@todoist/doistbot-cli 0.0.0-stage → 1.0.16

package/sandbox/dist/tasks/issue-triage/assignee-review.js

@@ -0,0 +1,114 @@
+import { isKnownDoistbotLogin } from '../../core/bot-logins.js';
+import { logger } from '../../core/logging.js';
+import { findOwningRoutes, findRepositoryTarget } from '../../core/repository-map.js';
+import { withRetry } from '../../core/retry.js';
+import { GITHUB_REQUEST_TIMEOUT_MS } from './github-request.js';
+import { ASSIGNEE_REVIEW_MARKER } from './markers.js';
+export async function resolveAssigneeReviewers({ owner, repo, assignees, membershipOctokit, }) {
+    const repository = findRepositoryTarget(owner, repo);
+    if (!repository || assignees.length === 0)
+        return [];
+    const routes = findOwningRoutes(repository);
+    const teams = [...new Set(routes.map((route) => route.ownerTeam))];
+    const reviewers = [];
+    const logins = [...new Set(assignees.map((login) => login.toLowerCase()))];
+    for (const username of logins) {
+        if (isKnownDoistbotLogin(username))
+            continue;
+        for (const teamSlug of teams) {
+            try {
+                const { data } = await withRetry(() => membershipOctokit.rest.teams.getMembershipForUserInOrg({
+                    org: owner,
+                    team_slug: teamSlug,
+                    username,
+                    request: { signal: AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS) },
+                }));
+                if (data.state === 'active') {
+                    reviewers.push(username);
+                    break;
+                }
+            }
+            catch (error) {
+                // A missing/invisible membership never qualifies an assignee.
+                if (error?.status !== 404) {
+                    logger.warn('Unable to verify autofix assignee team membership', {
+                        repository: `${owner}/${repo}`,
+                        username,
+                        team: teamSlug,
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                }
+            }
+        }
+    }
+    return reviewers;
+}
+/** Best-effort early review request. Failure must not lose an already opened PR. */
+export async function requestAssigneeReview({ assigneeReview, ...pr }) {
+    if (!assigneeReview)
+        return [];
+    const reviewers = await resolveAssigneeReviewers({ ...pr, ...assigneeReview });
+    if (reviewers.length === 0)
+        return [];
+    try {
+        await withRetry(() => pr.octokit.rest.pulls.requestReviewers({
+            owner: pr.owner,
+            repo: pr.repo,
+            pull_number: pr.prNumber,
+            reviewers,
+            request: { signal: AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS) },
+        }));
+    }
+    catch (error) {
+        logger.warn('Autofix assignee review request failed; retaining Hero fallback', {
+            repository: `${pr.owner}/${pr.repo}`,
+            pr_number: pr.prNumber,
+            reviewers,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return [];
+    }
+    try {
+        // A bot-authored receipt on the target PR survives the separate promotion
+        // process, completed/removed review requests, and edits to the PR body.
+        // Only write it AFTER GitHub accepts the request, never for candidates.
+        await withRetry(() => pr.octokit.rest.issues.createComment({
+            owner: pr.owner,
+            repo: pr.repo,
+            issue_number: pr.prNumber,
+            body: [
+                ASSIGNEE_REVIEW_MARKER,
+                '',
+                `Requested review from issue assignees: ${reviewers.map((login) => `@${login}`).join(', ')}.`,
+            ].join('\n'),
+            request: { signal: AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS) },
+        }));
+    }
+    catch (error) {
+        logger.warn('Failed to record autofix assignee review request; Hero fallback remains armed', {
+            repository: `${pr.owner}/${pr.repo}`,
+            pr_number: pr.prNumber,
+            reviewers,
+            error: error instanceof Error ? error.message : String(error),
+        });
+    }
+    return reviewers;
+}
+export async function hasAssigneeReviewRequest(pr) {
+    return withRetry(async () => {
+        const pages = pr.octokit.paginate.iterator(pr.octokit.rest.issues.listComments, {
+            owner: pr.owner,
+            repo: pr.repo,
+            issue_number: pr.prNumber,
+            per_page: 100,
+            request: { signal: AbortSignal.timeout(GITHUB_REQUEST_TIMEOUT_MS) },
+        });
+        for await (const { data: comments } of pages) {
+            if (comments.some((comment) => isKnownDoistbotLogin(comment.user?.login) &&
+                comment.body?.split('\n')[0]?.trim() === ASSIGNEE_REVIEW_MARKER)) {
+                return true;
+            }
+        }
+        return false;
+    });
+}

package/sandbox/dist/tasks/issue-triage/autofix-capabilities.js

@@ -0,0 +1,22 @@
+const REPOSITORY_CAPABILITIES = {
+    'todoist/todoist-web': ['github-packages-read'],
+};
+export function resolveAutofixCapabilities(repository) {
+    return REPOSITORY_CAPABILITIES[repository.toLowerCase()] ?? [];
+}
+export function resolveAutofixCapabilityEnv(repository, env = process.env) {
+    const capabilityEnv = {};
+    for (const capability of resolveAutofixCapabilities(repository)) {
+        if (capability === 'github-packages-read') {
+            const token = env.GH_PACKAGES_TOKEN?.trim();
+            if (!token) {
+                return {
+                    ok: false,
+                    reason: `Missing GH_PACKAGES_TOKEN for required autofix capability "${capability}" on ${repository}.`,
+                };
+            }
+            capabilityEnv.GH_PACKAGES_TOKEN = token;
+        }
+    }
+    return { ok: true, env: capabilityEnv };
+}

package/sandbox/dist/tasks/issue-triage/autofix-checkpoint.js

@@ -0,0 +1,122 @@
+import { randomUUID } from 'node:crypto';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import { GetObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
+import { Ajv } from 'ajv';
+import { hashAutofixInputs, verificationStateSchema } from '../../core/autofix-verification.js';
+import { githubHistoryIdentity } from '../../core/github-history.js';
+import { logger } from '../../core/logging.js';
+export const autofixCheckpointSchema = {
+    type: 'object',
+    additionalProperties: false,
+    required: ['version', 'identity', 'baseCommit', 'patch', 'verification', 'status', 'savedAt'],
+    properties: {
+        version: { const: 1 },
+        identity: { type: 'string' },
+        baseCommit: { type: 'string' },
+        patch: { type: 'string', maxLength: 5 * 1024 * 1024 },
+        verification: verificationStateSchema,
+        status: { enum: ['timed-out', 'failed', 'completed'] },
+        savedAt: { type: 'string' },
+    },
+};
+const validateCheckpoint = new Ajv().compile(autofixCheckpointSchema);
+export function checkpointIdentity(input) {
+    return hashAutofixInputs(JSON.stringify({
+        issueUrl: githubHistoryIdentity(input.issueUrl),
+        repository: githubHistoryIdentity(input.repository),
+        baseCommit: input.baseCommit,
+        triageOutput: input.triageOutput.trim(),
+        policy: input.policy,
+    }));
+}
+export class AutofixCheckpointStore {
+    identity;
+    bucket;
+    directory;
+    s3;
+    prefix;
+    constructor(identity, bucket, directory) {
+        this.identity = identity;
+        this.bucket = bucket;
+        this.directory = directory ?? path.join(tmpdir(), 'doistbot-autofix', randomUUID());
+        mkdirSync(this.directory, { recursive: true, mode: 0o700 });
+        this.prefix = `autofix/${identity}`;
+        this.s3 = bucket ? new S3Client({ maxAttempts: 2 }) : undefined;
+    }
+    async load() {
+        if (!this.s3 || !this.bucket)
+            return null;
+        try {
+            const key = `${this.prefix}/checkpoint.json`;
+            const listing = await this.s3.send(new ListObjectsV2Command({ Bucket: this.bucket, Prefix: key, MaxKeys: 1 }), { abortSignal: AbortSignal.timeout(15_000) });
+            if (!listing.Contents?.some((object) => object.Key === key))
+                return null;
+            const object = await this.s3.send(new GetObjectCommand({
+                Bucket: this.bucket,
+                Key: key,
+            }), { abortSignal: AbortSignal.timeout(15_000) });
+            if (!object.Body || (object.ContentLength ?? 0) > 10 * 1024 * 1024)
+                throw new Error('Invalid checkpoint size');
+            const data = JSON.parse(await object.Body.transformToString());
+            if (!validateCheckpoint(data) || data.identity !== this.identity)
+                throw new Error('Invalid autofix checkpoint');
+            return data.status === 'timed-out' ? data : null;
+        }
+        catch (error) {
+            if (error instanceof Error && error.name === 'NoSuchKey')
+                return null;
+            throw error;
+        }
+    }
+    async save(checkpoint, report) {
+        const checkpointFile = {
+            name: 'checkpoint.json',
+            body: JSON.stringify(checkpoint),
+            contentType: 'application/json',
+        };
+        const files = [
+            { name: 'fix.patch', body: checkpoint.patch, contentType: 'text/x-diff' },
+            { name: 'run.json', body: report, contentType: 'application/json' },
+            checkpointFile,
+        ];
+        for (const file of files)
+            writeFileSync(path.join(this.directory, file.name), file.body, { mode: 0o600 });
+        if (!this.s3 || !this.bucket) {
+            logger.warn('Autofix artifacts saved locally; cross-sandbox recovery is unavailable', {
+                directory: this.directory,
+            });
+            return false;
+        }
+        // Archive each run separately. Update the resumable checkpoint last.
+        const runPrefix = `${this.prefix}/runs/${path.basename(this.directory)}`;
+        const uploads = [
+            ...files.map((file) => ({ ...file, key: `${runPrefix}/${file.name}` })),
+            ...(checkpoint.status === 'failed'
+                ? []
+                : [{ ...checkpointFile, key: `${this.prefix}/checkpoint.json` }]),
+        ];
+        try {
+            for (const file of uploads)
+                await this.s3.send(new PutObjectCommand({
+                    Bucket: this.bucket,
+                    Key: file.key,
+                    Body: file.body,
+                    ContentType: file.contentType,
+                }), { abortSignal: AbortSignal.timeout(15_000) });
+            logger.info('Autofix artifacts saved', {
+                directory: this.directory,
+                artifactPrefix: `s3://${this.bucket}/${runPrefix}`,
+            });
+            return true;
+        }
+        catch (error) {
+            logger.error('Autofix artifact upload failed', {
+                directory: this.directory,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return false;
+        }
+    }
+}

package/sandbox/dist/tasks/issue-triage/autofix-policy.js

@@ -0,0 +1,36 @@
+import { CONFIG_FILE_PATH, getLocalRepoConfig } from 'doistbot-repo-config';
+import { validateAutofixPolicy } from '../../core/autofix-verification.js';
+import { logger } from '../../core/logging.js';
+const NO_CHECKS_POLICY = { verification: { checks: [] } };
+export function loadAutofixPolicy(repoPath) {
+    const config = getLocalRepoConfig({ workspaceDir: repoPath, logger, strict: true });
+    if (!config || typeof config !== 'object' || !('issue_triage' in config))
+        return NO_CHECKS_POLICY;
+    const section = config.issue_triage;
+    if (!section || typeof section !== 'object' || !('autofix' in section))
+        return NO_CHECKS_POLICY;
+    const policy = section.autofix;
+    if (!validateAutofixPolicy(policy)) {
+        throw new Error(`Invalid issue_triage.autofix in ${CONFIG_FILE_PATH}: ${JSON.stringify(validateAutofixPolicy.errors)}`);
+    }
+    const names = policy.verification.checks.map((check) => check.name);
+    if (new Set(names).size !== names.length)
+        throw new Error('Autofix check names must be unique');
+    return policy;
+}
+export function describeAutofixPolicy(policy) {
+    return [
+        '\n## Repository autofix policy',
+        `Source: ${CONFIG_FILE_PATH}. Verification shares the autofix time limit; there is no round-count limit.`,
+        policy.guidance ?? '',
+        'The first verification round runs every configured check. Later rounds can select check names. Run checks only through verify:',
+        ...policy.verification.checks.map((check) => `- ${check.name}: ${check.command}${check.use_test_selectors ? '. Supply focused testSelectors for this check.' : ''}`),
+        ...(policy.verification.checks.length
+            ? []
+            : ['No local checks are configured. Report this limit and leave checks to CI.']),
+        'UI tests are forbidden. Do not create or modify UI tests, even if repository guidance asks for them.',
+        'Extra forbidden test paths: ' + (policy.forbidden_test_paths?.join(', ') || 'none'),
+    ]
+        .filter(Boolean)
+        .join('\n');
+}

package/sandbox/dist/tasks/issue-triage/clone.js

@@ -0,0 +1,40 @@
+import { logger } from '../../core/logging.js';
+import { withPhase } from '../../core/tracing.js';
+import { cloneRepository } from './shared.js';
+export async function cloneTriageRepositories(params) {
+    return withPhase('triage.clone', { 'repos.count': params.repositories.length }, async (span) => {
+        const cloneFn = params.cloneRepositoryImpl ?? cloneRepository;
+        const clonedRepositories = [];
+        const failedRepositories = [];
+        for (const repository of params.repositories) {
+            try {
+                const cloneResult = await cloneFn({
+                    app: params.app,
+                    repository,
+                    reposDir: params.reposDir,
+                    fallbackInstallationId: params.fallbackInstallationId,
+                });
+                clonedRepositories.push(cloneResult);
+            }
+            catch (err) {
+                const message = err instanceof Error ? err.message : String(err);
+                // Keep per-repo diagnostics (auth/git errors) visible even
+                // when EVERY clone fails and the orchestrator bails early.
+                logger.warn('Repository clone failed', {
+                    repository: repository.fullName,
+                    error: message,
+                });
+                failedRepositories.push({
+                    repository: repository.fullName,
+                    error: message,
+                });
+            }
+        }
+        span.setAttributes({
+            'clone.success_count': clonedRepositories.length,
+            'clone.failed_count': failedRepositories.length,
+            'repos.count': params.repositories.length,
+        });
+        return { clonedRepositories, failedRepositories };
+    });
+}

package/sandbox/dist/tasks/issue-triage/context.js

@@ -0,0 +1,57 @@
+import { parseSandboxVariant } from 'doistbot-issue-routing';
+import { optionalPositiveInt, requiredEnv, requiredPositiveInt } from '../../core/environment.js';
+import { withPhase } from '../../core/tracing.js';
+import { extractLabelNames, fetchIssue, fetchIssueComments, } from './shared.js';
+function parseOpenAIApiKey(env) {
+    const openaiKey = env.OPENAI_KEY?.trim();
+    if (!openaiKey) {
+        throw new Error('Missing required environment variable: OPENAI_KEY');
+    }
+    return openaiKey;
+}
+export function parseIssueTriageContext(env = process.env) {
+    const commentId = optionalPositiveInt(env.COMMENT_ID);
+    const reactionId = optionalPositiveInt(env.REACTION_ID);
+    const deliveryId = env.DELIVERY_ID?.trim() || 'unknown';
+    const triggerType = env.TRIGGER_TYPE?.toLowerCase() === 'auto' ? 'auto' : 'manual';
+    return {
+        owner: requiredEnv('REPO_OWNER', env),
+        repo: requiredEnv('REPO_NAME', env),
+        issueNumber: requiredPositiveInt('ISSUE_NUMBER', env),
+        installationId: requiredPositiveInt('INSTALLATION_ID', env),
+        appId: requiredEnv('APP_ID', env),
+        privateKey: requiredEnv('PRIVATE_KEY', env),
+        githubToken: requiredEnv('GITHUB_TOKEN', env),
+        openaiApiKey: parseOpenAIApiKey(env),
+        geminiApiKey: env.GEMINI_API_KEY?.trim() || undefined,
+        commentId,
+        reactionId,
+        placeholderCommentId: optionalPositiveInt(env.PLACEHOLDER_COMMENT_ID),
+        deliveryId,
+        dryRun: env.DRY_RUN?.toLowerCase() === 'true',
+        triggerType,
+        sandboxVariant: parseSandboxVariant(env.SANDBOX_VARIANT),
+    };
+}
+export async function loadTriageContext(params) {
+    return withPhase('triage.context', { 'issue.number': params.issueNumber }, async (span) => {
+        const [issue, comments] = await Promise.all([
+            fetchIssue(params.octokit, {
+                owner: params.owner,
+                repo: params.repo,
+                issueNumber: params.issueNumber,
+            }),
+            fetchIssueComments(params.octokit, {
+                owner: params.owner,
+                repo: params.repo,
+                issueNumber: params.issueNumber,
+            }),
+        ]);
+        const labelNames = extractLabelNames(issue.labels);
+        span.setAttributes({
+            'comments.count': comments.length,
+            'labels.count': labelNames.length,
+        });
+        return { issue, comments, labelNames };
+    });
+}

package/sandbox/dist/tasks/issue-triage/diff-validator.js

@@ -0,0 +1,102 @@
+import path from 'path';
+import { isForbiddenAutofixTest } from '../../core/autofix-test-policy.js';
+import { logger } from '../../core/logging.js';
+const DEFAULT_MAX_CHANGED_LINES = 3000;
+const BINARY_EXTENSIONS = new Set([
+    '.png',
+    '.jpg',
+    '.jpeg',
+    '.gif',
+    '.ico',
+    '.woff',
+    '.woff2',
+    '.ttf',
+    '.eot',
+    '.zip',
+    '.tar',
+    '.gz',
+    '.pdf',
+    '.exe',
+    '.dll',
+    '.so',
+    '.dylib',
+]);
+function parseDiffStat(diff) {
+    const files = [];
+    const diffSegments = diff.split(/^diff --git /m).filter((s) => s.trim().length > 0);
+    for (const segment of diffSegments) {
+        const headerMatch = segment.match(/^a\/(.+?) b\/(.+)/);
+        if (!headerMatch) {
+            continue;
+        }
+        const sourcePath = headerMatch[1];
+        const filePath = headerMatch[2].split('\n')[0].trim();
+        let addedLines = 0;
+        let removedLines = 0;
+        const addedContent = [];
+        let inHunk = false;
+        const lines = segment.split('\n');
+        for (const line of lines) {
+            if (line.startsWith('@@')) {
+                inHunk = true;
+                continue;
+            }
+            if (!inHunk) {
+                continue;
+            }
+            if (line.startsWith('+')) {
+                addedLines++;
+                addedContent.push(line.slice(1));
+            }
+            else if (line.startsWith('-')) {
+                removedLines++;
+            }
+        }
+        files.push({
+            filePath,
+            sourcePath,
+            addedLines,
+            removedLines,
+            addedContent: addedContent.join('\n'),
+        });
+    }
+    return files;
+}
+export function validateDiff(diff, limits) {
+    const maxChangedLines = limits?.maxChangedLines ?? DEFAULT_MAX_CHANGED_LINES;
+    if (!diff.trim()) {
+        return { valid: false, reason: 'Diff is empty — no changes were made.' };
+    }
+    const files = parseDiffStat(diff);
+    if (files.length === 0) {
+        return { valid: false, reason: 'Could not parse any file changes from the diff.' };
+    }
+    const totalChangedLines = files.reduce((sum, f) => sum + f.addedLines + f.removedLines, 0);
+    if (totalChangedLines > maxChangedLines) {
+        return {
+            valid: false,
+            reason: `Diff has ${totalChangedLines} changed lines (max ${maxChangedLines}).`,
+        };
+    }
+    for (const file of files) {
+        for (const pathToCheck of [file.filePath, file.sourcePath]) {
+            if (isForbiddenAutofixTest(pathToCheck, limits?.forbiddenTestPaths, file.addedContent)) {
+                return { valid: false, reason: `Autofix cannot change UI tests: ${pathToCheck}` };
+            }
+            if (BINARY_EXTENSIONS.has(path.extname(pathToCheck).toLowerCase())) {
+                return { valid: false, reason: `Diff modifies binary file: ${pathToCheck}` };
+            }
+        }
+    }
+    logger.info('Diff validation passed', {
+        task: 'issue-triage',
+        filesCount: files.length,
+        totalChangedLines,
+        files: files.map((f) => ({
+            path: f.filePath,
+            added: f.addedLines,
+            removed: f.removedLines,
+        })),
+    });
+    return { valid: true };
+}