@shivaedev/work-fleet 0.0.0 → 0.1.1

package/src/host/readWaitStates.ts

@@ -0,0 +1,39 @@
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { makeRepository } from "@shivaedev/effect-sql/repository.ts";
+import { State } from "#host/waitOutcome.ts";
+import { recordColumns, recordJson, recordModel } from "#storage/model.ts";
+
+export interface ReadOptions {
+	readonly namespace: string;
+}
+
+export const readWaitStates = Effect.fn("FleetReader.readWaitStates")(function* (options: ReadOptions, ids?: readonly string[]) {
+	const read = Effect.gen(function* () {
+		const repository = yield* makeRepository(recordModel(), {
+			idColumn: "work_id",
+			spanPrefix: "FleetReader",
+			tableName: `${options.namespace}_records`,
+		});
+		const rows = yield* repository
+			.findMany({
+				orderBy: { direction: "asc", field: "work_id" },
+				select: ["work_id", "stage", "blocker", "attentionOwner", "checks", "decision", "outcome"],
+			})
+			.pipe(
+				Effect.catchTag("SqlError", (error) => {
+					const cause = error.reason.cause;
+					return typeof cause === "object" && cause !== null && "code" in cause && cause.code === "42P01" ? Effect.succeed([]) : Effect.fail(error);
+				}),
+			);
+		return yield* Effect.forEach(
+			rows.filter((row) => ids === undefined || ids.includes(row.work_id)),
+			(row) =>
+				recordJson(row, recordColumns()).pipe(
+					Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(State))),
+					Effect.map((state) => ({ ...state, outcome: state.outcome ?? {} })),
+				),
+		);
+	});
+	return yield* read;
+});

package/src/host/reassignWork.ts

@@ -0,0 +1,17 @@
+import { Effect } from "effect";
+import type { AttentionOwner } from "#attention.ts";
+import { Fleet } from "#fleet.ts";
+import { type HostParts, hostLayer, productionParts } from "#host/commands.ts";
+import type { FleetHost } from "#host/config.ts";
+
+export function reassignWork(
+	host: FleetHost,
+	workId: string,
+	decisionId: string,
+	attentionOwner: AttentionOwner,
+	parts: HostParts = productionParts(host),
+) {
+	return Effect.gen(function* () {
+		return yield* (yield* Fleet).reassign(workId, decisionId, attentionOwner);
+	}).pipe(Effect.provide(hostLayer(host, parts)));
+}

package/src/host/recordDecisionResponse.ts

@@ -0,0 +1,44 @@
+import { Clock, Effect, FileSystem, Schema } from "effect";
+import { BadRequest, Conflict } from "@shivaedev/platform/errors/taxonomy.ts";
+import { responses as responsesApi } from "@shivaedev/work-board/integration/responses.ts";
+import type { BoardDecision } from "#board/schema.ts";
+import { BoardGateway, type Decision } from "#policy.ts";
+
+const { DraftInput, makeResponse, publish, Responses, responseMarkdown } = responsesApi;
+
+export const recordDecisionResponse = Effect.fn("FleetHost.recordDecisionResponse")(function* (
+	root: string,
+	decision: Decision & { readonly published: BoardDecision },
+	action: "retry" | "release",
+	text?: string,
+) {
+	const responses = yield* Responses;
+	const board = yield* BoardGateway;
+	const published = decision.published;
+	const reading = yield* board.readDecision(published);
+	if (reading._tag === "Stale" || reading._tag === "Ambiguous") {
+		return yield* Effect.fail(new Conflict({ message: "Reconcile the exact decision response before answering" }));
+	}
+	const id = `response.fleet-${action}.${published.questionId}`;
+	if (reading._tag === "Response" && reading.response.id === id) {
+		return id;
+	}
+	const input = yield* Schema.decodeUnknownEffect(DraftInput)({
+		...(decision.worker !== undefined && action !== "release" ? {} : { answers: [{ prompt: "fleet-action", selected: [action], text: "" }] }),
+		author: "orchestrator",
+		body: text ?? (action === "release" ? "Release Fleet ownership." : "Retry Fleet work under trusted runtime policy."),
+		id,
+		question: published.questionId,
+		...(reading._tag === "Response" ? { supersedes: reading.response.id } : {}),
+		type: "answer",
+	}).pipe(Effect.mapError(() => new BadRequest({ message: "Invalid Board response; text must not exceed 32768 characters" })));
+	if (decision.worker === undefined && text === undefined) {
+		return (yield* responses.record(input)).id;
+	}
+	const question = (yield* responses.read(published.questionId)).question;
+	const response = makeResponse(input, question, yield* Clock.currentTimeMillis);
+	const fs = yield* FileSystem.FileSystem;
+	const realRoot = yield* fs.realPath(root);
+	yield* publish(root, realRoot, id, responseMarkdown(response));
+	return id;
+});

package/src/host/recordPayloads.ts

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+import { SqlClient } from "effect/sql";
+import { makeRepository } from "@shivaedev/effect-sql/repository.ts";
+import { recordColumns, recordJson, recordModel } from "#storage/model.ts";
+
+export const recordPayloads = Effect.fn("FleetHost.recordPayloads")(function* (namespace: string, workId?: string) {
+	const sql = yield* SqlClient.SqlClient;
+	const table = `${namespace}_records`;
+	const [present] = yield* sql<{ readonly present: boolean }>`select to_regclass(${table}) is not null as present`;
+	if (present?.present !== true) {
+		return [];
+	}
+	const repository = yield* makeRepository(recordModel(), { idColumn: "work_id", spanPrefix: "FleetReader", tableName: table });
+	const rows = yield* repository.findMany({ orderBy: { direction: "asc", field: "work_id" }, where: { "work_id": workId } });
+	return yield* Effect.forEach(rows, (row) => recordJson(row, recordColumns()));
+});

package/src/host/releaseWork.ts

@@ -0,0 +1,56 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { Effect, Layer } from "effect";
+import { Conflict, Forbidden } from "@shivaedev/platform/errors/taxonomy.ts";
+import { board } from "@shivaedev/work-board/integration/board.ts";
+import { responses } from "@shivaedev/work-board/integration/responses.ts";
+import { Fleet } from "#fleet.ts";
+import { type HostParts, hostLayer, productionParts } from "#host/commands.ts";
+import type { FleetHost } from "#host/config.ts";
+import { recordDecisionResponse } from "#host/recordDecisionResponse.ts";
+import { executing } from "#model.ts";
+
+const { searchSnapshot, watchChanges } = board;
+const { ResponseConfig, Responses } = responses;
+
+export function releaseWork(host: FleetHost, workIds: readonly string[], parts: HostParts = productionParts(host)) {
+	return releaseItems(host, workIds).pipe(Effect.provide(hostLayer(host, parts)));
+}
+
+export function releaseItems(host: FleetHost, workIds: readonly string[]) {
+	return withDecisionResponses(host, Effect.forEach(workIds, releaseItem(host.boardDir)));
+}
+
+export function withDecisionResponses<A, E, R>(host: FleetHost, effect: Effect.Effect<A, E, R>) {
+	return Effect.scoped(
+		Effect.gen(function* () {
+			const changes = yield* watchChanges(host.boardDir);
+			const read = yield* searchSnapshot(host.boardDir, undefined, changes);
+			const index = read.pipe(Effect.provide(NodeServices.layer));
+			return yield* effect.pipe(
+				Effect.provide(Responses.layer.pipe(Layer.provide(Layer.succeed(ResponseConfig, { changes, enabled: true, index, root: host.boardDir })))),
+			);
+		}),
+	);
+}
+
+function releaseItem(root: string) {
+	return Effect.fn("FleetHost.releaseItem")(function* (workId: string) {
+		const fleet = yield* Fleet;
+		let stored = yield* fleet.get(workId);
+		if (stored.value.stage === "released") {
+			return yield* fleet.reconcile(workId);
+		}
+		if (stored.value.stage !== "needs-human" || executing(stored.value)) {
+			return yield* Effect.fail(new Forbidden({ message: "Only terminal needs-human work can be released" }));
+		}
+		if (stored.value.decision?.published === undefined) {
+			stored = yield* fleet.reconcile(workId);
+		}
+		const decision = stored.value.decision;
+		if (decision?.published === undefined) {
+			return yield* Effect.fail(new Conflict({ message: "Publish the waiting decision before release" }));
+		}
+		const responseId = yield* recordDecisionResponse(root, { ...decision, published: decision.published }, "release");
+		return yield* fleet.resolve(workId, decision.id, responseId);
+	});
+}

package/src/host/renderStatus.ts

@@ -0,0 +1,33 @@
+import { diagnostics as diagnosticsApi } from "@shivaedev/work-board/integration/diagnostics.ts";
+import { sessionStatus } from "#engine/sessionStatus.ts";
+import type { FleetViews } from "#model.ts";
+
+const { DAEMON_PORT } = diagnosticsApi;
+
+type View = (typeof FleetViews.Type)["active"][number];
+
+function line(view: View, waiting: boolean, port: number) {
+	const reason = view.decision?.reason ?? view.blocker;
+	const detail = reason === undefined ? "" : `  ${reason}`;
+	const links = [...view.links, ...view.sessions.map(sessionStatus)];
+	const answer = waiting ? `\n    work-fleet answer ${view.workId}${port === DAEMON_PORT ? "" : ` --port ${port}`}` : "";
+	return `  ${view.workId}  ${view.stage}${detail}${links.length === 0 ? "" : `  (${links.join(", ")})`}${answer}`;
+}
+
+export function renderStatus(current: typeof FleetViews.Type, port: number = DAEMON_PORT): string {
+	const sections: readonly [string, readonly View[]][] = [
+		["Active", current.active],
+		["Waiting on maintainer", current.waiting.maintainer],
+		["Waiting on orchestrator", current.waiting.orchestrator],
+		["Waiting on automation", current.waiting.automation],
+		["Completed", current.completed],
+	];
+	return sections
+		.map(([title, items]) =>
+			[
+				`${title} (${items.length})`,
+				...items.map((item) => line(item, title === "Waiting on maintainer" || title === "Waiting on orchestrator", port)),
+			].join("\n"),
+		)
+		.join("\n");
+}

package/src/host/reportAttachmentFiles.ts

@@ -0,0 +1,91 @@
+import { constants, type Stats } from "node:fs";
+import { type FileHandle, lstat, open, realpath } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { Effect } from "effect";
+import type { ReportFile } from "#reportAttachments.ts";
+import { ReportFileFailure, reportFileIo, withReportFile } from "#reportFileFailure.ts";
+import { REPORT_LIMITS, reportLimit } from "#reportLimits.ts";
+
+function inside(folder: string, file: string) {
+	const name = relative(folder, file);
+	return name !== "" && name !== ".." && !name.startsWith(`..${sep}`) && !isAbsolute(name);
+}
+
+const readBounded = Effect.fnUntraced(function* (path: string, file: FileHandle, remaining: number) {
+	const chunks: Uint8Array[] = [];
+	let size = 0;
+	for (;;) {
+		const buffer = new Uint8Array(Math.min(64 * 1024, remaining - size + 1));
+		const { bytesRead } = yield* reportFileIo(path, () => file.read(buffer));
+		if (bytesRead === 0) {
+			return Buffer.concat(chunks);
+		}
+		size += bytesRead;
+		if (size > remaining) {
+			return yield* Effect.fail(new ReportFileFailure({ path, reason: reportLimit("attachmentBytes").message }));
+		}
+		chunks.push(buffer.subarray(0, bytesRead));
+	}
+});
+
+interface AttachmentEntry {
+	readonly info: Stats;
+	readonly name: string;
+	readonly target: string;
+}
+
+const attachmentEntries = Effect.fnUntraced(function* (root: string, names: readonly string[]) {
+	if (names.length > REPORT_LIMITS.attachmentCount) {
+		return yield* Effect.fail(
+			new ReportFileFailure({ path: names[REPORT_LIMITS.attachmentCount] ?? root, reason: reportLimit("attachmentCount").message }),
+		);
+	}
+	const entries: AttachmentEntry[] = [];
+	let total = 0;
+	for (const name of names) {
+		const target = resolve(root, name);
+		if (!inside(root, target)) {
+			return yield* Effect.fail(new ReportFileFailure({ path: name, reason: "Attachment path escapes scratch folder" }));
+		}
+		const info = yield* reportFileIo(name, () => lstat(target));
+		if (!(info.isFile() && inside(root, yield* reportFileIo(name, () => realpath(target))))) {
+			return yield* Effect.fail(new ReportFileFailure({ path: name, reason: "Attachment is not a regular file inside scratch folder" }));
+		}
+		total += info.size;
+		if (total > REPORT_LIMITS.attachmentBytes) {
+			return yield* Effect.fail(new ReportFileFailure({ path: name, reason: reportLimit("attachmentBytes").message }));
+		}
+		entries.push({ info, name, target });
+	}
+	return entries;
+});
+
+function readAttachment(root: string, { info, name, target }: AttachmentEntry, remaining: number) {
+	return withReportFile(
+		name,
+		() => open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK),
+		(file) =>
+			Effect.gen(function* () {
+				const opened = yield* reportFileIo(name, () => file.stat());
+				if (
+					!(opened.isFile() && opened.dev === info.dev && opened.ino === info.ino && inside(root, yield* reportFileIo(name, () => realpath(target))))
+				) {
+					return yield* Effect.fail(new ReportFileFailure({ path: name, reason: "Attachment changed after validation" }));
+				}
+				return yield* readBounded(name, file, remaining);
+			}),
+	);
+}
+
+export const reportAttachmentFiles = Effect.fn("Fleet.reportAttachmentFiles")(function* (folder: string, names: readonly string[]) {
+	const root = yield* reportFileIo(folder, () => realpath(folder));
+	const entries = yield* attachmentEntries(root, names);
+	const files: ReportFile[] = [];
+	let total = 0;
+	for (const entry of entries) {
+		const bytes = yield* readAttachment(root, entry, REPORT_LIMITS.attachmentBytes - total);
+		total += bytes.length;
+		files.push({ bytes, path: entry.name });
+	}
+	return files;
+});

package/src/host/reportBoard.ts

@@ -0,0 +1,143 @@
+import * as NodeServices from "@effect/platform-node/NodeServices";
+import { Context, Effect, Layer } from "effect";
+import { defineService } from "@shivaedev/effect-service/define-service.ts";
+import { BadRequest, ServiceUnavailable } from "@shivaedev/platform/errors/taxonomy.ts";
+import { markdownBoard } from "#board/markdown.ts";
+import { reportContent } from "#board/reportContent.ts";
+import { reportFiles } from "#board/reportFiles.ts";
+import { reportIdentity } from "#board/reportIdentity.ts";
+import { reportLinks } from "#board/reportLinks.ts";
+import { reportPayload } from "#board/reportPayload.ts";
+import { withFailureContext } from "#engine/failureContext.ts";
+import { ReportInspection } from "#engine/ReportInspection.ts";
+import { isFleetError } from "#errors.ts";
+import type { FleetHost } from "#host/config.ts";
+import { MainSource } from "#host/mainSource.ts";
+import { reportPublication, reportRepository } from "#host/reportPublication.ts";
+import { BoardFailure, BoardGateway, type BoardWork } from "#policy.ts";
+import { codexReportAttachments } from "#providers/codexReportAttachments.ts";
+import { declaredAttachments, type ReportAttachments } from "#reportAttachments.ts";
+import { ReportFileFailure } from "#reportFileFailure.ts";
+import { SessionFailure, type SessionObservation } from "#session/schema.ts";
+
+export const PUBLISHED_REPORT = "Report worker published to GitHub";
+
+function attachmentFailure(error: unknown) {
+	if (error instanceof BoardFailure) {
+		return error;
+	}
+	const message =
+		isFleetError(error) || error instanceof SessionFailure || error instanceof ReportFileFailure
+			? error.message
+			: "Cloud report attachments could not be downloaded";
+	return new BoardFailure({ message });
+}
+
+function unavailableAttachments(observation: SessionObservation, error: unknown): ReportAttachments {
+	const declared = declaredAttachments(observation.output);
+	return {
+		files: [],
+		unavailable: (declared.length === 0 ? ["Attachment collection"] : declared).map((path) => ({ path, reason: attachmentFailure(error).message })),
+	};
+}
+
+class ReportInputs extends Context.Service<
+	ReportInputs,
+	{
+		readonly root: string;
+		readonly check: (work: BoardWork) => Effect.Effect<boolean, unknown>;
+		readonly files: (observation: SessionObservation) => Effect.Effect<ReportAttachments, unknown>;
+	}
+>()("Fleet/ReportInputs") {}
+
+const ReportBoard = defineService({
+	id: "Fleet/ReportBoard",
+	initialize: Effect.gen(function* () {
+		const board = yield* BoardGateway;
+		const { root, check, files } = yield* ReportInputs;
+		function inspect(work: BoardWork) {
+			return check(work).pipe(
+				Effect.mapError(() => new ServiceUnavailable({ message: "Report publication could not be checked on GitHub" })),
+				Effect.flatMap((published) =>
+					published ? Effect.fail(withFailureContext(new BadRequest({ message: PUBLISHED_REPORT }), { code: "report-published" })) : Effect.void,
+				),
+			);
+		}
+		const collect = Effect.fn("Fleet.collect")(function* (work: BoardWork, observation: SessionObservation) {
+			const attachments = yield* files(observation).pipe(
+				Effect.catch((error) =>
+					error instanceof ReportFileFailure ? Effect.fail(error) : Effect.succeed(unavailableAttachments(observation, error)),
+				),
+			);
+			const { itemId } = reportIdentity(work, observation.receipt);
+			const output = observation.output + reportLinks(itemId, attachments.files, attachments.unavailable);
+			yield* reportContent(work, { ...observation, output });
+			return yield* reportPayload(root, work, observation).save({ files: attachments.files, output });
+		});
+		const report = Effect.fn("Fleet.report")(function* (work: BoardWork, observation: SessionObservation) {
+			const { itemId } = reportIdentity(work, observation.receipt);
+			const existing = yield* reportPayload(root, work, observation).read;
+			const payload = existing ?? (yield* collect(work, observation));
+			const reportObservation = { ...observation, output: payload.output };
+			yield* reportContent(work, reportObservation);
+			yield* reportFiles(root, itemId, payload.files);
+			return yield* board.report(work, reportObservation);
+		}, Effect.mapError(attachmentFailure));
+
+		return { inspect, report };
+	}),
+	methods: ({ inspect, report }) => ({ check: inspect, report }),
+	requires: [BoardGateway, ReportInputs],
+});
+
+export function reportBoard<TCheckServices, TCheckError, TFileServices, TFileError>(
+	root: string,
+	check: (work: BoardWork) => Effect.Effect<boolean, TCheckError, TCheckServices>,
+	files: (observation: SessionObservation) => Effect.Effect<ReportAttachments, TFileError, TFileServices>,
+) {
+	return Layer.unwrap(
+		Effect.gen(function* () {
+			const services = yield* Effect.context<TCheckServices | TFileServices>();
+			const inputs = Layer.succeed(ReportInputs, {
+				check: (work) => check(work).pipe(Effect.provide(services)),
+				files: (observation) => files(observation).pipe(Effect.provide(services)),
+				root,
+			});
+			return Layer.unwrap(
+				Effect.gen(function* () {
+					const board = yield* BoardGateway;
+					const reports = yield* ReportBoard;
+					return Layer.merge(
+						Layer.succeed(ReportInspection)({ check: reports.check }),
+						Layer.succeed(BoardGateway)({ ...board, report: reports.report }),
+					);
+				}),
+			).pipe(Layer.provide(ReportBoard.layer.pipe(Layer.provide(inputs))));
+		}),
+	);
+}
+
+export function hostReportBoard(host: FleetHost) {
+	return Layer.unwrap(
+		Effect.gen(function* () {
+			const main = yield* MainSource;
+			function check(work: BoardWork) {
+				return Effect.gen(function* () {
+					if (host.worker === undefined) {
+						return yield* Effect.fail(new BoardFailure({ message: "Report publication checks need worker.branchPrefix" }));
+					}
+					return yield* reportPublication(
+						yield* reportRepository(main.repositoryRoot, host.repository.remote),
+						`${host.worker.branchPrefix}${work.workId}`,
+					);
+				});
+			}
+			function files(observation: SessionObservation) {
+				return host.provider === "cloud" && host.cloud !== undefined
+					? codexReportAttachments(host.cloud, host.cloud.requestTimeoutMs ?? 60_000)(observation)
+					: Effect.succeed({ files: [], unavailable: [] });
+			}
+			return reportBoard(host.boardDir, check, files).pipe(Layer.provide(markdownBoard(host.boardDir)));
+		}),
+	).pipe(Layer.provide(NodeServices.layer));
+}

package/src/host/reportFileChanges.ts

@@ -0,0 +1,32 @@
+import { join } from "node:path";
+import { Effect, FileSystem } from "effect";
+import { BadRequest } from "@shivaedev/platform/errors/taxonomy.ts";
+import { reportAttachmentFiles } from "#host/reportAttachmentFiles.ts";
+import { reportFileReplay } from "#host/reportFileReplay.ts";
+import type { Item } from "#providers/codexProtocol.ts";
+import { declaredAttachments, type ReportAttachments } from "#reportAttachments.ts";
+import { ReportFileFailure } from "#reportFileFailure.ts";
+
+export const reportFileChanges = Effect.fn("Fleet.reportFileChanges")(function* (items: readonly (typeof Item.Type)[], output: string) {
+	const state = yield* reportFileReplay(items).pipe(Effect.mapError((error) => new BadRequest({ message: error.message })));
+	for (const path of declaredAttachments(output)) {
+		if (!(state.contents.has(path) || state.unavailable.has(path))) {
+			state.unavailable.set(path, "No file-edit attachment was exposed by this turn");
+		}
+	}
+	const fs = yield* FileSystem.FileSystem;
+	const folder = yield* fs
+		.makeTempDirectoryScoped()
+		.pipe(Effect.mapError((cause) => new ReportFileFailure({ cause, path: "Attachment scratch folder", reason: cause.message })));
+	for (const [name, text] of state.contents) {
+		const target = join(folder, name);
+		yield* fs
+			.makeDirectory(join(target, ".."), { recursive: true })
+			.pipe(Effect.mapError((cause) => new ReportFileFailure({ cause, path: name, reason: cause.message })));
+		yield* fs
+			.writeFileString(target, text, { flag: "wx" })
+			.pipe(Effect.mapError((cause) => new ReportFileFailure({ cause, path: name, reason: cause.message })));
+	}
+	const files = yield* reportAttachmentFiles(folder, [...state.contents.keys()].sort());
+	return { files, unavailable: [...state.unavailable].map(([path, reason]) => ({ path, reason })) } satisfies ReportAttachments;
+});

package/src/host/reportFileReplay.ts

@@ -0,0 +1,118 @@
+import { Effect, Schema } from "effect";
+import { applyReportPatch } from "#host/applyReportPatch.ts";
+import type { Item } from "#providers/codexProtocol.ts";
+import { REPORT_ATTACHMENT_DIRECTORY } from "#reportAttachments.ts";
+import { ReportFileFailure } from "#reportFileFailure.ts";
+import { REPORT_LIMITS, reportLimit } from "#reportLimits.ts";
+
+const Change = Schema.Struct({
+	diff: Schema.String,
+	kind: Schema.Union([
+		Schema.Struct({ type: Schema.Literal("add") }),
+		Schema.Struct({ type: Schema.Literal("delete") }),
+		Schema.Struct({ movePath: Schema.optional(Schema.NullOr(Schema.String)), type: Schema.Literal("update") }).pipe(
+			Schema.encodeKeys({ movePath: "move_path" }),
+		),
+	]),
+	path: Schema.String,
+});
+type Change = typeof Change.Type;
+interface Replay {
+	readonly contents: Map<string, string>;
+	diffBytes: number;
+	readonly names: Set<string>;
+	readonly unavailable: Map<string, string>;
+}
+function attachmentName(path: string) {
+	return path.startsWith(REPORT_ATTACHMENT_DIRECTORY) ? path.slice(REPORT_ATTACHMENT_DIRECTORY.length) : undefined;
+}
+function safeName(name: string) {
+	return (
+		!(name.includes("\\") || /\p{Cc}/u.test(name)) && name.split("/").every((part) => part !== "" && part !== "." && part !== ".." && part !== ".git")
+	);
+}
+const update = Effect.fnUntraced(function* (state: Replay, change: Change, name: string, target: string) {
+	const previous = state.contents.get(name);
+	if (previous === undefined) {
+		return yield* Effect.fail(new ReportFileFailure({ path: name, reason: "Attachment update has no retrievable add in this turn" }));
+	}
+	if (target !== name && state.contents.has(target)) {
+		return yield* Effect.fail(new ReportFileFailure({ path: target, reason: "Attachment move overwrites another attachment" }));
+	}
+	const updated = yield* applyReportPatch(previous, change.diff, name);
+	state.contents.delete(name);
+	state.contents.set(target, updated);
+});
+const applyChange = Effect.fnUntraced(function* (state: Replay, change: Change, name: string | undefined, target: string | undefined) {
+	if (name === undefined || target === undefined || !safeName(name) || !safeName(target)) {
+		return yield* Effect.fail(
+			new ReportFileFailure({ path: change.path, reason: "Unsafe attachment path or move outside the attachment directory" }),
+		);
+	}
+	if (change.kind.type === "delete") {
+		state.contents.delete(name);
+	} else if (change.kind.type === "add") {
+		if (state.contents.has(name)) {
+			return yield* Effect.fail(new ReportFileFailure({ path: name, reason: "Attachment was added more than once without deletion" }));
+		}
+		state.contents.set(name, change.diff);
+	} else {
+		yield* update(state, change, name, target);
+	}
+	state.unavailable.delete(name);
+	state.unavailable.delete(target);
+});
+const replayChange = Effect.fnUntraced(function* (state: Replay, change: Change) {
+	const name = attachmentName(change.path);
+	const moved = change.kind.type === "update" ? change.kind.movePath : undefined;
+	const target = moved === null || moved === undefined ? name : attachmentName(moved);
+	if (name === undefined && target === undefined) {
+		return;
+	}
+	const label = target ?? name ?? change.path;
+	state.names.add(label);
+	if (state.names.size > REPORT_LIMITS.attachmentCount) {
+		return yield* Effect.fail(new ReportFileFailure({ path: label, reason: reportLimit("attachmentCount").message }));
+	}
+	state.diffBytes += Buffer.byteLength(change.diff, "utf8");
+	if (state.diffBytes > REPORT_LIMITS.diffBytes) {
+		return yield* Effect.fail(new ReportFileFailure({ path: label, reason: reportLimit("diffBytes").message }));
+	}
+	yield* applyChange(state, change, name, target).pipe(
+		Effect.catchTag("ReportFileFailure", (error) =>
+			Effect.sync(() => {
+				if (name !== undefined) {
+					state.contents.delete(name);
+				}
+				if (target !== undefined) {
+					state.contents.delete(target);
+				}
+				state.unavailable.set(label, error.reason);
+			}),
+		),
+	);
+});
+export const reportFileReplay = Effect.fn("Fleet.reportFileReplay")(function* (items: readonly (typeof Item.Type)[]) {
+	const state: Replay = { contents: new Map(), diffBytes: 0, names: new Set(), unavailable: new Map() };
+	for (const item of items) {
+		if (item.type !== "fileChange" || (item.status !== undefined && item.status !== "completed")) {
+			continue;
+		}
+		const changes = Schema.decodeUnknownOption(Schema.Array(Change))(item.changes);
+		if (changes._tag === "None") {
+			state.unavailable.set("Attachment changes", "Codex returned malformed file changes");
+			continue;
+		}
+		for (const change of changes.value) {
+			yield* replayChange(state, change);
+		}
+	}
+	let bytes = 0;
+	for (const [path, text] of state.contents) {
+		bytes += Buffer.byteLength(text, "utf8");
+		if (bytes > REPORT_LIMITS.attachmentBytes) {
+			return yield* Effect.fail(new ReportFileFailure({ path, reason: reportLimit("attachmentBytes").message }));
+		}
+	}
+	return state;
+});

package/src/host/reportPublication.ts

@@ -0,0 +1,36 @@
+import { Effect, Schema } from "effect";
+import { ServiceUnavailable } from "@shivaedev/platform/errors/taxonomy.ts";
+import type { FleetError } from "#errors.ts";
+import { readCommand } from "#host/readCommand.ts";
+
+const References = Schema.Array(Schema.Array(Schema.Struct({ ref: Schema.String })));
+const PullRequests = Schema.Array(Schema.Array(Schema.Struct({ htmlUrl: Schema.String }).pipe(Schema.encodeKeys({ htmlUrl: "html_url" }))));
+
+export function makeReportPublication<R>(read: (endpoint: string) => Effect.Effect<string, FleetError, R>) {
+	return Effect.fn("Fleet.reportPublication")(
+		function* (repository: string, branch: string) {
+			const refs = yield* read(`repos/${repository}/git/matching-refs/heads/${encodeURIComponent(branch)}`).pipe(
+				Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(References))),
+			);
+			const prs = yield* read(
+				`repos/${repository}/pulls?state=all&head=${encodeURIComponent(`${repository.split("/")[0]}:${branch}`)}&per_page=100`,
+			).pipe(Effect.flatMap(Schema.decodeUnknownEffect(Schema.fromJsonString(PullRequests))));
+			return refs.flat().some((ref) => ref.ref === `refs/heads/${branch}`) || prs.flat().length > 0;
+		},
+		Effect.mapError(() => new ServiceUnavailable({ message: "Report publication could not be checked on GitHub" })),
+	);
+}
+
+export const reportPublication = makeReportPublication((endpoint) =>
+	readCommand("gh", ["api", "--method", "GET", "--paginate", "--slurp", endpoint]),
+);
+
+export const reportRepository = Effect.fn("Fleet.reportRepository")(function* (cwd: string, remote: string) {
+	const url = (yield* readCommand("git", ["remote", "get-url", remote], cwd)).trim();
+	const repository = /^(?:https:\/\/github\.com\/|git@github\.com:)(?<repository>[A-Za-z0-9-]+\/[A-Za-z0-9_.-]+?)(?:\.git)?$/u.exec(url)?.groups
+		?.repository;
+	if (repository === undefined) {
+		return yield* Effect.fail(new ServiceUnavailable({ message: "Report publication checks need a GitHub remote" }));
+	}
+	return repository;
+});

package/src/host/resultReport.ts

@@ -0,0 +1,32 @@
+import { Effect } from "effect";
+import { BadRequest } from "@shivaedev/platform/errors/taxonomy.ts";
+import { withFailureContext } from "#engine/failureContext.ts";
+import { reportedPullRequest } from "#prompt/worker.ts";
+
+export const resultReport = Effect.fn("FleetHost.resultReport")(function* (output: string) {
+	const pr = reportedPullRequest(output);
+	if (pr === undefined) {
+		return yield* withFailureContext(new BadRequest({ message: "Worker report needs one final FLEET_PR line containing a GitHub PR URL or none" }), {
+			code: "worker-report-pr-invalid",
+		});
+	}
+	const lines = output
+		.trim()
+		.split(/\r?\n/u)
+		.map((line) => line.trim());
+	const heads = lines.filter((line) => line.startsWith("FLEET_HEAD:"));
+	const head = heads[0]
+		?.slice("FLEET_HEAD:".length)
+		.trim()
+		.replace(/^`(?<value>[^`]*)`$/u, "$<value>")
+		.trim();
+	if (heads.length !== 1 || heads[0] !== lines.at(-2) || head === undefined || /^[a-f\d]{40}$/u.exec(head) === null) {
+		return yield* withFailureContext(
+			new BadRequest({
+				message: "Worker report needs one FLEET_HEAD line with the exact full head SHA immediately before the final PR line",
+			}),
+			{ code: "worker-report-head-invalid" },
+		);
+	}
+	return { head, pr };
+});