kanbot 0.0.0-stage → 0.1.0

package/src/github/project.ts

@@ -0,0 +1,278 @@
+import { COLUMN_KEYS, type ColumnKey, type Config } from "../config.ts";
+import type { Gh } from "./gh.ts";
+
+export type Board = {
+	id: string;
+	url: string;
+	statusFieldId: string;
+	/** column key → single-select option id */
+	options: Partial<Record<ColumnKey, string>>;
+	/** option id → column key */
+	columnOf: Map<string, ColumnKey>;
+};
+
+const COLUMN_COLORS: Record<ColumnKey, string> = {
+	ideas: "GRAY",
+	planning: "PURPLE",
+	ready: "BLUE",
+	inProgress: "YELLOW",
+	review: "ORANGE",
+	done: "GREEN",
+};
+
+const COLUMN_DESCRIPTIONS: Record<ColumnKey, string> = {
+	ideas: "Raw ideas and notes. Agents leave these alone.",
+	planning:
+		"Agent writes and refines the plan; comment to steer. Drag to Ready to approve.",
+	ready: "Approved. Picked from the top when a worker is free.",
+	inProgress: "An agent is implementing this.",
+	review: "PRs open. Agent review passes, then human testing and merge.",
+	done: "Merged and closed.",
+};
+
+const PROJECT_FIELDS = `
+	id url
+	field(name: "Status") {
+		... on ProjectV2SingleSelectField { id options { id name } }
+	}`;
+
+type RawProject = {
+	id: string;
+	url: string;
+	field: { id: string; options: { id: string; name: string }[] } | null;
+};
+
+function toBoard(p: RawProject, config: Config): Board {
+	if (!p.field) throw new Error("Project has no single-select Status field");
+	const options: Board["options"] = {};
+	const columnOf = new Map<string, ColumnKey>();
+	for (const key of COLUMN_KEYS) {
+		const opt = p.field.options.find(
+			(o) => o.name.toLowerCase() === config.columns[key].toLowerCase(),
+		);
+		if (opt) {
+			options[key] = opt.id;
+			columnOf.set(opt.id, key);
+		}
+	}
+	return { id: p.id, url: p.url, statusFieldId: p.field.id, options, columnOf };
+}
+
+export async function loadBoard(gh: Gh, config: Config): Promise<Board> {
+	if (!config.project) {
+		throw new Error("No project configured. Run `kanbot board create`.");
+	}
+	const data = await gh.query<{
+		repositoryOwner: { projectV2: RawProject | null } | null;
+	}>(
+		`query($login: String!, $number: Int!) {
+			repositoryOwner(login: $login) {
+				... on ProjectV2Owner { projectV2(number: $number) { ${PROJECT_FIELDS} } }
+			}
+		}`,
+		{ login: config.project.owner, number: config.project.number },
+	);
+	const p = data.repositoryOwner?.projectV2;
+	if (!p) {
+		throw new Error(
+			`Project ${config.project.owner}#${config.project.number} not found (does gh have the "project" scope? run: gh auth refresh -s project)`,
+		);
+	}
+	return toBoard(p, config);
+}
+
+export function missingColumns(board: Board): ColumnKey[] {
+	return COLUMN_KEYS.filter((k) => !board.options[k]);
+}
+
+/** Create a project linked to the repo with the kanbot columns. */
+export async function createBoard(gh: Gh, config: Config, title: string) {
+	const repo = await gh.query<{
+		repository: { id: string; owner: { id: string; login: string } };
+	}>(
+		`query($owner: String!, $name: String!) {
+			repository(owner: $owner, name: $name) { id owner { id login } }
+		}`,
+		{ owner: gh.owner, name: gh.name },
+	);
+	const created = await gh.mutate<{
+		createProjectV2: {
+			projectV2: RawProject & {
+				number: number;
+				views: { nodes: { id: string }[] };
+			};
+		};
+	}>(
+		`create project "${title}"`,
+		`mutation($ownerId: ID!, $repositoryId: ID!, $title: String!) {
+			createProjectV2(input: { ownerId: $ownerId, repositoryId: $repositoryId, title: $title }) {
+				projectV2 { number views(first: 1) { nodes { id } } ${PROJECT_FIELDS} }
+			}
+		}`,
+		{
+			ownerId: repo.repository.owner.id,
+			repositoryId: repo.repository.id,
+			title,
+		},
+	);
+	if (!created) return null;
+	const project = created.createProjectV2.projectV2;
+	if (!project.field) throw new Error("New project has no Status field");
+	await gh.mutate(
+		"configure Status columns",
+		`mutation($fieldId: ID!, $options: [ProjectV2SingleSelectFieldOptionInput!]!) {
+			updateProjectV2Field(input: { fieldId: $fieldId, singleSelectOptions: $options }) {
+				projectV2Field { ... on ProjectV2SingleSelectField { id } }
+			}
+		}`,
+		{
+			fieldId: project.field.id,
+			options: COLUMN_KEYS.map((k) => ({
+				name: config.columns[k],
+				color: COLUMN_COLORS[k],
+				description: COLUMN_DESCRIPTIONS[k],
+			})),
+		},
+	);
+	// New projects open as a table; make the default view a board (grouped by Status).
+	const view = project.views.nodes[0];
+	if (view) {
+		await gh.mutate(
+			"make default view a board",
+			`mutation($v: ID!) {
+				updateProjectV2View(input: { viewId: $v, name: "Board", layout: BOARD_LAYOUT }) {
+					projectV2View { id }
+				}
+			}`,
+			{ v: view.id },
+		);
+	}
+	return {
+		owner: repo.repository.owner.login,
+		number: project.number,
+		url: project.url,
+	};
+}
+
+export type RawItem = {
+	id: string;
+	status: { optionId: string } | null;
+	content: {
+		__typename: string;
+		number?: number;
+		state?: string;
+		repository?: { nameWithOwner: string };
+	} | null;
+};
+
+/** All board items for this repo's issues, in board order. */
+export async function listItems(gh: Gh, board: Board) {
+	const items: {
+		itemId: string;
+		column: ColumnKey | null;
+		number: number;
+		state: string;
+	}[] = [];
+	let after: string | null = null;
+	do {
+		const data: {
+			node: {
+				items: {
+					nodes: RawItem[];
+					pageInfo: { hasNextPage: boolean; endCursor: string };
+				};
+			};
+		} = await gh.query(
+			`query($id: ID!, $after: String) {
+				node(id: $id) {
+					... on ProjectV2 {
+						items(first: 100, after: $after) {
+							nodes {
+								id
+								status: fieldValueByName(name: "Status") {
+									... on ProjectV2ItemFieldSingleSelectValue { optionId }
+								}
+								content {
+									__typename
+									... on Issue { number state repository { nameWithOwner } }
+								}
+							}
+							pageInfo { hasNextPage endCursor }
+						}
+					}
+				}
+			}`,
+			{ id: board.id, after },
+		);
+		for (const n of data.node.items.nodes) {
+			if (n.content?.__typename !== "Issue") continue;
+			if (
+				n.content.repository?.nameWithOwner.toLowerCase() !==
+				gh.repo.toLowerCase()
+			)
+				continue;
+			items.push({
+				itemId: n.id,
+				column: n.status
+					? (board.columnOf.get(n.status.optionId) ?? null)
+					: null,
+				number: n.content.number as number,
+				state: n.content.state as string,
+			});
+		}
+		after = data.node.items.pageInfo.hasNextPage
+			? data.node.items.pageInfo.endCursor
+			: null;
+	} while (after);
+	return items;
+}
+
+export async function moveItem(
+	gh: Gh,
+	board: Board,
+	itemId: string,
+	column: ColumnKey,
+) {
+	const optionId = board.options[column];
+	if (!optionId) throw new Error(`Board has no "${column}" column`);
+	await gh.mutate(
+		`move item ${itemId} → ${column}`,
+		`mutation($p: ID!, $i: ID!, $f: ID!, $o: String!) {
+			updateProjectV2ItemFieldValue(input: { projectId: $p, itemId: $i, fieldId: $f, value: { singleSelectOptionId: $o } }) {
+				projectV2Item { id }
+			}
+		}`,
+		{ p: board.id, i: itemId, f: board.statusFieldId, o: optionId },
+	);
+}
+
+export async function addToBoard(
+	gh: Gh,
+	board: Board,
+	contentId: string,
+	column: ColumnKey,
+) {
+	const res = await gh.mutate<{
+		addProjectV2ItemById: { item: { id: string } };
+	}>(
+		`add ${contentId} to board`,
+		`mutation($p: ID!, $c: ID!) {
+			addProjectV2ItemById(input: { projectId: $p, contentId: $c }) { item { id } }
+		}`,
+		{ p: board.id, c: contentId },
+	);
+	if (res) await moveItem(gh, board, res.addProjectV2ItemById.item.id, column);
+}
+
+/** Built-in board workflows; they can be read but not enabled via the API. */
+export async function boardWorkflows(gh: Gh, board: Board) {
+	const data = await gh.query<{
+		node: { workflows: { nodes: { name: string; enabled: boolean }[] } };
+	}>(
+		`query($id: ID!) {
+			node(id: $id) { ... on ProjectV2 { workflows(first: 50) { nodes { name enabled } } } }
+		}`,
+		{ id: board.id },
+	);
+	return data.node.workflows.nodes;
+}

package/src/github/trust.ts

@@ -0,0 +1,38 @@
+import type { Gh } from "./gh.ts";
+
+const WRITE = new Set(["admin", "maintain", "write"]);
+const TTL_MS = 60 * 60 * 1000;
+
+/**
+ * Only comments from collaborators with write access may steer agents. This is
+ * the main prompt-injection guard on public repos.
+ */
+export class Trust {
+	private cache = new Map<string, { ok: boolean; at: number }>();
+
+	constructor(private gh: Gh) {}
+
+	async isTrusted(login: string): Promise<boolean> {
+		const hit = this.cache.get(login);
+		if (hit && Date.now() - hit.at < TTL_MS) return hit.ok;
+		let ok = false;
+		try {
+			const res = await this.gh.rest<{ permission: string }>(
+				this.gh.r(`/collaborators/${encodeURIComponent(login)}/permission`),
+			);
+			ok = WRITE.has(res.permission);
+		} catch {
+			ok = false;
+		}
+		this.cache.set(login, { ok, at: Date.now() });
+		return ok;
+	}
+
+	async resolve(logins: Iterable<string>): Promise<Set<string>> {
+		const unique = [...new Set(logins)];
+		const results = await Promise.all(
+			unique.map(async (l) => [l, await this.isTrusted(l)] as const),
+		);
+		return new Set(results.filter(([, ok]) => ok).map(([l]) => l));
+	}
+}

package/src/jobs/prompts.ts

@@ -0,0 +1,205 @@
+import {
+	type FixJob,
+	type ImplementJob,
+	type PlanJob,
+	type ReviewJob,
+	reviewPasses,
+} from "../daemon/derive.ts";
+import type { Comment, Issue, PR } from "../daemon/types.ts";
+import { extractPlan, isKanbot, stripPlan } from "../github/markers.ts";
+import type { Finding } from "../schemas/results.ts";
+
+/*
+ * Job prompts carry the *task*; the agent's own instructions (from
+ * .kanbot/agents) carry the *how*. Keep these factual and structured.
+ */
+
+const RULES = `## Ground rules
+- You are running headless inside a git worktree. Nobody will answer questions mid-run.
+- Never use \`gh\`, never \`git push\`, never contact GitHub. kanbot applies your output.
+- Your final answer must be the structured JSON result. Put everything the human should see in it.
+- Write short and plain: only what the reader needs to act or understand. Don't restate the input or narrate your process.`;
+
+function quote(text: string) {
+	return text.trim() ? text.trim() : "_(empty)_";
+}
+
+function conversation(comments: Comment[], limit = 30) {
+	const recent = comments.slice(-limit);
+	if (!recent.length) return "_(no comments)_";
+	return recent
+		.map(
+			(c) =>
+				`**${isKanbot(c.body) ? "kanbot (agent)" : `@${c.author}`}** — ${c.createdAt}\n${stripMarkers(c.body)}`,
+		)
+		.join("\n\n---\n\n");
+}
+
+function stripMarkers(body: string) {
+	return body.replace(/<!--\s*kanbot[^>]*-->/g, "").trim();
+}
+
+/**
+ * Earlier human feedback on the PR, resolved or not. Without it, review and fix
+ * agents see only the plan and "correct" decisions the human made on the PR.
+ */
+function humanDecisions(pr: PR) {
+	const threads = pr.threads.filter((t) =>
+		t.comments.some((c) => !isKanbot(c.body)),
+	);
+	const comments = [...pr.comments, ...pr.reviews].filter(
+		(c) => !isKanbot(c.body),
+	);
+	if (!threads.length && !comments.length) return null;
+	const parts = [
+		"## Human decisions on this PR\nFeedback the human already gave on this PR. It outranks the plan and acceptance criteria where they conflict; do not undo or flag these changes.",
+		...threads.map(
+			(t) =>
+				`### Review thread on ${t.path ?? "?"}${t.line ? `:${t.line}` : ""}${t.isResolved ? " (resolved)" : ""}\n${conversation(t.comments, 10)}`,
+		),
+	];
+	if (comments.length)
+		parts.push(`### PR comments\n${conversation(comments, 10)}`);
+	return parts.join("\n\n");
+}
+
+function issueHeader(issue: Issue) {
+	if (issue.prOnly)
+		return `# Pull request #${issue.number}: ${issue.title}
+No issue or plan: the human opened this PR and asked for review. Its description is the spec.
+URL: ${issue.url}`;
+	return `# Issue #${issue.number}: ${issue.title}
+Labels: ${issue.labels.join(", ") || "none"}
+URL: ${issue.url}`;
+}
+
+export function planPrompt(job: PlanJob, explore: number | null) {
+	const { issue } = job.item;
+	const plan = extractPlan(issue.body);
+	const parts = [
+		issueHeader(issue),
+		`## Original description (written by the human)\n${quote(stripPlan(issue.body))}`,
+		plan
+			? `## Current plan\n${plan}`
+			: "## Current plan\n_None yet. Write the first version._",
+		`## Conversation so far\n${conversation(issue.comments)}`,
+	];
+	if (job.comments.length) {
+		parts.push(
+			`## New human comments to address\nReply to each one by its id in \`replies\`, and update the plan to reflect them. If a comment asks to split work or start a new issue, use \`newIssues\`.\n\n${job.comments
+				.map((c) => `### commentId: ${c.id} (@${c.author})\n${c.body.trim()}`)
+				.join("\n\n")}`,
+		);
+	}
+	if (explore) {
+		parts.push(
+			`## Exploratory issue\nLabel explore:${explore}. The plan MUST have an "## Approaches" section with exactly ${explore} genuinely different approaches (### Approach 1: <name> … ### Approach ${explore}: <name>). Each will be implemented as a separate PR by a separate agent.`,
+		);
+	}
+	if (issue.labels.includes("technical")) {
+		parts.push(
+			"## Technical issue\nLabeled `technical`: write a technical goal instead of a user story.",
+		);
+	}
+	parts.push(RULES);
+	return parts.join("\n\n");
+}
+
+export function implementPrompt(job: ImplementJob, base: string) {
+	const { issue } = job.item;
+	const parts = [
+		issueHeader(issue),
+		`## Approved plan\n${extractPlan(issue.body) ?? stripPlan(issue.body)}`,
+	];
+	if (job.variant !== null) {
+		parts.push(
+			`## Your variant: Approach ${job.variant} of ${job.variants}\nImplement ONLY "Approach ${job.variant}" from the plan. Other agents implement the other approaches in parallel; do not hedge toward them. The human will compare the PRs and merge one.`,
+		);
+	}
+	const humanNotes = issue.comments.filter((c) => !isKanbot(c.body)).slice(-10);
+	if (humanNotes.length)
+		parts.push(
+			`## Recent human comments on the issue\n${conversation(humanNotes)}`,
+		);
+	parts.push(
+		`## Workspace\n- Branch \`${job.branch}\`, created from \`origin/${base}\`.\n- Commit your work with conventional commit messages. Uncommitted changes are committed for you, but prefer small commits.\n- Run the project's tests and linters before finishing and report them in \`testsRun\`.`,
+		RULES,
+	);
+	return parts.join("\n\n");
+}
+
+export function reviewPrompt(job: ReviewJob, base: string) {
+	const { issue } = job.item;
+	const { pr } = job;
+	return [
+		issueHeader(issue),
+		`## Plan / acceptance criteria\n${extractPlan(issue.body) ?? stripPlan(issue.body)}`,
+		`## Pull request #${pr.number}: ${pr.title}\nBranch \`${pr.headRefName}\` (checked out). Diff with: \`git diff origin/${base}...HEAD\`. CI status: ${pr.checks ?? "none"}.\n\n### PR description\n${quote(stripMarkers(pr.body))}`,
+		humanDecisions(pr),
+		`## Review pass ${job.pass} of ${reviewPasses(issue).length}\nYou only review. Do not edit files or commit.`,
+		RULES,
+	]
+		.filter(Boolean)
+		.join("\n\n");
+}
+
+/** `details`: CI logs for a CI fix, the conflicted files for a conflict fix. */
+export function fixPrompt(job: FixJob, base: string, details: string | null) {
+	const { issue } = job.item;
+	const { pr } = job;
+	const parts = [
+		issueHeader(issue),
+		`## Plan / acceptance criteria\n${extractPlan(issue.body) ?? stripPlan(issue.body)}`,
+		`## Pull request #${pr.number}: ${pr.title}\nBranch \`${pr.headRefName}\` (checked out). Diff with: \`git diff origin/${base}...HEAD\`.\n\n### Current PR description\n${quote(stripMarkers(pr.body))}`,
+	];
+	const r = job.reason;
+	const decisions = r.type === "feedback" ? null : humanDecisions(pr);
+	if (decisions) parts.push(decisions);
+	if (r.type === "review") {
+		parts.push(
+			`## Agent review pass ${r.pass} findings\nAddress each finding (use its id as \`ref\`). Nits are optional. If you disagree with a finding, leave the code and explain in \`reply\` with \`resolved: false\`.\n\n${findingsList(r.findings)}`,
+		);
+	} else if (r.type === "feedback") {
+		parts.push(
+			"## Human feedback\nThis is feedback from the human reviewer. It outranks the plan when they conflict. Answer every item below using its id as `ref`. Set `resolved: true` only when the change fully addresses it.",
+		);
+		for (const t of r.threads) {
+			parts.push(
+				`### ref: ${t.id} (review thread on ${t.path ?? "?"}${t.line ? `:${t.line}` : ""})\n${conversation(t.comments, 10)}`,
+			);
+		}
+		for (const c of r.comments) {
+			parts.push(
+				`### ref: ${c.id} (comment by @${c.author})\n${c.body.trim()}`,
+			);
+		}
+	} else if (r.type === "copilot") {
+		parts.push(
+			"## GitHub Copilot review\nAutomated review comments from GitHub Copilot. Treat them like agent findings: fix real problems, and decline with a reason where Copilot is wrong. They do not outrank the plan or the human's decisions. Answer every thread below using its id as `ref`.",
+		);
+		for (const t of r.threads) {
+			parts.push(
+				`### ref: ${t.id} (Copilot on ${t.path ?? "?"}${t.line ? `:${t.line}` : ""})\n${conversation(t.comments, 10)}`,
+			);
+		}
+	} else if (r.type === "conflict") {
+		parts.push(
+			`## Merge conflicts\n\`origin/${base}\` has moved and conflicts with this branch. A merge of it is in progress in the worktree. Resolve every conflict, keeping the intent of both sides; the PR's plan and the base branch's changes both stand. Then run tests, lint and typecheck. Stage your resolution; committing the merge is optional. Do not abort the merge or rebase. Use \`ref: "conflict"\` in \`addressed\`.\n\nConflicted files:\n${details}`,
+		);
+	} else {
+		parts.push(
+			`## CI is failing\nMake CI pass without weakening tests. Use \`ref: "ci"\` in \`addressed\`.\n\n${details || "_No logs available; reproduce locally with the project's test/lint commands._"}`,
+		);
+	}
+	parts.push(RULES);
+	return parts.join("\n\n");
+}
+
+export function findingsList(findings: Finding[]) {
+	return findings
+		.map(
+			(f) =>
+				`- **${f.id}** \`${f.severity}\`${f.path ? ` ${f.path}${f.line ? `:${f.line}` : ""}` : ""} — ${f.body}`,
+		)
+		.join("\n");
+}