@nanopm/cli 0.1.13 → 0.1.16

package/dist/index.js

@@ -5420,10 +5420,16 @@ var isDecideForMe = (answer) => /^\s*decide(\s+for\s+me)?\s*\.?\s*$/i.test(answe
 function answerForAgent(answer) {
   return isDecideForMe(answer) ? DECIDE_FOR_ME : answer;
 }
-var BUILD_HISTORY_KINDS = ["worktree", "plan", "step", "question", "answer", "paused", "pr"];
+var BUILD_HISTORY_KINDS = ["worktree", "plan", "step", "question", "answer", "paused", "pr", "handed"];
+var BUILD_CONFLICT = { resolve: "Let Nano resolve it", mine: "I\u2019ll do it in my terminal" };
+var chose = (answer, option) => {
+  const plain = (s) => s.trim().toLowerCase().replace(/[’‘]/g, "'");
+  return plain(answer) === plain(option);
+};
+var BUILD_REFUSED = { again: "Try again", open: "Open it on GitHub" };
 function trustedPlace(p, at) {
   const [branch, base, fork] = [p.branch, p.base, p.fork].map((v) => typeof v === "string" ? v : "");
-  if (!/^nano\/[a-z0-9][a-z0-9-]*$/.test(branch) || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(base) || !/^[0-9a-f]{7,40}$/.test(fork)) return null;
+  if (!/^nano\/[a-z0-9][a-z0-9-]*$/.test(branch) || !/^[A-Za-z0-9][A-Za-z0-9._/-]*$/.test(base) || /^refs\/|HEAD$/.test(base) || !/^[0-9a-f]{7,40}$/.test(fork)) return null;
   return { dir: buildDir(at.home, at.jobId), branch, base, fork };
 }
 function buildHistory(events, at) {
@@ -5431,20 +5437,30 @@ function buildHistory(events, at) {
   let plan = null;
   const done = /* @__PURE__ */ new Set();
   let last = null;
+  let report = "";
+  let handed = false;
   const answers = /* @__PURE__ */ new Map();
   for (const e of events) {
-    if (e.kind === "worktree") place = trustedPlace(e.payload, at);
+    if (e.kind === "worktree" && !place) place = trustedPlace(e.payload, at);
     else if (e.kind === "plan" && Array.isArray(e.payload.steps)) plan = e.payload.steps;
     else if (e.kind === "step" && typeof e.payload.step === "number") done.add(e.payload.step - 1);
     else if (e.kind === "answer") answers.set(e.seq, String(e.payload.answer ?? ""));
+    else if (e.kind === "handed") handed = true;
+    if (e.kind === "question" && (e.payload.about === "conflict" || e.payload.about === "refused")) {
+      if (typeof e.payload.report === "string") report = e.payload.report;
+      if (e.payload.about === "conflict") handed = false;
+    }
     if (e.kind === "question" || e.kind === "paused") last = e;
-    else if (e.kind === "plan" || e.kind === "step") last = null;
+    else if (e.kind === "plan" || e.kind === "step" || e.kind === "handed") last = null;
   }
-  if (!place) return { place, plan, done, resume: null };
-  if (last?.kind === "question" && answers.has(last.seq) && last.payload.about === "usage") return { place, plan, done, resume: { why: "limit" } };
-  if (last?.kind === "question" && answers.has(last.seq)) return { place, plan, done, resume: { why: "answer", answer: answers.get(last.seq) } };
-  if (last?.kind === "paused") return { place, plan, done, resume: { why: "limit" } };
-  return { place, plan, done, resume: { why: "lost" } };
+  const found = (resume2) => ({ place, plan, done, resume: resume2, report, handed });
+  if (!place) return found(null);
+  const answered2 = last?.kind === "question" && answers.has(last.seq) ? answers.get(last.seq) : null;
+  if (answered2 !== null && last.payload.about === "usage") return found({ why: "limit" });
+  if (answered2 !== null && (last.payload.about === "conflict" || last.payload.about === "refused")) return found({ why: last.payload.about, answer: answered2 });
+  if (answered2 !== null) return found({ why: "answer", answer: answered2 });
+  if (last?.kind === "paused") return found({ why: "limit" });
+  return found({ why: "lost" });
 }
 function wasOf(params) {
   return params?.was === "proposed" ? "proposed" : "accepted";
@@ -5461,11 +5477,18 @@ var execFileAsync3 = promisify3(execFile3);
 var MAX_BUFFER = 4 * 1024 * 1024;
 var TIMEOUT_MS = 6e4;
 var LOCKED = {
-  GIT_CONFIG_COUNT: "2",
+  GIT_CONFIG_COUNT: "5",
   GIT_CONFIG_KEY_0: "core.hooksPath",
   GIT_CONFIG_VALUE_0: "/dev/null",
   GIT_CONFIG_KEY_1: "core.fsmonitor",
-  GIT_CONFIG_VALUE_1: "false"
+  GIT_CONFIG_VALUE_1: "false",
+  // A fetch never opens a nested repository the agent could have planted where a submodule goes.
+  GIT_CONFIG_KEY_2: "fetch.recurseSubmodules",
+  GIT_CONFIG_VALUE_2: "false",
+  GIT_CONFIG_KEY_3: "submodule.recurse",
+  GIT_CONFIG_VALUE_3: "false",
+  GIT_CONFIG_KEY_4: "protocol.ext.allow",
+  GIT_CONFIG_VALUE_4: "never"
 };
 async function exec(cmd, repo, args, timeoutMs = TIMEOUT_MS) {
   if (typeof repo === "string") return execFileAsync3(cmd, cmd === "git" ? ["-C", repo, ...args] : args, { cwd: repo, maxBuffer: MAX_BUFFER, timeout: timeoutMs });
@@ -5483,7 +5506,7 @@ var RepoError = class extends Error {
 async function commitAll(cwd, message, note) {
   await git(cwd, ["add", "-A"]);
   const staged = await git(cwd, ["diff", "--cached", "--name-only"]).catch(() => "");
-  if (!staged) return null;
+  if (!staged && !await merging(cwd)) return null;
   await git(cwd, ["commit", "--no-verify", "-m", message, ...note ? ["-m", note] : [], "-m", `Written by NanoPM. Review before merging.
 
 ${BUILD_TRAILER}`]);
@@ -5564,6 +5587,42 @@ async function rebaseOnto(cwd, base) {
     return { ok: false, files };
   }
 }
+async function containsBase(cwd, base) {
+  const onto = await baseRef(cwd, base);
+  return git(cwd, ["merge-base", "--is-ancestor", onto, "HEAD"]).then(
+    () => true,
+    () => false
+  );
+}
+async function merging(cwd) {
+  return Boolean(await git(cwd, ["rev-parse", "-q", "--verify", "MERGE_HEAD"]).catch(() => ""));
+}
+async function mergedSince(cwd, fork) {
+  return Boolean(await git(cwd, ["rev-list", "--merges", "-n", "1", `${fork}..HEAD`]).catch(() => ""));
+}
+async function mergeBase(cwd, base) {
+  if (await merging(cwd)) return { files: await conflictsLeft(cwd, base) };
+  const onto = await baseRef(cwd, base);
+  try {
+    await git(cwd, ["merge", "--no-ff", "--no-commit", "--no-verify", onto], 12e4);
+    return { files: [] };
+  } catch (err) {
+    const files = (await git(cwd, ["diff", "--name-only", "--diff-filter=U"]).catch(() => "")).split("\n").filter(Boolean);
+    if (!files.length) throw new RepoError(`merging ${base} failed: ${errorMessage(err).split("\n").filter(Boolean).slice(-2).join(" ")}`);
+    return { files };
+  }
+}
+async function conflictsLeft(cwd, base) {
+  const onto = await baseRef(cwd, base);
+  const changed = (await git(cwd, ["diff", "--name-only", onto]).catch(() => "")).split("\n").filter(Boolean);
+  if (!changed.length) return [];
+  const marked = await git(cwd, ["grep", "-l", "-E", "^(<<<<<<<|>>>>>>>)( |$)", "--", ...changed]).catch(() => "");
+  return marked.split("\n").filter(Boolean).sort();
+}
+async function newPullRequestUrl(cwd, branch) {
+  const repo = /github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/.exec(await originUrl(cwd))?.[1];
+  return repo ? `https://github.com/${repo}/pull/new/${branch}` : null;
+}
 async function gh(cwd, args) {
   return (await exec("gh", cwd, args, 12e4)).stdout.trim();
 }
@@ -11160,16 +11219,16 @@ async function runBuildJob(input) {
   let plan = history.plan;
   const done = new Set(history.done);
   let usage;
-  let said = "";
+  let said = history.report;
   const stop2 = async (message, opts = { keep: true }) => {
     await unstartSolution(client, job.project_id, solution.ref, was).catch(() => void 0);
-    if (opts.keep) await commitAll(worktree, `${solution.ref}: unfinished \u2014 ${solution.title}`).catch(() => null);
+    if (opts.keep && !await merging(worktree)) await commitAll(worktree, `${solution.ref}: unfinished \u2014 ${solution.title}`).catch(() => null);
     else await removeWorktree(clone, dir);
     return { ...failed(opts.keep ? `${message}. What was done is on ${branch}, in ${dir}.` : message), usage };
   };
   const park = async (why) => {
     if ("ask" in why) {
-      await events.write("question", { ...why.ask, ...plan ? {} : { about: "plan" } });
+      await events.write("question", { ...why.ask, ...why.ask.about ? { report: said } : plan ? {} : { about: "plan" } });
       await log("build.ask", `${solution.ref} waits on the founder`);
     } else if (why.resetsAt) {
       await events.write("paused", { why: "limit", resets_at: new Date(why.resetsAt * 1e3).toISOString() });
@@ -11208,57 +11267,110 @@ async function runBuildJob(input) {
     }
     return end;
   };
+  const resolving = (files) => `\`${base}\` moved while you were building, and it is merged into your branch: ${files.map((f) => `\`${f}\``).join(", ")} still have conflict markers. Resolve each so both sides' intent holds, remove every marker, run the project's check again, then give your report again, whole and in the same form, with what you kept under *Decisions I made*. Do not call build_step, and do not commit: NanoPM commits the merge.`;
+  const left = async () => {
+    if (!finished()) return carryOn(plan, done);
+    if (history.handed) return null;
+    const files = await conflictsLeft(worktree, base);
+    return files.length ? resolving(files) : null;
+  };
+  const openPr = async (reviewUrl) => {
+    const [noPr, page] = await Promise.all([ghReady(worktree), solutionPage(client, job.project_id, solution.ref)]);
+    if (noPr) return pushed(null, reviewUrl, noPr);
+    const pr = await openPullRequest(worktree, { branch, base, title: `${solution.ref}: ${solution.title}`, body: prBody(said, page) });
+    if (!pr.ok) return park({ ask: { question: "The branch is pushed, but GitHub refused the pull request.", why: pr.reason, options: [BUILD_REFUSED.again, BUILD_REFUSED.open], about: "refused" } });
+    return pushed(pr, null);
+  };
+  const pushed = async (pr, reviewUrl, why = "not yet") => {
+    if (pr) {
+      await events.write("pr", { number: pr.number, url: pr.url });
+      await log("build.pr", `draft pull request #${pr.number} for ${solution.ref}`);
+    }
+    await removeWorktree(clone, dir);
+    return {
+      status: "succeeded",
+      result: [said.trim(), "", pr ? `Draft pull request #${pr.number} \xB7 ${pr.url}` : `Pushed ${branch}. No pull request: ${why}.${reviewUrl ? ` ${reviewUrl}` : ""}`].filter(Boolean).join("\n"),
+      data: { branch, session: spec2.sessionId, ...pr ? { pr: { number: pr.number, url: pr.url } } : { review_url: reviewUrl ?? null } },
+      usage
+    };
+  };
   const resume2 = history.resume;
   const check = verifyCommand2 ? `
 
 The project's own check is \`${verifyCommand2}\`. Run it before your last build_step, fix what it reports, and give its result under *How I checked it*.` : "";
   const finished = () => Boolean(plan && !stepsLeft(plan, done).length);
+  if (resume2?.why === "conflict" && chose(resume2.answer, BUILD_CONFLICT.mine)) {
+    const opened = await mergeBase(worktree, base).catch((err) => ({ error: errorMessage(err) }));
+    if ("error" in opened) return stop2(opened.error);
+    await events.write("handed", {});
+    return stop2(`It is yours to resolve: ${opened.files.join(", ")} carry conflict markers in that copy. Edit them, then Continue (nanopm build ${solution.ref} --continue): NanoPM commits the merge`);
+  }
+  if (resume2?.why === "refused" && chose(resume2.answer, BUILD_REFUSED.open)) return pushed(null, await newPullRequestUrl(worktree, branch), "you open it on GitHub");
   if (!resume2) {
     await log("build.start", `building ${solution.ref} on ${branch}, in a copy of your code`);
     await events.write("text", { text: `Working on ${branch}, in a copy of your code. Your own checkout is not touched.` });
   } else {
-    await events.write("text", { text: AGAIN[resume2.why].said });
+    await events.write("text", { text: AGAIN[resume2.why] });
     if (resume2.why === "answer" && spec2.answerFile) await writeFile5(spec2.answerFile, answerForAgent(resume2.answer), { mode: 384 });
   }
-  let turn = !resume2 ? await session2(spec2.prompt + check, false) : resume2.why === "answer" ? await session2("", true) : finished() ? null : await session2(`${AGAIN[resume2.why].lead} ${carryOn(plan, done)}`, true);
-  for (let resumes = 0; !turn && !finished(); resumes += 1) {
+  if (resume2?.why === "refused") return openPr();
+  let turn = null;
+  if (!resume2) turn = await session2(spec2.prompt + check, false);
+  else if (resume2.why === "answer") turn = await session2("", true);
+  else if (resume2.why === "conflict") {
+    const opened = await mergeBase(worktree, base).catch((err) => ({ error: errorMessage(err) }));
+    if ("error" in opened) return stop2(opened.error);
+    if (opened.files.length) turn = await session2(resolving(opened.files), true);
+  } else {
+    const next = await left();
+    if (next) turn = await session2(`${resume2.why === "limit" ? "Your Claude limit has reset." : "You were interrupted: the machine stopped."} ${next}`, true);
+  }
+  for (let resumes = 0; !turn; resumes += 1) {
+    const next = await left();
+    if (!next) break;
     if (resumes >= BUILD_RESUMES_MAX) {
-      const left = stepsLeft(plan, done).length;
-      return stop2(plan ? `Nano stopped with ${left} step${left === 1 ? "" : "s"} of its plan left` : "Nano stopped without saying its plan");
+      if (finished()) break;
+      const steps = stepsLeft(plan, done).length;
+      return stop2(plan ? `Nano stopped with ${steps} step${steps === 1 ? "" : "s"} of its plan left` : "Nano stopped without saying its plan");
     }
-    turn = await session2(carryOn(plan, done), true);
+    turn = await session2(next, true);
   }
   if (turn && "park" in turn) return park(turn.park);
   if (turn) return stop2(turn.stop.error?.message ?? "the build stopped");
+  const marked = await conflictsLeft(worktree, base);
+  if (marked.length) return park({ ask: conflictAsk(base, marked) });
   await commitAll(worktree, `${solution.ref}: ${solution.title}`);
   if (!await commitsSinceFork(worktree, fork)) return stop2("the build finished without changing anything", { keep: false });
-  const rebased = await rebaseOnto(worktree, base);
-  if (!rebased.ok) return stop2(`${base} moved while Nano was building, and the same files changed on both sides: ${rebased.files.join(", ") || "see git status"}`);
-  const [pushed, noPr, page] = await Promise.all([pushBranch(worktree, branch), ghReady(worktree), solutionPage(client, job.project_id, solution.ref)]);
-  if (!pushed.pushed) return stop2(`the push failed: ${pushed.reason}`);
-  const pr = noPr ? null : await openPullRequest(worktree, { branch, base, title: `${solution.ref}: ${solution.title}`, body: prBody(said, page) });
-  if (pr && !pr.ok) return { ...failed(`the branch ${branch} is pushed, but GitHub refused the pull request: ${pr.reason}${pushed.reviewUrl ? `. Open it yourself: ${pushed.reviewUrl}` : ""}`), usage };
-  if (pr) {
-    await events.write("pr", { number: pr.number, url: pr.url });
-    await log("build.pr", `draft pull request #${pr.number} for ${solution.ref}`);
-  }
-  await removeWorktree(clone, dir);
-  return {
-    status: "succeeded",
-    result: [
-      said.trim(),
-      "",
-      pr ? `Draft pull request #${pr.number} \xB7 ${pr.url}` : `Pushed ${branch}. No pull request: ${noPr}.${pushed.reviewUrl ? ` ${pushed.reviewUrl}` : ""}`
-    ].filter(Boolean).join("\n"),
-    data: { branch, session: spec2.sessionId, ...pr ? { pr: { number: pr.number, url: pr.url } } : { review_url: pushed.reviewUrl ?? null } },
-    usage
-  };
+  if (!await containsBase(worktree, base)) {
+    if (await mergedSince(worktree, fork)) {
+      const opened = await mergeBase(worktree, base).catch((err) => ({ error: errorMessage(err) }));
+      if ("error" in opened) return stop2(opened.error);
+      if (opened.files.length) return park({ ask: conflictAsk(base, opened.files) });
+      await commitAll(worktree, `${solution.ref}: ${base} merged in`);
+    } else {
+      const rebased = await rebaseOnto(worktree, base);
+      if (!rebased.ok && !rebased.files.length) return stop2(`the rebase onto ${base} failed: see git status`);
+      if (!rebased.ok) return park({ ask: conflictAsk(base, rebased.files) });
+    }
+  }
+  const push = await pushBranch(worktree, branch);
+  if (!push.pushed) return stop2(`the push failed: ${push.reason}`);
+  return openPr(push.reviewUrl);
 }
+var conflictAsk = (base, files) => ({
+  question: `Someone changed the same files on ${base} while Nano was building.`,
+  why: "Nano can try to merge them and run your checks again, or you resolve it yourself in your terminal. Nothing is pushed until it is resolved.",
+  files,
+  options: [BUILD_CONFLICT.resolve, BUILD_CONFLICT.mine],
+  about: "conflict"
+});
 var failed = (message) => ({ status: "failed", error: { code: "harness_error", message } });
 var AGAIN = {
-  answer: { said: "Your answer is in: carrying on.", lead: "" },
-  limit: { said: "Your Claude limit has reset: carrying on.", lead: "Your Claude limit has reset." },
-  lost: { said: "Picked up again where it stopped.", lead: "You were interrupted: the machine stopped." }
+  answer: "Your answer is in: carrying on.",
+  limit: "Your Claude limit has reset: carrying on.",
+  lost: "Picked up again where it stopped.",
+  conflict: "Merging the main branch in, and resolving it.",
+  refused: "Asking GitHub for the pull request again."
 };
 function askOf(input) {
   const { question, options, why } = input ?? {};
@@ -14492,7 +14604,7 @@ import { promisify as promisify8 } from "util";
 // package.json
 var package_default = {
   name: "@nanopm/cli",
-  version: "0.1.13",
+  version: "0.1.16",
   description: "An autonomous product manager for builders who run several small products. Runs on your machine, drives your own coding harness.",
   type: "module",
   license: "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanopm/cli",
-  "version": "0.1.13",
+  "version": "0.1.16",
   "description": "An autonomous product manager for builders who run several small products. Runs on your machine, drives your own coding harness.",
   "type": "module",
   "license": "MIT",

package/skills/build/SKILL.md

@@ -52,7 +52,9 @@ question per `ask_user`, with the options, and what you looked at in `why`.
   stops to wait on a background task is a build that stops.
 - The analytics events the spec names ship with the change, named as it says. No word a user
   typed goes in an event.
-- Do not touch secrets. `.env` files and keys are denied to you, deliberately.
+- Do not touch secrets. `.env` files and keys are denied to you, deliberately. Your sandbox keeps
+  you from reading them, so `git status` and `git diff` show them as deleted (`D`) and print
+  "Operation not permitted": they are not deleted. Never report them, restore them or stage them.
 - Do not reformat, rename or tidy anything the spec did not ask for. A diff the founder cannot
   review in one sitting is a diff they will not merge.
 - Install a new dependency only if the spec allows it; otherwise ask.