agentwrangler 0.1.0

package/dist/outcomes/github/credential.js

@@ -0,0 +1,195 @@
+/**
+ * src/outcomes/github/credential.ts — GitHub token reader.
+ *
+ * Reads "AgentWrangler-GithubToken" from Windows Credential Manager via a
+ * PowerShell P/Invoke call. Never logs the token. Never throws.
+ *
+ * Pattern mirrors src/oauth/usage.ts: typed {ok:true,data}|{ok:false,reason}.
+ *
+ * Clean degradation (HARD constraint from plan §4):
+ *   - AW_GITHUB_TOKEN environment variable → {ok:true,data:trimmed token}
+ *   - Token absent / empty blob → {ok:false,reason:'github-token-not-found'}
+ *   - PowerShell unavailable → {ok:false,reason:'powershell-unavailable'}
+ *   - Non-Windows → {ok:false,reason:'non-windows-platform'}
+ *   - Any exception → {ok:false,reason:message}
+ *   NEVER throws; NEVER crashes the daemon.
+ */
+import { execFile } from "node:child_process";
+import * as os from "node:os";
+const CREDENTIAL_TARGET = "AgentWrangler-GithubToken";
+// execFile's own timeout. Bumped from 10s: a cold `Add-Type` C# compile
+// (csc.exe) under the CPU/IO load right after a full-corpus back-scan can
+// legitimately exceed 10s. Node tries to kill the child at this bound.
+const EXECFILE_TIMEOUT_MS = 15_000;
+// Absolute settle bound. MUST exceed EXECFILE_TIMEOUT_MS so execFile's own
+// kill gets first chance; this is the backstop for the Windows failure mode
+// where execFile's timeout kill does NOT reap the grandchild (csc.exe) that
+// inherited the stdout pipe — the pipe stays open, the execFile callback
+// never fires, and without this guard the Promise (and outcomesRunning) would
+// hang forever. See runPowerShell.
+const HARD_TIMEOUT_MS = 20_000;
+/**
+ * PowerShell script that reads the credential blob via advapi32.
+ * Outputs only the token on stdout (or nothing on failure).
+ * Avoids cmdkey (can't reveal blobs); uses CredRead P/Invoke instead.
+ */
+const PS_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+Add-Type @"
+using System;
+using System.Runtime.InteropServices;
+using System.Text;
+public class CredMgr {
+  [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
+  public struct CREDENTIAL {
+    public int Flags;
+    public int Type;
+    public string TargetName;
+    public string Comment;
+    public System.Runtime.InteropServices.ComTypes.FILETIME LastWritten;
+    public int CredentialBlobSize;
+    public IntPtr CredentialBlob;
+    public int Persist;
+    public int AttributeCount;
+    public IntPtr Attributes;
+    public string TargetAlias;
+    public string UserName;
+  }
+  [DllImport("advapi32.dll", SetLastError=true, CharSet=CharSet.Unicode)]
+  public static extern bool CredRead(string target, int type, int flags, out IntPtr credential);
+  [DllImport("advapi32.dll", SetLastError=true)]
+  public static extern void CredFree([In] IntPtr buffer);
+}
+"@
+$ptr = [IntPtr]::Zero
+if ([CredMgr]::CredRead("${CREDENTIAL_TARGET}", 1, 0, [ref]$ptr)) {
+  $cred = [System.Runtime.InteropServices.Marshal]::PtrToStructure($ptr, [type][CredMgr+CREDENTIAL])
+  if ($cred.CredentialBlobSize -gt 0) {
+    $bytes = New-Object byte[] $cred.CredentialBlobSize
+    [System.Runtime.InteropServices.Marshal]::Copy($cred.CredentialBlob, $bytes, 0, $cred.CredentialBlobSize)
+    [CredMgr]::CredFree($ptr)
+    $tok = [System.Text.Encoding]::Unicode.GetString($bytes).Trim()
+    if ($tok.Length -gt 0) { Write-Output $tok }
+  } else {
+    [CredMgr]::CredFree($ptr)
+  }
+}
+`.trim();
+function defaultRawExec(script) {
+    return new Promise((resolve, reject) => {
+        const child = execFile("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], { timeout: EXECFILE_TIMEOUT_MS, killSignal: "SIGKILL", windowsHide: true }, (err, stdout, stderr) => {
+            if (err) {
+                reject(new Error(`powershell exit ${err.code}: ${stderr || err.message}`));
+                return;
+            }
+            resolve(stdout.trim());
+        });
+        child.on("error", (e) => reject(e));
+    });
+}
+/**
+ * Run a PowerShell script and ALWAYS settle within HARD_TIMEOUT_MS.
+ *
+ * `execFile`'s own timeout is not a reliable settle guarantee on Windows: if
+ * the timeout kill fails to reap a grandchild (e.g. csc.exe spawned by
+ * Add-Type) that still holds the inherited stdout pipe, the callback never
+ * fires and the underlying Promise hangs forever — which would stick the
+ * caller's `outcomesRunning` flag `true` and silently kill all future polls.
+ * This wrapper races the raw exec against a hard timer that rejects, so the
+ * returned Promise cannot hang regardless of the child's fate.
+ *
+ * `raw` is injectable for tests.
+ */
+export function runPowerShell(script, raw = defaultRawExec) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new Error(`powershell hard-timeout after ${HARD_TIMEOUT_MS}ms`));
+        }, HARD_TIMEOUT_MS);
+        raw(script).then((out) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(out);
+        }, (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            reject(err instanceof Error ? err : new Error(String(err)));
+        });
+    });
+}
+// Successful token, cached for the daemon's lifetime. The first read runs at
+// boot when the event loop is free (the caller defers it until after the
+// synchronous back-scan); every later 10-min poll then reuses this value
+// instead of re-spawning powershell.exe + recompiling Add-Type under load —
+// which is precisely the condition that can make the read slow/hang. Only
+// successful reads are cached, so a not-yet-configured token is still picked
+// up on a later poll. (A token rotated while the daemon runs needs a restart.)
+let cachedToken = null;
+/**
+ * Read the GitHub PAT from Windows Credential Manager.
+ * Returns {ok:true,data:token} or {ok:false,reason} — never throws.
+ */
+export async function readGithubToken(reader) {
+    if (reader !== undefined)
+        return reader();
+    const envToken = process.env.AW_GITHUB_TOKEN;
+    if (typeof envToken === "string") {
+        const token = envToken.trim();
+        if (token.length > 0) {
+            return { ok: true, data: token };
+        }
+    }
+    if (cachedToken !== null) {
+        return { ok: true, data: cachedToken };
+    }
+    if (os.platform() !== "win32") {
+        return { ok: false, reason: "non-windows-platform" };
+    }
+    try {
+        const token = await runPowerShell(PS_SCRIPT);
+        if (token.length === 0) {
+            return { ok: false, reason: "github-token-not-found" };
+        }
+        cachedToken = token;
+        return { ok: true, data: token };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (msg.includes("ENOENT") || msg.includes("not found") || msg.includes("spawn")) {
+            return { ok: false, reason: "powershell-unavailable" };
+        }
+        return { ok: false, reason: `credential-read-failed: ${msg}` };
+    }
+}
+/**
+ * Non-secret token status for the Settings UI. Mirrors the O9 usage-reader
+ * status pattern (getOAuthStatus): reports whether outcomes sync has a token
+ * and from which source, WITHOUT ever returning the token value. When no token
+ * is available the reason names the remedy (AW_GITHUB_TOKEN) so the feature is
+ * never silently dark. `reader` is injectable for tests.
+ */
+export async function getGithubTokenStatus(reader) {
+    if (reader === undefined) {
+        const envToken = process.env.AW_GITHUB_TOKEN;
+        if (typeof envToken === "string" && envToken.trim().length > 0) {
+            return { configured: true, source: "env" };
+        }
+    }
+    // reader===undefined here means no env token; delegate to the platform read.
+    // An injected reader stands in for the platform credential source.
+    const result = await readGithubToken(reader);
+    if (result.ok) {
+        return { configured: true, source: "credential-manager" };
+    }
+    const reason = os.platform() === "win32"
+        ? "outcomes sync: no GitHub token — set AW_GITHUB_TOKEN, or store AgentWrangler-GithubToken in Credential Manager"
+        : "outcomes sync: no GitHub token — set AW_GITHUB_TOKEN";
+    return { configured: false, source: null, reason };
+}

package/dist/outcomes/github/gh-cli-client.js

@@ -0,0 +1,340 @@
+/**
+ * src/outcomes/github/gh-cli-client.ts — GitHub reads via the `gh` CLI.
+ *
+ * Why this exists (T1 round 2 — event-loop starvation):
+ *   The fetch-based GithubSyncClient does its socket reads AND its
+ *   AbortSignal.timeout on the daemon's single event loop. During the outcomes
+ *   pass that loop is monopolised by the synchronous transcript-harvest / SHA
+ *   loop, so undici's socket callbacks are starved past the abort deadline and
+ *   even a prompt GitHub reply (~0.25s) aborts at the timeout — the pass never
+ *   reaches writeObservedOutcomes.
+ *
+ *   GhCliClient moves every GitHub read into a `gh api` child process. That
+ *   process has its OWN event loop, so the network completes independently of
+ *   the jammed parent loop; the parent only reads the finished result off an
+ *   OS-buffered pipe once it drains (linkSessions' setImmediate yields keep jam
+ *   windows short). No undici timers on the hot loop → no starvation aborts.
+ *
+ * Same contract as GithubSyncClient (implements GithubClient):
+ *   - Disabled (token ok:false) → every method returns {ok:false} and spawns
+ *     ZERO processes.
+ *   - Never throws; always {ok,data}|{ok:false,reason} (clean degradation).
+ *   - If `gh` is not installed the spawn error degrades to {ok:false,reason}.
+ *
+ * Auth: the daemon's own credential (Windows Credential Manager PAT) is passed
+ * to `gh` via GH_TOKEN, so AgentWrangler keeps using its configured token
+ * rather than whatever account `gh auth login` happens to hold.
+ *
+ * Note vs the fetch client: no ETag/304 conditional-request caching on this
+ * path (gh does not expose it); the sync watermark still bounds volume.
+ */
+import { spawn } from "node:child_process";
+import { aggregateCheckConclusion, normalizePRBody } from "../conclusions.js";
+import { projectPRHeadKey, projectPRPage, } from "./client.js";
+/**
+ * Termination bound for a single `gh` invocation. `gh` returns in ~0.25s;
+ * this generous backstop only fires if the parent loop is wedged continuously.
+ * Settlement follows the child's `close` event so cleanup never races open stdio.
+ */
+const GH_HARD_TIMEOUT_MS = 20_000;
+/** gh: "... (HTTP 404)" → 404. */
+function parseHttpStatus(stderr) {
+    const m = /\(HTTP (\d+)\)/.exec(stderr);
+    return m?.[1] !== undefined ? Number.parseInt(m[1], 10) : undefined;
+}
+/** Build the shared runner around an injectable spawn implementation. */
+export function createGhRunner(spawnFn = spawn) {
+    return (args, opts) => new Promise((resolve) => {
+        const env = { ...process.env, GH_PROMPT_DISABLED: "1" };
+        if (opts.token !== null)
+            env.GH_TOKEN = opts.token;
+        let child;
+        try {
+            child = spawnFn("gh", args, { env, windowsHide: true });
+        }
+        catch (e) {
+            resolve({
+                ok: false,
+                stdout: "",
+                stderr: e instanceof Error ? e.message : String(e),
+                code: null,
+            });
+            return;
+        }
+        // FIX 2: Collect Buffer chunks and decode once on close to avoid UTF-8
+        // corruption at pipe-chunk boundaries (e.g. multibyte chars in PR titles).
+        const outChunks = [];
+        const errChunks = [];
+        let stdoutBytes = 0;
+        let termination;
+        let settled = false;
+        const settle = (r) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(r);
+        };
+        const timer = setTimeout(() => {
+            if (termination !== undefined)
+                return;
+            termination = "timeout";
+            child.kill("SIGKILL");
+            // Do not settle here. `close` proves the child and its stdio handles are done.
+        }, opts.timeoutMs ?? GH_HARD_TIMEOUT_MS);
+        child.stdout?.on("data", (d) => {
+            if (termination !== undefined)
+                return;
+            if (opts.maxStdoutBytes !== undefined && stdoutBytes + d.byteLength > opts.maxStdoutBytes) {
+                termination = "stdout-limit";
+                child.kill("SIGKILL");
+                return;
+            }
+            outChunks.push(d);
+            stdoutBytes += d.byteLength;
+        });
+        child.stderr?.on("data", (d) => {
+            errChunks.push(d);
+        });
+        // ENOENT (gh not installed) and other spawn failures arrive here.
+        child.on("error", (e) => {
+            if (termination !== undefined)
+                return;
+            const stdout = Buffer.concat(outChunks).toString("utf8");
+            settle({ ok: false, stdout, stderr: e.message, code: null });
+        });
+        child.on("close", (code) => {
+            const stdout = Buffer.concat(outChunks).toString("utf8");
+            const stderr = Buffer.concat(errChunks).toString("utf8");
+            const httpStatus = parseHttpStatus(stderr);
+            const terminationMarker = termination === "timeout"
+                ? "\n[gh hard-timeout]"
+                : termination === "stdout-limit"
+                    ? "\n[gh stdout-limit]"
+                    : "";
+            settle({
+                ok: termination === undefined && code === 0,
+                stdout,
+                stderr: `${stderr}${terminationMarker}`,
+                code,
+                ...(httpStatus !== undefined ? { httpStatus } : {}),
+                ...(termination !== undefined ? { failure: termination } : {}),
+            });
+        });
+        // FIX 1: Guard stdin against EPIPE — if gh exits before reading stdin (e.g.
+        // ENOENT when gh is absent, or a fast auth failure), writing to the closed
+        // pipe would emit an unhandled 'error' event and crash the daemon.
+        child.stdin?.on("error", () => { });
+        if (opts.input !== undefined)
+            child.stdin?.write(opts.input);
+        child.stdin?.end();
+    });
+}
+export const defaultGhRunner = createGhRunner();
+// ---------------------------------------------------------------------------
+// Client
+// ---------------------------------------------------------------------------
+export class GhCliClient {
+    token;
+    runner;
+    constructor(tokenResult, runner = defaultGhRunner) {
+        this.token = tokenResult.ok ? tokenResult.data : null;
+        this.runner = runner;
+    }
+    get enabled() {
+        return this.token !== null;
+    }
+    disabledResult() {
+        return { ok: false, reason: "github-token-unset" };
+    }
+    errReason(prefix, r) {
+        if (r.httpStatus !== undefined)
+            return `${prefix}:${r.httpStatus}`;
+        if (/ENOENT|not recognized|no such file/i.test(r.stderr))
+            return `${prefix}:gh-not-found`;
+        return `${prefix}:${r.code ?? "spawn"}`;
+    }
+    run(args, input) {
+        return this.runner(args, { token: this.token, ...(input !== undefined ? { input } : {}) });
+    }
+    async listPRs(owner, repo, since) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const qs = new URLSearchParams({
+            state: "all",
+            sort: "updated",
+            direction: "desc",
+            per_page: "100",
+        });
+        if (since !== undefined)
+            qs.set("since", since);
+        const r = await this.run(["api", `repos/${owner}/${repo}/pulls?${qs}`]);
+        if (!r.ok)
+            return { ok: false, reason: this.errReason("github-api-error", r) };
+        try {
+            return projectPRPage(JSON.parse(r.stdout));
+        }
+        catch {
+            return { ok: false, reason: "github-pr-payload-invalid" };
+        }
+    }
+    async getPRHeadKey(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const r = await this.run(["api", `repos/${owner}/${repo}/pulls/${prNumber}`]);
+        if (!r.ok)
+            return { ok: false, reason: this.errReason("github-pr-error", r) };
+        try {
+            return projectPRHeadKey(JSON.parse(r.stdout));
+        }
+        catch {
+            return { ok: false, reason: "github-pr-payload-invalid" };
+        }
+    }
+    async getCheckConclusion(owner, repo, ref) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const r = await this.run([
+            "api",
+            `repos/${owner}/${repo}/commits/${ref}/check-runs?per_page=100`,
+        ]);
+        if (!r.ok)
+            return { ok: false, reason: this.errReason("github-checks-error", r) };
+        try {
+            return aggregateCheckConclusion(JSON.parse(r.stdout));
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-checks-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    async listPRCommits(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        // GitHub caps commits per page at 100; PRs with >100 commits truncate the SHA set
+        // (pre-existing limitation, same on both transports).
+        const r = await this.run([
+            "api",
+            `repos/${owner}/${repo}/pulls/${prNumber}/commits?per_page=100`,
+        ]);
+        if (!r.ok)
+            return { ok: false, reason: this.errReason("github-commits-error", r) };
+        try {
+            const data = JSON.parse(r.stdout);
+            return {
+                ok: true,
+                data: data.map((c) => ({ sha: c.sha, message: c.commit?.message ?? "" })),
+            };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-commits-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    async listPullsForCommit(owner, repo, sha) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const r = await this.run(["api", `repos/${owner}/${repo}/commits/${sha}/pulls`]);
+        // 404 = SHA not found in this repo → no PRs (non-fatal, mirror fetch transport).
+        // Any other failure (auth/rate-limit/network) propagates so coverage isn't silently lowered.
+        if (!r.ok) {
+            if (r.httpStatus === 404)
+                return { ok: true, data: [] };
+            return { ok: false, reason: this.errReason("github-commit-pulls-error", r) };
+        }
+        try {
+            const data = JSON.parse(r.stdout);
+            return { ok: true, data: data.map((p) => p.number) };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-commit-pulls-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    async getPRBody(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const r = await this.run(["api", `repos/${owner}/${repo}/pulls/${prNumber}`]);
+        if (!r.ok)
+            return { ok: false, reason: this.errReason("github-pr-error", r) };
+        try {
+            const data = JSON.parse(r.stdout);
+            return { ok: true, data: normalizePRBody(data) };
+        }
+        catch (e) {
+            return {
+                ok: false,
+                reason: `github-pr-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+            };
+        }
+    }
+    async getPRDiff(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const r = await this.run([
+            "api",
+            `repos/${owner}/${repo}/pulls/${prNumber}`,
+            "-H",
+            "Accept: application/vnd.github.diff",
+        ]);
+        if (!r.ok)
+            return { ok: false, reason: this.errReason("github-diff-error", r) };
+        return { ok: true, data: r.stdout };
+    }
+    async getReviewThreads(owner, repo, prNumber) {
+        if (!this.enabled)
+            return this.disabledResult();
+        const query = `
+      query($owner:String!, $repo:String!, $pr:Int!, $cursor:String) {
+        repository(owner:$owner, name:$repo) {
+          pullRequest(number:$pr) {
+            reviewThreads(first:100, after:$cursor) {
+              pageInfo { hasNextPage endCursor }
+              nodes { id isResolved }
+            }
+          }
+        }
+      }
+    `;
+        const allThreads = [];
+        let cursor = null;
+        do {
+            const input = JSON.stringify({
+                query,
+                variables: { owner, repo, pr: prNumber, cursor },
+            });
+            const r = await this.run(["api", "graphql", "--input", "-"], input);
+            if (!r.ok)
+                return { ok: false, reason: this.errReason("github-graphql-error", r) };
+            let body;
+            try {
+                body = JSON.parse(r.stdout);
+            }
+            catch (e) {
+                return {
+                    ok: false,
+                    reason: `github-graphql-fetch-error: ${e instanceof Error ? e.message : String(e)}`,
+                };
+            }
+            if (body.errors !== undefined && body.errors.length > 0) {
+                return {
+                    ok: false,
+                    reason: `github-graphql-errors: ${body.errors.map((e) => e.message).join("; ")}`,
+                };
+            }
+            const reviewThreads = body.data?.repository?.pullRequest?.reviewThreads;
+            allThreads.push(...(reviewThreads?.nodes ?? []));
+            const pageInfo = reviewThreads?.pageInfo;
+            if (pageInfo?.hasNextPage !== true)
+                break;
+            cursor = pageInfo.endCursor ?? null;
+        } while (cursor !== null);
+        return { ok: true, data: allThreads };
+    }
+}