@renseiai/agentfactory 0.8.0

package/dist/src/orchestrator/stream-parser.js

@@ -0,0 +1,137 @@
+/**
+ * Claude Stream-JSON Parser
+ *
+ * @deprecated This module is dead code — providers now emit normalized AgentEvents
+ * directly (see providers/types.ts). Activity emitters consume AgentEvent streams,
+ * not ClaudeStreamEvent. Retained for backward compatibility of public type exports.
+ * Will be removed in v1.0.
+ *
+ * Parses Claude's stream-json output format and maps events to handler callbacks.
+ * The stream-json format emits newline-delimited JSON events during execution.
+ *
+ * Event types:
+ * - init: Initial message with configuration
+ * - system: System messages and prompts
+ * - assistant: Assistant text output (partial/streaming)
+ * - tool_use: Tool being invoked
+ * - tool_result: Result from tool execution
+ * - result: Final result when complete
+ * - error: Error events
+ */
+/**
+ * Claude Stream Parser
+ *
+ * @deprecated Providers now emit normalized AgentEvents directly.
+ * Activity emitters consume AgentEvent streams, not ClaudeStreamEvent.
+ * This class is retained for backward compatibility and will be removed in v1.0.
+ */
+export class ClaudeStreamParser {
+    buffer = '';
+    handlers;
+    constructor(handlers = {}) {
+        this.handlers = handlers;
+    }
+    /**
+     * Feed raw data from stdout into the parser
+     */
+    async feed(data) {
+        this.buffer += data.toString();
+        // Process complete lines
+        const lines = this.buffer.split('\n');
+        // Keep the last incomplete line in buffer
+        this.buffer = lines.pop() ?? '';
+        for (const line of lines) {
+            if (line.trim()) {
+                await this.parseLine(line);
+            }
+        }
+    }
+    /**
+     * Flush any remaining buffered data
+     */
+    async flush() {
+        if (this.buffer.trim()) {
+            await this.parseLine(this.buffer);
+            this.buffer = '';
+        }
+    }
+    /**
+     * Parse a single JSON line and dispatch to appropriate handler
+     */
+    async parseLine(line) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch (error) {
+            // Log JSON parse errors with context for debugging
+            // This helps diagnose truncated or malformed messages
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const linePreview = line.length > 200
+                ? line.substring(0, 200) + `... (${line.length} chars total)`
+                : line;
+            console.warn('JSON parse error in stream', {
+                error: errorMessage,
+                lineLength: line.length,
+                linePreview,
+            });
+            return;
+        }
+        await this.dispatchEvent(event);
+    }
+    /**
+     * Dispatch an event to the appropriate handler
+     */
+    async dispatchEvent(event) {
+        try {
+            switch (event.type) {
+                case 'init':
+                    await this.handlers.onInit?.(event);
+                    break;
+                case 'system':
+                    await this.handlers.onSystem?.(event);
+                    break;
+                case 'assistant':
+                    await this.handlers.onAssistant?.(event);
+                    break;
+                case 'tool_use':
+                    await this.handlers.onToolUse?.(event);
+                    break;
+                case 'tool_result':
+                    await this.handlers.onToolResult?.(event);
+                    break;
+                case 'result':
+                    await this.handlers.onResult?.(event);
+                    break;
+                case 'error':
+                    await this.handlers.onError?.(event);
+                    break;
+                case 'user':
+                    await this.handleUserEvent(event);
+                    break;
+                default:
+                    await this.handlers.onUnknown?.(event);
+            }
+        }
+        catch (error) {
+            console.error(`Error handling ${event.type} event:`, error);
+        }
+    }
+    /**
+     * Handle user events, extracting todo updates if present
+     */
+    async handleUserEvent(event) {
+        // Always call onUser if registered
+        await this.handlers.onUser?.(event);
+        // Check for todo updates in tool_use_result
+        if (event.tool_use_result?.newTodos) {
+            await this.handlers.onTodo?.(event.tool_use_result.newTodos, event.tool_use_result.oldTodos ?? []);
+        }
+    }
+}
+/**
+ * Create a new Claude stream parser instance
+ */
+export function createStreamParser(handlers) {
+    return new ClaudeStreamParser(handlers);
+}

package/dist/src/orchestrator/types.d.ts

@@ -0,0 +1,232 @@
+/**
+ * Agent Orchestrator Types
+ */
+import type { AgentWorkType } from '@renseiai/agentfactory-linear';
+import type { AgentProvider } from '../providers/types.js';
+/**
+ * Result of parsing an agent's output to determine pass/fail
+ * Used for QA and acceptance work types to decide status transitions
+ */
+export type AgentWorkResult = 'passed' | 'failed' | 'unknown';
+/**
+ * Timeout configuration for a specific work type
+ */
+export interface WorkTypeTimeoutConfig {
+    /** Inactivity timeout in milliseconds for this work type */
+    inactivityTimeoutMs?: number;
+    /** Maximum session duration in milliseconds for this work type */
+    maxSessionTimeoutMs?: number;
+}
+export interface OrchestratorConfig {
+    /** Agent provider instance. If not provided, resolved via AGENT_PROVIDER env var (default: claude) */
+    provider?: AgentProvider;
+    /** Maximum concurrent agents (default: 3) */
+    maxConcurrent?: number;
+    /** Project name to filter backlog issues */
+    project?: string;
+    /** Base path for git worktrees (default: .worktrees) */
+    worktreePath?: string;
+    /** Linear API key (defaults to LINEAR_API_KEY env var) */
+    linearApiKey?: string;
+    /** Whether to auto-transition issue status (default: true) */
+    autoTransition?: boolean;
+    /**
+     * Preserve worktree when PR creation fails for development work types (default: true).
+     * When true, worktrees are kept if:
+     * - Work type is 'development' or 'inflight' and no PR URL was detected
+     * - There are uncommitted changes in the worktree
+     * - There are unpushed commits on the branch
+     * This prevents data loss when git push or PR creation fails.
+     */
+    preserveWorkOnPrFailure?: boolean;
+    /**
+     * Enable sandbox mode for spawned agents (default: false).
+     *
+     * WARNING: Currently defaults to false due to known bugs in Claude Code's sandbox:
+     * - https://github.com/anthropics/claude-code/issues/14162 (excludedCommands doesn't bypass network)
+     * - https://github.com/anthropics/claude-code/issues/12150 (proxy set for excluded commands)
+     *
+     * Set to true to re-enable sandbox once these issues are fixed.
+     */
+    sandboxEnabled?: boolean;
+    /** Configuration for streaming activities to Linear */
+    streamConfig?: OrchestratorStreamConfig;
+    /**
+     * Configuration for proxying activities through the agent API.
+     * When set, activities are sent to the API endpoint instead of directly to Linear.
+     * This is required for remote workers because Linear's Agent API requires OAuth tokens.
+     */
+    apiActivityConfig?: {
+        /** Base URL of the agent API (e.g., https://agent.rensei.dev) */
+        baseUrl: string;
+        /** API authentication key for the worker */
+        apiKey: string;
+        /** Worker ID for identification */
+        workerId: string;
+    };
+    /**
+     * Inactivity timeout in milliseconds (default: 300000 = 5 minutes).
+     * Agent is stopped if no activity for this duration.
+     * Can be overridden per work type via workTypeTimeouts.
+     */
+    inactivityTimeoutMs?: number;
+    /**
+     * Maximum session duration in milliseconds (default: unlimited).
+     * Hard cap on total agent runtime regardless of activity.
+     * Can be overridden per work type via workTypeTimeouts.
+     */
+    maxSessionTimeoutMs?: number;
+    /**
+     * Per-work-type timeout overrides.
+     * Different work types (e.g., QA, development) can have different thresholds.
+     */
+    workTypeTimeouts?: Partial<Record<AgentWorkType, WorkTypeTimeoutConfig>>;
+    /**
+     * Path to a directory containing custom workflow template YAML files.
+     * Templates in this directory override built-in defaults per work type.
+     * Supports .agentfactory/templates/ convention.
+     */
+    templateDir?: string;
+    /**
+     * Git remote URL pattern to validate against (e.g. 'github.com/renseiai/agentfactory').
+     * When set, the orchestrator validates that the git remote origin contains this pattern
+     * at startup and before spawning agents. Supports both HTTPS and SSH URL formats.
+     */
+    repository?: string;
+}
+export interface OrchestratorIssue {
+    id: string;
+    identifier: string;
+    title: string;
+    description: string | undefined;
+    url: string;
+    priority: number;
+    labels: string[];
+    /** Team key resolved from the issue (used to set LINEAR_TEAM_NAME env var) */
+    teamName?: string;
+    /** Project name resolved from the issue (used for path scoping in monorepos) */
+    projectName?: string;
+}
+export interface AgentProcess {
+    issueId: string;
+    identifier: string;
+    /** Worktree identifier includes work type suffix (e.g., "SUP-294-QA"). Undefined for non-code work types. */
+    worktreeIdentifier?: string;
+    sessionId?: string;
+    /** Provider CLI session ID for resuming sessions with --resume */
+    providerSessionId?: string;
+    /** Worktree path for code work types. Undefined for non-code work types (research, backlog-creation). */
+    worktreePath?: string;
+    pid: number | undefined;
+    status: 'starting' | 'running' | 'completed' | 'failed' | 'stopped' | 'incomplete';
+    startedAt: Date;
+    completedAt?: Date;
+    exitCode?: number;
+    error?: Error;
+    /** Type of work: 'development' or 'qa' */
+    workType?: AgentWorkType;
+    /** GitHub PR URL if a pull request was created */
+    pullRequestUrl?: string;
+    /** Full completion message from Claude (stored for comment posting) */
+    resultMessage?: string;
+    /** Reason why work was marked incomplete (only set when status is 'incomplete') */
+    incompleteReason?: 'no_pr_created' | 'uncommitted_changes' | 'unpushed_commits';
+    /** Result of work for QA/acceptance agents (passed/failed/unknown) */
+    workResult?: AgentWorkResult;
+    /** Reason why agent was stopped (only set when status is 'stopped') */
+    stopReason?: 'user_request' | 'timeout';
+    /** Last activity timestamp for inactivity timeout tracking */
+    lastActivityAt: Date;
+    /** Total cost in USD (accumulated from provider result events) */
+    totalCostUsd?: number;
+    /** Total input tokens used */
+    inputTokens?: number;
+    /** Total output tokens used */
+    outputTokens?: number;
+}
+export interface OrchestratorEvents {
+    onAgentStart?: (agent: AgentProcess) => void;
+    onAgentComplete?: (agent: AgentProcess) => void;
+    onAgentError?: (agent: AgentProcess, error: Error) => void;
+    onAgentStopped?: (agent: AgentProcess) => void;
+    /** Called when agent work is incomplete (no PR, uncommitted changes, etc.) */
+    onAgentIncomplete?: (agent: AgentProcess) => void;
+    onIssueSelected?: (issue: OrchestratorIssue) => void;
+    /** Called when provider session ID is captured from init event */
+    onProviderSessionId?: (linearSessionId: string, providerSessionId: string) => void | Promise<void>;
+    /** Called when an activity is emitted for an agent (used for timeout tracking) */
+    onActivityEmitted?: (agent: AgentProcess, activityType: string) => void;
+}
+export interface SpawnAgentOptions {
+    issueId: string;
+    identifier: string;
+    /** Worktree identifier with work type suffix (e.g., "SUP-294-QA"). Undefined for non-code work types. */
+    worktreeIdentifier?: string;
+    sessionId?: string;
+    /** Worktree path. Undefined for non-code work types (research, backlog-creation). */
+    worktreePath?: string;
+    /** Enable streaming activities to Linear (default: true when sessionId is provided) */
+    streamActivities?: boolean;
+    /** Type of work: determines prompt and agent routing (defaults to 'development') */
+    workType?: AgentWorkType;
+    /** Custom prompt override. If not provided, generates prompt based on workType */
+    prompt?: string;
+    /** Team key to set as LINEAR_TEAM_NAME env var for agents */
+    teamName?: string;
+    /** Project name for path scoping in monorepos */
+    projectName?: string;
+}
+export interface OrchestratorStreamConfig {
+    /** Minimum interval between activities in ms (default: 500ms) */
+    minInterval?: number;
+    /** Maximum length for tool outputs before truncation (default: 2000) */
+    maxOutputLength?: number;
+    /** Whether to include timestamps in activities (default: false) */
+    includeTimestamps?: boolean;
+}
+export interface OrchestratorResult {
+    success: boolean;
+    agents: AgentProcess[];
+    errors: Array<{
+        issueId: string;
+        error: Error;
+    }>;
+}
+export interface StopAgentResult {
+    stopped: boolean;
+    reason?: 'not_found' | 'already_stopped' | 'signal_failed';
+    agent?: AgentProcess;
+}
+export interface ForwardPromptResult {
+    forwarded: boolean;
+    resumed: boolean;
+    /** True if message was injected into running session (no restart needed) */
+    injected?: boolean;
+    reason?: 'not_found' | 'spawn_failed' | 'no_worktree' | 'terminal_status';
+    agent?: AgentProcess;
+    error?: Error;
+}
+export interface InjectMessageResult {
+    /** True if message was successfully injected into running session */
+    injected: boolean;
+    reason?: 'not_running' | 'no_query' | 'injection_failed';
+    error?: Error;
+}
+export interface SpawnAgentWithResumeOptions {
+    issueId: string;
+    identifier: string;
+    /** Worktree identifier with work type suffix (e.g., "SUP-294-QA"). Undefined for non-code work types. */
+    worktreeIdentifier?: string;
+    sessionId: string;
+    /** Worktree path. Undefined for non-code work types (research, backlog-creation). */
+    worktreePath?: string;
+    prompt: string;
+    providerSessionId?: string;
+    /** Type of work: determines transitions and agent behavior (defaults to 'development') */
+    workType?: AgentWorkType;
+    /** Team key to set as LINEAR_TEAM_NAME env var for agents */
+    teamName?: string;
+    /** Project name for path scoping in monorepos */
+    projectName?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/orchestrator/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAE1D;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;AAE7D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,4DAA4D;IAC5D,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,sGAAsG;IACtG,QAAQ,CAAC,EAAE,aAAa,CAAA;IACxB,6CAA6C;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;;;OAQG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,uDAAuD;IACvD,YAAY,CAAC,EAAE,wBAAwB,CAAA;IACvC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE;QAClB,iEAAiE;QACjE,OAAO,EAAE,MAAM,CAAA;QACf,4CAA4C;QAC5C,MAAM,EAAE,MAAM,CAAA;QACd,mCAAmC;QACnC,QAAQ,EAAE,MAAM,CAAA;KACjB,CAAA;IACD;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAA;IACxE;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IAC/B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,6GAA6G;IAC7G,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kEAAkE;IAClE,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,yGAAyG;IACzG,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;IACvB,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,CAAA;IAClF,SAAS,EAAE,IAAI,CAAA;IACf,WAAW,CAAC,EAAE,IAAI,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,aAAa,CAAA;IACxB,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,uEAAuE;IACvE,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,mFAAmF;IACnF,gBAAgB,CAAC,EAAE,eAAe,GAAG,qBAAqB,GAAG,kBAAkB,CAAA;IAC/E,sEAAsE;IACtE,UAAU,CAAC,EAAE,eAAe,CAAA;IAC5B,uEAAuE;IACvE,UAAU,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;IACvC,8DAA8D;IAC9D,cAAc,EAAE,IAAI,CAAA;IACpB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,8BAA8B;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+BAA+B;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAA;IAC5C,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAA;IAC/C,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,KAAK,IAAI,CAAA;IAC1D,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAA;IAC9C,8EAA8E;IAC9E,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAA;IACjD,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACpD,kEAAkE;IAClE,mBAAmB,CAAC,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAClG,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,KAAK,IAAI,CAAA;CACxE;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,yGAAyG;IACzG,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uFAAuF;IACvF,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,oFAAoF;IACpF,QAAQ,CAAC,EAAE,aAAa,CAAA;IACxB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,wBAAwB;IACvC,iEAAiE;IACjE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,YAAY,EAAE,CAAA;IACtB,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,WAAW,GAAG,iBAAiB,GAAG,eAAe,CAAA;IAC1D,KAAK,CAAC,EAAE,YAAY,CAAA;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,OAAO,CAAA;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,GAAG,cAAc,GAAG,aAAa,GAAG,iBAAiB,CAAA;IACzE,KAAK,CAAC,EAAE,YAAY,CAAA;IACpB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd;AAED,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,aAAa,GAAG,UAAU,GAAG,kBAAkB,CAAA;IACxD,KAAK,CAAC,EAAE,KAAK,CAAA;CACd;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,yGAAyG;IACzG,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,aAAa,CAAA;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}

package/dist/src/orchestrator/types.js

@@ -0,0 +1,4 @@
+/**
+ * Agent Orchestrator Types
+ */
+export {};

package/dist/src/orchestrator/validate-git-remote.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=validate-git-remote.test.d.ts.map

package/dist/src/orchestrator/validate-git-remote.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-git-remote.test.d.ts","sourceRoot":"","sources":["../../../src/orchestrator/validate-git-remote.test.ts"],"names":[],"mappings":""}

package/dist/src/orchestrator/validate-git-remote.test.js

@@ -0,0 +1,61 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { execSync } from 'child_process';
+import { validateGitRemote } from './orchestrator.js';
+vi.mock('child_process', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        execSync: vi.fn(),
+    };
+});
+const mockExecSync = vi.mocked(execSync);
+describe('validateGitRemote', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    it('passes when HTTPS remote matches expected repo', () => {
+        mockExecSync.mockReturnValue('https://github.com/renseiai/agentfactory.git\n');
+        expect(() => validateGitRemote('github.com/renseiai/agentfactory')).not.toThrow();
+    });
+    it('passes when SSH remote matches expected repo', () => {
+        mockExecSync.mockReturnValue('git@github.com:renseiai/agentfactory.git\n');
+        expect(() => validateGitRemote('github.com/renseiai/agentfactory')).not.toThrow();
+    });
+    it('passes when HTTPS remote matches without .git suffix', () => {
+        mockExecSync.mockReturnValue('https://github.com/renseiai/agentfactory\n');
+        expect(() => validateGitRemote('github.com/renseiai/agentfactory')).not.toThrow();
+    });
+    it('passes when expected repo includes https:// prefix', () => {
+        mockExecSync.mockReturnValue('https://github.com/renseiai/agentfactory.git\n');
+        expect(() => validateGitRemote('https://github.com/renseiai/agentfactory')).not.toThrow();
+    });
+    it('throws on repository mismatch', () => {
+        mockExecSync.mockReturnValue('https://github.com/renseiai/private-repo.git\n');
+        expect(() => validateGitRemote('github.com/renseiai/agentfactory')).toThrow(/Repository mismatch: expected 'github.com\/renseiai\/agentfactory' but git remote is/);
+    });
+    it('throws when git remote command fails', () => {
+        mockExecSync.mockImplementation(() => {
+            throw new Error('not a git repository');
+        });
+        expect(() => validateGitRemote('github.com/renseiai/agentfactory')).toThrow(/Repository validation failed: could not get git remote URL/);
+    });
+    it('does not throw when repository is not configured (no validation needed)', () => {
+        // This tests the orchestrator behavior: when config.repository is undefined,
+        // validateGitRemote is never called. Tested indirectly via orchestrator constructor.
+        // Here we just verify the function works with matching repos.
+        mockExecSync.mockReturnValue('git@github.com:renseiai/agentfactory.git\n');
+        expect(() => validateGitRemote('github.com/renseiai/agentfactory')).not.toThrow();
+    });
+    it('passes cwd option to execSync', () => {
+        mockExecSync.mockReturnValue('https://github.com/renseiai/agentfactory.git\n');
+        validateGitRemote('github.com/renseiai/agentfactory', '/some/path');
+        expect(mockExecSync).toHaveBeenCalledWith('git remote get-url origin', {
+            encoding: 'utf-8',
+            cwd: '/some/path',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+    });
+});

package/dist/src/providers/a2a-auth.d.ts

@@ -0,0 +1,81 @@
+/**
+ * A2A Authentication Utilities
+ *
+ * Client-side: resolve credentials from env vars and build HTTP auth headers
+ * for outbound requests to remote A2A agents.
+ *
+ * Server-side: validate inbound A2A request auth using timing-safe comparison,
+ * following the same pattern as worker-auth.ts.
+ */
+/** Auth scheme as declared in an A2A AgentCard */
+export interface A2aAuthScheme {
+    type: 'apiKey' | 'http' | 'oauth2';
+    /** For http: e.g. 'bearer' */
+    scheme?: string;
+    /** For apiKey: 'header' | 'query' */
+    in?: string;
+    /** For apiKey: header/query param name */
+    name?: string;
+}
+/** Resolved credentials for a remote A2A agent */
+export interface A2aCredentials {
+    apiKey?: string;
+    bearerToken?: string;
+}
+/** Configuration for validating incoming A2A requests */
+export interface A2aAuthConfig {
+    /** API key for validating incoming requests */
+    apiKey?: string;
+    /** Env var name for the API key (default: A2A_SERVER_API_KEY, fallback: WORKER_API_KEY) */
+    apiKeyEnvVar?: string;
+}
+/**
+ * Resolve credentials from environment variables for outbound A2A requests.
+ *
+ * Resolution order:
+ * 1. If agentUrl is provided, try host-specific env vars first:
+ *    - A2A_API_KEY_{HOSTNAME}
+ *    - A2A_BEARER_TOKEN_{HOSTNAME}
+ * 2. Fall back to generic env vars:
+ *    - A2A_API_KEY
+ *    - A2A_BEARER_TOKEN
+ *
+ * @param env - Environment variable map (e.g. process.env)
+ * @param agentUrl - Optional URL of the remote agent for host-specific lookup
+ * @returns Resolved credentials (may be empty if no env vars are set)
+ */
+export declare function resolveA2aCredentials(env: Record<string, string | undefined>, agentUrl?: string): A2aCredentials;
+/**
+ * Build HTTP headers for authenticating an outbound A2A request.
+ *
+ * When auth schemes are provided (from the remote agent's AgentCard), the
+ * function matches credentials to the first compatible scheme:
+ * - apiKey scheme  -> sets header {scheme.name}: {key}  (default: x-api-key)
+ * - http + bearer  -> sets Authorization: Bearer {token}
+ *
+ * When no auth schemes are provided, auto-detection is used:
+ * - bearerToken -> Authorization: Bearer {token}
+ * - apiKey      -> x-api-key: {key}
+ *
+ * @param credentials - Resolved credentials
+ * @param authSchemes - Optional auth schemes from the remote agent's card
+ * @returns Headers object (may be empty)
+ */
+export declare function buildA2aAuthHeaders(credentials: A2aCredentials, authSchemes?: A2aAuthScheme[]): Record<string, string>;
+/**
+ * Validate an incoming A2A request's auth header using timing-safe comparison.
+ *
+ * Resolution of expected key:
+ * 1. config.apiKey (explicit value)
+ * 2. env var named by config.apiKeyEnvVar
+ * 3. A2A_SERVER_API_KEY env var
+ * 4. WORKER_API_KEY env var (fallback for backward compat)
+ *
+ * If no expected key is configured, returns false (fail closed).
+ *
+ * @param authHeader - The Authorization header value from the request
+ * @param config - Optional auth configuration
+ * @returns true if the auth is valid
+ */
+export declare function validateA2aAuth(authHeader: string | undefined, config?: A2aAuthConfig): boolean;
+//# sourceMappingURL=a2a-auth.d.ts.map

package/dist/src/providers/a2a-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-auth.d.ts","sourceRoot":"","sources":["../../../src/providers/a2a-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,kDAAkD;AAClD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAA;IAClC,8BAA8B;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qCAAqC;IACrC,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,2FAA2F;IAC3F,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAkBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EACvC,QAAQ,CAAC,EAAE,MAAM,GAChB,cAAc,CA0ChB;AAMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,cAAc,EAC3B,WAAW,CAAC,EAAE,aAAa,EAAE,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA8BxB;AAoBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAoCT"}