@refleet-it/runner 0.1.186

package/dist/cli.js

@@ -0,0 +1,165 @@
+#!/usr/bin/env node
+import { realpathSync } from 'node:fs';
+import { hostname } from 'node:os';
+import { pathToFileURL } from 'node:url';
+import { clearStoredConfig, loadStoredConfig, resolveFleetConfig, saveStoredConfig } from './config.js';
+import { createApiKey, listApiKeys, login, revokeApiKey } from './backend-client.js';
+import { FleetStartupError, fleetOptionsFromEnv, runFleet } from './fleet/loop.js';
+import { createPrompter } from './prompt.js';
+const DEFAULT_API_URL = 'http://localhost/api';
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/**
+ * Interactive login: email+password against /identity/login, then mints a fresh
+ * long-lived API key via /identity/api-keys and saves it locally — the "CLI mode"
+ * counterpart to setting REFLEET_API_URL/REFLEET_API_KEY by hand for automatic/cloud
+ * mode. Revokes a previous local login's key first (best-effort) so re-running
+ * `login` doesn't litter the account's key list every time.
+ */
+async function runLogin() {
+    const existing = loadStoredConfig();
+    const prompter = createPrompter();
+    let apiUrl, email, password;
+    try {
+        const apiUrlInput = await prompter.question(`API URL [${DEFAULT_API_URL}]: `);
+        apiUrl = '' === apiUrlInput ? DEFAULT_API_URL : apiUrlInput;
+        email = await prompter.question('Email: ');
+        password = await prompter.questionHidden('Password: ');
+    }
+    finally {
+        prompter.close();
+    }
+    const { jwtToken } = await login(apiUrl, email, password);
+    const created = await createApiKey(apiUrl, jwtToken, `refleet-runner (${hostname()})`);
+    if (existing) {
+        try {
+            await revokeApiKey(existing.apiUrl, existing.apiKey, existing.apiKeyId);
+        }
+        catch (err) {
+            process.stderr.write(`warning: failed to revoke the previous local API key: ${errorMessage(err)}\n`);
+        }
+    }
+    saveStoredConfig({
+        apiUrl,
+        apiKey: created.token,
+        apiKeyId: created.id,
+        accountEmail: email,
+        createdAt: created.createdAt,
+    });
+    process.stdout.write(`Logged in as ${email}. API key ${created.prefix}… saved to your local config.\n`);
+    process.stdout.write("Run 'refleet-runner run' to start the runner.\n");
+}
+/** Revokes the locally saved key on the backend (best-effort) and clears the local config. */
+async function runLogout() {
+    const existing = loadStoredConfig();
+    if (!existing) {
+        process.stdout.write('Not logged in.\n');
+        return;
+    }
+    try {
+        await revokeApiKey(existing.apiUrl, existing.apiKey, existing.apiKeyId);
+    }
+    catch (err) {
+        process.stderr.write(`warning: failed to revoke the API key on the backend: ${errorMessage(err)}\n`);
+    }
+    clearStoredConfig();
+    process.stdout.write('Logged out.\n');
+}
+/** Shows which credentials are currently effective and whether they still work. */
+async function runWhoami() {
+    const resolved = resolveFleetConfig(process.env);
+    if (!resolved) {
+        process.stdout.write("Not logged in, and REFLEET_API_URL/REFLEET_API_KEY aren't set. Run 'refleet-runner login'.\n");
+        process.exitCode = 1;
+        return;
+    }
+    const sourceLabel = 'env' === resolved.source ? 'environment variables (automatic mode)' : 'refleet-runner login';
+    process.stdout.write(`API URL: ${resolved.apiUrl}\n`);
+    process.stdout.write(`API key: ${resolved.apiKey.slice(0, 12)}…\n`);
+    process.stdout.write(`Source:  ${sourceLabel}\n`);
+    try {
+        const keys = await listApiKeys(resolved.apiUrl, resolved.apiKey);
+        process.stdout.write(`Connected (${String(keys.length)} API key(s) on this account).\n`);
+    }
+    catch (err) {
+        process.stdout.write(`Could not reach the backend, or this key is no longer valid: ${errorMessage(err)}\n`);
+        process.exitCode = 1;
+    }
+}
+/**
+ * The fleet loop itself: REFLEET_API_URL/REFLEET_API_KEY (automatic/cloud mode: Docker,
+ * CI, any headless deployment) win over a locally saved `login`; without either there
+ * is no idle mode — the process exits so a misconfigured runner is noticed, not left
+ * silently waiting. SIGINT/SIGTERM finish the job in progress and then return.
+ */
+async function runRunner() {
+    const credentials = resolveFleetConfig(process.env);
+    if (!credentials) {
+        throw new Error("REFLEET_API_URL and REFLEET_API_KEY are both required — this runner only supports fleet mode. Run 'refleet-runner login' (or set them directly) first.");
+    }
+    const controller = new AbortController();
+    const stop = () => {
+        process.stdout.write('refleet-runner: shutting down after the current job\n');
+        controller.abort();
+    };
+    process.once('SIGINT', stop);
+    process.once('SIGTERM', stop);
+    try {
+        await runFleet(fleetOptionsFromEnv(process.env, credentials), controller.signal);
+    }
+    catch (err) {
+        if (err instanceof FleetStartupError) {
+            throw err;
+        }
+        // Reached only through an unexpected exception inside a poll loop: exit non-zero so
+        // the supervisor (Docker restart policy, systemd) restarts the whole runner.
+        process.stderr.write(`refleet-runner: fleet loop died: ${errorMessage(err)}\n`);
+        process.exitCode = 1;
+    }
+}
+async function main() {
+    const command = process.argv[2];
+    switch (command) {
+        case 'login':
+            await runLogin();
+            return;
+        case 'logout':
+            await runLogout();
+            return;
+        case 'whoami':
+            await runWhoami();
+            return;
+        case 'run':
+            await runRunner();
+            return;
+        default:
+            process.stderr.write(`refleet-runner: unknown command ${JSON.stringify(command ?? '')}\n`);
+            process.stderr.write('Usage: refleet-runner <login|logout|whoami|run>\n');
+            process.exitCode = 1;
+    }
+}
+/**
+ * npm links bin entries as symlinks, so argv[1] is node_modules/.bin/refleet-runner while
+ * import.meta.url is the resolved dist/cli.js — comparing them raw made the installed CLI a
+ * silent no-op. Resolve the symlink, and build the URL rather than concatenating it so paths
+ * with spaces compare correctly too.
+ */
+function isMainModule() {
+    const entry = process.argv[1];
+    if (undefined === entry) {
+        return false;
+    }
+    try {
+        return import.meta.url === pathToFileURL(realpathSync(entry)).href;
+    }
+    catch {
+        return false;
+    }
+}
+if (isMainModule()) {
+    main().catch((err) => {
+        process.stderr.write(`refleet-runner: ${errorMessage(err)}\n`);
+        process.exitCode = 1;
+    });
+}

package/dist/config.js

@@ -0,0 +1,57 @@
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Local login credentials saved by `refleet-runner login`, read back by `whoami`/
+ * `logout` and used by `run` when REFLEET_API_URL/REFLEET_API_KEY aren't set.
+ * Lives under XDG_CONFIG_HOME (falling back to ~/.config, the convention
+ * most CLI tools on the host already follow) rather than inside this repo, since
+ * it's per-machine/per-person, not project state. `baseDir` overrides the whole
+ * resolution for tests, same DI shape as detectAgents' injectable `isExecutable`.
+ */
+function configDir(baseDir) {
+    if (baseDir) {
+        return baseDir;
+    }
+    const xdgConfigHome = process.env.XDG_CONFIG_HOME;
+    const base = xdgConfigHome && '' !== xdgConfigHome ? xdgConfigHome : join(homedir(), '.config');
+    return join(base, 'refleet');
+}
+function configPath(baseDir) {
+    return join(configDir(baseDir), 'runner.json');
+}
+export function loadStoredConfig(baseDir) {
+    const path = configPath(baseDir);
+    if (!existsSync(path)) {
+        return null;
+    }
+    return JSON.parse(readFileSync(path, 'utf8'));
+}
+export function saveStoredConfig(config, baseDir) {
+    mkdirSync(configDir(baseDir), { recursive: true, mode: 0o700 });
+    writeFileSync(configPath(baseDir), JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+}
+export function clearStoredConfig(baseDir) {
+    const path = configPath(baseDir);
+    if (existsSync(path)) {
+        rmSync(path);
+    }
+}
+/**
+ * REFLEET_API_URL/REFLEET_API_KEY (automatic/cloud mode: Docker, CI, any headless
+ * deployment) always win over a locally saved `login`; the stored file is only
+ * consulted when both env vars are absent. Returns null when neither source has
+ * credentials.
+ */
+export function resolveFleetConfig(env, baseDir) {
+    const envUrl = env.REFLEET_API_URL;
+    const envKey = env.REFLEET_API_KEY;
+    if (envUrl && envKey) {
+        return { apiUrl: envUrl, apiKey: envKey, source: 'env' };
+    }
+    const stored = loadStoredConfig(baseDir);
+    if (stored) {
+        return { apiUrl: stored.apiUrl, apiKey: stored.apiKey, source: 'file' };
+    }
+    return null;
+}

package/dist/detect.js

@@ -0,0 +1,71 @@
+import { accessSync, constants } from 'node:fs';
+import { delimiter, join } from 'node:path';
+/**
+ * kiro-cli is Kiro's CLI binary name; claude is the Claude Code CLI. Scoped to these
+ * two agents for now (see the Runner redesign plan) — extending to more agents means
+ * adding a spec here, nothing else.
+ */
+const AGENT_SPECS = [
+    { engine: 'claude', defaultCommand: 'claude', pathEnvVar: 'REFLEET_CLAUDE_PATH' },
+    { engine: 'kiro', defaultCommand: 'kiro-cli', pathEnvVar: 'REFLEET_KIRO_PATH' },
+];
+export function defaultIsExecutable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Resolves a command to an executable path the same way a Unix shell would: if it
+ * already contains a path separator, it's used as-is (only checked for
+ * executability); otherwise every directory on PATH is scanned in order. Returns null
+ * when nothing executable is found — the caller treats that engine as not installed.
+ */
+export function resolveExecutable(command, env, isExecutable = defaultIsExecutable) {
+    const trimmed = command.trim();
+    if ('' === trimmed) {
+        return null;
+    }
+    if (trimmed.includes('/')) {
+        return isExecutable(trimmed) ? trimmed : null;
+    }
+    const pathEnv = env.PATH ?? '';
+    for (const dir of pathEnv.split(delimiter)) {
+        if ('' === dir) {
+            continue;
+        }
+        const candidate = join(dir, trimmed);
+        if (isExecutable(candidate)) {
+            return candidate;
+        }
+    }
+    return null;
+}
+/**
+ * Detects which of the supported agent CLIs are available on this host — the
+ * auto-detection this whole runner redesign is for. Called once when `refleet-runner
+ * run` starts (see fleet/loop.ts); a CLI installed after that requires a restart, not
+ * a live re-probe.
+ */
+export function detectAgents(env = process.env, isExecutable = defaultIsExecutable) {
+    const detected = [];
+    for (const spec of AGENT_SPECS) {
+        const override = env[spec.pathEnvVar];
+        const command = override && '' !== override.trim() ? override : spec.defaultCommand;
+        const path = resolveExecutable(command, env, isExecutable);
+        if (null !== path) {
+            detected.push({ engine: spec.engine, path });
+        }
+    }
+    return detected;
+}
+function isMainModule() {
+    return undefined !== process.argv[1] && import.meta.url === `file://${process.argv[1]}`;
+}
+if (isMainModule()) {
+    const agents = detectAgents();
+    process.stdout.write(agents.map(a => a.engine).join(' '));
+}

package/dist/fleet/api.js

@@ -0,0 +1,117 @@
+function withList(key, values) {
+    return values && values.length > 0 ? { [key]: values } : {};
+}
+/**
+ * The runner-facing slice of the Refleet API. Nothing here throws on a network error:
+ * a transient outage must skip one poll cycle, not kill the loop.
+ */
+export class FleetApi {
+    apiKey;
+    log;
+    fetchFn;
+    baseUrl;
+    constructor(apiUrl, apiKey, log, fetchFn = fetch) {
+        this.apiKey = apiKey;
+        this.log = log;
+        this.fetchFn = fetchFn;
+        this.baseUrl = apiUrl.replace(/\/+$/, '');
+    }
+    async request(method, path, body) {
+        try {
+            const response = await this.fetchFn(`${this.baseUrl}${path}`, {
+                method,
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                    'Content-Type': 'application/json',
+                },
+                body: undefined === body ? undefined : JSON.stringify(body),
+            });
+            return { status: response.status, body: await response.text() };
+        }
+        catch {
+            return { status: 0, body: '' };
+        }
+    }
+    async heartbeat(identity) {
+        const body = {
+            name: identity.name,
+            ...withList('supportedEngines', identity.supportedEngines),
+            ...withList('supportedModels', identity.supportedModels),
+        };
+        const response = await this.request('POST', '/runner/heartbeat', body);
+        if (!isSuccess(response.status)) {
+            this.log(`heartbeat request failed (status ${String(response.status)})`);
+        }
+    }
+    /** Returns null when no job is available (204) or the claim failed for any reason. */
+    async claimJob(identity) {
+        const body = {
+            runnerId: identity.name,
+            ...withList('supportedKinds', identity.supportedKinds),
+            ...withList('supportedModes', identity.supportedModes),
+            ...withList('supportedEngines', identity.supportedEngines),
+        };
+        const response = await this.request('POST', '/runner/jobs/claim', body);
+        if (200 !== response.status) {
+            return null;
+        }
+        try {
+            const claimed = JSON.parse(response.body);
+            return claimed.jobId ? claimed : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    async reportJob(identity, jobId, report) {
+        const body = {
+            runnerId: identity.name,
+            outcome: report.outcome,
+            summary: report.summary,
+            ...(report.errorMessage ? { errorMessage: report.errorMessage } : {}),
+            ...(undefined !== report.qualified ? { qualified: report.qualified } : {}),
+            ...(report.branchName ? { branchName: report.branchName } : {}),
+        };
+        const response = await this.request('POST', `/runner/jobs/${jobId}/report`, body);
+        if (!isSuccess(response.status)) {
+            this.log(`report failed for job ${jobId} (status ${String(response.status)})`);
+        }
+    }
+    /**
+     * Reports the real GitLab merge request URL once one has been opened (see
+     * ReportShiftMergeRequestStatusController), so the shift detail page can link to
+     * it instead of showing a bare "Open" status.
+     */
+    async reportMergeRequestOpened(shiftId, shiftTargetId, url) {
+        const response = await this.request('POST', `/shifts/${shiftId}/targets/${shiftTargetId}/merge-request`, {
+            status: 'opened',
+            url,
+        });
+        if (!isSuccess(response.status)) {
+            this.log(`failed to report merge request URL for target ${shiftTargetId} (status ${String(response.status)})`);
+        }
+    }
+    /**
+     * Fetched per job rather than once at startup so a reconnected/rotated GitLab
+     * token is picked up without restarting the runner.
+     */
+    async fetchGitLabCredentials() {
+        const response = await this.request('GET', '/runner/gitlab-credentials');
+        if (200 !== response.status) {
+            return null;
+        }
+        try {
+            const body = JSON.parse(response.body);
+            if (!body.baseUrl || !body.accessToken) {
+                return null;
+            }
+            return { baseUrl: body.baseUrl, accessToken: body.accessToken };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function isSuccess(status) {
+    return status >= 200 && status < 300;
+}

package/dist/fleet/execute.js

@@ -0,0 +1,33 @@
+import { detectAgents } from '../detect.js';
+import { ClaudeBackend } from '../backends/claude.js';
+import { KiroBackend } from '../backends/kiro.js';
+import { AgentExecutionError } from '../backends/types.js';
+/**
+ * Re-runs the same PATH-based detection the fleet loop used to decide which engines to
+ * register, so a job can never make this host execute a caller-supplied path — only an
+ * engine it actually has installed.
+ */
+export function resolveBackend(engine) {
+    const detected = detectAgents().find(agent => agent.engine === engine);
+    if (!detected) {
+        throw new AgentExecutionError(`engine "${engine}" was not detected on this host`);
+    }
+    return 'claude' === engine ? new ClaudeBackend(detected.path) : new KiroBackend(detected.path);
+}
+/**
+ * Extracts the prompt/engine/model an AI-mode job carries (see
+ * StartQualificationHandler/StartShiftChangeHandler's buildPayload) and hands it to
+ * the matching backend, which spawns the CLI and speaks its native protocol.
+ */
+export const executeJob = async (kind, payload, repoDir) => {
+    const engine = payload.engine ?? 'claude';
+    if ('claude' !== engine && 'kiro' !== engine) {
+        throw new AgentExecutionError(`unsupported engine "${engine}"`);
+    }
+    const prompt = (payload.prompt ?? '').trim();
+    if ('' === prompt) {
+        throw new AgentExecutionError('job payload has no prompt');
+    }
+    const result = await resolveBackend(engine).execute(prompt, { cwd: repoDir, kind, model: payload.model });
+    return result.output;
+};

package/dist/fleet/git.js

@@ -0,0 +1,34 @@
+import { execFile } from 'node:child_process';
+export class GitError extends Error {
+    args;
+    exitCode;
+    stderr;
+    constructor(args, exitCode, stderr) {
+        super(`git ${args.join(' ')} exited with ${String(exitCode)}: ${stderr.trim()}`);
+        this.args = args;
+        this.exitCode = exitCode;
+        this.stderr = stderr;
+    }
+}
+/**
+ * GitLab's git-http backend (unlike its REST API) does not accept the PRIVATE-TOKEN
+ * header — it only honors HTTP Basic auth, so the token is sent as a Basic credential
+ * (any non-empty username works). Passed per invocation as `-c http.extraHeader` so it
+ * is never written into the cached checkout's git config.
+ */
+export function gitAuthConfig(accessToken) {
+    const basic = Buffer.from(`oauth2:${accessToken}`).toString('base64');
+    return ['-c', `http.extraHeader=Authorization: Basic ${basic}`];
+}
+export function createGitRunner(execFileFn = execFile) {
+    return (args, cwd) => new Promise((resolve, reject) => {
+        execFileFn('git', args, { cwd, maxBuffer: 64 * 1024 * 1024, env: { ...process.env, GIT_TERMINAL_PROMPT: '0' } }, (error, stdout, stderr) => {
+            if (error) {
+                const code = 'code' in error && 'number' === typeof error.code ? error.code : null;
+                reject(new GitError(args, code, String(stderr)));
+                return;
+            }
+            resolve({ stdout: String(stdout), stderr: String(stderr) });
+        });
+    });
+}

package/dist/fleet/gitlab.js

@@ -0,0 +1,66 @@
+export class GitLabRequestError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+function apiBase(credentials) {
+    return `${credentials.baseUrl.replace(/\/+$/, '')}/api/v4`;
+}
+async function gitlabRequest(credentials, fetchFn, method, path, body) {
+    return fetchFn(`${apiBase(credentials)}${path}`, {
+        method,
+        headers: {
+            'PRIVATE-TOKEN': credentials.accessToken,
+            'Content-Type': 'application/json',
+        },
+        body: undefined === body ? undefined : JSON.stringify(body),
+    });
+}
+async function findOpenMergeRequest(credentials, projectId, spec, fetchFn) {
+    const query = new URLSearchParams({
+        source_branch: spec.sourceBranch,
+        target_branch: spec.targetBranch,
+        state: 'opened',
+    });
+    const response = await gitlabRequest(credentials, fetchFn, 'GET', `/projects/${projectId}/merge_requests?${query.toString()}`);
+    if (!response.ok) {
+        return null;
+    }
+    const list = (await response.json());
+    return list[0]?.web_url ?? null;
+}
+/**
+ * Opens a merge request straight through the GitLab REST API — the branch has already
+ * been pushed by publishChange, so unlike `glab mr create --push` this never needs
+ * git credentials of its own.
+ *
+ * A retried job force-pushes the same deterministic branch, which used to fail here
+ * with GitLab's 409 "merge request already exists"; the existing open MR is looked up
+ * and reused instead, so the retry ends up reporting the URL the shift already has.
+ */
+export async function createMergeRequest(credentials, projectId, spec, fetchFn = fetch) {
+    const response = await gitlabRequest(credentials, fetchFn, 'POST', `/projects/${projectId}/merge_requests`, {
+        source_branch: spec.sourceBranch,
+        target_branch: spec.targetBranch,
+        title: spec.title,
+        description: spec.description,
+        remove_source_branch: true,
+    });
+    if (409 === response.status) {
+        const existing = await findOpenMergeRequest(credentials, projectId, spec, fetchFn);
+        if (existing) {
+            return existing;
+        }
+    }
+    if (!response.ok) {
+        const detail = (await response.text()).slice(0, 500);
+        throw new GitLabRequestError(`merge request creation failed (status ${String(response.status)}): ${detail}`, response.status);
+    }
+    const created = (await response.json());
+    if (!created.web_url) {
+        throw new GitLabRequestError('merge request created but the response carried no web_url', response.status);
+    }
+    return created.web_url;
+}

package/dist/fleet/job.js

@@ -0,0 +1,108 @@
+import { publishChange as defaultPublishChange, syncRepo as defaultSyncRepo } from './workspace.js';
+/** The backend's summary/errorMessage columns are bounded; keep the tail, where the verdict is. */
+const REPORT_TAIL_CHARS = 4000;
+/**
+ * The last line matching "QUALIFICATION_DECISION: true|false" wins, so a decision
+ * restated mid-explanation doesn't confuse the match. The backend bakes this
+ * instruction into the AI prompt (see StartQualificationHandler::buildAiQualificationPrompt).
+ * Returns null if the job never committed to one.
+ */
+export function extractQualificationDecision(output) {
+    const matches = output.match(/QUALIFICATION_DECISION:\s*(true|false)/g);
+    if (!matches) {
+        return null;
+    }
+    const last = matches[matches.length - 1];
+    return undefined !== last && last.endsWith('true');
+}
+function tail(text) {
+    return text.length > REPORT_TAIL_CHARS ? text.slice(-REPORT_TAIL_CHARS) : text;
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function projectOf(job) {
+    const project = job.payload?.project;
+    if (!project?.externalId || !project.path) {
+        return null;
+    }
+    return { externalId: project.externalId, path: project.path, defaultBranch: project.defaultBranch ?? 'main' };
+}
+/**
+ * Claims at most one job and runs it to completion. Every failure mode after a
+ * successful claim is reported back as a job failure and swallowed — the poll loop
+ * must keep going — so only a genuinely unexpected exception escapes.
+ */
+export async function claimAndRunJob(deps) {
+    const job = await deps.api.claimJob(deps.identity);
+    if (!job) {
+        return;
+    }
+    const report = (outcome, summary, extra = {}) => deps.api.reportJob(deps.identity, job.jobId, { outcome, summary, ...extra });
+    const project = projectOf(job);
+    if (!project) {
+        deps.log(`job ${job.jobId} is missing project info, reporting failure`);
+        await report('failure', 'Runner job payload is missing project information', { errorMessage: 'missing project info' });
+        return;
+    }
+    const credentials = await deps.api.fetchGitLabCredentials();
+    if (!credentials) {
+        deps.log(`job ${job.jobId}: failed to fetch GitLab credentials from Slipway`);
+        await report('failure', 'Failed to fetch GitLab credentials from Slipway', { errorMessage: 'gitlab credentials fetch failed' });
+        return;
+    }
+    let repoDir;
+    try {
+        repoDir = await (deps.syncRepo ?? defaultSyncRepo)(deps.workspace, credentials, project);
+    }
+    catch (err) {
+        deps.log(`job ${job.jobId}: failed to check out ${project.path}: ${errorMessage(err)}`);
+        await report('failure', `Failed to clone/update ${project.path}`, { errorMessage: tail(`git sync failed: ${errorMessage(err)}`) });
+        return;
+    }
+    const kind = 'qualification' === job.kind ? 'qualification' : 'change';
+    deps.log(`claimed job ${job.jobId} (${kind}) for project ${project.path}, running in ${repoDir}`);
+    let output;
+    try {
+        output = await deps.execute(kind, job.payload ?? {}, repoDir);
+    }
+    catch (err) {
+        deps.log(`job ${job.jobId} failed`);
+        await report('failure', 'Task execution failed', { errorMessage: tail(errorMessage(err)) });
+        return;
+    }
+    if ('qualification' === kind) {
+        const decision = extractQualificationDecision(output);
+        if (null === decision) {
+            deps.log(`job ${job.jobId} succeeded but returned no qualification decision`);
+            await report('failure', 'Agent did not return a clear qualification decision', { errorMessage: tail(output) });
+        }
+        else {
+            deps.log(`job ${job.jobId} succeeded, decision=${String(decision)}`);
+            await report('success', tail(output), { qualified: decision });
+        }
+        return;
+    }
+    await publishAndReport(deps, job, credentials, repoDir, project, output, report);
+}
+async function publishAndReport(deps, job, credentials, repoDir, project, output, report) {
+    let published;
+    try {
+        published = await (deps.publishChange ?? defaultPublishChange)(deps.workspace, credentials, repoDir, project, job.ownerTargetId ?? '', `Apply Slipway shift ${job.ownerId ?? ''}`, tail(output), deps.fetchFn);
+    }
+    catch (err) {
+        deps.log(`job ${job.jobId}: failed to push the change / open a merge request: ${errorMessage(err)}`);
+        await report('failure', 'Failed to push the change and open a GitLab merge request', { errorMessage: tail(output) });
+        return;
+    }
+    if (!published) {
+        deps.log(`job ${job.jobId} succeeded with no changes to publish`);
+        await report('success', tail(output));
+        return;
+    }
+    deps.log(`job ${job.jobId} succeeded, opened merge request ${published.mergeRequestUrl}`);
+    await report('success', tail(output), { branchName: published.branchName });
+    if (job.ownerId && job.ownerTargetId) {
+        await deps.api.reportMergeRequestOpened(job.ownerId, job.ownerTargetId, published.mergeRequestUrl);
+    }
+}

package/dist/fleet/log.js

@@ -0,0 +1,4 @@
+/** `[runner] <name>: <message>` — the line format the Docker/journal logs have always had. */
+export function createLogger(runnerName, write = line => process.stdout.write(line)) {
+    return message => write(`[runner] ${runnerName}: ${message}\n`);
+}