@nairon-ai/aegis 0.2.0

package/src/cli/state.ts

@@ -0,0 +1,228 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { consola } from "consola";
+import type { AegisCliConfig } from "../shared/types.js";
+import { resolveEnvFileForRead, resolveEnvFileForWrite } from "./paths.js";
+
+export type SetupState = {
+	github: boolean;
+	linear: boolean;
+	telegram: boolean;
+	production: boolean;
+	worker: boolean;
+	isUsable: boolean;
+	config: AegisCliConfig;
+};
+
+export function loadConfig(): AegisCliConfig {
+	const envFile = resolveEnvFileForRead();
+	if (!envFile || !existsSync(envFile)) return {};
+	const config: AegisCliConfig = {};
+	for (const line of readFileSync(envFile, "utf-8").split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const idx = trimmed.indexOf("=");
+		if (idx === -1) continue;
+		const key = trimmed.slice(0, idx);
+		const value = trimmed.slice(idx + 1);
+		switch (key) {
+			case "AEGIS_WORKER_URL":
+				config.workerUrl = value;
+				break;
+			case "MONITORED_REPO":
+				config.monitoredRepo = value;
+				break;
+			case "BASE_BRANCH":
+				config.baseBranch = value;
+				break;
+			case "AUTOMATION_MODE":
+				config.automationMode = value as AegisCliConfig["automationMode"];
+				break;
+			case "CONTEXT_PROFILE":
+				config.contextProfile = value as AegisCliConfig["contextProfile"];
+				break;
+			case "READY_LABEL":
+				config.readyLabel = value;
+				break;
+			case "BUG_LABEL":
+				config.bugLabel = value;
+				break;
+			case "GITHUB_APP_ID":
+				config.githubAppId = value;
+				break;
+			case "GITHUB_APP_PRIVATE_KEY":
+				config.githubAppPrivateKey = value;
+				break;
+			case "GITHUB_INSTALLATION_ID":
+				config.githubInstallationId = value;
+				break;
+			case "GITHUB_WEBHOOK_SECRET":
+				config.githubWebhookSecret = value;
+				break;
+			case "GITHUB_TOKEN":
+				config.githubToken = value;
+				break;
+			case "LINEAR_API_KEY":
+				config.linearApiKey = value;
+				break;
+			case "LINEAR_WEBHOOK_SECRET":
+				config.linearWebhookSecret = value;
+				break;
+			case "LINEAR_TEAM_ID":
+				config.linearTeamId = value;
+				break;
+			case "LINEAR_PROJECT_ID":
+				config.linearProjectId = value;
+				break;
+			case "LINEAR_READY_STATUS":
+				config.linearReadyStatus = value;
+				break;
+			case "LINEAR_IN_PROGRESS_STATUS":
+				config.linearInProgressStatus = value;
+				break;
+			case "LINEAR_NEEDS_INFO_STATUS":
+				config.linearNeedsInfoStatus = value;
+				break;
+			case "LINEAR_BLOCKED_STATUS":
+				config.linearBlockedStatus = value;
+				break;
+			case "LINEAR_BUG_LABEL":
+				config.linearBugLabel = value;
+				break;
+			case "TELEGRAM_BOT_TOKEN":
+				config.telegramBotToken = value;
+				break;
+			case "TELEGRAM_CHAT_ID":
+				config.telegramChatId = value;
+				break;
+			case "TELEGRAM_WEBHOOK_SECRET":
+				config.telegramWebhookSecret = value;
+				break;
+			case "DATABASE_URL":
+				config.databaseUrl = value;
+				break;
+			case "VERCEL_TOKEN":
+				config.vercelToken = value;
+				break;
+			case "VERCEL_PROJECT_ID":
+				config.vercelProjectId = value;
+				break;
+			case "VERCEL_TEAM_ID":
+				config.vercelTeamId = value;
+				break;
+			case "AGENT_MODEL":
+				config.agentModel = value;
+				break;
+			case "OPENAI_API_KEY":
+				config.openaiApiKey = value;
+				break;
+		}
+	}
+	return config;
+}
+
+export function saveConfig(config: AegisCliConfig): void {
+	const envFile = resolveEnvFileForWrite();
+	const lines = [
+		"# Aegis configuration. Do not commit this file.",
+		"# Copy required values into Cloudflare secrets with `aegis deploy`.",
+		"",
+	];
+	const add = (key: string, value: string | undefined) => {
+		if (value) lines.push(`${key}=${value}`);
+	};
+	add("AEGIS_WORKER_URL", config.workerUrl);
+	add("MONITORED_REPO", config.monitoredRepo);
+	add("BASE_BRANCH", config.baseBranch);
+	add("AUTOMATION_MODE", config.automationMode);
+	add("CONTEXT_PROFILE", config.contextProfile);
+	add("READY_LABEL", config.readyLabel);
+	add("BUG_LABEL", config.bugLabel);
+	add("GITHUB_APP_ID", config.githubAppId);
+	add("GITHUB_APP_PRIVATE_KEY", config.githubAppPrivateKey);
+	add("GITHUB_INSTALLATION_ID", config.githubInstallationId);
+	add("GITHUB_WEBHOOK_SECRET", config.githubWebhookSecret);
+	add("GITHUB_TOKEN", config.githubToken);
+	add("LINEAR_API_KEY", config.linearApiKey);
+	add("LINEAR_WEBHOOK_SECRET", config.linearWebhookSecret);
+	add("LINEAR_TEAM_ID", config.linearTeamId);
+	add("LINEAR_PROJECT_ID", config.linearProjectId);
+	add("LINEAR_READY_STATUS", config.linearReadyStatus);
+	add("LINEAR_IN_PROGRESS_STATUS", config.linearInProgressStatus);
+	add("LINEAR_NEEDS_INFO_STATUS", config.linearNeedsInfoStatus);
+	add("LINEAR_BLOCKED_STATUS", config.linearBlockedStatus);
+	add("LINEAR_BUG_LABEL", config.linearBugLabel);
+	add("TELEGRAM_BOT_TOKEN", config.telegramBotToken);
+	add("TELEGRAM_CHAT_ID", config.telegramChatId);
+	add("TELEGRAM_WEBHOOK_SECRET", config.telegramWebhookSecret);
+	add("DATABASE_URL", config.databaseUrl);
+	add("VERCEL_TOKEN", config.vercelToken);
+	add("VERCEL_PROJECT_ID", config.vercelProjectId);
+	add("VERCEL_TEAM_ID", config.vercelTeamId);
+	add("AGENT_MODEL", config.agentModel);
+	add("OPENAI_API_KEY", config.openaiApiKey);
+	mkdirSync(dirname(envFile), { recursive: true });
+	writeFileSync(envFile, `${lines.join("\n")}\n`);
+}
+
+export function detectSetupState(): SetupState {
+	const config = loadConfig();
+	const github = Boolean(
+		config.monitoredRepo &&
+			((config.githubAppId && config.githubAppPrivateKey && config.githubInstallationId) ||
+				config.githubToken),
+	);
+	const linear = Boolean(config.linearApiKey && config.linearTeamId);
+	const telegram = Boolean(config.telegramBotToken && config.telegramChatId);
+	const production = Boolean(config.databaseUrl || (config.vercelToken && config.vercelProjectId));
+	const worker = Boolean(config.workerUrl);
+	return {
+		github,
+		linear,
+		telegram,
+		production,
+		worker,
+		isUsable: github,
+		config,
+	};
+}
+
+export function printState(state: SetupState): void {
+	const check = (ok: boolean, label: string) =>
+		consola.log(ok ? `  [x] ${label}` : `  [ ] ${label}`);
+	consola.log("");
+	check(state.github, "GitHub repo access configured");
+	check(state.linear, "Linear configured (optional)");
+	check(state.telegram, "Telegram approvals configured (optional)");
+	check(state.production, "Production context configured (optional)");
+	check(state.worker, "Worker URL saved");
+	consola.log("");
+}
+
+export async function runInteractiveMenu(): Promise<void> {
+	const choice = await consola.prompt("What would you like to do?", {
+		type: "select",
+		options: [
+			{ label: "Find ready bugs (dry run)", value: "pickup" },
+			{ label: "Run setup", value: "setup" },
+			{ label: "View status", value: "status" },
+			{ label: "Deploy worker", value: "deploy" },
+		],
+	});
+	if (choice === "pickup") {
+		const { runPickup } = await import("./commands/pickup.js");
+		await runPickup({ dryRun: true });
+	}
+	if (choice === "setup") {
+		const { runSetupWizard } = await import("./commands/setup.js");
+		await runSetupWizard();
+	}
+	if (choice === "status") {
+		const { runStatus } = await import("./commands/status.js");
+		await runStatus();
+	}
+	if (choice === "deploy") {
+		const { runDeploy } = await import("./commands/deploy.js");
+		await runDeploy();
+	}
+}

package/src/core/pickup.ts

@@ -0,0 +1,66 @@
+import { branchNameFor, formatNeedsInfoComment } from "../shared/format.js";
+import { evaluateReadiness } from "../shared/readiness.js";
+import { runFromItem } from "../shared/run-state.js";
+import type { AegisConfig, ReadinessDecision, WorkItem, WorkRun } from "../shared/types.js";
+import { createSources, sourceFor } from "../sources/index.js";
+
+export type PickupDecision = {
+	item: WorkItem;
+	decision: ReadinessDecision;
+	run?: WorkRun;
+	action: "would-run" | "claimed" | "needs-info" | "skipped";
+};
+
+export async function scanReadyBugs(config: AegisConfig): Promise<PickupDecision[]> {
+	const sources = createSources(config);
+	const items = (await Promise.all(sources.map((source) => source.listReadyBugs()))).flat();
+	return items.map((item) => {
+		const decision = evaluateReadiness(item, config);
+		return {
+			item,
+			decision,
+			action: decision.ready ? "would-run" : "needs-info",
+		};
+	});
+}
+
+export async function pickupReadyBugs(params: {
+	config: AegisConfig;
+	limit?: number;
+	startRun?: (item: WorkItem, run: WorkRun, decision: ReadinessDecision) => Promise<void>;
+}): Promise<PickupDecision[]> {
+	const limit = params.limit ?? params.config.maxConcurrentRuns;
+	const decisions = await scanReadyBugs(params.config);
+	const claimed: PickupDecision[] = [];
+
+	for (const candidate of decisions) {
+		if (claimed.length >= limit) break;
+		const source = sourceFor(params.config, candidate.item.source);
+
+		if (!candidate.decision.ready) {
+			await source.postNeedsInfo(
+				candidate.item,
+				formatNeedsInfoComment(candidate.decision.question),
+			);
+			candidate.action = "needs-info";
+			claimed.push(candidate);
+			continue;
+		}
+
+		const run = runFromItem(
+			candidate.item,
+			candidate.decision.autoImplementAllowed ? "auto-low-risk" : "plan-first",
+		);
+
+		await source.claim(candidate.item, { runId: run.id, branchName: run.branchName });
+		candidate.action = "claimed";
+		candidate.run = run;
+		claimed.push(candidate);
+
+		if (params.startRun) {
+			await params.startRun(candidate.item, run, candidate.decision);
+		}
+	}
+
+	return claimed.length ? claimed : decisions;
+}

package/src/github/index.ts

@@ -0,0 +1,2 @@
+export { generateManifest, exchangeManifestCode, getManifestCreationUrl } from "./manifest.js";
+export type { ManifestResult } from "./manifest.js";

package/src/github/manifest.ts

@@ -0,0 +1,97 @@
+/**
+ * GitHub App Manifest Flow - automated app creation via CLI.
+ *
+ * The manifest flow works like this:
+ * 1. CLI generates a manifest JSON describing the app
+ * 2. Opens browser to github.com/settings/apps/new?state=RANDOM
+ * 3. User clicks "Create GitHub App"
+ * 4. GitHub redirects to our callback URL with a `code`
+ * 5. We exchange the code for app credentials (id, pem, webhook_secret)
+ *
+ * Reference: https://docs.github.com/en/apps/sharing-github-apps/registering-a-github-app-from-a-manifest
+ */
+
+const MANIFEST_PERMISSIONS = {
+	contents: "write",
+	pull_requests: "write",
+	issues: "write",
+	metadata: "read",
+};
+
+const MANIFEST_EVENTS = ["issues", "issue_comment", "pull_request"];
+
+export type ManifestResult = {
+	appId: string;
+	appName: string;
+	privateKey: string;
+	webhookSecret: string;
+	clientId: string;
+	clientSecret: string;
+	htmlUrl: string;
+};
+
+/**
+ * Generate the GitHub App manifest JSON.
+ */
+export function generateManifest(callbackUrl: string): Record<string, unknown> {
+	return {
+		name: "aegis-bot",
+		url: "https://github.com/Nairon-AI/aegis",
+		hook_attributes: {
+			url: callbackUrl,
+			active: true,
+		},
+		redirect_url: callbackUrl,
+		callback_urls: [callbackUrl],
+		public: false,
+		default_permissions: MANIFEST_PERMISSIONS,
+		default_events: MANIFEST_EVENTS,
+	};
+}
+
+/**
+ * Exchange a manifest code for full app credentials.
+ */
+export async function exchangeManifestCode(code: string): Promise<ManifestResult> {
+	const response = await fetch(`https://api.github.com/app-manifests/${code}/conversions`, {
+		method: "POST",
+		headers: {
+			Accept: "application/vnd.github+json",
+			"X-GitHub-Api-Version": "2022-11-28",
+		},
+	});
+
+	if (!response.ok) {
+		const text = await response.text();
+		throw new Error(`Manifest exchange failed: ${response.status} ${text}`);
+	}
+
+	const data = (await response.json()) as {
+		id: number;
+		slug: string;
+		pem: string;
+		webhook_secret: string;
+		client_id: string;
+		client_secret: string;
+		html_url: string;
+		name: string;
+	};
+
+	return {
+		appId: String(data.id),
+		appName: data.name,
+		privateKey: data.pem,
+		webhookSecret: data.webhook_secret,
+		clientId: data.client_id,
+		clientSecret: data.client_secret,
+		htmlUrl: data.html_url,
+	};
+}
+
+/**
+ * Get the manifest creation URL that the user opens in their browser.
+ */
+export function getManifestCreationUrl(manifest: Record<string, unknown>): string {
+	const encoded = encodeURIComponent(JSON.stringify(manifest));
+	return `https://github.com/settings/apps/new?manifest=${encoded}`;
+}

package/src/integrations/github.ts

@@ -0,0 +1,241 @@
+import { getInstallationToken } from "../sandbox/github-token.js";
+import type { AegisConfig, WorkItem } from "../shared/types.js";
+
+type GitHubIssue = {
+	id: number;
+	number: number;
+	title: string;
+	body: string | null;
+	html_url: string;
+	created_at: string;
+	updated_at: string;
+	user?: { login: string };
+	labels: Array<string | { name?: string }>;
+	pull_request?: unknown;
+};
+
+type GitHubBranch = {
+	name: string;
+	commit: { sha: string };
+};
+
+type GitHubPullRequest = {
+	html_url: string;
+	number: number;
+	head: { sha: string };
+};
+
+export class GitHubClient {
+	private readonly config: AegisConfig;
+	private token?: string;
+	private readonly ensuredLabels = new Set<string>();
+
+	constructor(config: AegisConfig) {
+		this.config = config;
+	}
+
+	async listReadyIssues(): Promise<WorkItem[]> {
+		const repo = this.config.monitoredRepo;
+		const labels = encodeURIComponent(`${this.config.readyLabel},${this.config.bugLabel}`);
+		const issues = await this.request<GitHubIssue[]>(
+			`/repos/${repo}/issues?state=open&labels=${labels}&per_page=50`,
+		);
+
+		return issues
+			.filter((issue) => !issue.pull_request)
+			.filter((issue) => {
+				const labels = extractLabels(issue.labels);
+				return ![
+					this.config.inProgressLabel,
+					this.config.needsInfoLabel,
+					this.config.blockedLabel,
+					this.config.prOpenedLabel,
+				].some((label) => labels.includes(label));
+			})
+			.map((issue) => ({
+				source: "github" as const,
+				id: String(issue.id),
+				number: issue.number,
+				identifier: `#${issue.number}`,
+				title: issue.title,
+				body: issue.body ?? "",
+				url: issue.html_url,
+				repo,
+				labels: extractLabels(issue.labels),
+				createdAt: issue.created_at,
+				updatedAt: issue.updated_at,
+				author: issue.user?.login,
+			}));
+	}
+
+	async getIssue(repo: string, issueNumber: number): Promise<WorkItem> {
+		const issue = await this.request<GitHubIssue>(`/repos/${repo}/issues/${issueNumber}`);
+		return {
+			source: "github",
+			id: String(issue.id),
+			number: issue.number,
+			identifier: `#${issue.number}`,
+			title: issue.title,
+			body: issue.body ?? "",
+			url: issue.html_url,
+			repo,
+			labels: extractLabels(issue.labels),
+			createdAt: issue.created_at,
+			updatedAt: issue.updated_at,
+			author: issue.user?.login,
+		};
+	}
+
+	async findAegisBranch(repo: string, runId: string): Promise<string | undefined> {
+		const branches = await this.request<GitHubBranch[]>(
+			`/repos/${repo}/branches?protected=false&per_page=100`,
+		);
+		return branches.find((branch) => branch.name.includes(runId) || branch.name.endsWith(runId))
+			?.name;
+	}
+
+	async addLabels(repo: string, issueNumber: number, labels: string[]): Promise<void> {
+		const uniqueLabels = [...new Set(labels.filter(Boolean))];
+		if (!uniqueLabels.length) return;
+		await Promise.all(uniqueLabels.map((label) => this.ensureLabel(repo, label)));
+		await this.request(`/repos/${repo}/issues/${issueNumber}/labels`, {
+			method: "POST",
+			body: JSON.stringify({ labels: uniqueLabels }),
+		});
+	}
+
+	async removeLabel(repo: string, issueNumber: number, label: string): Promise<void> {
+		try {
+			await this.request(
+				`/repos/${repo}/issues/${issueNumber}/labels/${encodeURIComponent(label)}`,
+				{
+					method: "DELETE",
+				},
+			);
+		} catch (error) {
+			if (error instanceof Error && error.message.includes("404")) return;
+			throw error;
+		}
+	}
+
+	async comment(repo: string, issueNumber: number, body: string): Promise<void> {
+		await this.request(`/repos/${repo}/issues/${issueNumber}/comments`, {
+			method: "POST",
+			body: JSON.stringify({ body }),
+		});
+	}
+
+	async createPullRequest(params: {
+		repo: string;
+		title: string;
+		body: string;
+		head: string;
+		base: string;
+	}): Promise<{ url: string; number: number; headSha: string }> {
+		const pr = await this.request<GitHubPullRequest>(`/repos/${params.repo}/pulls`, {
+			method: "POST",
+			body: JSON.stringify({
+				title: params.title,
+				body: params.body,
+				head: params.head,
+				base: params.base,
+			}),
+		});
+		return { url: pr.html_url, number: pr.number, headSha: pr.head.sha };
+	}
+
+	async getCloneUrl(repo: string): Promise<string> {
+		const token = await this.getToken();
+		return `https://x-access-token:${token}@github.com/${repo}.git`;
+	}
+
+	async getToken(): Promise<string> {
+		if (this.token) return this.token;
+		if (this.config.github?.token) {
+			this.token = this.config.github.token;
+			return this.token;
+		}
+
+		const appId = this.config.github?.appId;
+		const privateKey = this.config.github?.privateKey;
+		const installationId = this.config.github?.installationId;
+		if (!appId || !privateKey || !installationId) {
+			throw new Error("GitHub credentials are not configured");
+		}
+
+		this.token = await getInstallationToken(appId, normalizePrivateKey(privateKey), installationId);
+		return this.token;
+	}
+
+	private async request<T>(path: string, init: RequestInit = {}): Promise<T> {
+		const token = await this.getToken();
+		const response = await fetch(`https://api.github.com${path}`, {
+			...init,
+			headers: {
+				Authorization: `Bearer ${token}`,
+				Accept: "application/vnd.github+json",
+				"X-GitHub-Api-Version": "2022-11-28",
+				"User-Agent": "aegis-afk-bug-agent",
+				"Content-Type": "application/json",
+				...init.headers,
+			},
+		});
+		if (!response.ok) {
+			const text = await response.text();
+			throw new Error(`GitHub ${path}: ${response.status} ${text}`);
+		}
+		if (response.status === 204) return undefined as T;
+		return (await response.json()) as T;
+	}
+
+	private async ensureLabel(repo: string, label: string): Promise<void> {
+		const cacheKey = `${repo}:${label.toLowerCase()}`;
+		if (this.ensuredLabels.has(cacheKey)) return;
+
+		try {
+			await this.request(`/repos/${repo}/labels/${encodeURIComponent(label)}`);
+			this.ensuredLabels.add(cacheKey);
+			return;
+		} catch (error) {
+			if (!(error instanceof Error) || !error.message.includes("404")) throw error;
+		}
+
+		try {
+			await this.request(`/repos/${repo}/labels`, {
+				method: "POST",
+				body: JSON.stringify({
+					name: label,
+					color: labelColor(label),
+					description: "Managed by Aegis",
+				}),
+			});
+		} catch (error) {
+			if (!(error instanceof Error) || !error.message.includes("422")) throw error;
+		}
+		this.ensuredLabels.add(cacheKey);
+	}
+}
+
+function extractLabels(labels: GitHubIssue["labels"]): string[] {
+	return labels
+		.map((label) => (typeof label === "string" ? label : label.name))
+		.filter((label): label is string => Boolean(label));
+}
+
+function normalizePrivateKey(value: string): string {
+	if (value.includes("BEGIN")) return value;
+	try {
+		return atob(value);
+	} catch {
+		return value;
+	}
+}
+
+function labelColor(label: string): string {
+	const normalized = label.toLowerCase();
+	if (normalized.includes("in-progress")) return "1d76db";
+	if (normalized.includes("needs-info")) return "fbca04";
+	if (normalized.includes("blocked")) return "d73a4a";
+	if (normalized.includes("pr-opened")) return "0e8a16";
+	return "6f42c1";
+}