', 'No check list is defined in crew.config.json', {
+        cause_hint: 'the project is not configured yet',
+        retry: 'add steps to "check": [{ "name": "test", "run": "npm test" }]',
+        stop_when: 'you do not own the config — tell a human',
+      });
+    }
+    const dir = join(root, '.crew', 'logs');
+    mkdirSync(dir, { recursive: true });
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const logPath = join(dir, `check-${stamp}.txt`);
+    // #13 (H5): we extend the lease BEFORE the steps too — a long check (up to timeout_s per step) could otherwise outlive the lease,
+    // and sweep would return the task to the queue midway. After the steps — once more (at most once per 5 minutes).
+    const id = Number(/^crew\/(\d+)-/.exec(currentBranch(root))?.[1]) || null;
+    const leaseCheck = deps.checkLease ?? checkLease;
+    if (id) leaseCheck({ id, me: agentId() });
+    const results = [];
+    let log = '';
+    for (const s of steps) {
+      // when_exists: the step only makes sense if that part of the project already exists (web/package.json etc.)
+      if (s.when_exists && !existsSync(join(root, s.when_exists))) {
+        results.push({ name: s.name, ok: true, skipped: true, exit: 0, excerpt: '' });
+        continue;
+      }
+      // tests_dir: a mandatory set (acceptance tests). While there are no tests (the very start) — skipped;
+      // once there is at least one, the step must pass with exit code 0 ("no tests found" does not count).
+      // An agent cannot delete existing acceptance tests — crew-guard catches that.
+      const tests = s.tests_dir ? countTests(join(root, s.tests_dir), s.tests_pattern) : null;
+      if (s.tests_dir && tests === 0) {
+        results.push({ name: s.name, ok: true, skipped: true, no_tests: true, exit: 0, excerpt: '' });
+        continue;
+      }
+      const timeout_s = Number(s.timeout_s) > 0 ? Number(s.timeout_s) : DEFAULT_TIMEOUT_S;
+      const r = runShell(s.run, { cwd: join(root, s.cwd ?? '.'), timeout_s });
+      const okCodes = s.tests_dir ? [0] : (s.ok_exit_codes ?? [0]);
+      const passed = !r.timedOut && okCodes.includes(r.code);
+      log += `\n===== ${s.name}: ${s.run} (${r.timedOut ? `timeout ${timeout_s} s` : `exit ${r.code}`})\n${r.stdout}\n${r.stderr}\n`;
+      const output = tail(r.stdout + '\n' + r.stderr, r.timedOut ? 10 : 20);
+      const excerpt = passed
+        ? ''
+        : r.timedOut
+          ? `timeout: step "${s.name}" did not finish within ${timeout_s} s (timeout_s) and was stopped — is a test hung, waiting for input, or running a dev server?${output ? '\n' + output : ''}`
+          : output;
+      results.push({ name: s.name, ok: passed, exit: r.code, ...(tests !== null ? { tests } : {}), ...(r.timedOut ? { timed_out: true, timeout_s } : {}), excerpt });
+      if (!passed && s.stop_on_fail !== false) break;
+    }
+    writeFileSync(logPath, log);
+    const sha = git(['rev-parse', 'HEAD'], { cwd: root, allowFail: true }).stdout;
+    const dirty = git(['status', '--porcelain'], { cwd: root, allowFail: true }).stdout !== '';
+    const partial = !!only;
+    const passedSteps = results.every((r) => r.ok) && results.length === steps.length;
+    // green — only a full run of all config steps: `--only` does not unlock crew pr open.
+    const green = !partial && isFullRun(results, all);
+    writeFileSync(join(root, '.crew', 'last-check.json'), JSON.stringify({ sha, dirty, green, partial, at: new Date().toISOString(), results }, null, 2));
+
+    // On a task branch, check also counts as activity: we extend the lease (at most once per 5 minutes).
+    const lease = id ? leaseCheck({ id, me: agentId() }) : null;
+    const leaseNote = lease?.state === 'lost' ? [`⚠ task #${id} is no longer yours (${lease.owner ?? 'returned to the queue'}) — crew commit and crew pr open will refuse; crew task claim ${id} if it is ready again`] : [];
+
+    if (passedSteps) {
+      const ran = results.filter((r) => !r.skipped).map((r) => r.name);
+      const skipped = results.filter((r) => r.skipped).map((r) => (r.no_tests ? `${r.name} (no tests yet)` : r.name));
+      const noTests = results.filter((r) => r.no_tests).map((r) => r.name);
+      return ok(`${partial ? `Step ${only} is green (partial run — crew pr open needs a full crew check)` : 'All checks green'} (${ran.join(', ') || 'nothing to check'}${skipped.length ? `; skipped: ${skipped.join(', ')}` : ''})`, {
+        status: partial || leaseNote.length ? 'warning' : 'success',
+        artifacts: { log: logPath, sha, partial, green, ...(lease ? { lease: lease.state } : {}) },
+        next_actions: [
+          ...leaseNote,
+          ...(noTests.length ? [`no acceptance tests yet (${noTests.join(', ')}) — per AGENTS.md they are written in the task first commit`] : []),
+          ...(partial ? ['crew check (full run)'] : dirty ? ['crew commit -m "..."', 'crew check (again, after the commit)', 'crew pr open'] : ['crew pr open']),
+        ],
+      });
+    }
+    const failed = results.filter((r) => !r.ok);
+    const timedOut = failed.filter((f) => f.timed_out).map((f) => f.name);
+    return fail('ci_red', `Failed: ${failed.map((f) => (f.timed_out ? `${f.name} (timeout)` : f.name)).join(', ')}`, {
+      cause_hint: failed[0].excerpt,
+      retry: 'fix and run crew check again',
+      stop_when: 'the same error 3 times in a row → crew task status <id> blocked --note "..."',
+      artifacts: { log: logPath, failed: failed.map((f) => f.name), ...(timedOut.length ? { timed_out: timedOut } : {}) },
+    });
+  },
+};

package/src/commands/commit.js

@@ -0,0 +1,105 @@
+// crew commit — git commit with mandatory trailers (Agent, Issue) so the origin of the code is visible.
+// Only on a task branch crew/<id>-*, only while the task is yours (lease), and without secret-looking files.
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { ok, fail } from '../core/output.js';
+import { git, currentBranch } from '../core/exec.js';
+import { loadConfig, agentId } from '../core/config.js';
+import { checkLease, leaseLostError } from '../core/lease.js';
+import { issueFromBranch } from './pr.js';
+
+/** Files that are almost always secrets or dumps (by name). */
+const SECRET_FILES = [
+  [/(^|\/)\.env(\.[^/]*)?$/i, '.env file'],
+  [/\.(pem|key|p12|pfx|jks|keystore)$/i, 'key/certificate'],
+  [/(^|\/)id_(rsa|dsa|ecdsa|ed25519)(\.pub)?$/i, 'SSH key'],
+  [/(^|\/)(credentials|service[-_]?account|secrets?)[^/]*\.(json|ya?ml|toml)$/i, 'credentials file'],
+  [/\.(sqlite3?|db|dump)$/i, 'database / dump'],
+];
+const SECRET_FILE_OK = [/(^|\/)\.env\.(example|sample|template)$/i];
+
+/** Lines that look like tokens and keys (in added diff lines). */
+const SECRET_TEXT = [
+  [/-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/, 'private key'],
+  [/\bAKIA[0-9A-Z]{16}\b/, 'AWS access key'],
+  [/\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{40,}\b/, 'GitHub token'],
+  [/\bsk-ant-[A-Za-z0-9_-]{20,}/, 'Anthropic API key'],
+  [/\bsk-(?:proj-)?[A-Za-z0-9_-]{32,}/, 'OpenAI API key'],
+  [/\bxox[abposr]-[A-Za-z0-9-]{10,}/, 'Slack token'],
+  [/\bAIza[0-9A-Za-z_-]{35}\b/, 'Google API key'],
+];
+
+/**
+ * Simple index check before committing (pure function).
+ * names — paths from `git diff --cached --name-only`; diff — `git diff --cached -U0`.
+ * → [{ file, reason }]
+ */
+export function scanStaged(names = [], diff = '') {
+  const hits = [];
+  for (const f of names) {
+    const p = f.replace(/\\/g, '/');
+    if (SECRET_FILE_OK.some((re) => re.test(p))) continue;
+    const m = SECRET_FILES.find(([re]) => re.test(p));
+    if (m) hits.push({ file: p, reason: m[1] });
+  }
+  let file = null;
+  for (const line of diff.split(/\r?\n/)) {
+    if (line.startsWith('+++ ')) file = line.replace(/^\+\+\+ (b\/)?/, '');
+    // Template names are allowed, but their contents must still be scanned for credentials.
+    else if (line.startsWith('+') && file) {
+      const m = SECRET_TEXT.find(([re]) => re.test(line));
+      if (m && !hits.some((h) => h.file === file && h.reason === m[1])) hits.push({ file, reason: m[1] });
+    }
+  }
+  return hits;
+}
+
+export default {
+  name: 'commit',
+  summary: 'Commit everything with Agent/Issue trailers (task branch only, no secrets)',
+  usesCwd: true,
+  args: [{ name: 'm', type: 'string', required: true, description: 'commit message (Conventional Commits: feat: ..., fix: ...)' }],
+  run({ m, cwd }, deps = {}) {
+    const { root } = loadConfig(cwd);
+    const branch = currentBranch(root);
+    const id = issueFromBranch(branch);
+    if (!id) {
+      return fail('not_task_branch', `Branch ${branch} is not a task branch crew/<number>-...`, {
+        cause_hint: 'commits to main and to arbitrary branches are forbidden (AGENTS.md): work happens only from a claimed task',
+        retry: 'crew task next → crew task claim <id> → work in the issued worktree',
+        stop_when: 'this is project setup by a human — then use a plain git commit',
+      });
+    }
+    const me = agentId();
+    const lease = (deps.checkLease ?? checkLease)({ id, me });
+    if (lease.state === 'lost') return leaseLostError(fail, id, lease, me);
+
+    git(['add', '-A'], { cwd: root });
+    // .crew/ is gitignored (local state), but before/after screenshots belong to the PR (crew shots).
+    if (existsSync(join(root, '.crew', 'shots'))) git(['add', '-f', '--', '.crew/shots'], { cwd: root });
+    const names = git(['diff', '--cached', '--name-only'], { cwd: root }).stdout.split('\n').filter(Boolean);
+    if (!names.length) return fail('nothing_to_commit', 'Nothing to commit', { retry: 'crew check' });
+    const hits = scanStaged(names, git(['diff', '--cached', '-U0', '--no-color'], { cwd: root }).stdout);
+    if (hits.length) {
+      git(['reset', '-q'], { cwd: root }); // unstage; leave the files untouched
+      return fail('secret_suspected', `Looks like secrets, commit not made: ${hits.map((h) => `${h.file} (${h.reason})`).join(', ')}`, {
+        cause_hint: 'secrets belong only in .env (gitignored); the repo holds .env.example with empty values',
+        retry: 'remove the file/line (or add the file to .gitignore) and run crew commit -m "..." again',
+        stop_when: 'it is definitely not a secret (test fixture) — rename the value so it does not look like a key; do not bypass the check',
+        artifacts: { hits },
+      });
+    }
+    const trailers = [`Agent: ${me}`, `Issue: #${id}`];
+    git(['commit', '-m', m, '-m', trailers.join('\n')], { cwd: root });
+    const sha = git(['rev-parse', '--short', 'HEAD'], { cwd: root }).stdout;
+    return ok(`Commit ${sha}: ${m}`, {
+      status: lease.state === 'unknown' ? 'warning' : 'success',
+      artifacts: { sha, issue: id, lease: lease.state, heartbeat: !!lease.heartbeat },
+      next_actions: [
+        ...(lease.state === 'unknown' ? [`could not verify the lease (${lease.error}) — extend it manually: crew task heartbeat ${id}`] : []),
+        'crew check',
+        'crew pr open',
+      ],
+    });
+  },
+};

package/src/commands/compliance.js

@@ -0,0 +1,109 @@
+// crew compliance check | disclosure — compliance with the event rules (event mode).
+// Event rules live in events/<name>.json (start, end, ai_allowed, team_members, ...).
+import { writeFileSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { ok, warn, fail } from '../core/output.js';
+import { git, run } from '../core/exec.js';
+import { loadConfig, loadEvent, HARNESS_ROOT } from '../core/config.js';
+
+/** Commits with changes, excluding service merge commits: author date, author, Agent trailer. */
+export function commits(root) {
+  const out = git(['log', '--no-merges', '--format=%H%x1f%aI%x1f%ae%x1f%(trailers:key=Agent,valueonly,separator=%x2c)%x1e'], { cwd: root, allowFail: true });
+  if (out.code !== 0) return [];
+  return out.stdout.split('\x1e').map((r) => r.trim()).filter(Boolean).map((r) => {
+    const [sha, date, email, agent] = r.split('\x1f');
+    return { sha, date, email, agent: (agent ?? '').trim() || null };
+  });
+}
+
+/** Pure check function — the tests run it too. */
+export function evaluate(event, list, prAuthors = []) {
+  const problems = [];
+  const warnings = [];
+  const start = Date.parse(event.start);
+  const end = Date.parse(event.end);
+  const early = list.filter((c) => Date.parse(c.date) < start);
+  const late = list.filter((c) => Date.parse(c.date) > end);
+  if (early.length) problems.push(`commits before the start: ${early.length} (first ${early.at(-1).sha.slice(0, 7)})`);
+  if (late.length) problems.push(`commits after the end: ${late.length}`);
+  const agentCommits = list.filter((c) => c.agent && c.agent !== 'human');
+  if (event.ai_allowed === false && agentCommits.length) problems.push(`AI is forbidden, but agent commits: ${agentCommits.length}`);
+  const team = new Set((event.team_members ?? []).map((s) => s.toLowerCase()));
+  if (team.size) {
+    const outsiders = [...new Set(prAuthors.filter((a) => !team.has(a.toLowerCase())))];
+    if (outsiders.length) problems.push(`PRs from humans outside the team: ${outsiders.join(', ')}`);
+  } else {
+    warnings.push('team_members is empty — team membership is not checked');
+  }
+  const noTrailer = list.filter((c) => !c.agent && Date.parse(c.date) >= start);
+  if (noTrailer.length) problems.push(`commits without the Agent trailer: ${noTrailer.length} (use crew commit)`);
+  return { problems, warnings, stats: { commits: list.length, agent_commits: agentCommits.length } };
+}
+
+const check = {
+  name: 'compliance check',
+  summary: 'Event mode: check the repo against the event rules (time window, team membership, AI use)',
+  usesCwd: true,
+  args: [],
+  run({ cwd } = {}) {
+    const { config, root } = loadConfig(cwd);
+    const event = loadEvent(config, root);
+    if (!event) {
+      return warn('No event configured — nothing to check', {
+        next_actions: ['fill in events/event.json and set "event": "events/event.json" in crew.config.json'],
+      });
+    }
+    const pr = run('gh', ['pr', 'list', '--state', 'all', '--limit', '500', '--json', 'author'], { cwd: root, allowFail: true });
+    const authors = pr.code === 0 ? JSON.parse(pr.stdout || '[]').map((p) => p.author?.login).filter(Boolean) : [];
+    const res = evaluate(event, commits(root), authors);
+    if (res.problems.length) {
+      return fail('compliance_violation', `Violations: ${res.problems.length}`, {
+        cause_hint: res.problems.join('; '),
+        stop_when: 'always — a human decides this; agents do not rewrite history',
+        next_actions: ['tell the team captain', 'do not rewrite git history'],
+        artifacts: res,
+      });
+    }
+    return (res.warnings.length ? warn : ok)(`Compliance with the rules of "${event.name}": OK`, { artifacts: res });
+  },
+};
+
+const disclosure = {
+  name: 'compliance disclosure',
+  summary: 'Generate DISCLOSURE.md: which tools and agents were used',
+  agent: false,
+  args: [],
+  run() {
+    const { config, root } = loadConfig();
+    const event = loadEvent(config, root) ?? {};
+    const list = commits(root);
+    const byAgent = {};
+    for (const c of list) byAgent[c.agent ?? 'unknown'] = (byAgent[c.agent ?? 'unknown'] ?? 0) + 1;
+    const version = JSON.parse(readFileSync(join(HARNESS_ROOT, 'package.json'), 'utf8')).version;
+    const md = [
+      '# Disclosure',
+      '',
+      `Event: **${event.name ?? '—'}** (${event.start ?? '?'} — ${event.end ?? '?'})`,
+      '',
+      '## Tools',
+      `- [agent-crew](${config.harness_url ?? 'https://github.com/<org>/agent-crew'}) v${version} — an open-source tool for coordinating agents (rules, templates, CLI). Contains no product code.`,
+      `- AI agents: ${config.hosts.join(', ')}${config.ecc?.enabled !== false ? '; ECC plugin for Claude Code' : ''}.`,
+      `- Stack generators: ${(config.scaffold ?? []).map((s) => '`' + s + '`').join(', ') || '—'}`,
+      '',
+      '## What was done before the event',
+      '- Only tooling and public dependencies. All product code was written during the event.',
+      '',
+      '## Commit provenance',
+      '| Agent / author | Commits |',
+      '|---|---|',
+      ...Object.entries(byAgent).map(([a, n]) => `| ${a} | ${n} |`),
+      '',
+      'Every agent commit carries an `Agent:` trailer and a link to the task (`Issue: #N`).',
+      '',
+    ].join('\n');
+    writeFileSync(join(root, 'DISCLOSURE.md'), md);
+    return ok('DISCLOSURE.md created', { artifacts: { path: join(root, 'DISCLOSURE.md'), by_agent: byAgent } });
+  },
+};
+
+export default [check, disclosure];

package/src/commands/doctor.js

@@ -0,0 +1,48 @@
+// crew doctor — check that the machine is ready to work.
+import { ok, fail } from '../core/output.js';
+import { run } from '../core/exec.js';
+import { loadConfig, agentId } from '../core/config.js';
+import { LOCAL_VERSION, updateHint } from '../core/version.js';
+
+const probe = (cmd, args) => {
+  const r = run(cmd, args, { allowFail: true });
+  return r.code === 0 ? (r.stdout || r.stderr).split('\n')[0] : null;
+};
+
+export default {
+  name: 'doctor',
+  summary: 'Check the environment: node, git, gh (auth), claude, codex, project config',
+  args: [],
+  run() {
+    const { config, path } = loadConfig();
+    const winCmd = process.platform === 'win32';
+    const tool = (name, args) => probe(name, args) ?? (winCmd ? probe('cmd', ['/c', name, ...args]) : null);
+    const items = {
+      node: process.version,
+      git: tool('git', ['--version']),
+      gh: tool('gh', ['--version']),
+      gh_auth: run('gh', ['auth', 'status'], { allowFail: true }).code === 0 ? 'ok' : null,
+      config: path ?? null,
+      agent_id: agentId(),
+    };
+    for (const h of config.hosts ?? []) items[h] = tool(h, ['--version']);
+    const required = ['git', 'gh', 'gh_auth'];
+    const missing = required.filter((k) => !items[k]);
+    const hostsMissing = (config.hosts ?? []).filter((h) => !items[h]);
+    if (missing.length) {
+      return fail('env_missing', `Missing: ${missing.join(', ')}`, {
+        cause_hint: missing.includes('gh_auth') ? 'gh is not authenticated' : 'tool is not installed',
+        retry: missing.includes('gh_auth') ? 'gh auth login' : 'install it and re-run crew doctor',
+        artifacts: items,
+      });
+    }
+    items.crew = LOCAL_VERSION;
+    const hint = updateHint();
+    const notes = [hostsMissing.length ? `agents missing: ${hostsMissing.join(', ')}` : null, hint ? `crew is outdated (${LOCAL_VERSION})` : null].filter(Boolean);
+    return ok(notes.length ? `Environment OK, but ${notes.join('; ')}` : 'Environment ready', {
+      status: notes.length ? 'warning' : 'success',
+      artifacts: items,
+      next_actions: [...(hint ? [hint] : []), ...(path ? ['crew status'] : ['crew init <dir> — create a project'])],
+    });
+  },
+};