infraweaver 0.1.0

package/src/utils/run.ts

@@ -0,0 +1,100 @@
+import type { AgentResult } from "#app/agents/shared";
+import type { MainResult } from "#app/main";
+import { reportProgress } from "#app/mcp/comment";
+import type { ToolContext } from "#app/mcp/server";
+import { log } from "#app/utils/cli";
+import { reportErrorToComment } from "#app/utils/errorReport";
+
+export interface HandleAgentResultParams {
+  result: AgentResult;
+  toolContext: ToolContext;
+  silent: boolean | undefined;
+}
+
+function getErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}
+
+export async function handleAgentResult(ctx: HandleAgentResultParams): Promise<MainResult> {
+  if (!ctx.result.success) {
+    // rendering + posting for the `!success` branch lives in
+    // `finalizeSuccessRun` (called immediately before this function) so the
+    // BYOK billing-exhausted, hang, and api-key bodies land on a single
+    // surface — both for runs with a pre-existing progress comment AND for
+    // silent triggers via `createIfMissing`. see #835.
+    return {
+      success: false,
+      error: ctx.result.error || "Agent execution failed",
+      output: ctx.result.output!,
+    };
+  }
+
+  // IncrementalReview's non-substantive path exits cleanly without
+  // submitting any review, so no MCP write tool flips wasUpdated and the
+  // strict completion check below would otherwise fail the run. The
+  // isReviewMode skip is load-bearing for that path: the agent's exit
+  // code is the completion signal, not a progress-comment write.
+  // (Review mode that submits a real review now flips wasUpdated via
+  // create_pull_request_review, so the skip is redundant for the
+  // substantive-review path but kept for symmetry with IncrementalReview.)
+  // See plans/review_progress_comment_cleanup_b0120f6c.plan.md.
+  const toolState = ctx.toolContext.toolState;
+  const mode = toolState.selectedMode;
+  const isReviewMode =
+    mode === "Review" || mode === "IncrementalReview" || mode === "TerraformCodeReview";
+  if (!isReviewMode && !toolState.wasUpdated && toolState.hadProgressComment && !ctx.silent) {
+    // the agent exited successfully but never landed a GitHub write — either it
+    // answered the mention in raw assistant text (which is never posted, only
+    // logged) or a write tool failed (e.g. report_progress hit a 401). salvage
+    // by delivering the content we have to the progress comment so the user
+    // actually gets the answer instead of a failed run. (finalizeSuccessRun
+    // preserves the progress comment whenever wasUpdated is false, so the write
+    // lands here.)
+    //
+    // stop the todo tracker first: on this path the agent used todowrite but
+    // never called report_progress, so a pending debounced render could still
+    // be queued — draining it keeps it from clobbering the salvaged answer and
+    // from holding the event loop open. mirrors ReportProgressTool.
+    const tracker = toolState.todoTracker;
+    if (tracker) {
+      tracker.cancel();
+      await tracker.settled();
+    }
+    // `lastProgressBody` is the body a failed report_progress already assembled
+    // (task-list collapsible included), so use it verbatim; otherwise fall back
+    // to the agent's final assistant text and append the collapsible the way
+    // report_progress would.
+    let salvage = toolState.lastProgressBody?.trim();
+    if (!salvage) {
+      const output = ctx.result.output?.trim();
+      const collapsible = tracker?.renderCollapsible({ completeInProgress: true });
+      salvage = output && collapsible ? `${output}\n\n${collapsible}` : output;
+    }
+    if (salvage) {
+      try {
+        await reportProgress(ctx.toolContext, { body: salvage });
+        log.success("Task complete.");
+        return { success: true, output: ctx.result.output || "" };
+      } catch (writeError) {
+        // the write itself is failing (auth/permissions) — surface THAT, not
+        // the generic "no progress" message, so the real cause isn't masked.
+        const error = `failed to deliver agent result: ${getErrorMessage(writeError)}`;
+        await reportErrorToComment({ toolState, error, title: "Error" }).catch(() => {});
+        return { success: false, error, output: ctx.result.output || "" };
+      }
+    }
+
+    const error = ctx.result.error || "agent completed without reporting progress";
+    try {
+      await reportErrorToComment({ toolState, error, title: "Error" });
+    } catch {}
+    return { success: false, error, output: ctx.result.output || "" };
+  }
+
+  log.success("Task complete.");
+
+  return {
+    success: true,
+    output: ctx.result.output || "",
+  };
+}

package/src/utils/runContext.ts

@@ -0,0 +1,276 @@
+import { PRODUCT_NAME, TOKEN_PREFIX } from "#app/brand";
+import type { PushPermission, ShellPermission } from "#app/external";
+import { apiFetch } from "#app/utils/apiFetch";
+import { isBackendConfigured } from "#app/utils/apiUrl";
+import { log } from "#app/utils/cli";
+import type { RepoContext } from "#app/utils/github";
+
+export interface Mode {
+  id: string;
+  name: string;
+  description: string;
+  prompt: string;
+}
+
+/**
+ * server-parsed TOC entry for `Repo.learnings`. depth is 1-6 (h1-h6),
+ * line numbers are 1-indexed against the raw body. computed by
+ * `parseLearningsHeadings` in `utils/learningsToc.ts` (server side) and
+ * shipped over the run-context JSON boundary; the canonical declaration
+ * lives there. duplicated here because the action runtime can't reach
+ * across into the proprietary root-level codebase, and the JSON wire
+ * means typecheck can't enforce shape equality across both sides.
+ */
+export interface LearningsHeading {
+  depth: 1 | 2 | 3 | 4 | 5 | 6;
+  title: string;
+  startLine: number;
+  endLine: number;
+}
+
+export interface RepoSettings {
+  model: string | null;
+  modes: Mode[];
+  setupScript: string | null;
+  postCheckoutScript: string | null;
+  prepushScript: string | null;
+  stopScript: string | null;
+  push: PushPermission;
+  shell: ShellPermission;
+  prApproveEnabled: boolean;
+  modeInstructions: Record<string, string>;
+  learnings: string | null;
+  learningsHeadings: LearningsHeading[];
+  envAllowlist: string | null;
+}
+
+/**
+ * Account-level billing plan. Orthogonal to repo-level OSS status. Mirrors
+ * the server's `AccountPlan` in `utils/billing.ts`. `"none"` = free tier,
+ * `"payg"` = card on file / pay-as-you-go.
+ */
+export type AccountPlan = "none" | "payg";
+
+/**
+ * Cloud-managed module credentials for this repo, entered once in the dashboard's
+ * Refactor dialog and sealed at rest. Delivered over the authenticated, repo-scoped
+ * run-context call (never the GitHub `repository_dispatch` payload). Used by the
+ * engine only as a FALLBACK for the matching action inputs — an explicit
+ * `module_fetch_token` / `registry_token` input always wins. Both fields optional;
+ * absent on OSS / unmanaged runs or when none were stored.
+ */
+export interface ModuleCredentials {
+  /** read-only PAT for a private cross-repo `git::` module (refactor b.1). */
+  moduleFetchToken?: string;
+  /** bearer token for a private Terraform registry module (refactor b.4). */
+  registryToken?: string;
+}
+
+export interface RunContext {
+  settings: RepoSettings;
+  apiToken: string;
+  oss: boolean;
+  plan: AccountPlan;
+  /**
+   * The maintained-pack control ids this run's ORG marked MANDATORY in the Cloud
+   * dashboard (the "required controls" policy). Org-scoped by construction — the
+   * run-context call is authenticated to exactly one org + repo, so a run only
+   * ever receives its own org's policy. Merged into the gate's `required_controls`
+   * so an open finding on any of these fails CI regardless of severity. `[]` for
+   * OSS / unmanaged runs.
+   */
+  requiredControls: string[];
+  /** §5.12 the org's proven-fix library — patterns (finding-type → proven
+   *  transformation) captured from prior `✗→✓` proofs across the org's fleet,
+   *  served so this run can offer them as priors for matching finding-types. An
+   *  untrusted blob coerced engine-side (utils/fixMemory `coerceLibrary`). `[]`
+   *  for OSS / unentitled / unconfigured runs. */
+  provenFixes: unknown[];
+  /** G7 the org's fleet-wide dismissal record — which rules this org has waived,
+   *  across how many DISTINCT repos, with the reasons given. A SURFACING signal
+   *  only: it reorders the low-severity tail and can neither suppress a finding
+   *  nor change a verdict (see `terraform/noiseProfile`). An untrusted blob
+   *  coerced engine-side, same posture as {@link RunContext.provenFixes}. `[]`
+   *  for OSS / unentitled / unconfigured runs. */
+  noiseProfile: unknown[];
+  /** TC-2.2 the org's fleet-wide record of provider-upgrade transforms that have
+   *  already planned cleanly elsewhere — counters keyed by transform id, never
+   *  another repo's configuration. Annotates a detected transform with how widely
+   *  it has been proven. An untrusted blob coerced engine-side, same posture as
+   *  {@link RunContext.provenFixes}. `[]` for OSS / unentitled / unconfigured runs. */
+  provenTransforms: unknown[];
+  /** Cloud-managed module credentials (see {@link ModuleCredentials}); undefined
+   *  when none are stored for this repo. */
+  moduleCredentials?: ModuleCredentials;
+}
+
+const defaultSettings: RepoSettings = {
+  model: null,
+  modes: [],
+  setupScript: null,
+  postCheckoutScript: null,
+  prepushScript: null,
+  stopScript: null,
+  push: "restricted",
+  shell: "restricted",
+  prApproveEnabled: false,
+  modeInstructions: {},
+  learnings: null,
+  learningsHeadings: [],
+  envAllowlist: null,
+};
+
+const defaultRunContext: RunContext = {
+  settings: defaultSettings,
+  apiToken: "",
+  oss: false,
+  plan: "none",
+  requiredControls: [],
+  provenFixes: [],
+  noiseProfile: [],
+  provenTransforms: [],
+};
+
+function fellBackToDefaults(reason: string): RunContext {
+  if (isBackendConfigured()) {
+    log.warning(
+      `» repo settings unavailable (${reason}); using defaults — Cloud policy (required controls, modes, model) is NOT applied for this run`,
+    );
+  }
+  return defaultRunContext;
+}
+
+/**
+ * Actionable hint for a 401/403 from the run-context call — by far the most common
+ * setup mistake. A Cloud-connected workflow authenticates to Infraweaver Cloud one of
+ * two ways: the tokenless GitHub App path (the engine mints a GitHub Actions OIDC
+ * token, which needs `permissions: id-token: write`), or an org token passed as the
+ * `api_token` input. With neither, Cloud only sees the workflow's GitHub job token —
+ * which it can't use — and rejects the run, so reporting + learnings silently no-op.
+ * The message is tailored to whether an OIDC token was even available this run, so we
+ * don't tell someone to add a permission they already granted.
+ */
+function cloudAuthHint(status: number, oidcToken: string | undefined): string {
+  if (!oidcToken) {
+    return (
+      `» ${PRODUCT_NAME} Cloud rejected this run (HTTP ${status}) and NO GitHub Actions OIDC token was ` +
+      `available. To report via the ${PRODUCT_NAME} GitHub App (tokenless), add \`id-token: write\` to this ` +
+      `workflow's \`permissions:\` block — no secret needed. Or pass an \`api_token\` input (a ${TOKEN_PREFIX} org ` +
+      "token from the Cloud Tokens page) to use the org-token path instead. Until then this run can't " +
+      "reach Cloud and runs as pure OSS (results stay in CI)."
+    );
+  }
+  return (
+    `» ${PRODUCT_NAME} Cloud rejected this run's GitHub OIDC identity (HTTP ${status}). The OIDC token was ` +
+    `sent, so \`id-token: write\` is set correctly — check instead that the ${PRODUCT_NAME} GitHub App is ` +
+    "installed on this repository's owner, and that `GITHUB_OIDC_AUDIENCE` (if you set it) matches " +
+    `the value configured in ${PRODUCT_NAME} Cloud.`
+  );
+}
+
+/** Coerce the untrusted run-context `moduleCredentials` blob into the typed shape,
+ *  keeping only non-empty string values. Returns undefined when nothing usable is
+ *  present (so the engine treats it as "no managed credentials"). */
+export function parseModuleCredentials(
+  raw: { moduleFetchToken?: unknown; registryToken?: unknown } | undefined,
+): ModuleCredentials | undefined {
+  if (!raw || typeof raw !== "object") return undefined;
+  const out: ModuleCredentials = {};
+  if (typeof raw.moduleFetchToken === "string" && raw.moduleFetchToken.trim())
+    out.moduleFetchToken = raw.moduleFetchToken;
+  if (typeof raw.registryToken === "string" && raw.registryToken.trim())
+    out.registryToken = raw.registryToken;
+  return out.moduleFetchToken || out.registryToken ? out : undefined;
+}
+
+/**
+ * fetch run context from Infraweaver API
+ * returns settings + API token for subsequent calls
+ * returns defaults if fetch fails (warns when a backend was configured)
+ */
+export async function fetchRunContext(params: {
+  token: string;
+  repoContext: RepoContext;
+  oidcToken?: string | undefined;
+}): Promise<RunContext> {
+  const timeoutMs = 30000;
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
+
+  try {
+    const headers: Record<string, string> = {
+      Authorization: `Bearer ${params.token}`,
+    };
+    if (params.oidcToken) {
+      headers["X-GitHub-OIDC-Token"] = params.oidcToken;
+    }
+
+    const response = await apiFetch({
+      path: `/api/repo/${params.repoContext.owner}/${params.repoContext.name}/run-context`,
+      headers,
+      signal: controller.signal,
+    });
+
+    clearTimeout(timeoutId);
+
+    if (!response.ok) {
+      if (
+        (response.status === 401 || response.status === 403) &&
+        isBackendConfigured()
+      ) {
+        log.warning(cloudAuthHint(response.status, params.oidcToken));
+      }
+      return fellBackToDefaults(`run-context HTTP ${response.status}`);
+    }
+
+    const data = (await response.json()) as {
+      settings: RepoSettings | null;
+      apiToken: string;
+      oss?: boolean;
+      plan?: AccountPlan;
+      requiredControls?: string[];
+      provenFixes?: unknown[];
+      provenTransforms?: unknown[];
+      noiseProfile?: unknown[];
+      moduleCredentials?: {
+        moduleFetchToken?: unknown;
+        registryToken?: unknown;
+      };
+    } | null;
+
+    if (data === null) {
+      return fellBackToDefaults("run-context returned no body");
+    }
+
+    const moduleCredentials = parseModuleCredentials(data.moduleCredentials);
+    return {
+      settings: {
+        ...defaultSettings,
+        ...data.settings,
+        modes: data.settings?.modes ?? [],
+        setupScript: data.settings?.setupScript ?? null,
+        postCheckoutScript: data.settings?.postCheckoutScript ?? null,
+        prepushScript: data.settings?.prepushScript ?? null,
+        stopScript: data.settings?.stopScript ?? null,
+        learningsHeadings: data.settings?.learningsHeadings ?? [],
+      },
+      apiToken: data.apiToken,
+      oss: data.oss ?? false,
+      plan: data.plan ?? "none",
+      requiredControls: Array.isArray(data.requiredControls)
+        ? data.requiredControls
+        : [],
+      provenFixes: Array.isArray(data.provenFixes) ? data.provenFixes : [],
+      provenTransforms: Array.isArray(data.provenTransforms)
+        ? data.provenTransforms
+        : [],
+      noiseProfile: Array.isArray(data.noiseProfile) ? data.noiseProfile : [],
+      ...(moduleCredentials ? { moduleCredentials } : {}),
+    };
+  } catch (err) {
+    clearTimeout(timeoutId);
+    return fellBackToDefaults(
+      err instanceof Error ? err.message : "request failed",
+    );
+  }
+}

package/src/utils/runContextData.ts

@@ -0,0 +1,121 @@
+import * as core from "@actions/core";
+import type { Octokit } from "@octokit/rest";
+import { PRODUCT_NAME } from "#app/brand";
+import { cloudOidcAudience } from "#app/utils/apiUrl";
+import { log } from "#app/utils/cli";
+import { type OctokitWithPlugins, parseRepoContext } from "#app/utils/github";
+import { isTransientServerError, retry } from "#app/utils/retry";
+import {
+  type AccountPlan,
+  fetchRunContext,
+  type ModuleCredentials,
+  type RepoSettings,
+} from "#app/utils/runContext";
+import packageJson from "#package.json" with { type: "json" };
+
+export interface RunContextData {
+  repo: {
+    owner: string;
+    name: string;
+    data: Awaited<ReturnType<Octokit["repos"]["get"]>>["data"];
+  };
+  repoSettings: RepoSettings;
+  apiToken: string;
+  oss: boolean;
+  plan: AccountPlan;
+  /** The org's mandatory crosswalk-pack control ids (Cloud "required controls"
+   *  policy), org-scoped via the authenticated run-context. Merged into the gate. */
+  requiredControls: string[];
+  /** §5.12 the org's proven-fix library (untrusted blob; coerced engine-side).
+   *  `[]` for OSS / unentitled runs. */
+  provenFixes: unknown[];
+  /** TC-2.2 the org's proven provider-upgrade transforms (untrusted blob;
+   *  coerced engine-side). Counters only — never another repo's configuration.
+   *  `[]` for OSS / unentitled runs. */
+  provenTransforms: unknown[];
+  /** G7 the org's fleet-wide dismissal record (untrusted blob; coerced
+   *  engine-side). Reorders surfacing only — never suppresses. `[]` for OSS /
+   *  unentitled runs. */
+  noiseProfile: unknown[];
+  /** Cloud-managed module credentials for this repo (a read-only module-repo PAT /
+   *  a private-registry token), entered in the dashboard's Refactor dialog. A
+   *  fallback for the matching action inputs; an explicit input still wins.
+   *  undefined when none are stored. */
+  moduleCredentials?: ModuleCredentials;
+}
+
+interface ResolveRunContextDataParams {
+  octokit: OctokitWithPlugins;
+  token: string;
+}
+
+/**
+ * initialize run context data: parse context, fetch repo info and settings
+ */
+export async function resolveRunContextData(
+  params: ResolveRunContextDataParams,
+): Promise<RunContextData> {
+  log.info(`» running ${PRODUCT_NAME} v${packageJson.version}...`);
+
+  const repoContext = parseRepoContext();
+
+  // The org-token reporting path authenticates the run to Cloud with an `api_token`.
+  // run-context is the FIRST Cloud call and happens before payload resolution, so
+  // read the input here and use it as the run-context Bearer — the GitHub job token
+  // is no good to Cloud, so without this the org-token path would 401 on run-context
+  // (and silently lose org policy/settings) even though its end-of-run report works.
+  // The tokenless GitHub App (OIDC) path is the alternative when there is no
+  // api_token. Mask it the moment we read it.
+  const apiToken = core.getInput("api_token") || undefined;
+  if (apiToken) core.setSecret(apiToken);
+
+  let oidcToken: string | undefined;
+  try {
+    oidcToken = await core.getIDToken(cloudOidcAudience());
+  } catch {
+    // OIDC not available (local dev, non-actions environment, fork PRs)
+  }
+
+  const [repoResponse, runContext] = await Promise.all([
+    // This runs at run startup, BEFORE the clean-error surface in main.ts, so a
+    // transient GitHub 5xx here would reject the Promise.all and hard-crash the
+    // run (while its sibling fetchRunContext degrades to defaults). Retry the
+    // transient blip; a deterministic 4xx (e.g. 404 repo) still fails fast. #999.
+    retry(() => params.octokit.repos.get({ owner: repoContext.owner, repo: repoContext.name }), {
+      delaysMs: [100, 500],
+      shouldRetry: isTransientServerError,
+      label: "repos.get",
+    }),
+    // Cloud bearer = api_token when set, else the job token (which only authenticates
+    // via the OIDC header on the App path). octokit keeps the job token for GitHub.
+    fetchRunContext({ token: apiToken ?? params.token, repoContext, oidcToken }),
+  ]);
+
+  // Mask any Cloud-managed module credentials the moment they arrive — they are
+  // real secrets (a PAT / registry token) and must never surface in a log line.
+  if (runContext.moduleCredentials) {
+    for (const v of [
+      runContext.moduleCredentials.moduleFetchToken,
+      runContext.moduleCredentials.registryToken,
+    ]) {
+      if (v) core.setSecret(v);
+    }
+  }
+
+  return {
+    repo: {
+      owner: repoContext.owner,
+      name: repoContext.name,
+      data: repoResponse.data,
+    },
+    repoSettings: runContext.settings,
+    apiToken: runContext.apiToken,
+    oss: runContext.oss,
+    plan: runContext.plan,
+    requiredControls: runContext.requiredControls,
+    provenFixes: runContext.provenFixes,
+    provenTransforms: runContext.provenTransforms,
+    noiseProfile: runContext.noiseProfile,
+    ...(runContext.moduleCredentials ? { moduleCredentials: runContext.moduleCredentials } : {}),
+  };
+}