@todoist/doistbot-cli 0.0.0-stage → 1.0.16

package/sandbox/dist/tasks/sentry-triage/store.js

@@ -0,0 +1,133 @@
+import { randomUUID } from 'node:crypto';
+import { GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { isRecord, isSentryRetryableStatus, isSentryRunRecord, sentryArtifactsPrefix, sentryRunKey, } from 'doistbot-issue-routing';
+export async function currentTaskArn() {
+    const uri = process.env.ECS_CONTAINER_METADATA_URI_V4;
+    if (!uri)
+        throw new Error('Sentry triage requires ECS task metadata');
+    const response = await fetch(`${uri}/task`, { signal: AbortSignal.timeout(5000) });
+    if (!response.ok)
+        throw new Error(`Cannot read ECS task metadata: ${response.status}`);
+    const metadata = await response.json();
+    if (!isRecord(metadata) ||
+        typeof metadata.TaskARN !== 'string' ||
+        !metadata.TaskARN.startsWith('arn:aws:ecs:'))
+        throw new Error('ECS task metadata has no valid TaskARN');
+    return metadata.TaskARN;
+}
+/** Conditional writes give exactly one sandbox ownership of each saved run. */
+export class SentryRunStore {
+    bucket;
+    envelope;
+    client;
+    key;
+    etag;
+    record;
+    savedReport;
+    constructor(bucket, envelope, client = new S3Client({ maxAttempts: 2 })) {
+        this.bucket = bucket;
+        this.envelope = envelope;
+        this.client = client;
+        this.key = sentryRunKey(envelope.issue);
+    }
+    get reportBody() {
+        return this.savedReport;
+    }
+    get runId() {
+        return this.record?.runId;
+    }
+    get fixStarted() {
+        return this.record?.fixStarted ?? false;
+    }
+    async claim(route, taskArn) {
+        const retentionDays = Number(process.env.SENTRY_ARTIFACT_RETENTION_DAYS ?? '1');
+        if (!Number.isInteger(retentionDays) || retentionDays < 1 || retentionDays > 7)
+            throw new Error('SENTRY_ARTIFACT_RETENTION_DAYS must be an integer from 1 to 7');
+        let previous;
+        if (this.envelope.retryOf) {
+            const object = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: this.key }), { abortSignal: AbortSignal.timeout(15_000) });
+            const parsed = JSON.parse(await object.Body.transformToString());
+            if (!isSentryRunRecord(parsed) || !object.ETag)
+                throw new Error('Invalid saved Sentry run');
+            if (this.envelope.retryOf !== parsed.runId)
+                return false;
+            // Completed runs are cleaned up. Retrying them could create a second PR.
+            if (!isSentryRetryableStatus(parsed.status))
+                throw new Error(`Cannot retry Sentry run in ${parsed.status} state`);
+            if (Date.now() >= Date.parse(parsed.retryUntil))
+                throw new Error('Sentry retry window has expired; inspect the PR and logs manually');
+            if (parsed.route.product !== route.product || parsed.route.routeId !== route.routeId)
+                throw new Error('Cannot resume a Sentry run with changed team routing');
+            previous = parsed;
+            this.etag = object.ETag;
+            if (parsed.hasReport) {
+                const report = await this.client.send(new GetObjectCommand({
+                    Bucket: this.bucket,
+                    Key: `${sentryArtifactsPrefix(this.envelope.issue)}report.md`,
+                }), { abortSignal: AbortSignal.timeout(15_000) });
+                // Missing retry data must fail closed, never start a second fix.
+                this.savedReport = await report.Body.transformToString();
+            }
+        }
+        const now = new Date().toISOString();
+        const record = {
+            version: 1,
+            runId: randomUUID(),
+            taskArn,
+            envelope: this.envelope,
+            route,
+            status: 'running',
+            startedAt: now,
+            updatedAt: now,
+            retryUntil: previous?.retryUntil ??
+                new Date(Date.now() + retentionDays * 86_400_000).toISOString(),
+            hasReport: previous?.hasReport ?? false,
+            // Old records cannot prove that no fix started. Keep recovery strict for them.
+            fixStarted: previous?.fixStarted ?? previous?.hasReport ?? false,
+            pr: previous?.pr,
+        };
+        try {
+            await this.write(record);
+            return true;
+        }
+        catch (error) {
+            if (error.$metadata?.httpStatusCode ===
+                412)
+                return false;
+            throw error;
+        }
+    }
+    async save(result) {
+        if (!this.record)
+            throw new Error('Sentry run has not been claimed');
+        const { reportBody, ...outcome } = result;
+        if (reportBody !== undefined && reportBody !== this.savedReport) {
+            await this.client.send(new PutObjectCommand({
+                Bucket: this.bucket,
+                Key: `${sentryArtifactsPrefix(this.envelope.issue)}report.md`,
+                Body: reportBody,
+                ContentType: 'text/markdown; charset=utf-8',
+            }), { abortSignal: AbortSignal.timeout(15_000) });
+            this.savedReport = reportBody;
+        }
+        await this.write({
+            ...this.record,
+            ...outcome,
+            hasReport: this.savedReport !== undefined,
+            updatedAt: new Date().toISOString(),
+        });
+    }
+    async write(record) {
+        const result = await this.client.send(new PutObjectCommand({
+            Bucket: this.bucket,
+            Key: this.key,
+            Body: JSON.stringify(record),
+            ContentType: 'application/json',
+            ...(this.etag ? { IfMatch: this.etag } : { IfNoneMatch: '*' }),
+        }), { abortSignal: AbortSignal.timeout(15_000) });
+        if (!result.ETag)
+            throw new Error('S3 did not return an ETag for the Sentry run');
+        this.etag = result.ETag;
+        this.record = record;
+    }
+}

package/sandbox/dist/tasks/sentry-triage/triage.js

@@ -0,0 +1,217 @@
+import { findIssueRoute, isRecord, isSentryEnvelope, isSentryRouteSnapshot, parseSandboxVariant, repositoryKey, resolveSentryRoute, sentryIssueUrl, } from 'doistbot-issue-routing';
+import { App } from 'octokit';
+import { requiredEnv, WORKSPACE_DIR } from '../../core/environment.js';
+import { logger } from '../../core/logging.js';
+import { resolveWriteOctokit } from '../../core/shared.js';
+import { recordDecision, withPhase } from '../../core/tracing.js';
+import { cloneTriageRepositories } from '../issue-triage/clone.js';
+import { runConfiguredFix } from '../issue-triage/fix-dispatch.js';
+import { invokeTriageModel } from '../issue-triage/model.js';
+import { validateTriageOutput } from '../issue-triage/output.js';
+import { buildTriagePrompt } from '../issue-triage/prompt.js';
+import { createRepoConfigLoader, isAutoTriageEnabled } from '../issue-triage/repo-config.js';
+import { readTriageReport, renderTriageReport, reportAssessment, reportForFix, } from '../issue-triage/report.js';
+import { prepareWorkspaceReposDirectory } from '../issue-triage/shared.js';
+import { currentTaskArn, SentryRunStore } from './store.js';
+function parseSentryTask(raw) {
+    const task = JSON.parse(raw);
+    if (!isRecord(task) || !isSentryEnvelope(task.envelope) || !isSentryRouteSnapshot(task.route))
+        throw new Error('Invalid SENTRY_TASK');
+    const route = resolveSentryRoute(task.envelope, [task.route]);
+    if (!route)
+        throw new Error('Sentry task does not match project route');
+    return { envelope: task.envelope, route };
+}
+export async function runSentryTriage() {
+    const { envelope, route } = parseSentryTask(requiredEnv('SENTRY_TASK'));
+    const scope = findIssueRoute(route.product, route.routeId);
+    const issue = envelope.issue;
+    const issueUrl = sentryIssueUrl(issue);
+    const startedAt = Date.now();
+    const store = new SentryRunStore(requiredEnv('LOG_SNAPSHOT_BUCKET'), envelope);
+    logger.setBaseContext({ source: 'sentry', ...issue, deliveryId: envelope.deliveryId });
+    if (!(await store.claim(route, await currentTaskArn()))) {
+        logger.info('Sentry issue skipped: already claimed', { runKey: store.key });
+        return;
+    }
+    let reportBody = store.reportBody;
+    let fix;
+    async function finish(status, reason) {
+        await store.save({
+            status,
+            reportBody,
+            ...(fix?.attempted && fix.prNumber !== undefined
+                ? { pr: { repository: fix.repository, number: fix.prNumber } }
+                : {}),
+        });
+        logger.info('Sentry triage result', {
+            status,
+            reason,
+            mode: route.mode,
+            team: scope.ownerTeam,
+            runKey: store.key,
+            runId: store.runId,
+            durationMs: Date.now() - startedAt,
+            fix,
+        });
+    }
+    await withPhase('sentry.triage', {
+        'sentry.issue_id': issue.issueId,
+        'sentry.project_id': issue.projectId,
+        'gen_ai.operation.name': 'invoke_agent',
+        'gen_ai.agent.name': 'doistbot.sentry-triage',
+    }, async () => {
+        try {
+            requiredEnv('SENTRY_AUTH_TOKEN');
+            if (process.env.SENTRY_ORG !== route.organization)
+                throw new Error('Sentry organization does not match sandbox configuration');
+            const primary = scope.repositories[0];
+            const app = new App({
+                appId: requiredEnv('APP_ID'),
+                privateKey: requiredEnv('PRIVATE_KEY'),
+            });
+            const installation = await app.octokit.rest.apps.getRepoInstallation({
+                owner: primary.owner,
+                repo: primary.repo,
+            });
+            const installationId = installation.data.id;
+            const readOctokit = await app.getInstallationOctokit(installationId);
+            const githubToken = requiredEnv('GITHUB_TOKEN');
+            const writeOctokit = resolveWriteOctokit({
+                githubToken,
+                fallbackOctokit: readOctokit,
+            });
+            const loadRepoConfig = createRepoConfigLoader({ octokit: readOctokit, logger });
+            for (const repository of scope.repositories) {
+                // Load errors reach the failure handler and remain retryable.
+                if (!isAutoTriageEnabled(await loadRepoConfig(repository))) {
+                    await finish('skipped', 'repository-opt-out');
+                    return;
+                }
+            }
+            let report;
+            let repositories = scope.repositories;
+            if (reportBody !== undefined) {
+                const saved = readTriageReport(reportBody);
+                const targetRepo = saved && 'targetRepo' in saved.analysis.decision
+                    ? saved.analysis.decision.targetRepo
+                    : undefined;
+                if (saved?.issueUrl !== issueUrl ||
+                    (targetRepo &&
+                        !scope.repositories.some((repo) => repositoryKey(repo.fullName) === repositoryKey(targetRepo))))
+                    throw new Error('Saved Sentry report does not match the current scope');
+                report = saved;
+                repositories = targetRepo
+                    ? scope.repositories.filter((repo) => repositoryKey(repo.fullName) === repositoryKey(targetRepo))
+                    : [];
+            }
+            const { clonedRepositories, failedRepositories } = await cloneTriageRepositories({
+                app,
+                repositories,
+                reposDir: prepareWorkspaceReposDirectory(),
+                fallbackInstallationId: installationId,
+            });
+            if (failedRepositories.length)
+                throw new Error('Could not clone the required Sentry repositories');
+            const auth = (await app.octokit.auth({ type: 'installation', installationId }));
+            const history = { latest: null, pending: null };
+            const ctx = {
+                owner: primary.owner,
+                repo: primary.repo,
+                sentryIssue: { ...issue, product: route.product, routeId: route.routeId },
+                installationId,
+                appId: requiredEnv('APP_ID'),
+                privateKey: requiredEnv('PRIVATE_KEY'),
+                githubToken,
+                openaiApiKey: requiredEnv('OPENAI_KEY'),
+                geminiApiKey: process.env.GEMINI_API_KEY,
+                deliveryId: envelope.deliveryId,
+                dryRun: false,
+                triggerType: envelope.fixCommentId ? 'manual' : 'auto',
+                sandboxVariant: parseSandboxVariant(process.env.SANDBOX_VARIANT),
+            };
+            if (!report) {
+                const triage = await invokeTriageModel({
+                    prompt: buildTriagePrompt({
+                        issueUrl,
+                        repositories: clonedRepositories,
+                        history,
+                        source: 'sentry',
+                    }),
+                    apiKey: ctx.openaiApiKey,
+                    cwd: WORKSPACE_DIR,
+                    thinkingLevel: 'xhigh',
+                    extraEnv: { GH_TOKEN: auth.token },
+                    phaseName: 'sentry.model',
+                });
+                if (!triage.ok)
+                    throw new Error(triage.error);
+                const validated = await validateTriageOutput({
+                    rawOutput: triage.output,
+                    issueUrl,
+                    repositories: scope.repositories.map((repo) => repo.fullName),
+                    history,
+                    // Save the full report in S3; openDraftFixPR limits the GitHub description.
+                    enforceCommentLimit: false,
+                });
+                if (!validated.ok)
+                    throw new Error(validated.error);
+                report = validated.report;
+            }
+            reportBody = renderTriageReport(report);
+            const assessment = reportAssessment(report);
+            recordDecision('sentry.fix-eligibility', {
+                mode: route.mode,
+                classification: assessment.classification,
+                confidence: assessment.confidence,
+            });
+            if (route.mode === 'triage' ||
+                assessment.classification !== 'auto-fixable' ||
+                assessment.confidence !== 'high') {
+                await finish('triaged', assessment.classification);
+                return;
+            }
+            // Persist the exact report before effects; recovery hashes this report.
+            await store.save({ status: 'running', reportBody });
+            fix = await runConfiguredFix({
+                ctx,
+                octokit: writeOctokit,
+                triageOutput: reportForFix(report),
+                fixAssessment: assessment,
+                clonedRepos: clonedRepositories,
+                issueTitle: issue.shortId ?? `Sentry issue ${issue.issueId}`,
+                issueUrl,
+                ghToken: auth.token,
+                retry: store.fixStarted,
+                onRecoverySaved: async () => {
+                    if (!store.fixStarted)
+                        await store.save({ status: 'running', fixStarted: true });
+                },
+            });
+            await finish(fix.attempted && fix.prCreated ? 'awaiting-ci' : 'needs-human', 'reason' in fix ? fix.reason : undefined);
+        }
+        catch (error) {
+            try {
+                await finish('failed', error instanceof Error ? error.message : String(error));
+            }
+            catch (saveError) {
+                logger.error('Could not save Sentry failure', {
+                    runKey: store.key,
+                    error: String(saveError),
+                });
+            }
+            throw error;
+        }
+    });
+}
+export async function main() {
+    try {
+        await runSentryTriage();
+    }
+    catch (error) {
+        logger.error('Sentry triage failed', {
+            error: error instanceof Error ? error.message : String(error),
+        });
+        process.exitCode = 1;
+    }
+}

package/sandbox/node_modules/doistbot-logging/dist/index.d.ts

@@ -0,0 +1,23 @@
+export type LogLevel = 'info' | 'warn' | 'error';
+export type LogMeta = Record<string, unknown>;
+export type LoggerOptions = {
+    baseContext?: LogMeta;
+    getContext?: () => LogMeta | undefined;
+    getTraceInfo?: () => LogMeta | undefined;
+    suppressLogs?: (level: LogLevel) => boolean;
+    suppressInfoLogs?: () => boolean;
+    includeLogField?: boolean;
+    /** Receives serialized JSON without a trailing newline. The writer must add one. */
+    write?: (line: string) => void;
+    buildInfo?: {
+        version: number;
+        commit: string;
+    };
+};
+export type Logger = {
+    info: (message: string, meta?: LogMeta) => void;
+    warn: (message: string, meta?: LogMeta) => void;
+    error: (message: string, meta?: LogMeta) => void;
+    setBaseContext: (meta: LogMeta) => void;
+};
+export declare function createLogger(options?: LoggerOptions): Logger;

package/sandbox/node_modules/doistbot-logging/dist/index.js

@@ -0,0 +1,51 @@
+export function createLogger(options = {}) {
+    let baseContext = options.baseContext ?? {};
+    const includeLogField = options.includeLogField ?? false;
+    const buildInfo = options.buildInfo;
+    function setBaseContext(meta) {
+        baseContext = meta;
+    }
+    function log(level, message, meta) {
+        if (options.suppressLogs?.(level) === true) {
+            return;
+        }
+        if (level === 'info' && options.suppressInfoLogs?.() === true) {
+            return;
+        }
+        const context = options.getContext?.() ?? {};
+        const traceInfo = options.getTraceInfo?.() ?? {};
+        const metaInfo = {
+            ...context,
+            ...baseContext,
+            ...(meta ?? {}),
+        };
+        const payload = {
+            level,
+            message,
+            timestamp: new Date().toISOString(),
+        };
+        if (includeLogField) {
+            payload.log = message;
+        }
+        if (buildInfo) {
+            payload.version = buildInfo.version;
+            payload.commit = buildInfo.commit;
+        }
+        Object.assign(payload, traceInfo);
+        payload.meta = metaInfo;
+        const line = JSON.stringify(payload);
+        if (options.write) {
+            options.write(line);
+        }
+        else {
+            // eslint-disable-next-line no-console
+            console.log(line);
+        }
+    }
+    return {
+        info: (message, meta) => log('info', message, meta),
+        warn: (message, meta) => log('warn', message, meta),
+        error: (message, meta) => log('error', message, meta),
+        setBaseContext,
+    };
+}

package/sandbox/node_modules/doistbot-logging/package.json

@@ -0,0 +1,12 @@
+{
+    "name": "doistbot-logging",
+    "version": "1.0.0",
+    "type": "module",
+    "main": "dist/index.js",
+    "exports": {
+        ".": {
+            "types": "./src/index.ts",
+            "default": "./dist/index.js"
+        }
+    }
+}

package/sandbox/node_modules/doistbot-repo-config/dist/index.d.ts

@@ -0,0 +1,93 @@
+import type { Logger } from 'doistbot-logging';
+import type { Octokit } from 'octokit';
+export declare const CONFIG_FILE_PATH = ".github/doistbot.yml";
+export declare const DEFAULT_REVIEW_MODELS: readonly ["openai", "deepseek", "zai"];
+export type DefaultReviewModel = (typeof DEFAULT_REVIEW_MODELS)[number];
+export type AutofixPolicy = {
+    guidance?: string;
+    forbidden_test_paths?: string[];
+    verification: {
+        checks: {
+            name: string;
+            command: string;
+            use_test_selectors?: boolean;
+        }[];
+    };
+};
+export type ReviewModeConfig = {
+    guidance_path?: string;
+    labels?: {
+        ask?: string[];
+        show?: string[];
+        ship?: string[];
+    };
+};
+export type RepoConfig = {
+    review?: {
+        skip_forks?: boolean;
+        skip_drafts?: boolean;
+        skip_title_pattern?: string;
+        skip_branch_pattern?: string;
+        mode?: ReviewModeConfig;
+        /**
+         * @deprecated Ignored as of #274. Doistbot now posts a GitHub Check
+         * Run for every `/review` (always-on; no opt-in) when `HEAD_SHA` is
+         * available. Kept here for back-compat: any existing
+         * `.github/doistbot.yml` setting this field will parse fine but the
+         * value has no effect.
+         */
+        post_commit_status?: boolean;
+    };
+    issue_triage?: {
+        enable_auto_triage?: boolean;
+        prompts?: {
+            triage?: string;
+            autofix?: string;
+        };
+        /** @deprecated Ignored. Every actionable triage report starts a fix. */
+        enable_auto_fix?: boolean;
+        /** @deprecated Ignored. Every issue fix uses the review and CI loop. */
+        use_fix_loop?: boolean;
+        max_changed_files?: number;
+        max_changed_lines?: number;
+        autofix?: AutofixPolicy;
+    };
+};
+type FetchFileParams = {
+    octokit: Octokit;
+    owner: string;
+    repo: string;
+    path: string;
+    ref?: string;
+    signal?: AbortSignal;
+    logger?: Logger;
+    strict?: boolean;
+    maxBytes?: number;
+};
+export declare class RepoFileContentError extends Error {
+    readonly reason: 'not_file' | 'too_large' | 'unavailable';
+    constructor(reason: 'not_file' | 'too_large' | 'unavailable');
+}
+/** Review-mode validation is opt-in so it cannot block unrelated config callers. */
+export declare function parseRepoConfigContent(content: string, { validateReviewMode }?: {
+    validateReviewMode?: boolean;
+}): RepoConfig;
+export declare function fetchFileContent({ octokit, owner, repo, path, ref, signal, logger, strict, maxBytes, }: FetchFileParams): Promise<string | null>;
+/**
+ * Fetches the repository-specific configuration from .github/doistbot.yml.
+ * Returns null when the file is genuinely absent (404) or the path is not a file.
+ * Throws on transport / authorization errors so callers can distinguish "no
+ * config" from "could not load config" — important when an opt-out flag would
+ * otherwise be silently ignored.
+ */
+export declare function getRepoConfig({ octokit, owner, repo, ref, signal, logger, }: Omit<FetchFileParams, 'path' | 'strict' | 'maxBytes'> & {
+    logger: Logger;
+}): Promise<RepoConfig | null>;
+export declare function getLocalRepoConfig({ workspaceDir, logger, strict, }: {
+    workspaceDir: string;
+    logger: Logger;
+    strict?: boolean;
+}): RepoConfig | null;
+export declare function getDefaultReviewModels(): DefaultReviewModel[];
+export declare function parseReviewModelsEnabled(value: string | undefined): string[];
+export {};