@vercel/factory 0.0.3 → 0.0.4

package/dist/eve/index.js

@@ -1,752 +0,0 @@
-import {
-  answerReviewComment,
-  readReviewComment
-} from "../chunk-D2XMABG4.js";
-import {
-  changeEvidenceSchema,
-  defaultApprovalPolicy,
-  dispatchTask,
-  findingFingerprint,
-  findingSchema,
-  levelSchema,
-  requiresApproval,
-  taskQuestionSchema
-} from "../chunk-EFL4PDDE.js";
-import {
-  changeIdSchema,
-  repositoryIdSchema,
-  signalIdSchema,
-  taskIdSchema,
-  vocabularySchema
-} from "../chunk-2JFES6BA.js";
-import "../chunk-CEF6VJZC.js";
-
-// src/eve/index.ts
-import { defineHook } from "eve/hooks";
-import { defineTool as defineTool8 } from "eve/tools";
-import { z as z8 } from "zod";
-
-// src/eve/conflict.ts
-import { z } from "zod";
-import { defineTool } from "eve/tools";
-var gitShaSchema = z.string().regex(/^[0-9a-f]{40}$/);
-var gitBranchSchema = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._/-]*$/).refine((value) => !value.includes(".."));
-var mergeConflictPayloadSchema = z.strictObject({
-  repository: z.string().regex(/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/),
-  prNumber: z.number().int().positive(),
-  prUrl: z.url(),
-  headBranch: gitBranchSchema.refine((value) => value.startsWith("factory/")),
-  headSha: gitShaSchema,
-  baseBranch: gitBranchSchema,
-  baseSha: gitShaSchema
-});
-function mergeConflictTools(stores, options) {
-  const repoPath = options.repoPath ?? "repo";
-  async function context(taskId) {
-    const task = await stores.tasks.get(taskId);
-    if (task === null) throw new Error(`task ${taskId} does not exist`);
-    if (task.kind !== "merge_conflict") throw new Error(`task ${taskId} is ${task.kind}, not merge_conflict`);
-    if (task.state !== "running") throw new Error(`task ${taskId} is ${task.state}, not running`);
-    if (task.origin.signalId === void 0) throw new Error(`task ${taskId} has no conflict signal`);
-    const signal = await stores.signals.get(task.origin.signalId);
-    if (signal === null || signal.source !== "github_merge_conflict") {
-      throw new Error(`task ${taskId} has no GitHub merge conflict signal`);
-    }
-    return { task, conflict: mergeConflictPayloadSchema.parse(signal.payload) };
-  }
-  return {
-    fetch_merge_conflict: defineTool({
-      description: "Fetch the conflicted factory pull request and its current base, check out the PR head, and start the merge. Resolve every file returned in conflictedFiles, then test and commit the merge.",
-      inputSchema: z.object({ taskId: taskIdSchema }),
-      async execute({ taskId }, ctx) {
-        const { conflict } = await context(taskId);
-        const sandbox = await ctx.getSandbox();
-        const git = `git -C ${repoPath}`;
-        const headRef = `refs/remotes/origin/conflict-pr-${conflict.prNumber}`;
-        const baseRef = `refs/remotes/origin/conflict-base-${conflict.prNumber}`;
-        const fetch2 = await options.withCredential(
-          sandbox,
-          conflict.repository,
-          `${git} fetch --depth 100 origin +refs/pull/${conflict.prNumber}/head:${headRef} +refs/heads/${conflict.baseBranch}:${baseRef}`
-        );
-        if (typeof fetch2.exitCode === "number" && fetch2.exitCode !== 0) {
-          throw new Error(`could not fetch pull request: ${(fetch2.stderr ?? "").trim()}`);
-        }
-        const fetched = await sandbox.run({
-          command: `${git} rev-parse ${headRef} && ${git} rev-parse ${baseRef}`
-        });
-        const [headSha, baseSha] = fetched.stdout.trim().split("\n");
-        if (headSha !== conflict.headSha || baseSha !== conflict.baseSha) {
-          throw new Error("pull request or base changed while conflict resolution was starting; retry from a new task");
-        }
-        await sandbox.run({ command: `${git} checkout -B conflict-pr ${headRef}` });
-        const merge = await sandbox.run({ command: `${git} merge --no-commit --no-ff ${baseRef}` });
-        const conflicts = await sandbox.run({ command: `${git} diff --name-only --diff-filter=U` });
-        const conflictedFiles = conflicts.stdout.trim().split("\n").filter(Boolean);
-        if (conflictedFiles.length === 0) {
-          throw new Error(
-            typeof merge.exitCode === "number" && merge.exitCode !== 0 ? `merge failed without file conflicts: ${(merge.stderr ?? "").trim()}` : "pull request no longer has merge conflicts"
-          );
-        }
-        return { ...conflict, conflictedFiles };
-      }
-    }),
-    publish_merge_resolution: defineTool({
-      description: "Publish a tested, committed conflict resolution to the existing pull request branch. Fails if the remote branch changed since this task started.",
-      inputSchema: z.object({
-        taskId: taskIdSchema,
-        summary: z.string().min(1).max(2e3)
-      }),
-      async execute({ taskId, summary }, ctx) {
-        const { conflict } = await context(taskId);
-        const sandbox = await ctx.getSandbox();
-        const git = `git -C ${repoPath}`;
-        const clean = await sandbox.run({ command: `${git} status --porcelain` });
-        if (clean.stdout.trim() !== "") throw new Error("commit the conflict resolution before publishing");
-        const unresolved = await sandbox.run({ command: `${git} diff --name-only --diff-filter=U` });
-        if (unresolved.stdout.trim() !== "") throw new Error("merge conflicts remain unresolved");
-        const push = await options.withCredential(
-          sandbox,
-          conflict.repository,
-          `${git} push --force-with-lease=refs/heads/${conflict.headBranch}:${conflict.headSha} origin HEAD:refs/heads/${conflict.headBranch}`
-        );
-        if (typeof push.exitCode === "number" && push.exitCode !== 0) {
-          throw new Error(`could not update pull request branch: ${(push.stderr ?? "").trim()}`);
-        }
-        await stores.tasks.transition(taskId, "verifying", { reason: summary });
-        await stores.tasks.transition(taskId, "succeeded", { reason: summary });
-        return { updated: true, prNumber: conflict.prNumber, prUrl: conflict.prUrl };
-      }
-    })
-  };
-}
-
-// src/eve/deepsec.ts
-import { defineTool as defineTool3 } from "eve/tools";
-import { z as z3 } from "zod";
-
-// src/eve/finding.ts
-import { defineTool as defineTool2 } from "eve/tools";
-import { z as z2 } from "zod";
-async function recordFinding(stores, repositoryId, finding, options = {}) {
-  const source = options.source ?? "security_scan";
-  const policy = options.approval ?? defaultApprovalPolicy;
-  const repository = await stores.repositories.get(repositoryId);
-  if (repository === null) {
-    return { recorded: false, reason: `repository ${repositoryId} does not exist` };
-  }
-  const fingerprint = findingFingerprint(repositoryId, finding);
-  const signal = await stores.signals.create({
-    repositoryId,
-    source,
-    deliveryId: fingerprint,
-    replyTo: { channel: "finding", address: fingerprint },
-    payload: finding
-  });
-  if (signal.outcome !== "pending") {
-    return { recorded: false, duplicate: true, signalId: signal.id, reason: `already recorded as ${signal.id}` };
-  }
-  await stores.signals.decide(signal.id, "accepted", {
-    detail: finding.priority,
-    reason: `${finding.tool ?? "scanner"} reported it, ${finding.verification.level} by ${finding.verification.method}`
-  });
-  const approval = requiresApproval(policy, { source, kind: "code_change", priority: finding.priority });
-  const task = await stores.tasks.create({
-    repositoryIds: [repositoryId],
-    kind: "code_change",
-    origin: { signalId: signal.id },
-    replyTo: signal.replyTo,
-    ...approval ? { approval: "required" } : {}
-  });
-  return { recorded: true, signalId: signal.id, taskId: task.id, approval: approval ? "required" : "not_required" };
-}
-function recordFindingTool(stores, options = {}) {
-  return defineTool2({
-    description: "Record one problem you found in the repository. Creates a fix task (which may wait for human approval) unless the same finding was already recorded. Report every finding separately; never batch.",
-    inputSchema: z2.object({
-      repositoryId: repositoryIdSchema,
-      finding: findingSchema
-    }),
-    execute({ repositoryId, finding }) {
-      return recordFinding(stores, repositoryId, finding, options);
-    }
-  });
-}
-
-// src/eve/deepsec.ts
-var deepsecFindingSchema = z3.looseObject({
-  title: z3.string().min(1),
-  description: z3.string().min(1),
-  severity: z3.string().min(1),
-  metadata: z3.looseObject({
-    filePath: z3.string().min(1).optional(),
-    lineNumbers: z3.array(z3.number().int().min(1)).optional(),
-    vulnSlug: z3.string().min(1).optional(),
-    confidence: z3.string().optional(),
-    runId: z3.string().optional()
-  }).optional()
-});
-var deepsecExportSchema = z3.union([
-  z3.array(deepsecFindingSchema),
-  z3.looseObject({ findings: z3.array(deepsecFindingSchema) }).transform((value) => value.findings)
-]);
-var priorityBySeverity = {
-  CRITICAL: "P0",
-  HIGH: "P1",
-  MEDIUM: "P2",
-  HIGH_BUG: "P2",
-  BUG: "P3",
-  LOW: "P3"
-};
-function findingFromDeepsec(raw) {
-  const meta = raw.metadata ?? {};
-  const confidence = (meta.confidence ?? "").toLowerCase();
-  const line = meta.lineNumbers?.[0];
-  const endLine = meta.lineNumbers === void 0 ? void 0 : Math.max(...meta.lineNumbers);
-  return findingSchema.parse({
-    title: raw.title.replace(/^\[[A-Z_]+\]\s*/u, "").slice(0, 200),
-    body: raw.description.slice(0, 8e3),
-    ...meta.filePath === void 0 ? {} : { path: meta.filePath.slice(0, 500) },
-    ...line === void 0 ? {} : { line },
-    ...endLine === void 0 || endLine === line ? {} : { endLine },
-    priority: priorityBySeverity[raw.severity.toUpperCase()] ?? "P3",
-    category: "security",
-    verification: {
-      // deepsec's agent reads the code; it does not run it. Say so.
-      level: confidence === "high" ? "supported" : "unverified",
-      method: "static_analysis",
-      summary: `deepsec ${meta.vulnSlug ?? "finding"} with ${confidence || "unknown"} confidence${meta.runId === void 0 ? "" : ` (run ${meta.runId})`}.`,
-      limitations: "AI-assisted static analysis of the checkout; not reproduced at runtime."
-    },
-    tool: "deepsec",
-    ...meta.vulnSlug === void 0 ? {} : { ruleId: meta.vulnSlug }
-  });
-}
-var findingsPath = "/tmp/deepsec-findings.json";
-function candidateCount(output) {
-  const match = /(\d+)\s+file\(s\) with candidates/u.exec(output);
-  return match?.[1] === void 0 ? null : Number(match[1]);
-}
-function tail(output, lines = 4) {
-  const ansi = /\u001b\[[0-9;]*m/gu;
-  return output.replaceAll(ansi, "").split("\n").map((line) => line.trim()).filter((line) => line !== "").slice(-lines).join(" | ").slice(0, 600);
-}
-function deepsecScanTool(stores, options) {
-  const repoPath = options.repoPath ?? "repo";
-  const workspace = options.workspacePath ?? "deepsec";
-  const version = options.version ?? "2.3.8";
-  const agent = options.agent ?? "claude";
-  const model = options.model ?? "claude-sonnet-4-6";
-  const thinkingLevel = options.thinkingLevel ?? "medium";
-  const concurrency = options.concurrency ?? 4;
-  const prefix = options.commandPrefix === void 0 ? [] : [options.commandPrefix];
-  const filesPerRun = options.filesPerRun ?? 40;
-  return defineTool3({
-    description: "Run deepsec, the AI-powered vulnerability scanner, over the repository checkout and record every finding it reports as a fix task. Takes minutes. Call once per scan; then summarize the result.",
-    inputSchema: z3.object({
-      repositoryId: repositoryIdSchema,
-      limit: z3.number().int().min(1).max(500).optional().describe("Candidate files to investigate this run (default 40; deepsec resumes where it left off next time).")
-    }),
-    async execute({ repositoryId, limit }, ctx) {
-      const repository = await stores.repositories.get(repositoryId);
-      if (repository === null) {
-        return { scanned: false, reason: `repository ${repositoryId} does not exist` };
-      }
-      const sandbox = await ctx.getSandbox();
-      const projectId = repository.slug.replace(/[^a-z0-9]+/gu, "-");
-      const startedAt = Date.now();
-      const phase = async (state, reason) => {
-        await stores.receipts.append({
-          repositoryIds: [repositoryId],
-          kind: "deepsec",
-          state,
-          phase: "security_scan",
-          reason: `${reason} (${Math.round((Date.now() - startedAt) / 1e3)}s in)`
-        });
-      };
-      await phase("started", `deepsec ${version} on ${repository.slug}, ${agent}/${model}`);
-      const prepare = await sandbox.run({
-        command: [
-          ...prefix,
-          "set -e",
-          `if [ ! -f ${workspace}/deepsec.config.ts ]; then`,
-          `  npx -y deepsec@${version} init ./${workspace} ./${repoPath} --id ${projectId} --scaffold-only --headless --yes --skip-install`,
-          `  (cd ${workspace} && npm install --no-audit --no-fund --loglevel=error)`,
-          "fi",
-          // deepsec resolves deepsec.config.ts from the current directory, so
-          // every deepsec command runs inside the workspace. No --root: it is a
-          // one-off override that skips the project's file records, leaving
-          // `process` with nothing to investigate.
-          `cd ${workspace}`,
-          `./node_modules/.bin/deepsec scan --project-id ${projectId}`
-        ].join("\n")
-      });
-      if (typeof prepare.exitCode === "number" && prepare.exitCode !== 0) {
-        const detail = (prepare.stderr ?? prepare.stdout).trim().slice(-1500);
-        await phase("failed", `scan phase failed: ${detail.slice(-300)}`);
-        return { scanned: false, reason: `deepsec scan failed: ${detail}` };
-      }
-      const candidates = candidateCount(prepare.stdout);
-      await phase(
-        "scanned",
-        `${candidates === null ? "scan output" : `${candidates} files with candidates`}: ${tail(`${prepare.stdout}
-${prepare.stderr ?? ""}`)}`
-      );
-      const investigate = await options.withModelCredential(
-        sandbox,
-        [
-          ...prefix,
-          "set -e",
-          `cd ${workspace}`,
-          `./node_modules/.bin/deepsec process --project-id ${projectId} --agent ${agent} --model ${model} --thinking-level ${thinkingLevel} --concurrency ${concurrency} --limit ${limit ?? filesPerRun}`,
-          `./node_modules/.bin/deepsec export --project-id ${projectId} --format json --out ${findingsPath}`
-        ].join("\n")
-      );
-      if (typeof investigate.exitCode === "number" && investigate.exitCode !== 0) {
-        const detail = (investigate.stderr ?? investigate.stdout).trim().slice(-1500);
-        await phase("failed", `process phase failed: ${detail.slice(-300)}`);
-        return { scanned: false, reason: `deepsec process failed: ${detail}` };
-      }
-      const exported = await sandbox.run({ command: `cat ${findingsPath}` });
-      let parsed;
-      try {
-        parsed = JSON.parse(exported.stdout);
-      } catch {
-        return { scanned: false, reason: "deepsec export was not valid JSON" };
-      }
-      const raw = deepsecExportSchema.safeParse(parsed);
-      if (!raw.success) {
-        return { scanned: false, reason: `deepsec export had an unexpected shape: ${raw.error.issues[0]?.message ?? "unknown"}` };
-      }
-      const results = [];
-      for (const entry of raw.data) {
-        const finding = findingFromDeepsec(entry);
-        results.push({ finding, result: await recordFinding(stores, repositoryId, finding, options) });
-      }
-      const recorded = results.filter(({ result }) => result.recorded);
-      await phase(
-        "completed",
-        `${results.length} findings, ${recorded.length} new. process output: ${tail(`${investigate.stdout}
-${investigate.stderr ?? ""}`, 6)}`
-      );
-      return {
-        scanned: true,
-        tool: "deepsec",
-        found: results.length,
-        recorded: recorded.length,
-        duplicates: results.length - recorded.length,
-        awaitingApproval: recorded.filter(({ result }) => result.recorded && result.approval === "required").length,
-        findings: results.map(({ finding, result }) => ({
-          title: finding.title,
-          priority: finding.priority,
-          path: finding.path,
-          line: finding.line,
-          ...result.recorded ? { taskId: result.taskId, approval: result.approval } : { duplicate: true }
-        }))
-      };
-    }
-  });
-}
-
-// src/eve/fetch.ts
-import { defineTool as defineTool4 } from "eve/tools";
-import { z as z4 } from "zod";
-function fetchPullRequestTool(stores, options) {
-  const repoPath = options.repoPath ?? "repo";
-  const depth = options.depth ?? 50;
-  return defineTool4({
-    description: "Fetch the pull request under review into the checkout and check it out as the local branch `pr`. Call this after get_task, before inspecting or testing the change. Returns the PR number, URL, and the commit you are now on.",
-    inputSchema: z4.object({
-      changeId: changeIdSchema.describe("The change under review, from your starting message.")
-    }),
-    async execute({ changeId }, ctx) {
-      const change = await stores.changes.get(changeId);
-      if (change === null) {
-        return { fetched: false, reason: `change ${changeId} does not exist` };
-      }
-      if (change.state !== "verifying") {
-        return { fetched: false, reason: `change is ${change.state}, not verifying; nothing to fetch` };
-      }
-      const repository = await stores.repositories.get(change.repositoryId);
-      if (repository === null) {
-        return { fetched: false, reason: `repository ${change.repositoryId} does not exist` };
-      }
-      const sandbox = await ctx.getSandbox();
-      const tracking = `refs/remotes/origin/pr-${change.prNumber}`;
-      const git = `git -C ${repoPath}`;
-      const result = await options.withCredential(
-        sandbox,
-        repository.slug,
-        `${git} fetch --depth ${depth} origin +refs/pull/${change.prNumber}/head:${tracking} && ${git} checkout -B pr ${tracking}`
-      );
-      if (typeof result.exitCode === "number" && result.exitCode !== 0) {
-        return {
-          fetched: false,
-          reason: `git fetch of pull request ${change.prNumber} failed: ${(result.stderr ?? "").trim()}`
-        };
-      }
-      const head = await sandbox.run({ command: `${git} rev-parse HEAD` });
-      return {
-        fetched: true,
-        prNumber: change.prNumber,
-        prUrl: change.prUrl,
-        branch: "pr",
-        headSha: head.stdout.trim()
-      };
-    }
-  });
-}
-
-// src/eve/invoke.ts
-import { defineTool as defineTool5 } from "eve/tools";
-import { z as z5 } from "zod";
-function invokeAgentTool(stores, options) {
-  const doFetch = options.fetch ?? fetch;
-  return defineTool5({
-    description: `${options.description} Hands the work to a separate agent in a fresh session; you will not see its reasoning. Returns the handoff task id.`,
-    inputSchema: z5.object({
-      repositoryIds: z5.array(repositoryIdSchema).min(1),
-      parentTaskId: taskIdSchema.optional().describe("Your own task, when this work continues it."),
-      changeId: changeIdSchema.optional().describe("The change the target agent should work on."),
-      channel: z5.string().min(1).describe("Reply connector, e.g. github."),
-      address: z5.string().min(1).describe("Reply address, e.g. acme/web#41."),
-      brief: z5.string().min(1).max(4e3).describe("What the target agent needs to know. Facts and references only, not your reasoning.")
-    }),
-    async execute(input) {
-      const task = await stores.tasks.create({
-        repositoryIds: input.repositoryIds,
-        kind: options.kind,
-        origin: input.parentTaskId === void 0 ? { operator: "factory" } : { parentTaskId: input.parentTaskId },
-        replyTo: { channel: input.channel, address: input.address }
-      });
-      const running = await dispatchTask(stores, task.id, {
-        launch: async (dispatched) => {
-          const headers = {
-            "content-type": "application/json",
-            ...await options.headers?.()
-          };
-          const token = await options.token?.();
-          if (token !== void 0) {
-            headers.authorization = `Bearer ${token}`;
-          }
-          const message = [
-            `You are assigned factory task ${dispatched.id}.`,
-            input.changeId === void 0 ? null : `Change under review: ${input.changeId}.`,
-            `Reply address: ${input.channel} ${input.address}.`,
-            "",
-            input.brief,
-            "",
-            "Read the task with get_task first, do the work, and record the outcome with your factory tools."
-          ].filter((line) => line !== null).join("\n");
-          const response = await doFetch(`${options.targetUrl()}/eve/v1/session`, {
-            method: "POST",
-            headers,
-            body: JSON.stringify({ message, operationId: `factory-task:${dispatched.id}` })
-          });
-          if (!response.ok) {
-            throw new Error(`target agent refused the session: ${response.status}`);
-          }
-        }
-      });
-      return { taskId: running.id, kind: running.kind, state: running.state };
-    }
-  });
-}
-
-// src/eve/review.ts
-import { defineTool as defineTool6 } from "eve/tools";
-import { z as z6 } from "zod";
-function reviewCommentTools(stores, options) {
-  const commentInputSchema = z6.object({
-    changeId: changeIdSchema.describe("The change under review, from your starting message."),
-    commentId: z6.number().int().positive().describe("The GitHub review comment id.")
-  });
-  async function context(changeId) {
-    const change = await stores.changes.get(changeId);
-    if (change === null) {
-      throw new Error(`change ${changeId} does not exist`);
-    }
-    if (change.state !== "verifying") {
-      throw new Error(`change is ${change.state}, not verifying`);
-    }
-    const repository = await stores.repositories.get(change.repositoryId);
-    if (repository === null) {
-      throw new Error(`repository ${change.repositoryId} does not exist`);
-    }
-    return {
-      repository: repository.slug,
-      token: await options.tokenForRepository(repository.slug),
-      fetch: options.fetch,
-      pullRequestNumber: change.prNumber
-    };
-  }
-  return {
-    read_review_comment: defineTool6({
-      description: "Read an inline review comment on the change under verification. By default this refuses to return comments from people without write access to the repository.",
-      inputSchema: commentInputSchema,
-      async execute({ changeId, commentId }) {
-        return readReviewComment({ ...await context(changeId), commentId });
-      }
-    }),
-    answer_review_comment: defineTool6({
-      description: "Reply to an inline review comment on the change under verification. The repository and pull request come from the ledger, and the comment author must have write access.",
-      inputSchema: commentInputSchema.extend({
-        body: z6.string().min(1).max(5e3).describe("The Markdown reply to post.")
-      }),
-      async execute({ changeId, commentId, body }) {
-        return answerReviewComment({ ...await context(changeId), commentId, body });
-      }
-    })
-  };
-}
-
-// src/eve/verification.ts
-import { defineTool as defineTool7 } from "eve/tools";
-import { z as z7 } from "zod";
-function recordVerificationTool(stores) {
-  return defineTool7({
-    description: "Record the outcome of a verification task: the evidence you gathered and whether the change passed. Pass moves the change to ready for human review; fail keeps it out of review.",
-    inputSchema: z7.object({
-      taskId: taskIdSchema.describe("Your verification task."),
-      changeId: changeIdSchema.describe("The change you verified."),
-      verdict: z7.enum(["pass", "fail"]),
-      evidence: changeEvidenceSchema,
-      confidence: levelSchema.describe("How certain you are in the verdict."),
-      summary: z7.string().min(1).max(2e3).describe("What you checked and what you found.")
-    }),
-    async execute({ taskId, changeId, verdict, evidence, confidence, summary }) {
-      const change = await stores.changes.get(changeId);
-      if (change === null) {
-        return { recorded: false, reason: `change ${changeId} does not exist` };
-      }
-      if (change.state !== "verifying") {
-        return {
-          recorded: false,
-          reason: `change is ${change.state}, not verifying; nothing to record`
-        };
-      }
-      const task = await stores.tasks.get(taskId);
-      if (task === null || task.kind !== "verification") {
-        return { recorded: false, reason: `${taskId} is not a verification task` };
-      }
-      let updatedChange = change;
-      if (verdict === "pass") {
-        updatedChange = await stores.changes.transition(changeId, "ready", {
-          patch: { evidence, confidence },
-          reason: summary
-        });
-      }
-      let finished;
-      if (verdict === "pass") {
-        await stores.tasks.transition(taskId, "verifying", { reason: summary });
-        finished = await stores.tasks.transition(taskId, "succeeded");
-      } else {
-        finished = await stores.tasks.transition(taskId, "failed", { reason: summary });
-      }
-      if (change.taskId !== void 0) {
-        const parent = await stores.tasks.get(change.taskId);
-        if (parent?.state === "verifying") {
-          await stores.tasks.transition(
-            change.taskId,
-            verdict === "pass" ? "succeeded" : "failed",
-            verdict === "pass" ? {} : { reason: `verification failed: ${summary}` }
-          ).catch(() => void 0);
-        }
-      }
-      return {
-        recorded: true,
-        verdict,
-        changeState: updatedChange.state,
-        taskState: finished.state
-      };
-    }
-  });
-}
-
-// src/eve/index.ts
-var decidedOutcomeSchema = z8.enum([
-  "accepted",
-  "duplicate",
-  "unactionable",
-  "low_confidence",
-  "ignored"
-]);
-var recordChangeInputSchema = z8.object({
-  taskId: taskIdSchema,
-  repositoryId: repositoryIdSchema,
-  prNumber: z8.number().int().min(1),
-  prUrl: z8.url(),
-  risk: levelSchema.describe("Blast radius of the change if it is wrong."),
-  confidence: levelSchema.describe("How certain you are the change is correct."),
-  summary: z8.string().min(1).describe("One-sentence description of the change.")
-});
-function factoryTools(stores, options = {}) {
-  const recordChangeGate = options.recordChangeGate;
-  return {
-    get_task: defineTool8({
-      description: "Read one factory task by id: its kind, state, repositories, origin, and results.",
-      inputSchema: z8.object({ taskId: taskIdSchema }),
-      async execute({ taskId }) {
-        const task = await stores.tasks.get(taskId);
-        return task ?? { found: false, taskId };
-      }
-    }),
-    decide_signal: defineTool8({
-      description: "Record the triage decision for a pending signal. A signal is decided exactly once.",
-      inputSchema: z8.object({
-        signalId: signalIdSchema,
-        outcome: decidedOutcomeSchema,
-        reason: z8.string().min(1).describe("Why this outcome was chosen."),
-        detail: z8.string().min(1).optional().describe("Severity if accepted, or the duplicate-of signal id.")
-      }),
-      execute({ signalId, outcome, reason, detail }) {
-        return stores.signals.decide(signalId, outcome, { reason, detail });
-      }
-    }),
-    record_change: defineTool8({
-      description: "Record the pull request produced for a code_change task. Creates the change, links it to the task, and moves the task to verifying.",
-      inputSchema: recordChangeInputSchema,
-      ...recordChangeGate === void 0 ? {} : {
-        approval: async ({ toolInput }) => {
-          const parsed = recordChangeInputSchema.safeParse(toolInput);
-          if (!parsed.success) {
-            return {
-              type: "denied",
-              reason: "record_change input is malformed; fix the arguments and retry"
-            };
-          }
-          const verdict = await recordChangeGate(parsed.data);
-          return verdict.ok ? "not-applicable" : { type: "denied", reason: verdict.reason };
-        }
-      },
-      async execute({ taskId, repositoryId, prNumber, prUrl, risk, confidence, summary }) {
-        const change = await stores.changes.create({
-          repositoryId,
-          taskId,
-          prNumber,
-          prUrl,
-          author: "factory",
-          risk,
-          confidence,
-          evidence: {
-            reproVerified: false,
-            testsAdded: 0,
-            checksGreen: false,
-            attackPassed: false,
-            scopeMatches: false
-          }
-        });
-        const task = await stores.tasks.transition(taskId, "verifying", {
-          patch: { changeId: change.id },
-          reason: summary
-        });
-        return { change, task };
-      }
-    }),
-    finish_task: defineTool8({
-      description: "Mark your task finished with a summary, for task kinds that have no other outcome tool (for example a security_scan). Not for code_change or verification tasks: those end with record_change and record_verification.",
-      inputSchema: z8.object({
-        taskId: taskIdSchema,
-        summary: z8.string().min(1).max(4e3).describe("What you did and found, for the ledger.")
-      }),
-      async execute({ taskId, summary }) {
-        const task = await stores.tasks.get(taskId);
-        if (task === null) {
-          return { finished: false, reason: `${taskId} does not exist` };
-        }
-        if (task.kind === "code_change" || task.kind === "verification") {
-          return { finished: false, reason: `${task.kind} tasks end with their own outcome tool` };
-        }
-        if (task.state !== "running") {
-          return { finished: false, reason: `task is ${task.state}, not running` };
-        }
-        await stores.tasks.transition(taskId, "verifying", { reason: summary });
-        const finished = await stores.tasks.transition(taskId, "succeeded", { reason: summary });
-        return { finished: true, taskState: finished.state };
-      }
-    }),
-    report_blocked: defineTool8({
-      description: "Mark a running task as needing a human because the work cannot continue without help.",
-      inputSchema: z8.object({
-        taskId: taskIdSchema,
-        reason: z8.string().min(1).describe("What is blocking, written for the human.")
-      }),
-      execute({ taskId, reason }) {
-        return stores.tasks.transition(taskId, "needs_human", { reason });
-      }
-    }),
-    ask_question: defineTool8({
-      description: "Raise a question a human operator must answer. Creates a question task that waits for the answer.",
-      inputSchema: z8.object({
-        repositoryIds: z8.array(repositoryIdSchema).min(1),
-        parentTaskId: taskIdSchema.optional().describe("Task the answer unblocks, when there is one."),
-        channel: z8.string().min(1).describe("Reply connector, e.g. github."),
-        address: z8.string().min(1).describe("Reply address, e.g. acme/web#41."),
-        question: taskQuestionSchema.omit({ answer: true, answeredBy: true })
-      }),
-      async execute({ repositoryIds, parentTaskId, channel, address, question }) {
-        const task = await stores.tasks.create({
-          repositoryIds,
-          kind: "question",
-          origin: parentTaskId === void 0 ? { operator: "factory" } : { parentTaskId },
-          replyTo: { channel, address },
-          question
-        });
-        return stores.tasks.transition(task.id, "needs_human");
-      }
-    }),
-    append_receipt: defineTool8({
-      description: "Append one immutable audit receipt for an event worth remembering. Receipts can never be edited or deleted.",
-      inputSchema: z8.object({
-        repositoryIds: z8.array(repositoryIdSchema).min(1),
-        taskId: taskIdSchema.optional(),
-        changeId: changeIdSchema.optional(),
-        kind: vocabularySchema.describe("What the receipt is about, e.g. investigation."),
-        state: vocabularySchema.describe("What happened, e.g. flag_ramped."),
-        reason: z8.string().min(1).max(2e3).optional(),
-        dedupeKey: z8.string().min(1).optional().describe("Same key twice records one receipt instead of two.")
-      }),
-      execute(input) {
-        return stores.receipts.append(input);
-      }
-    })
-  };
-}
-function factoryHooks(stores) {
-  return {
-    factory: defineHook({
-      events: {
-        async "turn.completed"(_event, ctx) {
-          const address = ctx.channel.continuationToken;
-          if (address === void 0) {
-            return;
-          }
-          const tasks = await stores.tasks.list();
-          const abandoned = tasks.filter(
-            (task) => task.state === "running" && task.replyTo.address === address
-          );
-          for (const task of abandoned) {
-            await stores.tasks.transition(task.id, "needs_human", {
-              reason: "agent turn ended without recording an outcome"
-            }).catch(() => void 0);
-          }
-        }
-      }
-    })
-  };
-}
-export {
-  deepsecScanTool,
-  factoryHooks,
-  factoryTools,
-  fetchPullRequestTool,
-  findingFromDeepsec,
-  invokeAgentTool,
-  mergeConflictPayloadSchema,
-  mergeConflictTools,
-  recordFinding,
-  recordFindingTool,
-  recordVerificationTool,
-  reviewCommentTools
-};
-//# sourceMappingURL=index.js.map