agent-dealer 1.1.7 → 1.1.9

package/bundle/server/dist/adapters/agent-health.js

@@ -299,25 +299,83 @@ function claudeUsesThirdPartyProvider() {
  */
 export async function githubIssuesUncached() {
     const status = await runCommand("gh", ["auth", "status"]);
-    const out = status.output.toLowerCase();
-    if (out.includes("enoent") ||
+    return classifyGithubAuthStatus({
+        ok: status.ok,
+        output: status.output,
+        timedOut: status.timedOut,
+    });
+}
+const GITHUB_CLI_MISSING_MESSAGE = "gh CLI not found — install GitHub CLI (`gh`)";
+const GITHUB_AUTH_MESSAGE = "Run `gh auth login` — GitHub CLI auth required to open PRs";
+const GITHUB_UNREACHABLE_MESSAGE = "Can't reach GitHub (network or keyring timeout) — check your VPN; Dealer will retry";
+/**
+ * Output fragments naming a timeout, TLS handshake, DNS or connection failure.
+ * Matched against lowercased `gh` output. `timedout` (no space) covers ETIMEDOUT;
+ * `timeout` covers gh's own "Timeout trying to log in … (keyring)" and the
+ * "timeout while trying to … secret in/from keyring" variants.
+ */
+const GITHUB_UNREACHABLE_PATTERNS = [
+    "timed out",
+    "timeout",
+    "timedout",
+    "tls",
+    "ssl",
+    "handshake",
+    "certificate",
+    "dns",
+    "could not resolve",
+    "no such host",
+    "name resolution",
+    "eai_again",
+    "enotfound",
+    "getaddrinfo",
+    "connection refused",
+    "connection reset",
+    "failed to connect",
+    "could not connect",
+    "network is unreachable",
+    "network unreachable",
+    "econnrefused",
+    "econnreset",
+    "ehostunreach",
+    "enetunreach",
+    "econnaborted",
+    "socket hang up",
+];
+/**
+ * NOT-195: one `gh auth status` classifier shared by the async (`runCommand`) and
+ * sync (`spawnSync`) paths. Four cases, checked in order:
+ *
+ * 1. CLI missing — `ENOENT` (or the pre-existing not-found texts) only. A spawn
+ *    timeout also sets the sync `error`, so any-error-means-missing misread a slow
+ *    network as an absent binary.
+ * 2. Unreachable — spawn timeout, `ETIMEDOUT`, or output naming a timeout / TLS /
+ *    DNS / connection failure. Checked before auth because gh maps some
+ *    connectivity failures onto login/token wording (and the keyring-login timeout
+ *    names neither). Transient: callers defer and retry.
+ * 3. Logged out / invalid token — the pre-existing texts, or any other non-zero exit.
+ * 4. Healthy.
+ */
+export function classifyGithubAuthStatus(probe) {
+    const out = probe.output.toLowerCase();
+    if (probe.spawnErrorCode === "ENOENT" ||
+        out.includes("enoent") ||
         out.includes("not found") ||
-        out.includes("no such file") ||
-        (out.includes("spawn") && out.includes("gh"))) {
-        return [{ code: "github_cli_missing", message: "gh CLI not found — install GitHub CLI (`gh`)" }];
+        out.includes("no such file")) {
+        return [{ code: "github_cli_missing", message: GITHUB_CLI_MISSING_MESSAGE }];
     }
-    if (!status.ok ||
+    if (probe.timedOut ||
+        probe.spawnErrorCode === "ETIMEDOUT" ||
+        GITHUB_UNREACHABLE_PATTERNS.some((p) => out.includes(p))) {
+        return [{ code: "github_unreachable", message: GITHUB_UNREACHABLE_MESSAGE }];
+    }
+    if (!probe.ok ||
         out.includes("not logged in") ||
         out.includes("failed to log in") ||
         out.includes("token in keyring is invalid") ||
         out.includes("re-authenticate") ||
         out.includes("to re-authenticate")) {
-        return [
-            {
-                code: "github_auth",
-                message: "Run `gh auth login` — GitHub CLI auth required to open PRs",
-            },
-        ];
+        return [{ code: "github_auth", message: GITHUB_AUTH_MESSAGE }];
     }
     return [];
 }
@@ -343,27 +401,14 @@ export function githubIssuesSync() {
         env: process.env,
     });
     const output = `${result.stdout ?? ""}${result.stderr ?? ""}${result.error?.message ?? ""}`;
-    const out = output.toLowerCase();
-    let issues = [];
-    if (result.error ||
-        out.includes("enoent") ||
-        out.includes("not found") ||
-        out.includes("no such file")) {
-        issues = [{ code: "github_cli_missing", message: "gh CLI not found — install GitHub CLI (`gh`)" }];
-    }
-    else if (result.status !== 0 ||
-        out.includes("not logged in") ||
-        out.includes("failed to log in") ||
-        out.includes("token in keyring is invalid") ||
-        out.includes("re-authenticate") ||
-        out.includes("to re-authenticate")) {
-        issues = [
-            {
-                code: "github_auth",
-                message: "Run `gh auth login` — GitHub CLI auth required to open PRs",
-            },
-        ];
-    }
+    // NOT-195: same four-case classifier as the async path — a spawnSync timeout sets
+    // `error` (ETIMEDOUT), which must not read as a missing CLI.
+    const issues = classifyGithubAuthStatus({
+        ok: result.status === 0,
+        output,
+        timedOut: result.error?.code === "ETIMEDOUT",
+        spawnErrorCode: result.error?.code,
+    });
     githubIssueCache = { at: Date.now(), issues };
     return issues;
 }

package/bundle/server/dist/adapters/agent-health.test.js

@@ -15,7 +15,7 @@ import { fileURLToPath } from "node:url";
 process.env.AGENT_DEALER_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-agenthealth-"));
 const { migrate, getDb } = await import("../db/index.js");
 const { createAgent, getAgent } = await import("../repository/agents.js");
-const { healthForAgent, runtimeIssuesUncached, githubIssuesUncached, clearAgentHealthCaches, setCursorProbeTimingForTests, setRunCommandForTests, } = await import("./agent-health.js");
+const { healthForAgent, runtimeIssuesUncached, githubIssuesUncached, githubIssuesSync, classifyGithubAuthStatus, clearAgentHealthCaches, setCursorProbeTimingForTests, setRunCommandForTests, } = await import("./agent-health.js");
 migrate();
 const FAILURE = { ok: false, code: "DECK_UNAVAILABLE", message: "Agent Deck API error: 502" };
 /** Tests inject an empty github list so host `gh auth` does not pollute assertions. */
@@ -461,4 +461,158 @@ The keychain item is stuck. Delete it and sign in again:
         assert.match(issue.message, /expected 127\.0\.0\.1:1110/);
         assert.equal(issue.message.includes("Run agent-deck setup"), false);
     });
+    // ---------------------------------------------------------------------------
+    // NOT-195: a `gh` timeout is a transient network problem (`github_unreachable`),
+    // not "gh CLI not found" or "Run `gh auth login`". Fixtures in
+    // packages/shared/src/fixtures/runtime-auth/gh-auth-status-*.txt.
+    // ---------------------------------------------------------------------------
+    const GH_FIXTURE = (name) => fs.readFileSync(path.join(FIXTURES, name), "utf8");
+    async function uncachedWithGhOutput(output, ok) {
+        setRunCommandForTests(async () => ({ ok, output, timedOut: false }));
+        clearAgentHealthCaches();
+        try {
+            return await githubIssuesUncached();
+        }
+        finally {
+            setRunCommandForTests(null);
+            clearAgentHealthCaches();
+        }
+    }
+    test("NOT-195: keyring-timeout capture reports github_unreachable, not github_auth", async () => {
+        const issues = await uncachedWithGhOutput(GH_FIXTURE("gh-auth-status-keyring-timeout.txt"), false);
+        assert.deepEqual(issues.map((i) => i.code), ["github_unreachable"]);
+        assert.match(issues[0].message, /Can't reach GitHub/);
+        assert.match(issues[0].message, /VPN/);
+        assert.doesNotMatch(issues[0].message, /gh auth login/);
+    });
+    test("NOT-195: logged-out capture still reports github_auth with the gh auth login message", async () => {
+        const issues = await uncachedWithGhOutput(GH_FIXTURE("gh-auth-status-logged-out.txt"), false);
+        assert.deepEqual(issues.map((i) => i.code), ["github_auth"]);
+        assert.match(issues[0].message, /gh auth login/);
+    });
+    test("NOT-195: invalid-token capture still reports github_auth with the gh auth login message", async () => {
+        const issues = await uncachedWithGhOutput(GH_FIXTURE("gh-auth-status-invalid-token.txt"), false);
+        assert.deepEqual(issues.map((i) => i.code), ["github_auth"]);
+        assert.match(issues[0].message, /gh auth login/);
+    });
+    test("NOT-195: logged-in capture leaves github health empty", async () => {
+        const issues = await uncachedWithGhOutput(GH_FIXTURE("gh-auth-status-logged-in.txt"), true);
+        assert.deepEqual(issues, []);
+    });
+    test("NOT-195: an async probe timeout reports github_unreachable, not github_cli_missing", async () => {
+        setRunCommandForTests(async () => ({ ok: false, output: "timeout", timedOut: true }));
+        clearAgentHealthCaches();
+        try {
+            const issues = await githubIssuesUncached();
+            assert.deepEqual(issues.map((i) => i.code), ["github_unreachable"]);
+        }
+        finally {
+            setRunCommandForTests(null);
+            clearAgentHealthCaches();
+        }
+    });
+    test("NOT-195: ETIMEDOUT reports github_unreachable; only ENOENT reports github_cli_missing", async () => {
+        // Sync spawnSync shapes: a timeout sets error.code ETIMEDOUT, a missing binary ENOENT.
+        const timedOut = classifyGithubAuthStatus({
+            ok: false,
+            output: "spawnSync gh ETIMEDOUT",
+            timedOut: true,
+            spawnErrorCode: "ETIMEDOUT",
+        });
+        assert.deepEqual(timedOut.map((i) => i.code), ["github_unreachable"]);
+        const etimedoutOutput = classifyGithubAuthStatus({
+            ok: false,
+            output: "spawnSync gh ETIMEDOUT",
+            timedOut: false,
+            spawnErrorCode: "ETIMEDOUT",
+        });
+        assert.deepEqual(etimedoutOutput.map((i) => i.code), ["github_unreachable"]);
+        const missing = classifyGithubAuthStatus({
+            ok: false,
+            output: "spawnSync gh ENOENT",
+            timedOut: false,
+            spawnErrorCode: "ENOENT",
+        });
+        assert.deepEqual(missing.map((i) => i.code), ["github_cli_missing"]);
+        // A non-ENOENT spawn failure must not read as a missing CLI (fail-closed as auth).
+        const otherSpawnError = classifyGithubAuthStatus({
+            ok: false,
+            output: "spawnSync gh EACCES",
+            timedOut: false,
+            spawnErrorCode: "EACCES",
+        });
+        assert.deepEqual(otherSpawnError.map((i) => i.code), ["github_auth"]);
+        // gh's sibling token-path timeout variant (format verified in the gh 2.78.0 binary:
+        // "%s Timeout trying to log in to %s using token (%s)") is unreachable too.
+        const tokenTimeout = classifyGithubAuthStatus({
+            ok: false,
+            output: "ghe.example.com\n  X Timeout trying to log in to ghe.example.com using token (GH_TOKEN)",
+            timedOut: false,
+        });
+        assert.deepEqual(tokenTimeout.map((i) => i.code), ["github_unreachable"]);
+    });
+    /** A `gh` stub on PATH that prints a captured fixture verbatim and exits with the captured code. */
+    function stubGhOnPath(fixture, exitCode) {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-gh-stub-"));
+        const bin = path.join(dir, "gh");
+        fs.writeFileSync(bin, `#!/bin/sh\ncat ${JSON.stringify(path.join(FIXTURES, fixture))}\nexit ${exitCode}\n`);
+        fs.chmodSync(bin, 0o755);
+        const prevPath = process.env.PATH ?? "";
+        process.env.PATH = `${dir}${path.delimiter}${prevPath}`;
+        return prevPath;
+    }
+    /**
+     * The sync entry point, through the real spawnSync plumbing. `test:unit` sets
+     * AGENT_DEALER_SKIP_GITHUB_HEALTH=1, which would short-circuit to [] — clear it so
+     * the classifier actually runs.
+     */
+    function syncWithStubGh(fixture, exitCode) {
+        const prevPath = stubGhOnPath(fixture, exitCode);
+        const prevSkip = process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH;
+        delete process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH;
+        clearAgentHealthCaches();
+        try {
+            return githubIssuesSync();
+        }
+        finally {
+            process.env.PATH = prevPath;
+            if (prevSkip === undefined)
+                delete process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH;
+            else
+                process.env.AGENT_DEALER_SKIP_GITHUB_HEALTH = prevSkip;
+            clearAgentHealthCaches();
+        }
+    }
+    test("NOT-195: githubIssuesSync follows the same classification over the three fixtures", async () => {
+        const unreachable = syncWithStubGh("gh-auth-status-keyring-timeout.txt", 1);
+        assert.deepEqual(unreachable.map((i) => i.code), ["github_unreachable"]);
+        assert.match(unreachable[0].message, /Can't reach GitHub/);
+        const loggedOut = syncWithStubGh("gh-auth-status-logged-out.txt", 1);
+        assert.deepEqual(loggedOut.map((i) => i.code), ["github_auth"]);
+        assert.match(loggedOut[0].message, /gh auth login/);
+        const invalidToken = syncWithStubGh("gh-auth-status-invalid-token.txt", 1);
+        assert.deepEqual(invalidToken.map((i) => i.code), ["github_auth"]);
+        const healthy = syncWithStubGh("gh-auth-status-logged-in.txt", 0);
+        assert.deepEqual(healthy, []);
+    });
+    test("NOT-195: github_unreachable marks the agent unhealthy so admission/review defers without spending an attempt", async () => {
+        // Any nonCap health issue fails checkRoleAgentHealthy, and the worker loop routes
+        // that through the existing deferLeasedWorkItemForAgentUnhealthy infra-defer path
+        // (agent_unhealthy outcome — no infra attempt, no review round spent), exactly as
+        // github_auth already behaves. No new wiring: the code IS the defer path.
+        const agent = createAgent({
+            name: "gh-down",
+            runtime: "claude_code",
+            deckId: "00000000-0000-4000-a000-000000000099",
+        });
+        const gh = classifyGithubAuthStatus({
+            ok: false,
+            output: GH_FIXTURE("gh-auth-status-keyring-timeout.txt"),
+            timedOut: false,
+        });
+        assert.deepEqual(gh.map((i) => i.code), ["github_unreachable"]);
+        const result = await healthForAgent(agent, true, new Map(), true, null, gh);
+        assert.equal(result.healthy, false);
+        assert.equal(result.issues.some((i) => i.code === "github_unreachable"), true);
+    });
 }); // describe agent-health (serial)

package/bundle/server/dist/adapters/linear-inbox.js

@@ -1,3 +1,4 @@
+import { resolveLinearRepoLabels } from "@agent-dealer/shared";
 import { DEFAULT_LINEAR_STATE_FILTER, getLinearIntakeConfig } from "../repository/intake-settings.js";
 import { linearGraphqlRequest } from "./linear-graphql.js";
 export { DEFAULT_LINEAR_STATE_FILTER };
@@ -13,7 +14,14 @@ async function linearQuery(operation, query, variables, opts) {
         timeoutMs: opts?.timeoutMs,
     });
 }
-function nodeToCandidate(n) {
+/**
+ * NOT-242: every candidate carries a server-resolved repository hint read from
+ * explicit `repo:` labels. Raw labels stay on the candidate; resolution is
+ * deterministic (one valid label resolves, zero is unresolved, several
+ * conflict, a bad value is invalid) and never guesses from anything else.
+ */
+export function nodeToCandidate(n) {
+    const labels = n.labels?.nodes.map((l) => l.name) ?? [];
     return {
         id: n.id,
         identifier: n.identifier,
@@ -22,7 +30,8 @@ function nodeToCandidate(n) {
         url: n.url,
         state: n.state?.name,
         teamId: n.team?.id,
-        labels: n.labels?.nodes.map((l) => l.name) ?? [],
+        labels,
+        repoResolution: resolveLinearRepoLabels(labels),
     };
 }
 const ISSUE_FIELDS = `

package/bundle/server/dist/adapters/linear-inbox.test.js

@@ -1,6 +1,6 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { buildIssueFilter, parseLinearIssueRef } from "./linear-inbox.js";
+import { buildIssueFilter, nodeToCandidate, parseLinearIssueRef } from "./linear-inbox.js";
 test("parseLinearIssueRef accepts identifier, URL, and UUID", () => {
     assert.equal(parseLinearIssueRef("NOT-103"), "NOT-103");
     assert.equal(parseLinearIssueRef("  not-90  "), "NOT-90");
@@ -21,6 +21,54 @@ test("buildIssueFilter omits assignee when assigneeMe is false", () => {
         team: { id: { eq: "team-1" } },
     });
 });
+test("nodeToCandidate resolves exactly one repo: label to the canonical identity", () => {
+    const c = nodeToCandidate({
+        id: "uuid-1",
+        identifier: "NOT-242",
+        title: "t",
+        url: "https://linear.app/not-so-fat/issue/NOT-242/t",
+        labels: { nodes: [{ name: "agent-dealer" }, { name: "repo:github.com/not-so-fat/agent-dealer" }] },
+    });
+    // Raw labels stay available alongside the resolved hint.
+    assert.deepEqual(c.labels, ["agent-dealer", "repo:github.com/not-so-fat/agent-dealer"]);
+    assert.equal(c.repoResolution?.status, "resolved");
+    assert.equal(c.repoResolution?.repository, "github.com/not-so-fat/agent-dealer");
+    assert.equal(c.repoResolution?.sourceLabel, "repo:github.com/not-so-fat/agent-dealer");
+});
+test("nodeToCandidate leaves zero repo: labels unresolved and conflicts several", () => {
+    const none = nodeToCandidate({
+        id: "uuid-1",
+        identifier: "NOT-1",
+        title: "t",
+        url: "https://linear.app/x/issue/NOT-1/t",
+        labels: { nodes: [{ name: "agent-dealer" }] },
+    });
+    assert.equal(none.repoResolution?.status, "unresolved");
+    assert.equal(none.repoResolution?.repository, undefined);
+    const conflict = nodeToCandidate({
+        id: "uuid-2",
+        identifier: "NOT-2",
+        title: "t",
+        url: "https://linear.app/x/issue/NOT-2/t",
+        labels: { nodes: [{ name: "repo:github.com/a/one" }, { name: "repo:github.com/b/two" }] },
+    });
+    assert.equal(conflict.repoResolution?.status, "conflict");
+    assert.equal(conflict.repoResolution?.repository, undefined);
+    assert.deepEqual(conflict.repoResolution?.labels, ["repo:github.com/a/one", "repo:github.com/b/two"]);
+});
+test("nodeToCandidate marks a non-GitHub repo: value invalid", () => {
+    const c = nodeToCandidate({
+        id: "uuid-3",
+        identifier: "NOT-3",
+        title: "t",
+        url: "https://linear.app/x/issue/NOT-3/t",
+        labels: { nodes: [{ name: "repo:https://gitlab.com/acme/app" }] },
+    });
+    assert.equal(c.repoResolution?.status, "invalid");
+    assert.equal(c.repoResolution?.repository, undefined);
+    assert.deepEqual(c.repoResolution?.labels, ["repo:https://gitlab.com/acme/app"]);
+    assert.ok(c.repoResolution?.error);
+});
 test("buildIssueFilter includes assignee when assigneeMe is true", () => {
     const filter = buildIssueFilter({
         stateFilter: ["Todo"],

package/bundle/server/dist/coordinator/admission.test.js

@@ -716,3 +716,38 @@ test("NOT-157: soft Cursor probe timeout waits with probe-timeout reason, not lo
         setAdmissionHealthCheckerForTests(async () => ({ ok: true }));
     }
 });
+// ---------------------------------------------------------------------------
+// NOT-239: Close issue vs the admission tick — exactly one terminal outcome.
+// ---------------------------------------------------------------------------
+test("NOT-239: closing the queue head lets the next tick admit the following issue", async () => {
+    const { closeReadyIssue } = await import("./commands.js");
+    const head = readyIssue("close-head");
+    const next = readyIssue("close-next");
+    enqueueIssue(head.id);
+    enqueueIssue(next.id);
+    // Close wins the race: the head retires without ever starting.
+    assert.deepEqual(closeReadyIssue(head.id, "web"), {
+        ok: true,
+        issueStatus: "closed",
+        alreadyClosed: false,
+    });
+    const admitted = await admitNext();
+    assert.equal(admitted?.issueId, next.id, "the tick fills the freed slot with the next issue");
+    assert.equal(getIssue(next.id).status, "developing");
+    assert.equal(getIssue(head.id).status, "closed");
+    assert.equal(instanceCount(head.id), 0, "close created no workflow instance");
+    assert.equal(instanceCount(next.id), 1);
+});
+test("NOT-239: a tick that admitted first makes a late close refuse", async () => {
+    const { closeReadyIssue } = await import("./commands.js");
+    const issue = readyIssue("close-late");
+    enqueueIssue(issue.id);
+    const admitted = await admitNext();
+    assert.equal(admitted?.issueId, issue.id);
+    const late = closeReadyIssue(issue.id, "web");
+    assert.equal(late.ok, false);
+    if (late.ok)
+        throw new Error("expected the late close to refuse");
+    assert.equal(late.code, 409);
+    assert.equal(getIssue(issue.id).status, "developing");
+});