@wascartech/devbot 0.0.0-stage → 2.1.1

package/dist/attachments.js

@@ -0,0 +1,76 @@
+// Forge-free attachment helpers shared by every driver.
+//
+// Discovery (which note body snippets are attachments) and fetching (which
+// forge endpoint serves them) are forge-specific and live in each driver:
+//   src/platform/gitlab/attachments.ts
+//   src/platform/gitealike/attachments.ts
+//   src/platform/github/attachments.ts
+// This module owns only the forge-neutral primitives: the markdown-scanning
+// regexes used to find references, code-span stripping, URL decoding, and the
+// filename→MIME table used when staging an outbound attachment.
+//
+// DevBot no longer extracts or OCRs attachment content host-side. Attachments
+// are downloaded whole into the run volume by the agent (the
+// `download_work_item_attachment` MCP tool) and handled autonomously; image/PDF
+// OCR is available to the agent inside the builder image.
+// ---- Shared markdown-scanning primitives -----------------------------------
+// Drivers strip code spans before matching so a ref inside a code sample is
+// not treated as an actual attachment.
+export const FENCED_CODE = /```[\s\S]*?```/g;
+export const INLINE_CODE = /`[^`\n]*`/g;
+export const MD_LINK = /!?\[([^\]]*)\]\(([^)]+)\)/g;
+export function stripCodeSpans(body) {
+    return body.replace(FENCED_CODE, "").replace(INLINE_CODE, "");
+}
+export function safeDecode(s) {
+    try {
+        return decodeURIComponent(s);
+    }
+    catch {
+        return s;
+    }
+}
+// ---- Filename → MIME -------------------------------------------------------
+// Inline MIME table (no npm dep). Maps filename extension → MIME used when
+// staging an outbound attachment so the forge stores a useful Content-Type.
+const EXT_TO_MIME = {
+    txt: "text/plain", log: "text/plain", md: "text/markdown",
+    csv: "text/csv", tsv: "text/tab-separated-values",
+    json: "application/json", xml: "application/xml", yaml: "text/yaml",
+    yml: "text/yaml", toml: "application/toml", ini: "text/plain",
+    diff: "text/x-diff", patch: "text/x-diff",
+    sh: "text/x-shellscript", bash: "text/x-shellscript",
+    sql: "application/sql", html: "text/html", htm: "text/html",
+    css: "text/css", js: "text/javascript", ts: "text/typescript",
+    py: "text/x-python", rb: "text/x-ruby", go: "text/x-go",
+    rs: "text/x-rust", java: "text/x-java", c: "text/x-c", h: "text/x-c",
+    cpp: "text/x-c++", hpp: "text/x-c++", cs: "text/x-csharp",
+    php: "text/x-php", pl: "text/x-perl", lua: "text/x-lua",
+    env: "text/plain", conf: "text/plain", cfg: "text/plain",
+    gitignore: "text/plain", dockerfile: "text/plain",
+    // images
+    png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg",
+    gif: "image/gif", webp: "image/webp", bmp: "image/bmp",
+    tif: "image/tiff", tiff: "image/tiff",
+    // pdf
+    pdf: "application/pdf",
+};
+/** Extension-based MIME lookup for a filename (no forge, no IO). Used when
+ *  staging an outbound attachment so the forge stores a useful Content-Type. */
+export function mimeForFilename(filename) {
+    const ext = filename.split(".").pop()?.toLowerCase() ?? "";
+    return EXT_TO_MIME[ext] ?? "application/octet-stream";
+}
+/** Turn a forge-supplied filename into a safe staging basename. Strips any
+ *  directory components and keeps only `[A-Za-z0-9._-]`, so a forged name like
+ *  `../../etc/passwd` or `a/b` can never escape the staging dir. Falls back to
+ *  `fallback` when nothing usable remains. */
+export function safeDownloadFilename(filename, fallback = "attachment") {
+    const base = filename.split(/[/\\]/).pop() ?? "";
+    const cleaned = base.replace(/[^A-Za-z0-9._-]/g, "_").replace(/^\.+/, "");
+    const trimmed = cleaned.slice(0, 128);
+    if (!trimmed || trimmed === "." || trimmed === "..")
+        return fallback;
+    return trimmed;
+}
+//# sourceMappingURL=attachments.js.map

package/dist/attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,uCAAuC;AACvC,0CAA0C;AAC1C,uCAAuC;AACvC,4EAA4E;AAC5E,8EAA8E;AAC9E,gEAAgE;AAChE,EAAE;AACF,8EAA8E;AAC9E,6DAA6D;AAC7D,gFAAgF;AAChF,0DAA0D;AAI1D,+EAA+E;AAC/E,4EAA4E;AAC5E,uCAAuC;AACvC,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAC7C,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC;AACxC,MAAM,CAAC,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAEpD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,CAAS;IAClC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,WAAW,GAA2B;IAC1C,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,eAAe;IACzD,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,2BAA2B;IACjD,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW;IACnE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,YAAY;IAC7D,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa;IACzC,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,oBAAoB;IACpD,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW;IAC3D,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,iBAAiB;IAC7D,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW;IACvD,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU;IACpE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,eAAe;IACzD,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,YAAY;IACvD,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,YAAY;IACxD,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY;IACjD,SAAS;IACT,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY;IACvD,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW;IACtD,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY;IACrC,MAAM;IACN,GAAG,EAAE,iBAAiB;CACvB,CAAC;AAEF;gFACgF;AAChF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AACxD,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,UAAU,oBAAoB,CAAC,QAAgB,EAAE,QAAQ,GAAG,YAAY;IAC5E,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACrE,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/auto-commands.js

@@ -0,0 +1,88 @@
+import { config } from "./config.js";
+import { log } from "./logger.js";
+import { getPlatform } from "./platform/index.js";
+import { isOnboardingAllowed } from "./onboarding-allowlist.js";
+import { resolveAutoFeature } from "./settings-store.js";
+import { AUTO_FEATURES, autoFeatureMeta } from "./auto-features.js";
+import { clearAutoOverride, getAutoOverride, setAutoOverride, } from "./work-item-auto-store.js";
+// Contextual auto-* command handler (work item #58). Applies /auto-push,
+// /auto-mr, /auto-resolve-conflicts, /auto-ci-report (and /auto, /ask) to this
+// work item's override rows and posts one aggregated reply note.
+//
+// Authorization is enforced by the general trigger gate in webhook.ts before
+// this is called. The one extra rule: enabling a feature the project resolves
+// OFF requires the actor to be a DevBot admin (allowlisted in ONBOARDING_USERS,
+// fail-closed). Disabling is always allowed for an authorized subject — it is
+// the safe direction.
+function projectResolved(projectId, feature) {
+    return resolveAutoFeature(projectId, feature);
+}
+function isAdmin(username) {
+    return isOnboardingAllowed(username, config.ONBOARDING_USERS);
+}
+// Apply one command to one feature and return the reply line.
+function applyOne(projectId, workItemId, feature, action, admin) {
+    const label = autoFeatureMeta(feature).label;
+    const projectOn = projectResolved(projectId, feature);
+    const override = getAutoOverride(workItemId, feature);
+    if (action === "query") {
+        if (override === "off")
+            return `⚙️ \`${label}\` — disabled for this work item.`;
+        if (override === "on")
+            return `⚙️ \`${label}\` — enabled for this work item (project default is off).`;
+        return projectOn ? `⚙️ \`${label}\` — enabled.` : `⚙️ \`${label}\` — not enabled on this project.`;
+    }
+    if (action === "off") {
+        setAutoOverride(workItemId, feature, "off");
+        return `✅ \`${label}\` disabled for this work item.`;
+    }
+    // action === "on"
+    if (projectOn) {
+        const cleared = clearAutoOverride(workItemId, feature);
+        return cleared
+            ? `✅ \`${label}\` re-enabled for this work item.`
+            : `ℹ️ \`${label}\` is already enabled for this work item.`;
+    }
+    if (admin) {
+        setAutoOverride(workItemId, feature, "on");
+        return `✅ \`${label}\` enabled for this work item.`;
+    }
+    return `🚫 \`${label}\` is not enabled on this project — only a DevBot admin can enable it for this work item.`;
+}
+// Expand the ordered command list into (feature, action) pairs. "all" fans out
+// to every feature; later commands for the same feature still win because they
+// are applied in order and the reply line is keyed per feature (last wins).
+function expand(commands) {
+    const out = [];
+    for (const c of commands) {
+        if (c.feature === "all") {
+            for (const f of AUTO_FEATURES)
+                out.push({ feature: f, action: c.action });
+        }
+        else {
+            out.push({ feature: c.feature, action: c.action });
+        }
+    }
+    return out;
+}
+export async function handleAutoCommands(params) {
+    const { commands } = params;
+    if (commands.length === 0)
+        return;
+    const admin = isAdmin(params.actorUsername);
+    // Apply in order; the last command touching a feature determines its line.
+    const lines = new Map();
+    for (const { feature, action } of expand(commands)) {
+        lines.set(feature, applyOne(params.projectId, params.workItemId, feature, action, admin));
+    }
+    const body = [...lines.values()].join("\n");
+    if (!body)
+        return;
+    try {
+        await getPlatform().workItems.postErrorReply(params.projectId, params.workItemNumber, params.triggeringNoteId, body);
+    }
+    catch (e) {
+        log.warn("auto-command reply failed", { workItemId: params.workItemId, err: e });
+    }
+}
+//# sourceMappingURL=auto-commands.js.map

package/dist/auto-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-commands.js","sourceRoot":"","sources":["../src/auto-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAoB,MAAM,oBAAoB,CAAC;AACtF,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,eAAe,GAChB,MAAM,2BAA2B,CAAC;AAGnC,yEAAyE;AACzE,+EAA+E;AAC/E,iEAAiE;AACjE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,sBAAsB;AAEtB,SAAS,eAAe,CAAC,SAAiB,EAAE,OAAoB;IAC9D,OAAO,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,QAA4B;IAC3C,OAAO,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAChE,CAAC;AAED,8DAA8D;AAC9D,SAAS,QAAQ,CACf,SAAiB,EACjB,UAAkB,EAClB,OAAoB,EACpB,MAA8B,EAC9B,KAAc;IAEd,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAEtD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,QAAQ,KAAK,mCAAmC,CAAC;QAChF,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,QAAQ,KAAK,2DAA2D,CAAC;QACvG,OAAO,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,KAAK,mCAAmC,CAAC;IACrG,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,OAAO,KAAK,iCAAiC,CAAC;IACvD,CAAC;IAED,kBAAkB;IAClB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,OAAO;YACZ,CAAC,CAAC,OAAO,KAAK,mCAAmC;YACjD,CAAC,CAAC,QAAQ,KAAK,2CAA2C,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,OAAO,KAAK,gCAAgC,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,KAAK,2FAA2F,CAAC;AAClH,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,SAAS,MAAM,CAAC,QAAuB;IACrC,MAAM,GAAG,GAAoE,EAAE,CAAC;IAChF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,aAAa;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAOxC;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAE5C,2EAA2E;IAC3E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,MAAM,WAAW,EAAE,CAAC,SAAS,CAAC,cAAc,CAC1C,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,gBAAgB,EACvB,IAAI,CACL,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC"}

package/dist/auto-features.js

@@ -0,0 +1,32 @@
+// Metadata for the four auto-* features (work item #58). Pure: no DB, no
+// config import, so both the parser (mention.ts) and the store
+// (work-item-auto-store.ts) can share one source of truth for the neutral
+// feature key, the settings DB key, the command token, and the display label.
+export const AUTO_FEATURES = ["autoPush", "autoMr", "autoResolveConflicts", "ciFailAutoReport"];
+const META = {
+    autoPush: { key: "autoPush", dbKey: "auto_push", token: "/auto-push", label: "auto-push" },
+    autoMr: { key: "autoMr", dbKey: "auto_mr", token: "/auto-mr", label: "auto-mr" },
+    autoResolveConflicts: {
+        key: "autoResolveConflicts",
+        dbKey: "auto_resolve_conflicts",
+        token: "/auto-resolve-conflicts",
+        label: "auto-resolve-conflicts",
+    },
+    ciFailAutoReport: {
+        key: "ciFailAutoReport",
+        dbKey: "ci_fail_auto_report",
+        token: "/auto-ci-report",
+        label: "auto-ci-report",
+    },
+};
+export function autoFeatureMeta(key) {
+    return META[key];
+}
+export function isAutoFeature(value) {
+    return AUTO_FEATURES.includes(value);
+}
+export function autoFeatureByToken(token) {
+    const t = token.toLowerCase();
+    return AUTO_FEATURES.find((k) => META[k].token === t);
+}
+//# sourceMappingURL=auto-features.js.map

package/dist/auto-features.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-features.js","sourceRoot":"","sources":["../src/auto-features.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,+DAA+D;AAC/D,0EAA0E;AAC1E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,sBAAsB,EAAE,kBAAkB,CAAU,CAAC;AAczG,MAAM,IAAI,GAAyC;IACjD,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE;IAC1F,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE;IAChF,oBAAoB,EAAE;QACpB,GAAG,EAAE,sBAAsB;QAC3B,KAAK,EAAE,wBAAwB;QAC/B,KAAK,EAAE,yBAAyB;QAChC,KAAK,EAAE,wBAAwB;KAChC;IACD,gBAAgB,EAAE;QAChB,GAAG,EAAE,kBAAkB;QACvB,KAAK,EAAE,qBAAqB;QAC5B,KAAK,EAAE,iBAAiB;QACxB,KAAK,EAAE,gBAAgB;KACxB;CACF,CAAC;AAEF,MAAM,UAAU,eAAe,CAAC,GAAgB;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAQ,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/base-branch-store.js

@@ -0,0 +1,40 @@
+import { db } from "./db.js";
+// Per-work-item base/target branch chosen via the /base <branch> mention token.
+// Belt-and-braces: the table is also created by migrations/0003_work_item_base_branch.sql
+//   once the migration framework (wi-3, MR !3) lands. This init runs in
+//   lifecycle.ts bootstrap() alongside the other init*Table() calls so the table
+//   exists even before migrate() is wired up. Idempotent (IF NOT EXISTS).
+export function initBaseBranchTable() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS work_item_base_branch (
+      work_item_id INTEGER PRIMARY KEY,
+      base_branch  TEXT    NOT NULL,
+      created_at   INTEGER NOT NULL
+    )
+  `);
+}
+// First-write-wins: only sets the base branch if no row exists yet for this work
+//   item. Subsequent /base mentions (after the first run) do NOT overwrite —
+//   runner.ts gates the /base-ignored note on volume existence, and the store
+//   enforces the same first-wins invariant here so a post-reset re-mention can
+//   set a fresh value while a same-session re-mention cannot. INSERT OR IGNORE
+//   is the atomic first-write-wins primitive; the row is the single source of
+//   truth for mrTarget across all subsequent runs.
+export function setBaseBranchIfUnset(workItemId, branch) {
+    db.prepare(`
+    INSERT OR IGNORE INTO work_item_base_branch (work_item_id, base_branch, created_at)
+    VALUES (?, ?, ?)
+  `).run(workItemId, branch, Math.floor(Date.now() / 1000));
+}
+export function getBaseBranch(workItemId) {
+    const row = db
+        .prepare("SELECT base_branch FROM work_item_base_branch WHERE work_item_id = ?")
+        .get(workItemId);
+    return row ? row.base_branch : null;
+}
+// Cleared by /reset (agents.ts handleResetNote) and work-item close (webhook.ts
+//   close path) so a post-reset re-mention with /base sets a fresh value.
+export function deleteBaseBranch(workItemId) {
+    db.prepare("DELETE FROM work_item_base_branch WHERE work_item_id = ?").run(workItemId);
+}
+//# sourceMappingURL=base-branch-store.js.map

package/dist/base-branch-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-branch-store.js","sourceRoot":"","sources":["../src/base-branch-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAE7B,gFAAgF;AAChF,0FAA0F;AAC1F,wEAAwE;AACxE,iFAAiF;AACjF,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB;IACjC,EAAE,CAAC,IAAI,CAAC;;;;;;GAMP,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,6EAA6E;AAC7E,8EAA8E;AAC9E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,mDAAmD;AACnD,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,MAAc;IACrE,EAAE,CAAC,OAAO,CAAC;;;GAGV,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,sEAAsE,CAAC;SAC/E,GAAG,CAAC,UAAU,CAAwC,CAAC;IAC1D,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,EAAE,CAAC,OAAO,CAAC,0DAA0D,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACzF,CAAC"}

package/dist/base-branches.js

@@ -0,0 +1,9 @@
+// Parse a comma-separated branch list into walk order: dedupe + trim + filter
+// empties, preserving the stored order so callers try the top/first entry first
+// (highest priority). Single-sourced so git.ts (clone slot 2) and runner.ts
+// (mrTarget) share one definition of the walk, and so per-project overrides
+// parse identically to the global default.
+export function parseBaseBranches(raw) {
+    return [...new Set(raw.split(",").map((s) => s.trim()).filter(Boolean))];
+}
+//# sourceMappingURL=base-branches.js.map

package/dist/base-branches.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-branches.js","sourceRoot":"","sources":["../src/base-branches.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,2CAA2C;AAC3C,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/build-workflow.js

@@ -0,0 +1,116 @@
+// Build-mode prompt scaffolding, split into two user-editable templates:
+//
+//   - workflowTemplate  — branch checkout/rebase + commit prose, ending with a
+//     `{{mrBlock}}` reference (auto-appended when omitted).
+//   - mrDescriptionTemplate — the MR/PR description body, rendered INSIDE the
+//     fixed ```mr scaffold.
+//
+// The ```mr fence, the `title:`/`description:` keys, and the "must be last"
+// rule are DevBot-owned and never editable: they are the machine-parsed
+// contract (src/mr-content.ts). Users edit prose + description structure only.
+//
+// Placeholder policy: validate-on-save rejects unknown `{{...}}` tokens (the
+// zod schemas call findUnknownPlaceholders), no literal escape. The empty
+// string means "use the built-in default", so an upgrade reproduces today's
+// prompt byte-for-byte until an admin edits a field.
+export const WORKFLOW_PLACEHOLDERS = ["iid", "branch", "mrTarget", "mrBlock"];
+export const MR_DESCRIPTION_PLACEHOLDERS = ["iid", "branch", "mrTarget"];
+// The built-in workflow body (everything after the fixed `\n\n---\n\n`
+// separator that runner.ts adds). Reproduces the pre-feature hardcoded text
+// exactly; placeholders were substituted for the per-run values.
+export const DEFAULT_BUILD_WORKFLOW_TEMPLATE = `Before you start, make sure you are on the work item branch \`{{branch}}\`:
+- DevBot has already placed your checkout on \`{{branch}}\`. Verify with \`git rev-parse --abbrev-ref HEAD\` — it must show \`{{branch}}\`.
+- Once on it, rebase onto the latest remote: \`git rebase origin/{{branch}}\` (DevBot already fetched origin for this run; skip the rebase if \`origin/{{branch}}\` doesn't exist — fresh branch).
+- If HEAD is somehow different (recovery only): run \`git checkout {{branch}}\` if it exists locally, else \`git checkout -b {{branch}} origin/{{branch}}\` if it exists remotely, else \`git checkout -B {{branch}} {{mrTarget}}\` to start the work branch from the MR target.
+- If a rebase hits conflicts, stop and report them in your reply — do not force anything.
+
+When finished, commit your work:
+- Stage every change with \`git add -A\`.
+- Create a **single** git commit using Conventional Commits format: \`type(scope): imperative summary (#{{iid}})\`
+  where \`type\` is one of feat, fix, refactor, docs, test, chore, perf, style, build, ci and \`scope\` is the touched module (omit \`scope\` if the change spans multiple modules).
+- Add a body paragraph explaining *what* and *why* when the change is non-trivial.
+- **Do not push** — devbot pushes the branch after you finish.
+
+After your commit, summarize the WHOLE branch for the MR (not just this run's commit):
+- Run \`git log origin/{{mrTarget}}..HEAD --format='- %s'\` to list every commit on this branch since it diverged from {{mrTarget}}.
+- Read each commit's subject and body with \`git log origin/{{mrTarget}}..HEAD\` (no --format) for the full bodies.
+- Write the MR content block from that full picture as structured Markdown:
+
+{{mrBlock}}
+
+DevBot parses the block and strips it from the note posted to the work item; the description body (everything after \`description:\`) is passed through to the forge verbatim as the MR/PR description, which renders Markdown. The block must be the last thing in your reply. Re-runs replace the MR/PR description, so always summarize the full branch, not just the latest commit. The closing \`Resolves #{{iid}}\` line lets the forge auto-close the work item when the merge/pull request merges — keep it as the last line.`;
+// The built-in MR description body, injected after the fixed `description:`
+// key. Matches the pre-feature scaffold's body exactly.
+export const DEFAULT_MR_DESCRIPTION_TEMPLATE = `## Summary
+<1-3 sentences: what the branch as a whole changes>
+
+## Changes
+- <commit subject 1>
+- <commit subject 2>
+- …list every commit from the git log above (use the same subjects)
+
+## Rationale
+<1-2 sentences on why, if the change is non-trivial; omit this whole section if the change is self-evident>
+
+Resolves #{{iid}}`;
+// All `{{name}}` tokens present in a template, deduped, in first-seen order.
+export function extractPlaceholders(template) {
+    const out = [];
+    const seen = new Set();
+    for (const m of template.matchAll(/\{\{\s*([a-zA-Z0-9_]+)\s*\}\}/g)) {
+        const name = m[1];
+        if (!seen.has(name)) {
+            seen.add(name);
+            out.push(name);
+        }
+    }
+    return out;
+}
+// Placeholder names used in `template` that are not in `allowed`. Empty array
+// means valid. Used by the zod schemas (save-time validation).
+export function findUnknownPlaceholders(template, allowed) {
+    const ok = new Set(allowed);
+    return extractPlaceholders(template).filter((name) => !ok.has(name));
+}
+function fill(template, values) {
+    let out = template;
+    for (const [name, value] of Object.entries(values)) {
+        // Function replacer so `$` sequences in user content are never treated as
+        // String.replace patterns.
+        out = out.replaceAll(`{{${name}}}`, () => value);
+    }
+    return out;
+}
+// The fixed ```mr scaffold wrapping the rendered description. DevBot-owned.
+function mrBlock(workItemNumber, description) {
+    return [
+        "```mr",
+        `title: <Conventional Commit summary of the branch's overall change, end with (#${workItemNumber})>`,
+        "description:",
+        description,
+        "```",
+    ].join("\n");
+}
+// Render the build-mode workflow body. runner.ts prepends the fixed separator.
+// When `workflow` omits `{{mrBlock}}`, the scaffold is appended so MR parsing
+// can never silently degrade.
+export function renderBuildWorkflow(input) {
+    const workflowTpl = input.workflow?.trim() ? input.workflow : DEFAULT_BUILD_WORKFLOW_TEMPLATE;
+    const descTpl = input.mrDescription?.trim()
+        ? input.mrDescription
+        : DEFAULT_MR_DESCRIPTION_TEMPLATE;
+    const description = fill(descTpl, {
+        iid: String(input.workItemNumber),
+        branch: input.branch,
+        mrTarget: input.mrTarget,
+    });
+    const block = mrBlock(input.workItemNumber, description);
+    const rendered = fill(workflowTpl, {
+        iid: String(input.workItemNumber),
+        branch: input.branch,
+        mrTarget: input.mrTarget,
+        mrBlock: block,
+    });
+    return workflowTpl.includes("{{mrBlock}}") ? rendered : `${rendered}\n\n${block}`;
+}
+//# sourceMappingURL=build-workflow.js.map

package/dist/build-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-workflow.js","sourceRoot":"","sources":["../src/build-workflow.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,+EAA+E;AAC/E,4DAA4D;AAC5D,8EAA8E;AAC9E,4BAA4B;AAC5B,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,+EAA+E;AAC/E,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,qDAAqD;AAErD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAU,CAAC;AACvF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAU,CAAC;AAElF,uEAAuE;AACvE,4EAA4E;AAC5E,iEAAiE;AACjE,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;;;;;;;;;;;;;;sgBAoBud,CAAC;AAEvgB,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,CAAC,MAAM,+BAA+B,GAAG;;;;;;;;;;;kBAW7B,CAAC;AAEnB,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,gCAAgC,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,+DAA+D;AAC/D,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,OAA0B;IAClF,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,IAAI,CAAC,QAAgB,EAAE,MAA8B;IAC5D,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,0EAA0E;QAC1E,2BAA2B;QAC3B,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,OAAO,CAAC,cAAsB,EAAE,WAAmB;IAC1D,OAAO;QACL,OAAO;QACP,kFAAkF,cAAc,IAAI;QACpG,cAAc;QACd,WAAW;QACX,KAAK;KACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAWD,+EAA+E;AAC/E,8EAA8E;AAC9E,8BAA8B;AAC9B,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC;IAC9F,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE;QACzC,CAAC,CAAC,KAAK,CAAC,aAAa;QACrB,CAAC,CAAC,+BAA+B,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE;QAChC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE;QACjC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,KAAK,EAAE,CAAC;AACpF,CAAC"}

package/dist/change-request-lifecycle.js

@@ -0,0 +1,16 @@
+export function decideChangeRequestAction(mrs) {
+    const sorted = [...mrs].sort((a, b) => b.number - a.number);
+    const open = sorted.find((m) => m.state === "open");
+    if (open)
+        return { kind: "update", number: open.number };
+    return { kind: "create", priorState: sorted[0]?.state ?? null };
+}
+// The open merge request associated with a branch, highest number first (a
+//   forge can briefly return more than one). Used by the standalone
+//   /fix-conflicts task to resolve against the MR's *current* target branch,
+//   so a retargeted MR is fixed against the right base. Pure + testable.
+export function openChangeRequest(mrs) {
+    const open = [...mrs].sort((a, b) => b.number - a.number).find((m) => m.state === "open");
+    return open ?? null;
+}
+//# sourceMappingURL=change-request-lifecycle.js.map

package/dist/change-request-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-request-lifecycle.js","sourceRoot":"","sources":["../src/change-request-lifecycle.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,yBAAyB,CAAC,GAA2B;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IACpD,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACzD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,oEAAoE;AACpE,6EAA6E;AAC7E,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAAC,GAA2B;IAC3D,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;IAC1F,OAAO,IAAI,IAAI,IAAI,CAAC;AACtB,CAAC"}

package/dist/change-request-store.js

@@ -0,0 +1,72 @@
+import { db } from "./db.js";
+import { log } from "./logger.js";
+// Durable registry of merge/pull requests DevBot created (work item #57). The
+// CI-failure handler needs to answer "is this failed pipeline on an MR DevBot
+// opened, and for which work item?" — the forge webhook alone cannot (a GitLab
+// Pipeline Hook carries no MR author, and DevBot never persisted the MR iid).
+// Rows are written when the runner CREATES an MR; an MR DevBot merely updated
+// is not registered (it was not created by DevBot).
+//
+// last_pipeline_id / last_pipeline_sha implement dedup: a pipeline is reported
+// to the work item once. A redelivered webhook (or a re-fired workflow_run) sees
+// the stored id and is ignored. Same DB file (devbot.db, 0600).
+export function initChangeRequestTable() {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS change_requests (
+      project_id        INTEGER NOT NULL,
+      source_branch     TEXT    NOT NULL,
+      cr_number         INTEGER NOT NULL,
+      work_item_id      INTEGER NOT NULL,
+      work_item_number  INTEGER NOT NULL,
+      last_pipeline_id  INTEGER,
+      last_pipeline_sha TEXT,
+      last_reported_at  INTEGER,
+      created_at        INTEGER NOT NULL,
+      PRIMARY KEY (project_id, source_branch)
+    )
+  `);
+    db.exec("CREATE INDEX IF NOT EXISTS idx_change_requests_work_item ON change_requests(work_item_id)");
+}
+// Register an MR DevBot just created. Upsert keeps created_at and any dedup
+// state on a re-create of the same branch (e.g. branch reused after /reset).
+export function recordChangeRequest(input) {
+    const now = Math.floor(Date.now() / 1000);
+    db.prepare(`INSERT INTO change_requests
+       (project_id, source_branch, cr_number, work_item_id, work_item_number, created_at)
+     VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(project_id, source_branch) DO UPDATE SET
+       cr_number        = excluded.cr_number,
+       work_item_id     = excluded.work_item_id,
+       work_item_number = excluded.work_item_number`).run(input.projectId, input.sourceBranch, input.crNumber, input.workItemId, input.workItemNumber, now);
+}
+export function getChangeRequestBySourceBranch(projectId, sourceBranch) {
+    const row = db
+        .prepare("SELECT project_id, source_branch, cr_number, work_item_id, work_item_number, last_pipeline_id, last_pipeline_sha, last_reported_at, created_at FROM change_requests WHERE project_id = ? AND source_branch = ?")
+        .get(projectId, sourceBranch);
+    return row ?? null;
+}
+// Mark a pipeline as reported so redeliveries (same pipeline id or sha) are
+// ignored. Returns false when the row no longer exists.
+export function markCiReported(input) {
+    const now = Math.floor(Date.now() / 1000);
+    const r = db
+        .prepare(`UPDATE change_requests
+         SET last_pipeline_id = ?, last_pipeline_sha = ?, last_reported_at = ?
+       WHERE project_id = ? AND source_branch = ?`)
+        .run(input.pipelineId, input.sha, now, input.projectId, input.sourceBranch);
+    return r.changes > 0;
+}
+// Test-only cleanup hook (the table is tiny and rows persist in production).
+export function deleteChangeRequest(projectId, sourceBranch) {
+    db.prepare("DELETE FROM change_requests WHERE project_id = ? AND source_branch = ?").run(projectId, sourceBranch);
+}
+// Test-only: wipe all rows.
+export function deleteAllChangeRequests() {
+    try {
+        db.prepare("DELETE FROM change_requests").run();
+    }
+    catch (e) {
+        log.debug("deleteAllChangeRequests skipped", { err: e });
+    }
+}
+//# sourceMappingURL=change-request-store.js.map

package/dist/change-request-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-request-store.js","sourceRoot":"","sources":["../src/change-request-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,oDAAoD;AACpD,EAAE;AACF,+EAA+E;AAC/E,iFAAiF;AACjF,gEAAgE;AAEhE,MAAM,UAAU,sBAAsB;IACpC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;GAaP,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;AACvG,CAAC;AAcD,4EAA4E;AAC5E,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,KAMnC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,EAAE,CAAC,OAAO,CACR;;;;;;oDAMgD,CACjD,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AAC1G,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,SAAiB,EAAE,YAAoB;IACpF,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CACN,gNAAgN,CACjN;SACA,GAAG,CAAC,SAAS,EAAE,YAAY,CAAiC,CAAC;IAChE,OAAO,GAAG,IAAI,IAAI,CAAC;AACrB,CAAC;AAED,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,UAAU,cAAc,CAAC,KAK9B;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,EAAE;SACT,OAAO,CACN;;kDAE4C,CAC7C;SACA,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,YAAoB;IACzE,EAAE,CAAC,OAAO,CAAC,wEAAwE,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;AACpH,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,uBAAuB;IACrC,IAAI,CAAC;QACH,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,GAAG,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC"}

package/dist/ci-failure.js

@@ -0,0 +1,80 @@
+import { getPlatform } from "./platform/index.js";
+import { log } from "./logger.js";
+// Build the CI-failure context block injected into a plan run's prompt. Kept
+// free of the runner's git/volume machinery so it can be unit-tested with a
+// stub platform. Logs are fetched at run time (fresher and larger than a
+// webhook can carry); each job log is tailed — the failure is at the end, so
+// the engine drops the head exactly as the feature requires.
+//
+// Every step degrades gracefully: a forge error yields a section noting the
+// gap rather than aborting the whole run, because the agent can still reason
+// from the work item and job names.
+// Per-job cap (tail) and a total budget across all fetched jobs. The totals are
+// deliberately modest: this block is context, not the task itself.
+export const CI_LOG_PER_JOB_BYTES = 50_000;
+export const CI_LOG_TOTAL_BYTES = 100_000;
+export const CI_MAX_JOBS = 3;
+function fmtJob(job) {
+    return job.webUrl ? `- \`${job.name}\` (${job.status}) — ${job.webUrl}` : `- \`${job.name}\` (${job.status})`;
+}
+export async function buildCiFailureSection(projectId, ctx, injectedCi) {
+    const platform = injectedCi ? { ci: injectedCi } : getPlatform();
+    const header = [
+        "## CI failure on the DevBot merge/pull request",
+        "",
+        `Pipeline \`${ctx.pipelineId}\` failed on \`${ctx.ref}\`${ctx.sha ? ` @ \`${ctx.sha.slice(0, 8)}\`` : ""}${ctx.changeRequestNumber ? ` (MR !${ctx.changeRequestNumber})` : ""}.`,
+        "Triage the failure and propose a concrete fix. CI job logs (tails) are included below.",
+    ].join("\n");
+    let jobs = [];
+    try {
+        const listed = await platform.ci.listPipelineJobs(projectId, ctx.pipelineId, { outcome: "failed" });
+        jobs = listed.map((j) => ({
+            id: j.id,
+            name: j.name,
+            status: j.status,
+            ...(j.webUrl ? { webUrl: j.webUrl } : {}),
+        }));
+    }
+    catch (e) {
+        log.warn("ci-failure job list failed", { projectId, pipelineId: ctx.pipelineId, err: e });
+        return {
+            section: `${header}\n\n_Could not list the pipeline's jobs: ${e instanceof Error ? e.message : String(e)}._`,
+            jobCount: 0,
+            truncated: false,
+        };
+    }
+    if (jobs.length === 0) {
+        return { section: `${header}\n\n_No failed jobs were reported for this pipeline._`, jobCount: 0, truncated: false };
+    }
+    const selected = jobs.slice(0, CI_MAX_JOBS);
+    const omittedJobs = jobs.slice(CI_MAX_JOBS);
+    const parts = [header, "", "### Failed jobs", ...selected.map(fmtJob)];
+    if (omittedJobs.length > 0) {
+        parts.push(`_(${omittedJobs.length} more failed job(s) omitted.)_`);
+    }
+    let budget = CI_LOG_TOTAL_BYTES;
+    let anyTruncated = false;
+    for (const job of selected) {
+        if (budget <= 0)
+            break;
+        const cap = Math.min(CI_LOG_PER_JOB_BYTES, budget);
+        try {
+            const logContent = await platform.ci.getJobLog(projectId, job.id, cap);
+            budget -= logContent.content.length;
+            if (logContent.truncated)
+                anyTruncated = true;
+            parts.push("", `### Log: ${job.name}`, "```", logContent.content.trimEnd(), "```");
+        }
+        catch (e) {
+            parts.push("", `_Could not fetch the log for \`${job.name}\`: ${e instanceof Error ? e.message : String(e)}._`);
+        }
+    }
+    if (budget <= 0 && selected.length > 0)
+        anyTruncated = true;
+    return {
+        section: parts.join("\n"),
+        jobCount: selected.length,
+        truncated: anyTruncated,
+    };
+}
+//# sourceMappingURL=ci-failure.js.map

package/dist/ci-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-failure.js","sourceRoot":"","sources":["../src/ci-failure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAIlC,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,6EAA6E;AAC7E,6DAA6D;AAC7D,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,oCAAoC;AAEpC,gFAAgF;AAChF,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAQ7B,SAAS,MAAM,CAAC,GAAsD;IACpE,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC;AAChH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,GAAqB,EACrB,UAAyB;IAEzB,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,MAAM,GAAG;QACb,gDAAgD;QAChD,EAAE;QACF,cAAc,GAAG,CAAC,UAAU,kBAAkB,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;QAChL,wFAAwF;KACzF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,IAAI,IAAI,GAAyE,EAAE,CAAC;IACpF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpG,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC,CAAC;IACN,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,EAAE,CAAU,EAAE,CAAC,CAAC;QACnG,OAAO;YACL,OAAO,EAAE,GAAG,MAAM,4CAA4C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YAC5G,QAAQ,EAAE,CAAC;YACX,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,uDAAuD,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAa,CAAC,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,MAAM,gCAAgC,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,MAAM,GAAG,kBAAkB,CAAC;IAChC,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,MAAM,IAAI,CAAC;YAAE,MAAM;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACvE,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;YACpC,IAAI,UAAU,CAAC,SAAS;gBAAE,YAAY,GAAG,IAAI,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;QACrF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,kCAAkC,GAAG,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,YAAY,GAAG,IAAI,CAAC;IAE5D,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,SAAS,EAAE,YAAY;KACxB,CAAC;AACJ,CAAC"}

package/dist/cli.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import "./server.js";
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,aAAa,CAAC"}

package/dist/config.js

@@ -0,0 +1,17 @@
+import { EnvSchema } from "./types/env.js";
+function loadEnv() {
+    const result = EnvSchema.safeParse(process.env);
+    if (!result.success) {
+        const formatted = result.error.issues
+            .map((i) => `  ${i.path.join(".")}: ${i.message}`)
+            .join("\n");
+        throw new Error(`Invalid environment configuration:\n${formatted}`);
+    }
+    return result.data;
+}
+export const config = loadEnv();
+// Base-branch parsing lives in ./base-branches.ts so it can be imported by
+// stores without pulling in config validation. Re-exported here for callers
+// that historically imported it from config.
+export { parseBaseBranches } from "./base-branches.js";
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAY,MAAM,gBAAgB,CAAC;AAErD,SAAS,OAAO;IACd,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aACjD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uCAAuC,SAAS,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAQ,OAAO,EAAE,CAAC;AAGrC,2EAA2E;AAC3E,4EAA4E;AAC5E,6CAA6C;AAC7C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC"}