automata-cli 0.11.0-develop.457 → 0.11.0-develop.468

package/README.md

@@ -133,6 +133,12 @@ One tick of the autonomous loop: answer the open issues whose newest message fro
 
 ---
 
+## `automata conductor`
+
+One cron-friendly tick of the conductor role, run as an allowed (human) account with its own run lock beside `do-work`'s. Reference: [docs/conductor.md](docs/conductor.md).
+
+---
+
 ## Development
 
 ### Prerequisites

package/dist/{ConfigWizard-QZ2CJJS3.js → ConfigWizard-KI43QOGG.js}

@@ -10,7 +10,7 @@ import {
   readConfig,
   readRawConfig,
   writeConfig
-} from "./chunk-OUJQLQP3.js";
+} from "./chunk-DTZB5FOY.js";
 
 // src/config/ConfigWizard.tsx
 import { useState } from "react";

package/dist/{chunk-OUJQLQP3.js → chunk-DTZB5FOY.js}

@@ -16,7 +16,7 @@ var DEFAULT_DO_WORK = {
   dumpOnBlock: true,
   postRunLog: true
 };
-var DEFAULT_DO_WORK_ISSUE_DISCUSS_PROMPT = "You are the agent named in the context below, working on a GitHub issue together with the people allowed to instruct you. Answer the messages marked NEW; the earlier messages are context only.\n\nDo not modify, create or delete any file, and do not create a branch or a pull request, UNLESS a message marked NEW explicitly asks you to implement the work. If it does: create a branch off the base branch named below, implement the change following the project's existing conventions, run the tests and the linter, and open a pull request whose body contains `Closes #<issue number>`.\n\nOtherwise do not touch the code at all: reply on the issue with the specification, the plan, or the open questions you need answered. Keep the reply short and concrete.\n\nEither way, always post a reply on the issue before you finish \u2014 including when you implemented and opened a pull request. Silence is indistinguishable from a crash, and the run will be reported as having produced no answer.";
+var DEFAULT_DO_WORK_ISSUE_DISCUSS_PROMPT = "You are the agent named in the context below, working on a GitHub issue together with the people allowed to instruct you. Answer the messages marked NEW; the earlier messages are context only.\n\nDo not modify, create or delete any file in the repository, and do not create a branch or a pull request, UNLESS a message marked NEW explicitly asks you to implement the work. If it does: create a branch off the base branch named below, implement the change following the project's existing conventions, run the tests and the linter, and open a pull request whose body contains `Closes #<issue number>`.\n\nOtherwise do not touch the code at all: reply on the issue with the specification, the plan, or the open questions you need answered. Keep the reply short and concrete.\n\nEither way, always post a reply on the issue before you finish \u2014 including when you implemented and opened a pull request. Silence is indistinguishable from a crash, and the run will be reported as having produced no answer.\n\nPost the reply yourself with the GitHub CLI: write it to a temporary file outside the repository (the only file you may create in this case) and run `gh issue comment <issue-number> --body-file <file>`, or `gh pr comment <pr-number> --body-file <file>` when you are replying on a pull request. `do-work` does not publish your output, so printing the answer to stdout does not count as a posted reply.";
 var DEFAULT_DO_WORK_PR_WORK_PROMPT = "You are the agent named in the context below, working on the pull request for a GitHub issue together with the people allowed to instruct you. Work on the branch named below, which is already checked out and up to date.\n\nAddress every message marked NEW and every unresolved review thread listed. Follow the project's existing conventions, run the tests and the linter, then commit and push to that branch. Do not merge the pull request and do not push to the base branch.\n\nOnce a review thread is fixed and pushed, resolve it (GraphQL `resolveReviewThread`) after replying; leave open any thread you did not fix. Reply on the pull request with a short summary of what you changed, or reply in the review thread when your answer belongs to a specific comment. Always post a reply \u2014 silence looks like a crash.";
 var DEFAULT_DO_WORK_PR_ORPHAN_PROMPT = "You are the agent named in the context below, working on a pull request that is not linked to any issue \u2014 a dependency bump, or another change opened without one \u2014 together with the people allowed to instruct you. Work on the branch named below, which is already checked out and up to date.\n\nAddress every message marked NEW and every unresolved review thread listed. Typical work here is finding out why the checks are failing, bringing the branch up to date with the base branch, and fixing whatever the change needs in order to be mergeable. Follow the project's existing conventions, run the tests and the linter, then commit and push to that branch.\n\nDo not merge the pull request, do not close it, and do not push to the base branch. If you conclude that it should be merged or closed, say so in your reply and leave the decision to the humans.\n\nOnce a review thread is fixed and pushed, resolve it (GraphQL `resolveReviewThread`) after replying; leave open any thread you did not fix. Reply on the pull request with a short summary of what you did and what you recommend, or reply in the review thread when your answer belongs to a specific comment. Always post a reply \u2014 silence looks like a crash.";
 var CONFIG_DIR = ".automata";

package/dist/index.js

@@ -11,10 +11,10 @@ import {
   readConfig,
   readRawConfig,
   writeConfig
-} from "./chunk-OUJQLQP3.js";
+} from "./chunk-DTZB5FOY.js";
 
 // src/index.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 
 // src/version.ts
 import { readFileSync } from "fs";
@@ -321,7 +321,7 @@ var configCommand = new Command("config").description("Configure automata settin
   const [{ render }, React, { ConfigWizard }] = await Promise.all([
     import("ink"),
     import("react"),
-    import("./ConfigWizard-QZ2CJJS3.js")
+    import("./ConfigWizard-KI43QOGG.js")
   ]);
   const { waitUntilExit } = render(React.createElement(ConfigWizard));
   await waitUntilExit();
@@ -3581,6 +3581,19 @@ function identityProblemFor(login2, agentUser, allowedUsers) {
   }
   return `\`gh\` is authenticated as "${login2}" but agentUser is "${agentUser}". Comments posted under that identity are neither the agent's nor an authorized user's, so they are filtered out of the conversation: the answer boundary would never advance and the same message would start a run on every tick. Authenticate \`gh\` as the agent account (${agentUser}) in this environment, or correct \`agentUser\`.`;
 }
+function conductorIdentityProblemFor(login2, agentUser, allowedUsers) {
+  if (login2 === null) {
+    return "Could not determine which account `gh` is authenticated as, and the conductor must run as an account listed in allowedUsers. Run `gh auth login` as that account, or set `GH_TOKEN` in the scheduler's environment.";
+  }
+  const lower = login2.toLowerCase();
+  if (lower === agentUser.toLowerCase()) {
+    return `\`gh\` is authenticated as "${login2}", which is the agent (agentUser). The conductor instructs the agent and must run as a different account listed in allowedUsers.`;
+  }
+  if (!allowedUsers.some((user) => user.toLowerCase() === lower)) {
+    return `\`gh\` is authenticated as "${login2}", which is not listed in allowedUsers. Authenticate \`gh\` as one of the allowed users, or add this account to allowedUsers.`;
+  }
+  return null;
+}
 
 // src/github/workDetection.ts
 var NO_ISSUE_MESSAGES = {
@@ -4137,12 +4150,15 @@ function readHeartbeat(token, cwd = process.cwd()) {
 var LOCK_DIR = ".automata";
 var LOCK_FILE = "automata.lock";
 var RUN_LOCK_RELATIVE_PATH = `${LOCK_DIR}/${LOCK_FILE}`;
+var CONDUCTOR_LOCK_FILE = "conductor.lock";
+var CONDUCTOR_LOCK_RELATIVE_PATH = `${LOCK_DIR}/${CONDUCTOR_LOCK_FILE}`;
 var AUTOMATA_OWN_PATHS = [
   RUN_LOCK_RELATIVE_PATH,
+  CONDUCTOR_LOCK_RELATIVE_PATH,
   HEARTBEAT_RELATIVE_PATH
 ];
-function lockPath() {
-  return join4(process.cwd(), LOCK_DIR, LOCK_FILE);
+function lockPath(lockFile = LOCK_FILE) {
+  return join4(process.cwd(), LOCK_DIR, lockFile);
 }
 function processStartedAt(pid) {
   try {
@@ -4278,8 +4294,8 @@ function publishLock(path, command, token) {
     }
   }
 }
-function acquireRunLock(command, staleMinutes) {
-  const path = lockPath();
+function acquireRunLock(command, staleMinutes, lockFile = LOCK_FILE) {
+  const path = lockPath(lockFile);
   const token = randomUUID();
   mkdirSync(join4(process.cwd(), LOCK_DIR), { recursive: true });
   if (publishLock(path, command, token)) {
@@ -4299,6 +4315,9 @@ var UNKNOWN_OWNER = {
   command: "unknown",
   token: ""
 };
+function acquireConductorLock(staleMinutes) {
+  return acquireRunLock("conductor", staleMinutes, CONDUCTOR_LOCK_FILE);
+}
 function claimStaleLock(path, token, expected) {
   const claimed = `${path}.stale.${token}`;
   try {
@@ -8063,8 +8082,84 @@ function toPlanJson(decision) {
   };
 }
 
+// src/commands/conductor.ts
+import { Command as Command7 } from "commander";
+function fail2(message) {
+  process.stderr.write(`Error: ${message}
+`);
+  return 1;
+}
+function runConductor() {
+  let config;
+  try {
+    config = readConfig();
+  } catch (err) {
+    return fail2(err.message);
+  }
+  if (!isExplicitGitHub(config)) {
+    return fail2(
+      azdoUnsupportedMessage(
+        "conductor",
+        "It needs the GitHub APIs; set the remote with `automata config set type gh`."
+      )
+    );
+  }
+  const allowedUsers = (config.allowedUsers ?? []).filter((user) => user.trim().length > 0);
+  if (allowedUsers.length === 0) {
+    return fail2("No allowed users configured. Run `automata config set allowed-users <user1,user2>`.");
+  }
+  const agentUser = (config.agentUser ?? "").trim();
+  if (agentUser.length === 0) {
+    return fail2("No agent user configured. Run `automata config set agent-user <login>`.");
+  }
+  let login2;
+  try {
+    login2 = getAuthenticatedLogin();
+  } catch (err) {
+    return fail2(`\`gh\` could not be queried: ${err.message}`);
+  }
+  const problem = conductorIdentityProblemFor(login2, agentUser, allowedUsers);
+  if (problem !== null) return fail2(problem);
+  const rawStale = config.doWork?.lockStaleMinutes;
+  if (rawStale !== void 0 && rawStale !== null) {
+    if (typeof rawStale !== "number" || !Number.isSafeInteger(rawStale) || rawStale < 1) {
+      return fail2(`doWork.lockStaleMinutes must be a positive integer, got ${JSON.stringify(rawStale)}.`);
+    }
+  }
+  const staleMinutes = config.doWork?.lockStaleMinutes ?? DEFAULT_DO_WORK.lockStaleMinutes;
+  const lock = acquireConductorLock(staleMinutes);
+  if (!lock.ok) {
+    const held = lock.heldBy;
+    process.stdout.write(
+      `Another conductor is already running here (pid ${String(held.pid)} on ${held.host}, started ${held.startedAt}). Doing nothing.
+`
+    );
+    if (lock.suspect) {
+      process.stderr.write(
+        `Warning: that lock has been held longer than ${String(staleMinutes)} minutes. If no tick is really running, its process id was probably reused; remove ${CONDUCTOR_LOCK_RELATIVE_PATH} once you have confirmed that.
+`
+      );
+      return 2;
+    }
+    return 0;
+  }
+  try {
+    process.stdout.write(`Conductor: running as ${login2 ?? ""}. Nothing to do yet.
+`);
+    return 0;
+  } finally {
+    lock.handle.release();
+  }
+}
+var conductorCommand = new Command7("conductor").description(
+  "Run one conductor tick as an allowed (human) account: verify the identity, take the conductor's own run lock, then act"
+).action(() => {
+  const exitCode = runConductor();
+  if (exitCode !== 0) process.exit(exitCode);
+});
+
 // src/index.ts
-var program = new Command7();
+var program = new Command8();
 program.name("automata").description("Automata CLI tool").version(version, "-v, --version");
 program.addCommand(configCommand);
 program.addCommand(gitCommand2);
@@ -8072,6 +8167,7 @@ program.addCommand(implementNextCommand);
 program.addCommand(executeCommand);
 program.addCommand(executePromptCommand);
 program.addCommand(doWorkCommand);
+program.addCommand(conductorCommand);
 program.showHelpAfterError();
 program.parse();
 if (process.argv.length <= 2) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "automata-cli",
-  "version": "0.11.0-develop.457",
+  "version": "0.11.0-develop.468",
   "description": "Automata CLI tool",
   "type": "module",
   "engines": {