@wrongstack/cli 1.0.28 → 1.0.32

package/dist/automation-MCDFCIMV.js

@@ -0,0 +1,369 @@
+
+// src/subcommands/handlers/automation.ts
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile as readFile2, unlink } from "node:fs/promises";
+import * as path from "node:path";
+import {
+  atomicWrite,
+  toErrorMessage,
+  withFileLock,
+  wstackGlobalRoot
+} from "@wrongstack/core/utils";
+import {
+  AutomationService,
+  AutomationStore,
+  createAutomationServer,
+  createHeadlessLaunchPlan,
+  evaluateGitHubFilters
+} from "@wrongstack/runtime";
+import {
+  exportAutomationJob,
+  importAutomationJob,
+  VERSIONED_AUTOMATION_TEMPLATES
+} from "@wrongstack/webui-protocol";
+
+// src/subcommands/handlers/automation-credentials.ts
+import { readFile } from "node:fs/promises";
+import { decryptConfigSecrets, isSecretField } from "@wrongstack/core/security";
+import {
+  isCredentialEnvName
+} from "@wrongstack/runtime";
+async function resolveAutomationCredentialBundle(refs, paths, vault) {
+  const values = /* @__PURE__ */ Object.create(null);
+  const providers = /* @__PURE__ */ Object.create(null);
+  const profiles = /* @__PURE__ */ new Map();
+  for (const ref of refs) {
+    if (!/^[\w-]{1,64}$/.test(ref.profile) || !isCredentialEnvName(ref.envName))
+      throw new Error("Invalid automation credential reference");
+    let config = profiles.get(ref.profile);
+    if (!config) {
+      config = decryptConfigSecrets(
+        JSON.parse(await readFile(paths.profileConfig(ref.profile), "utf8")),
+        vault
+      );
+      profiles.set(ref.profile, config);
+    }
+    const provider = config.providers && Object.hasOwn(config.providers, ref.provider) ? config.providers[ref.provider] : void 0;
+    const key = provider?.apiKeys?.find((item) => item.label === ref.keyLabel);
+    if (!key || key.authMethod !== void 0 && key.authMethod !== "api_key" || typeof key.apiKey !== "string" || !key.apiKey.trim() || vault.isEncrypted(key.apiKey))
+      throw new Error(
+        `API credential reference unavailable: ${ref.profile}/${ref.provider}/${ref.keyLabel}`
+      );
+    if (Object.hasOwn(values, ref.envName))
+      throw new Error("Duplicate automation credential destination");
+    values[ref.envName] = key.apiKey;
+    if (Object.hasOwn(providers, ref.provider))
+      throw new Error("A provider cannot reference two credentials in one run");
+    const selected = { type: provider.type || ref.provider, apiKey: key.apiKey };
+    for (const field of [
+      "family",
+      "cloud",
+      "baseUrl",
+      "model",
+      "models",
+      "customModels",
+      "capabilities",
+      "quirks",
+      "autoDiscoverModels",
+      "modelDiscoveryPath",
+      "modelDiscoveryAuthoritative"
+    ]) {
+      if (provider[field] !== void 0)
+        selected[field] = structuredClone(provider[field]);
+    }
+    if (provider.headers)
+      selected.headers = Object.fromEntries(
+        Object.entries(provider.headers).filter(
+          ([name, value]) => !isSecretField(name) && !value.includes(key.apiKey)
+        )
+      );
+    providers[ref.provider] = selected;
+  }
+  return { env: values, providers };
+}
+
+// src/subcommands/handlers/automation.ts
+var USAGE = `Usage: wstack automation <add|preview|templates|import|export|list|run|enable|disable|cancel|serve|prune> [id] [options]
+
+Persistent agent jobs and run history. Jobs execute in a copied Docker workspace
+and produce reviewable patches. No host project edits or automatic publishing.
+
+add --name <name> --image <trusted-image> --prompt <task>
+    [--every <seconds>] [--provider <id>] [--model <id>] [--env NAME,...]
+    [--repository owner/repo --events issue_comment.created,pull_request.opened]
+    [--webhook-secret-env GITHUB_WEBHOOK_SECRET] [--timeout <seconds>]
+    [--credential ENV=provider/key-label] [--yolo] [--max-iterations <n>]
+    [--cron "0 9 * * 1-5" --timezone Europe/Istanbul]
+    [--mention @wrongstack] [--label agent] [--branch main]
+    [--conclusion failure] [--exclude-bots] [--exclude-drafts]
+preview               Same options as add; validate without writing or executing
+    [--event-file <json>] Preview GitHub conditions against a sample payload
+templates             List versioned templates and required setup
+add --template <id>   Use a versioned prompt template with existing project instructions/skills
+export <id>           Print a portable definition without project identity or credential values
+import --file <json>  Import into this project, disabled and with unattended tools off
+    [--dry-run] Validate the import without writing a job
+run <id>              Queue a manual run
+list                  Show persistent jobs and run status
+enable|disable <id>   Change scheduling state
+cancel <run-id>       Cancel a queued run (running cancellation uses the API)
+prune --days <n>      Prune old terminal metadata; retain latest PR checkpoints and artifacts
+serve [--port 3501]   Start worker and loopback HTTP API until interrupted
+--data-dir <path>     Explicit state directory (default machine home/automation)
+
+The API token is stored in token.txt, not printed. GitHub POSTs use
+/hooks/<job-id>/github and HMAC-SHA256 verification. Control routes require
+Bearer authentication; manual run POSTs require an Idempotency-Key.
+Choose --every (fixed seconds) or --cron (five fields, timezone defaults to UTC).
+Preview and add --dry-run print references only; values are resolved at execution.
+`;
+async function apiToken(directory) {
+  const file = path.join(directory, "token.txt");
+  return withFileLock(file, async () => {
+    try {
+      const value = (await readFile2(file, "utf8")).trim();
+      if (!/^[a-f0-9]{64}$/.test(value)) throw new Error("Invalid automation API token file");
+      return value;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      const value = randomBytes(32).toString("hex");
+      await atomicWrite(file, `${value}
+`, { mode: 384 });
+      return value;
+    }
+  });
+}
+var automationCmd = async (args, deps) => {
+  const flags = deps.flags ?? {};
+  const action = args[0] ?? "list";
+  if (flags["help"] || action === "help") {
+    deps.renderer.write(USAGE);
+    return 0;
+  }
+  const value = (name) => typeof flags[name] === "string" ? flags[name] : void 0;
+  const directory = path.resolve(value("data-dir") ?? path.join(wstackGlobalRoot(), "automation"));
+  const store = new AutomationStore(directory);
+  try {
+    if (action === "add" || action === "preview") {
+      const template = value("template") ? VERSIONED_AUTOMATION_TEMPLATES.find((item) => item.id === value("template")) : void 0;
+      if (value("template") && !template) throw new Error("Unknown automation template");
+      if (value("timezone") && !value("cron")) throw new Error("--timezone requires --cron");
+      const credentials = value("credential")?.split(",").map((item) => {
+        const equal = item.indexOf("=");
+        const envName = item.slice(0, equal).trim();
+        const keyPath = item.slice(equal + 1).split("/");
+        if (equal < 1 || keyPath.length < 2)
+          throw new Error("Use --credential ENV=provider/key-label");
+        return {
+          envName,
+          profile: deps.paths.profileName,
+          provider: keyPath[0],
+          keyLabel: keyPath.slice(1).join("/")
+        };
+      });
+      const spec = {
+        name: value("name") ?? template?.name ?? "",
+        projectRoot: deps.projectRoot,
+        image: value("image") ?? "",
+        prompt: value("prompt") ?? template?.prompt ?? "",
+        template: template ? { id: template.id, version: template.version } : void 0,
+        provider: value("provider"),
+        model: value("model"),
+        envNames: value("env")?.split(",").map((name) => name.trim()).filter(Boolean) ?? [],
+        intervalMs: value("every") === void 0 ? void 0 : Number(value("every")) * 1e3,
+        schedule: value("cron") ? {
+          type: "cron",
+          expression: value("cron"),
+          timezone: value("timezone") ?? "UTC"
+        } : void 0,
+        enabled: true,
+        yolo: flags["yolo"] === true,
+        timeoutMs: Number(value("timeout") ?? 600) * 1e3,
+        maxIterations: Number(value("max-iterations") ?? 40),
+        credentials,
+        github: value("repository") ? {
+          repository: value("repository"),
+          events: value("events")?.split(",").map((event) => event.trim()) ?? ["issue_comment.created"],
+          secretEnv: value("webhook-secret-env") ?? "GITHUB_WEBHOOK_SECRET",
+          filters: {
+            mention: value("mention"),
+            label: value("label"),
+            branch: value("branch"),
+            conclusion: value("conclusion"),
+            draft: flags["exclude-drafts"] === true ? false : void 0,
+            excludeBots: flags["exclude-bots"] === true ? true : void 0
+          }
+        } : void 0
+      };
+      const plan = createHeadlessLaunchPlan(spec);
+      if (action === "preview" || flags["dry-run"] === true) {
+        const missing = spec.envNames.filter((name) => !process.env[name]);
+        for (const ref of spec.credentials ?? []) {
+          try {
+            const profile = JSON.parse(
+              await readFile2(deps.paths.profileConfig(ref.profile), "utf8")
+            );
+            const provider = profile.providers && Object.hasOwn(profile.providers, ref.provider) ? profile.providers[ref.provider] : void 0;
+            const key = provider?.apiKeys?.find(
+              (entry) => entry.label === ref.keyLabel
+            );
+            if (!key?.apiKey || key.authMethod && key.authMethod !== "api_key")
+              missing.push(`${ref.profile}/${ref.provider}/${ref.keyLabel}`);
+          } catch {
+            missing.push(`${ref.profile}/${ref.provider}/${ref.keyLabel}`);
+          }
+        }
+        const filterPreview = value("event-file") ? evaluateGitHubFilters(
+          spec.github?.filters,
+          JSON.parse(await readFile2(value("event-file"), "utf8"))
+        ) : void 0;
+        deps.renderer.write(
+          `${JSON.stringify({ ...plan, missingReferences: missing, filterPreview }, null, 2)}
+`
+        );
+        return 0;
+      }
+      const job = await store.add(spec);
+      deps.renderer.write(`Automation: ${job.id}
+`);
+      return 0;
+    }
+    if (action === "list") {
+      deps.renderer.write(`${JSON.stringify(await store.snapshot(), null, 2)}
+`);
+      return 0;
+    }
+    if (action === "templates") {
+      deps.renderer.write(`${JSON.stringify(VERSIONED_AUTOMATION_TEMPLATES, null, 2)}
+`);
+      return 0;
+    }
+    if (action === "export" && args[1]) {
+      const job = (await store.snapshot()).jobs.find((item) => item.id === args[1]);
+      if (!job) throw new Error("Automation job not found");
+      deps.renderer.write(`${JSON.stringify(exportAutomationJob(job), null, 2)}
+`);
+      return 0;
+    }
+    if (action === "import" && value("file")) {
+      const raw = await readFile2(path.resolve(deps.cwd, value("file")), "utf8");
+      if (Buffer.byteLength(raw) > 128 * 1024)
+        throw new Error("Automation document exceeds 128 KB");
+      const spec = { ...importAutomationJob(JSON.parse(raw)), projectRoot: deps.projectRoot };
+      const plan = createHeadlessLaunchPlan(spec);
+      if (flags["dry-run"]) deps.renderer.write(`${JSON.stringify(plan, null, 2)}
+`);
+      else deps.renderer.write(`Imported disabled job: ${(await store.add(spec)).id}
+`);
+      return 0;
+    }
+    if (action === "run" && args[1]) {
+      const run = await store.enqueue(args[1]);
+      deps.renderer.write(`Queued: ${run.id}
+`);
+      return 0;
+    }
+    if ((action === "enable" || action === "disable") && args[1]) {
+      await store.setEnabled(args[1], action === "enable");
+      return 0;
+    }
+    if (action === "cancel" && args[1]) {
+      await store.cancel(args[1]);
+      return 0;
+    }
+    if (action === "prune") {
+      const days = Number(value("days") ?? 30);
+      if (!Number.isFinite(days) || days < 0) throw new Error("Prune days must be nonnegative");
+      const count = await store.prune(Date.now() - days * 864e5);
+      deps.renderer.write(
+        `Pruned terminal metadata: ${count}
+Artifacts and latest PR checkpoints retained.
+`
+      );
+      return 0;
+    }
+    if (action !== "serve") {
+      deps.renderer.write(USAGE);
+      return 2;
+    }
+    const port = Number(value("port") ?? 3501);
+    if (!Number.isSafeInteger(port) || port < 1 || port > 65535)
+      throw new Error("Automation port must be 1 to 65535");
+    await mkdir(directory, { recursive: true, mode: 448 });
+    const token = await apiToken(directory);
+    const service = new AutomationService(
+      store,
+      void 0,
+      Number(value("max-concurrent") ?? 1),
+      (refs) => resolveAutomationCredentialBundle(refs, deps.paths, deps.vault)
+    );
+    const server = createAutomationServer(
+      service,
+      token,
+      (profile) => deps.paths.profileConfig(profile)
+    );
+    await new Promise((resolve2, reject) => {
+      server.once("error", reject);
+      server.listen(port, "127.0.0.1", () => {
+        server.removeListener("error", reject);
+        resolve2();
+      });
+    });
+    deps.renderer.write(
+      `Automation: http://127.0.0.1:${port}
+Token file: ${path.join(directory, "token.txt")}
+`
+    );
+    const abort = new AbortController();
+    const cancel = () => abort.abort();
+    process.once("SIGINT", cancel);
+    process.once("SIGTERM", cancel);
+    try {
+      const endpointFile = path.join(directory, "endpoint.json");
+      await withFileLock(
+        endpointFile,
+        () => atomicWrite(endpointFile, JSON.stringify({ port, workerId: service.workerId }), {
+          mode: 384
+        })
+      );
+      while (!abort.signal.aborted) {
+        await service.tick();
+        await new Promise((resolve2) => {
+          const done = () => {
+            clearTimeout(timer);
+            abort.signal.removeEventListener("abort", done);
+            resolve2();
+          };
+          const timer = setTimeout(done, 1e3);
+          abort.signal.addEventListener("abort", done, { once: true });
+          if (abort.signal.aborted) done();
+        });
+      }
+    } finally {
+      process.removeListener("SIGINT", cancel);
+      process.removeListener("SIGTERM", cancel);
+      try {
+        await service.stop();
+      } finally {
+        await new Promise((resolve2) => server.close(() => resolve2()));
+        try {
+          const endpointFile = path.join(directory, "endpoint.json");
+          await withFileLock(endpointFile, async () => {
+            if (JSON.parse(await readFile2(endpointFile, "utf8")).workerId === service.workerId)
+              await unlink(endpointFile);
+          });
+        } catch {
+        }
+      }
+    }
+    return 0;
+  } catch (error) {
+    deps.renderer.write(`automation: ${toErrorMessage(error)}
+`);
+    return 1;
+  }
+};
+export {
+  automationCmd
+};
+//# sourceMappingURL=automation-MCDFCIMV.js.map