agent-dealer 1.2.8 → 1.2.10

package/bundle/server/dist/coordinator/muse-spawn.test.js

@@ -2,30 +2,36 @@
 // arrival-stamped normalized events, and the five-field stall metadata object.
 // The full `runMuseDeveloperSession` needs a Muse binary + credentials, so these
 // test the pure pieces it wires together (plus the parser contract it relies on).
-import { test } from "node:test";
+import { test, after } from "node:test";
 import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { parseMuseRun } from "../runners/muse-code-jsonl.js";
-import { museIdleTimeoutMs, DEFAULT_MUSE_IDLE_TIMEOUT_MS } from "./session-timeouts.js";
-import { museIdleMinutes, museStallMetadata, sessionLogActivityMs, writeMuseNormalizedLog, } from "./muse-spawn.js";
+import { fileURLToPath } from "node:url";
+import { MUSE_CODE_CONTRIBUTOR_MODEL } from "@agent-dealer/shared";
+import { parseMuseRun, isMuseTerminalStdoutLine, createMusePrimaryTerminalMatcher, } from "../runners/muse-code-jsonl.js";
+import { museIdleTimeoutMs, museTerminalGraceMs, DEFAULT_MUSE_IDLE_TIMEOUT_MS, DEFAULT_MUSE_TERMINAL_GRACE_MS, } from "./session-timeouts.js";
+import { museIdleMinutes, museStallMetadata, runMuseDeveloperSession, sessionLogActivityMs, writeMuseNormalizedLog, } from "./muse-spawn.js";
 const MODEL = "muse-spark-1.3-contributor";
 // ── MUSE_IDLE_TIMEOUT_MS parsing ─────────────────────────────────────────────
 function withIdleEnv(raw, fn) {
-    const prev = process.env.MUSE_IDLE_TIMEOUT_MS;
+    withEnv("MUSE_IDLE_TIMEOUT_MS", raw, fn);
+}
+function withEnv(name, raw, fn) {
+    const prev = process.env[name];
     try {
         if (raw === undefined)
-            delete process.env.MUSE_IDLE_TIMEOUT_MS;
+            delete process.env[name];
         else
-            process.env.MUSE_IDLE_TIMEOUT_MS = raw;
+            process.env[name] = raw;
         fn();
     }
     finally {
         if (prev === undefined)
-            delete process.env.MUSE_IDLE_TIMEOUT_MS;
+            delete process.env[name];
         else
-            process.env.MUSE_IDLE_TIMEOUT_MS = prev;
+            process.env[name] = prev;
     }
 }
 test("museIdleTimeoutMs defaults to 30 minutes when unset or blank", () => {
@@ -97,19 +103,21 @@ test("museIdleMinutes measures silence from last activity, else the bound", () =
     assert.equal(museIdleMinutes({ lastActivityAt: null, idleTimeoutMs: undefined }), null, "disabled watchdog has no idle kill to explain");
 });
 // ── stall metadata object ────────────────────────────────────────────────────
-test("museStallMetadata carries exactly the five worker_sessions fields", () => {
+test("museStallMetadata carries stall-evidence fields including lingeredAfterTerminal", () => {
     assert.deepEqual(museStallMetadata({
         lastActivityAt: "2026-10-01T19:00:00.000Z",
         toolCallCount: 24,
         lastToolName: "npm_test",
         firstOutputMs: 1234,
         idleTimedOut: true,
+        lingeredAfterTerminal: false,
     }), {
         lastActivityAt: "2026-10-01T19:00:00.000Z",
         toolCallCount: 24,
         lastToolName: "npm_test",
         firstOutputMs: 1234,
         idleTimedOut: true,
+        lingeredAfterTerminal: false,
     });
 });
 // ── arrival-stamped normalized events ────────────────────────────────────────
@@ -185,6 +193,7 @@ test("the written ndjson carries ts on every event and durationMs on completed t
         firstOutputMs: 900,
         lastActivityAt: new Date(t0 + 63_000).toISOString(),
         idleTimedOut: false,
+        lingeredAfterTerminal: false,
         toolCallCount: r.tools.length,
         lastToolName: "npm_test",
     };
@@ -206,5 +215,152 @@ test("the written ndjson carries ts on every event and durationMs on completed t
     assert.equal(muse.toolCallCount, 2);
     assert.equal(muse.lastToolName, "npm_test");
     assert.equal(muse.idleTimedOut, false);
+    assert.equal(muse.lingeredAfterTerminal, false);
     assert.equal(muse.lastActivityAt, new Date(t0 + 63_000).toISOString());
 });
+// ── MUSE_TERMINAL_GRACE_MS parsing ───────────────────────────────────────────
+test("museTerminalGraceMs defaults to 30 seconds when unset or blank", () => {
+    withEnv("MUSE_TERMINAL_GRACE_MS", undefined, () => assert.equal(museTerminalGraceMs(), DEFAULT_MUSE_TERMINAL_GRACE_MS));
+    withEnv("MUSE_TERMINAL_GRACE_MS", "", () => assert.equal(museTerminalGraceMs(), DEFAULT_MUSE_TERMINAL_GRACE_MS));
+    withEnv("MUSE_TERMINAL_GRACE_MS", "   ", () => assert.equal(museTerminalGraceMs(), DEFAULT_MUSE_TERMINAL_GRACE_MS));
+    assert.equal(DEFAULT_MUSE_TERMINAL_GRACE_MS, 30_000);
+});
+test("MUSE_TERMINAL_GRACE_MS=0 disables the post-terminal kill", () => {
+    withEnv("MUSE_TERMINAL_GRACE_MS", "0", () => assert.equal(museTerminalGraceMs(), undefined));
+});
+test("isMuseTerminalStdoutLine matches completed and failed envelopes only", () => {
+    assert.equal(isMuseTerminalStdoutLine(JSON.stringify({ payload_type: "run.terminal.failed", payload: { terminal: "failed", reason: "x" } })), true);
+    assert.equal(isMuseTerminalStdoutLine(JSON.stringify({ payload_type: "run.terminal.completed", payload: {} })), true);
+    assert.equal(isMuseTerminalStdoutLine(JSON.stringify({ payload_type: "tool.result", payload: {} })), false);
+    assert.equal(isMuseTerminalStdoutLine("not json"), false);
+});
+// ── NOT-342: linger after terminal, through the Muse spawn ───────────────────
+const FAKE_MUSE = path.join(path.dirname(fileURLToPath(import.meta.url)), "fixtures", "fake-muse.mjs");
+const LINGER_HOME = fs.mkdtempSync(path.join(os.homedir(), ".dealer-muse-linger-"));
+after(() => {
+    fs.rmSync(LINGER_HOME, { recursive: true, force: true });
+});
+function lingerScratchWorktree() {
+    const wt = fs.mkdtempSync(path.join(LINGER_HOME, "wt-"));
+    execFileSync("git", ["init", "-q", "-b", "main"], { cwd: wt });
+    execFileSync("git", ["config", "user.email", "t@example.com"], { cwd: wt });
+    execFileSync("git", ["config", "user.name", "T"], { cwd: wt });
+    fs.writeFileSync(path.join(wt, "a.txt"), "a\n");
+    execFileSync("git", ["add", "."], { cwd: wt });
+    execFileSync("git", ["-c", "user.email=t@example.com", "-c", "user.name=T", "commit", "-q", "-m", "init"], {
+        cwd: wt,
+    });
+    return wt;
+}
+async function runLingeringMuse(opts) {
+    const keys = [
+        "MUSE_CLI",
+        "FAKE_MUSE_SCENARIO",
+        "META_API_KEY",
+        "AGENT_DEALER_HOME",
+        "MUSE_TERMINAL_GRACE_MS",
+        "MUSE_IDLE_TIMEOUT_MS",
+    ];
+    const prev = Object.fromEntries(keys.map((k) => [k, process.env[k]]));
+    const wt = lingerScratchWorktree();
+    const dealerHome = fs.mkdtempSync(path.join(LINGER_HOME, "home-"));
+    const startedAt = Date.now();
+    try {
+        process.env.MUSE_CLI = FAKE_MUSE;
+        process.env.FAKE_MUSE_SCENARIO = opts.scenario;
+        process.env.META_API_KEY = "mk-test-linger-key";
+        process.env.AGENT_DEALER_HOME = dealerHome;
+        process.env.MUSE_TERMINAL_GRACE_MS = opts.graceMs;
+        process.env.MUSE_IDLE_TIMEOUT_MS = "0";
+        const result = await runMuseDeveloperSession({
+            sessionId: opts.sessionId,
+            runtime: "muse_code",
+            policy: { worktreeWrite: true },
+            model: MUSE_CODE_CONTRIBUTOR_MODEL,
+            deckId: "00000000-0000-4000-a000-000000000099",
+            agentDeckUrl: "http://127.0.0.1:1110/mcp",
+            prompt: "Implement it",
+            cwd: wt,
+            timeoutMs: opts.timeoutMs,
+            logPath: path.join(dealerHome, `muse-${opts.sessionId}.ndjson`),
+        });
+        return {
+            timedOut: result.timedOut,
+            // Assert top-level and muse summary separately — a regression that drops
+            // either field must fail (do not coalesce with ??).
+            lingeredAfterTerminal: result.lingeredAfterTerminal,
+            museLingeredAfterTerminal: result.muse?.lingeredAfterTerminal,
+            failureMessage: result.muse?.failure?.message ?? null,
+            failureKind: result.muse?.failure?.kind ?? null,
+            elapsedMs: Date.now() - startedAt,
+            logPath: result.logPath,
+        };
+    }
+    finally {
+        for (const k of keys) {
+            if (prev[k] === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = prev[k];
+        }
+        fs.rmSync(wt, { recursive: true, force: true });
+        fs.rmSync(dealerHome, { recursive: true, force: true });
+    }
+}
+test("a Muse transport-error that lingers is recorded as a failure, not a timeout", { timeout: 15_000 }, async () => {
+    const out = await runLingeringMuse({
+        scenario: "transport-linger",
+        graceMs: "200",
+        timeoutMs: 20_000,
+        sessionId: "00000000-0000-4000-8000-000000000342",
+    });
+    assert.ok(out.elapsedMs < 5_000, `settled on the grace, took ${out.elapsedMs}ms`);
+    assert.equal(out.timedOut, false);
+    assert.equal(out.lingeredAfterTerminal, true);
+    assert.equal(out.museLingeredAfterTerminal, true);
+    assert.match(out.failureMessage ?? "", /transport error/);
+});
+test("a completed Muse run that lingers is still a completion, not a timeout", { timeout: 15_000 }, async () => {
+    const out = await runLingeringMuse({
+        scenario: "completed-linger",
+        graceMs: "200",
+        timeoutMs: 20_000,
+        sessionId: "00000000-0000-4000-8000-000000000344",
+    });
+    assert.equal(out.timedOut, false);
+    assert.equal(out.lingeredAfterTerminal, true);
+    assert.equal(out.museLingeredAfterTerminal, true);
+    assert.equal(out.failureMessage, null);
+});
+test("MUSE_TERMINAL_GRACE_MS=0 leaves a lingering Muse child to the wall clock", { timeout: 15_000 }, async () => {
+    const out = await runLingeringMuse({
+        scenario: "transport-linger",
+        graceMs: "0",
+        timeoutMs: 500,
+        sessionId: "00000000-0000-4000-8000-000000000343",
+    });
+    assert.equal(out.lingeredAfterTerminal, false);
+    assert.equal(out.museLingeredAfterTerminal, false);
+    assert.equal(out.timedOut, true, "without the grace, the wall clock still kills");
+});
+// NOT-342 repair: a cron run's terminal must not arm the 30s grace and SIGTERM the
+// still-working primary. The child has no primary terminal — only the wall clock kills.
+test("a cron terminal before the primary does not arm terminal grace", { timeout: 15_000 }, async () => {
+    const out = await runLingeringMuse({
+        scenario: "cron-terminal-then-primary-linger",
+        graceMs: "200",
+        timeoutMs: 800,
+        sessionId: "00000000-0000-4000-8000-000000000345",
+    });
+    assert.equal(out.lingeredAfterTerminal, false, "cron terminal must not linger-kill");
+    assert.equal(out.museLingeredAfterTerminal, false);
+    assert.equal(out.timedOut, true, "wall clock still owns the kill when primary never terminals");
+    assert.notEqual(out.failureKind, "malformed_stream");
+});
+test("createMusePrimaryTerminalMatcher is what Muse wires for terminalGrace", () => {
+    // Sanity: the factory exists and matches the shape spawnCli expects.
+    const m = createMusePrimaryTerminalMatcher();
+    assert.equal(typeof m.isTerminalLine, "function");
+    assert.equal(typeof m.sawPrimaryTerminal, "function");
+    assert.equal(m.sawPrimaryTerminal(), false);
+});

package/bundle/server/dist/coordinator/operator-criteria.js

@@ -0,0 +1,168 @@
+// packages/server/src/coordinator/operator-criteria.ts
+//
+// NOT-314: `[operator]`-tagged acceptance criteria are a first-class merge gate.
+// Some ACs can only be proven by a human with real credentials, a real login, or
+// a paid session — the builder discovers this mid-run and today burns rounds
+// before raising a product-scope escalation. Instead the tag is deliberate: the
+// frozen snapshot's operator criteria block auto-merge until a human records the
+// result (verified / waive) or sends the work back (repair).
+//
+// This module is pure except for the frozen-snapshot + verification-record
+// readers at the bottom. The gate itself lives in auto-merge.ts
+// (finalizeAutoMergeOnce, after reviewer approve, before the `gh` merge);
+// resolution lives in commands.ts's resolveHumanActionAndAdvance.
+import { latestIssueArtifact } from "../repository/artifacts.js";
+import { listArtifactsForIssueByKind } from "../repository/artifacts-for-issue.js";
+import { listWorkflowEventsForIssue } from "../repository/workflow-events.js";
+/** The frozen snapshot artifact kind — same string as commands.ts's
+ * TASK_SNAPSHOT_ARTIFACT_KIND, repeated here so this module never imports the
+ * coordinator kernel (commands.ts imports auto-merge.ts, which imports this). */
+const TASK_SNAPSHOT_KIND = "task_snapshot";
+/** Issue artifact kind holding a recorded `verified` result (author human). */
+export const OPERATOR_VERIFICATION_ARTIFACT_KIND = "operator_verification";
+/**
+ * NOT-314: the stored response options for an `operator_verification` action.
+ * Shared by auto-merge.ts (which raises it) and commands.ts's responseOptionsFor
+ * so the two can never drift apart — same pattern as MERGE_FAILURE_RESPONSE_OPTIONS.
+ */
+export const OPERATOR_VERIFICATION_RESPONSE_OPTIONS = [
+    { choice: "verified", label: "Verified — merge" },
+    { choice: "waive", label: "Waive — merge without it" },
+    { choice: "repair", label: "Another repair round" },
+];
+/** Dedupe key for the gate's action: one open action per issue + head SHA. */
+export function operatorVerificationRequestId(headSha) {
+    return `operator-verification:${headSha}`;
+}
+const OPERATOR_TAG_RE = /\[operator\]/i;
+/** An indented checkbox (a nested sub-task) — never a command, never a gate. */
+const INDENTED_CHECKBOX_RE = /^\s+[-*]\s*\[[ xX]?\]/;
+/** An indented plain bullet — an evidence/command sub-bullet. */
+const INDENTED_BULLET_RE = /^\s+[-*]\s+(.*)$/;
+/**
+ * Returns each top-level (unindented) checkbox AC whose text contains the token
+ * `[operator]` (case-insensitive, anywhere in the line), together with the
+ * indented bullet lines directly under it (the command to run).
+ *
+ * "Top-level" means the checkbox marker starts at column 0; indented
+ * checkboxes (sub-tasks) never open the gate. Collection of a criterion's
+ * commands stops at the next column-0 checkbox, a non-bullet line, or EOF —
+ * blank lines inside the sub-bullet block are skipped, not terminators.
+ */
+export function extractOperatorCriteria(acceptanceCriteria) {
+    const found = [];
+    const lines = acceptanceCriteria.split("\n");
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        const top = line.match(/^[-*]\s*\[[ xX]?\]\s*(.*)$/);
+        if (top && OPERATOR_TAG_RE.test(top[1] ?? "")) {
+            const criterion = { text: (top[1] ?? "").trim(), commands: [] };
+            i += 1;
+            while (i < lines.length) {
+                const sub = lines[i];
+                if (/^\s*$/.test(sub)) {
+                    i += 1;
+                    continue;
+                }
+                // A column-0 checkbox ends this criterion's block (operator or not —
+                // the outer loop classifies it).
+                if (/^[-*]\s*\[[ xX]?\]\s*/.test(sub))
+                    break;
+                // A nested (indented) checkbox is a sub-task, not a command — it ends
+                // the block without being collected.
+                if (INDENTED_CHECKBOX_RE.test(sub))
+                    break;
+                const bullet = sub.match(INDENTED_BULLET_RE);
+                if (bullet) {
+                    criterion.commands.push((bullet[1] ?? "").trim());
+                    i += 1;
+                    continue;
+                }
+                break;
+            }
+            found.push(criterion);
+            continue;
+        }
+        i += 1;
+    }
+    return found;
+}
+/** The frozen snapshot's acceptanceCriteria, falling back to the live issue
+ * fields for items queued before snapshots existed (same fallback as
+ * commands.ts's getTaskSnapshot). */
+export function snapshotAcceptanceCriteria(issue) {
+    try {
+        const artifact = latestIssueArtifact(issue.id, TASK_SNAPSHOT_KIND);
+        if (artifact?.contentJson) {
+            const parsed = JSON.parse(artifact.contentJson);
+            if (typeof parsed.acceptanceCriteria === "string")
+                return parsed.acceptanceCriteria;
+        }
+    }
+    catch {
+        // fall through to the live-field fallback below
+    }
+    return issue.acceptanceCriteria ?? "";
+}
+/** The frozen snapshot's `[operator]` criteria for this issue ([] when none). */
+export function getOperatorCriteriaForIssue(issue) {
+    return extractOperatorCriteria(snapshotAcceptanceCriteria(issue));
+}
+function recordHeadSha(record) {
+    return record && typeof record.headSha === "string" && record.headSha ? record.headSha : null;
+}
+/**
+ * True when the human already recorded a result for exactly `headSha`: either a
+ * `verified` artifact (kind `operator_verification`, author human) or a
+ * `operator_verification.waived` workflow event. A result pins the head it was
+ * recorded at — new commits re-block the gate.
+ */
+export function hasOperatorVerificationForHead(issueId, headSha) {
+    if (!headSha)
+        return false;
+    try {
+        for (const artifact of listArtifactsForIssueByKind(issueId, OPERATOR_VERIFICATION_ARTIFACT_KIND)) {
+            if (!artifact.contentJson)
+                continue;
+            try {
+                const record = JSON.parse(artifact.contentJson);
+                if (recordHeadSha(record) === headSha)
+                    return true;
+            }
+            catch {
+                // unreadable artifact content cannot prove verification
+            }
+        }
+    }
+    catch {
+        // a read failure fails closed below (no verification found → gate blocks)
+    }
+    try {
+        for (const event of listWorkflowEventsForIssue(issueId)) {
+            if (event.type !== "operator_verification.waived" || !event.payloadJson)
+                continue;
+            try {
+                const record = JSON.parse(event.payloadJson);
+                if (recordHeadSha(record) === headSha)
+                    return true;
+            }
+            catch {
+                // unreadable payload cannot prove a waiver
+            }
+        }
+    }
+    catch {
+        // same fail-closed reasoning as above
+    }
+    return false;
+}
+/** One numbered criterion + its commands, for the gate's reason/question. */
+export function formatOperatorCriteria(criteria) {
+    return criteria.flatMap((criterion, index) => {
+        const lines = [`${index + 1}. ${criterion.text}`];
+        for (const command of criterion.commands)
+            lines.push(`   - ${command}`);
+        return lines;
+    });
+}

package/bundle/server/dist/coordinator/operator-criteria.test.js

@@ -0,0 +1,78 @@
+// NOT-314: `[operator]` criterion parser — pure cases (no DB).
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { extractOperatorCriteria } from "./operator-criteria.js";
+test("two [operator] ACs return both; the indented command sub-bullet is collected", () => {
+    const criteria = extractOperatorCriteria([
+        "- [ ] Agent can list sessions from the registry",
+        "- [ ] Operator can sign in with SSO and see the org dashboard [operator]",
+        "  - `npm run probe:sso -- --env staging`",
+        "- [ ] Sessions expire after 30 days of inactivity",
+        "- [ ] Operator can complete a paid checkout in the sandbox [operator]",
+        "",
+        "- [ ] Docs describe the probe",
+    ].join("\n"));
+    assert.equal(criteria.length, 2);
+    assert.equal(criteria[0].text, "Operator can sign in with SSO and see the org dashboard [operator]");
+    assert.deepEqual(criteria[0].commands, ["`npm run probe:sso -- --env staging`"]);
+    assert.equal(criteria[1].text, "Operator can complete a paid checkout in the sandbox [operator]");
+    assert.deepEqual(criteria[1].commands, []);
+});
+test("a snapshot with no [operator] AC returns an empty list", () => {
+    assert.deepEqual(extractOperatorCriteria("- [ ] Agent lists sessions\n- [ ] Sessions expire after 30d\n"), []);
+    assert.deepEqual(extractOperatorCriteria(""), []);
+});
+test("tag case variants match: [OPERATOR], [Operator], [oPeRaToR]", () => {
+    const criteria = extractOperatorCriteria(["- [ ] First [OPERATOR]", "- [ ] Second [Operator]", "- [ ] Third [oPeRaToR]"].join("\n"));
+    assert.equal(criteria.length, 3);
+});
+test("tag position variants match: leading, middle, trailing, and bare", () => {
+    const criteria = extractOperatorCriteria([
+        "- [ ] [operator] Leading tag proves login",
+        "- [ ] Middle [operator] tag proves login",
+        "- [ ] Trailing tag proves login [operator]",
+        "- [ ] [operator]",
+    ].join("\n"));
+    assert.equal(criteria.length, 4);
+    assert.equal(criteria[0].text, "[operator] Leading tag proves login");
+});
+test("multiple indented sub-bullets all collect; blank lines inside the block are skipped", () => {
+    const criteria = extractOperatorCriteria([
+        "- [ ] Paid checkout works end to end [operator]",
+        "  - `npm run probe:checkout -- --env staging`",
+        "",
+        "  - see docs/probes/checkout.md for the test card",
+    ].join("\n"));
+    assert.equal(criteria.length, 1);
+    assert.deepEqual(criteria[0].commands, [
+        "`npm run probe:checkout -- --env staging`",
+        "see docs/probes/checkout.md for the test card",
+    ]);
+});
+test("indented (nested) checkboxes never open the gate, even with the tag", () => {
+    const criteria = extractOperatorCriteria(["- [ ] Parent task", "  - [ ] Nested subtask [operator]", "- [ ] Other"].join("\n"));
+    assert.deepEqual(criteria, []);
+});
+test("a checked box with the tag still matches, and `*` markers work", () => {
+    const criteria = extractOperatorCriteria(["* [x] Already proven by hand [operator]", "- [ ] Plain task"].join("\n"));
+    assert.equal(criteria.length, 1);
+    assert.equal(criteria[0].text, "Already proven by hand [operator]");
+});
+test("the next top-level checkbox ends the command block; prose ends it too", () => {
+    const criteria = extractOperatorCriteria([
+        "- [ ] First [operator]",
+        "  - `cmd-one`",
+        "- [ ] Second without tag",
+        "- [ ] Third [operator]",
+        "  - `cmd-three`",
+        "Trailing prose, not a bullet.",
+        "- [ ] Fourth [operator]",
+    ].join("\n"));
+    assert.equal(criteria.length, 3);
+    assert.deepEqual(criteria[0].commands, ["`cmd-one`"]);
+    assert.deepEqual(criteria[1].commands, ["`cmd-three`"]);
+    assert.deepEqual(criteria[2].commands, []);
+});
+test("[agent] in AC text is not an operator criterion", () => {
+    assert.deepEqual(extractOperatorCriteria("- [ ] Agent lists sessions [agent]\n"), []);
+});