agent-relay-server 0.11.6 → 0.11.9

package/src/steward.ts

@@ -0,0 +1,117 @@
+import { createHash } from "node:crypto";
+import { basename, isAbsolute, relative, resolve } from "node:path";
+import { getSpawnPolicy, getStewardConfig, setConfig } from "./config-store";
+import { listOrchestrators } from "./db";
+import { getLifecycleManager } from "./lifecycle-manager";
+import type { Orchestrator, SpawnPolicy, StewardConfig } from "./types";
+
+// Real path containment (same rule as routes/mcp/lifecycle): never string startsWith.
+function pathWithinBase(path: string | undefined, baseDir: string | undefined): boolean {
+  if (!path || !baseDir) return false;
+  const rel = relative(resolve(baseDir), resolve(path));
+  return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+
+/** Stable, readable, collision-resistant policy name for a repo's steward. */
+export function repoStewardPolicyName(repoRoot: string): string {
+  const slug = basename(repoRoot).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
+  const hash = createHash("sha1").update(resolve(repoRoot)).digest("hex").slice(0, 8);
+  return `steward-${slug}-${hash}`;
+}
+
+/**
+ * The steward's system prompt — provider-agnostic (works for any provider/model).
+ * It tells the agent the workflow: take the worktrees it can't auto-land, rebase,
+ * resolve, run the repo's checks, and land green ones via the relay merge API;
+ * escalate only what genuinely needs a human.
+ */
+export function buildStewardPrompt(repoRoot: string): string {
+  return [
+    `You are the autonomous repository steward for ${repoRoot}.`,
+    "",
+    "Multiple agents work this repo in isolated git worktrees. The relay auto-merges branches that fast-forward cleanly; it hands YOU the ones it can't — merge conflicts, or a branch whose base moved on (behind > 0). Your job is to land that work with no human in the loop whenever you safely can.",
+    "",
+    "When woken, gather what needs attention: read the message(s) you were sent (each names a `workspaceId`, `worktreePath`, `branch`, `baseRef`, `status`), and also query `GET /api/workspaces?status=conflict` and `GET /api/workspaces?status=review_requested` for this repo. Handle one workspace at a time — the relay's per-repo merge lease serializes you with any other merger.",
+    "",
+    "For each workspace:",
+    "1. `cd` into its `worktreePath`.",
+    "2. Rebase the branch onto its `baseRef` (`git rebase <baseRef>`).",
+    "3. Resolve any conflicts faithfully — preserve the intent of EVERY side; never silently drop a change. If a conflict needs product judgment you can't make confidently, stop and escalate.",
+    "4. Run the repo's checks/tests (look for the project's documented commands). Fix trivial breakage you caused while rebasing; do not paper over real failures.",
+    "5. If green, land it: `POST /api/workspaces/<id>/actions` with `{\"action\":\"merge\",\"strategy\":\"rebase-ff\"}`. The relay acquires the lease and dispatches the merge.",
+    "",
+    "Escalate (do NOT merge) when: checks fail and you can't fix them, the conflict resolution is genuinely ambiguous, or anything looks risky. Send a clear, specific summary to the configured fallback/human target and leave the workspace as-is. Never force-merge a red branch, never `git push --force` to a shared base, never discard committed work.",
+    "",
+    "Be terminal-efficient and decisive. When the queue is empty, you're done — you'll be woken again when there's more.",
+  ].join("\n");
+}
+
+function desiredStewardPolicy(repoRoot: string, owner: Orchestrator, config: StewardConfig): SpawnPolicy {
+  // Launch (and scope the runtime token) at the orchestrator's baseDir, not the
+  // repo: isolated worktrees live at `<baseDir>/.agent-relay/workspaces/...`
+  // (orchestrator/src/spawn.ts), OUTSIDE repo_root. The steward must reach both the
+  // repo and those worktrees, and its provider-agent token's cwdPrefixes derive
+  // from this cwd — baseDir is their common ancestor, so the merge action against a
+  // worktree path passes authorization. The prompt scopes it to the specific repo.
+  return {
+    name: repoStewardPolicyName(repoRoot),
+    description: `Autonomous repo steward for ${repoRoot} (issue #167).`,
+    enabled: true,
+    orchestratorId: owner.id,
+    cwd: owner.baseDir,
+    provider: config.provider,
+    workspaceMode: "inherit",
+    ...(config.model ? { model: config.model } : {}),
+    ...(config.effort ? { effort: config.effort } : {}),
+    providerArgs: [],
+    prompt: buildStewardPrompt(repoRoot),
+    tags: ["steward"],
+    capabilities: ["merge", "review"],
+    label: `steward:${basename(repoRoot)}`,
+    mode: "on-demand",
+    permissionMode: config.permissionMode,
+    restartOnUpdate: false,
+    scheduledDailyRestart: false,
+    onDemand: { keepaliveSeconds: config.keepaliveSeconds, idleDefinition: "no-activity" },
+    backoff: { schedule: [30, 60, 180], resetAfterSeconds: 300 },
+  };
+}
+
+// Fields whose change means the persisted policy should be refreshed. Avoids
+// churning the config version (and the lifecycle reconcile) every sweep.
+function stewardPolicyDiffers(existing: SpawnPolicy, desired: SpawnPolicy): boolean {
+  return (
+    existing.enabled !== desired.enabled ||
+    existing.provider !== desired.provider ||
+    existing.model !== desired.model ||
+    existing.effort !== desired.effort ||
+    existing.permissionMode !== desired.permissionMode ||
+    existing.cwd !== desired.cwd ||
+    existing.orchestratorId !== desired.orchestratorId ||
+    existing.prompt !== desired.prompt ||
+    existing.onDemand?.keepaliveSeconds !== desired.onDemand?.keepaliveSeconds
+  );
+}
+
+/**
+ * Ensure an on-demand steward spawn policy exists for `repoRoot`, built from the
+ * global steward config (issue #167). Returns the policy name (durable `policy:`
+ * target the caller wakes), or null when stewards are disabled or no orchestrator
+ * owns the repo. Idempotent — refreshes the policy only when config-derived fields
+ * change, so it can be called on every sweep without churn.
+ */
+export function ensureRepoSteward(repoRoot: string): string | null {
+  const config = getStewardConfig();
+  if (!config.enabled) return null;
+  const owner = listOrchestrators().find((orch) => pathWithinBase(repoRoot, orch.baseDir));
+  if (!owner) return null;
+
+  const name = repoStewardPolicyName(repoRoot);
+  const desired = desiredStewardPolicy(repoRoot, owner, config);
+  const existing = getSpawnPolicy(name);
+  if (existing && !stewardPolicyDiffers(existing.value, desired)) return name;
+
+  setConfig("spawn-policy", name, desired, "steward-autoprovision");
+  getLifecycleManager().onConfigChanged("spawn-policy", name);
+  return name;
+}

package/src/workspace-merge.ts

@@ -0,0 +1,108 @@
+import { isAbsolute, relative, resolve } from "node:path";
+import { createCommand } from "./commands-db";
+import {
+  acquireMergeLease,
+  listOrchestrators,
+  releaseMergeLease,
+  setMergeLeaseCommand,
+  updateWorkspaceStatus,
+} from "./db";
+import type { Command, WorkspaceMergeStrategy, WorkspaceRecord } from "./types";
+
+export interface RequestWorkspaceMergeOptions {
+  /** Who asked for the merge (lease holder + audit). e.g. an agent id, "dashboard", "auto-merge". */
+  requestedBy: string;
+  /** Merge strategy; "auto" lets the host pick pr-vs-rebase-ff. Defaults to "auto". */
+  strategy?: WorkspaceMergeStrategy;
+  /** Delete the agent branch after a successful land. Defaults to true. */
+  deleteBranch?: boolean;
+  prTitle?: string;
+  prBody?: string;
+  /** Extra metadata merged onto the workspace row when moving to merge_planned. */
+  metadata?: Record<string, unknown>;
+}
+
+export type RequestWorkspaceMergeResult =
+  | { ok: true; command: Command; workspace: WorkspaceRecord }
+  | { ok: false; status: number; error: string };
+
+// Real path containment (same rule as routes/mcp): never string startsWith.
+function pathWithinBase(path: string | undefined, baseDir: string | undefined): boolean {
+  if (!path || !baseDir) return false;
+  const rel = relative(resolve(baseDir), resolve(path));
+  return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+
+/**
+ * Dispatch a base merge for an isolated workspace, serialized by the per-repo
+ * merge lease (issue #157). Single source of truth shared by the manual
+ * `POST /api/workspaces/:id/actions {action:"merge"}` route and the deterministic
+ * `workspace-auto-merge` maintenance job, so both honor the same lease + command
+ * contract.
+ *
+ * Acquires the lease BEFORE mutating status (a loser leaves the workspace
+ * untouched), binds it to the dispatched command so `postCommandResult` frees it
+ * on settle, and releases it on every early-out or throw. Does NOT emit the
+ * command event — the caller emits via its own `emitCommand` (kept module-local).
+ */
+export function requestWorkspaceMerge(workspace: WorkspaceRecord, opts: RequestWorkspaceMergeOptions): RequestWorkspaceMergeResult {
+  if (workspace.mode !== "isolated" || !workspace.worktreePath) {
+    return { ok: false, status: 422, error: `workspace ${workspace.id} has no worktree to merge` };
+  }
+  const lease = acquireMergeLease(workspace.repoRoot, workspace.id, opts.requestedBy);
+  if (!lease.ok) {
+    return {
+      ok: false,
+      status: 409,
+      error: `a merge is already in progress for ${workspace.repoRoot} (workspace ${lease.lease.workspaceId}); retry after it settles`,
+    };
+  }
+  try {
+    // Merge needs a live host: rebasing against a stale base later is unsafe.
+    const onlineOwner = listOrchestrators().find(
+      (candidate) => candidate.status === "online" && pathWithinBase(workspace.sourceCwd, candidate.baseDir),
+    );
+    if (!onlineOwner) {
+      releaseMergeLease({ repoRoot: workspace.repoRoot, workspaceId: workspace.id });
+      return { ok: false, status: 409, error: "no online orchestrator available for workspace merge" };
+    }
+    const updated = updateWorkspaceStatus(workspace.id, "merge_planned", {
+      ...(opts.metadata ?? {}),
+      lastWorkspaceAction: "merge",
+      lastWorkspaceActionAt: Date.now(),
+    });
+    if (!updated) {
+      releaseMergeLease({ repoRoot: workspace.repoRoot, workspaceId: workspace.id });
+      return { ok: false, status: 404, error: "workspace not found" };
+    }
+    const command = createCommand({
+      type: "workspace.merge",
+      source: "system",
+      target: onlineOwner.agentId,
+      correlationId: workspace.id,
+      params: {
+        action: "merge",
+        workspaceId: workspace.id,
+        repoRoot: workspace.repoRoot,
+        worktreePath: workspace.worktreePath,
+        branch: workspace.branch,
+        baseRef: workspace.baseRef,
+        baseSha: workspace.baseSha,
+        strategy: opts.strategy ?? "auto",
+        deleteBranch: opts.deleteBranch !== false,
+        prTitle: opts.prTitle,
+        prBody: opts.prBody,
+        requestedBy: opts.requestedBy,
+        requestedAt: Date.now(),
+      },
+    });
+    // Bind the lease to the dispatched command so it releases by id on settle.
+    setMergeLeaseCommand(workspace.repoRoot, command.id);
+    return { ok: true, command, workspace: updated };
+  } catch (e) {
+    // Acquired the lease but failed before dispatch — release it or the repo
+    // stays blocked until the TTL expires.
+    releaseMergeLease({ repoRoot: workspace.repoRoot, workspaceId: workspace.id });
+    throw e;
+  }
+}