mergestorm 0.3.49 → 0.3.51

package/README.md

@@ -45,7 +45,7 @@ On a TTY, bare `mergestorm` (or `mergestorm shell`) opens a branded REPL: a comp
 
 ```
 ╭──────────────────────────────────────────────────────────────────────────────╮
-│  ▀▀▀▀▀▀▀▀▀▀▘  mergestorm v0.3.49                                             │
+│  ▀▀▀▀▀▀▀▀▀▀▘  mergestorm v0.3.51                                             │
 │ ▀▀▀▀▀▀▀▀▀     ● msk_live_… · maelstrom                                       │
 │  ▀▀▀▀▀▀       [████████░░░░░░░░░░░░░░░░░░░░░░] 25% used                      │
 │   ▝▀▀▀▀▀      local reviews + stacked PRs · mergestorm.ai                    │
@@ -76,6 +76,8 @@ One-shot subcommands work the same inside the shell and from argv (scripts/CI):
 mergestorm                      Interactive shell (TTY only)
 mergestorm shell                Explicit shell entry
 mergestorm login                Sign in via browser; stores an API key in ~/.mergestorm/config.json
+mergestorm login --start        Print a sign-in URL and code, then exit (agents)
+mergestorm login --finish       Store the API key once the code from --start is approved
 mergestorm login --key          Paste an existing API key instead (headless/CI)
 mergestorm logout               Remove the stored API key
 mergestorm review [base] [head] Review git diff base...head (default: origin/HEAD or main or master)
@@ -148,6 +150,8 @@ Runs a browser device-authorization flow: prints a short code, opens `https://me
 
 For headless or CI environments, use `mergestorm login --key` to paste an existing `msk_live_…` key (create one on the dashboard [Settings → API](https://mergestorm.ai/settings#api)). On a TTY the paste is hidden (not echoed); the CLI verifies the key with the API before saving.
 
+For an agent, which cannot sit in a prompt while a person signs in, use two steps. `mergestorm login --start` prints the URL and the short code and exits. Give both to the account owner, who opens [mergestorm.ai/cli/auth](https://mergestorm.ai/cli/auth) on any device, signs in, and approves the code. Then `mergestorm login --finish` stores the API key. The code lasts 10 minutes, and `--finish` can be run again if it is interrupted before the approval.
+
 ### `logout`
 
 Removes `~/.mergestorm/config.json` so the stored key is no longer used.

package/dist/automation-catalog.d.ts

@@ -9,11 +9,11 @@ export declare const BEARER_SETTINGS: readonly [{
 }, {
     readonly key: "auto_resolve_conflicts_enabled";
     readonly flag: "--auto-resolve-conflicts";
-    readonly label: "Auto-resolve merge conflicts";
+    readonly label: "Auto-resolve merge conflicts (alpha)";
 }, {
     readonly key: "auto_fix_ci_enabled";
     readonly flag: "--auto-fix-ci";
-    readonly label: "Auto-fix failing CI";
+    readonly label: "Auto-fix failing CI (alpha)";
 }, {
     readonly key: "vortex_show_thinking_traces";
     readonly flag: "--vortex-thinking";

package/dist/automation-catalog.js

@@ -1,8 +1,8 @@
 export const BEARER_SETTINGS = [
     { key: "auto_review_enabled", flag: "--auto-review", label: "Auto review" },
     { key: "auto_patch_enabled", flag: "--auto-patch", label: "Auto patch" },
-    { key: "auto_resolve_conflicts_enabled", flag: "--auto-resolve-conflicts", label: "Auto-resolve merge conflicts" },
-    { key: "auto_fix_ci_enabled", flag: "--auto-fix-ci", label: "Auto-fix failing CI" },
+    { key: "auto_resolve_conflicts_enabled", flag: "--auto-resolve-conflicts", label: "Auto-resolve merge conflicts (alpha)" },
+    { key: "auto_fix_ci_enabled", flag: "--auto-fix-ci", label: "Auto-fix failing CI (alpha)" },
     { key: "vortex_show_thinking_traces", flag: "--vortex-thinking", label: "Vortex thinking traces" },
     { key: "repo_overview_enabled", flag: "--repo-overview", label: "Repo overview" },
     { key: "cyclone_skip_ci_enabled", flag: "--cyclone-skip-ci", label: "Skip CI on Cyclone commits" },

package/dist/commands/help.js

@@ -40,7 +40,7 @@ export function buildHelpTabs() {
                 cmd("thread <slug>", "jobs in a review thread"),
                 "",
                 rule("Account"),
-                cmd("login", "browser sign-in (or login --key)"),
+                cmd("login", "sign in (--key; agents: --start)"),
                 cmd("whoami", "key · plan · API"),
                 cmd("settings", "automation toggles · Config tab"),
                 cmd("logout", "forget the stored key"),

package/dist/commands/login.d.ts

@@ -5,4 +5,5 @@ import { type MeResponse } from "../api.js";
  * Throws CommandError when the key must not be saved.
  */
 export declare function validateApiKey(cfg: Config): Promise<MeResponse>;
+export declare function pendingLoginPath(): string;
 export declare function cmdLogin(args: string[]): Promise<void>;

package/dist/commands/login.js

@@ -1,6 +1,8 @@
 import { spawn } from "node:child_process";
 import { platform } from "node:os";
-import { apiBase, configPath, loadConfig, saveConfig } from "../config.js";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { apiBase, configPath, loadConfig, mergestormHome, saveConfig, } from "../config.js";
 import { devicePost, getMe } from "../api.js";
 import { CommandError } from "../errors.js";
 import { ansi } from "../ui/ansi.js";
@@ -52,13 +54,40 @@ async function loginWithKey() {
     const prefix = me.key?.prefix?.trim() || "msk_live_…";
     await present("Login", [`  Verified ${prefix}… · saved to ${configPath()}`]);
 }
-export async function cmdLogin(args) {
-    if (args.includes("--key")) {
-        await loginWithKey();
-        return;
+export function pendingLoginPath() {
+    return path.join(mergestormHome(), "login-pending.json");
+}
+async function savePendingLogin(pending) {
+    await mkdir(mergestormHome(), { recursive: true });
+    await writeFile(pendingLoginPath(), JSON.stringify(pending, null, 2) + "\n", {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+}
+async function loadPendingLogin() {
+    try {
+        const parsed = JSON.parse(await readFile(pendingLoginPath(), "utf8"));
+        if (typeof parsed.deviceCode !== "string" ||
+            typeof parsed.userCode !== "string" ||
+            typeof parsed.openUrl !== "string" ||
+            typeof parsed.apiBase !== "string" ||
+            typeof parsed.pollMs !== "number" ||
+            typeof parsed.expiresAt !== "number") {
+            return null;
+        }
+        return parsed;
     }
-    const cfg = await loadConfig();
-    const base = apiBase(cfg);
+    catch {
+        return null;
+    }
+}
+async function clearPendingLogin(deviceCode) {
+    const pending = await loadPendingLogin();
+    if (pending?.deviceCode !== deviceCode)
+        return;
+    await rm(pendingLoginPath(), { force: true });
+}
+async function startDeviceLogin(base) {
     let start;
     let attempt = 0;
     do {
@@ -87,51 +116,110 @@ export async function cmdLogin(args) {
         throw new CommandError(`Could not start device login (HTTP ${start.status}). The API may be unreachable or misconfigured.\n` +
             `Run \`mergestorm login --key\` to paste an existing API key instead.`);
     }
-    const { device_code, user_code, verification_uri, verification_uri_complete, interval, expires_in, } = start.body;
-    const openUrl = verification_uri_complete || verification_uri;
-    console.log("To sign in, open this URL and confirm the code:\n");
-    console.log(`  ${ansi.brightGreen(openUrl)}`);
-    console.log(`\n  Code: ${ansi.bold(user_code)}\n`);
-    openBrowser(openUrl);
-    console.log("Waiting for approval…");
-    const pollMs = Math.max(interval || 5, 2) * 1000;
-    const deadline = Date.now() + (expires_in || 600) * 1000;
-    while (Date.now() < deadline) {
-        await new Promise((r) => setTimeout(r, pollMs));
+    return start.body;
+}
+function pendingFromStart(base, start) {
+    return {
+        deviceCode: start.device_code,
+        userCode: start.user_code,
+        openUrl: start.verification_uri_complete || start.verification_uri,
+        apiBase: base,
+        pollMs: Math.max(start.interval || 5, 2) * 1000,
+        expiresAt: Date.now() + (start.expires_in || 600) * 1000,
+    };
+}
+async function pollDeviceLogin(pending, retryCommand, recovery) {
+    while (Date.now() < pending.expiresAt) {
         let poll;
         try {
-            poll = await devicePost(base, "/api/v1/cli/device/token", { device_code });
+            poll = await devicePost(pending.apiBase, "/api/v1/cli/device/token", {
+                device_code: pending.deviceCode,
+            });
         }
         catch {
-            throw new CommandError("Login failed: network error. Check your connection and run `mergestorm login` again.");
+            throw new CommandError(`Login failed: network error. Check your connection and run \`${retryCommand}\` again.`);
         }
         if (poll.status === 200 && poll.body?.api_key) {
             const next = await loadConfig();
             next.apiKey = poll.body.api_key;
+            next.apiBase = pending.apiBase;
             await saveConfig(next);
+            await clearPendingLogin(pending.deviceCode);
             await present("Login", [`  Logged in. Key saved to ${configPath()}`]);
             return;
         }
         const err = poll.body?.error;
         if (err === "authorization_pending") {
             process.stdout.write(".");
+            await new Promise((r) => setTimeout(r, pending.pollMs));
             continue;
         }
         if (err === "slow_down" || err === "rate_limited") {
             const backoff = Number(poll.body?.retry_after_seconds);
-            await new Promise((r) => setTimeout(r, Number.isFinite(backoff) && backoff > 0 ? backoff * 1000 : pollMs));
+            await new Promise((r) => setTimeout(r, Number.isFinite(backoff) && backoff > 0 ? backoff * 1000 : pending.pollMs));
             continue;
         }
         if (err === "key_limit_reached") {
             throw new CommandError("You have reached the max active API keys. Revoke one at https://mergestorm.ai/settings#api and try again.");
         }
+        if (err === "expired_token" || err === "already_redeemed" || err === "access_denied") {
+            await clearPendingLogin(pending.deviceCode);
+        }
         if (err === "expired_token") {
-            throw new CommandError("Login code expired. Run `mergestorm login` again.");
+            throw new CommandError(`Login code expired. ${recovery}`);
         }
         if (err === "already_redeemed") {
-            throw new CommandError("This code was already used. Run `mergestorm login` again.");
+            throw new CommandError(`This code was already used. ${recovery}`);
         }
         throw new CommandError(`Login failed: ${typeof err === "string" ? err : JSON.stringify(poll.body)}`);
     }
-    throw new CommandError("Login timed out. Run `mergestorm login` again.");
+    await clearPendingLogin(pending.deviceCode);
+    throw new CommandError(`Login timed out. ${recovery}`);
+}
+async function loginStart() {
+    const cfg = await loadConfig();
+    const base = apiBase(cfg);
+    const pending = pendingFromStart(base, await startDeviceLogin(base));
+    await savePendingLogin(pending);
+    const minutes = Math.max(1, Math.round((pending.expiresAt - Date.now()) / 60_000));
+    console.log("Ask the account owner to open this URL, sign in, and approve the code:\n");
+    console.log(`  ${pending.openUrl}`);
+    console.log(`\n  Code: ${pending.userCode}\n`);
+    console.log(`The code expires in ${minutes} minutes.`);
+    console.log("After they approve, run `mergestorm login --finish` to store the API key.");
+}
+async function loginFinish() {
+    const pending = await loadPendingLogin();
+    if (!pending) {
+        throw new CommandError("No login is waiting. Run `mergestorm login --start` first.");
+    }
+    if (Date.now() >= pending.expiresAt) {
+        await clearPendingLogin(pending.deviceCode);
+        throw new CommandError("Login code expired. Run `mergestorm login --start` again.");
+    }
+    console.log(`Waiting for approval of code ${pending.userCode} at ${pending.openUrl}`);
+    await pollDeviceLogin(pending, "mergestorm login --finish", "Run `mergestorm login --start`, then `mergestorm login --finish`.");
+}
+export async function cmdLogin(args) {
+    if (args.includes("--key")) {
+        await loginWithKey();
+        return;
+    }
+    if (args.includes("--start")) {
+        await loginStart();
+        return;
+    }
+    if (args.includes("--finish")) {
+        await loginFinish();
+        return;
+    }
+    const cfg = await loadConfig();
+    const base = apiBase(cfg);
+    const pending = pendingFromStart(base, await startDeviceLogin(base));
+    console.log("To sign in, open this URL and confirm the code:\n");
+    console.log(`  ${ansi.brightGreen(pending.openUrl)}`);
+    console.log(`\n  Code: ${ansi.bold(pending.userCode)}\n`);
+    openBrowser(pending.openUrl);
+    console.log("Waiting for approval…");
+    await pollDeviceLogin(pending, "mergestorm login", "Run `mergestorm login` again.");
 }

package/dist/commands/registry.js

@@ -25,6 +25,8 @@ export const COMMAND_REGISTRY = [
         summary: "Sign in via browser (or paste a key)",
         usage: [
             "mergestorm login                Sign in via browser and store an API key",
+            "mergestorm login --start        Print a sign-in URL and code, then exit (agents)",
+            "mergestorm login --finish       Store the API key once the code from --start is approved",
             "mergestorm login --key          Paste an existing API key instead (headless/CI)",
         ],
         async run(args, ctx) {

package/dist/stack-blockers.js

@@ -63,11 +63,14 @@ function coreReviewDoneAtHead(layer) {
     return review?.status === "done" && sameHead(review.head_sha, layer.headSha);
 }
 export const VORTEX_FINDINGS_NEED_PERSON = "Vortex findings need a person";
-function vortexChangesRequestedAtHead(layer) {
+function vortexFindingsRestAtHead(layer) {
     const review = layer.vortexReview;
     if (review && !(review.status === "done" && sameHead(review.head_sha, layer.headSha)))
         return false;
-    return layer.vortexStatus === "findings" && layer.reviewStatus === "changes_requested";
+    return layer.vortexStatus === "findings" || layer.vortexStatus === "throttled";
+}
+function vortexChangesRequestedAtHead(layer) {
+    return vortexFindingsRestAtHead(layer) && layer.reviewStatus === "changes_requested";
 }
 function cycloneHandoffAtHead(stack, layer) {
     if (sameHead(layer.cycloneHandoff?.headSha, layer.headSha))
@@ -149,9 +152,24 @@ function ciHandoffNote(stack, layer) {
     }
     return null;
 }
+const CYCLONE_HELD_FINDINGS_REASONS = [
+    "failed",
+    "left_for_human",
+    "infra_failure",
+    "pr_state_unavailable",
+    "vortex_patch_cap",
+    "patch_job_lost",
+];
+function vortexImportantFindingsHeldAtHead(layer) {
+    return vortexFindingsRestAtHead(layer) && layer.reviewStatus === "reviewed" &&
+        sameHead(layer.cycloneHandoff?.headSha, layer.headSha) &&
+        CYCLONE_HELD_FINDINGS_REASONS.includes(layer.cycloneHandoff.reason);
+}
 function vortexFindingsLeftForPerson(stack, layer) {
-    return vortexChangesRequestedAtHead(layer) && !layerAgentsBusy(layer).cyclone &&
-        cycloneHandoffAtHead(stack, layer) !== null;
+    if (layerAgentsBusy(layer).cyclone)
+        return false;
+    return vortexImportantFindingsHeldAtHead(layer) ||
+        (vortexChangesRequestedAtHead(layer) && cycloneHandoffAtHead(stack, layer) !== null);
 }
 function quotaSkippedReview(layer) {
     const review = layer.vortexReview;
@@ -776,7 +794,7 @@ export function stackRepair(stack, attention, layer, bounce, queueWait = null) {
             branch: layer.branch,
             handoff,
             findings,
-            steps: `Vortex requested changes on ${layer.branch} at ${layer.headSha ?? "its live head"} and Cyclone left them for a person${handoff ? ` (${cycloneHandoffWords(handoff)})` : ""}, so nothing will patch them and Auto land waits. Read the newest Vortex review and its inline comments (${findings}), verify each finding against ${layer.branch} at its live remote head, fix the real ones with the smallest patch, run the tests, confirm the remote head is still ${layer.headSha ?? "the head you started from"}, then an ordinary git push (no force). If a finding is wrong, tell the human; mg dismiss ${stack.owner}/${stack.repo}#${layer.prNumber} --head <sha> --review <id> dismisses that review. Do not retarget the PR base.`,
+            steps: `Vortex ${vortexImportantFindingsHeldAtHead(layer) ? "left Important findings" : "requested changes"} on ${layer.branch} at ${layer.headSha ?? "its live head"} and Cyclone left them for a person${handoff ? ` (${cycloneHandoffWords(handoff)})` : ""}, so nothing will patch them and Auto land waits. Read the newest Vortex review and its inline comments (${findings}), verify each finding against ${layer.branch} at its live remote head, fix the real ones with the smallest patch, run the tests, confirm the remote head is still ${layer.headSha ?? "the head you started from"}, then an ordinary git push (no force). If a finding is wrong, tell the human; mg dismiss ${stack.owner}/${stack.repo}#${layer.prNumber} --head <sha> --review <id> dismisses that review. Do not retarget the PR base.`,
         };
     }
     if (reason === "ci_failed" || attention.bounceKind === "ci_failure") {

package/dist/ui/banner.js

@@ -185,6 +185,12 @@ const WHATS_NEW = {
     "0.3.49": [
         "Submit retries a stalled stacks check",
     ],
+    "0.3.50": [
+        "Agent sign-in: login --start, --finish",
+    ],
+    "0.3.51": [
+        "Watch names findings held on a throttled head",
+    ],
 };
 function densityFromVariant(variant) {
     if (variant === "mini" || variant === "nano")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mergestorm",
-  "version": "0.3.49",
+  "version": "0.3.51",
   "description": "Mergestorm CLI (mg) — local reviews & stacked PRs. MIT; build from source: https://github.com/marginsystems/mergestorm-cli",
   "license": "MIT",
   "type": "module",