@lchase/kiln 0.6.0 → 0.7.0

package/dist/reliability.js

@@ -1,8 +1,9 @@
 import { spawnSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, readSync, renameSync, statSync, writeFileSync, } from "node:fs";
 import { dirname, join, resolve, sep } from "node:path";
 import { z } from "zod";
+import { authenticationFailureLine } from "./auth.js";
 import { jobBasename } from "./paths.js";
 import { FAILURE_REASONS } from "./reconcile.js";
 /**
@@ -79,8 +80,10 @@ export function resetAttemptLedger(kilnDir, jobId, runId) {
 }
 /**
  * Stall, orphan, crash, and non-zero-exit handling for one observation.
- * Caller holds the tick lock. Safe to run twice: a run id is recorded once,
- * and worktree cleanup no-ops once the tree is gone or must be kept.
+ * A run that finishes with status `failed` takes the same worktree decision
+ * as a crash. Caller holds the tick lock. Safe to run twice: a run id is
+ * recorded once, and worktree cleanup no-ops once the tree is gone or must
+ * be kept.
  */
 export function recoverRuns(config, jobs, options) {
     const notes = [];
@@ -164,22 +167,79 @@ function pendingFailure(job, config, options) {
     if (runLive)
         return undefined;
     if (run && (run.status === "dead" || (run.status === "alive" && run.pid !== undefined && !isPidAlive(run.pid)))) {
-        return options.startup
+        return classifyAuth(job, options.startup
             ? { reason: "orphaned", runId: run.runId, pid: run.pid, detail: "process gone at startup" }
-            : { reason: "crashed", runId: run.runId, pid: run.pid, detail: "process exited" };
+            : { reason: "crashed", runId: run.runId, pid: run.pid, detail: "process exited" });
     }
+    // A normal failed exit (journal status failed) is not a crash. It still
+    // records an attempt and reaches cleanupRunWorktree below.
     if (run?.status === "failed") {
-        return { reason: "failed", runId: run.runId, pid: run.pid, detail: "non-zero exit" };
+        return classifyAuth(job, { reason: "failed", runId: run.runId, pid: run.pid, detail: "non-zero exit" });
     }
     if (job.launchFailed) {
-        return {
+        return classifyAuth(job, {
             reason: "crashed",
             ...(job.launchPid !== undefined ? { pid: job.launchPid } : {}),
             detail: "launch exited before a journal",
-        };
+        });
     }
     return undefined;
 }
+/** A rejected Claude login is recorded once and is not scheduled for retry. */
+function classifyAuth(job, pending) {
+    const line = authenticationFailureLine(authTexts(job));
+    if (!line)
+        return pending;
+    return {
+        reason: "auth-failed",
+        ...(pending.runId ? { runId: pending.runId } : {}),
+        ...(pending.pid !== undefined ? { pid: pending.pid } : {}),
+        detail: line,
+    };
+}
+function authTexts(job) {
+    const texts = [];
+    for (const event of job.run?.stepEvents ?? []) {
+        if (event.detail)
+            texts.push(event.detail);
+    }
+    if (job.logTail)
+        texts.push(job.logTail);
+    const log = readAuthLog(job.logPath);
+    if (log)
+        texts.push(log);
+    return texts;
+}
+/** Tail of the kiln log. Yak prints the Claude stderr line here, past the 40-line status tail. */
+function readAuthLog(logPath) {
+    if (!logPath)
+        return undefined;
+    let size;
+    try {
+        size = statSync(logPath).size;
+    }
+    catch {
+        return undefined;
+    }
+    if (size <= 0)
+        return undefined;
+    const take = Math.min(size, 256 * 1024);
+    let fd;
+    try {
+        fd = openSync(logPath, "r");
+        const buffer = Buffer.alloc(take);
+        readSync(fd, buffer, 0, take, size - take);
+        const text = buffer.toString("utf8").trim();
+        return text || undefined;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
 function recordFailure(config, jobId, existing, pending, now) {
     const ledger = existing ?? { jobId, attempts: [] };
     if (alreadyRecorded(ledger, pending))
@@ -193,7 +253,7 @@ function recordFailure(config, jobId, existing, pending, now) {
         detail: pending.detail,
     };
     const attempts = [...ledger.attempts, attempt];
-    const exhausted = attempts.length >= config.maxAttempts;
+    const exhausted = attempts.length >= config.maxAttempts || pending.reason === "auth-failed";
     const next = exhausted ? undefined : new Date(now.getTime() + retryDelayMs(attempts.length)).toISOString();
     const written = {
         jobId,
@@ -243,6 +303,8 @@ function writeLedger(kilnDir, ledger) {
  * Drop a failed run's worktree only when that loses no commits.
  * A branch with commits that are not on HEAD and not on a remote is kept,
  * and so is a dirty worktree. The checkout's own worktree is not removed.
+ * The branch is left in place.
+ * A second call, or a call when the worktree is already gone, does nothing.
  */
 export function cleanupRunWorktree(checkout, runId) {
     if (!safeRunId(runId))
@@ -253,25 +315,19 @@ export function cleanupRunWorktree(checkout, runId) {
     const worktreeRoot = resolve(root, ".yak", "worktrees");
     if (worktree === root || !worktree.startsWith(`${worktreeRoot}${sep}`))
         return "kept";
-    const branchExists = gitOk(root, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
-    const worktreeExists = existsSync(worktree);
-    if (!branchExists && !worktreeExists)
+    if (!existsSync(worktree))
         return "absent";
+    const branchExists = gitOk(root, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
     if (checkedOut(root, branch))
         return "kept";
     if (branchExists && hasUnpushedCommits(root, branch))
         return "kept";
-    if (worktreeExists && worktreeDirty(worktree))
+    if (worktreeDirty(worktree))
         return "kept";
-    if (worktreeExists && worktreeListed(root, worktree)) {
+    if (worktreeListed(root, worktree)) {
         gitOk(root, ["worktree", "remove", worktree]);
     }
-    if (existsSync(worktree))
-        return "kept";
-    if (branchExists)
-        gitOk(root, ["branch", "-D", branch]);
-    const stillBranch = gitOk(root, ["show-ref", "--verify", "--quiet", `refs/heads/${branch}`]);
-    return existsSync(worktree) || stillBranch ? "kept" : "removed";
+    return existsSync(worktree) ? "kept" : "removed";
 }
 function safeRunId(runId) {
     return RUN_ID.test(runId) && !runId.includes("..");
@@ -280,9 +336,14 @@ function checkedOut(checkout, branch) {
     const result = git(checkout, ["rev-parse", "--abbrev-ref", "HEAD"]);
     return result.status === 0 && result.stdout.trim() === branch;
 }
-/** Commits on the branch that are neither in HEAD nor on any remote. Failure keeps the branch. */
+/**
+ * Commits on the branch that are neither in HEAD nor on any remote.
+ * `--not` toggles exclusion for every following revision, so it must appear
+ * once: a second `--not` would count commits that exist only on a remote.
+ * A git error keeps the worktree.
+ */
 function hasUnpushedCommits(checkout, branch) {
-    const result = git(checkout, ["rev-list", "--count", branch, "--not", "HEAD", "--not", "--remotes"]);
+    const result = git(checkout, ["rev-list", "--count", branch, "--not", "HEAD", "--remotes"]);
     if (result.status !== 0)
         return true;
     const count = Number(result.stdout.trim());

package/dist/report.js

@@ -1,6 +1,7 @@
 import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join } from "node:path";
+import { AUTH_FAILED_LINE } from "./auth.js";
 import { readBoardFiles, readReviewRounds } from "./board.js";
 import { feedbackRoundText } from "./feedback.js";
 import { INVESTIGATION_WORKFLOW } from "./findings.js";
@@ -162,6 +163,8 @@ export function statusDetails(job) {
         lines.push(`attempts ${job.attemptCount}`);
     if (job.lastFailureReason)
         lines.push(`reason ${job.lastFailureReason}`);
+    if (job.lastFailureReason === "auth-failed")
+        lines.push(AUTH_FAILED_LINE);
     if (job.nextRetryAt)
         lines.push(`next retry ${job.nextRetryAt}`);
     if (job.state === "dead" && job.attemptCount > 0)
@@ -224,6 +227,7 @@ function toStatusJob(job, observation) {
             canApprove: false,
             canReject: false,
             steps: progressFor(job),
+            ...(job.deliver ? { deliver: job.deliver } : {}),
             ...(job.createdAt ? { createdAt: job.createdAt } : {}),
             ...(job.logTail ? { logTail: job.logTail } : {}),
             ...boardFields(job),
@@ -250,7 +254,8 @@ function toStatusJob(job, observation) {
         stack: job.stack === true,
         ...(job.source ? { source: { kind: job.source.kind, ref: job.source.ref } } : {}),
         ...(runId ? { runId } : {}),
-        ...(showBranch ? { branch: `yak/${runId}` } : {}),
+        ...(showBranch ? { branch: job.delivery?.branch ?? `yak/${runId}` } : {}),
+        ...(job.deliver ? { deliver: job.deliver } : {}),
         ...(job.delivery?.prUrl ? { prUrl: job.delivery.prUrl } : {}),
         ...(prNumber ? { prNumber } : {}),
         ...(job.logPath ? { logPath: job.logPath } : {}),
@@ -397,7 +402,7 @@ export function renderTick(observation, actions, launches, delivers = [], findin
             : `findings ${recorded.jobId}  missing`);
     }
     for (const note of notes) {
-        const next = note.nextRetryAt ? `  next ${note.nextRetryAt}` : "  dead";
+        const next = note.nextRetryAt ? `  next ${note.nextRetryAt}` : note.reason === "auth-failed" ? "" : "  dead";
         lines.push(`${note.kind} ${note.jobId}  ${note.reason}  attempt ${note.attempt}${next}`);
     }
     for (const note of feedbackNotes) {

package/dist/sandbox.js

@@ -14,10 +14,13 @@ import { jobBasename } from "./paths.js";
  * and land commits with the host git identity. Pull requests and
  * `gh pr view` run in the kiln process.
  *
- * @lchase/yak 0.7.1 drops `sandbox`, `image`, and `allowedDomains` while
- * loading workflow YAML, and calls `createAgentSandboxNetwork` with only
- * `api.anthropic.com`. Kiln refuses to launch while that is still true,
- * because the job would run on the host.
+ * Preflight searches the installed `@lchase/yak` bundle for
+ * `raw.agent.allowedDomains`. `@lchase/yak` 0.8.0 keeps that property
+ * access and passes the step allowlist into the sandbox proxy. An older
+ * package drops `sandbox`, `image`, and `allowedDomains` while loading
+ * workflow YAML and calls `createAgentSandboxNetwork` with only
+ * `api.anthropic.com`. Kiln refuses that pin, because the job would run
+ * on the host.
  */
 export const AGENT_SANDBOX_IMAGE = "yak-agent-sandbox:latest";
 export const PROXY_SANDBOX_IMAGE = "yak-agent-sandbox-proxy:latest";
@@ -167,7 +170,7 @@ export function sandboxPreflightMessage(config, facts) {
     return sandboxPreflight(config, facts ?? probeSandboxEnvironment(process.env, requiredSandboxImages(config)));
 }
 /**
- * `docker` argv yak 0.7.1 builds for one sandboxed agent step
+ * `docker` argv yak builds for one sandboxed agent step
  * (`dockerAgentRunArgs` in `@lchase/yak`). Kiln does not spawn docker
  * itself. Credential values are copied through so a test can show the
  * shape; do not log the result when `env` holds a real token.
@@ -197,16 +200,21 @@ export function agentSandboxDockerArgs(input) {
         ...input.cliArgs,
     ];
 }
-/** Proxy sidecar argv from yak's `startProxyArgs`. */
-export function proxySandboxDockerArgs(networkName, allowedDomains) {
+/**
+ * Proxy sidecar argv from yak's `startProxyArgs`. `--network` is the
+ * egress network (`bridge`, or `podman` when `bridge` is absent), not
+ * the internal sandbox network. Yak attaches that internal network only
+ * after the proxy accepts connections. Kiln does not spawn the proxy.
+ */
+export function proxySandboxDockerArgs(egressNetwork, allowedDomains, containerName) {
     return [
         "run",
         "-d",
         "--rm",
         "--name",
-        `${networkName}-proxy`,
+        containerName,
         "--network",
-        networkName,
+        egressNetwork,
         "-e",
         `ALLOWED_DOMAINS=${allowedDomains.join(",")}`,
         PROXY_SANDBOX_IMAGE,
@@ -290,7 +298,7 @@ function missingPieces(agentImages, adapter, facts) {
         missing.push("no Claude credential for the sandbox. The container only receives ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN. macOS keychain login is not forwarded. Run `claude setup-token` and export CLAUDE_CODE_OAUTH_TOKEN for this kiln process.");
     }
     if (!yakDistHonorsAllowlist(facts.yakDist)) {
-        missing.push(`installed @lchase/yak ${facts.yakVersion} does not pass allowedDomains from a workflow step into the sandbox proxy. @lchase/yak 0.7.1 drops sandbox, image, and allowedDomains when it loads workflow YAML, and the proxy allowlist stays api.anthropic.com. Kiln will not launch an unsandboxed run while sandbox mode is docker.`);
+        missing.push(`installed @lchase/yak ${facts.yakVersion} does not pass allowedDomains from a workflow step into the sandbox proxy. A package older than 0.8.0 drops sandbox, image, and allowedDomains when it loads workflow YAML, and the proxy allowlist stays api.anthropic.com. Kiln will not launch an unsandboxed run while sandbox mode is docker.`);
     }
     return missing;
 }

package/dist/schemas.js

@@ -10,12 +10,35 @@ import { z } from "zod";
  * `pr` pushes that branch and opens a draft pull request against `base`.
  * `base` defaults to origin's default branch, discovered with git, when omitted.
  */
+/** Jira-style issue keys (`ABC-123`). Stored and matched in uppercase. */
+export const ISSUE_KEY = /^[A-Z][A-Z0-9]+-\d+$/;
+export function parseIssueKey(raw) {
+    const key = raw.trim().toUpperCase();
+    if (!ISSUE_KEY.test(key)) {
+        throw new Error(`Issue key ${JSON.stringify(raw)} must match KEY-123.`);
+    }
+    return key;
+}
+export const REPO_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 export const RepoEntrySchema = z.object({
-    path: z.string().min(1),
-    test: z.string().min(1).optional(),
+    path: z.string().min(1, "Path is required."),
+    test: z.string().min(1, "Test command is empty.").optional(),
     deliver: z.enum(["local", "pr"]).optional(),
-    base: z.string().min(1).optional(),
+    base: z.string().min(1, "Base branch is empty.").optional(),
+    /**
+     * Pull request title when the job has an `issue`. Placeholders `{issue}` and `{title}`.
+     * Default `[{issue}] {title}`. A job with no issue keeps its title and ignores this.
+     */
+    prTitle: z.string().min(1, "PR title template is empty.").optional(),
+    /**
+     * Remote branch for `deliver=pr`. Placeholders `{issue}`, `{slug}`, and `{jobId}`.
+     * Default `<issue>-<slug>`, or `kiln/<slug>-<short id>` when there is no issue.
+     * The local branch stays `yak/<run-id>`.
+     */
+    branch: z.string().min(1, "Branch template is empty.").optional(),
 });
+/** Repo map shared by the config file and the settings API. */
+export const KilnReposSchema = z.record(z.string().regex(REPO_NAME, "must start with a letter or digit and contain only letters, digits, dots, underscores, and hyphens"), RepoEntrySchema);
 /**
  * Optional Jira Cloud credentials in the gitignored kiln config.
  * `JIRA_BASE_URL`, `JIRA_EMAIL`, and `JIRA_API_TOKEN` override these.
@@ -41,6 +64,14 @@ export const SandboxSettingsSchema = z.object({
         .optional(),
     allowDomains: z.array(z.string().regex(HOSTNAME, "must be a hostname")).min(1).optional(),
 });
+/**
+ * Sandbox fields the settings UI edits. `image` stays on the file schema only
+ * and is preserved when settings are saved.
+ */
+export const EditableSandboxSchema = SandboxSettingsSchema.pick({
+    mode: true,
+    allowDomains: true,
+}).strict();
 const WORKFLOW_KEY = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 /** No yak event and no log output for this long stalls a running job. `<= 0` disables it. */
 export const DEFAULT_STALL_TIMEOUT_MS = 15 * 60 * 1000;
@@ -48,26 +79,53 @@ export const DEFAULT_STALL_TIMEOUT_MS = 15 * 60 * 1000;
 export const DEFAULT_MAX_ATTEMPTS = 3;
 /** Pull request fix rounds before the job is needs-human (`feedback-exhausted`). */
 export const DEFAULT_MAX_FIX_ROUNDS = 2;
+/**
+ * Milliseconds without a yak event or log output before a running job is
+ * killed and retried. Default 15 minutes. `0` or negative disables stall detection.
+ */
+const stallTimeoutMs = z.number().int("Stall timeout must be a whole number of milliseconds.").optional();
+/** Transient failures before the job is dead. Default 3. */
+const maxAttempts = z
+    .number()
+    .int("Max attempts must be a whole number.")
+    .min(1, "Max attempts must be at least 1.")
+    .optional();
+/**
+ * Fix rounds for an open pull request before the job is needs-human with
+ * reason `feedback-exhausted`. Default 2. Kiln does not merge.
+ */
+const maxFixRounds = z
+    .number()
+    .int("Max fix rounds must be a whole number.")
+    .min(1, "Max fix rounds must be at least 1.")
+    .optional();
+/**
+ * The subset `kiln serve` settings can edit. The file schema below uses these
+ * same field validators. Settings does not accept jira, tokens, adapter,
+ * workflows, or sandbox image.
+ */
+export const EditableKilnSettingsSchema = z.object({
+    repos: KilnReposSchema,
+    stallTimeoutMs,
+    maxAttempts,
+    maxFixRounds,
+    sandbox: EditableSandboxSchema.optional(),
+});
+/** PUT /api/settings body. `revision` is the sha256 of the file the client loaded. */
+export const SettingsWriteSchema = EditableKilnSettingsSchema.extend({
+    revision: z.string().min(1, "Reload settings and try again."),
+}).strict();
 export const KilnConfigFileSchema = z.object({
     note: z.string().min(1).optional(),
     maxConcurrent: z.number().int().min(1).optional(),
-    /**
-     * Milliseconds without a yak event or log output before a running job is
-     * killed and retried. Default 15 minutes. `0` or negative disables stall detection.
-     */
-    stallTimeoutMs: z.number().int().optional(),
-    /** Transient failures before the job is dead. Default 3. */
-    maxAttempts: z.number().int().min(1).optional(),
-    /**
-     * Fix rounds for an open pull request before the job is needs-human with
-     * reason `feedback-exhausted`. Default 2. Kiln does not merge.
-     */
-    maxFixRounds: z.number().int().min(1).optional(),
+    stallTimeoutMs,
+    maxAttempts,
+    maxFixRounds,
     adapter: z.enum(["mock", "claude-code"]).optional(),
     sandbox: SandboxSettingsSchema.optional(),
     /** Per-workflow sandbox override. A set field replaces the global one; an omitted field inherits. */
     workflows: z.record(z.string().regex(WORKFLOW_KEY), z.object({ sandbox: SandboxSettingsSchema.optional() })).optional(),
-    repos: z.record(z.string(), RepoEntrySchema),
+    repos: KilnReposSchema,
     jira: JiraConfigSchema.optional(),
 });
 /**
@@ -101,6 +159,8 @@ export const JobSchema = z.object({
      * a branch.
      */
     stack: z.boolean().optional(),
+    /** Issue id such as `ABC-123`. Omitted when intake had no key. */
+    issue: z.string().regex(ISSUE_KEY).optional(),
     source: JobSourceSchema.optional(),
     createdAt: z.string().min(1),
 });