forgedock 1.30.0 → 1.32.0

package/bin/lean/fixround.mjs

@@ -0,0 +1,90 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+/**
+ * Fresh fix sessions (#4363): which fix rounds run in a new, narrow session (resume: null, lean.fix_model) instead of
+ * resuming the builder's whole plan+build transcript, and the caps of that session's prompt. Pure: no I/O.
+ * Repo-agnostic: a failure "cites a file:line" when its text names any `path.ext:N`, whatever the language.
+ */
+
+import { noComments } from "./render.mjs";
+
+/** Fix-round kinds whose failures are mechanical: always a fresh session. */
+export const MECHANICAL_KINDS = Object.freeze(["precheck", "ci", "docs", "structure", "enumerating", "sequence", "post_merge", "duplicate"]);
+
+/** The fresh prompt stays under this many characters; the per-part caps leave room for the fixed text. */
+export const FIX_PROMPT_MAX = 60000;
+export const FIX_CAPS = Object.freeze({ task: 20000, diff: 24000, contract: 8000, summary: 1500 });
+
+const FILE_LINE_RE = /[\w.@/-]+\.[A-Za-z0-9]+:\d+/;
+
+/** True only for a non-empty list whose every failure (a string, or `f.detail`) cites a `path.ext:N`. */
+export function citesFileLine(failures) {
+  if (!Array.isArray(failures) || !failures.length) return false;
+  return failures.every((f) => FILE_LINE_RE.test(typeof f === "string" ? f : String(f?.detail ?? "")));
+}
+
+/** A mechanical kind, or a conformance/review FAIL whose failures all cite a file:line. */
+export function freshFix(kind, failures = []) {
+  if (MECHANICAL_KINDS.includes(kind)) return true;
+  return (kind === "conformance" || kind === "review") && citesFileLine(failures);
+}
+
+/** `s` cut to `max` characters with a marker naming what was dropped. */
+export function capText(s, max) {
+  const t = String(s ?? "");
+  return t.length <= max ? t : `${t.slice(0, max)}\n[... ${t.length - max} more characters cut]`;
+}
+
+/** The issue body without HTML comments (FORGE:STATE and other markers), trimmed and capped. */
+export function issueSummary(body, max = FIX_CAPS.summary) {
+  const t = noComments(body).replace(/\n{3,}/g, "\n\n").trim();
+  return capText(t, max);
+}
+
+/**
+ * #4362: why a PHASE_ATTEMPT_USAGE attempt ran (its `trigger`). Every builder, reviewer and grouping call passes one of
+ * these; events written before the field existed read as "unknown" in `forgedock stats`.
+ */
+export const TRIGGERS = Object.freeze(["plan", "build", "block_correction", "contract_correction", "precheck", "structure", "docs", "enumerating",
+  "sequence", "ci_unavailable", "ci_red", "conformance", "review", "merge_ci", "timeout_restart", "recovery", "verifier", "post_merge", "duplicate",
+  "context_restart", // #4390: a session stopped at the context ceiling, restarted fresh (restart_of: the stopped trigger)
+  "budget_wrapup"]); // #4392: the bounded wrap-up after the implement turn budget is spent (restart_of: the stopped trigger)
+
+/** Builder attempts after the build that mean its diff needed rework (environment and engine repairs do not). */
+export const REWORK_TRIGGERS = Object.freeze(["precheck", "structure", "docs", "enumerating", "sequence", "ci_red", "conformance", "review", "merge_ci", "post_merge", "duplicate"]);
+
+/**
+ * First pass of one lane from its implement-phase attempts in order ({trigger, restart_of}): null when it never reached the
+ * build or an attempt has no trigger (not measurable), else true when no rework-trigger attempt follows the first `build`
+ * (or the `timeout_restart`/`context_restart`/`budget_wrapup` of a build, `restart_of: "build"`, when the build itself was killed).
+ */
+export function firstPassOf(attempts) {
+  const list = Array.isArray(attempts) ? attempts : [];
+  if (list.some((a) => !a?.trigger)) return null;
+  const at = list.findIndex((a) => a.trigger === "build" || (["timeout_restart", "context_restart", "budget_wrapup"].includes(a.trigger) && a.restart_of === "build"));
+  if (at < 0) return null;
+  return !list.slice(at + 1).some((a) => REWORK_TRIGGERS.includes(a.trigger));
+}
+
+/** The batch report's first-pass line (rows carry `first_pass`), or null when no lane reached the build. */
+export function formatFirstPassSummary(rows) {
+  const reached = (rows ?? []).filter((r) => typeof r?.first_pass === "boolean");
+  if (!reached.length) return null;
+  const k = reached.filter((r) => r.first_pass).length;
+  return `first-pass: ${Math.round((k / reached.length) * 100)}% (${k}/${reached.length} lane${reached.length === 1 ? "" : "s"} that reached the build)`;
+}
+
+/**
+ * #4407: one attempt's cost from the CLI envelope's `total_cost_usd`, which is cumulative over a resumed session.
+ * `last` maps a session id to its last reported total (updated in place). A resumed attempt costs its total minus the
+ * session's previous total; a fresh call, an unknown session or a total below the previous one counts in full, so the
+ * deltas of a session's attempts sum to its final total. A non-finite cost yields nulls and leaves `last` alone.
+ */
+export function sessionCostDelta(last, { resume = null, sessionId = null, cost = null } = {}) {
+  if (!Number.isFinite(cost)) return { delta: null, session: null };
+  const prev = resume ? last.get(resume) : undefined;
+  const delta = Number.isFinite(prev) && cost >= prev ? Math.round((cost - prev) * 1e9) / 1e9 : cost;
+  const key = sessionId ?? resume;
+  if (key) last.set(key, cost);
+  return { delta, session: cost };
+}

package/bin/lean/fixround.test.mjs

@@ -0,0 +1,117 @@
+// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
+// SPDX-License-Identifier: AGPL-3.0-or-later
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { MECHANICAL_KINDS, FIX_PROMPT_MAX, citesFileLine, freshFix, issueSummary, capText, TRIGGERS, REWORK_TRIGGERS, firstPassOf, formatFirstPassSummary, sessionCostDelta } from "./fixround.mjs";
+import { fixSessionPrompt } from "./prompts.mjs";
+
+describe("#4363 fresh fix sessions: which rounds, and the prompt caps", () => {
+  it("every mechanical kind is fresh; block/contract/conflict kinds are not", () => {
+    assert.deepEqual([...MECHANICAL_KINDS], ["precheck", "ci", "docs", "structure", "enumerating", "sequence", "post_merge", "duplicate"]);
+    for (const k of MECHANICAL_KINDS) assert.equal(freshFix(k, []), true, k);
+    for (const k of ["block", "contract", "base-sync", "ci-unavailable"]) assert.equal(freshFix(k, [{ detail: "src/a.js:1" }]), false, k);
+  });
+
+  it("a conformance or review FAIL is fresh only when every failure cites a file:line", () => {
+    const cited = [{ code: "c", detail: "R1 partial: null throws (src/foo.js:9)" }, { code: "c", detail: "P1 violated (lib/bar.ts:12)" }];
+    const mixed = [...cited, { code: "c", detail: "validate V1 (`npm test`) failed (exit 1)" }];
+    for (const k of ["conformance", "review"]) {
+      assert.equal(freshFix(k, cited), true, k);
+      assert.equal(freshFix(k, mixed), false, `${k}: one failure without a file:line`);
+      assert.equal(freshFix(k, []), false, `${k}: no failures`);
+    }
+  });
+
+  it("file:line detection is codebase-agnostic", () => {
+    for (const d of ["app/models.py:42", "cmd/main.go:7", "src/lib.rs:310", "web/src/App.tsx:5", "lib/x/y.rb:1", "@scope/pkg/index.mjs:88", "Foo.java:3"]) {
+      assert.equal(citesFileLine([`fails at ${d}`]), true, d);
+    }
+    for (const d of ["the foo module", "R1 partial", "exit 1: 3 tests failed", "http://host:8080"]) assert.equal(citesFileLine([d]), false, d);
+  });
+
+  it("the issue summary drops HTML comments (FORGE:STATE) and is capped", () => {
+    const s = issueSummary(`## Problem\nfoo breaks\n\n<!-- FORGE:STATE\n{"v":1}\n-->\n${"y".repeat(5000)}`);
+    assert.doesNotMatch(s, /FORGE:STATE|"v":1/);
+    assert.match(s, /^## Problem\nfoo breaks/);
+    assert.ok(s.length < 1600);
+    assert.equal(capText("abc", 5), "abc");
+  });
+
+  it("the issue summary leaves no comment opener for nested or unclosed markers", () => {
+    for (const body of ["a <!<!-- x -->-- FORGE:STATE --> b", "a <!-- unclosed FORGE:STATE", "a <!--<!-- x -->--> b"]) {
+      assert.doesNotMatch(issueSummary(body), /<!--|<!/);
+    }
+  });
+
+  it("an oversized task, diff and contract still give a prompt under 60K with the title, summary, contract and diff", () => {
+    const diff = Array.from({ length: 50 }, (_, i) => `diff --git a/src/f${i}.js b/src/f${i}.js\n${"+line\n".repeat(2000)}`).join("");
+    const contract = { requirements: [{ id: "R1", quote: "q".repeat(50000), disposition: "deliver" }] };
+    const p = fixSessionPrompt({ task: `lint failed\n${"z".repeat(200000)}`, diff, stat: " src/f0.js | 2000 +", base: "origin/staging", contract, title: "foo breaks", summary: "foo crashes on null" });
+    assert.ok(p.length < 60000, `prompt ${p.length} chars`);
+    assert.ok(p.length < FIX_PROMPT_MAX);
+    assert.match(p, /no earlier session/); assert.match(p, /## Issue: foo breaks\nfoo crashes on null/);
+    assert.match(p, /"id": "R1"/); assert.match(p, /diff --git a\/src\/f0\.js/); assert.match(p, /git diff origin\/staging\.\.\.HEAD/);
+    assert.match(p, /lint failed/); assert.match(p, /Host rules/);
+  });
+});
+
+describe("#4362 attempt triggers and first pass", () => {
+  const t = (...xs) => xs.map((trigger) => ({ trigger }));
+  it("the trigger vocabulary is the issue's closed list; rework is a subset", () => {
+    assert.deepEqual([...TRIGGERS], ["plan", "build", "block_correction", "contract_correction", "precheck", "structure", "docs", "enumerating",
+      "sequence", "ci_unavailable", "ci_red", "conformance", "review", "merge_ci", "timeout_restart", "recovery", "verifier", "post_merge", "duplicate", "context_restart", "budget_wrapup"]);
+    for (const r of REWORK_TRIGGERS) assert.ok(TRIGGERS.includes(r), r);
+  });
+  it("firstPassOf: null without a build or with an untagged attempt; rework after the build breaks it, repairs do not", () => {
+    assert.equal(firstPassOf(t("plan")), null);
+    assert.equal(firstPassOf([{ trigger: "plan" }, {}]), null);
+    assert.equal(firstPassOf(t("plan", "build")), true);
+    assert.equal(firstPassOf(t("plan", "precheck", "build")), true, "only attempts after the build count");
+    assert.equal(firstPassOf(t("plan", "build", "timeout_restart", "recovery", "ci_unavailable", "block_correction")), true);
+    for (const r of REWORK_TRIGGERS) assert.equal(firstPassOf(t("plan", "build", r)), false, r);
+    const killed = [{ trigger: "plan" }, { trigger: "timeout_restart", restart_of: "build" }];
+    assert.equal(firstPassOf(killed), true, "a killed and restarted build still reached the build");
+    assert.equal(firstPassOf([...killed, { trigger: "review" }]), false);
+    assert.equal(firstPassOf([{ trigger: "timeout_restart", restart_of: "plan" }]), null, "a restarted plan is not the build");
+    assert.equal(firstPassOf([{ trigger: "plan" }, { trigger: "context_restart", restart_of: "build" }]), true, "#4390: a context-ceiling restart of the build reached the build");
+    assert.equal(firstPassOf(t("plan", "build", "context_restart")), true, "#4390: a context restart is not rework");
+  });
+  it("formatFirstPassSummary counts only rows that reached the build", () => {
+    assert.equal(formatFirstPassSummary([{ first_pass: true }, { first_pass: false }, { issue: 3 }, { first_pass: true }]), "first-pass: 67% (2/3 lanes that reached the build)");
+    assert.equal(formatFirstPassSummary([{ first_pass: true }]), "first-pass: 100% (1/1 lane that reached the build)");
+    assert.equal(formatFirstPassSummary([{ issue: 1 }]), null);
+    assert.equal(formatFirstPassSummary(undefined), null);
+  });
+});
+
+describe("#4407 sessionCostDelta: per-attempt cost from a resumed session's running total", () => {
+  it("a session of N attempts: the deltas sum to the final session total", () => {
+    const last = new Map(), totals = [2.33, 2.41, 15.25, 16.31];
+    const ds = totals.map((cost, i) => sessionCostDelta(last, { resume: i ? "s" : null, sessionId: "s", cost }));
+    assert.deepEqual(ds.map((d) => d.session), totals);
+    assert.equal(Math.round(ds.reduce((a, d) => a + d.delta, 0) * 1e9) / 1e9, 16.31);
+    assert.deepEqual(ds.map((d) => d.delta), [2.33, 0.08, 12.84, 1.06]);
+  });
+
+  it("a fresh call, an unknown session and a total below the previous one count in full", () => {
+    const last = new Map([["s", 5]]);
+    assert.equal(sessionCostDelta(last, { resume: null, sessionId: "s", cost: 1 }).delta, 1, "fresh");
+    assert.equal(sessionCostDelta(new Map(), { resume: "x", sessionId: "x", cost: 3 }).delta, 3, "unknown session");
+    const l2 = new Map([["s", 5]]);
+    assert.equal(sessionCostDelta(l2, { resume: "s", sessionId: "s", cost: 2 }).delta, 2, "below the previous total");
+  });
+
+  it("a non-finite cost yields nulls and leaves the map alone", () => {
+    const last = new Map([["s", 1]]);
+    assert.deepEqual(sessionCostDelta(last, { resume: "s", sessionId: "s", cost: null }), { delta: null, session: null });
+    assert.deepEqual(sessionCostDelta(last, { resume: "s", sessionId: "s", cost: NaN }), { delta: null, session: null });
+    assert.deepEqual([...last], [["s", 1]]);
+  });
+
+  it("a resume that returns a new session id: the next resume of that id subtracts its total", () => {
+    const last = new Map();
+    sessionCostDelta(last, { resume: null, sessionId: "a", cost: 1 });
+    assert.equal(sessionCostDelta(last, { resume: "a", sessionId: "b", cost: 1.5 }).delta, 0.5);
+    assert.equal(sessionCostDelta(last, { resume: "b", sessionId: "b", cost: 2 }).delta, 0.5);
+  });
+});

package/bin/lean/heavy.mjs

@@ -64,6 +64,31 @@ export function classifyStep(name, args = []) {
   return "llm";
 }
 
+const INTERP = new Set(["sh", "bash", "dash", "zsh", "node", "nodejs", "python", "python3", "env"]);
+const PY_HEAVY_MODULES = new Set(["pytest", "mypy", "tox", "unittest"]);
+/**
+ * #4405: is this `ps` command line a heavy step (a shim-gated step, test runner, linter, type checker, install)? Looks
+ * through an interpreter (`/bin/sh …/vitest run`, `node …/eslint .`) and knows `node --test` and `python -m pytest`.
+ * Pollers (`sleep`, `until grep …`), MCP servers and plain scripts are not.
+ */
+export function isHeavyProcess(cmd) {
+  const s = String(cmd ?? "");
+  if (/\bheavy\.mjs['"]?\s+run\b/.test(s)) return true;
+  const t = s.trim().split(/\s+/).filter(Boolean);
+  if (!t.length) return false;
+  const base = (x) => x.split("/").pop().replace(/\.(c|m)?js$/, "");
+  if (classifyStep(base(t[0]), t.slice(1)) === "heavy") return true;
+  const b0 = base(t[0]), py = /^python\d*(\.\d+)?$/.test(b0);
+  if (!INTERP.has(b0) && !py) return false;
+  const rest = t.slice(1);
+  if ((b0 === "node" || b0 === "nodejs") && rest.includes("--test")) return true;
+  const mi = rest.indexOf("-m");
+  if (py && mi >= 0 && PY_HEAVY_MODULES.has(rest[mi + 1])) return true;
+  const si = rest.findIndex((x) => !x.startsWith("-") && !/^\w+=/.test(x));
+  if (si < 0 || rest[si - 1] === "-c") return false;
+  return classifyStep(base(rest[si]), rest.slice(si + 1)) === "heavy";
+}
+
 /** Merged heavy config: defaults ← cfg (forge.yaml engine.heavy_*) ← env (FORGE_HEAVY_MAX|STEP_MEM_MB|RESERVE_MB). */
 export function heavyConfig(cfg = {}, env = {}) {
   const pos = (v) => { const x = Number(v); return v !== undefined && v !== null && String(v).trim() !== "" && Number.isFinite(x) && x > 0 ? x : null; };
@@ -175,6 +200,14 @@ export function openHeavy(dir = schedDir(), { cfg = {}, env = {}, host = default
     },
     withdraw: (key) => { try { mutate((s) => { delete s.waiters[key]; }); } catch { /* fail-open */ } },
     release: (key) => { try { mutate((s) => { delete s.holders[key]; delete s.waiters[key]; }); } catch { /* fail-open */ } },
+    /** #4405: {queued, running} of live entries whose pid is in `pids` (one session's processes), read-only; null when unreadable. */
+    lane: (pids = []) => {
+      try {
+        const s = read(), set = new Set([...pids].map(Number));
+        const n = (o) => Object.values(o).filter((e) => set.has(Number(e?.pid)) && alive(e.pid)).length;
+        return { queued: n(s.waiters), running: n(s.holders) };
+      } catch { return null; }
+    },
     /** {holders, queued, maxQueued, max} of live entries, read-only (no lock, no write); null when unreadable. */
     stats: () => {
       try {
@@ -205,10 +238,10 @@ export async function acquireHeavy(h, entry = {}, { pollMs = HEAVY_POLL_MS, slee
   }
 }
 
-/** Default lane effect: `acquire(entry, cfg)` → {waitMs, queued, release()} (cfg = the lane's forge.yaml heavy keys); `stats()`. */
+/** Default lane effect: `acquire(entry, cfg)` → {waitMs, queued, release()} (cfg = the lane's forge.yaml heavy keys); `stats()`; `lane(pids)` (#4405). */
 export function makeHeavyIo({ dir = schedDir(), env = process.env, host } = {}) {
   const open = (cfg) => openHeavy(dir, { cfg, env, ...(host ? { host } : {}) });
-  return { acquire: (entry, cfg = {}) => acquireHeavy(open(cfg), entry), stats: () => open({}).stats() };
+  return { acquire: (entry, cfg = {}) => acquireHeavy(open(cfg), entry), stats: () => open({}).stats(), lane: (pids) => open({}).lane(pids) };
 }
 
 const SHIM_HEADER = "#!/bin/sh\n# forgedock heavy-step shim (#4169): waits for a host heavy-step slot, then runs the real command; do not edit.\n";

package/bin/lean/heavy.test.mjs

@@ -5,9 +5,9 @@ import assert from "node:assert/strict";
 import { writeFileSync, readFileSync, mkdirSync, chmodSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { tmpDir } from "../tests/_tmp.mjs";
-import { classifyStep, heavyConfig, openHeavy, acquireHeavy, writeHeavyShims, heavyShimScript, sumWaits, runWrapped, HEAVY_BINS } from "./heavy.mjs";
+import { classifyStep, heavyConfig, openHeavy, acquireHeavy, writeHeavyShims, heavyShimScript, sumWaits, runWrapped, HEAVY_BINS, isHeavyProcess } from "./heavy.mjs";
 import { checkAdmission, ADMISSION_DEFAULTS } from "./admission.mjs";
-import { formatWaitSummary } from "./orchestrate.mjs";
+import { formatAlertLines, formatWaitSummary } from "./orchestrate.mjs";
 import { readHeavy } from "../engine-cli.mjs";
 
 // Injected pids, clock and host: `live` is the set of pids the registry sees as alive; `mem` the MemAvailable in MB.
@@ -50,6 +50,29 @@ describe("step classes (#4169)", () => {
   });
 });
 
+describe("idle-detector inputs (#4405)", () => {
+  it("isHeavyProcess: shim steps, test runners and linters behind an interpreter are heavy; pollers, MCP servers and git are not", () => {
+    for (const c of ["/usr/bin/node /x/bin/lean/heavy.mjs run --name npm -- /usr/bin/npm test", "/bin/sh /x/vitest run", "node /x/node_modules/.bin/eslint .",
+      "node --test a.test.mjs", "python3 -m pytest -q", "pytest -x", "cargo test", "env CI=1 jest"]) assert.equal(isHeavyProcess(c), true, c);
+    for (const c of ["sleep 10", "bash -c until grep -q done out; do sleep 10; done", "node mcp-server.js", "git status", "npm --version", "", null]) assert.equal(isHeavyProcess(c), false, String(c));
+  });
+
+  it("lane(pids) counts only this session's live queued and running entries, read-only", () => {
+    const { handle, live, dir } = world({ mem: 64000, cores: 2 });
+    const a = handle(201), b = handle(202), c = handle(301);
+    assert.equal(a.tryAcquire("a", { issue: 7 }).ok, true);
+    assert.equal(b.tryAcquire("b", { issue: 7 }).ok, false);
+    assert.equal(c.tryAcquire("c", { issue: 7 }).ok, false);
+    const before = readFileSync(join(dir, "heavy.json"), "utf8");
+    assert.deepEqual(a.lane([201, 202, 999]), { queued: 1, running: 1 });
+    assert.deepEqual(a.lane([301]), { queued: 1, running: 0 }, "same issue number, other session: matched by pid only");
+    assert.deepEqual(a.lane([]), { queued: 0, running: 0 });
+    live.delete(201);
+    assert.deepEqual(a.lane([201, 202]), { queued: 1, running: 0 }, "a dead holder does not count");
+    assert.equal(readFileSync(join(dir, "heavy.json"), "utf8"), before, "lane() never writes the registry");
+  });
+});
+
 describe("heavy-step semaphore (#4169)", () => {
   it("caps live holders at max(1, cores-1) and frees a slot on release or holder death", () => {
     const { handle, live } = world({ mem: 64000, cores: 4 });
@@ -204,4 +227,11 @@ describe("heavy shims and the run wrapper (#4169)", () => {
     assert.equal(formatWaitSummary([{ issue: 3 }], { queued: 0 }), null, "no waits and an empty queue print no line");
     assert.equal(formatWaitSummary([{ issue: 3 }], { queued: 2 }), "waits by phase: none; heavy queue: now 2, max 0");
   });
+
+  it("formatAlertLines (#4354): the batch-report alert tail, nothing when no alert fired", () => {
+    assert.deepEqual(formatAlertLines([]), []);
+    assert.deepEqual(formatAlertLines(undefined), []);
+    assert.deepEqual(formatAlertLines([{ event: "deferred-to-ci", rate: 0.4, count: 4, sample: 10, threshold: 0.3, example: "npx tsc" }]),
+      ["ALERTS", 'deferred-to-ci: 40% (4/10 lanes, threshold 30%), e.g. "npx tsc"']);
+  });
 });