agent-dealer 1.2.7 → 1.2.9

package/bundle/server/dist/adapters/agent-deck-bind.js

@@ -153,20 +153,29 @@ function readAmbientCodexAuthPolicy(ambientCodexHome) {
         return {};
     }
 }
-function deckLaunchHeaders(deckId, worktreePath) {
-    return {
+/**
+ * NOT-305: header carrying the session's opaque Deck correlation UUID. Observability
+ * metadata only — Deck uses it to attribute its normalized playbook-fetch stream back
+ * to this durable Dealer session; it grants no authority.
+ */
+export const DECK_CORRELATION_HEADER = "x-agent-deck-correlation-id";
+function deckLaunchHeaders(deckId, worktreePath, correlationId) {
+    const headers = {
         "x-agent-deck-deck-id": deckId,
         "x-agent-deck-workspace": worktreePath,
     };
+    if (correlationId)
+        headers[DECK_CORRELATION_HEADER] = correlationId;
+    return headers;
 }
 /** claude's `--mcp-config` file schema — deck headers only, no Authorization. */
-function urlHeaderMcpConfig(mcpUrl, deckId, worktreePath) {
+function urlHeaderMcpConfig(mcpUrl, deckId, worktreePath, correlationId) {
     return {
         mcpServers: {
             "agent-deck": {
                 type: "http",
                 url: mcpUrl,
-                headers: deckLaunchHeaders(deckId, worktreePath),
+                headers: deckLaunchHeaders(deckId, worktreePath, correlationId),
             },
         },
     };
@@ -202,7 +211,7 @@ function ensureCursorMcpExcluded(worktreePath) {
 async function materializeWorkerMcpConfig(opts) {
     const mcpBase = getAgentDeckMcpUrl().replace(/\/mcp\/?$/, "");
     const mcpUrl = `${mcpBase}/mcp`;
-    const headers = deckLaunchHeaders(opts.deckId, opts.worktreePath);
+    const headers = deckLaunchHeaders(opts.deckId, opts.worktreePath, opts.correlationId);
     // NOT-278: Muse Code settings come only from `prepareMuseAttempt`
     // (runners/muse-config.ts) — never emit a Claude/Codex/Cursor config for Muse. Refuse
     // before anything is written rather than fall through to the Claude config below.
@@ -257,7 +266,7 @@ async function materializeWorkerMcpConfig(opts) {
     const dir = getWorkerMcpConfigDir();
     const filePath = path.join(dir, `claude-mcp-${opts.deckId.slice(0, 8)}-${randomUUID()}.json`);
     try {
-        fs.writeFileSync(filePath, JSON.stringify(urlHeaderMcpConfig(mcpUrl, opts.deckId, opts.worktreePath)), { mode: 0o600 });
+        fs.writeFileSync(filePath, JSON.stringify(urlHeaderMcpConfig(mcpUrl, opts.deckId, opts.worktreePath, opts.correlationId)), { mode: 0o600 });
     }
     catch (err) {
         fs.rmSync(filePath, { force: true });
@@ -416,6 +425,7 @@ export async function prepareWorkerDeckConnection(opts) {
             deckId: opts.deckId,
             worktreePath: opts.worktreePath,
             policy: opts.policy,
+            correlationId: opts.correlationId,
         });
     }
     catch (err) {

package/bundle/server/dist/adapters/agent-deck-bind.test.js

@@ -528,3 +528,77 @@ test("a deck that loses the connection mid-playbook is deck_unavailable", async
     if (!result.ok)
         assert.equal(result.kind, "deck_unavailable");
 });
+// NOT-305: every new worker session persists an opaque Deck correlation UUID before
+// spawn, and every runtime launch config carries it as the exact
+// `x-agent-deck-correlation-id` observability header (never authority).
+const CORRELATION_ID = "aaaaaaaa-1111-4111-a111-aaaaaaaaaaaa";
+test("prepareWorkerDeckConnection writes the exact correlation header for claude_code", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        correlationId: CORRELATION_ID,
+        verifyCallTool: async (name) => {
+            assert.equal(name, "get_bound_deck");
+            return textResult({ id: DECK, name: "personal-dev" });
+        },
+    });
+    assert.equal(result.ok, true);
+    if (result.ok) {
+        const written = JSON.parse(fs.readFileSync(result.mcpConfigPath, "utf8"));
+        const headers = written.mcpServers["agent-deck"].headers;
+        assert.equal(headers["x-agent-deck-correlation-id"], CORRELATION_ID);
+        await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+    }
+});
+test("prepareWorkerDeckConnection omits the correlation header when the session has none", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        verifyCallTool: async () => textResult({ id: DECK, name: "personal-dev" }),
+    });
+    assert.equal(result.ok, true);
+    if (result.ok) {
+        const written = JSON.parse(fs.readFileSync(result.mcpConfigPath, "utf8"));
+        const headers = written.mcpServers["agent-deck"].headers;
+        assert.equal("x-agent-deck-correlation-id" in headers, false);
+        await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+    }
+});
+test("prepareWorkerDeckConnection writes the exact correlation header for codex_local", async () => {
+    const result = await prepareWorkerDeckConnection({
+        policy: DENIED,
+        ...BASE_OPTS,
+        runtime: "codex_local",
+        correlationId: CORRELATION_ID,
+        verifyCallTool: async () => textResult({ id: DECK }),
+    });
+    assert.equal(result.ok, true);
+    if (result.ok) {
+        const toml = fs.readFileSync(path.join(result.mcpConfigPath, "config.toml"), "utf8");
+        assert.match(toml, new RegExp(`x-agent-deck-correlation-id = "${CORRELATION_ID}"`));
+        await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+    }
+});
+test("prepareWorkerDeckConnection writes the exact correlation header for cursor_local", async () => {
+    const repo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-cursor-correlation-"));
+    initGitRepo(repo);
+    try {
+        const result = await prepareWorkerDeckConnection({
+            policy: DENIED,
+            deckId: DECK,
+            worktreePath: repo,
+            runtime: "cursor_local",
+            correlationId: CORRELATION_ID,
+            verifyCallTool: async () => textResult({ id: DECK }),
+        });
+        assert.equal(result.ok, true);
+        if (result.ok) {
+            const written = JSON.parse(fs.readFileSync(result.mcpConfigPath, "utf8"));
+            assert.equal(written.mcpServers["agent-deck"].headers["x-agent-deck-correlation-id"], CORRELATION_ID);
+            await releaseWorkerDeckConnection({ mcpConfigPath: result.mcpConfigPath });
+        }
+    }
+    finally {
+        fs.rmSync(repo, { recursive: true, force: true });
+    }
+});

package/bundle/server/dist/adapters/agent-health.js

@@ -107,6 +107,15 @@ export function setRunCommandForTests(fn) {
 function runCommand(cmd, args, timeoutMs = DEFAULT_PROBE_TIMEOUT_MS, env) {
     return runCommandImpl(cmd, args, timeoutMs, env);
 }
+/**
+ * NOT-308: drop only the cached muse runtime issues — the `muse_capability` acknowledge
+ * path calls this so the lifted block is seen on the next health read instead of after
+ * the 60s TTL. Never touches capability state itself (unlike clearAgentHealthCaches,
+ * which resets it for tests).
+ */
+export function invalidateMuseHealthCache() {
+    runtimeIssueCache.delete("muse_code");
+}
 /** Exported for tests — clears the shared github + runtime health caches and soft-fail streak. */
 export function clearAgentHealthCaches() {
     runtimeIssueCache.clear();
@@ -199,9 +208,11 @@ async function cursorRuntimeIssues() {
  * existence only, never read.
  *
  * NOT-277: with CLI and credentials present, the reported version is handed to the capability
- * check — a version not yet checked runs one real developer-shell probe (muse-capability.ts);
- * `runtime_capability` blocks while it runs, when it finds shell/write missing, or when it could
- * not complete.
+ * check — a version not yet checked runs one real developer-shell probe (muse-capability.ts).
+ * NOT-308: `runtime_capability` blocks only on a confirmed shell/write loss (`missing`,
+ * not operator-overridden); while the version is unchecked or inconclusive the check
+ * runs in the background and admission proceeds on the last confirmed baseline
+ * (fresh installs with no baseline still fail closed).
  */
 async function museRuntimeIssues() {
     const bin = resolveMuseBin();

package/bundle/server/dist/adapters/github.js

@@ -386,6 +386,14 @@ export function createGithubAdapter(exec = defaultExec) {
                 return null;
             }
         },
+        async hasPullRequestWorkflow({ cwd, baseRef }) {
+            try {
+                return await baseRefHasPullRequestWorkflow(cwd, baseRef);
+            }
+            catch {
+                return null;
+            }
+        },
         async publishReview({ cwd, number, event, bodyFilePath }) {
             const result = await runReview(exec, cwd, number, event, bodyFilePath);
             if (result.ok || event === "COMMENT" || !OWN_PR_REVIEW_PATTERN.test(result.reason)) {
@@ -491,6 +499,64 @@ export async function fetchChecksFailureEvidence(exec, opts) {
         details,
     };
 }
+/**
+ * NOT-311: does `origin/<baseRef>` contain a workflow triggered by `pull_request`?
+ * False when the tree has no workflow files at all; null when the tree itself cannot
+ * be read (unknown base ref, unparsable git output) so the caller waits fail-closed.
+ */
+export async function baseRefHasPullRequestWorkflow(cwd, baseRef) {
+    let listing;
+    try {
+        // `-r`: without it ls-tree prints the workflows *directory* entry itself rather
+        // than the files under it, so the scan would never see a workflow (NOT-311).
+        listing = (await run("git", ["ls-tree", "-r", `origin/${baseRef}`, "--name-only", ".github/workflows"], { cwd })).stdout;
+    }
+    catch {
+        return null;
+    }
+    const files = listing
+        .split("\n")
+        .map((s) => s.trim())
+        .filter((f) => f && /\.(ya?ml)$/i.test(f));
+    if (files.length === 0)
+        return false;
+    for (const file of files) {
+        let content;
+        try {
+            content = (await run("git", ["show", `origin/${baseRef}:${file}`], { cwd })).stdout;
+        }
+        catch {
+            return null;
+        }
+        if (workflowHasPullRequestTrigger(content))
+            return true;
+    }
+    return false;
+}
+/**
+ * Heuristic `on:` trigger scan: matches inline (`on: pull_request`,
+ * `on: [push, pull_request]`) and block forms. Stops at the next top-level key so a
+ * later `pull_request` mention outside `on:` (a job name, a comment) cannot qualify.
+ * Leans toward waiting — a false positive only costs CI-wait backoff, while a false
+ * negative would send an unverified PR to review.
+ */
+export function workflowHasPullRequestTrigger(content) {
+    const lines = content.split("\n");
+    const onIdx = lines.findIndex((l) => /^\s*on\s*:/.test(l));
+    if (onIdx < 0)
+        return false;
+    const onLine = lines[onIdx];
+    if (/\bpull_request\b/.test(onLine.slice(onLine.indexOf("on") + 2)))
+        return true;
+    for (let i = onIdx + 1; i < lines.length; i++) {
+        const line = lines[i];
+        if (/^\S/.test(line))
+            break;
+        if (/\bpull_request\b/.test(line.replace(/#.*$/, "")))
+            return true;
+    }
+    return false;
+}
 export const realGithubAdapter = createGithubAdapter();
 const REVIEW_FLAG = {
     APPROVE: "--approve",
@@ -527,25 +593,38 @@ const NONE_STREAK_REQUIRED = 2;
  * between resets the streak); if the deadline is hit before that streak completes, the
  * poll fails closed as "timeout" rather than silently waving the handoff through.
  */
-export async function pollPrChecks(adapter, opts) {
+export async function pollPrChecks(
+// NOT-310: narrowed to what the poll actually calls — the merge-conflict sync
+// passes only a checks reader, and full adapters still satisfy this shape.
+adapter, opts) {
+    return (await pollPrChecksDetailed(adapter, opts)).result;
+}
+/**
+ * NOT-311: same bounded poll as {@link pollPrChecks}, but reporting what was last
+ * seen and whether an abort cut the wait short. `pollPrChecks` keeps the collapsed
+ * contract for callers that only branch on the result.
+ */
+export async function pollPrChecksDetailed(adapter, opts) {
     const deadline = Date.now() + opts.timeoutMs;
     let noneStreak = 0;
+    let lastSnapshot = null;
     for (;;) {
         if (opts.signal?.aborted)
-            return "timeout";
+            return { result: "timeout", lastSnapshot, aborted: true };
         const snapshot = await adapter.checksSnapshot({ cwd: opts.cwd, number: opts.number, branch: opts.branch });
+        lastSnapshot = snapshot;
         if (snapshot === "failure" || snapshot === "success")
-            return snapshot;
+            return { result: snapshot, lastSnapshot, aborted: false };
         if (snapshot === "none") {
             noneStreak++;
             if (noneStreak >= NONE_STREAK_REQUIRED)
-                return "none";
+                return { result: "none", lastSnapshot, aborted: false };
         }
         else {
             noneStreak = 0;
         }
         if (Date.now() >= deadline)
-            return "timeout";
+            return { result: "timeout", lastSnapshot, aborted: false };
         await new Promise((resolve) => setTimeout(resolve, Math.min(opts.intervalMs, deadline - Date.now())));
     }
 }

package/bundle/server/dist/adapters/github.test.js

@@ -1,7 +1,7 @@
 // packages/server/src/adapters/github.test.ts
 import { test } from "node:test";
 import assert from "node:assert/strict";
-import { parsePrView, summarizeChecks, pollPrChecks, createGithubAdapter, fetchChecksFailureEvidence, sanitizeCiText, sanitizeUrl, extractActionsRunId, buildFailureExcerpt, formatChecksFailureDetails, CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, CHECKS_EVIDENCE_MAX_EXCERPT_LINES, CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN, CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER, CHECKS_FAILURE_GENERIC_REASON, PR_VIEW_FIELDS, } from "./github.js";
+import { parsePrView, summarizeChecks, pollPrChecks, pollPrChecksDetailed, baseRefHasPullRequestWorkflow, workflowHasPullRequestTrigger, createGithubAdapter, fetchChecksFailureEvidence, sanitizeCiText, sanitizeUrl, extractActionsRunId, buildFailureExcerpt, formatChecksFailureDetails, CHECKS_EVIDENCE_MAX_EXCERPT_CHARS, CHECKS_EVIDENCE_MAX_EXCERPT_LINES, CHECKS_EVIDENCE_MAX_RAW_LOG_CHARS_PER_RUN, CHECKS_EVIDENCE_GH_LOG_MAX_BUFFER, CHECKS_FAILURE_GENERIC_REASON, PR_VIEW_FIELDS, } from "./github.js";
 test("parsePrView extracts the ground-truth handoff fields, including draft status", () => {
     const view = parsePrView(JSON.stringify({
         number: 7,
@@ -205,6 +205,88 @@ test("pollPrChecks bails out as timeout immediately when the lease signal is alr
     });
     assert.equal(result, "timeout");
 });
+test("NOT-311: pollPrChecksDetailed reports the last snapshot so a timeout can tell pending from abort", async () => {
+    const pending = await pollPrChecksDetailed(fakeAdapter(["pending", "pending", "pending", "pending"]), {
+        cwd: "/x",
+        timeoutMs: 20,
+        intervalMs: 10,
+    });
+    assert.deepEqual(pending, { result: "timeout", lastSnapshot: "pending", aborted: false });
+    const controller = new AbortController();
+    controller.abort();
+    const aborted = await pollPrChecksDetailed(fakeAdapter(["pending"]), {
+        cwd: "/x",
+        timeoutMs: 1000,
+        intervalMs: 5,
+        signal: controller.signal,
+    });
+    assert.deepEqual(aborted, { result: "timeout", lastSnapshot: null, aborted: true });
+    const none = await pollPrChecksDetailed(fakeAdapter(["none", "none"]), { cwd: "/x", timeoutMs: 1000, intervalMs: 5 });
+    assert.deepEqual(none, { result: "none", lastSnapshot: "none", aborted: false });
+    const incompleteNoneStreak = await pollPrChecksDetailed(fakeAdapter(["none"]), {
+        cwd: "/x",
+        timeoutMs: 0,
+        intervalMs: 10,
+    });
+    assert.deepEqual(incompleteNoneStreak, { result: "timeout", lastSnapshot: "none", aborted: false });
+});
+test("NOT-311: workflowHasPullRequestTrigger matches inline, list, and block on: forms", () => {
+    assert.equal(workflowHasPullRequestTrigger("on: pull_request\njobs:\n  x:\n    runs-on: ubuntu-latest\n"), true);
+    assert.equal(workflowHasPullRequestTrigger("on: [push, pull_request]\n"), true);
+    assert.equal(workflowHasPullRequestTrigger("on:\n  push:\n    branches: [main]\n  pull_request:\n    branches: [main]\n"), true);
+    assert.equal(workflowHasPullRequestTrigger("on:\n  push:\n    branches: [main]\n"), false);
+    assert.equal(workflowHasPullRequestTrigger("on: push\n"), false);
+    assert.equal(workflowHasPullRequestTrigger("on:\n  schedule:\n    - cron: '0 0 * * *'\n"), false);
+    assert.equal(workflowHasPullRequestTrigger("jobs:\n  x:\n    runs-on: ubuntu-latest\n"), false);
+    // A pull_request mention outside `on:` (job name) must not qualify.
+    assert.equal(workflowHasPullRequestTrigger("on: push\njobs:\n  pull_request_preview:\n    runs-on: ubuntu-latest\n"), false);
+});
+test("NOT-311: baseRefHasPullRequestWorkflow reads the base ref tree, false without workflows, null on unknown ref", async () => {
+    const { execFileSync } = await import("node:child_process");
+    const fs = await import("node:fs");
+    const os = await import("node:os");
+    const path = await import("node:path");
+    const setup = (files) => {
+        const repo = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-gh-wf-repo-"));
+        const git = (...args) => execFileSync("git", args, { cwd: repo, encoding: "utf8" });
+        git("init", "-q", "-b", "main");
+        git("config", "user.email", "test@example.com");
+        git("config", "user.name", "Test");
+        for (const [rel, content] of Object.entries(files)) {
+            fs.mkdirSync(path.join(repo, path.dirname(rel)), { recursive: true });
+            fs.writeFileSync(path.join(repo, rel), content);
+        }
+        git("add", ".");
+        git("commit", "-q", "-m", "init");
+        const remote = fs.mkdtempSync(path.join(os.tmpdir(), "dealer-gh-wf-remote-"));
+        execFileSync("git", ["init", "-q", "--bare", "-b", "main", remote]);
+        git("remote", "add", "origin", remote);
+        git("push", "-q", "origin", "main");
+        git("fetch", "-q", "origin");
+        return { repo, remote };
+    };
+    const withCi = setup({
+        "README.md": "hi\n",
+        ".github/workflows/ci.yml": "name: ci\non:\n  pull_request:\n    branches: [main]\njobs:\n  x:\n    runs-on: ubuntu-latest\n",
+    });
+    const pushOnly = setup({
+        "README.md": "hi\n",
+        ".github/workflows/nightly.yml": "name: nightly\non:\n  schedule:\n    - cron: '0 0 * * *'\njobs:\n  x:\n    runs-on: ubuntu-latest\n",
+    });
+    const bare = setup({ "README.md": "hi\n" });
+    try {
+        assert.equal(await baseRefHasPullRequestWorkflow(withCi.repo, "main"), true);
+        assert.equal(await baseRefHasPullRequestWorkflow(pushOnly.repo, "main"), false);
+        assert.equal(await baseRefHasPullRequestWorkflow(bare.repo, "main"), false);
+        assert.equal(await baseRefHasPullRequestWorkflow(bare.repo, "no-such-branch"), null);
+    }
+    finally {
+        for (const { repo, remote } of [withCi, pushOnly, bare]) {
+            fs.rmSync(repo, { recursive: true, force: true });
+            fs.rmSync(remote, { recursive: true, force: true });
+        }
+    }
+});
 // --- NOT-252: terminal checks_failed enrichment ---
 const HEAD_SHA = "abc123def456abc123def456abc123def456abcd";
 function prViewWithRollup(rollup, headSha = HEAD_SHA) {