indusagi-coding-agent 0.2.12 → 0.2.14

package/src/review-agent/supabase.ts

@@ -0,0 +1,209 @@
+import type { ReviewOutput, ReviewRequest } from "./contract.js";
+
+export interface ReviewJob {
+  id: string;
+  installationId: number;
+  repository: string;
+  owner: string;
+  repo: string;
+  pullNumber: number;
+  headSha: string;
+  title: string;
+  attempts: number;
+  maxAttempts: number;
+  workerId: string;
+  leaseToken: string;
+  checkRunId?: number;
+}
+
+export interface CheckRunReconciliation {
+  id: string;
+  installationId: number;
+  owner: string;
+  repo: string;
+  checkRunId: number;
+  review: ReviewOutput;
+}
+
+function toJob(row: Record<string, any>): ReviewJob {
+  return {
+    id: String(row.id),
+    installationId: Number(row.installation_id),
+    repository: String(row.repository),
+    owner: String(row.owner),
+    repo: String(row.repo),
+    pullNumber: Number(row.pr_number),
+    headSha: String(row.head_sha),
+    title: String(row.title),
+    attempts: Number(row.attempts ?? 0),
+    maxAttempts: Number(row.max_attempts ?? 3),
+    workerId: String(row.worker_id ?? ""),
+    leaseToken: String(row.lease_token ?? ""),
+    ...(row.check_run_id != null ? { checkRunId: Number(row.check_run_id) } : {}),
+  };
+}
+
+export class SupabaseReviewStore {
+  private readonly baseUrl: string;
+
+  constructor(
+    url: string,
+    private readonly serviceKey: string,
+    private readonly fetcher: typeof fetch = fetch,
+    private readonly requestTimeoutMs = 30_000,
+  ) {
+    this.baseUrl = url.replace(/\/$/, "");
+  }
+
+  private async request<T>(path: string, init: RequestInit = {}): Promise<T> {
+    const response = await this.fetcher(`${this.baseUrl}${path}`, {
+      ...init,
+      signal: init.signal ?? AbortSignal.timeout(this.requestTimeoutMs),
+      headers: {
+        apikey: this.serviceKey,
+        Authorization: `Bearer ${this.serviceKey}`,
+        "Content-Type": "application/json",
+        ...(init.headers as Record<string, string> | undefined),
+      },
+    });
+    if (!response.ok) {
+      throw new Error(`Supabase ${init.method ?? "GET"} ${path} failed (${response.status}): ${(await response.text()).slice(0, 500)}`);
+    }
+    if (response.status === 204) return undefined as T;
+    return await response.json() as T;
+  }
+
+  async recordDelivery(deliveryId: string, eventName: string): Promise<boolean> {
+    const rows = await this.request<Array<Record<string, unknown>>>(
+      "/rest/v1/indusagi_review_deliveries?on_conflict=delivery_id",
+      {
+        method: "POST",
+        headers: { Prefer: "resolution=ignore-duplicates,return=representation" },
+        body: JSON.stringify({ delivery_id: deliveryId, event_name: eventName }),
+      },
+    );
+    return rows.length > 0;
+  }
+
+  async enqueueWebhook(request: ReviewRequest, eventName: string): Promise<{ jobId?: string; duplicate: boolean }> {
+    const rows = await this.request<Array<{ job_id?: unknown; duplicate?: unknown }>>(
+      "/rest/v1/rpc/enqueue_indusagi_review_job",
+      {
+        method: "POST",
+        body: JSON.stringify({
+          p_delivery_id: request.deliveryId,
+          p_event_name: eventName,
+          p_installation_id: request.installationId,
+          p_repository: request.repository,
+          p_owner: request.owner,
+          p_repo: request.repo,
+          p_pr_number: request.pullNumber,
+          p_head_sha: request.headSha,
+          p_title: request.title,
+        }),
+      },
+    );
+    const row = rows[0];
+    if (!row || typeof row.duplicate !== "boolean") throw new Error("Supabase returned no webhook enqueue result");
+    if (!row.duplicate && (typeof row.job_id !== "string" || !row.job_id)) {
+      throw new Error("Supabase returned no queued review job id");
+    }
+    return {
+      ...(typeof row.job_id === "string" && row.job_id ? { jobId: row.job_id } : {}),
+      duplicate: row.duplicate,
+    };
+  }
+
+  async claim(workerId: string): Promise<ReviewJob | null> {
+    const rows = await this.request<Array<Record<string, any>>>("/rest/v1/rpc/claim_indusagi_review_job", {
+      method: "POST",
+      body: JSON.stringify({ p_worker_id: workerId }),
+    });
+    return rows[0] ? toJob(rows[0]) : null;
+  }
+
+  async setCheckRun(job: ReviewJob, checkRunId: number): Promise<void> {
+    await this.ownedPatch(job, { check_run_id: checkRunId });
+  }
+
+  async complete(job: ReviewJob, review: ReviewOutput, githubReviewId?: number, commentId?: number): Promise<void> {
+    await this.ownedPatch(job, {
+      status: "completed",
+      review,
+      github_review_id: githubReviewId ?? null,
+      github_comment_id: commentId ?? null,
+      completed_at: new Date().toISOString(),
+      worker_id: null,
+      claimed_at: null,
+      lease_expires_at: null,
+      error: null,
+    });
+  }
+
+  async markCheckRunComplete(jobId: string): Promise<void> {
+    await this.patch(jobId, { check_completed_at: new Date().toISOString() });
+  }
+
+  async nextCheckRunReconciliation(): Promise<CheckRunReconciliation | null> {
+    const path = "/rest/v1/indusagi_review_jobs?status=eq.completed&check_run_id=not.is.null&check_completed_at=is.null&review=not.is.null&select=id,installation_id,owner,repo,check_run_id,review&order=completed_at.asc&limit=1";
+    const rows = await this.request<Array<Record<string, any>>>(path);
+    const row = rows[0];
+    if (!row) return null;
+    return {
+      id: String(row.id),
+      installationId: Number(row.installation_id),
+      owner: String(row.owner),
+      repo: String(row.repo),
+      checkRunId: Number(row.check_run_id),
+      review: row.review as ReviewOutput,
+    };
+  }
+
+  async fail(job: ReviewJob, message: string, retryable = true): Promise<void> {
+    const retry = retryable && job.attempts < job.maxAttempts;
+    const delaySeconds = Math.min(300, Math.max(5, 5 * 2 ** Math.max(0, job.attempts - 1)));
+    await this.ownedPatch(job, {
+      status: retry ? "pending" : "failed",
+      error: message.slice(0, 4_000),
+      worker_id: null,
+      claimed_at: null,
+      lease_expires_at: null,
+      ...(retry ? { available_at: new Date(Date.now() + delaySeconds * 1_000).toISOString() } : { completed_at: new Date().toISOString() }),
+    });
+  }
+
+  async recoverStaleJobs(staleMinutes = 15): Promise<void> {
+    await this.request("/rest/v1/rpc/recover_stale_indusagi_review_jobs", {
+      method: "POST",
+      body: JSON.stringify({ p_stale_minutes: staleMinutes }),
+    });
+  }
+
+  async renewLease(job: ReviewJob, leaseSeconds = 300): Promise<boolean> {
+    const rows = await this.ownedPatch(job, {
+      lease_expires_at: new Date(Date.now() + leaseSeconds * 1_000).toISOString(),
+    }, false);
+    return rows.length > 0;
+  }
+
+  private async ownedPatch(job: ReviewJob, values: Record<string, unknown>, required = true): Promise<Array<Record<string, unknown>>> {
+    if (!job.workerId || !job.leaseToken) throw new Error("review job has no lease ownership");
+    const leaseFloor = encodeURIComponent(new Date().toISOString());
+    const filters = `id=eq.${encodeURIComponent(job.id)}&status=eq.running&worker_id=eq.${encodeURIComponent(job.workerId)}&lease_token=eq.${encodeURIComponent(job.leaseToken)}&lease_expires_at=gt.${leaseFloor}`;
+    const rows = await this.request<Array<Record<string, unknown>>>(`/rest/v1/indusagi_review_jobs?${filters}`, {
+      method: "PATCH",
+      headers: { Prefer: "return=representation" },
+      body: JSON.stringify({ ...values, updated_at: new Date().toISOString() }),
+    });
+    if (required && rows.length === 0) throw new Error("review job lease ownership was lost");
+    return rows;
+  }
+
+  private async patch(jobId: string, values: Record<string, unknown>): Promise<void> {
+    await this.request(`/rest/v1/indusagi_review_jobs?id=eq.${encodeURIComponent(jobId)}`, {
+      method: "PATCH",
+      headers: { Prefer: "return=minimal" },
+      body: JSON.stringify({ ...values, updated_at: new Date().toISOString() }),
+    });
+  }
+}

package/src/review-agent/webhook.ts

@@ -0,0 +1,76 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import type { ReviewRequest } from "./contract.js";
+
+const REVIEW_ACTIONS = new Set(["opened", "reopened", "synchronize", "ready_for_review"]);
+
+export function verifyGithubSignature(
+  payload: string,
+  signature: string | null | undefined,
+  secret: string,
+): boolean {
+  if (!secret || !signature?.startsWith("sha256=")) return false;
+  const expected = `sha256=${createHmac("sha256", secret).update(payload).digest("hex")}`;
+  const actualBuffer = Buffer.from(signature);
+  const expectedBuffer = Buffer.from(expected);
+  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
+}
+
+function object(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+}
+
+export function parsePullRequestWebhook(
+  payload: string,
+  deliveryId: string,
+  options: { allowMissingInstallation?: boolean } = {},
+): ReviewRequest | null {
+  let decoded: unknown;
+  try {
+    decoded = JSON.parse(payload);
+  } catch {
+    throw new Error("GitHub webhook body is not valid JSON");
+  }
+  const body = object(decoded);
+  const action = typeof body?.action === "string" ? body.action : "";
+  if (!REVIEW_ACTIONS.has(action)) return null;
+
+  const installation = object(body?.installation);
+  const repository = object(body?.repository);
+  const pull = object(body?.pull_request);
+  const head = object(pull?.head);
+  const fullName = typeof repository?.full_name === "string" ? repository.full_name : "";
+  const separator = fullName.indexOf("/");
+  const installationId = installation?.id == null && options.allowMissingInstallation
+    ? 0
+    : Number(installation?.id);
+  const pullNumber = Number(body?.number ?? pull?.number);
+  const headSha = typeof head?.sha === "string" ? head.sha : "";
+  const title = typeof pull?.title === "string" ? pull.title : "";
+  const draft = pull?.draft === true;
+
+  if (draft && action !== "ready_for_review") return null;
+  if (
+    !deliveryId || separator <= 0 || separator === fullName.length - 1 ||
+    !Number.isInteger(installationId) || installationId < 0 ||
+    (!options.allowMissingInstallation && installationId === 0) ||
+    !Number.isInteger(pullNumber) || pullNumber <= 0 ||
+    !headSha || !title
+  ) {
+    throw new Error("GitHub pull_request webhook is missing required fields");
+  }
+
+  return {
+    deliveryId,
+    action,
+    installationId,
+    repository: fullName,
+    owner: fullName.slice(0, separator),
+    repo: fullName.slice(separator + 1),
+    pullNumber,
+    headSha,
+    title,
+    draft,
+  };
+}

package/src/security/private-state.ts

@@ -0,0 +1,122 @@
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
+const NO_FOLLOW = constants.O_NOFOLLOW ?? 0;
+
+function isPosix(): boolean {
+  return process.platform !== "win32";
+}
+
+function assertOwned(uid: number, path: string): void {
+  if (!isPosix() || process.getuid === undefined) return;
+  if (uid !== process.getuid()) {
+    throw new Error(`Refusing sensitive path not owned by the current user: ${path}`);
+  }
+}
+
+export function ensurePrivateDirectorySync(path: string): void {
+  try {
+    const current = lstatSync(path);
+    if (current.isSymbolicLink() || !current.isDirectory()) {
+      throw new Error(`Refusing non-directory sensitive state path: ${path}`);
+    }
+    assertOwned(current.uid, path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    mkdirSync(path, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+  }
+  if (isPosix()) chmodSync(path, PRIVATE_DIRECTORY_MODE);
+}
+
+function validateExistingFile(path: string): void {
+  try {
+    const current = lstatSync(path);
+    if (current.isSymbolicLink() || !current.isFile()) {
+      throw new Error(`Refusing non-regular sensitive file: ${path}`);
+    }
+    assertOwned(current.uid, path);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    throw error;
+  }
+}
+
+export function readPrivateFileSync(path: string): string | null {
+  ensurePrivateDirectorySync(dirname(path));
+  try {
+    validateExistingFile(path);
+    const fd = openSync(path, constants.O_RDONLY | NO_FOLLOW);
+    try {
+      const current = fstatSync(fd);
+      if (!current.isFile()) throw new Error(`Refusing non-regular sensitive file: ${path}`);
+      assertOwned(current.uid, path);
+      if (isPosix()) fchmodSync(fd, PRIVATE_FILE_MODE);
+      return readFileSync(fd, "utf8");
+    } finally {
+      closeSync(fd);
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+export function atomicWritePrivateFileSync(path: string, content: string): void {
+  const parent = dirname(path);
+  ensurePrivateDirectorySync(parent);
+  validateExistingFile(path);
+  const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+  let fd: number | undefined;
+  try {
+    fd = openSync(
+      temporary,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NO_FOLLOW,
+      PRIVATE_FILE_MODE,
+    );
+    writeFileSync(fd, content, "utf8");
+    if (isPosix()) fchmodSync(fd, PRIVATE_FILE_MODE);
+    closeSync(fd);
+    fd = undefined;
+    renameSync(temporary, path);
+    if (isPosix()) chmodSync(path, PRIVATE_FILE_MODE);
+  } catch (error) {
+    if (fd !== undefined) closeSync(fd);
+    try { rmSync(temporary, { force: true }); } catch { /* best effort cleanup */ }
+    throw error;
+  }
+}
+
+export function appendPrivateFileSync(path: string, content: string): void {
+  ensurePrivateDirectorySync(dirname(path));
+  validateExistingFile(path);
+  const fd = openSync(
+    path,
+    constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | NO_FOLLOW,
+    PRIVATE_FILE_MODE,
+  );
+  try {
+    const current = fstatSync(fd);
+    if (!current.isFile()) throw new Error(`Refusing non-regular sensitive file: ${path}`);
+    assertOwned(current.uid, path);
+    if (isPosix()) fchmodSync(fd, PRIVATE_FILE_MODE);
+    writeFileSync(fd, content, "utf8");
+  } finally {
+    closeSync(fd);
+  }
+}

package/src/window-budget/summarize/condense.ts

@@ -11,6 +11,8 @@ import { completeSimple } from "indusagi/ai";
 import { CONDENSER_BRIEF, buildSummaryPrompt, flattenTranscript } from "./prompt.js";
 
 export interface SummarizeDeps {
+  /** Literal user guidance; never interpreted as shell input. */
+  readonly instructions?: string;
   /** Injectable completer (default: framework `completeSimple`). */
   readonly complete?: CompleteFn;
   /** The summarization model. When omitted, a deterministic local digest is used. */
@@ -71,7 +73,8 @@ export async function summarize(
     const digest = localFallbackDigest(messages, deps.priorDigest);
     return { message: toSummaryMessage(digest, scope), coveredCount };
   }
-  const prompt = buildSummaryPrompt(messages, scope, deps.priorDigest);
+  const prompt = buildSummaryPrompt(messages, scope, deps.priorDigest) +
+    (deps.instructions ? `\n\nUser compaction guidance:\n${deps.instructions}` : "");
   const context = {
     systemPrompt: CONDENSER_BRIEF,
     messages: [{ role: "user", content: prompt, timestamp: Date.now() }],

package/src/workspace/brand.ts

@@ -26,4 +26,4 @@ export const BRAND: Brand = Object.freeze({
 /**
  * The product version — printed by `--version` and shown on the startup banner.
  */
-export const VERSION = "0.2.12";
+export const VERSION = "0.2.14";

package/src/workspace/locator.ts

@@ -2,11 +2,11 @@
  * Workspace Locator — turns the active {@link Brand} plus the environment into a
  * single, fully-resolved {@link Workspace} record of absolute paths.
  */
-import { mkdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, join, resolve } from "node:path";
 import type { Brand, Workspace } from "../boot/contract.js";
 import { BRAND } from "./brand.js";
+import { ensurePrivateDirectorySync } from "../security/private-state.js";
 
 export interface WorkspaceOverrides {
   /** User home directory; defaults to {@link homedir}. */
@@ -97,7 +97,7 @@ export function createWorkspace(overrides: WorkspaceOverrides = {}): Workspace {
  */
 export function ensureDirs(workspace: Workspace): Workspace {
   for (const key of DIRECTORY_KEYS) {
-    mkdirSync(workspace[key], { recursive: true });
+    ensurePrivateDirectorySync(workspace[key]);
   }
   return workspace;
 }

package/supabase/migrations/20260827031803_indusagi_review_agent.sql

@@ -0,0 +1,109 @@
+create extension if not exists pgcrypto;
+
+create table if not exists public.indusagi_review_deliveries (
+  delivery_id text primary key,
+  event_name text not null,
+  received_at timestamptz not null default now()
+);
+
+create table if not exists public.indusagi_review_jobs (
+  id uuid primary key default gen_random_uuid(),
+  delivery_id text references public.indusagi_review_deliveries(delivery_id) on delete set null,
+  installation_id bigint not null,
+  repository text not null,
+  owner text not null,
+  repo text not null,
+  pr_number integer not null check (pr_number > 0),
+  head_sha text not null,
+  title text not null,
+  status text not null default 'pending' check (status in ('pending', 'running', 'completed', 'failed')),
+  attempts integer not null default 0 check (attempts >= 0),
+  max_attempts integer not null default 3 check (max_attempts between 1 and 10),
+  available_at timestamptz not null default now(),
+  worker_id text,
+  claimed_at timestamptz,
+  completed_at timestamptz,
+  review jsonb,
+  github_review_id bigint,
+  github_comment_id bigint,
+  check_run_id bigint,
+  error text,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  unique (repository, pr_number, head_sha)
+);
+
+create index if not exists indusagi_review_jobs_claim_idx
+  on public.indusagi_review_jobs (status, available_at, created_at)
+  where status = 'pending';
+create index if not exists indusagi_review_jobs_pr_idx
+  on public.indusagi_review_jobs (repository, pr_number, created_at desc);
+
+alter table public.indusagi_review_deliveries enable row level security;
+alter table public.indusagi_review_jobs enable row level security;
+
+create or replace function public.claim_indusagi_review_job(p_worker_id text)
+returns setof public.indusagi_review_jobs
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  claimed public.indusagi_review_jobs;
+begin
+  if nullif(trim(p_worker_id), '') is null then
+    raise exception 'worker id is required';
+  end if;
+
+  select * into claimed
+  from public.indusagi_review_jobs
+  where status = 'pending' and available_at <= now()
+  order by created_at
+  for update skip locked
+  limit 1;
+
+  if claimed.id is null then
+    return;
+  end if;
+
+  update public.indusagi_review_jobs
+  set status = 'running',
+      attempts = attempts + 1,
+      worker_id = p_worker_id,
+      claimed_at = now(),
+      updated_at = now()
+  where id = claimed.id
+  returning * into claimed;
+
+  return next claimed;
+end;
+$$;
+
+create or replace function public.recover_stale_indusagi_review_jobs(p_stale_minutes integer default 15)
+returns integer
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  recovered integer;
+begin
+  update public.indusagi_review_jobs
+  set status = case when attempts < max_attempts then 'pending' else 'failed' end,
+      available_at = now(),
+      worker_id = null,
+      claimed_at = null,
+      error = coalesce(error, 'worker lease expired'),
+      completed_at = case when attempts >= max_attempts then now() else completed_at end,
+      updated_at = now()
+  where status = 'running'
+    and claimed_at < now() - make_interval(mins => greatest(1, p_stale_minutes));
+  get diagnostics recovered = row_count;
+  return recovered;
+end;
+$$;
+
+revoke all on function public.claim_indusagi_review_job(text) from public, anon, authenticated;
+revoke all on function public.recover_stale_indusagi_review_jobs(integer) from public, anon, authenticated;
+grant execute on function public.claim_indusagi_review_job(text) to service_role;
+grant execute on function public.recover_stale_indusagi_review_jobs(integer) to service_role;

package/supabase/migrations/20260827035747_atomic_webhook_enqueue.sql

@@ -0,0 +1,75 @@
+create or replace function public.enqueue_indusagi_review_job(
+  p_delivery_id text,
+  p_event_name text,
+  p_installation_id bigint,
+  p_repository text,
+  p_owner text,
+  p_repo text,
+  p_pr_number integer,
+  p_head_sha text,
+  p_title text
+)
+returns table(job_id uuid, duplicate boolean)
+language plpgsql
+security definer
+set search_path = public
+as $$
+declare
+  queued_id uuid;
+  inserted_delivery integer;
+begin
+  if nullif(trim(p_delivery_id), '') is null
+    or nullif(trim(p_event_name), '') is null
+    or p_installation_id <= 0
+    or nullif(trim(p_repository), '') is null
+    or nullif(trim(p_owner), '') is null
+    or nullif(trim(p_repo), '') is null
+    or p_pr_number <= 0
+    or nullif(trim(p_head_sha), '') is null
+    or nullif(trim(p_title), '') is null then
+    raise exception 'invalid review webhook job';
+  end if;
+
+  insert into public.indusagi_review_deliveries(delivery_id, event_name)
+  values (p_delivery_id, p_event_name)
+  on conflict (delivery_id) do nothing;
+  get diagnostics inserted_delivery = row_count;
+
+  if inserted_delivery = 0 then
+    return query select null::uuid, true;
+    return;
+  end if;
+
+  insert into public.indusagi_review_jobs(
+    delivery_id,
+    installation_id,
+    repository,
+    owner,
+    repo,
+    pr_number,
+    head_sha,
+    title
+  ) values (
+    p_delivery_id,
+    p_installation_id,
+    p_repository,
+    p_owner,
+    p_repo,
+    p_pr_number,
+    p_head_sha,
+    p_title
+  )
+  on conflict (repository, pr_number, head_sha) do update
+  set installation_id = excluded.installation_id,
+      title = excluded.title,
+      updated_at = now()
+  returning id into queued_id;
+
+  return query select queued_id, false;
+end;
+$$;
+
+revoke all on function public.enqueue_indusagi_review_job(text, text, bigint, text, text, text, integer, text, text)
+  from public, anon, authenticated;
+grant execute on function public.enqueue_indusagi_review_job(text, text, bigint, text, text, text, integer, text, text)
+  to service_role;

package/supabase/migrations/20260827040104_check_run_reconciliation.sql

@@ -0,0 +1,8 @@
+alter table public.indusagi_review_jobs
+  add column if not exists check_completed_at timestamptz;
+
+create index if not exists indusagi_review_jobs_check_reconcile_idx
+  on public.indusagi_review_jobs (completed_at)
+  where status = 'completed'
+    and check_run_id is not null
+    and check_completed_at is null;