omp-conductor 0.13.0 → 0.15.0

package/src/verbs/server.ts

@@ -43,7 +43,7 @@ import { createServer, type Server, type Socket } from "node:net";
 
 import { resolvePolicy, resolveReleaseGrants } from "../config.ts";
 import { chainEntriesFromDiff, chainViolations } from "../chain-check.ts";
-import type { readBaseChain as readBaseChainType } from "../gitops.ts";
+import { repoSlugFor, type readBaseChain as readBaseChainType } from "../gitops.ts";
 import { releaseRefusal } from "../release-policy.ts";
 import { LIVE_STATES } from "../store.ts";
 import type {
@@ -61,6 +61,7 @@ import type {
   VerbName,
   VerbRefusal,
 } from "../types.ts";
+import { prUrlParts } from "../tracker/github.ts";
 import { parseVerbRequest, roleRefusal, VERB_SPECS, type VerbReply } from "./protocol.ts";
 import {
   peerVerdict,
@@ -265,9 +266,9 @@ export interface ReleaseFacts {
   openPrs: number;
   /** Queue depth, or `undefined` when the tracker could not be read. */
   queueDepth: number | undefined;
-  /** Newest observed verdict for the released routed repository. */
+  /** Current live-head workflow verdict for the released routed repository. */
   baseCheck?: RunRecord["baseCheck"];
-  /** Evidence attached to a newest red verdict. */
+  /** Evidence attached to a current red verdict. */
   redBase?: string;
 }
 
@@ -637,6 +638,20 @@ function runForPr(deps: VerbDeps, project: string, prUrl: string): RunRecord | u
     .find((candidate) => candidate.prUrl === prUrl);
 }
 
+/**
+ * Whether a PR URL names a repository this project routes.
+ *
+ * Orchestrator status / update-branch may act on open project PRs that no run
+ * opened (workflow-generated release pins, etc.). Scope is the routed clone
+ * slugs — not "any PR a run once recorded".
+ */
+function prInProjectRouting(project: ProjectConfig, prUrl: string): boolean {
+  const parts = prUrlParts(prUrl);
+  if (parts === undefined) return false;
+  const slug = `${parts.owner}/${parts.repo}`;
+  return Object.values(project.routing.repos).some((repo) => repoSlugFor(repo) === slug);
+}
+
 /** Refuse an orchestrator completion mutation that cannot prove a pre-pause run. */
 function orchestratorPauseRefusal(
   deps: VerbDeps,
@@ -688,8 +703,12 @@ async function prUpdateBranchVerb(
     target = own;
   } else {
     target = runForPr(deps, project.name, prUrl);
-    if (target === undefined) {
-      return refuse("pr-not-this-run", `refused: ${prUrl} is not a pull request any run in ${project.name} opened.`);
+    if (target === undefined && !prInProjectRouting(project, prUrl)) {
+      return refuse(
+        "pr-not-this-run",
+        `refused: ${prUrl} is not a pull request in ${project.name}'s routed repositories ` +
+          `(${Object.values(project.routing.repos).map(repoSlugFor).join(", ") || "none"}).`,
+      );
     }
   }
 
@@ -709,15 +728,15 @@ async function prUpdateBranchVerb(
       state === undefined
         ? `refused: the tracker could not say whether ${prUrl} is open. Refusing rather than acting on an unknown state.`
         : `refused: ${prUrl} is ${state}, not open.`,
-      target.issue,
+      target?.issue,
     );
   }
 
   const outcome = await deps.actions.updatePrBranch(prUrl);
   if (!outcome.ok) {
-    return refuse("action-failed", `refused: gh could not update the branch:\n${outcome.stderr}`, target.issue);
+    return refuse("action-failed", `refused: gh could not update the branch:\n${outcome.stderr}`, target?.issue);
   }
-  return allow(`updated ${prUrl} with its base branch. Re-check its checks before merging.`, outcome.sha, target.issue);
+  return allow(`updated ${prUrl} with its base branch. Re-check its checks before merging.`, outcome.sha, target?.issue);
 }
 
 async function prMergeVerb(
@@ -978,18 +997,17 @@ async function releaseVerb(
     }
   }
   const wantsBase = policy.release.requires.includes("base-branch-green");
-  const latestBase = wantsBase
-    ? deps.store.latestBaseChecks(project.name, 0).find((run) => run.repo === repoName)
+  const health = wantsBase
+    ? deps.store.baseHealth(project.name).find((row) => row.repo === repoName)
     : undefined;
-  const redBase = latestBase?.settlementFlags?.find(
-    (flag) => flag.kind === "base-branch-red",
-  )?.detail;
   const unmet = releaseRequirementRefusal(policy.release.requires, {
     unsettledRuns: active.length,
     openPrs: active.filter((r) => r.prUrl !== undefined).length,
     queueDepth,
-    ...(latestBase?.baseCheck === undefined ? {} : { baseCheck: latestBase.baseCheck }),
-    ...(redBase === undefined ? {} : { redBase }),
+    ...(health === undefined ? {} : { baseCheck: health.verdict }),
+    ...(health?.verdict === "red" && health.detail !== undefined
+      ? { redBase: health.detail }
+      : {}),
   });
   if (unmet !== undefined) return refuse("release-not-granted", `refused: ${unmet}`);
 
@@ -1062,11 +1080,15 @@ async function prStatusVerb(
       return refuse("malformed-argument", "refused: conductor_pr_status needs prUrl when it has no run to infer one from.");
     }
     const target = runForPr(deps, project.name, asked);
-    if (target === undefined) {
-      return refuse("pr-not-this-run", `refused: ${asked} is not a pull request any run in ${project.name} opened.`);
+    if (target === undefined && !prInProjectRouting(project, asked)) {
+      return refuse(
+        "pr-not-this-run",
+        `refused: ${asked} is not a pull request in ${project.name}'s routed repositories ` +
+          `(${Object.values(project.routing.repos).map(repoSlugFor).join(", ") || "none"}).`,
+      );
     }
     prUrl = asked;
-    issue = target.issue;
+    issue = target?.issue;
   }
 
   const askedHead = args["headSha"];

package/src/wizard-ui.ts

@@ -0,0 +1,249 @@
+/**
+ * The presentation surface the setup wizard ({@link setup-wizard.ts}) codes
+ * against. Nothing about it is terminal-specific: any driver that satisfies this
+ * exact shape can drive the wizard, and today that driver is the terminal
+ * `omp-conductor setup` verb (#309 deleted the in-session dialog).
+ *
+ * Three of the four methods are prompt-bearing. The load-bearing contracts,
+ * each of which the wizard already relies on and a future refactor would break
+ * silently:
+ *
+ *   - `input` resolves the placeholder on an empty submit ("Enter accepts what
+ *     you see"), so a re-run that Enters through a prompt re-affirms the shown
+ *     default instead of blanking it.
+ *   - `select` resolves the chosen option's **label**, never its index — the
+ *     label *is* the config value for the closed-vocabulary questions, so a
+ *     lookup table that disagreed with the vocabulary it was built from would
+ *     corrupt the written config.
+ *   - `select` honours `dialogOptions.initialIndex` so a bare Enter re-affirms
+ *     the current setting (see the "cannot be a confirm" note in the wizard).
+ *   - `confirm` is `y/N`, defaulting to no.
+ *
+ * Every prompt resolves `undefined` when the operator dismisses it (Ctrl-C /
+ * EOF), which every wizard caller already treats as the cancel path
+ * (`Cancelled`). The terminal UI guarantees the readline interface is closed on
+ * every exit path so the verb cannot hang the terminal.
+ */
+export interface WizardUi {
+  notify(message: string, type?: "info" | "warning" | "error"): void;
+  /**
+   * Yes/no. `undefined` means the operator *dismissed* the prompt rather than
+   * answering it, which is a different thing from "no": the wizard turns it into
+   * `Cancelled` and abandons the run. Collapsing the two is how Ctrl-C at a
+   * confirm used to record a silent "no" and carry on to the next question.
+   */
+  confirm(title: string, message: string): Promise<boolean | undefined>;
+  /** Single-line text prompt. `undefined` dismisses it; an empty submit accepts
+   *  the placeholder. */
+  input(title: string, placeholder?: string): Promise<string | undefined>;
+  /** Numbered single-choice list. Resolves the chosen option's label, or
+   *  `undefined` when dismissed. */
+  select(
+    title: string,
+    options: { label: string; description?: string }[],
+    dialogOptions?: { initialIndex?: number },
+  ): Promise<string | undefined>;
+}
+
+import { createInterface, type Interface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import type { Readable, Writable } from "node:stream";
+
+/**
+ * A `WizardUi` over a real terminal — or a pipe, which is how the verb is
+ * scripted in tests — backed by `node:readline/promises`.
+ *
+ * **One interface for the whole wizard, closed once.** The first version of this
+ * created and closed a readline interface per prompt, on the theory that
+ * releasing stdin after each question could not leak. It cannot: closing a
+ * readline interface ends the shared stdin stream, so the *second* prompt of a
+ * piped run had no readable input left and the run hung indefinitely — the exact
+ * failure this comment used to claim it prevented. The interface therefore lives
+ * as long as the wizard, and {@link TerminalUi.close} releases it once, from the
+ * caller's `finally`.
+ *
+ * Dismissal is the interface's own `close`: `rl.question()` on an exhausted
+ * stream never settles on its own, so EOF (a script that ran out of answers) and
+ * Ctrl-C both close the interface, and the line reader turns that into the
+ * `undefined` every wizard caller reads as cancel.
+ *
+ * `io` exists so the contracts below can be tested in-process against a pipe
+ * rather than only through a spawned CLI; production callers pass nothing.
+ */
+export interface TerminalUi extends WizardUi {
+  /** Releases stdin. Idempotent; call it from a `finally`. */
+  close(): void;
+}
+
+export function terminalUi(io: { input?: Readable; output?: Writable } = {}): TerminalUi {
+  const input = io.input ?? stdin;
+  const output = io.output ?? stdout;
+  const rl: Interface = createInterface({ input, output });
+  let closed = false;
+  const close = (): void => {
+    if (closed) return;
+    closed = true;
+    rl.close();
+  };
+  // Ctrl-C is a cancel, not a signal to the whole process: closing the interface
+  // makes every pending and subsequent prompt resolve `undefined`, which the
+  // wizard already turns into `Cancelled`.
+  rl.once("SIGINT", close);
+
+  // Lines are buffered as they arrive rather than read on demand, because on a
+  // non-TTY stdin readline drains the whole pipe at once and emits `line` for
+  // every one of them immediately. `rl.question()` only captures the line that
+  // arrives *after* it is called, so a scripted run lost every answer that had
+  // already flown past and then hit EOF — three prompts resolving `undefined`
+  // and a wizard that cancelled itself. Buffering makes a pipe and a terminal
+  // behave the same: nothing is read before it is asked for, nothing is lost.
+  const buffered: string[] = [];
+  let waiting: ((value: string | undefined) => void) | undefined;
+  let ended = false;
+  const deliver = (value: string | undefined): boolean => {
+    const resolve = waiting;
+    if (resolve === undefined) return false;
+    waiting = undefined;
+    resolve(value);
+    return true;
+  };
+  rl.on("line", (text: string) => {
+    if (!deliver(text)) buffered.push(text);
+  });
+  rl.once("close", () => {
+    ended = true;
+    deliver(undefined);
+  });
+
+  /** One line, or `undefined` when the operator dismissed the prompt. */
+  const line = async (query: string): Promise<string | undefined> => {
+    if (closed && buffered.length === 0) return undefined;
+    output.write(query);
+    const ready = buffered.shift();
+    if (ready !== undefined) return ready;
+    if (ended) return undefined;
+    return await new Promise<string | undefined>((resolve) => {
+      waiting = resolve;
+    });
+  };
+
+  return {
+    close,
+    notify(message) {
+      output.write(`${message}\n`);
+    },
+    async confirm(title, message) {
+      for (;;) {
+        const answer = await line(`${title} — ${message} (y/N) `);
+        // Dismissal is NOT "no". Ctrl-C or EOF here means the operator left, and
+        // reporting `false` made the interview march on to the next question with
+        // a silent "no" recorded — so `Ctrl-C abandons the run` was untrue for
+        // every yes/no prompt. The wizard turns this into `Cancelled`.
+        if (answer === undefined) return undefined;
+        const a = answer.trim().toLowerCase();
+        if (a === "y" || a === "yes") return true;
+        // Enter is still the safe answer: no, and the interview continues.
+        if (a === "n" || a === "no" || a === "") return false;
+        output.write("Please answer y or n.\n");
+      }
+    },
+    async input(title, placeholder) {
+      const query =
+        placeholder !== undefined && placeholder.length > 0 ? `${title} [${placeholder}]: ` : `${title}: `;
+      const answer = await line(query);
+      if (answer === undefined) return undefined;
+      // "Enter accepts what you see": an empty submit keeps the placeholder.
+      return answer.trim().length === 0 ? (placeholder ?? "") : answer;
+    },
+    async select(title, options, dialogOptions) {
+      output.write(`${title}\n`);
+      options.forEach((o, i) => {
+        output.write(`  ${i + 1}. ${o.label}${o.description !== undefined ? ` — ${o.description}` : ""}\n`);
+      });
+      const initial = dialogOptions?.initialIndex ?? 0;
+      const defaultLabel = options[initial]?.label ?? "";
+      for (;;) {
+        const answer = await line(
+          `Select 1-${options.length} [${initial + 1} = ${defaultLabel}] (Enter keeps it, Ctrl-C cancels): `,
+        );
+        if (answer === undefined) return undefined;
+        const a = answer.trim();
+        if (a === "") return defaultLabel; // a bare Enter re-affirms the current row
+        const n = Number(a);
+        if (Number.isInteger(n)) {
+          const picked = options[n - 1];
+          if (picked !== undefined) return picked.label;
+        }
+        output.write(`Please enter a number between 1 and ${options.length}.\n`);
+      }
+    },
+  };
+}
+
+/**
+ * The test seam: a `WizardUi` driven by a script keyed by a substring of each
+ * prompt's title.
+ *
+ * **Anything unscripted takes the answer an operator gets by pressing Enter** —
+ * an empty `input` (which the wizard reads as "accept the shown default"), `no`
+ * on a `confirm`, and the row the caller put the cursor on for a `select`. That
+ * leniency is deliberate and is itself the thing under test: "Enter accepts what
+ * you see" is the contract the whole wizard is built on, so a test that has to
+ * script an answer is a test whose default moved. Throwing on an unscripted
+ * prompt would make that property untestable.
+ *
+ * Asking an *unintended* question is caught a stronger way instead: the suite
+ * pins the full ordered list of prompts, so a question that appears or vanishes
+ * fails on the transcript rather than on a missing script entry.
+ *
+ *   - `input`: the scripted string, else `""` (Enter → the wizard's fallback).
+ *   - `confirm`: the scripted boolean, else `false`. `null` dismisses the prompt
+ *     (`undefined`), which the wizard reads as cancel — the same spelling
+ *     `select` uses.
+ *   - `select`: a number picks that option's **label**; a string matches an
+ *     offered label by prefix; `null` dismisses the prompt (`undefined`, which
+ *     the wizard reads as cancel); unscripted takes `initialIndex`'s label.
+ *   - An array answers successive prompts sharing the same title; the last entry
+ *     repeats.
+ */
+export interface ScriptedAnswers {
+  input?: Record<string, string>;
+  confirm?: Record<string, boolean | boolean[] | null>;
+  select?: Record<string, string | number | null>;
+}
+
+export function scriptedUi(script: ScriptedAnswers = {}): WizardUi {
+  const seen = new Map<string, number>();
+  const answer = <T>(table: Record<string, T> | undefined, title: string): T | undefined => {
+    for (const [key, value] of Object.entries(table ?? {})) {
+      if (!title.includes(key)) continue;
+      if (!Array.isArray(value)) return value;
+      const n = seen.get(key) ?? 0;
+      seen.set(key, n + 1);
+      return (value[Math.min(n, value.length - 1)] ?? value.at(-1)) as T;
+    }
+    return undefined;
+  };
+
+  return {
+    notify() {
+      /* recorded by the caller's wrapper when a test asserts on notices */
+    },
+    async confirm(title) {
+      const scripted = answer(script.confirm, title);
+      if (scripted === null) return undefined;
+      return Array.isArray(scripted) ? false : (scripted ?? false);
+    },
+    async input(title) {
+      return answer(script.input, title) ?? "";
+    },
+    async select(title, options, dialogOptions) {
+      const chosen = answer(script.select, title);
+      if (chosen === null) return undefined;
+      if (typeof chosen === "number") return options[chosen]?.label;
+      if (typeof chosen === "string") return options.find((o) => o.label.startsWith(chosen))?.label ?? chosen;
+      // Enter: the row the caller put the cursor on.
+      return options[dialogOptions?.initialIndex ?? 0]?.label;
+    },
+  };
+}

package/src/worker.ts

@@ -22,6 +22,8 @@ const BLOCKED_PATTERN = /^state:\s*blocked\s*$/im;
 
 /** Any explicit verdict line, whatever it claims. */
 const STATE_LINE_PATTERN = /^state:\s*\S+\s*$/im;
+/** GitHub PR URLs in unstructured prose; capture their canonical `owner/repo`. */
+const GITHUB_PR_URL_PATTERN = /https:\/\/github\.com\/([^/\s]+\/[^/\s]+)\/pull\/\d+\b/gi;
 
 /** `{{KEY}}` placeholders in a brief template. */
 const PLACEHOLDER_PATTERN = /\{\{([A-Za-z0-9_]+)\}\}/g;
@@ -63,6 +65,8 @@ export interface WorkerOpts {
   brief: string;
   cwd: string;
   caps: Caps;
+  /** Canonical `owner/repo` identity used to scope prose-only PR URLs. */
+  repoSlug?: string;
   /**
    * Directory the harness writes this run's transcript into — a directory, not
    * a file. The SDK takes no `sessionFile` input, so naming a path here would
@@ -179,15 +183,23 @@ export function renderBrief(template: string, vars: Record<string, string>): str
  * asks the tracker to verify those facts independently. Missing or malformed
  * evidence fails closed.
  */
-export function deriveResult(report: string): {
+export function deriveResult(report: string, repoSlug?: string): {
   state: RunState;
   prUrl?: string;
   headSha?: string;
 } {
-  const prUrl = PR_URL_PATTERN.exec(report)?.[1];
+  const structuredPrUrl = PR_URL_PATTERN.exec(report)?.[1];
   const headSha = HEAD_SHA_PATTERN.exec(report)?.[1]?.toLowerCase();
-  if (PUSHED_GREEN_PATTERN.test(report) && prUrl !== undefined && headSha !== undefined) {
-    return { state: "pushed-green", prUrl, headSha };
+  if (PUSHED_GREEN_PATTERN.test(report) && structuredPrUrl !== undefined && headSha !== undefined) {
+    return { state: "pushed-green", prUrl: structuredPrUrl, headSha };
+  }
+
+  let prUrl = structuredPrUrl;
+  if (prUrl === undefined && repoSlug !== undefined) {
+    const expectedRepo = repoSlug.toLowerCase();
+    for (const match of report.matchAll(GITHUB_PR_URL_PATTERN)) {
+      if (match[1]?.toLowerCase() === expectedRepo) prUrl = match[0];
+    }
   }
 
   const state: RunState = BLOCKED_PATTERN.test(report) ? "blocked" : "failed";
@@ -424,7 +436,7 @@ export async function runWorker(
     const text = reportText(field(message, "content"));
     if (text !== "") {
       report = text;
-      const stated = deriveResult(text);
+      const stated = deriveResult(text, o.repoSlug);
       if (stated.state === "pushed-green" && stated.prUrl !== undefined && stated.headSha !== undefined) {
         claim = { prUrl: stated.prUrl, headSha: stated.headSha };
       }
@@ -554,7 +566,7 @@ export async function runWorker(
     return withSessionFacts({ state: "pushed-green", ...claim, turns, spendUsd, report });
   }
   return withSessionFacts({
-    ...deriveResult(report),
+    ...deriveResult(report, o.repoSlug),
     turns,
     spendUsd,
     report,
@@ -597,7 +609,12 @@ function field(source: unknown, key: string): unknown {
 }
 
 /** Flatten an assistant message's content blocks to their plain text. */
-function reportText(content: unknown): string {
+/**
+ * The newest assistant text, flattened out of whatever block shape the harness
+ * sent. Exported for ./setup-probe.ts, which collects a probe's answer the same
+ * way a worker's report is collected — one spelling, so the two cannot drift.
+ */
+export function reportText(content: unknown): string {
   if (typeof content === "string") return content.trim();
   const blocks: readonly unknown[] = Array.isArray(content) ? content : [];
   const parts: string[] = [];