@vercel/factory 0.0.2 → 0.0.3

package/dist/eve/index.js

@@ -1,32 +1,133 @@
+import {
+  answerReviewComment,
+  readReviewComment
+} from "../chunk-D2XMABG4.js";
 import {
   changeEvidenceSchema,
-  changeIdSchema,
   defaultApprovalPolicy,
   dispatchTask,
   findingFingerprint,
   findingSchema,
   levelSchema,
-  repositoryIdSchema,
   requiresApproval,
+  taskQuestionSchema
+} from "../chunk-EFL4PDDE.js";
+import {
+  changeIdSchema,
+  repositoryIdSchema,
   signalIdSchema,
   taskIdSchema,
-  taskQuestionSchema,
   vocabularySchema
-} from "../chunk-LBEYCOSR.js";
+} from "../chunk-2JFES6BA.js";
 import "../chunk-CEF6VJZC.js";
 
 // src/eve/index.ts
 import { defineHook } from "eve/hooks";
-import { defineTool as defineTool6 } from "eve/tools";
-import { z as z6 } from "zod";
+import { defineTool as defineTool8 } from "eve/tools";
+import { z as z8 } from "zod";
+
+// src/eve/conflict.ts
+import { z } from "zod";
+import { defineTool } from "eve/tools";
+var gitShaSchema = z.string().regex(/^[0-9a-f]{40}$/);
+var gitBranchSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._/-]*$/).refine((value) => !value.includes(".."));
+var mergeConflictPayloadSchema = z.strictObject({
+  repository: z.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/),
+  prNumber: z.number().int().positive(),
+  prUrl: z.url(),
+  headBranch: gitBranchSchema.refine((value) => value.startsWith("factory/")),
+  headSha: gitShaSchema,
+  baseBranch: gitBranchSchema,
+  baseSha: gitShaSchema
+});
+function mergeConflictTools(stores, options) {
+  const repoPath = options.repoPath ?? "repo";
+  async function context(taskId) {
+    const task = await stores.tasks.get(taskId);
+    if (task === null) throw new Error(`task ${taskId} does not exist`);
+    if (task.kind !== "merge_conflict") throw new Error(`task ${taskId} is ${task.kind}, not merge_conflict`);
+    if (task.state !== "running") throw new Error(`task ${taskId} is ${task.state}, not running`);
+    if (task.origin.signalId === void 0) throw new Error(`task ${taskId} has no conflict signal`);
+    const signal = await stores.signals.get(task.origin.signalId);
+    if (signal === null || signal.source !== "github_merge_conflict") {
+      throw new Error(`task ${taskId} has no GitHub merge conflict signal`);
+    }
+    return { task, conflict: mergeConflictPayloadSchema.parse(signal.payload) };
+  }
+  return {
+    fetch_merge_conflict: defineTool({
+      description: "Fetch the conflicted factory pull request and its current base, check out the PR head, and start the merge. Resolve every file returned in conflictedFiles, then test and commit the merge.",
+      inputSchema: z.object({ taskId: taskIdSchema }),
+      async execute({ taskId }, ctx) {
+        const { conflict } = await context(taskId);
+        const sandbox = await ctx.getSandbox();
+        const git = `git -C ${repoPath}`;
+        const headRef = `refs/remotes/origin/conflict-pr-${conflict.prNumber}`;
+        const baseRef = `refs/remotes/origin/conflict-base-${conflict.prNumber}`;
+        const fetch2 = await options.withCredential(
+          sandbox,
+          conflict.repository,
+          `${git} fetch --depth 100 origin +refs/pull/${conflict.prNumber}/head:${headRef} +refs/heads/${conflict.baseBranch}:${baseRef}`
+        );
+        if (typeof fetch2.exitCode === "number" && fetch2.exitCode !== 0) {
+          throw new Error(`could not fetch pull request: ${(fetch2.stderr ?? "").trim()}`);
+        }
+        const fetched = await sandbox.run({
+          command: `${git} rev-parse ${headRef} && ${git} rev-parse ${baseRef}`
+        });
+        const [headSha, baseSha] = fetched.stdout.trim().split("\n");
+        if (headSha !== conflict.headSha || baseSha !== conflict.baseSha) {
+          throw new Error("pull request or base changed while conflict resolution was starting; retry from a new task");
+        }
+        await sandbox.run({ command: `${git} checkout -B conflict-pr ${headRef}` });
+        const merge = await sandbox.run({ command: `${git} merge --no-commit --no-ff ${baseRef}` });
+        const conflicts = await sandbox.run({ command: `${git} diff --name-only --diff-filter=U` });
+        const conflictedFiles = conflicts.stdout.trim().split("\n").filter(Boolean);
+        if (conflictedFiles.length === 0) {
+          throw new Error(
+            typeof merge.exitCode === "number" && merge.exitCode !== 0 ? `merge failed without file conflicts: ${(merge.stderr ?? "").trim()}` : "pull request no longer has merge conflicts"
+          );
+        }
+        return { ...conflict, conflictedFiles };
+      }
+    }),
+    publish_merge_resolution: defineTool({
+      description: "Publish a tested, committed conflict resolution to the existing pull request branch. Fails if the remote branch changed since this task started.",
+      inputSchema: z.object({
+        taskId: taskIdSchema,
+        summary: z.string().min(1).max(2e3)
+      }),
+      async execute({ taskId, summary }, ctx) {
+        const { conflict } = await context(taskId);
+        const sandbox = await ctx.getSandbox();
+        const git = `git -C ${repoPath}`;
+        const clean = await sandbox.run({ command: `${git} status --porcelain` });
+        if (clean.stdout.trim() !== "") throw new Error("commit the conflict resolution before publishing");
+        const unresolved = await sandbox.run({ command: `${git} diff --name-only --diff-filter=U` });
+        if (unresolved.stdout.trim() !== "") throw new Error("merge conflicts remain unresolved");
+        const push = await options.withCredential(
+          sandbox,
+          conflict.repository,
+          `${git} push --force-with-lease=refs/heads/${conflict.headBranch}:${conflict.headSha} origin HEAD:refs/heads/${conflict.headBranch}`
+        );
+        if (typeof push.exitCode === "number" && push.exitCode !== 0) {
+          throw new Error(`could not update pull request branch: ${(push.stderr ?? "").trim()}`);
+        }
+        await stores.tasks.transition(taskId, "verifying", { reason: summary });
+        await stores.tasks.transition(taskId, "succeeded", { reason: summary });
+        return { updated: true, prNumber: conflict.prNumber, prUrl: conflict.prUrl };
+      }
+    })
+  };
+}
 
 // src/eve/deepsec.ts
-import { defineTool as defineTool2 } from "eve/tools";
-import { z as z2 } from "zod";
+import { defineTool as defineTool3 } from "eve/tools";
+import { z as z3 } from "zod";
 
 // src/eve/finding.ts
-import { defineTool } from "eve/tools";
-import { z } from "zod";
+import { defineTool as defineTool2 } from "eve/tools";
+import { z as z2 } from "zod";
 async function recordFinding(stores, repositoryId, finding, options = {}) {
   const source = options.source ?? "security_scan";
   const policy = options.approval ?? defaultApprovalPolicy;
@@ -60,9 +161,9 @@ async function recordFinding(stores, repositoryId, finding, options = {}) {
   return { recorded: true, signalId: signal.id, taskId: task.id, approval: approval ? "required" : "not_required" };
 }
 function recordFindingTool(stores, options = {}) {
-  return defineTool({
+  return defineTool2({
     description: "Record one problem you found in the repository. Creates a fix task (which may wait for human approval) unless the same finding was already recorded. Report every finding separately; never batch.",
-    inputSchema: z.object({
+    inputSchema: z2.object({
       repositoryId: repositoryIdSchema,
       finding: findingSchema
     }),
@@ -73,21 +174,21 @@ function recordFindingTool(stores, options = {}) {
 }
 
 // src/eve/deepsec.ts
-var deepsecFindingSchema = z2.looseObject({
-  title: z2.string().min(1),
-  description: z2.string().min(1),
-  severity: z2.string().min(1),
-  metadata: z2.looseObject({
-    filePath: z2.string().min(1).optional(),
-    lineNumbers: z2.array(z2.number().int().min(1)).optional(),
-    vulnSlug: z2.string().min(1).optional(),
-    confidence: z2.string().optional(),
-    runId: z2.string().optional()
+var deepsecFindingSchema = z3.looseObject({
+  title: z3.string().min(1),
+  description: z3.string().min(1),
+  severity: z3.string().min(1),
+  metadata: z3.looseObject({
+    filePath: z3.string().min(1).optional(),
+    lineNumbers: z3.array(z3.number().int().min(1)).optional(),
+    vulnSlug: z3.string().min(1).optional(),
+    confidence: z3.string().optional(),
+    runId: z3.string().optional()
   }).optional()
 });
-var deepsecExportSchema = z2.union([
-  z2.array(deepsecFindingSchema),
-  z2.looseObject({ findings: z2.array(deepsecFindingSchema) }).transform((value) => value.findings)
+var deepsecExportSchema = z3.union([
+  z3.array(deepsecFindingSchema),
+  z3.looseObject({ findings: z3.array(deepsecFindingSchema) }).transform((value) => value.findings)
 ]);
 var priorityBySeverity = {
   CRITICAL: "P0",
@@ -140,11 +241,11 @@ function deepsecScanTool(stores, options) {
   const concurrency = options.concurrency ?? 4;
   const prefix = options.commandPrefix === void 0 ? [] : [options.commandPrefix];
   const filesPerRun = options.filesPerRun ?? 40;
-  return defineTool2({
+  return defineTool3({
     description: "Run deepsec, the AI-powered vulnerability scanner, over the repository checkout and record every finding it reports as a fix task. Takes minutes. Call once per scan; then summarize the result.",
-    inputSchema: z2.object({
+    inputSchema: z3.object({
       repositoryId: repositoryIdSchema,
-      limit: z2.number().int().min(1).max(500).optional().describe("Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).")
+      limit: z3.number().int().min(1).max(500).optional().describe("Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).")
     }),
     async execute({ repositoryId, limit }, ctx) {
       const repository = await stores.repositories.get(repositoryId);
@@ -248,14 +349,14 @@ ${investigate.stderr ?? ""}`, 6)}`
 }
 
 // src/eve/fetch.ts
-import { defineTool as defineTool3 } from "eve/tools";
-import { z as z3 } from "zod";
+import { defineTool as defineTool4 } from "eve/tools";
+import { z as z4 } from "zod";
 function fetchPullRequestTool(stores, options) {
   const repoPath = options.repoPath ?? "repo";
   const depth = options.depth ?? 50;
-  return defineTool3({
+  return defineTool4({
     description: "Fetch the pull request under review into the checkout and check it out as the local branch `pr`. Call this after get_task, before inspecting or testing the change. Returns the PR number, URL, and the commit you are now on.",
-    inputSchema: z3.object({
+    inputSchema: z4.object({
       changeId: changeIdSchema.describe("The change under review, from your starting message.")
     }),
     async execute({ changeId }, ctx) {
@@ -297,19 +398,19 @@ function fetchPullRequestTool(stores, options) {
 }
 
 // src/eve/invoke.ts
-import { defineTool as defineTool4 } from "eve/tools";
-import { z as z4 } from "zod";
+import { defineTool as defineTool5 } from "eve/tools";
+import { z as z5 } from "zod";
 function invokeAgentTool(stores, options) {
   const doFetch = options.fetch ?? fetch;
-  return defineTool4({
+  return defineTool5({
     description: `${options.description} Hands the work to a separate agent in a fresh session; you will not see its reasoning. Returns the handoff task id.`,
-    inputSchema: z4.object({
-      repositoryIds: z4.array(repositoryIdSchema).min(1),
+    inputSchema: z5.object({
+      repositoryIds: z5.array(repositoryIdSchema).min(1),
       parentTaskId: taskIdSchema.optional().describe("Your own task, when this work continues it."),
       changeId: changeIdSchema.optional().describe("The change the target agent should work on."),
-      channel: z4.string().min(1).describe("Reply connector, e.g. github."),
-      address: z4.string().min(1).describe("Reply address, e.g. acme/web#41."),
-      brief: z4.string().min(1).max(4e3).describe("What the target agent needs to know. Facts and references only, not your reasoning.")
+      channel: z5.string().min(1).describe("Reply connector, e.g. github."),
+      address: z5.string().min(1).describe("Reply address, e.g. acme/web#41."),
+      brief: z5.string().min(1).max(4e3).describe("What the target agent needs to know. Facts and references only, not your reasoning.")
     }),
     async execute(input) {
       const task = await stores.tasks.create({
@@ -352,19 +453,66 @@ function invokeAgentTool(stores, options) {
   });
 }
 
+// src/eve/review.ts
+import { defineTool as defineTool6 } from "eve/tools";
+import { z as z6 } from "zod";
+function reviewCommentTools(stores, options) {
+  const commentInputSchema = z6.object({
+    changeId: changeIdSchema.describe("The change under review, from your starting message."),
+    commentId: z6.number().int().positive().describe("The GitHub review comment id.")
+  });
+  async function context(changeId) {
+    const change = await stores.changes.get(changeId);
+    if (change === null) {
+      throw new Error(`change ${changeId} does not exist`);
+    }
+    if (change.state !== "verifying") {
+      throw new Error(`change is ${change.state}, not verifying`);
+    }
+    const repository = await stores.repositories.get(change.repositoryId);
+    if (repository === null) {
+      throw new Error(`repository ${change.repositoryId} does not exist`);
+    }
+    return {
+      repository: repository.slug,
+      token: await options.tokenForRepository(repository.slug),
+      fetch: options.fetch,
+      pullRequestNumber: change.prNumber
+    };
+  }
+  return {
+    read_review_comment: defineTool6({
+      description: "Read an inline review comment on the change under verification. By default this refuses to return comments from people without write access to the repository.",
+      inputSchema: commentInputSchema,
+      async execute({ changeId, commentId }) {
+        return readReviewComment({ ...await context(changeId), commentId });
+      }
+    }),
+    answer_review_comment: defineTool6({
+      description: "Reply to an inline review comment on the change under verification. The repository and pull request come from the ledger, and the comment author must have write access.",
+      inputSchema: commentInputSchema.extend({
+        body: z6.string().min(1).max(5e3).describe("The Markdown reply to post.")
+      }),
+      async execute({ changeId, commentId, body }) {
+        return answerReviewComment({ ...await context(changeId), commentId, body });
+      }
+    })
+  };
+}
+
 // src/eve/verification.ts
-import { defineTool as defineTool5 } from "eve/tools";
-import { z as z5 } from "zod";
+import { defineTool as defineTool7 } from "eve/tools";
+import { z as z7 } from "zod";
 function recordVerificationTool(stores) {
-  return defineTool5({
+  return defineTool7({
     description: "Record the outcome of a verification task: the evidence you gathered and whether the change passed. Pass moves the change to ready for human review; fail keeps it out of review.",
-    inputSchema: z5.object({
+    inputSchema: z7.object({
       taskId: taskIdSchema.describe("Your verification task."),
       changeId: changeIdSchema.describe("The change you verified."),
-      verdict: z5.enum(["pass", "fail"]),
+      verdict: z7.enum(["pass", "fail"]),
       evidence: changeEvidenceSchema,
       confidence: levelSchema.describe("How certain you are in the verdict."),
-      summary: z5.string().min(1).max(2e3).describe("What you checked and what you found.")
+      summary: z7.string().min(1).max(2e3).describe("What you checked and what you found.")
     }),
     async execute({ taskId, changeId, verdict, evidence, confidence, summary }) {
       const change = await stores.changes.get(changeId);
@@ -416,46 +564,46 @@ function recordVerificationTool(stores) {
 }
 
 // src/eve/index.ts
-var decidedOutcomeSchema = z6.enum([
+var decidedOutcomeSchema = z8.enum([
   "accepted",
   "duplicate",
   "unactionable",
   "low_confidence",
   "ignored"
 ]);
-var recordChangeInputSchema = z6.object({
+var recordChangeInputSchema = z8.object({
   taskId: taskIdSchema,
   repositoryId: repositoryIdSchema,
-  prNumber: z6.number().int().min(1),
-  prUrl: z6.url(),
+  prNumber: z8.number().int().min(1),
+  prUrl: z8.url(),
   risk: levelSchema.describe("Blast radius of the change if it is wrong."),
   confidence: levelSchema.describe("How certain you are the change is correct."),
-  summary: z6.string().min(1).describe("One-sentence description of the change.")
+  summary: z8.string().min(1).describe("One-sentence description of the change.")
 });
 function factoryTools(stores, options = {}) {
   const recordChangeGate = options.recordChangeGate;
   return {
-    get_task: defineTool6({
+    get_task: defineTool8({
       description: "Read one factory task by id: its kind, state, repositories, origin, and results.",
-      inputSchema: z6.object({ taskId: taskIdSchema }),
+      inputSchema: z8.object({ taskId: taskIdSchema }),
       async execute({ taskId }) {
         const task = await stores.tasks.get(taskId);
         return task ?? { found: false, taskId };
       }
     }),
-    decide_signal: defineTool6({
+    decide_signal: defineTool8({
       description: "Record the triage decision for a pending signal. A signal is decided exactly once.",
-      inputSchema: z6.object({
+      inputSchema: z8.object({
         signalId: signalIdSchema,
         outcome: decidedOutcomeSchema,
-        reason: z6.string().min(1).describe("Why this outcome was chosen."),
-        detail: z6.string().min(1).optional().describe("Severity if accepted, or the duplicate-of signal id.")
+        reason: z8.string().min(1).describe("Why this outcome was chosen."),
+        detail: z8.string().min(1).optional().describe("Severity if accepted, or the duplicate-of signal id.")
       }),
       execute({ signalId, outcome, reason, detail }) {
         return stores.signals.decide(signalId, outcome, { reason, detail });
       }
     }),
-    record_change: defineTool6({
+    record_change: defineTool8({
       description: "Record the pull request produced for a code_change task. Creates the change, links it to the task, and moves the task to verifying.",
       inputSchema: recordChangeInputSchema,
       ...recordChangeGate === void 0 ? {} : {
@@ -495,11 +643,11 @@ function factoryTools(stores, options = {}) {
         return { change, task };
       }
     }),
-    finish_task: defineTool6({
+    finish_task: defineTool8({
       description: "Mark your task finished with a summary, for task kinds that have no other outcome tool (for example a security_scan). Not for code_change or verification tasks: those end with record_change and record_verification.",
-      inputSchema: z6.object({
+      inputSchema: z8.object({
         taskId: taskIdSchema,
-        summary: z6.string().min(1).max(4e3).describe("What you did and found, for the ledger.")
+        summary: z8.string().min(1).max(4e3).describe("What you did and found, for the ledger.")
       }),
       async execute({ taskId, summary }) {
         const task = await stores.tasks.get(taskId);
@@ -517,23 +665,23 @@ function factoryTools(stores, options = {}) {
         return { finished: true, taskState: finished.state };
       }
     }),
-    report_blocked: defineTool6({
+    report_blocked: defineTool8({
       description: "Mark a running task as needing a human because the work cannot continue without help.",
-      inputSchema: z6.object({
+      inputSchema: z8.object({
         taskId: taskIdSchema,
-        reason: z6.string().min(1).describe("What is blocking, written for the human.")
+        reason: z8.string().min(1).describe("What is blocking, written for the human.")
       }),
       execute({ taskId, reason }) {
         return stores.tasks.transition(taskId, "needs_human", { reason });
       }
     }),
-    ask_question: defineTool6({
+    ask_question: defineTool8({
       description: "Raise a question a human operator must answer. Creates a question task that waits for the answer.",
-      inputSchema: z6.object({
-        repositoryIds: z6.array(repositoryIdSchema).min(1),
+      inputSchema: z8.object({
+        repositoryIds: z8.array(repositoryIdSchema).min(1),
         parentTaskId: taskIdSchema.optional().describe("Task the answer unblocks, when there is one."),
-        channel: z6.string().min(1).describe("Reply connector, e.g. github."),
-        address: z6.string().min(1).describe("Reply address, e.g. acme/web#41."),
+        channel: z8.string().min(1).describe("Reply connector, e.g. github."),
+        address: z8.string().min(1).describe("Reply address, e.g. acme/web#41."),
         question: taskQuestionSchema.omit({ answer: true, answeredBy: true })
       }),
       async execute({ repositoryIds, parentTaskId, channel, address, question }) {
@@ -547,16 +695,16 @@ function factoryTools(stores, options = {}) {
         return stores.tasks.transition(task.id, "needs_human");
       }
     }),
-    append_receipt: defineTool6({
+    append_receipt: defineTool8({
       description: "Append one immutable audit receipt for an event worth remembering. Receipts can never be edited or deleted.",
-      inputSchema: z6.object({
-        repositoryIds: z6.array(repositoryIdSchema).min(1),
+      inputSchema: z8.object({
+        repositoryIds: z8.array(repositoryIdSchema).min(1),
         taskId: taskIdSchema.optional(),
         changeId: changeIdSchema.optional(),
         kind: vocabularySchema.describe("What the receipt is about, e.g. investigation."),
         state: vocabularySchema.describe("What happened, e.g. flag_ramped."),
-        reason: z6.string().min(1).max(2e3).optional(),
-        dedupeKey: z6.string().min(1).optional().describe("Same key twice records one receipt instead of two.")
+        reason: z8.string().min(1).max(2e3).optional(),
+        dedupeKey: z8.string().min(1).optional().describe("Same key twice records one receipt instead of two.")
       }),
       execute(input) {
         return stores.receipts.append(input);
@@ -594,8 +742,11 @@ export {
   fetchPullRequestTool,
   findingFromDeepsec,
   invokeAgentTool,
+  mergeConflictPayloadSchema,
+  mergeConflictTools,
   recordFinding,
   recordFindingTool,
-  recordVerificationTool
+  recordVerificationTool,
+  reviewCommentTools
 };
 //# sourceMappingURL=index.js.map