flowviant 0.74.2 → 0.76.0

package/bin/lib/agentPlan.mjs

@@ -0,0 +1,187 @@
+/**
+ * READING A PLANNER'S ANSWER.
+ *
+ * The scratch agent behind a Deploy press is asked for one JSON object and
+ * nothing else. This is what turns its final message into a proposal, and it is
+ * its own module because it is the one piece of that turn that can quietly LIE:
+ * everything else either works or throws, while a half-parsed proposal renders
+ * as a plausible-looking board somebody accepts.
+ *
+ * LENIENT ON PACKAGING, STRICT ON SHAPE.
+ *
+ * A model asked for one object will sometimes fence it and sometimes not, and
+ * sometimes say "Here you go:" first. Refusing the whole plan over that spends
+ * the operator's own model quota to produce nothing, so the packaging is
+ * forgiven. What is NOT forgiven is the shape: an agent holding no cards, a
+ * `taskIds` that is not an array of strings, or no agents at all is a proposal
+ * nobody can accept, and `null` — which the caller reports in the machine's own
+ * words — beats rendering an empty board with an Accept button on it.
+ *
+ * Every string is CAPPED here rather than downstream. This text is model
+ * output about untrusted card content, and it becomes a row.
+ *
+ * Run: node --test bin/lib/agentPlan.test.mjs
+ */
+
+/** The biggest a single proposal may be. Bounds on a machine, not a policy:
+ *  the server caps these again at its own boundary. */
+const MAX_AGENTS = 20;
+const MAX_TASKS_PER_AGENT = 60;
+const MAX_NAME = 80;
+const MAX_NOTE = 1000;
+
+/**
+ * Find the object.
+ *
+ * A fenced block first, because that is what was asked for. Otherwise every `{`
+ * in the text is tried as a start, and its BALANCED end is found by counting
+ * braces while skipping string literals — the first candidate that parses into
+ * something with an `agents` array wins.
+ *
+ * The obvious cheap version — first `{` to last `}` — is wrong in a way a test
+ * caught: a planner that writes "I looked at {the auth module} first" before its
+ * JSON produces a span starting at the wrong brace, and the whole plan is lost
+ * to a sentence. Scanning candidates costs nothing at this size and cannot be
+ * defeated by prose.
+ */
+function extract(raw) {
+  const fenced = raw.match(/```(?:json)?\s*([\s\S]*?)```/);
+  const candidates = [];
+  if (fenced) candidates.push(fenced[1]);
+  for (let i = 0; i < raw.length; i++) {
+    if (raw[i] !== '{') continue;
+    const end = balanced(raw, i);
+    if (end > i) candidates.push(raw.slice(i, end + 1));
+  }
+  for (const body of candidates) {
+    if (!body.trim()) continue;
+    try {
+      const v = JSON.parse(body);
+      if (v && typeof v === 'object' && Array.isArray(v.agents)) return v;
+    } catch {
+      /* the next candidate may be the object */
+    }
+  }
+  return null;
+}
+
+/** The index of the `}` that closes the `{` at `from`, or -1. Skips string
+ *  literals so a brace inside a card title cannot end the object early. */
+function balanced(s, from) {
+  let depth = 0;
+  let inStr = false;
+  let esc = false;
+  for (let i = from; i < s.length; i++) {
+    const ch = s[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (ch === '\\') esc = true;
+      else if (ch === '"') inStr = false;
+      continue;
+    }
+    if (ch === '"') inStr = true;
+    else if (ch === '{') depth++;
+    else if (ch === '}' && --depth === 0) return i;
+  }
+  return -1;
+}
+
+export function parseProposal(text) {
+  const raw = String(text ?? '');
+  const parsed = extract(raw);
+  if (!parsed) return null;
+
+  const agents = [];
+  for (const [i, g] of parsed.agents.slice(0, MAX_AGENTS).entries()) {
+    if (!g || typeof g !== 'object') continue;
+    const taskIds = Array.isArray(g.taskIds)
+      ? g.taskIds.filter((t) => typeof t === 'string' && t.trim()).slice(0, MAX_TASKS_PER_AGENT)
+      : [];
+    // AN AGENT WITH NO CARDS IS NOT AN AGENT. Dropping it is right rather than
+    // merely tidy: accepting one would create a worktree and a branch for
+    // nothing, and it would sit in Working forever with an empty queue.
+    if (taskIds.length === 0) continue;
+    agents.push({
+      tempId: String(g.tempId || `a${i + 1}`).slice(0, 64),
+      name: String(g.name ?? '').slice(0, MAX_NAME),
+      taskIds,
+      ...(Number.isFinite(g.pointsBudget) && g.pointsBudget > 0
+        ? { pointsBudget: Math.min(Math.round(g.pointsBudget), 100_000) }
+        : {}),
+      ...(Array.isArray(g.waitsOn)
+        ? { waitsOn: g.waitsOn.filter((w) => typeof w === 'string' && w).slice(0, 20) }
+        : {}),
+      ...(typeof g.intoAgentId === 'string' && g.intoAgentId
+        ? { intoAgentId: g.intoAgentId.slice(0, 64) }
+        : {}),
+    });
+  }
+  if (agents.length === 0) return null;
+  return {
+    agents,
+    ...(typeof parsed.note === 'string' && parsed.note.trim()
+      ? { note: parsed.note.slice(0, MAX_NOTE) }
+      : {}),
+  };
+}
+
+/**
+ * READING AN AGENT'S ANSWER at the end of a turn.
+ *
+ * Same lenient-packaging / strict-shape rule as `parseProposal`, and the same
+ * reason: the turn already ran and the operator already paid for it, so
+ * refusing the whole thing over a stray "Here you go:" throws away real work.
+ *
+ * NULL IS A REAL ANSWER AND THE MOST IMPORTANT ONE. It means the turn declared
+ * NEITHER delivered nor blocked — a signed-out CLI, a crash, an exhausted
+ * quota, or a model that simply stopped — and the caller reports it as
+ * `nothing`, which sends the agent to Stuck. Optimistic status from a machine
+ * that quit is the one lie this board cannot afford, so anything ambiguous ends
+ * up here rather than being read as success.
+ */
+export function parseTurnResult(text) {
+  const parsedRaw = String(text ?? '');
+  const fenced = parsedRaw.match(/```(?:json)?\s*([\s\S]*?)```/);
+  const candidates = [];
+  if (fenced) candidates.push(fenced[1]);
+  for (let i = 0; i < parsedRaw.length; i++) {
+    if (parsedRaw[i] !== '{') continue;
+    const end = balanced(parsedRaw, i);
+    if (end > i) candidates.push(parsedRaw.slice(i, end + 1));
+  }
+  for (const body of candidates) {
+    let v;
+    try {
+      v = JSON.parse(body);
+    } catch {
+      continue;
+    }
+    if (!v || typeof v !== 'object') continue;
+    if (v.status === 'blocked') {
+      const question = typeof v.question === 'string' ? v.question.trim() : '';
+      // A "blocked" with no question is not an answer anybody can act on — it
+      // parks an agent with nothing to reply to. Treated as `nothing`, which
+      // at least says truthfully that the machine went quiet.
+      if (!question) continue;
+      return { outcome: 'question', answer: question.slice(0, 8000) };
+    }
+    if (v.status === 'delivered') {
+      return {
+        outcome: 'delivered',
+        answer: (typeof v.summary === 'string' ? v.summary : '').slice(0, 8000),
+        raised: Array.isArray(v.raised)
+          ? v.raised
+              .filter((r) => r && typeof r.title === 'string' && r.title.trim())
+              .slice(0, 10)
+              .map((r) => ({
+                title: r.title.trim().slice(0, 300),
+                ...(typeof r.brief === 'string' && r.brief.trim()
+                  ? { brief: r.brief.trim().slice(0, 2000) }
+                  : {}),
+              }))
+          : [],
+      };
+    }
+  }
+  return null;
+}

package/bin/lib/deploy.mjs

@@ -77,6 +77,10 @@ export async function reportDeployConfig(repoRoot) {
     healthcheck: t.healthcheck,
     healthStatus: t.healthStatus,
     pushSecrets: t.pushSecrets,
+    // Deploy-on-merge: the env this target auto-deploys to when commits land
+    // on base. MUST ride this map — a field forgotten here never reaches the
+    // server, and the server is what turns a landed report into the job.
+    ...(typeof t.onMerge === 'string' ? { onMerge: t.onMerge } : {}),
   }));
   try {
     await post('deploy-config', { pubkey: myPubB64(), targets: meta });

package/bin/lib/fleet.mjs

@@ -816,6 +816,11 @@ export async function runFleetDaemon() {
     processShipJobs,
     processDiffJobs,
     processKillJobs,
+    processPrJobs,
+    processAgentPlanJobs,
+    processAgentTurnJobs,
+    processAgentMergeJobs,
+    freshenManualPlaces,
     heldSessionIds,
     processPreviewJobs,
     livePreviewIds,
@@ -1610,6 +1615,26 @@ export async function runFleetDaemon() {
     // the pid on this job is a request, never an authority, because pids are
     // recycled and the row the browser clicked is up to a sweep old.
     processKillJobs(roster.killJobs);
+    // PR-mode work (push + open, or merge) — leased like a kill: two daemons
+    // pushing one branch would open two PRs. Runs under the operator's own
+    // `gh` credential; a settle never closes a card (done is observed by the
+    // landed walk when the merge reaches base).
+    processPrJobs(roster.prJobs);
+    // A Deploy press waiting for a plan. AFTER the job lanes above and before
+    // the worktree report, for no reason other than that it reads directories
+    // those lanes may still be writing — it measures, so a stale read is a
+    // slightly worse hint and never a wrong action.
+    processAgentPlanJobs(roster.agentPlanJobs);
+    // …and an agent's next card. After the plan jobs because a press becoming
+    // agents is the thing that produces these.
+    processAgentTurnJobs(roster.agentTurnJobs);
+    // …and a branch somebody approved. After the turns: a merge takes the
+    // place's WRITER lock, and writer preference means it goes ahead of any
+    // reader queued behind it anyway.
+    processAgentMergeJobs(roster.agentMergeJobs);
+    // Catch each person's manual worktree up to base while it is clean. Silent,
+    // fast-forward only, and it never touches an agent's branch.
+    freshenManualPlaces();
     // …and what the SURVIVING ones hold: branch, ahead-of-base, diffstat.
     // Throttled inside, never awaited — a `git status` the human cannot run
     // themselves from a browser, relayed. After retirement so a directory that

package/bin/lib/landed.mjs

@@ -0,0 +1,175 @@
+/**
+ * THE LANDED OBSERVER — what arrived on base, whichever road it took.
+ *
+ * The daemon already fetches origin on a throttled beat (the worktree sweep)
+ * and moves the local base ref itself on a ship push. This module watches the
+ * base tip across those moments and, when it moves, walks the NEW commits and
+ * reports them to /fleet/base-landed: sha, subject, and any `Flowviant-Task:`
+ * trailer ids. The server closes what those commits name (a trailer from any
+ * live status, a delivered card's receipt sha) — done is OBSERVED, and this is
+ * the observation that covers a hand push, a PR merged on GitHub, and a
+ * teammate's ship, none of which pass through /fleet/ship-done.
+ *
+ * A daemon→server REPORT, so there is no version floor and the delivery
+ * discipline is repo-state's: a 404 (older server) goes quiet until restart,
+ * and the observed tip is persisted ONLY when the server accepted the report —
+ * a failed POST re-walks the same range on the next beat, which is free
+ * because the server skips done cards.
+ *
+ * FIRST SIGHT SEEDS, NEVER WALKS. A fresh install (or a base-ref change) has
+ * no honest "since when", and walking history would close every trailered card
+ * ever merged. The tip is recorded and observation starts from there. The same
+ * rule covers a range the repo can no longer answer (force-push, gc): reseed,
+ * report nothing — ignorance is never turned into a state.
+ */
+
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { git, baseBranchName } from './git.mjs';
+import { taskIdsFromMessage } from './worktreeDiff.mjs';
+import { warn } from './ui.mjs';
+import { FLEET_URL, FLEET_TOKEN, USER_AGENT } from './config.mjs';
+
+const LANDED_URL = FLEET_URL.replace(/\/agents\/?$/, '/base-landed');
+/** The server accepts 50 per report. A bigger range walks OLDEST-FIRST in
+ *  batches: the persisted tip advances to the last commit actually reported,
+ *  so the remainder is picked up on the next beat rather than skipped forever
+ *  — a trailered card in commit 51 of a big catch-up still closes. */
+const MAX_COMMITS = 50;
+const SHA_RE = /^[0-9a-f]{7,64}$/i;
+
+export function createLandedObserver({ repoRoot, baseRef }) {
+  // Keyed like the worktree base dir: one state file per checkout, so two
+  // repos on one box never share a tip.
+  const key = createHash('sha256').update(String(repoRoot)).digest('hex').slice(0, 8);
+  const stateFile = join(homedir(), '.flowviant', `landed-${key}.json`);
+  let unsupported = false; // 404 once → an older server; quiet until restart
+  let inFlight = false;
+
+  const readState = () => {
+    try {
+      const s = JSON.parse(readFileSync(stateFile, 'utf8'));
+      return s && typeof s.ref === 'string' && typeof s.tip === 'string' ? s : null;
+    } catch {
+      return null;
+    }
+  };
+  const writeState = (s) => {
+    try {
+      mkdirSync(join(homedir(), '.flowviant'), { recursive: true });
+      writeFileSync(stateFile, JSON.stringify(s));
+    } catch {
+      /* a box that cannot persist just re-observes from the next seed */
+    }
+  };
+
+  const tipOf = (ref) => {
+    try {
+      const t = git(['rev-parse', ref], repoRoot);
+      return SHA_RE.test(t) ? t : null;
+    } catch {
+      return null;
+    }
+  };
+
+  /** New non-merge commits in from..to, OLDEST FIRST. `--no-merges` for the
+   *  same reason branchCommits keeps it: a merge commit describes a range
+   *  rather than doing work, and its constituents are walked as themselves. */
+  const walk = (from, to) => {
+    const raw = git(
+      ['log', '--reverse', '--no-merges', '--format=%H%x1f%s%x1f%B%x1e', `${from}..${to}`],
+      repoRoot
+    );
+    const out = [];
+    for (const rec of raw.split('\x1e')) {
+      const line = rec.replace(/^\n+/, '');
+      if (!line.trim()) continue;
+      const [sha, subject, body] = line.split('\x1f');
+      if (!SHA_RE.test(sha || '')) continue;
+      out.push({
+        sha,
+        subject: String(subject || '').slice(0, 200),
+        taskIds: taskIdsFromMessage(body).slice(0, 8),
+      });
+    }
+    return out;
+  };
+
+  /** Look at the base tip; if it moved, report the range. Call after anything
+   *  that may have moved origin/<base> — the sweep's fetch, a ship's push, a
+   *  PR merge this daemon performed. Never throws, never awaited by a turn. */
+  const observe = async () => {
+    if (unsupported || inFlight) return;
+    const ref = baseRef();
+    if (!ref) return;
+    const tip = tipOf(ref);
+    if (!tip) return;
+    const st = readState();
+    if (!st || st.ref !== ref) {
+      writeState({ ref, tip });
+      return;
+    }
+    if (st.tip === tip) return;
+    let all;
+    try {
+      all = walk(st.tip, ref);
+    } catch {
+      // The old tip is no longer answerable (force-push, gc) — reseed and
+      // report nothing rather than guess at a range.
+      writeState({ ref, tip });
+      return;
+    }
+    // Oldest-first BATCH: a range past the server's cap advances the tip only
+    // to the last commit reported, so the remainder rides the next beat —
+    // nothing is skipped forever. (A range of nothing but merge commits still
+    // reports, tip-only: the tip moving is the fact deploy-on-merge rides.)
+    const commits = all.slice(0, MAX_COMMITS);
+    const reportedTip = all.length > MAX_COMMITS ? commits[commits.length - 1].sha : tip;
+    inFlight = true;
+    try {
+      const res = await fetch(LANDED_URL, {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${FLEET_TOKEN}`,
+          'User-Agent': USER_AGENT,
+          'Content-Type': 'application/json',
+        },
+        signal: AbortSignal.timeout(20_000),
+        body: JSON.stringify({ base: baseBranchName(ref), tip: reportedTip, commits }),
+      });
+      if (res.status === 404) {
+        unsupported = true;
+        return;
+      }
+      if (res.ok) {
+        // Persist ONLY an accepted report — a 5xx (the server could not close
+        // the cards) or a network failure leaves the tip where it was, so the
+        // next beat re-walks the same range and the close re-runs, idempotently.
+        writeState({ ref, tip: reportedTip });
+        // Deploy-on-merge refusals are computed server-side and would
+        // otherwise vanish — an onMerge:'prod' (or a target with no
+        // commands[env]) must not be quietly inert.
+        const j = await res.json().catch(() => null);
+        for (const r of j?.data?.deployRefused ?? []) {
+          warn(`deploy-on-merge refused for target "${r?.targetId}": ${r?.reason}`);
+        }
+      } else if (res.status >= 400 && res.status < 500) {
+        // A persistent 4xx (deploy skew, a payload this server refuses) would
+        // otherwise re-send the same poison range on every beat forever.
+        // Drop the range — the closes it carried re-run at the next REAL tip
+        // move only if their cards are still open, which is the idempotent
+        // half; the honest cost is stated out loud.
+        writeState({ ref, tip });
+        warn(`base-landed report refused (${res.status}) — skipped ${commits.length} commit(s)`);
+      }
+    } catch {
+      /* offline — the next fetch beat retries */
+    } finally {
+      inFlight = false;
+    }
+  };
+
+  return { observe };
+}