@theagilemonkeys/facility 0.11.4 → 0.12.0

package/templates/receipts/collect.mjs

@@ -1,297 +0,0 @@
-#!/usr/bin/env node
-import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
-
-const MODES = new Set([
-  "architect",
-  "builder",
-  "review",
-  "address_review",
-  "ci_doctor",
-  "security_sweep",
-  "po",
-  "learning",
-  "canary",
-  "custom",
-]);
-const PROVIDERS = new Set(["claude_code", "codex_cli", "byo"]);
-const MAX_RECEIPT_CHECKS = 200;
-
-export function collectReceipt(env = process.env, now = new Date()) {
-  const provider = requiredChoice(env.FACILITY_RECEIPT_PROVIDER, PROVIDERS, "provider");
-  const mode = requiredChoice(env.FACILITY_RECEIPT_MODE, MODES, "mode");
-  const result = normalizeResult(env.FACILITY_RECEIPT_RESULT);
-  const startedAt = validDate(env.FACILITY_RECEIPT_STARTED_AT) ?? now;
-  const engine = parseEngineEvidence(env.FACILITY_RECEIPT_ENGINE_JSONL);
-  const checkEvidence = parseChecks(env.FACILITY_RECEIPT_CHECKS_FILE);
-  const target = githubTarget(env.GITHUB_EVENT_PATH);
-  const baseSha = gitCommitSha(env.FACILITY_RECEIPT_BASE_SHA);
-  const git = gitActivity(baseSha, env.GITHUB_WORKSPACE);
-  const actor = env.GITHUB_ACTOR;
-  const receipt = {
-    schema: "facility.run.v1",
-    run_id: [env.GITHUB_RUN_ID, env.GITHUB_RUN_ATTEMPT, env.GITHUB_JOB].filter(Boolean).join(":"),
-    provider,
-    ...(env.FACILITY_RECEIPT_MODEL ? { model: env.FACILITY_RECEIPT_MODEL } : {}),
-    mode,
-    result,
-    usage: {
-      input_tokens: engine.usage.input_tokens,
-      output_tokens: engine.usage.output_tokens,
-      cache_read: engine.usage.cache_read,
-      cache_write: engine.usage.cache_write,
-      cost_cents: engine.usage.cost_cents,
-      cost_source: engine.usage.cost_source,
-    },
-    activity: {
-      turns: engine.activity.turns,
-      shell_commands: engine.activity.shell_commands,
-      file_changes: Math.max(engine.activity.file_changes, git.filesChanged),
-      mcp_tool_calls: engine.activity.mcp_tool_calls,
-      web_searches: engine.activity.web_searches,
-      tool_calls: engine.activity.tool_calls,
-      errors: engine.activity.errors + (result === "failed" ? 1 : 0),
-    },
-    github: {
-      owner: env.GITHUB_REPOSITORY?.split("/")[0],
-      repo: env.GITHUB_REPOSITORY?.split("/")[1],
-      issue: target.issue,
-      pr: target.pr,
-      ...(baseSha ? { base_sha: baseSha } : {}),
-      ...(actor ? { actor_sha256: sha256(actor) } : {}),
-    },
-    timing: {
-      started_at: startedAt.toISOString(),
-      ended_at: now.toISOString(),
-      duration_ms: Math.max(0, now.getTime() - startedAt.getTime()),
-    },
-    events: { count: engine.eventCount, checks: checkEvidence.total },
-    checks: checkEvidence.items,
-    checks_truncated: checkEvidence.total > checkEvidence.items.length,
-  };
-  const integrity = {
-    algorithm: "sha256",
-    previous_sha256: null,
-  };
-  return {
-    ...receipt,
-    integrity: {
-      ...integrity,
-      payload_sha256: sha256(stableStringify({ ...receipt, integrity })),
-    },
-  };
-}
-
-export function writeReceipt(receipt, env = process.env) {
-  if (!verifyReceipt(receipt)) throw new Error("refusing to publish an invalid Facility receipt");
-  const output = resolve(
-    env.FACILITY_RECEIPT_OUTPUT ??
-      join(env.RUNNER_TEMP ?? ".facility-receipts", "facility-run.json"),
-  );
-  mkdirSync(dirname(output), { recursive: true });
-  writeFileSync(output, `${JSON.stringify(receipt, null, 2)}\n`, "utf8");
-  if (env.GITHUB_OUTPUT) {
-    writeFileSync(
-      env.GITHUB_OUTPUT,
-      `path=${output}\nsha256=${receipt.integrity.payload_sha256}\n`,
-      { flag: "a" },
-    );
-  }
-  if (env.GITHUB_STEP_SUMMARY) {
-    writeFileSync(
-      env.GITHUB_STEP_SUMMARY,
-      [
-        "### Facility agent receipt",
-        "",
-        `- Mode: \`${receipt.mode}\``,
-        `- Result: \`${receipt.result}\``,
-        `- Receipt SHA-256: \`${receipt.integrity.payload_sha256}\``,
-        "- Integrity: SHA-256 (verify the separate GitHub Actions attestation when enabled)",
-        "",
-      ].join("\n"),
-      { flag: "a" },
-    );
-  }
-  return output;
-}
-
-export function verifyReceipt(receipt) {
-  if (!receipt || typeof receipt !== "object" || receipt.schema !== "facility.run.v1") return false;
-  const { integrity, ...content } = receipt;
-  const digestable = {
-    ...content,
-    integrity: {
-      algorithm: integrity?.algorithm,
-      previous_sha256: integrity?.previous_sha256 ?? null,
-      ...(integrity?.attestation ? { attestation: integrity.attestation } : {}),
-    },
-  };
-  return (
-    integrity?.algorithm === "sha256" &&
-    typeof integrity.payload_sha256 === "string" &&
-    integrity.payload_sha256 === sha256(stableStringify(digestable))
-  );
-}
-
-function parseEngineEvidence(path) {
-  const evidence = {
-    usage: {
-      input_tokens: 0,
-      output_tokens: 0,
-      cache_read: 0,
-      cache_write: 0,
-      cost_cents: null,
-      cost_source: "unavailable",
-    },
-    activity: {
-      turns: 0,
-      shell_commands: 0,
-      file_changes: 0,
-      mcp_tool_calls: 0,
-      web_searches: 0,
-      tool_calls: 0,
-      errors: 0,
-    },
-    eventCount: 0,
-  };
-  if (!path || !existsSync(path)) return evidence;
-  for (const line of readFileSync(path, "utf8").split(/\r?\n/).filter(Boolean)) {
-    let event;
-    try {
-      event = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    evidence.eventCount += 1;
-    const type = String(event.type ?? event.event ?? "");
-    const itemType = String(event.item?.type ?? event.name ?? "");
-    if (type === "turn.completed" || type === "assistant" || type === "assistant_message") {
-      evidence.activity.turns += 1;
-    }
-    if (type === "error" || type === "turn.failed" || itemType === "error") {
-      evidence.activity.errors += 1;
-    }
-    if (itemType === "command_execution") evidence.activity.shell_commands += 1;
-    if (itemType === "file_change") evidence.activity.file_changes += 1;
-    if (itemType === "mcp_tool_call") evidence.activity.mcp_tool_calls += 1;
-    if (itemType === "web_search") evidence.activity.web_searches += 1;
-    if (itemType) evidence.activity.tool_calls += 1;
-    mergeUsage(evidence.usage, event.usage ?? event.response?.usage ?? event.item?.usage);
-  }
-  return evidence;
-}
-
-function mergeUsage(usage, value) {
-  if (!value || typeof value !== "object") return;
-  usage.input_tokens = integer(value.input_tokens ?? value.inputTokens, usage.input_tokens);
-  usage.output_tokens = integer(value.output_tokens ?? value.outputTokens, usage.output_tokens);
-  usage.cache_read = integer(value.cache_read ?? value.cached_input_tokens, usage.cache_read);
-  usage.cache_write = integer(value.cache_write, usage.cache_write);
-  const cents =
-    value.cost_cents ??
-    (typeof value.cost_usd === "number" ? Math.round(value.cost_usd * 100) : undefined);
-  if (typeof cents === "number" && Number.isFinite(cents) && cents >= 0) {
-    usage.cost_cents = Math.round(cents);
-    usage.cost_source = "engine";
-  }
-}
-
-function parseChecks(path) {
-  if (!path || !existsSync(path)) return { items: [], total: 0 };
-  const checks = [];
-  for (const line of readFileSync(path, "utf8").split(/\r?\n/).filter(Boolean)) {
-    try {
-      const value = JSON.parse(line);
-      const status = ["passed", "failed", "skipped", "unknown"].includes(value.status)
-        ? value.status
-        : "unknown";
-      checks.push({
-        name: String(value.name ?? value.command ?? "unnamed check"),
-        status,
-        source: value.self_reported === false ? "platform" : "agent",
-        ...(Number.isInteger(value.exit_code) ? { exit_code: value.exit_code } : {}),
-      });
-    } catch {}
-  }
-  return { items: checks.slice(0, MAX_RECEIPT_CHECKS), total: checks.length };
-}
-
-function gitActivity(baseSha, worktree) {
-  if (!baseSha || !worktree) return { filesChanged: 0 };
-  try {
-    const files = execFileSync(
-      "git",
-      ["-C", worktree, "diff", "--name-only", `${baseSha}...HEAD`],
-      { encoding: "utf8" },
-    );
-    return { filesChanged: files.split(/\r?\n/).filter(Boolean).length };
-  } catch {
-    return { filesChanged: 0 };
-  }
-}
-
-function githubTarget(path) {
-  if (!path || !existsSync(path)) return {};
-  try {
-    const event = JSON.parse(readFileSync(path, "utf8"));
-    if (Number.isInteger(event.pull_request?.number)) return { pr: event.pull_request.number };
-    if (Number.isInteger(event.issue?.number)) {
-      return event.issue.pull_request ? { pr: event.issue.number } : { issue: event.issue.number };
-    }
-  } catch {}
-  return {};
-}
-
-function normalizeResult(value) {
-  if (value === "success" || value === "succeeded") return "succeeded";
-  if (value === "cancelled" || value === "canceled") return "canceled";
-  if (value === "skipped") return "skipped";
-  return "failed";
-}
-
-function gitCommitSha(value) {
-  return typeof value === "string" && /^[0-9a-f]{40}$/i.test(value)
-    ? value.toLowerCase()
-    : undefined;
-}
-
-function requiredChoice(value, choices, name) {
-  if (!value || !choices.has(value))
-    throw new Error(`FACILITY_RECEIPT_${name.toUpperCase()} is invalid`);
-  return value;
-}
-
-function validDate(value) {
-  if (!value) return null;
-  const date = new Date(value);
-  return Number.isNaN(date.getTime()) ? null : date;
-}
-
-function integer(value, fallback) {
-  return typeof value === "number" && Number.isInteger(value) && value >= 0 ? value : fallback;
-}
-
-function sha256(value) {
-  return createHash("sha256").update(value).digest("hex");
-}
-
-function stableStringify(value) {
-  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-  if (value && typeof value === "object") {
-    return `{${Object.entries(value)
-      .filter(([, inner]) => inner !== undefined)
-      .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-      .map(([key, inner]) => `${JSON.stringify(key)}:${stableStringify(inner)}`)
-      .join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
-
-if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
-  const receipt = collectReceipt();
-  const output = writeReceipt(receipt);
-  console.log(`Facility agent receipt written to ${output}`);
-}

package/templates/review/finalize.mjs

@@ -1,38 +0,0 @@
-#!/usr/bin/env node
-// Generated by facility — make every successful automated review observable.
-import { execFileSync } from "node:child_process";
-
-const repo = required("GITHUB_REPOSITORY");
-const prNumber = required("FACILITY_PR_NUMBER");
-const startedAt = required("FACILITY_REVIEW_STARTED_AT");
-const inlineComments = ghJson([
-  "api",
-  `repos/${repo}/pulls/${prNumber}/comments?per_page=100`,
-]).filter((comment) => comment.created_at >= startedAt && comment.user?.type === "Bot");
-
-if (inlineComments.length > 0) {
-  console.log(`Facility review produced ${inlineComments.length} inline finding(s).`);
-  process.exit(0);
-}
-
-const marker = `<!-- facility-review:${process.env.GITHUB_RUN_ID ?? "unknown"} -->`;
-const body = [
-  "Facility automated review completed with no actionable findings.",
-  "",
-  "This is advisory evidence, not approval; the required human review and merge gate remain in force.",
-  "",
-  marker,
-].join("\n");
-execFileSync("gh", ["api", `repos/${repo}/issues/${prNumber}/comments`, "-f", `body=${body}`], {
-  stdio: "inherit",
-});
-
-function ghJson(args) {
-  return JSON.parse(execFileSync("gh", args, { encoding: "utf8" }));
-}
-
-function required(name) {
-  const value = process.env[name];
-  if (!value) throw new Error(`${name} is required`);
-  return value;
-}

package/templates/scripts/move-board-status.sh

@@ -1,155 +0,0 @@
-#!/usr/bin/env bash
-#
-# Generated by facility — https://github.com/theam/facility
-#
-# Reflect the invoked agent on the org GitHub Project board by setting the
-# triggering issue's "Status" field:
-#
-#   /architect -> Planning      (only advances from empty/Backlog; never backward)
-#   /builder   -> In Progress   (invoking /builder is acceptance of the plan)
-#   verified delivery -> In Review
-#
-# Forward-only: the board is never moved backward (an issue already in
-# "In Review"/"Done" is left alone). The script no-ops cleanly when the
-# PROJECTS_PAT secret is missing, so the crew keeps working before the token
-# is configured.
-#
-# Requires: gh, jq. Auth via GH_TOKEN (a PAT/App token with org Projects
-# read+write; the default GITHUB_TOKEN cannot write org-level Projects v2).
-#
-# Env: MODE (builder|architect|review), ISSUE_NODE_ID, ORG, PROJECT_NUMBER.
-# Optional env to adapt to your board's column names:
-#   STATUS_COLUMNS    ordered, comma-separated (default below)
-#   ARCHITECT_STATUS  target column for /architect (default "Planning")
-#   BUILDER_STATUS    target column for /builder (default "In Progress")
-#   REVIEW_STATUS     target column after verified delivery (default "In Review")
-set -euo pipefail
-
-: "${MODE:?MODE required}"
-: "${ISSUE_NODE_ID:?ISSUE_NODE_ID required}"
-: "${ORG:?ORG required}"
-: "${PROJECT_NUMBER:?PROJECT_NUMBER required}"
-STATUS_COLUMNS="${STATUS_COLUMNS:-Backlog,Planning,Ready,In Progress,In Review,Done}"
-ARCHITECT_STATUS="${ARCHITECT_STATUS:-Planning}"
-BUILDER_STATUS="${BUILDER_STATUS:-In Progress}"
-REVIEW_STATUS="${REVIEW_STATUS:-In Review}"
-
-if [ -z "${GH_TOKEN:-}" ]; then
-  echo "::notice::PROJECTS_PAT not configured — skipping Project #${PROJECT_NUMBER} status move."
-  exit 0
-fi
-
-case "$MODE" in
-  architect) TARGET="$ARCHITECT_STATUS" ;;
-  builder)   TARGET="$BUILDER_STATUS" ;;
-  review)    TARGET="$REVIEW_STATUS" ;;
-  *) echo "::notice::mode '$MODE' has no status mapping — skipping."; exit 0 ;;
-esac
-
-# gh api graphql with a small retry — the GitHub API occasionally returns a
-# transient 401/5xx that succeeds on a second attempt.
-gql() {
-  local attempt out err
-  err=$(mktemp)
-  for attempt in 1 2 3; do
-    if out=$(gh api graphql "$@" 2>"$err"); then printf '%s' "$out"; rm -f "$err"; return 0; fi
-    sleep $((attempt * 2))
-  done
-  echo "::warning::GraphQL call failed after 3 attempts: $(tail -n1 "$err")" >&2
-  rm -f "$err"
-  return 1
-}
-
-# --- Project + Status single-select field metadata ---
-proj_json=$(gql -F number="$PROJECT_NUMBER" -f org="$ORG" -f query='
-  query($org:String!, $number:Int!) {
-    organization(login:$org) {
-      projectV2(number:$number) {
-        id
-        field(name:"Status") {
-          ... on ProjectV2SingleSelectField { id options { id name } }
-        }
-      }
-    }
-  }')
-
-PROJECT_ID=$(jq -r '.data.organization.projectV2.id // ""' <<<"$proj_json")
-STATUS_FIELD_ID=$(jq -r '.data.organization.projectV2.field.id // ""' <<<"$proj_json")
-TARGET_OPTION_ID=$(jq -r --arg n "$TARGET" \
-  '.data.organization.projectV2.field.options[]? | select(.name==$n) | .id' <<<"$proj_json")
-
-if [ -z "$PROJECT_ID" ] || [ -z "$STATUS_FIELD_ID" ] || [ -z "$TARGET_OPTION_ID" ]; then
-  echo "::warning::Could not resolve Project #${PROJECT_NUMBER} / Status option '$TARGET' — skipping."
-  exit 0
-fi
-
-# --- Find the item for this issue on the project (add it if missing) ---
-item_json=$(gql -f issue="$ISSUE_NODE_ID" -f query='
-  query($issue:ID!) {
-    node(id:$issue) {
-      ... on Issue {
-        projectItems(first:50) {
-          nodes {
-            id
-            project { id }
-            fieldValueByName(name:"Status") {
-              ... on ProjectV2ItemFieldSingleSelectValue { name }
-            }
-          }
-        }
-      }
-    }
-  }')
-
-ITEM_ID=$(jq -r --arg p "$PROJECT_ID" \
-  '.data.node.projectItems.nodes[]? | select(.project.id==$p) | .id' <<<"$item_json")
-CURRENT=$(jq -r --arg p "$PROJECT_ID" \
-  '.data.node.projectItems.nodes[]? | select(.project.id==$p) | .fieldValueByName.name // ""' <<<"$item_json")
-
-if [ -z "$ITEM_ID" ]; then
-  ITEM_ID=$(gql -f project="$PROJECT_ID" -f content="$ISSUE_NODE_ID" -f query='
-    mutation($project:ID!, $content:ID!) {
-      addProjectV2ItemById(input:{projectId:$project, contentId:$content}) { item { id } }
-    }' --jq '.data.addProjectV2ItemById.item.id')
-  CURRENT=""
-  echo "Added issue to Project #${PROJECT_NUMBER} (item ${ITEM_ID})."
-fi
-
-# --- Forward-only guard (board column order from STATUS_COLUMNS) ---
-rank() {
-  local name="$1" i=0 col
-  if [ -z "$name" ]; then echo 0; return; fi
-  IFS=',' read -ra cols <<< "$STATUS_COLUMNS"
-  for col in "${cols[@]}"; do
-    if [ "$col" = "$name" ]; then echo "$i"; return; fi
-    i=$((i + 1))
-  done
-  echo 0
-}
-cur_rank=$(rank "$CURRENT")
-tgt_rank=$(rank "$TARGET")
-
-# /architect only kicks off planning; if work has already moved past the first
-# column, leave the board as-is (a follow-up question shouldn't drag it back).
-if [ "$MODE" = "architect" ] && [ "$cur_rank" -gt 0 ]; then
-  echo "::notice::Issue already at '${CURRENT}' — /architect leaves the board unchanged."
-  exit 0
-fi
-# Never move backward or sideways.
-if [ -n "$CURRENT" ] && [ "$tgt_rank" -le "$cur_rank" ]; then
-  echo "::notice::Issue at '${CURRENT}'; not moving to '${TARGET}' (forward-only)."
-  exit 0
-fi
-
-# --- Apply ---
-gql \
-  -f project="$PROJECT_ID" -f item="$ITEM_ID" -f field="$STATUS_FIELD_ID" -f option="$TARGET_OPTION_ID" \
-  -f query='
-    mutation($project:ID!, $item:ID!, $field:ID!, $option:String!) {
-      updateProjectV2ItemFieldValue(input:{
-        projectId:$project, itemId:$item, fieldId:$field,
-        value:{ singleSelectOptionId:$option }
-      }) { projectV2Item { id } }
-    }' >/dev/null
-
-echo "Moved issue to '${TARGET}' on Project #${PROJECT_NUMBER} (was '${CURRENT:-unset}')."