agent-dealer 1.1.2 → 1.1.3

package/bundle/server/dist/adapters/git-worktree.js

@@ -27,6 +27,67 @@ async function git(cwd, args) {
         throw new Error(`git ${args.join(" ")} failed: ${e.stderr?.trim() || e.message}`);
     }
 }
+/** Default bound for the pre-branch fetch of `origin/<baseBranch>` (NOT-197). */
+export const DEFAULT_BASE_FETCH_TIMEOUT_MS = 60_000;
+function clampFetchTimeoutMs(timeoutMs) {
+    return Number.isFinite(timeoutMs) && timeoutMs > 0
+        ? timeoutMs
+        : DEFAULT_BASE_FETCH_TIMEOUT_MS;
+}
+/** Whether `repo` has an `origin` remote at all. */
+async function hasOriginRemote(repo) {
+    try {
+        await git(repo, ["remote", "get-url", "origin"]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * NOT-197: resolve the commit a fresh developer branch must start from. Fetches
+ * `origin/<baseBranch>` in the cached clone with a bounded timeout and returns the
+ * fetched `origin/<baseBranch>` tip — never the possibly-stale local base branch the
+ * cached clone was left on.
+ *
+ * A repo with no `origin` remote has no fresher truth than its local branches, so the
+ * local base is used as-is (legacy local checkouts keep working offline). Any other
+ * fetch failure — network down, VPN, timeout — is returned, never silently replaced
+ * with the stale local branch: the caller defers the start instead.
+ */
+export async function fetchFreshBase(repo, baseBranch, timeoutMs) {
+    const boundMs = clampFetchTimeoutMs(timeoutMs);
+    if (!(await hasOriginRemote(repo))) {
+        try {
+            const { stdout } = await git(repo, ["rev-parse", baseBranch]);
+            return { ok: true, sha: stdout.trim(), ref: baseBranch };
+        }
+        catch (err) {
+            return { ok: false, reason: `no origin remote and local base ${baseBranch} does not resolve: ${err.message}` };
+        }
+    }
+    try {
+        await run("git", ["fetch", "origin", baseBranch], { cwd: repo, timeout: boundMs });
+    }
+    catch (err) {
+        const e = err;
+        const timedOut = e?.killed === true;
+        const detail = typeof e?.stderr === "string" && e.stderr.trim() ? e.stderr.trim() : e?.message;
+        return {
+            ok: false,
+            reason: timedOut
+                ? `git fetch origin ${baseBranch} timed out after ${boundMs}ms — network or VPN may be down`
+                : `git fetch origin ${baseBranch} failed: ${detail}`,
+        };
+    }
+    try {
+        const { stdout } = await git(repo, ["rev-parse", `origin/${baseBranch}`]);
+        return { ok: true, sha: stdout.trim(), ref: `origin/${baseBranch}` };
+    }
+    catch (err) {
+        return { ok: false, reason: `fetched origin ${baseBranch} but origin/${baseBranch} does not resolve: ${err.message}` };
+    }
+}
 export async function addWorktree(opts) {
     const args = ["worktree", "add"];
     if (opts.detach)
@@ -500,15 +561,38 @@ export async function resolveDeveloperWorktree(opts) {
             }
             await pruneWorktrees(opts.repo);
         }
+        // NOT-197: a fresh issue branch starts from the freshly fetched
+        // `origin/<baseBranch>` tip — never the cached clone's possibly-stale local base.
+        // A failed fetch returns `base_unavailable` (no branch is created) instead of
+        // silently falling back to the stale local branch. The reuse path below needs no
+        // fetch — it checks out a branch that already exists — and is unchanged.
+        let ref;
+        let newBranch;
+        let baseSha = null;
+        let baseRef = null;
+        if (!opts.reuseBranch) {
+            const fresh = await fetchFreshBase(opts.repo, opts.baseBranch, opts.fetchTimeoutMs);
+            if (!fresh.ok) {
+                return { kind: "base_unavailable", reason: fresh.reason };
+            }
+            ref = fresh.ref;
+            newBranch = opts.branchName;
+            baseSha = fresh.sha;
+            baseRef = fresh.ref;
+        }
+        else {
+            ref = opts.branchName;
+            newBranch = undefined;
+        }
         const worktreePath = opts.worktreePath ?? roleWorktreePath(opts.repo, opts.sessionId, "developer");
         ensureParentDir(worktreePath);
         await addWorktree({
             repo: opts.repo,
             path: worktreePath,
-            ref: opts.reuseBranch ? opts.branchName : opts.baseBranch,
+            ref,
             detach: false,
-            newBranch: opts.reuseBranch ? undefined : opts.branchName,
+            newBranch,
         });
-        return { kind: "created", path: tryRealpath(worktreePath) };
+        return { kind: "created", path: tryRealpath(worktreePath), baseSha, baseRef };
     });
 }

package/bundle/server/dist/adapters/git-worktree.test.js

@@ -11,7 +11,7 @@ import path from "node:path";
 // against findWorktreeForBranch/resolveDeveloperWorktree would fail.
 const home = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "dealer-wt-home-")));
 process.env.AGENT_DEALER_HOME = home;
-const { createRoleWorktree, safeRemoveWorktree, inspectLeftoverWorktree, isWorktreeClean, withRepoLock, pushBranch, commitsAhead, findWorktreeForBranch, resolveDeveloperWorktree, worktreesRoot, WORKTREES_DIR_NAME, } = await import("./git-worktree.js");
+const { branchExists, createRoleWorktree, safeRemoveWorktree, fetchFreshBase, inspectLeftoverWorktree, isWorktreeClean, withRepoLock, pushBranch, commitsAhead, findWorktreeForBranch, resolveDeveloperWorktree, worktreesRoot, WORKTREES_DIR_NAME, } = await import("./git-worktree.js");
 let repo;
 let remote;
 function git(cwd, ...args) {
@@ -500,3 +500,162 @@ test("NOT-127: resolveDeveloperWorktree still escalates a dirty leftover when th
     fs.rmSync(leftover.path, { recursive: true, force: true });
     await withRepoLock(repo, async () => execFileSync("git", ["worktree", "prune"], { cwd: repo }));
 });
+// ---------------------------------------------------------------- NOT-197: fresh base
+/** An isolated repo + file remote pair, so tests can move or break origin without
+ * touching the module-level fixture every other test shares. */
+function makeIsoRepoPair(tag) {
+    const isoRepo = fs.mkdtempSync(path.join(os.tmpdir(), `dealer-wt197-repo-${tag}-`));
+    git(isoRepo, "init", "-b", "main");
+    git(isoRepo, "config", "user.email", "test@example.com");
+    git(isoRepo, "config", "user.name", "Test");
+    fs.writeFileSync(path.join(isoRepo, "README.md"), "hello\n");
+    git(isoRepo, "add", ".");
+    git(isoRepo, "commit", "-m", "init");
+    const isoRemote = fs.mkdtempSync(path.join(os.tmpdir(), `dealer-wt197-remote-${tag}-`));
+    execFileSync("git", ["init", "-q", "--bare", "-b", "main", isoRemote]);
+    git(isoRepo, "remote", "add", "origin", isoRemote);
+    git(isoRepo, "push", "-q", "origin", "main");
+    return { isoRepo, isoRemote };
+}
+/** Advance origin/main from a separate clone so the repo's own local main stays stale. */
+function advanceOriginMain(isoRemote, file) {
+    const other = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-wt197-other-"));
+    try {
+        execFileSync("git", ["clone", "-q", isoRemote, other]);
+        git(other, "config", "user.email", "test@example.com");
+        git(other, "config", "user.name", "Test");
+        fs.writeFileSync(path.join(other, file), "upstream\n");
+        git(other, "add", ".");
+        git(other, "commit", "-q", "-m", "upstream change");
+        git(other, "push", "-q", "origin", "main");
+        return git(other, "rev-parse", "HEAD");
+    }
+    finally {
+        fs.rmSync(other, { recursive: true, force: true });
+    }
+}
+async function removeIsoWorktree(isoRepo, worktreePath, branch) {
+    fs.rmSync(worktreePath, { recursive: true, force: true });
+    await withRepoLock(isoRepo, async () => execFileSync("git", ["worktree", "prune"], { cwd: isoRepo }));
+    execFileSync("git", ["branch", "-D", branch], { cwd: isoRepo });
+}
+test("NOT-197: a fresh developer branch starts from the fetched origin/<base>, not the stale local base", async () => {
+    const { isoRepo, isoRemote } = makeIsoRepoPair("fresh");
+    try {
+        const staleLocalMain = git(isoRepo, "rev-parse", "main");
+        const originTip = advanceOriginMain(isoRemote, "upstream-change.txt");
+        assert.notEqual(staleLocalMain, originTip, "the local main must lag origin/main for this test to mean anything");
+        assert.equal(git(isoRepo, "rev-parse", "main"), staleLocalMain, "advancing origin must not move the local main");
+        const resolved = await resolveDeveloperWorktree({
+            repo: isoRepo,
+            sessionId: "s-fresh-base",
+            branchName: "issue-fresh-base",
+            baseBranch: "main",
+            reuseBranch: false,
+        });
+        assert.equal(resolved.kind, "created");
+        if (resolved.kind !== "created")
+            return;
+        assert.equal(resolved.baseSha, originTip, "the recorded base must be the fetched origin/main tip");
+        assert.equal(resolved.baseRef, "origin/main");
+        assert.equal(git(isoRepo, "rev-parse", "issue-fresh-base"), originTip, "the new branch must start exactly at the origin/main tip, not the stale local main");
+        assert.equal(git(isoRepo, "rev-parse", "main"), staleLocalMain, "the stale local base itself is left untouched");
+        await removeIsoWorktree(isoRepo, resolved.path, "issue-fresh-base");
+    }
+    finally {
+        fs.rmSync(isoRepo, { recursive: true, force: true });
+        fs.rmSync(isoRemote, { recursive: true, force: true });
+    }
+});
+test("NOT-197: a failed pre-branch fetch returns base_unavailable and creates no branch", async () => {
+    const { isoRepo, isoRemote } = makeIsoRepoPair("fail");
+    try {
+        git(isoRepo, "remote", "set-url", "origin", path.join(isoRemote, "does-not-exist.git"));
+        const resolved = await resolveDeveloperWorktree({
+            repo: isoRepo,
+            sessionId: "s-fetch-fail",
+            branchName: "issue-no-base",
+            baseBranch: "main",
+            reuseBranch: false,
+        });
+        assert.equal(resolved.kind, "base_unavailable");
+        if (resolved.kind === "base_unavailable")
+            assert.match(resolved.reason, /fetch/i);
+        assert.equal(await branchExists(isoRepo, "issue-no-base"), false, "a failed fetch must never fall back to cutting the branch from the stale local base");
+    }
+    finally {
+        fs.rmSync(isoRepo, { recursive: true, force: true });
+        fs.rmSync(isoRemote, { recursive: true, force: true });
+    }
+});
+test("NOT-197: the reuse path checks out the existing branch without fetching", async () => {
+    const { isoRepo, isoRemote } = makeIsoRepoPair("reuse");
+    try {
+        git(isoRepo, "branch", "issue-reuse-197");
+        // Break origin so thoroughly that any fetch attempt would fail — reuse must not care.
+        git(isoRepo, "remote", "set-url", "origin", path.join(isoRemote, "does-not-exist.git"));
+        const broken = await fetchFreshBase(isoRepo, "main");
+        assert.equal(broken.ok, false, "sanity: a fetch against this origin really does fail");
+        const leftover = await createRoleWorktree({ repo: isoRepo, role: "developer", sessionId: "s-reuse-left", ref: "issue-reuse-197" });
+        const resolved = await resolveDeveloperWorktree({
+            repo: isoRepo,
+            sessionId: "s-reuse-new",
+            branchName: "issue-reuse-197",
+            baseBranch: "main",
+            reuseBranch: true,
+        });
+        assert.equal(resolved.kind, "reused");
+        if (resolved.kind === "reused")
+            assert.equal(resolved.path, leftover.path);
+        fs.rmSync(leftover.path, { recursive: true, force: true });
+        await withRepoLock(isoRepo, async () => execFileSync("git", ["worktree", "prune"], { cwd: isoRepo }));
+        execFileSync("git", ["branch", "-D", "issue-reuse-197"], { cwd: isoRepo });
+    }
+    finally {
+        fs.rmSync(isoRepo, { recursive: true, force: true });
+        fs.rmSync(isoRemote, { recursive: true, force: true });
+    }
+});
+test("NOT-197: fetchFreshBase bounds a hanging fetch with a timeout instead of hanging", async () => {
+    const { isoRepo, isoRemote } = makeIsoRepoPair("timeout");
+    try {
+        // An ssh remote whose "ssh" is a script that sleeps: the fetch can only end when our
+        // timeout kills it, so this deterministically exercises the timeout classification.
+        const sleeper = path.join(isoRepo, "fake-ssh.sh");
+        fs.writeFileSync(sleeper, "#!/bin/sh\nsleep 30\n");
+        fs.chmodSync(sleeper, 0o755);
+        git(isoRepo, "remote", "set-url", "origin", "ssh://git@example.invalid/repo.git");
+        git(isoRepo, "config", "core.sshCommand", sleeper);
+        const startedAt = Date.now();
+        const result = await fetchFreshBase(isoRepo, "main", 1000);
+        const elapsedMs = Date.now() - startedAt;
+        assert.equal(result.ok, false);
+        if (!result.ok)
+            assert.match(result.reason, /timed out/);
+        assert.ok(elapsedMs < 20_000, `the fetch must be bounded (took ${elapsedMs}ms)`);
+    }
+    finally {
+        fs.rmSync(isoRepo, { recursive: true, force: true });
+        fs.rmSync(isoRemote, { recursive: true, force: true });
+    }
+});
+test("NOT-197: fetchFreshBase uses the local base as-is when the repo has no origin remote", async () => {
+    const bare = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-wt197-noorigin-"));
+    try {
+        git(bare, "init", "-b", "main");
+        git(bare, "config", "user.email", "test@example.com");
+        git(bare, "config", "user.name", "Test");
+        fs.writeFileSync(path.join(bare, "README.md"), "hello\n");
+        git(bare, "add", ".");
+        git(bare, "commit", "-m", "init");
+        const result = await fetchFreshBase(bare, "main");
+        assert.equal(result.ok, true);
+        if (result.ok) {
+            assert.equal(result.ref, "main");
+            assert.equal(result.sha, git(bare, "rev-parse", "main"));
+        }
+    }
+    finally {
+        fs.rmSync(bare, { recursive: true, force: true });
+    }
+});

package/bundle/server/dist/coordinator/auto-merge.js

@@ -28,6 +28,7 @@ import { getDb } from "../db/index.js";
 import { getIssue, listIssues, transitionIssue } from "../repository/issues.js";
 import { appendWorkflowEvent, completeWorkflowInstance, getActiveWorkflowInstance, } from "../repository/workflow-events.js";
 import { createHumanAction, findOpenHumanAction, resolveHumanAction, } from "../repository/human-actions.js";
+import { MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS } from "./human-resolution.js";
 const run = promisify(execFile);
 /** Bound each `gh` shell-out so a hang cannot freeze the coordinator process. */
 export const GH_MERGE_TIMEOUT_MS = 20_000;
@@ -291,16 +292,20 @@ function escalateMergeFailure(issue, workflowInstanceId, reason) {
             currentOwner: "human",
             currentIntent: reason,
         });
+        // NOT-194: the work is approved, so "Resume development" is wrong. Offer a merge
+        // retry on the current PR head, another repair round (same as final_review:repair),
+        // or close. The reason keeps the underlying failure text verbatim so the operator can
+        // pick retry vs repair. Evidence marks this as a merge failure for per-action choice
+        // narrowing in resolveHumanActionAndAdvance (pre-NOT-194 open actions have no such
+        // evidence and still resolve through resume).
         const action = createHumanAction({
             issueId: issue.id,
             workflowInstanceId,
             actionType: "policy_escalation",
             reason,
-            question: `${reason} Resume development, or close the issue?`,
-            responseOptions: [
-                { choice: "resume", label: "Resume development" },
-                { choice: "close", label: "Close" },
-            ],
+            question: `${reason} Retry the merge, queue another repair round, or close the issue?`,
+            evidence: { [MERGE_FAILURE_EVIDENCE_KEY]: true },
+            responseOptions: [...MERGE_FAILURE_RESPONSE_OPTIONS],
         });
         appendWorkflowEvent({
             issueId: issue.id,