agent-dealer 1.2.7 → 1.2.9

package/bundle/server/dist/coordinator/developer-effect.js

@@ -18,16 +18,22 @@ import os from "node:os";
 import path from "node:path";
 import { parsePhaseBudget, parseProfileSnapshot, roleCeiling } from "@agent-dealer/shared";
 import { getTaskSnapshot } from "./commands.js";
+import { extractOperatorCriteria } from "./operator-criteria.js";
 import { buildDeveloperPrompt } from "./prompts.js";
 import { guidanceForNextSession } from "./guidance.js";
 import { realDeveloperSpawn, developerSessionLogPath } from "./spawn.js";
+import { ensureWorktreeDeps, worktreeDepsTimeoutMs, } from "../adapters/worktree-deps.js";
 import { DEFAULT_BASE_FETCH_TIMEOUT_MS, fastForwardLocalBranchToSha, resolveDeveloperWorktree, safeRemoveWorktree, isWorktreeClean, commitsAhead, pushBranch, mergeBase, branchExists, pushBranchRef, revParseHead, revParseRef, fetchRef, salvageDirtyWorktree, dirtyWorktreeRecoveryCommands, withRepoLock, leftoverFingerprint, } from "../adapters/git-worktree.js";
 import { recordIssueBaseSha } from "../repository/issues.js";
 import { ensureIssueRepoCheckout, roleWorktreePathForResolution, resolveCheckoutBaseBranch, } from "../adapters/managed-repo.js";
 import { baseRefCandidates, inspectBranchProgress } from "./branch-progress.js";
 import { prepareWorkerDeckConnection, releaseWorkerDeckConnection, verifyWorkerDeckConnection } from "../adapters/agent-deck-bind.js";
-import { realGithubAdapter, pollPrChecks } from "../adapters/github.js";
-import { getWorkerSession, patchRunningSession, recordSessionProcess, setSessionInputSha } from "../repository/worker-sessions.js";
+import { realGithubAdapter, pollPrChecksDetailed } from "../adapters/github.js";
+import { checksWaitCeilingExceeded, checksWaitCeilingMs } from "./checks-wait-config.js";
+import { museCapabilitySafetyNetAfterSession } from "../adapters/muse-capability.js";
+import { getOrAssignSessionCorrelationId, getWorkerSession, mergeSessionMetadata, patchRunningSession, recordSessionProcess, setSessionInputSha } from "../repository/worker-sessions.js";
+import { museIdleMinutes, museStallMetadata } from "./muse-spawn.js";
+import { museIdleTimeoutMs } from "./session-timeouts.js";
 import { COORDINATOR_PROCESS_OWNER, readProcessStartTime } from "./process-liveness.js";
 import { checkDeveloperWorktreeOwnerLiveness } from "./worktree-owner-liveness.js";
 import { developerSessionTimeoutMs } from "./session-timeouts.js";
@@ -87,6 +93,23 @@ async function crashOrTimeoutOutcome(opts) {
         ...(opts.logPath ? { logPath: opts.logPath } : {}),
     };
 }
+/**
+ * NOT-307: idle-kill description for the timeout reason, or null for anything else
+ * (wall-clock timeout, crash, success). Minutes prefer the measured last-activity
+ * time and fall back to the configured bound; the last tool name rides along so the
+ * recorded reason — and the `muse_no_progress` classifier — names the stall point.
+ */
+function idleCrashInfoFor(spawned) {
+    if (!spawned.idleTimedOut)
+        return null;
+    return {
+        minutes: museIdleMinutes({
+            lastActivityAt: spawned.muse?.lastActivityAt ?? null,
+            idleTimeoutMs: museIdleTimeoutMs(),
+        }),
+        lastToolName: spawned.muse?.lastToolName ?? null,
+    };
+}
 export const developerEffectConfig = {
     get sessionTimeoutMs() {
         return developerSessionTimeoutMs();
@@ -97,10 +120,18 @@ export const developerEffectConfig = {
     get checksPollIntervalMs() {
         return num("CHECKS_POLL_INTERVAL_MS", 15_000);
     },
+    /** NOT-311: overall CI-wait ceiling measured from the first poll, across deferrals. */
+    get checksWaitCeilingMs() {
+        return checksWaitCeilingMs();
+    },
     /** NOT-197: bound for the pre-branch `git fetch origin <base>` on a fresh issue branch. */
     get baseFetchTimeoutMs() {
         return num("BASE_FETCH_TIMEOUT_MS", DEFAULT_BASE_FETCH_TIMEOUT_MS);
     },
+    /** NOT-315: bound for `npm ci` in the fresh worktree (coordinator side, with network). */
+    get worktreeDepsTimeoutMs() {
+        return worktreeDepsTimeoutMs();
+    },
     /** NOT-110: bounded window to let a lagging `gh pr view` catch up to a just-pushed HEAD. */
     get headReconcileTimeoutMs() {
         return num("HEAD_RECONCILE_TIMEOUT_MS", 30_000);
@@ -270,6 +301,69 @@ async function checksFailedOutcome(opts) {
     });
     return details ? { kind: "checks_failed", details } : { kind: "checks_failed" };
 }
+/**
+ * NOT-311: the `checksWaitStartedAt` persisted by a prior `checks_pending` deferral,
+ * anchoring the overall wait ceiling across re-polls. Null on a first wait (or an
+ * unparseable payload) — the caller then anchors at its own poll start.
+ */
+function checksWaitStartedAtFromPayload(payloadJson) {
+    if (!payloadJson)
+        return null;
+    try {
+        const v = JSON.parse(payloadJson).checksWaitStartedAt;
+        return typeof v === "string" && v ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * NOT-311: decide what a finished checks poll means. Returns a `checks_pending`
+ * outcome when CI is still queued/running at the timeout (or reports no checks while
+ * the base branch has a `pull_request` workflow — "not yet registered", never "no
+ * CI"), and null when the caller stays on today's path (success, failure, an aborted
+ * wait, or `none` with no workflow configured). Also yields the `checks.completed`
+ * milestone reason for the wait cases.
+ *
+ * A missing/unknown workflow answer (no adapter method, unreadable base ref) waits
+ * fail-closed: sending an unverified PR to review is the outcome this exists to
+ * prevent, and the wait ceiling still bounds it.
+ */
+async function resolveChecksWait(opts) {
+    const waitStartedAt = checksWaitStartedAtFromPayload(opts.payloadJson) ?? opts.pollStartedAt;
+    const base = {
+        kind: "checks_pending",
+        branch: opts.branch,
+        prNumber: opts.prNumber,
+        headSha: opts.headSha,
+        waitStartedAt,
+    };
+    const noChecks = opts.poll.result === "none" || (opts.poll.result === "timeout" && opts.poll.lastSnapshot === "none");
+    if (noChecks) {
+        let hasWorkflow = null;
+        try {
+            hasWorkflow = (await opts.github.hasPullRequestWorkflow?.({ cwd: opts.cwd, baseRef: opts.baseRef })) ?? null;
+        }
+        catch {
+            hasWorkflow = null;
+        }
+        if (hasWorkflow === false) {
+            return { pending: null, milestoneReason: "none_no_workflow" };
+        }
+        return {
+            pending: { ...base, reason: "Waiting for CI (queued) - no attempt spent" },
+            milestoneReason: "none_with_workflow",
+        };
+    }
+    if (opts.poll.result === "timeout" && opts.poll.lastSnapshot === "pending" && !opts.poll.aborted && !opts.signal?.aborted) {
+        const milestoneReason = checksWaitCeilingExceeded(waitStartedAt) ? "pending_ceiling" : undefined;
+        return {
+            pending: { ...base, reason: "Waiting for CI (running) - no attempt spent" },
+            ...(milestoneReason ? { milestoneReason } : {}),
+        };
+    }
+    return { pending: null };
+}
 /**
  * Infra retry that skips the agent: publish whatever the branch already carries. Uses the
  * issue repo as `gh` cwd and `origin/<branch>` as the verified head (any worktree was
@@ -508,17 +602,35 @@ async function runPublishOnlyHandoff(ctx, deps, branchName) {
             prNumber: prView.number,
             headSha: prView.headRefOid,
         });
-        const checks = await pollPrChecks(deps.github, {
+        const pollStartedAt = new Date().toISOString();
+        const poll = await pollPrChecksDetailed(deps.github, {
             cwd,
             timeoutMs: developerEffectConfig.checksPollTimeoutMs,
             intervalMs: developerEffectConfig.checksPollIntervalMs,
             signal: ctx.signal,
             number: prView.number,
         });
+        // NOT-311: pending/queued CI at the timeout (or no checks yet with a
+        // `pull_request` workflow on the base) waits with backoff instead of spending
+        // an infra attempt — resolved here so the milestone carries the wait reason.
+        const wait = await resolveChecksWait({
+            github: deps.github,
+            cwd,
+            prNumber: prView.number,
+            baseRef: prView.baseRefName,
+            headSha: prView.headRefOid,
+            branch: branchName,
+            poll,
+            signal: ctx.signal,
+            payloadJson: workItem.payloadJson,
+            pollStartedAt,
+        });
+        const checks = poll.result;
         milestone("checks.completed", `Developer · checks ${checks}`, {
             snapshot: checks,
             prNumber: prView.number,
             headSha: prView.headRefOid,
+            ...(wait.milestoneReason ? { reason: wait.milestoneReason } : {}),
         });
         const postPollView = await deps.github.viewPr({ cwd, branch: branchName });
         if (!postPollView) {
@@ -555,6 +667,10 @@ async function runPublishOnlyHandoff(ctx, deps, branchName) {
             author: "system",
             content: { snapshot: checks, prNumber: prView.number, headSha: prView.headRefOid },
         });
+        // NOT-311: still-waiting CI defers with backoff (no attempt spent) instead of
+        // timing out the session. An aborted wait keeps today's `timed_out`.
+        if (wait.pending)
+            return wait.pending;
         if (checks === "timeout")
             return { kind: "timed_out" };
         await fetchRef(cwd, prView.baseRefName);
@@ -601,6 +717,9 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
     }
     const session = getWorkerSession(sessionId);
     const snapshot = parseProfileSnapshot(session?.profileSnapshotJson);
+    // NOT-305: opaque per-session Deck correlation UUID, persisted before spawn and
+    // carried as observability metadata in every runtime launch config below.
+    const deckCorrelationId = session?.deckCorrelationId ?? getOrAssignSessionCorrelationId(sessionId);
     let taskSnapshot = getTaskSnapshot(issue);
     const runtime = snapshot?.runtime ?? "claude_code";
     const round = workItem.round;
@@ -750,6 +869,18 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
             recordIssueBaseSha(issue.id, resolved.baseSha);
             issue.baseSha = resolved.baseSha;
         }
+        // NOT-315: provision dependencies here, outside the sandbox, with network — the
+        // builder sandbox has none, so an in-session install can never work. A throw
+        // lands in the worktree-setup adapter_failure below: visible and
+        // infra-retryable, never a silent hour-long stall. The session is not spawned.
+        const depsResult = await ensureWorktreeDeps(worktreePath, {
+            runner: deps.depsRunner,
+            timeoutMs: developerEffectConfig.worktreeDepsTimeoutMs,
+        });
+        milestone("worktree.deps_ready", `Developer · dependencies ready (round ${round})`, {
+            ...(depsResult.ran ? { ran: true } : { ran: false, reason: depsResult.reason }),
+            durationMs: depsResult.durationMs,
+        });
     }
     catch (err) {
         return { kind: "adapter_failure", reason: `worktree setup failed: ${String(err)}` };
@@ -807,6 +938,7 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                 worktreePath,
                 runtime,
                 policy,
+                correlationId: deckCorrelationId,
                 verifyCallTool: deps.deckCallTool,
             });
             if (!prepared.ok) {
@@ -862,6 +994,30 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
         const scopeDecisionNote = typeof payload.scopeDecisionNote === "string" && payload.scopeDecisionNote.trim()
             ? payload.scopeDecisionNote.trim()
             : undefined;
+        // NOT-314: same one-shot ride for an operator_verification repair note.
+        const operatorRepairNote = typeof payload.operatorRepairNote === "string" && payload.operatorRepairNote.trim()
+            ? payload.operatorRepairNote.trim()
+            : undefined;
+        // NOT-314: the frozen snapshot's operator criteria, parsed here so the
+        // worker never re-derives them — the section renders only when non-empty.
+        const operatorCriteria = extractOperatorCriteria(taskSnapshot.acceptanceCriteria);
+        const hasOperatorCriteria = operatorCriteria.length > 0 ? operatorCriteria : undefined;
+        // NOT-310: the conflict directive rides only the work item queued by the merge
+        // path — exactly this round reads it; nothing is re-read from the DB. Shaped
+        // defensively: a malformed directive renders nothing rather than breaking the
+        // prompt (conflictRepairSection also guards on empty base/branch).
+        const conflictRepair = payload.conflictRepair &&
+            typeof payload.conflictRepair === "object" &&
+            typeof payload.conflictRepair.baseBranch === "string" &&
+            typeof payload.conflictRepair.branch === "string"
+            ? {
+                baseBranch: payload.conflictRepair.baseBranch,
+                branch: payload.conflictRepair.branch,
+                files: Array.isArray(payload.conflictRepair.files)
+                    ? payload.conflictRepair.files.filter((f) => typeof f === "string")
+                    : [],
+            }
+            : undefined;
         let priorConclusion;
         let priorVerificationReceipt;
         if (retryReason) {
@@ -897,6 +1053,9 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
             museDeveloper: isMuse,
             guidance: guidance.length ? guidance : undefined,
             scopeDecisionNote,
+            conflictRepair,
+            operatorCriteria: hasOperatorCriteria,
+            operatorRepairNote,
         });
         // NOT-83 review finding: the session is marked `running` (worker-loop.ts) before this
         // handler ever runs, so an abort landing during worktree setup/deck-bind above already
@@ -998,6 +1157,9 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                 // NOT-278: frozen profile deck → the Muse exec attempt (deck headers + pre-spawn
                 // verify). Other runtimes carry their deck via mcpConfigPath/mcpEnv and ignore this.
                 deckId: snapshot?.deckId ?? null,
+                // NOT-305: opaque per-session Deck correlation UUID → the Muse settings
+                // `x-agent-deck-correlation-id` observability header.
+                deckCorrelationId,
                 prompt,
                 cwd: worktreePath,
                 timeoutMs: developerEffectConfig.sessionTimeoutMs,
@@ -1069,6 +1231,18 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
         // here on (usage, receipt, push, PR verify, checks poll) is post-spawn and must
         // not be mislabeled as a session that could not start.
         sessionStarted = true;
+        // NOT-307: stall evidence for every Muse session (timed out or not) — merged
+        // into metadata_json while the row is still running, so the classifier and the
+        // operator can read last-activity evidence whatever the outcome. Best-effort:
+        // evidence must never fail the attempt it describes.
+        if (spawned.muse) {
+            try {
+                mergeSessionMetadata(sessionId, museStallMetadata(spawned.muse));
+            }
+            catch {
+                // ignore
+            }
+        }
         // NOT-169: exactly one agent.completed per spawned process, at child exit and before
         // any receipt mining, usage extraction, or validation. Raw outcome only — no
         // failure classification.
@@ -1094,6 +1268,26 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                 // ignore
             }
         }
+        // NOT-308 safety net: a Muse session that left the worktree dirty without a
+        // single shell tool call is what a shell-less build looks like from the outside —
+        // when the running version is not yet the confirmed baseline, re-verify it in the
+        // background immediately (bypassing the error backoff) and escalate a `missing`
+        // verdict on this issue. Fire-and-forget: never throws, never changes this outcome.
+        // Dirtiness is read here, before salvage/commit handling below can clean the tree.
+        if (runtime === "muse_code") {
+            try {
+                const dirtyAtSessionEnd = !(await isWorktreeClean(worktreePath).catch(() => true));
+                museCapabilitySafetyNetAfterSession({
+                    issueId: issue.id,
+                    runtime,
+                    logPath: spawned.logPath,
+                    dirty: dirtyAtSessionEnd,
+                });
+            }
+            catch {
+                // Observational only — the session outcome stands on its own.
+            }
+        }
         // NOT-130: record suite evidence even when the session later fails/times out — an
         // interrupted-but-verified tip must carry the receipt into the retry prompt.
         const verificationReceipt = await persistVerificationReceiptIfAny({
@@ -1287,6 +1481,7 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                         timedOut: Boolean(spawned.timedOut),
                         logPath: spawned.logPath,
                         runtime,
+                        idle: idleCrashInfoFor(spawned),
                     });
                     const salvageNote = `Salvaged uncommitted work as ${salvaged.message} (${salvaged.commitSha.slice(0, 7)}).`;
                     const crashOutcome = await crashOrTimeoutOutcome({
@@ -1341,6 +1536,7 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
                     timedOut: Boolean(spawned.timedOut),
                     logPath: spawned.logPath,
                     runtime,
+                    idle: idleCrashInfoFor(spawned),
                 }),
                 worktreePath,
                 logPath: spawned.logPath,
@@ -1536,7 +1732,8 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
             prNumber: prView.number,
             headSha: prView.headRefOid,
         });
-        const checks = await pollPrChecks(deps.github, {
+        const pollStartedAt = new Date().toISOString();
+        const poll = await pollPrChecksDetailed(deps.github, {
             cwd: worktreePath,
             timeoutMs: developerEffectConfig.checksPollTimeoutMs,
             intervalMs: developerEffectConfig.checksPollIntervalMs,
@@ -1546,10 +1743,27 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
             // back to a bare `gh pr view` either).
             number: prView.number,
         });
+        // NOT-311: pending/queued CI at the timeout (or no checks yet with a
+        // `pull_request` workflow on the base) waits with backoff instead of spending
+        // an infra attempt — resolved here so the milestone carries the wait reason.
+        const wait = await resolveChecksWait({
+            github: deps.github,
+            cwd: worktreePath,
+            prNumber: prView.number,
+            baseRef: prView.baseRefName,
+            headSha: prView.headRefOid,
+            branch: branchName,
+            poll,
+            signal: ctx.signal,
+            payloadJson: workItem.payloadJson,
+            pollStartedAt,
+        });
+        const checks = poll.result;
         milestone("checks.completed", `Developer · checks ${checks}`, {
             snapshot: checks,
             prNumber: prView.number,
             headSha: prView.headRefOid,
+            ...(wait.milestoneReason ? { reason: wait.milestoneReason } : {}),
         });
         // The poll can run for up to checksPollTimeoutMs (default 10 minutes) — re-fetch and
         // re-validate identity against the SAME localHead before trusting either the checks
@@ -1597,6 +1811,12 @@ export async function runDeveloperEffect(ctx, deps = defaultDeps) {
             author: "system",
             content: { snapshot: checks, prNumber: prView.number, headSha: prView.headRefOid },
         });
+        // NOT-311: still-waiting CI defers with backoff (no attempt spent) instead of
+        // timing out the session. An aborted wait keeps today's `timed_out`.
+        if (wait.pending) {
+            await bestEffortRemove(repoPath, worktreePath);
+            return wait.pending;
+        }
         if (checks === "timeout") {
             await bestEffortRemove(repoPath, worktreePath);
             return { kind: "timed_out" };