agent-dealer 1.2.8 → 1.2.10

package/bundle/server/dist/coordinator/auto-merge.js

@@ -27,14 +27,27 @@ import { classifyIssueRepo } from "../adapters/managed-repo.js";
 import { getDb } from "../db/index.js";
 import { getIssue, listIssues, transitionIssue } from "../repository/issues.js";
 import { appendWorkflowEvent, completeWorkflowInstance, getActiveWorkflowInstance, } from "../repository/workflow-events.js";
-import { createHumanAction, findOpenHumanAction, resolveHumanAction, } from "../repository/human-actions.js";
+import { createHumanAction, findOpenHumanAction, findOpenHumanActionByRequestId, resolveHumanAction, } from "../repository/human-actions.js";
 import { MERGE_FAILURE_EVIDENCE_KEY, MERGE_FAILURE_RESPONSE_OPTIONS } from "./human-resolution.js";
 import { isMergeConflictFailure, runMergeConflictSync } from "./merge-conflict-sync.js";
+import { OPERATOR_VERIFICATION_RESPONSE_OPTIONS, formatOperatorCriteria, getOperatorCriteriaForIssue, hasOperatorVerificationForHead, operatorVerificationRequestId, } from "./operator-criteria.js";
 const run = promisify(execFile);
 /** Bound each `gh` shell-out so a hang cannot freeze the coordinator process. */
 export const GH_MERGE_TIMEOUT_MS = 20_000;
 /** Must match projection.ts's auto_merge currentIntent — recovery keys off this string. */
 export const AUTO_MERGE_INTENT = "Auto-merging approved PR";
+/**
+ * NOT-314: the issue intent while an `[operator]` gate holds the merge. Named
+ * verbatim by the ticket: the PR stays unmerged in `needs_human` under this intent
+ * until the human records a result or waives the criterion.
+ */
+export const OPERATOR_VERIFICATION_INTENT = "Operator verification required before merge";
+/**
+ * NOT-314 fail-closed: the stable request id for the no-head escalation, so
+ * repeat finalizes dedupe onto the one open `policy_escalation` instead of
+ * stacking a new one per tick.
+ */
+export const OPERATOR_VERIFICATION_NO_HEAD_REQUEST_ID = "operator-verification-blocked:no-head";
 const ALREADY_MERGED = /already (been )?merged|pull request is not mergeable:.*merged/i;
 /**
  * Map issue.repo (portable identity or legacy local path) to a real filesystem cwd for
@@ -184,6 +197,15 @@ async function finalizeAutoMergeOnce(issueId) {
     if (issue.prNumber == null) {
         return escalateMergeFailure(issue, instance.id, "Reviewer approved but the issue has no PR number to merge.");
     }
+    // NOT-314 seam: this finalize is the single path from reviewer-approve to the
+    // `gh` merge — auto-merge-on routes here from applyCompletion, auto-merge-off
+    // arrives via final_review:merge / policy_escalation:retry_merge, and crash
+    // recovery re-enters through recoverStrandedAutoMerges. An `[operator]`
+    // criterion in the frozen snapshot blocks here (PR unmerged, needs_human)
+    // until a human records the result for the current head.
+    const operatorBlock = gateOperatorVerification(issue.id);
+    if (operatorBlock)
+        return operatorBlock;
     const resolvedCwd = resolveAutoMergeCwd(issue.repo);
     if (!resolvedCwd.ok) {
         return escalateMergeFailure(issue, instance.id, `Auto-merge failed: ${resolvedCwd.reason}`);
@@ -287,6 +309,188 @@ async function finalizeAutoMergeOnce(issueId) {
         };
     })();
 }
+/**
+ * NOT-314: the `[operator]` merge gate. After reviewer approve and before the
+ * `gh` merge: when the frozen snapshot holds operator criteria and no result is
+ * recorded for the current head (a `verified` artifact or a
+ * `operator_verification.waived` event — both head-pinned), the PR stays
+ * unmerged and the issue parks in `needs_human` with an `operator_verification`
+ * action listing each criterion and its command.
+ *
+ * Returns null when the merge may proceed (no operator criteria, a recorded
+ * result for this head, or no workflow to gate). Idempotent: a second finalize
+ * for the same head reuses the open action instead of raising another.
+ *
+ * Fail-closed: when operator criteria exist, every non-proceed path returns a
+ * result (never null), so a missing head SHA or an unexpected status blocks the
+ * `gh` merge instead of letting it through.
+ */
+export function gateOperatorVerification(issueId) {
+    return getDb().transaction(() => {
+        const current = getIssue(issueId);
+        if (!current)
+            return null;
+        const active = getActiveWorkflowInstance(issueId);
+        if (!active)
+            return null;
+        const criteria = getOperatorCriteriaForIssue(current);
+        if (criteria.length === 0)
+            return null;
+        const head = current.headSha;
+        if (head && hasOperatorVerificationForHead(issueId, head))
+            return null;
+        if (current.status === "done")
+            return null;
+        // Only the auto-merge park (or an already-gated issue) is gated — any other
+        // status is a racer or a non-parked issue; do not invent an action there,
+        // but do not let the merge through either — park the finalize as a no-op.
+        if (current.status !== "final_review" && current.status !== "needs_human") {
+            return {
+                applied: true,
+                issueStatus: current.status,
+                nextWorkItemId: null,
+                humanActionId: null,
+                instanceCompleted: false,
+                triggerReflect: false,
+            };
+        }
+        // No head SHA to pin the verification to (no handoff recorded one): the
+        // gate cannot name a head, so escalate instead of merging — retry_merge
+        // re-enters this same finalize once a head exists and gates normally.
+        // Repeat finalizes reuse the one open escalation (no duplicate action or
+        // event), and the transition is skipped when already parked
+        // (needs_human has no self-loop).
+        if (!head) {
+            const retry = findOpenHumanActionByRequestId(issueId, "policy_escalation", OPERATOR_VERIFICATION_NO_HEAD_REQUEST_ID);
+            if (retry) {
+                if (current.status !== "needs_human") {
+                    transitionIssue(issueId, "needs_human", {
+                        currentOwner: "human",
+                        currentIntent: OPERATOR_VERIFICATION_INTENT,
+                    });
+                }
+                return {
+                    applied: true,
+                    issueStatus: "needs_human",
+                    nextWorkItemId: null,
+                    humanActionId: retry.id,
+                    instanceCompleted: false,
+                    triggerReflect: false,
+                };
+            }
+            const reason = `Reviewer approved, but ${criteria.length} acceptance ` +
+                `${criteria.length === 1 ? "criterion requires" : "criteria require"} a human operator ` +
+                `to verify (tagged [operator] in the frozen task snapshot) and no head SHA is ` +
+                `recorded to pin the verification to. The PR stays unmerged.`;
+            if (current.status !== "needs_human") {
+                transitionIssue(issueId, "needs_human", {
+                    currentOwner: "human",
+                    currentIntent: reason,
+                });
+            }
+            const action = createHumanAction({
+                issueId,
+                workflowInstanceId: active.id,
+                actionType: "policy_escalation",
+                reason,
+                question: `${reason} Retry the merge once a head is recorded, queue another repair round, or close the issue?`,
+                evidence: { [MERGE_FAILURE_EVIDENCE_KEY]: true, operatorVerificationBlocked: true },
+                responseOptions: [...MERGE_FAILURE_RESPONSE_OPTIONS],
+                requestId: OPERATOR_VERIFICATION_NO_HEAD_REQUEST_ID,
+            });
+            appendWorkflowEvent({
+                issueId,
+                workflowInstanceId: active.id,
+                workerSessionId: null,
+                type: "human_action.requested",
+                actorType: "system",
+                stage: "needs_human",
+                round: current.currentRound,
+                payload: { actionType: "policy_escalation", actionId: action.id, operatorVerificationBlocked: true },
+            });
+            return {
+                applied: true,
+                issueStatus: "needs_human",
+                nextWorkItemId: null,
+                humanActionId: action.id,
+                instanceCompleted: false,
+                triggerReflect: false,
+            };
+        }
+        const existing = findOpenHumanAction(issueId, "operator_verification");
+        if (existing && operatorActionHeadSha(existing) === head) {
+            if (current.status !== "needs_human") {
+                transitionIssue(issueId, "needs_human", {
+                    currentOwner: "human",
+                    currentIntent: OPERATOR_VERIFICATION_INTENT,
+                });
+            }
+            return {
+                applied: true,
+                issueStatus: "needs_human",
+                nextWorkItemId: null,
+                humanActionId: existing.id,
+                instanceCompleted: false,
+                triggerReflect: false,
+            };
+        }
+        const shortHead = head.slice(0, 8);
+        const reason = `Reviewer approved ${shortHead}, but ${criteria.length} acceptance ` +
+            `${criteria.length === 1 ? "criterion requires" : "criteria require"} a human operator ` +
+            `to verify (tagged [operator] in the frozen task snapshot) and no result is recorded ` +
+            `for this head. The PR stays unmerged until the result is recorded:\n` +
+            formatOperatorCriteria(criteria).join("\n");
+        transitionIssue(issueId, "needs_human", {
+            currentOwner: "human",
+            currentIntent: OPERATOR_VERIFICATION_INTENT,
+        });
+        // Head-pinned request_id: a concurrent finalize for the same head dedupes
+        // onto this action through createHumanAction's open-request conflict path;
+        // new commits after the gate get a fresh action with their own commands.
+        const action = createHumanAction({
+            issueId,
+            workflowInstanceId: active.id,
+            actionType: "operator_verification",
+            reason,
+            question: `${reason}\n\nPaste the probe output to record verification, waive with a reason, ` +
+                `or send the work back for another repair round?`,
+            evidence: { operatorVerification: { criteria, headSha: head } },
+            responseOptions: [...OPERATOR_VERIFICATION_RESPONSE_OPTIONS],
+            requestId: operatorVerificationRequestId(head),
+        });
+        appendWorkflowEvent({
+            issueId,
+            workflowInstanceId: active.id,
+            workerSessionId: null,
+            type: "human_action.requested",
+            actorType: "system",
+            stage: "needs_human",
+            round: current.currentRound,
+            payload: { actionType: "operator_verification", actionId: action.id, headSha: head },
+        });
+        return {
+            applied: true,
+            issueStatus: "needs_human",
+            nextWorkItemId: null,
+            humanActionId: action.id,
+            instanceCompleted: false,
+            triggerReflect: false,
+        };
+    })();
+}
+/** The head SHA an `operator_verification` action gates (null when unreadable). */
+function operatorActionHeadSha(action) {
+    if (!action.evidenceJson)
+        return null;
+    try {
+        const evidence = JSON.parse(action.evidenceJson);
+        const headSha = evidence.operatorVerification?.headSha;
+        return typeof headSha === "string" && headSha ? headSha : null;
+    }
+    catch {
+        return null;
+    }
+}
 function escalateMergeFailure(issue, workflowInstanceId, reason, evidence = { [MERGE_FAILURE_EVIDENCE_KEY]: true }) {
     return getDb().transaction(() => {
         const current = getIssue(issue.id);

package/bundle/server/dist/coordinator/checks-wait-config.js

@@ -0,0 +1,19 @@
+// packages/server/src/coordinator/checks-wait-config.ts
+//
+// NOT-311: how long one work item may wait on CI before the wait itself escalates.
+// The per-poll bound (CHECKS_POLL_TIMEOUT_MS, default 10 min) only ends a single
+// poll with a `checks_pending` deferral; this ceiling bounds the whole wait measured
+// from the first poll, across deferrals. Past it the item stops re-queueing and a
+// human is asked to look at the stuck CI run instead of waiting forever.
+/** Overall CI-wait ceiling measured from the first checks poll (default 2 h). */
+export function checksWaitCeilingMs() {
+    const parsed = Number(process.env.CHECKS_WAIT_CEILING_MS ?? 2 * 60 * 60_000);
+    return Number.isFinite(parsed) ? parsed : 2 * 60 * 60_000;
+}
+/** True once `nowMs` is at or past the ceiling after the first wait started. */
+export function checksWaitCeilingExceeded(firstWaitStartedAt, nowMs = Date.now()) {
+    const start = Date.parse(firstWaitStartedAt);
+    if (!Number.isFinite(start))
+        return false;
+    return nowMs - start >= checksWaitCeilingMs();
+}