@volter/supercode-orchestrator 0.4.148 → 0.4.150

package/board/ci.mjs

@@ -1,14 +1,19 @@
 // Review candidates are observed before a board mutation. No network or Git
 // process runs inside the optimistic transaction. Deployment is not a completion gate.
 import { spawnSync } from 'node:child_process';
-import { readFileSync, realpathSync, writeFileSync, renameSync } from 'node:fs';
+import { readFileSync, realpathSync, writeFileSync, renameSync, statSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
 import { createHash } from 'node:crypto';
-import { resolveWorkspace } from './workspace.mjs';
+import { branchCheckouts, checkoutOf, resolveWorkspace } from './workspace.mjs';
 
 const observations = new Map();
 const key = (board, id) => `${board.root}\0${board.slug}\0${id}`;
 const run = (program, args, cwd) => {
+  if (cwd) {
+    let directory = false;
+    try { directory = statSync(cwd).isDirectory(); } catch { /* reported below */ }
+    if (!directory) throw new Error(`Repository checkout ${cwd} is unavailable; resolve the card's declared workspace before verifying its source.`);
+  }
   const result = spawnSync(program, args, { cwd, encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024 });
   if (result.status !== 0) throw new Error(`${program}: ${(result.stderr || result.error?.message || 'command failed').trim().slice(-500)}`);
   return result.stdout.trim();
@@ -41,13 +46,17 @@ export function withCompletionEvidence(board, id, state, fn) {
   }
 }
 
-/** The latest explicitly requested PR is the reviewer's candidate, never the deployment tip. */
+/** The latest explicitly requested PRs are the reviewer's candidate, never the deployment tip. */
 export function reviewCandidate(board, id) {
   const row = board.db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='review_requested' ORDER BY id DESC LIMIT 1").get(id);
   const payload = row && JSON.parse(row.payload);
   return payload?.ci?.pr ? payload.ci : null;
 }
 
+/** The PRs an evidence record covers: every PR of one arc review (the first is also its top-level PR). */
+export const candidatePullRequests = (ci) => ci?.prs ?? (ci?.pr ? [{ repository: ci.repository, branch: ci.branch, commit: ci.commit, source_sha: ci.source_sha ?? ci.commit, pr: ci.pr }] : []);
+const originOf = (path) => /(?:github\.com[:/])([^/]+\/[^/]+?)(?:\.git)?$/.exec(run('git', ['remote', 'get-url', 'origin'], path))?.[1] ?? null;
+
 function repositoryWorkspace(board, id) {
   const task = board.db.prepare('SELECT t.*,c.subtask_of,c.workspace_anchor,c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(id);
   const parent = task?.subtask_of && board.db.prepare('SELECT t.*,c.workspace_anchor,c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(task.subtask_of);
@@ -57,90 +66,172 @@ function repositoryWorkspace(board, id) {
 
 const pullRequestLists = new Map();
 
-/** Find an opened PR for this card's declared worktree branch; caller decides the transition. */
-export function openReviewPullRequest(board, id) {
-  const path = repositoryWorkspace(board, id);
-  if (!path) return null;
+function branchCheckout(board, id, repository, branch) {
+  const task = board.db.prepare('SELECT c.machine FROM tasks t LEFT JOIN supercode_cards c ON c.task_id=t.id WHERE t.id=?').get(id);
+  try { return checkoutOf(task?.machine, repository, branch)?.path ?? null; } catch { return null; }
+}
+
+/** The sibling checkouts an arc registered: each subtask (and the card itself) that declares a repository
+ *  workspace and a branch, e.g. `create "<what>" --subtask-of <arc> --workspace worktree:<repository> --branch <name>`.
+ *  Their PRs are the arc's whatever the branch is named. */
+function registeredBranches(board, id) {
+  const rows = board.db.prepare(`SELECT t.branch_name, t.workspace_kind, c.workspace_anchor FROM tasks t JOIN supercode_cards c ON c.task_id=t.id
+    WHERE (t.id=? OR c.subtask_of=?) AND t.status != 'cancelled' AND t.workspace_kind IN ('worktree','dir') AND t.branch_name IS NOT NULL`).all(id, id);
+  const out = [];
+  for (const row of rows) {
+    if (!row.workspace_anchor || /^(\/|~|[A-Za-z]:[\\/])/.test(row.workspace_anchor)) continue;
+    out.push({ repository: row.workspace_anchor.replace(/^github\.com\//i, '').replace(/\.git$/, ''), branch: row.branch_name });
+  }
+  return out;
+}
+
+/** Every opened PR of the arc: each open PR whose head is the card's branch or a `wt/<card id>` branch, in the
+ *  card's own repository and in every repository this machine keeps a checkout of, and each open PR on a sibling
+ *  checkout the arc registered (`registeredBranches`). One review covers them all; the caller decides the transition. */
+export function openReviewPullRequests(board, id) {
+  const own = repositoryWorkspace(board, id);
+  if (!own) return null;
   const task = board.db.prepare('SELECT branch_name FROM tasks WHERE id=?').get(id);
-  const branch = task?.branch_name ?? run('git', ['branch', '--show-current'], path);
-  if (!branch) return null;
-  const repository = /(?:github\.com[:/])([^/]+\/[^/]+?)(?:\.git)?$/.exec(run('git', ['remote', 'get-url', 'origin'], path))?.[1];
-  if (!repository) return null;
-  // Discovery is shared per repository for one minute; the selected PR/head is
-  // always re-read by inspectCompletionEvidence before it authorizes a move.
-  let list = pullRequestLists.get(repository);
-  if (!list || Date.now() - list.at >= 60_000) {
-    list = { at: Date.now(), items: JSON.parse(run('gh', ['pr', 'list', '--repo', repository, '--state', 'open', '--limit', '1000', '--json', 'url,headRefOid,headRefName,baseRefName,isCrossRepository'], path)) };
-    if (pullRequestLists.size >= 32) pullRequestLists.delete(pullRequestLists.keys().next().value);
-    pullRequestLists.set(repository, list);
+  const branch = task?.branch_name ?? run('git', ['branch', '--show-current'], own);
+  const ownRepository = originOf(own);
+  if (!ownRepository) return null;
+  const registered = registeredBranches(board, id);
+  const mine = (repository, head) => head === branch || [`wt/${id}`, `wt/${id.replace(/^t_/, 't-')}`].some((prefix) => head === prefix || head.startsWith(`${prefix}-`) || head.startsWith(`${prefix}/`))
+    || registered.some((r) => r.repository === repository && r.branch === head);
+  const prs = [];
+  for (const repository of new Set([ownRepository, ...registered.map((r) => r.repository), ...knownRepositories()])) {
+    // Discovery is shared per repository for one minute; each selected PR/head is re-read before it authorizes a move.
+    let list = pullRequestLists.get(repository);
+    if (!list || Date.now() - list.at >= 60_000) {
+      let items = [];
+      try { items = JSON.parse(run('gh', ['pr', 'list', '--repo', repository, '--state', 'open', '--limit', '1000', '--json', 'url,headRefOid,headRefName,baseRefName,isCrossRepository,isDraft'])); }
+      catch (error) { if (repository === ownRepository || registered.some((r) => r.repository === repository)) throw error; } // another repository unreachable here is not this arc's
+      list = { at: Date.now(), items };
+      if (pullRequestLists.size >= 64) pullRequestLists.delete(pullRequestLists.keys().next().value);
+      pullRequestLists.set(repository, list);
+    }
+    // a draft is not handed over yet: its review starts when it is marked ready
+    for (const pr of list.items) if (!pr.isCrossRepository && !pr.isDraft && mine(repository, pr.headRefName)) prs.push({ url: pr.url, head: pr.headRefOid });
   }
-  const prs = list.items.filter(pr => pr.headRefName === branch && !pr.isCrossRepository);
-  if (prs.length !== 1) return null;
-  return { pr: prs[0].url, pr_head: prs[0].headRefOid, commit: prs[0].headRefOid, branch };
+  if (!prs.length) return null;
+  return { pr: prs.map((p) => p.url), pr_head: prs.map((p) => p.head), branch };
+}
+
+/** The repositories this machine keeps a checkout of. */
+function knownRepositories() {
+  try { return [...new Set(branchCheckouts(null, '*').map((row) => row.repository))]; } catch { return []; }
+}
+
+/** Whether the arc's open PRs (`[{ url, head }]`) call for its review. Before any verdict: while some head has none.
+ *  After a verdict: only once a PR that verdict judged shows a new head. A PR that joins the arc, or one that merged or
+ *  closed, does not by itself bring the arc back: after changes are requested the next run is the implementer's. */
+export function reviewDue(board, id, prs) {
+  const unjudged = prs.some((p) => !judgedHead(board, id, p.head));
+  const last = board.db.prepare(`SELECT r.payload FROM task_events r WHERE r.task_id = ? AND r.kind = 'review_requested'
+    AND EXISTS (SELECT 1 FROM task_events v WHERE v.task_id = r.task_id AND v.kind IN ('changes_requested', 'review_pass') AND v.id > r.id)
+    ORDER BY r.id DESC LIMIT 1`).get(id);
+  if (!last) return unjudged;
+  const judged = candidatePullRequests(JSON.parse(last.payload)?.ci);
+  return unjudged && judged.some((j) => prs.some((p) => p.url === j.pr.url && p.head !== j.commit));
+}
+
+/** The verdict already recorded on `head` of the card's PR: a changes-requested or pass that answered
+ * a review request naming that head, before the next request. A head is reviewed once. */
+export function judgedHead(board, id, head) {
+  if (!head) return null;
+  return board.db.prepare(`SELECT v.id, v.kind FROM task_events r JOIN task_events v ON v.task_id = r.task_id
+    AND v.kind IN ('changes_requested', 'review_pass') AND v.id > r.id
+    AND v.id < COALESCE((SELECT MIN(n.id) FROM task_events n WHERE n.task_id = r.task_id AND n.kind = 'review_requested' AND n.id > r.id), 9223372036854775807)
+    WHERE r.task_id = ? AND r.kind = 'review_requested' AND (json_extract(r.payload, '$.ci.commit') = ?
+      OR EXISTS (SELECT 1 FROM json_each(r.payload, '$.ci.prs') p WHERE json_extract(p.value, '$.commit') = ?)) ORDER BY v.id LIMIT 1`).get(id, head, head) ?? null;
 }
 
 export function inspectCompletionEvidence(board, id, entry, payload = {}, stage = 'completion') {
   const state = { required: false, ready: true, reason: null, phase: 'source', deployed_sha: null };
   try {
-    const path = repositoryWorkspace(board, id);
     if (stage === 'completion' || stage === 'acceptance') {
       const supplied = payload.commit ?? payload.metadata?.commit;
       if (supplied) {
+        const path = repositoryWorkspace(board, id);
         if (!path) throw new Error('The named commit needs a resolved repository workspace.');
-        const repository = /(?:github\.com[:/])([^/]+\/[^/]+?)(?:\.git)?$/.exec(run('git', ['remote', 'get-url', 'origin'], path))?.[1];
-        Object.assign(state, { repository, commit: run('git', ['rev-parse', '--verify', `${supplied}^{commit}`], path) });
+        Object.assign(state, { repository: originOf(path), commit: run('git', ['rev-parse', '--verify', `${supplied}^{commit}`], path) });
       }
       const candidate = stage === 'acceptance' ? reviewCandidate(board, id) : null;
       if (candidate) {
         const row = board.db.prepare("SELECT payload FROM task_events WHERE task_id=? AND kind='review_pass' ORDER BY id DESC LIMIT 1").get(id);
-        const pass = row && JSON.parse(row.payload)?.ci;
-        if (pass?.commit !== candidate.commit || pass?.pr?.url !== candidate.pr.url) throw new Error('The current PR head needs its independent verdict before acceptance.');
-        const pr = JSON.parse(run('gh', ['pr', 'view', candidate.pr.url, '--repo', candidate.repository, '--json', 'state,headRefOid'], path));
-        if (!['OPEN', 'MERGED'].includes(pr.state) || pr.headRefOid !== candidate.commit) throw new Error('The PR head changed after its verdict; request a new review.');
+        const passed = candidatePullRequests(row && JSON.parse(row.payload)?.ci);
+        const wanted = candidatePullRequests(candidate);
+        if (wanted.length !== passed.length || wanted.some((w) => !passed.some((p) => p.pr.url === w.pr.url && p.commit === w.commit))) throw new Error('The current PR heads need their independent verdict before acceptance.');
+        for (const w of wanted) {
+          const pr = JSON.parse(run('gh', ['pr', 'view', w.pr.url, '--repo', w.repository, '--json', 'state,headRefOid']));
+          if (!['OPEN', 'MERGED'].includes(pr.state) || pr.headRefOid !== w.commit) throw new Error(`The head of ${w.pr.url} changed after its verdict; request a new review.`);
+        }
         Object.assign(state, { ...candidate, ready: true, reason: null });
       }
       return state;
     }
+    const own = repositoryWorkspace(board, id);
     const asked = stage === 'review_verdict' ? reviewCandidate(board, id) : null;
-    const pr = payload.pr ?? payload.metadata?.pr ?? asked?.pr?.url;
-    if (!path) {
-      if (pr) throw new Error('A PR candidate needs a resolved repository workspace.');
+    const urls = [].concat(payload.pr ?? payload.metadata?.pr ?? candidatePullRequests(asked).map((c) => c.pr.url)).filter(Boolean);
+    if (!own) {
+      if (urls.length) throw new Error('A PR candidate needs a resolved repository workspace.');
       return state;
     }
-    // Repository-free review-only jobs keep their own verdict contract. Ordinary
-    // implementation reviews always name an opened PR, independent of completion_ci.
-    if (stage === 'review_verdict' && !asked && !pr) return state;
+    // A verdict with no requested PR (a scratch arc) keeps its own contract. An arc's review
+    // always names every opened PR it changed, independent of completion_ci.
+    if (stage === 'review_verdict' && !asked && !urls.length) return state;
     Object.assign(state, { required: true, ready: false });
-    if (typeof pr !== 'string' || !/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/[1-9][0-9]*\/?$/.test(pr)) throw new Error('Name the opened PR URL with --pr.');
-    const repository = /(?:github\.com[:/])([^/]+\/[^/]+?)(?:\.git)?$/.exec(run('git', ['remote', 'get-url', 'origin'], path))?.[1];
-    if (!repository || new URL(pr).pathname.split('/').slice(1, 3).join('/') !== repository) throw new Error('The PR must belong to this workspace repository.');
-    const observed = JSON.parse(run('gh', ['pr', 'view', pr, '--repo', repository, '--json', 'url,number,state,headRefOid,headRefName,baseRefName,isCrossRepository'], path));
-    if (observed.state !== 'OPEN' || observed.isCrossRepository) throw new Error('Source review needs an open PR from this repository.');
-    const supplied = payload.pr_head ?? payload.reviewed_sha ?? payload.commit ?? payload.metadata?.pr_head ?? payload.metadata?.commit;
-    if (!supplied || !/^[a-f0-9]{40}$/.test(supplied)) throw new Error('Name the full PR head commit with --pr-head (reviewer: --reviewed-sha).');
-    if (observed.headRefOid !== supplied) throw new Error(`PR head changed to ${observed.headRefOid}; request review of that head before recording a verdict.`);
-    const branch = payload.branch ?? payload.metadata?.branch ?? observed.headRefName;
-    const mainBranch = entry.params.completion_ci?.main_branches?.[repository] ?? 'main';
-    if (branch !== observed.headRefName || branch === mainBranch || observed.baseRefName !== mainBranch) throw new Error('The PR must propose its named worktree branch to the repository main branch.');
+    if (!urls.length) throw new Error('Name each opened PR with --pr.');
+    const named = [].concat(stage === 'review_verdict'
+      ? payload.reviewed_sha ?? payload.pr_head ?? payload.commit ?? []
+      : payload.pr_head ?? payload.commit ?? payload.metadata?.pr_head ?? payload.metadata?.commit ?? []).filter(Boolean);
+    if (stage === 'request_review' && named.length !== urls.length) throw new Error('Name each PR head with --pr-head, one for each --pr, in the same order.');
+    if (stage === 'review_verdict' && !named.length) throw new Error('Name every reviewed PR head with --reviewed-sha.');
+    const prs = urls.map((url, index) => verifyPullRequest(board, id, entry, own, url, stage === 'request_review' ? named[index] : null, stage));
     if (stage === 'request_review') {
-      run('git', ['check-ref-format', '--branch', branch], path);
-      if (run('git', ['rev-parse', 'HEAD'], path) !== supplied) throw new Error('The named PR head must be this worktree head.');
-      run('git', ['diff', '--quiet', 'HEAD'], path);
-      if (run('git', ['ls-files', '--others', '--exclude-standard'], path)) throw new Error('Commit the untracked work before requesting review.');
-      const pushed = run('git', ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], path).split(/\s+/)[0];
-      if (pushed !== supplied) throw new Error('Push the exact PR head before requesting review.');
+      // A review is asked for only while some PR has a head no verdict has judged.
+      if (!reviewDue(board, id, prs.map((p) => ({ url: p.pr.url, head: p.commit })))) throw new Error('The PRs the last verdict judged have no new head; push a new head before requesting review.');
     } else if (asked) {
-      if (asked.commit !== supplied || asked.pr.url !== observed.url) throw new Error('The verdict must name the requested PR and head.');
+      const requested = candidatePullRequests(asked);
+      if (requested.length !== prs.length || requested.some((r) => !prs.some((p) => p.pr.url === r.pr.url && p.commit === r.commit))) throw new Error('The verdict covers the requested PRs at their requested heads; a PR whose head moved needs a new review request.');
+      if (requested.some((r) => !named.includes(r.commit))) throw new Error('Name every reviewed PR head with --reviewed-sha.');
       const latest = board.db.prepare('SELECT metadata FROM task_runs WHERE task_id=? ORDER BY id DESC LIMIT 1').get(id);
-      const bound = latest && JSON.parse(latest.metadata ?? '{}')?.supercode?.review_candidate;
-      if (bound && (bound.commit !== supplied || bound.pr?.url !== observed.url)) throw new Error('This reviewer run was launched for a different PR head.');
+      const bound = candidatePullRequests(latest && JSON.parse(latest.metadata ?? '{}')?.supercode?.review_candidate);
+      if (bound.length && (bound.length !== requested.length || bound.some((b) => !requested.some((r) => r.pr.url === b.pr.url && r.commit === b.commit)))) throw new Error('This reviewer run was launched for different PR heads.');
     }
-    Object.assign(state, { ready: true, repository, branch, commit: supplied, source_sha: supplied,
-      pr: { url: observed.url, number: observed.number, head: supplied, branch, base: observed.baseRefName }, reason: null });
+    Object.assign(state, { ...prs[0], ready: true, reason: null, ...(prs.length > 1 ? { prs } : {}) });
   } catch (error) { Object.assign(state, { required: true, ready: false, reason: error.message }); }
   return state;
 }
 
+/** One PR of an arc review, read from GitHub and, for a review request, from the card branch's checkout. */
+function verifyPullRequest(board, id, entry, own, url, supplied, stage) {
+  if (typeof url !== 'string' || !/^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/[1-9][0-9]*\/?$/.test(url)) throw new Error('Name the opened PR URL with --pr.');
+  const repository = new URL(url).pathname.split('/').slice(1, 3).join('/');
+  // An arc may change several repositories. A PR is read from GitHub; its pushed head is the reviewed one. The
+  // card's own checkout, and this machine's checkout of the PR's branch when it keeps one, must also hold that head
+  // with nothing uncommitted.
+  const observed = JSON.parse(run('gh', ['pr', 'view', url, '--repo', repository, '--json', 'url,number,state,headRefOid,headRefName,baseRefName,isCrossRepository,isDraft']));
+  const path = originOf(own) === repository && run('git', ['branch', '--show-current'], own) === observed.headRefName ? own : branchCheckout(board, id, repository, observed.headRefName);
+  if (observed.state !== 'OPEN' || observed.isCrossRepository) throw new Error(`Source review needs an open PR from its repository (${url}).`);
+  if (observed.isDraft) throw new Error(`${url} is a draft; its review starts when it is marked ready for review.`);
+  const head = supplied ?? observed.headRefOid;
+  if (!/^[a-f0-9]{40}$/.test(head)) throw new Error('Name the full PR head commit with --pr-head (reviewer: --reviewed-sha).');
+  if (observed.headRefOid !== head) throw new Error(`The head of ${url} changed to ${observed.headRefOid}; request review of that head before recording a verdict.`);
+  const branch = observed.headRefName;
+  const mainBranch = entry.params.completion_ci?.main_branches?.[repository] ?? 'main';
+  if (branch === mainBranch || observed.baseRefName !== mainBranch) throw new Error(`${url} must propose its worktree branch to the repository main branch.`);
+  if (stage === 'request_review' && path) {
+    run('git', ['check-ref-format', '--branch', branch], path);
+    if (run('git', ['rev-parse', 'HEAD'], path) !== head) throw new Error(`The head named for ${url} must be its worktree head.`);
+    const uncommitted = run('git', ['status', '--porcelain', '--untracked-files=normal'], path).split('\n').filter(Boolean);
+    if (uncommitted.length) throw new Error(`Commit the work in ${path} before requesting review: ${uncommitted.length} uncommitted path(s): ${uncommitted.slice(0, 5).map((l) => l.replace(/^\s*\S+\s+/, '')).join(', ')}${uncommitted.length > 5 ? ', …' : ''}`);
+    const pushed = run('git', ['ls-remote', '--heads', 'origin', `refs/heads/${branch}`], path).split(/\s+/)[0];
+    if (pushed !== head) throw new Error(`Push the exact head of ${url} before requesting review.`);
+  }
+  return { repository, branch, commit: head, source_sha: head, pr: { url: observed.url, number: observed.number, head, branch, base: observed.baseRefName } };
+}
+
 const digest = bytes => createHash('sha256').update(bytes).digest('hex');
 /** Read the tracked workflow revision the next serve tick will load. */
 export function workflowRevision(root) {