infraweaver 0.1.0

package/src/utils/apiFetch.ts

@@ -0,0 +1,19 @@
+import { log } from "#app/utils/cli";
+import { type CloudFetchOptions, cloudFetch } from "#app/utils/cloudFetchCore";
+
+export type ApiFetchOptions = CloudFetchOptions;
+
+/**
+ * fetch wrapper for hitting the Infraweaver API. the transport concerns —
+ * default host, host allowlist, Vercel bypass secret, default timeout —
+ * live in cloudFetchCore.ts, shared with the stdlib-only post hook.
+ *
+ * requests without an explicit `signal` get the core's default timeout, so a
+ * stalled backend can't hang the action.
+ */
+export async function apiFetch(options: ApiFetchOptions): Promise<Response> {
+  log.debug(
+    `api fetch: ${options.method ?? "GET"} ${new URL(options.path, "https://x").pathname}`,
+  );
+  return cloudFetch(options);
+}

package/src/utils/apiKeys.ts

@@ -0,0 +1,305 @@
+import { DOCS_URL, PRODUCT_NAME } from "#app/brand";
+import {
+  BEDROCK_MODEL_ID_ENV,
+  OPENAI_COMPATIBLE_MODEL_ID_ENV,
+  resolveDisplayAlias,
+  VERTEX_MODEL_ID_ENV,
+} from "#app/models";
+import { getApiUrl } from "#app/utils/apiUrl";
+import {
+  isOpenAiCompatibleRoute,
+  OPENAI_COMPATIBLE_API_KEY_ENV,
+  OPENAI_COMPATIBLE_BASE_URL_ENV,
+} from "#app/utils/openaiCompatible";
+import {
+  GOOGLE_CLOUD_PROJECT_ENV,
+  readProjectIdFromVertexServiceAccountJson,
+  VERTEX_LOCATION_ENV,
+  VERTEX_SERVICE_ACCOUNT_JSON_ENV,
+} from "#app/utils/vertex";
+
+/** marker prefix on the throw message for the catch-side reclassification path */
+const MISSING_KEY_MARKER = "no API key found";
+
+/** Markdown body used for both the thrown error and the formatted PR comment summary. */
+function buildMissingApiKeyError(params: { owner: string; name: string }): string {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+  const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+
+  return [
+    `**${MISSING_KEY_MARKER}** — ${PRODUCT_NAME} needs at least one LLM provider API key (e.g. \`ANTHROPIC_API_KEY\`, \`OPENAI_API_KEY\`, \`GEMINI_API_KEY\`) configured as a GitHub Actions secret.`,
+    "",
+    `[Open repo secrets →](${githubSecretsUrl}) · [Configure model →](${settingsUrl}) · [Setup docs →](${DOCS_URL}/keys) · [Ask in Discord →](https://discord.gg/8y96raFg8e)`,
+  ].join("\n");
+}
+
+function buildBedrockSetupError(params: {
+  owner: string;
+  name: string;
+  missing: string[];
+}): string {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+
+  return `Bedrock model selected but required configuration is missing: ${params.missing.join(", ")}.
+
+add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then reference them in your workflow's \`env:\` block:
+
+  AWS_BEARER_TOKEN_BEDROCK: \${{ secrets.AWS_BEARER_TOKEN_BEDROCK }}
+  AWS_REGION: \${{ secrets.AWS_REGION }}
+  ${BEDROCK_MODEL_ID_ENV}: \${{ secrets.${BEDROCK_MODEL_ID_ENV} }}
+
+\`AWS_BEARER_TOKEN_BEDROCK\` may be substituted with \`AWS_ACCESS_KEY_ID\` + \`AWS_SECRET_ACCESS_KEY\` (and optional \`AWS_SESSION_TOKEN\`) if you prefer access keys.
+
+for full setup instructions, see ${DOCS_URL}/bedrock`;
+}
+
+function buildVertexSetupError(params: { owner: string; name: string; missing: string[] }): string {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+
+  return `Google Vertex AI model selected but required configuration is missing: ${params.missing.join(", ")}.
+
+add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then reference them in your workflow's \`env:\` block:
+
+  ${VERTEX_SERVICE_ACCOUNT_JSON_ENV}: \${{ secrets.${VERTEX_SERVICE_ACCOUNT_JSON_ENV} }}
+  ${GOOGLE_CLOUD_PROJECT_ENV}: my-project
+  ${VERTEX_LOCATION_ENV}: global
+  ${VERTEX_MODEL_ID_ENV}: <vertex-model-id>
+
+for full setup instructions, see ${DOCS_URL}/vertex`;
+}
+
+function buildOpenAiCompatibleSetupError(params: {
+  owner: string;
+  name: string;
+  missing: string[];
+}): string {
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+
+  return `OpenAI-compatible endpoint selected but required configuration is missing: ${params.missing.join(", ")}.
+
+add the missing secret(s) to your GitHub repository at ${githubSecretsUrl}, then reference them in your workflow's \`env:\` block:
+
+  ${OPENAI_COMPATIBLE_BASE_URL_ENV}: \${{ secrets.${OPENAI_COMPATIBLE_BASE_URL_ENV} }}
+  ${OPENAI_COMPATIBLE_MODEL_ID_ENV}: <model-id-your-endpoint-serves>
+  ${OPENAI_COMPATIBLE_API_KEY_ENV}: \${{ secrets.${OPENAI_COMPATIBLE_API_KEY_ENV} }}   # optional for keyless self-hosted servers
+
+for full setup instructions, see ${DOCS_URL}/openai-compatible`;
+}
+
+function hasEnvVar(name: string): boolean {
+  const value = process.env[name];
+  return typeof value === "string" && value.length > 0;
+}
+
+function validateOpenAiCompatibleSetup(params: { owner: string; name: string }): void {
+  // base URL + model id are required; the API key is optional (keyless self-hosted
+  // endpoints like a local Ollama don't need one).
+  const missing: string[] = [];
+  if (!hasEnvVar(OPENAI_COMPATIBLE_BASE_URL_ENV)) missing.push(OPENAI_COMPATIBLE_BASE_URL_ENV);
+  if (!hasEnvVar(OPENAI_COMPATIBLE_MODEL_ID_ENV)) missing.push(OPENAI_COMPATIBLE_MODEL_ID_ENV);
+
+  if (missing.length > 0) {
+    throw new Error(
+      buildOpenAiCompatibleSetupError({ owner: params.owner, name: params.name, missing }),
+    );
+  }
+}
+
+function validateBedrockSetup(params: { owner: string; name: string }): void {
+  const hasAuth =
+    hasEnvVar("AWS_BEARER_TOKEN_BEDROCK") ||
+    (hasEnvVar("AWS_ACCESS_KEY_ID") && hasEnvVar("AWS_SECRET_ACCESS_KEY"));
+
+  const missing: string[] = [];
+  if (!hasAuth)
+    missing.push("AWS_BEARER_TOKEN_BEDROCK (or AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)");
+  if (!hasEnvVar("AWS_REGION")) missing.push("AWS_REGION");
+  if (!hasEnvVar(BEDROCK_MODEL_ID_ENV)) missing.push(BEDROCK_MODEL_ID_ENV);
+
+  if (missing.length > 0) {
+    throw new Error(
+      buildBedrockSetupError({
+        owner: params.owner,
+        name: params.name,
+        missing,
+      }),
+    );
+  }
+}
+
+function validateVertexSetup(params: { owner: string; name: string }): void {
+  const hasAuth = hasEnvVar(VERTEX_SERVICE_ACCOUNT_JSON_ENV);
+  const hasProject =
+    hasEnvVar(GOOGLE_CLOUD_PROJECT_ENV) ||
+    readProjectIdFromVertexServiceAccountJson() !== undefined;
+
+  const missing: string[] = [];
+  if (!hasAuth) missing.push(VERTEX_SERVICE_ACCOUNT_JSON_ENV);
+  if (!hasProject) missing.push(GOOGLE_CLOUD_PROJECT_ENV);
+  if (!hasEnvVar(VERTEX_LOCATION_ENV)) missing.push(VERTEX_LOCATION_ENV);
+  if (!hasEnvVar(VERTEX_MODEL_ID_ENV)) missing.push(VERTEX_MODEL_ID_ENV);
+
+  if (missing.length > 0) {
+    throw new Error(
+      buildVertexSetupError({
+        owner: params.owner,
+        name: params.name,
+        missing,
+      }),
+    );
+  }
+}
+
+/**
+ * Validate that the resolved model can actually be served by the chosen
+ * agent. For routing slugs (Bedrock / Vertex) the auth shape is multi-var
+ * (auth + region/location + model-id) and `opencode models` doesn't catch
+ * gaps in the latter two — keep dedicated setup validators. For the
+ * opencode path, the authoritative answer comes from OpenCode's own model
+ * introspection (`authorized` set captured in `openCodeModels.ts`). For
+ * the claude path, fall back to the static check (`ANTHROPIC_API_KEY` /
+ * `CLAUDE_CODE_OAUTH_TOKEN`).
+ */
+export function validateAgentApiKey(params: {
+  agent: { name: string };
+  model: string | undefined;
+  authorized: Set<string>;
+  owner: string;
+  name: string;
+}): void {
+  if (params.model) {
+    const alias = resolveDisplayAlias(params.model);
+    // OpenAI-compatible BYOK route: detected by env sentinel because the resolved
+    // id is the raw model (not the slug), and a HuggingFace id can contain a `/` —
+    // so this must come before BOTH the no-slash routing block and the opencode
+    // `authorized` check (a custom endpoint never appears in `opencode models`).
+    if (isOpenAiCompatibleRoute(params.model)) {
+      validateOpenAiCompatibleSetup({ owner: params.owner, name: params.name });
+      return;
+    }
+    if (alias?.routing === "bedrock") {
+      validateBedrockSetup({ owner: params.owner, name: params.name });
+      return;
+    }
+    if (alias?.routing === "vertex") {
+      validateVertexSetup({ owner: params.owner, name: params.name });
+      return;
+    }
+
+    // raw backend model IDs (post-resolveModel for routing slugs) have no
+    // `/`. discriminate by the env-var sentinel, then run the matching
+    // setup validator — `opencode models` doesn't help here because the
+    // Bedrock/Vertex provider plugins need region/location/model-id wired
+    // through env regardless of CLI-side auth.
+    if (!params.model.includes("/")) {
+      if (process.env[VERTEX_MODEL_ID_ENV]?.trim() === params.model) {
+        validateVertexSetup({ owner: params.owner, name: params.name });
+        return;
+      }
+      validateBedrockSetup({ owner: params.owner, name: params.name });
+      return;
+    }
+
+    if (params.agent.name === "opencode") {
+      if (params.authorized.has(params.model)) return;
+      throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+    }
+
+    // claude: single-provider check on the Anthropic auth shapes.
+    if (hasEnvVar("ANTHROPIC_API_KEY") || hasEnvVar("CLAUDE_CODE_OAUTH_TOKEN")) return;
+    throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+  }
+
+  // no model configured (auto-select path).
+  if (params.agent.name === "opencode") {
+    if (params.authorized.size > 0) return;
+    throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+  }
+  if (hasEnvVar("ANTHROPIC_API_KEY") || hasEnvVar("CLAUDE_CODE_OAUTH_TOKEN")) return;
+  throw new Error(buildMissingApiKeyError({ owner: params.owner, name: params.name }));
+}
+
+/**
+ * Detect agent-runtime auth failures that should be reformatted as an actionable
+ * key-fix CTA before being shown to the user. Covers the shapes we see:
+ *   - missing key (validateAgentApiKey throw): contains MISSING_KEY_MARKER
+ *   - revoked / invalid key (Claude CLI 401 surfaced via api_error_status):
+ *     "Invalid API key · Fix external API key" + similar provider variants
+ *   - direct-Anthropic 401 (`Failed to authenticate. API Error: 401 ...
+ *     {"type":"error","error":{"type":"authentication_error", ...
+ *     "Invalid bearer token"}}`) emitted by the Claude CLI for revoked /
+ *     mistyped / rotated `ANTHROPIC_API_KEY`. see #782.
+ */
+export function isApiKeyAuthError(text: string): boolean {
+  if (!text) return false;
+  return (
+    text.includes(MISSING_KEY_MARKER) ||
+    /Invalid API key/i.test(text) ||
+    /\bUser not found\b/i.test(text) ||
+    /\bInvalid authentication\b/i.test(text) ||
+    /authentication_error/i.test(text) ||
+    /Invalid bearer token/i.test(text) ||
+    /api_error_status\s*=\s*401/i.test(text) ||
+    /API Error:\s*401/i.test(text) ||
+    // upstream #931: covers the direct-Anthropic AND managed-Bedrock 403 shape
+    // (`Failed to authenticate. API Error: 403 … has expired`) — a short-lived
+    // bearer/OAuth credential that lapsed mid-run, not just a 401-rejected key.
+    /Failed to authenticate\. API Error:/i.test(text) ||
+    // upstream #960: DeepSeek's invalid-key shape, anchored so it can't collide
+    // with its separate `Insufficient balance` billing message.
+    /Your api key:.*is invalid/i.test(text) ||
+    isOAuthCredentialExpiredError(text)
+  );
+}
+
+/**
+ * A subscription/OAuth credential (Claude `CLAUDE_CODE_OAUTH_TOKEN`, Codex OAuth, or a
+ * short-lived Bedrock bearer) that has EXPIRED — distinct from a rejected/mistyped key.
+ * The fix is to refresh/re-mint the credential, not rotate an API key, so it gets its
+ * own CTA in {@link formatApiKeyErrorSummary}.
+ */
+export function isOAuthCredentialExpiredError(text: string): boolean {
+  if (!text) return false;
+  return (
+    /authentication token has expired/i.test(text) ||
+    /Token refresh failed/i.test(text) ||
+    /API Error:\s*403[\s\S]*has expired/i.test(text)
+  );
+}
+
+/**
+ * Friendly Markdown summary for both the missing-key and invalid-key cases.
+ * Used in the catch / result-failure paths in `main.ts` to overwrite the raw
+ * agent error before it's posted to the PR progress comment.
+ */
+export function formatApiKeyErrorSummary(params: {
+  owner: string;
+  name: string;
+  raw: string;
+}): string {
+  if (params.raw.includes(MISSING_KEY_MARKER)) {
+    return buildMissingApiKeyError({ owner: params.owner, name: params.name });
+  }
+
+  const githubSecretsUrl = `https://github.com/${params.owner}/${params.name}/settings/secrets/actions`;
+  const settingsUrl = `${getApiUrl()}/console/${params.owner}/${params.name}`;
+
+  // An EXPIRED subscription/OAuth/Bedrock-bearer credential needs RE-ISSUING, not key
+  // rotation — give it its own CTA (upstream #931).
+  if (isOAuthCredentialExpiredError(params.raw)) {
+    return [
+      `**Your credential expired.** A subscription/OAuth token or short-lived Bedrock bearer ${PRODUCT_NAME} used is no longer valid — refreshing it (not rotating an API key) is the fix. Re-issue it and update the matching GitHub Actions secret:`,
+      "",
+      `- \`CLAUDE_CODE_OAUTH_TOKEN\` — re-mint the Claude subscription token, then update the secret.`,
+      `- Bedrock \`AWS_BEARER_TOKEN_BEDROCK\` — re-issue the bearer, or switch to \`AWS_ACCESS_KEY_ID\`/\`AWS_SECRET_ACCESS_KEY\`.`,
+      "",
+      `[Update repo secret →](${githubSecretsUrl}) · [Setup docs →](${DOCS_URL}/keys) · [Ask in Discord →](https://discord.gg/8y96raFg8e)`,
+    ].join("\n");
+  }
+
+  return [
+    `**Your LLM provider API key was rejected (401/403).** Rotate the key in your provider dashboard, then update the matching GitHub Actions secret.`,
+    "",
+    `[Update repo secret →](${githubSecretsUrl}) · [Model settings →](${settingsUrl}) · [Setup docs →](${DOCS_URL}/keys) · [Ask in Discord →](https://discord.gg/8y96raFg8e)`,
+  ].join("\n");
+}

package/src/utils/apiUrl.ts

@@ -0,0 +1,42 @@
+import { OIDC_AUDIENCE } from "#app/brand";
+import { log } from "#app/utils/cli";
+import { resolveApiUrl } from "#app/utils/cloudFetchCore";
+
+/**
+ * resolve the Infraweaver API base URL. validation (https enforcement, the
+ * bearer-credential host allowlist, API_ALLOWED_HOSTS) lives in
+ * cloudFetchCore.ts so the stdlib-only post hook enforces the same policy.
+ */
+export function getApiUrl(): string {
+  const raw = resolveApiUrl();
+  log.debug(`resolved API_URL: ${raw}`);
+  return raw;
+}
+
+/**
+ * Whether a real Infraweaver backend is configured.
+ *
+ * Standalone BYOK runs (the OSS default) leave `API_URL` unset — `getApiUrl`
+ * then falls back to the marketing host, which serves no API. The dormant
+ * open-core persistence seams (repo learnings, run-field PATCHes) must no-op
+ * in that case rather than POST into the void and surface the host's 404 as a
+ * CI warning. A real backend — the hosted SaaS, or local dev with
+ * `API_URL=http://localhost:3000` — sets `API_URL` explicitly.
+ */
+export function isBackendConfigured(): boolean {
+  return Boolean(process.env.API_URL);
+}
+
+/**
+ * The OIDC audience the tokenless path requests via `core.getIDToken(...)`.
+ *
+ * The default `"infraweaver-api"` is NOT the security boundary (the GitHub App
+ * install-consent gate is — Cloud only mints for an owner that installed the App). It
+ * is defence-in-depth, and is operator-overridable per deployment: set
+ * `GITHUB_OIDC_AUDIENCE` on BOTH the Cloud (its `expectedOidcAudience()` reads the same
+ * var) AND the engine's Action job env. Both must agree or OIDC auth fails closed.
+ * Single-source so all three engine call sites can never drift from the Cloud default.
+ */
+export function cloudOidcAudience(): string {
+  return process.env.GITHUB_OIDC_AUDIENCE || OIDC_AUDIENCE;
+}

package/src/utils/assets.ts

@@ -0,0 +1,123 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { log } from "#app/utils/cli";
+
+// github image hosts that appear in issue/PR/review/comment markdown.
+//  - github.com/user-attachments/assets/... and github.com/<owner>/<repo>/assets/...
+//    are the raw urls present in *unrendered* bodies (the MCP tools return these);
+//    fetching them needs the installation token.
+//  - {private-user-images,user-images,camo}.githubusercontent.com/... are the signed
+//    urls produced by body_html→turndown (see resolveBody); they self-authenticate via
+//    a jwt/signature in the query string and must be fetched WITHOUT an Authorization
+//    header (sending the token to the CDN would leak it).
+const ASSET_HOST = String.raw`(?:github\.com\/(?:user-attachments\/assets|[^/\s]+\/[^/\s]+\/assets)\/|(?:private-user-images|user-images|camo)\.githubusercontent\.com\/)`;
+const MARKDOWN_IMAGE = new RegExp(String.raw`!\[[^\]]*\]\((https:\/\/${ASSET_HOST}[^\s"')]+)`, "g");
+const HTML_IMAGE = new RegExp(String.raw`<img[^>]+src=["'](https:\/\/${ASSET_HOST}[^"'\s]+)`, "g");
+
+// Bound the download of an attacker-controlled (PR/issue/comment-sourced) asset
+// url: a hung or oversized response must not stall the run or exhaust memory.
+const ASSET_FETCH_TIMEOUT_MS = 20_000;
+const MAX_ASSET_BYTES = 50 * 1024 * 1024;
+
+const ALLOWED_EXTENSIONS = new Set([
+  ".png",
+  ".jpg",
+  ".gif",
+  ".webp",
+  ".svg",
+  ".mp4",
+  ".mov",
+  ".webm",
+]);
+
+/**
+ * downloads any github-hosted image/video assets referenced in `markdown` to
+ * `<tmpdir>/assets` and rewrites the urls to the local file paths, so the agent can
+ * read screenshots directly instead of relying on remote (often short-lived, signed)
+ * urls. unique urls are downloaded once and every occurrence is rewritten. assets that
+ * fail to download are left untouched.
+ */
+export async function downloadAssetsInMarkdown(
+  markdown: string,
+  tmpdir: string,
+  githubToken: string,
+): Promise<string> {
+  const urls = new Set<string>();
+  for (const match of markdown.matchAll(MARKDOWN_IMAGE)) urls.add(match[1]!);
+  for (const match of markdown.matchAll(HTML_IMAGE)) urls.add(match[1]!);
+
+  if (urls.size === 0) return markdown;
+
+  const assetsDir = path.join(tmpdir, "assets");
+  fs.mkdirSync(assetsDir, { recursive: true });
+
+  log.debug(`[assets] found ${urls.size} asset(s) to download`);
+
+  let result = markdown;
+  for (const url of urls) {
+    const localPath = await downloadAsset(url, assetsDir, githubToken);
+    if (localPath) result = result.replaceAll(url, localPath);
+  }
+  return result;
+}
+
+async function downloadAsset(
+  url: string,
+  assetsDir: string,
+  githubToken: string,
+): Promise<string | null> {
+  // only github.com itself needs the installation token; the githubusercontent CDN
+  // urls carry their own signature. `redirect: "follow"` (undici default) strips the
+  // Authorization header on cross-origin hops, so the token never reaches S3/the CDN.
+  const needsAuth = new URL(url).hostname === "github.com";
+
+  try {
+    const res = await fetch(url, {
+      headers: needsAuth ? { Authorization: `Bearer ${githubToken}` } : {},
+      signal: AbortSignal.timeout(ASSET_FETCH_TIMEOUT_MS),
+    });
+    if (!res.ok) {
+      log.warning(`[assets] failed to download ${url}: ${res.status}`);
+      return null;
+    }
+
+    const declared = Number(res.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > MAX_ASSET_BYTES) {
+      log.warning(`[assets] skipping ${url}: ${declared} bytes exceeds ${MAX_ASSET_BYTES} cap`);
+      return null;
+    }
+
+    const buffer = Buffer.from(await res.arrayBuffer());
+    if (buffer.length > MAX_ASSET_BYTES) {
+      log.warning(`[assets] skipping ${url}: body exceeds ${MAX_ASSET_BYTES} cap`);
+      return null;
+    }
+    const ext = resolveExtension(url, res.headers.get("content-type"));
+    const filename = `${crypto.createHash("sha256").update(url).digest("hex").slice(0, 16)}${ext}`;
+    const localPath = path.join(assetsDir, filename);
+    fs.writeFileSync(localPath, buffer);
+    log.debug(`[assets] downloaded ${url} to ${localPath}`);
+    return localPath;
+  } catch (e) {
+    log.warning(`[assets] error downloading ${url}: ${e}`);
+    return null;
+  }
+}
+
+/** picks a safe, whitelisted file extension from the url path or response content-type. */
+function resolveExtension(url: string, contentType: string | null): string {
+  const fromPath = path.extname(new URL(url).pathname).toLowerCase();
+  if (ALLOWED_EXTENSIONS.has(fromPath)) return fromPath;
+  if (fromPath === ".jpeg") return ".jpg";
+
+  const ct = contentType?.toLowerCase() ?? "";
+  if (ct.includes("jpeg") || ct.includes("jpg")) return ".jpg";
+  if (ct.includes("gif")) return ".gif";
+  if (ct.includes("webp")) return ".webp";
+  if (ct.includes("svg")) return ".svg";
+  if (ct.includes("mp4")) return ".mp4";
+  if (ct.includes("quicktime") || ct.includes("mov")) return ".mov";
+  if (ct.includes("webm")) return ".webm";
+  return ".png";
+}