agentxchain 2.155.73 → 2.156.0

package/dashboard/components/org-runs.js

@@ -0,0 +1,168 @@
+/**
+ * Org Runs component — renders cross-project run list as a filterable data table.
+ *
+ * Pure render function: takes data, returns HTML string.
+ * Follows the same pattern as ledger.js filter bar and run-history.js table.
+ */
+
+function esc(str) {
+  if (str == null) return '';
+  return String(str)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+function badge(label, color = 'var(--text-dim)') {
+  return `<span class="badge" style="color:${color};border-color:${color}">${esc(label)}</span>`;
+}
+
+function statusBadge(status) {
+  switch (status) {
+    case 'active': return badge('active', 'var(--green)');
+    case 'blocked': return badge('blocked', 'var(--yellow)');
+    case 'completed': return badge('completed', 'var(--green)');
+    case 'failed': return badge('failed', 'var(--red)');
+    default: return badge(status || 'unknown', 'var(--text-dim)');
+  }
+}
+
+function phaseBadge(phase) {
+  switch (phase) {
+    case 'planning': return badge('planning', 'var(--accent)');
+    case 'implementation': return badge('implementation', '#38bdf8');
+    case 'qa': return badge('qa', 'var(--yellow)');
+    default: return badge(phase || 'unknown', 'var(--text-dim)');
+  }
+}
+
+function formatUsd(amount) {
+  return '$' + (amount || 0).toFixed(2);
+}
+
+function relativeTime(isoString) {
+  if (!isoString) return '—';
+  try {
+    const dt = new Date(isoString);
+    const now = Date.now();
+    const diffMs = now - dt.getTime();
+    if (diffMs < 0) return esc(isoString);
+    const seconds = Math.floor(diffMs / 1000);
+    if (seconds < 60) return `${seconds}s ago`;
+    const minutes = Math.floor(seconds / 60);
+    if (minutes < 60) return `${minutes}m ago`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 24) return `${hours}h ago`;
+    const days = Math.floor(hours / 24);
+    return `${days}d ago`;
+  } catch {
+    return esc(isoString);
+  }
+}
+
+function truncateRunId(runId) {
+  if (!runId) return '—';
+  return runId.length > 20 ? runId.slice(0, 20) + '...' : runId;
+}
+
+function renderFilterBar(runs, filter) {
+  const projectSet = new Set(runs.map(r => r.project_name));
+  const projectOptions = ['all', ...Array.from(projectSet).sort()];
+  const phaseOptions = ['all', 'planning', 'implementation', 'qa'];
+  const statusOptions = ['all', 'active', 'blocked', 'completed', 'failed'];
+
+  function options(list, selected) {
+    return list.map(v =>
+      `<option value="${esc(v)}"${v === selected ? ' selected' : ''}>${esc(v)}</option>`
+    ).join('');
+  }
+
+  return `<div class="filter-bar">
+    <label class="filter-control">
+      Project
+      <select data-view-control="org-runs-project">
+        ${options(projectOptions, filter?.project || 'all')}
+      </select>
+    </label>
+    <label class="filter-control">
+      Phase
+      <select data-view-control="org-runs-phase">
+        ${options(phaseOptions, filter?.phase || 'all')}
+      </select>
+    </label>
+    <label class="filter-control">
+      Status
+      <select data-view-control="org-runs-status">
+        ${options(statusOptions, filter?.status || 'all')}
+      </select>
+    </label>
+  </div>`;
+}
+
+function applyFilter(runs, filter) {
+  let filtered = runs;
+  if (filter?.project && filter.project !== 'all') {
+    filtered = filtered.filter(r => r.project_name === filter.project);
+  }
+  if (filter?.phase && filter.phase !== 'all') {
+    filtered = filtered.filter(r => r.phase === filter.phase);
+  }
+  if (filter?.status && filter.status !== 'all') {
+    filtered = filtered.filter(r => r.status === filter.status);
+  }
+  return filtered;
+}
+
+/**
+ * @param {{ orgRuns: object, liveMeta: object, filter?: object }} data
+ * @returns {string} HTML string
+ */
+export function render(data) {
+  const runsData = data?.orgRuns?.data || data?.orgRuns || null;
+  const runs = Array.isArray(runsData) ? runsData : (runsData?.data || []);
+  const filter = data?.filter || {};
+
+  if (!runs.length && !filter.project && !filter.phase && !filter.status) {
+    return `<div class="placeholder">
+      <h2>Org Runs</h2>
+      <p>No cross-project runs available. Register projects and start governed runs.</p>
+    </div>`;
+  }
+
+  const filtered = applyFilter(runs, filter);
+
+  const tableRows = filtered.map(r => `<tr>
+    <td>${esc(r.project_name)}</td>
+    <td class="mono">${esc(truncateRunId(r.run_id))}</td>
+    <td>${phaseBadge(r.phase)}</td>
+    <td>${statusBadge(r.status)}</td>
+    <td>${r.turns_completed || 0}</td>
+    <td>${formatUsd(r.cost_usd)}</td>
+    <td>${relativeTime(r.started_at)}</td>
+    <td>${relativeTime(r.updated_at)}</td>
+  </tr>`).join('');
+
+  return `<div class="section">
+  <h3>Org Runs (${filtered.length})</h3>
+  ${renderFilterBar(runs, filter)}
+  <table class="data-table">
+    <thead>
+      <tr>
+        <th>Project</th>
+        <th>Run ID</th>
+        <th>Phase</th>
+        <th>Status</th>
+        <th>Turns</th>
+        <th>Cost</th>
+        <th>Started</th>
+        <th>Updated</th>
+      </tr>
+    </thead>
+    <tbody>
+      ${tableRows || '<tr><td colspan="8" style="text-align:center;color:var(--text-dim)">No runs match filters</td></tr>'}
+    </tbody>
+  </table>
+</div>`;
+}

package/dashboard/index.html

@@ -395,6 +395,10 @@
   </header>
   <div class="action-banner" id="action-banner"></div>
   <nav>
+    <a href="#org-overview">Org Overview</a>
+    <a href="#org-runs">Org Runs</a>
+    <a href="#org-history">Org History</a>
+    <a href="#org-audit-trail">Audit Trail</a>
     <a href="#initiative">Initiative</a>
     <a href="#cross-repo">Cross-Repo</a>
     <a href="#timeline" class="active">Timeline</a>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentxchain",
-  "version": "2.155.73",
+  "version": "2.156.0",
   "description": "CLI for AgentXchain — governed multi-agent software delivery",
   "type": "module",
   "bin": {
@@ -75,6 +75,7 @@
     "node": ">=18.17.0 || >=20.5.0"
   },
   "devDependencies": {
+    "js-yaml": "^4.1.1",
     "vitest": "^4.1.2"
   }
 }

package/src/commands/ci-report.js

@@ -0,0 +1,80 @@
+import { buildRunExport } from '../lib/export.js';
+import { loadExportArtifact } from '../lib/export-verifier.js';
+import { buildGovernanceReport } from '../lib/report.js';
+import {
+  deriveCIExitCode,
+  detectCIEnvironment,
+  formatGitHubAnnotations,
+  formatJUnitXml,
+  writeGitHubOutputVars,
+} from '../lib/ci-reporter.js';
+
+export async function ciReportCommand(options) {
+  const cwd = process.cwd();
+  const format = options.format || 'auto';
+
+  // Step 1: Build or load the governance report
+  let report;
+  if (options.input && options.input !== '-') {
+    const loaded = loadExportArtifact(options.input, cwd);
+    if (!loaded.ok) {
+      console.error(loaded.error);
+      process.exitCode = 1;
+      return;
+    }
+    const result = buildGovernanceReport(loaded.artifact, { input: loaded.input });
+    report = result.report;
+  } else {
+    // Build from current project
+    const exportResult = buildRunExport(cwd);
+    if (!exportResult.ok) {
+      console.error(exportResult.error);
+      process.exitCode = 1;
+      return;
+    }
+    const result = buildGovernanceReport(exportResult.export, { input: 'current-project' });
+    report = result.report;
+  }
+
+  // Step 2: Detect CI environment and resolve format
+  const ci = detectCIEnvironment();
+  let resolvedFormat = format;
+  if (resolvedFormat === 'auto') {
+    if (ci?.provider === 'github_actions') {
+      resolvedFormat = 'github-actions';
+    } else {
+      resolvedFormat = 'json';
+    }
+  }
+
+  // Step 3: Emit formatted output
+  switch (resolvedFormat) {
+    case 'github-actions': {
+      const annotations = formatGitHubAnnotations(report);
+      console.log(annotations);
+
+      // Write output variables if $GITHUB_OUTPUT is set
+      const ghOutput = process.env.GITHUB_OUTPUT;
+      if (ghOutput) {
+        writeGitHubOutputVars(report, ghOutput);
+      }
+      break;
+    }
+    case 'junit-xml': {
+      const xml = formatJUnitXml(report);
+      console.log(xml);
+      break;
+    }
+    case 'json': {
+      console.log(JSON.stringify(report, null, 2));
+      break;
+    }
+    default:
+      console.error(`Unsupported ci-report format "${resolvedFormat}". Use "github-actions", "junit-xml", "json", or "auto".`);
+      process.exitCode = 1;
+      return;
+  }
+
+  // Step 4: Exit with CI-appropriate code
+  process.exitCode = deriveCIExitCode(report);
+}

package/src/commands/doctor.js

@@ -21,7 +21,7 @@ import { detectActiveTurnBindingDrift, detectStateBundleDesync } from '../lib/go
 import { findPendingApprovedIntents } from '../lib/intake.js';
 import { checkCleanBaseline } from '../lib/repo-observer.js';
 import { probeRuntimeSpawnContext } from '../lib/runtime-spawn-context.js';
-import { getClaudeSubprocessAuthIssue } from '../lib/claude-local-auth.js';
+import { getClaudeSubprocessAuthIssue, isCursorLocalCliRuntime, isWindsurfLocalCliRuntime, isOpenCodeLocalCliRuntime } from '../lib/claude-local-auth.js';
 
 export async function doctorCommand(opts = {}) {
   const root = findProjectRoot(process.cwd());
@@ -502,6 +502,27 @@ async function checkRuntimeReachable(root, rtId, rt, boundRoleEntries = []) {
     case 'local_cli': {
       const probe = probeRuntimeSpawnContext(root, rt, { runtimeId: rtId });
       if (probe.ok) {
+        if (isCursorLocalCliRuntime(rt)) {
+          return attachRuntimeContract({
+            ...base,
+            level: 'pass',
+            detail: `${probe.detail} (Cursor IDE local_cli connector)`,
+          }, rtId, rt, boundRoleEntries);
+        }
+        if (isWindsurfLocalCliRuntime(rt)) {
+          return attachRuntimeContract({
+            ...base,
+            level: 'pass',
+            detail: `${probe.detail} (Windsurf IDE local_cli connector)`,
+          }, rtId, rt, boundRoleEntries);
+        }
+        if (isOpenCodeLocalCliRuntime(rt)) {
+          return attachRuntimeContract({
+            ...base,
+            level: 'pass',
+            detail: `${probe.detail} (OpenCode local_cli connector)`,
+          }, rtId, rt, boundRoleEntries);
+        }
         const claudeAuthIssue = await getClaudeSubprocessAuthIssue(rt);
         if (claudeAuthIssue) {
           return attachRuntimeContract({

package/src/commands/intake-approve.js

@@ -18,6 +18,7 @@ export async function intakeApproveCommand(opts) {
   const result = approveIntent(root, opts.intent, {
     approver: opts.approver || undefined,
     reason: opts.reason || undefined,
+    forceScope: opts.forceScope || false,
   });
 
   if (opts.json) {

package/src/commands/replay.js

@@ -54,6 +54,7 @@ export async function replayTurnCommand(turnId, opts = {}) {
       root,
       verification: entry.verification,
       timeoutMs,
+      allowCommandExecution: Boolean(opts.execute),
     }),
   };
 

package/src/commands/run.js

@@ -18,6 +18,7 @@ import { readFileSync, existsSync, mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { loadProjectContext, loadProjectState } from '../lib/config.js';
 import { runLoop } from '../lib/run-loop.js';
+import { isCredentialedExitGate } from '../lib/approval-policy.js';
 import { transitionActiveTurnLifecycle } from '../lib/runner-interface.js';
 import { buildRunExport } from '../lib/export.js';
 import { buildGovernanceReport, formatGovernanceReportMarkdown } from '../lib/report.js';
@@ -365,6 +366,12 @@ export async function executeGovernedRun(context, opts = {}) {
         onStartupHeartbeat: ({ elapsed_since_spawn_ms }) => {
           tracker.heartbeat(`Adapter keepalive (${Math.round((elapsed_since_spawn_ms || 0) / 1000)}s since spawn)`);
         },
+        onLivenessHeartbeat: ({ elapsed_since_spawn_ms }) => {
+          // RB-6: refresh last_activity_at while the subprocess is alive but
+          // output-silent, so the stale-turn watchdog does not misfire during
+          // long quiet operations (e.g. running a test suite inside the turn).
+          tracker.heartbeat(`Subprocess alive (${Math.round((elapsed_since_spawn_ms || 0) / 1000)}s since spawn)`);
+        },
       };
 
       const recordOutputActivity = (stream, text) => {
@@ -438,6 +445,37 @@ export async function executeGovernedRun(context, opts = {}) {
           const transport = runtime ? resolvePromptTransport(runtime) : 'dispatch_bundle_only';
           log(chalk.dim(`  Dispatching to local CLI: ${runtime?.command || '(default)'}  transport: ${transport}`));
           adapterResult = await dispatchLocalCli(projectRoot, state, cfg, adapterOpts);
+
+          // Rate-limit backoff: if adapter classified as rate_limited + retryable,
+          // apply exponential backoff and re-dispatch. Does NOT consume max_turn_retries.
+          const RATE_LIMIT_MAX_RETRIES = 5;
+          const RATE_LIMIT_BASE_DELAY_MS = 2000;
+          const RATE_LIMIT_MAX_DELAY_MS = 120_000;
+          const RATE_LIMIT_BACKOFF_MULTIPLIER = 2;
+
+          let rateLimitAttempt = 0;
+          while (
+            adapterResult?.classified?.error_class === 'rate_limited' &&
+            adapterResult?.classified?.retryable === true &&
+            rateLimitAttempt < RATE_LIMIT_MAX_RETRIES
+          ) {
+            rateLimitAttempt++;
+            const resetMs = adapterResult.classified.reset_ms;
+            const exponentialDelay = Math.min(
+              RATE_LIMIT_MAX_DELAY_MS,
+              RATE_LIMIT_BASE_DELAY_MS * RATE_LIMIT_BACKOFF_MULTIPLIER ** (rateLimitAttempt - 1),
+            );
+            const delayMs = resetMs != null ? Math.max(resetMs, RATE_LIMIT_BASE_DELAY_MS) : exponentialDelay;
+            // Add jitter: 0-25% of delay
+            const jitter = Math.floor(Math.random() * delayMs * 0.25);
+            const totalDelay = delayMs + jitter;
+
+            log(chalk.yellow(`  Rate-limited by provider (attempt ${rateLimitAttempt}/${RATE_LIMIT_MAX_RETRIES}). Retrying in ${Math.ceil(totalDelay / 1000)}s...`));
+            await new Promise((resolve) => setTimeout(resolve, totalDelay));
+
+            log(chalk.dim(`  Re-dispatching after rate-limit backoff...`));
+            adapterResult = await dispatchLocalCli(projectRoot, state, cfg, adapterOpts);
+          }
         } else if (runtimeType === 'remote_agent') {
           ensureStartingState(null);
           ensureRunningState('request');
@@ -578,6 +616,15 @@ export async function executeGovernedRun(context, opts = {}) {
 
     async approveGate(gateType, state) {
       if (autoApprove) {
+        // Lights-out without blind trust: a credentialed gate (protecting an
+        // irreversible, external, or operator-owned action) is NEVER auto-approved,
+        // even under --auto-approve / continuous mode. It falls through to gate_held,
+        // so a human must approve it (agentxchain approve-transition / approve-completion).
+        if (isCredentialedExitGate(config, state?.phase)) {
+          const gateId = config?.routing?.[state?.phase]?.exit_gate;
+          log(chalk.red(`  Gate "${gateId}" is credentialed — auto-approval refused. A human must approve (lights-out without blind trust).`));
+          return false;
+        }
         log(chalk.yellow(`  Auto-approved ${gateType} gate`));
         return true;
       }

package/src/commands/serve.js

@@ -0,0 +1,64 @@
+/**
+ * agentxchain serve — start the hosted runner HTTP server.
+ *
+ * Exposes control plane API routes for remote run management and dispatches
+ * governed turns to cloud agent APIs via the execution worker.
+ *
+ * Usage:
+ *   agentxchain serve [--port 4100] [--host 127.0.0.1] [--project <path>]
+ */
+
+import { resolve } from 'node:path';
+import { findProjectRoot, loadProjectContext } from '../lib/config.js';
+import { createHostedRunner } from '../lib/api/hosted-runner.js';
+
+export async function serveCommand(opts) {
+  const rootHint = opts.project || process.cwd();
+  const root = findProjectRoot(resolve(rootHint));
+
+  if (!root) {
+    process.stderr.write(
+      `[agentxchain serve] Error: no agentxchain.json found at or above ${rootHint}\n`
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const ctx = loadProjectContext(root);
+  if (!ctx || !ctx.config) {
+    process.stderr.write(
+      `[agentxchain serve] Error: failed to load project configuration from ${root}\n`
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  const port = parseInt(opts.port || '4100', 10);
+  const host = opts.host || '127.0.0.1';
+
+  const additionalProjects = (opts.projects || '')
+    .split(',')
+    .map(p => p.trim())
+    .filter(Boolean)
+    .map(p => resolve(p));
+
+  const runner = createHostedRunner({
+    root,
+    config: ctx.config,
+    port,
+    host,
+    projects: additionalProjects,
+  });
+
+  await runner.start();
+  process.stderr.write(`[agentxchain serve] Hosted runner listening on http://${host}:${port}\n`);
+
+  const shutdown = async () => {
+    process.stderr.write('[agentxchain serve] Shutting down...\n');
+    await runner.stop();
+    process.exit(0);
+  };
+
+  process.on('SIGINT', shutdown);
+  process.on('SIGTERM', shutdown);
+}

package/src/commands/step.js

@@ -77,6 +77,7 @@ import { consumeNextApprovedIntent } from '../lib/intake.js';
 import { failTurnStartup, reconcileStaleTurns } from '../lib/stale-turn-watchdog.js';
 import { isKnownTurnRunningProofStream } from '../lib/dispatch-streams.js';
 import { getDispatchProgressRelativePath } from '../lib/dispatch-progress.js';
+import { checkpointAcceptedTurn } from '../lib/turn-checkpoint.js';
 
 export async function stepCommand(opts) {
   const context = loadProjectContext();
@@ -1002,6 +1003,21 @@ export async function stepCommand(opts) {
     }
 
     printAcceptSummary(acceptResult, config);
+
+    // Auto-checkpoint accepted turn so workspace is clean for next assignment
+    if (!opts.noCheckpoint && existsSync(join(root, '.git'))) {
+      const checkpoint = checkpointAcceptedTurn(root, { turnId: turn.turn_id });
+      if (!checkpoint.ok) {
+        console.log(`  ${chalk.yellow('Checkpoint:')} accepted but checkpoint failed`);
+        console.log(`  ${chalk.dim('Error:')}  ${checkpoint.error}`);
+        console.log(`  ${chalk.dim('Retry:')}  agentxchain checkpoint-turn --turn ${turn.turn_id}`);
+        console.log('');
+        process.exit(1);
+      }
+      if (!checkpoint.skipped) {
+        console.log(`  ${chalk.dim('Checkpoint:')} ${checkpoint.checkpoint_sha}`);
+      }
+    }
   } else {
     // Reject and potentially retry
     console.log(chalk.yellow('Validation failed:'));

package/src/commands/verify.js

@@ -244,6 +244,7 @@ export async function verifyTurnCommand(turnId, opts = {}) {
       root,
       verification: turnResult.verification,
       timeoutMs,
+      allowCommandExecution: Boolean(opts.execute),
     }),
   };