@kbediako/codex-orchestrator 0.1.38 → 0.2.0

package/dist/orchestrator/src/cli/control/linearWebhookController.js

@@ -0,0 +1,499 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { isoTimestamp } from '../utils/time.js';
+import { evaluateTrackerDispatchPilot } from './trackerDispatchPilot.js';
+import { resolveLiveLinearTrackedIssueById } from './linearDispatchSource.js';
+const LINEAR_WEBHOOK_MAX_AGE_MS = 5 * 60 * 1000;
+const LINEAR_ADVISORY_SEEN_DELIVERY_LIMIT = 100;
+export async function handleLinearWebhookRequest(input) {
+    const { req, res } = input;
+    const pathname = new URL(req.url ?? '/', 'http://localhost').pathname;
+    if (pathname !== '/integrations/linear/webhook') {
+        return false;
+    }
+    const env = input.env ?? process.env;
+    const now = input.now ?? Date.now;
+    if (req.method !== 'POST') {
+        writeLinearWebhookResponse(res, 405, 'rejected', 'method_not_allowed');
+        return true;
+    }
+    const deliveryId = readHeaderValue(req.headers['linear-delivery']);
+    if (!deliveryId) {
+        writeLinearWebhookResponse(res, 400, 'rejected', 'linear_delivery_header_missing');
+        return true;
+    }
+    const signature = readHeaderValue(req.headers['linear-signature']);
+    if (!signature) {
+        writeLinearWebhookResponse(res, 401, 'rejected', 'linear_signature_missing');
+        return true;
+    }
+    const webhookSecret = env.CO_LINEAR_WEBHOOK_SECRET?.trim();
+    if (!webhookSecret) {
+        writeLinearWebhookResponse(res, 503, 'rejected', 'linear_webhook_secret_missing');
+        return true;
+    }
+    const rawBody = await input.readRawBody(req);
+    if (!isLinearWebhookSignatureValid(signature, rawBody, webhookSecret)) {
+        writeLinearWebhookResponse(res, 401, 'rejected', 'linear_signature_invalid');
+        return true;
+    }
+    const payload = parseJsonRecord(rawBody);
+    if (!payload) {
+        writeLinearWebhookResponse(res, 400, 'rejected', 'invalid_json');
+        return true;
+    }
+    const eventName = readHeaderValue(req.headers['linear-event']) ?? readStringValue(payload, 'type') ?? null;
+    const action = readStringValue(payload, 'action') ?? null;
+    const issueId = readLinearWebhookIssueId(payload);
+    const webhookTimestamp = resolveLinearWebhookTimestamp(payload);
+    if (!webhookTimestamp) {
+        await recordAndPersistLinearAdvisoryOutcome(input, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            webhookTimestamp: null,
+            outcome: 'rejected',
+            reason: 'linear_webhook_timestamp_invalid'
+        });
+        writeLinearWebhookResponse(res, 401, 'rejected', 'linear_webhook_timestamp_invalid');
+        return true;
+    }
+    if (Math.abs(now() - webhookTimestamp) > LINEAR_WEBHOOK_MAX_AGE_MS) {
+        await recordAndPersistLinearAdvisoryOutcome(input, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            webhookTimestamp,
+            outcome: 'rejected',
+            reason: 'linear_webhook_timestamp_expired'
+        });
+        writeLinearWebhookResponse(res, 401, 'rejected', 'linear_webhook_timestamp_expired');
+        return true;
+    }
+    if (hasSeenLinearDelivery(input.linearAdvisoryState, deliveryId)) {
+        markLinearAdvisoryDuplicate(input.linearAdvisoryState, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            webhookTimestamp
+        });
+        await input.persistLinearAdvisory();
+        await input.emitAuditEvent({
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            outcome: 'duplicate',
+            reason: 'linear_delivery_duplicate'
+        });
+        writeLinearWebhookResponse(res, 200, 'duplicate', 'linear_delivery_duplicate');
+        return true;
+    }
+    const sourceSetup = resolveLinearWebhookSourceSetup(input.readFeatureToggles(), env);
+    if ('error' in sourceSetup) {
+        await recordAndPersistLinearAdvisoryOutcome(input, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            webhookTimestamp,
+            outcome: 'rejected',
+            reason: sourceSetup.error
+        });
+        writeLinearWebhookResponse(res, sourceSetup.status, 'rejected', sourceSetup.error);
+        return true;
+    }
+    if ((eventName ?? '').toLowerCase() !== 'issue' || (readStringValue(payload, 'type') ?? '').toLowerCase() !== 'issue') {
+        await recordAndPersistLinearAdvisoryOutcome(input, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            webhookTimestamp,
+            outcome: 'ignored',
+            reason: 'linear_event_unsupported'
+        });
+        writeLinearWebhookResponse(res, 200, 'ignored', 'linear_event_unsupported');
+        return true;
+    }
+    if (action !== 'create' && action !== 'update') {
+        await recordAndPersistLinearAdvisoryOutcome(input, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            webhookTimestamp,
+            outcome: 'ignored',
+            reason: 'linear_action_unsupported'
+        });
+        writeLinearWebhookResponse(res, 200, 'ignored', 'linear_action_unsupported');
+        return true;
+    }
+    if (!issueId) {
+        await recordAndPersistLinearAdvisoryOutcome(input, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId: null,
+            webhookTimestamp,
+            outcome: 'rejected',
+            reason: 'linear_issue_id_missing'
+        });
+        writeLinearWebhookResponse(res, 400, 'rejected', 'linear_issue_id_missing');
+        return true;
+    }
+    const resolution = await resolveLiveLinearTrackedIssueById({
+        issueId,
+        sourceSetup: sourceSetup.sourceSetup,
+        env
+    });
+    if (resolution.kind === 'ready') {
+        await input.providerIssueHandoff?.handleAcceptedTrackedIssue({
+            trackedIssue: resolution.tracked_issue,
+            deliveryId,
+            event: eventName,
+            action,
+            webhookTimestamp
+        });
+        await recordAndPersistLinearAdvisoryOutcome(input, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            webhookTimestamp,
+            outcome: 'accepted',
+            reason: 'linear_delivery_accepted',
+            trackedIssue: resolution.tracked_issue
+        });
+        writeLinearWebhookResponse(res, 200, 'accepted', 'linear_delivery_accepted');
+        input.publishRuntime();
+        return true;
+    }
+    if (shouldIgnoreLinearResolutionReason(resolution.reason)) {
+        await recordAndPersistLinearAdvisoryOutcome(input, {
+            deliveryId,
+            event: eventName,
+            action,
+            issueId,
+            webhookTimestamp,
+            outcome: 'ignored',
+            reason: resolution.reason
+        });
+        writeLinearWebhookResponse(res, 200, 'ignored', resolution.reason);
+        return true;
+    }
+    await recordAndPersistLinearAdvisoryOutcome(input, {
+        deliveryId,
+        event: eventName,
+        action,
+        issueId,
+        webhookTimestamp,
+        outcome: 'rejected',
+        reason: resolution.reason
+    });
+    writeLinearWebhookResponse(res, resolution.status, 'rejected', resolution.reason);
+    return true;
+}
+export function normalizeLinearAdvisoryState(input) {
+    const state = input ?? {
+        schema_version: 1,
+        updated_at: new Date(0).toISOString(),
+        latest_delivery_id: null,
+        latest_result: null,
+        latest_reason: null,
+        latest_event: null,
+        latest_accepted_at: null,
+        tracked_issue: null,
+        seen_deliveries: []
+    };
+    const staleSource = normalizeLinearAdvisoryStaleSource(state.stale_source);
+    return {
+        schema_version: 1,
+        updated_at: typeof state.updated_at === 'string' && state.updated_at.trim().length > 0
+            ? state.updated_at
+            : new Date(0).toISOString(),
+        latest_delivery_id: typeof state.latest_delivery_id === 'string' ? state.latest_delivery_id : null,
+        latest_result: state.latest_result === 'accepted' ||
+            state.latest_result === 'duplicate' ||
+            state.latest_result === 'ignored' ||
+            state.latest_result === 'rejected'
+            ? state.latest_result
+            : null,
+        latest_reason: typeof state.latest_reason === 'string' ? state.latest_reason : null,
+        latest_event: state.latest_event ?? null,
+        latest_accepted_at: typeof state.latest_accepted_at === 'string' ? state.latest_accepted_at : null,
+        tracked_issue: state.tracked_issue ?? null,
+        seen_deliveries: Array.isArray(state.seen_deliveries)
+            ? state.seen_deliveries.slice(-LINEAR_ADVISORY_SEEN_DELIVERY_LIMIT)
+            : [],
+        ...(staleSource ? { stale_source: staleSource } : {})
+    };
+}
+export function markLinearAdvisoryStateStaleFromProviderIntake(state, providerIntakeState, options = {}) {
+    if (!state.tracked_issue) {
+        return false;
+    }
+    const providerIntakeUpdatedAt = resolveProviderIntakeTruthUpdatedAt(providerIntakeState, state.tracked_issue);
+    const advisoryUpdatedAt = resolveLinearAdvisoryTrackedIssueReferenceUpdatedAt(state);
+    if (!isIsoNewer(providerIntakeUpdatedAt, advisoryUpdatedAt)) {
+        return false;
+    }
+    const nextStaleSource = {
+        source: 'provider-intake',
+        reason: 'provider_intake_newer_than_linear_advisory',
+        marked_at: options.now?.() ?? isoTimestamp(),
+        provider_intake_updated_at: providerIntakeUpdatedAt,
+        advisory_updated_at: advisoryUpdatedAt
+    };
+    if (state.stale_source?.source === nextStaleSource.source &&
+        state.stale_source.reason === nextStaleSource.reason &&
+        state.stale_source.provider_intake_updated_at === nextStaleSource.provider_intake_updated_at &&
+        state.stale_source.advisory_updated_at === nextStaleSource.advisory_updated_at) {
+        return false;
+    }
+    state.stale_source = nextStaleSource;
+    return true;
+}
+function resolveProviderIntakeTruthUpdatedAt(providerIntakeState, trackedIssue) {
+    const matchingClaims = (providerIntakeState?.claims ?? []).filter((claim) => claim.issue_id === trackedIssue.id || claim.issue_identifier === trackedIssue.identifier);
+    if (matchingClaims.length === 0) {
+        return null;
+    }
+    let truthUpdatedAt = null;
+    for (const claim of matchingClaims) {
+        truthUpdatedAt = pickLatestIsoTimestamp(pickLatestIsoTimestamp(truthUpdatedAt, claim.updated_at), claim.issue_updated_at);
+    }
+    return truthUpdatedAt;
+}
+function resolveLinearAdvisoryTrackedIssueReferenceUpdatedAt(state) {
+    return pickLatestIsoTimestamp(typeof state.latest_accepted_at === 'string' ? state.latest_accepted_at : null, state.tracked_issue?.updated_at);
+}
+function pickLatestIsoTimestamp(left, right) {
+    if (typeof right !== 'string' || right.trim().length === 0) {
+        return left;
+    }
+    if (isIsoNewer(right, left)) {
+        return right;
+    }
+    return left;
+}
+async function recordAndPersistLinearAdvisoryOutcome(input, outcome) {
+    recordLinearAdvisoryOutcome(input.linearAdvisoryState, outcome);
+    await input.persistLinearAdvisory();
+    await input.emitAuditEvent({
+        deliveryId: outcome.deliveryId,
+        event: outcome.event,
+        action: outcome.action,
+        issueId: outcome.issueId,
+        outcome: outcome.outcome,
+        reason: outcome.reason
+    });
+}
+function writeLinearWebhookResponse(res, status, outcome, reason) {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ status: outcome, reason, timestamp: isoTimestamp() }));
+}
+export function resolveLinearWebhookSourceSetup(featureToggles, env) {
+    const evaluation = evaluateTrackerDispatchPilot({
+        featureToggles,
+        defaultIssueIdentifier: null,
+        env
+    });
+    if (!evaluation.summary.configured) {
+        return { status: 503, error: 'dispatch_source_unavailable' };
+    }
+    if (!evaluation.summary.enabled) {
+        return { status: 409, error: 'dispatch_source_disabled' };
+    }
+    if (evaluation.summary.kill_switch) {
+        return { status: 409, error: 'dispatch_source_kill_switched' };
+    }
+    if (!evaluation.summary.source_setup || evaluation.summary.source_setup.provider !== 'linear') {
+        return { status: 422, error: 'dispatch_source_binding_missing' };
+    }
+    return { sourceSetup: evaluation.summary.source_setup };
+}
+function shouldIgnoreLinearResolutionReason(reason) {
+    return (reason === 'dispatch_source_issue_not_found' ||
+        reason === 'dispatch_source_workspace_mismatch' ||
+        reason === 'dispatch_source_team_mismatch' ||
+        reason === 'dispatch_source_project_mismatch');
+}
+function readLinearWebhookIssueId(payload) {
+    const data = readRecordValue(payload, 'data');
+    if (!data) {
+        return null;
+    }
+    return readStringValue(data, 'id') ?? null;
+}
+function resolveLinearWebhookTimestamp(payload) {
+    const raw = payload.webhookTimestamp;
+    if (typeof raw === 'number' && Number.isFinite(raw)) {
+        return raw;
+    }
+    if (typeof raw === 'string' && raw.trim().length > 0) {
+        const parsed = Number(raw);
+        if (Number.isFinite(parsed)) {
+            return parsed;
+        }
+    }
+    return null;
+}
+function parseJsonRecord(payload) {
+    if (payload.length === 0) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(payload.toString('utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return null;
+        }
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function isLinearWebhookSignatureValid(signature, payload, secret) {
+    const expected = createHmac('sha256', secret).update(payload).digest('hex');
+    return safeTokenCompare(signature, expected);
+}
+function hasSeenLinearDelivery(state, deliveryId) {
+    return state.seen_deliveries.some((entry) => entry.delivery_id === deliveryId);
+}
+function markLinearAdvisoryDuplicate(state, input) {
+    state.updated_at = isoTimestamp();
+    state.latest_result = 'duplicate';
+    state.latest_reason = 'linear_delivery_duplicate';
+    state.latest_event = {
+        delivery_id: input.deliveryId,
+        event: input.event,
+        action: input.action,
+        issue_id: input.issueId,
+        webhook_timestamp: input.webhookTimestamp,
+        processed_at: state.updated_at
+    };
+}
+function recordLinearAdvisoryOutcome(state, input) {
+    const processedAt = isoTimestamp();
+    state.updated_at = processedAt;
+    state.latest_result = input.outcome;
+    state.latest_reason = input.reason;
+    state.latest_event = {
+        delivery_id: input.deliveryId,
+        event: input.event,
+        action: input.action,
+        issue_id: input.issueId,
+        webhook_timestamp: input.webhookTimestamp,
+        processed_at: processedAt
+    };
+    state.latest_delivery_id = input.deliveryId;
+    state.seen_deliveries = [
+        ...state.seen_deliveries.filter((entry) => entry.delivery_id !== input.deliveryId),
+        {
+            delivery_id: input.deliveryId,
+            event: input.event,
+            action: input.action,
+            issue_id: input.issueId,
+            webhook_timestamp: input.webhookTimestamp,
+            processed_at: processedAt,
+            outcome: input.outcome,
+            reason: input.reason
+        }
+    ].slice(-LINEAR_ADVISORY_SEEN_DELIVERY_LIMIT);
+    if (input.outcome === 'accepted' && input.trackedIssue) {
+        state.latest_accepted_at = processedAt;
+        state.tracked_issue = input.trackedIssue;
+        delete state.stale_source;
+    }
+}
+function normalizeLinearAdvisoryStaleSource(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return null;
+    }
+    const record = value;
+    if (record.source !== 'provider-intake' ||
+        record.reason !== 'provider_intake_newer_than_linear_advisory') {
+        return null;
+    }
+    return {
+        source: 'provider-intake',
+        reason: 'provider_intake_newer_than_linear_advisory',
+        marked_at: typeof record.marked_at === 'string' ? record.marked_at : new Date(0).toISOString(),
+        provider_intake_updated_at: typeof record.provider_intake_updated_at === 'string'
+            ? record.provider_intake_updated_at
+            : null,
+        advisory_updated_at: typeof record.advisory_updated_at === 'string' ? record.advisory_updated_at : null
+    };
+}
+function isIsoNewer(candidateIso, currentIso) {
+    const candidateMs = Date.parse(candidateIso ?? '');
+    const currentMs = Date.parse(currentIso ?? '');
+    if (!Number.isFinite(candidateMs)) {
+        return false;
+    }
+    if (!Number.isFinite(currentMs)) {
+        return true;
+    }
+    return candidateMs > currentMs;
+}
+function safeTokenCompare(left, right) {
+    if (left.length !== right.length) {
+        return false;
+    }
+    return timingSafeEqual(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8'));
+}
+function readStringValue(record, ...keys) {
+    for (const key of keys) {
+        const value = record[key];
+        if (typeof value === 'string' && value.trim().length > 0) {
+            return value.trim();
+        }
+    }
+    return undefined;
+}
+function readRecordValue(record, key) {
+    const value = record[key];
+    if (value && typeof value === 'object' && !Array.isArray(value)) {
+        return value;
+    }
+    return undefined;
+}
+function readHeaderValue(value) {
+    if (Array.isArray(value)) {
+        const values = [];
+        for (const entry of value) {
+            if (typeof entry !== 'string') {
+                continue;
+            }
+            const parts = entry.split(',');
+            for (const part of parts) {
+                const trimmed = part.trim();
+                if (trimmed) {
+                    values.push(trimmed);
+                }
+            }
+        }
+        return readUniqueHeaderValue(values);
+    }
+    if (typeof value === 'string') {
+        const values = value
+            .split(',')
+            .map((part) => part.trim())
+            .filter(Boolean);
+        return readUniqueHeaderValue(values);
+    }
+    return null;
+}
+function readUniqueHeaderValue(values) {
+    if (values.length === 0) {
+        return null;
+    }
+    const unique = new Set(values);
+    if (unique.size > 1) {
+        return null;
+    }
+    return values[0];
+}

package/dist/orchestrator/src/cli/control/liveLinearAdvisoryRuntime.js

@@ -0,0 +1,70 @@
+import { summarizeTrackerDispatchPilotPolicy, evaluateTrackerDispatchPilotAsync } from './trackerDispatchPilot.js';
+export function createLiveLinearAdvisoryRuntime(context) {
+    let generation = 0;
+    let cachedEvaluation = null;
+    let inflightEvaluation = null;
+    let cachedSnapshotSummary = null;
+    return {
+        readSnapshotSummary(issueIdentifier = null) {
+            const normalizedIssueIdentifier = normalizeIssueIdentifier(issueIdentifier);
+            if (cachedEvaluation && cachedEvaluation.issueIdentifier === normalizedIssueIdentifier) {
+                return cachedEvaluation.evaluation.summary;
+            }
+            cachedSnapshotSummary ??= summarizeTrackerDispatchPilotPolicy({
+                featureToggles: context.controlStore.snapshot().feature_toggles,
+                env: context.env ?? process.env
+            });
+            return cachedSnapshotSummary;
+        },
+        readDispatchEvaluation(issueIdentifier = null) {
+            const normalizedIssueIdentifier = normalizeIssueIdentifier(issueIdentifier);
+            if (cachedEvaluation && cachedEvaluation.issueIdentifier === normalizedIssueIdentifier) {
+                return Promise.resolve(cachedEvaluation.evaluation);
+            }
+            if (inflightEvaluation && inflightEvaluation.issueIdentifier === normalizedIssueIdentifier) {
+                return inflightEvaluation.promise;
+            }
+            const requestGeneration = generation;
+            const promise = evaluateTrackerDispatchPilotAsync({
+                featureToggles: context.controlStore.snapshot().feature_toggles,
+                defaultIssueIdentifier: normalizedIssueIdentifier,
+                env: context.env ?? process.env,
+                fetchImpl: context.fetchImpl
+            }).then((evaluation) => {
+                if (generation === requestGeneration) {
+                    cachedEvaluation = {
+                        issueIdentifier: normalizedIssueIdentifier,
+                        evaluation
+                    };
+                }
+                if (inflightEvaluation?.promise === promise) {
+                    inflightEvaluation = null;
+                }
+                return evaluation;
+            }, (error) => {
+                if (inflightEvaluation?.promise === promise) {
+                    inflightEvaluation = null;
+                }
+                throw error;
+            });
+            inflightEvaluation = {
+                issueIdentifier: normalizedIssueIdentifier,
+                promise
+            };
+            return promise;
+        },
+        invalidate() {
+            generation += 1;
+            cachedEvaluation = null;
+            inflightEvaluation = null;
+            cachedSnapshotSummary = null;
+        }
+    };
+}
+function normalizeIssueIdentifier(value) {
+    if (!value) {
+        return null;
+    }
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}