swarm-orchestrator 7.0.0-alpha.0

package/dist/src/branch-merger.js

@@ -0,0 +1,427 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BranchMerger = void 0;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const spinner_1 = require("./spinner");
+const logger_1 = require("./logger");
+const logger = (0, logger_1.getLogger)('branch-merger');
+/**
+ * Render a long swarm branch name as `step-N agent` so log lines stay readable.
+ * The full ref `swarm/<execId>/step-N-<agent>` is unwieldy; the user already
+ * knows which run they triggered, so the per-step segment is the meaningful
+ * part. Falls back to the raw name when the convention does not match.
+ */
+function shortBranchLabel(branchName) {
+    const m = branchName.match(/\/step-(\d+)-(.+?)$/);
+    return m ? `step-${m[1]} ${m[2]}` : branchName;
+}
+/**
+ * Handles all git branch merging: wave merges, final merges, and conflict
+ * resolution strategies. Extracted from SwarmOrchestrator for cohesion.
+ */
+class BranchMerger {
+    workingDir;
+    worktreeManager;
+    constructor(workingDir, worktreeManager) {
+        this.workingDir = workingDir;
+        this.worktreeManager = worktreeManager;
+    }
+    /**
+     * Clear residual unmerged index entries left by failed merges or stash pops.
+     * Aborts any in-progress merge, resets the index, and restores tracked files.
+     * Safe to call when the index is already clean.
+     */
+    resetUnmergedState() {
+        const opts = { cwd: this.workingDir, stdio: 'pipe', encoding: 'utf8' };
+        try {
+            (0, child_process_1.execSync)('git merge --abort', opts);
+        }
+        catch { /* no merge in progress */ }
+        try {
+            const status = (0, child_process_1.execSync)('git status --porcelain', opts).trim();
+            const hasConflicts = status.split('\n').some(line => /^(U.|.U|AA|DD)/.test(line));
+            if (hasConflicts) {
+                (0, child_process_1.execSync)('git reset HEAD', opts);
+                (0, child_process_1.execSync)('git checkout -- .', opts);
+            }
+        }
+        catch { /* not critical */ }
+    }
+    /**
+     * Merge completed wave branches back to main, with PR or direct merge.
+     * Records unmerged branches and returns them for caller tracking.
+     */
+    async mergeWaveBranches(completedResults, context, prMode, prUrls, stepCostRecords, plan) {
+        const unmerged = [];
+        const branches = completedResults
+            .filter(r => r.branchName)
+            .map(r => r.branchName);
+        if (branches.length === 0)
+            return unmerged;
+        if (context.prManager) {
+            for (const result of completedResults) {
+                if (!result.branchName)
+                    continue;
+                const step = plan?.steps.find(s => s.stepNumber === result.stepNumber);
+                const taskDesc = step?.task || `Step ${result.stepNumber}`;
+                const costRecord = stepCostRecords?.find(r => r.stepNumber === result.stepNumber);
+                const prResult = context.prManager.createStepPR(result.branchName, context.mainBranch, result.stepNumber, result.agentName, taskDesc, { verification: result.verificationResult, costRecord });
+                if (prResult.success && prResult.url) {
+                    prUrls?.set(result.stepNumber, prResult.url);
+                    // PR URL goes into the final-summary footer; this debug line is the
+                    // forensic record of when each PR was created.
+                    logger.debug(`pr step-${result.stepNumber} ${prResult.url}`);
+                    if (prMode === 'auto' && prResult.number) {
+                        const merged = context.prManager.autoMergePR(prResult.number);
+                        if (merged) {
+                            logger.debug(`merged pr #${prResult.number}`);
+                        }
+                        else {
+                            logger.warn(`auto-merge failed for pr #${prResult.number}; manual merge required`);
+                        }
+                    }
+                    else if (prMode === 'review' && prResult.number) {
+                        logger.info(`waiting on review for pr #${prResult.number}...`);
+                        const status = await context.prManager.waitForApproval(prResult.number);
+                        if (status.approved || status.state === 'MERGED') {
+                            logger.debug(`approved pr #${prResult.number}`);
+                            if (status.state !== 'MERGED') {
+                                context.prManager.autoMergePR(prResult.number);
+                            }
+                        }
+                        else {
+                            logger.warn(`pr #${prResult.number} review timed out or was not approved`);
+                        }
+                    }
+                }
+                else {
+                    logger.warn(`pr creation failed for ${shortBranchLabel(result.branchName)}: ${prResult.error}`);
+                    try {
+                        await this.mergeBranch(result.branchName, context);
+                        logger.debug(`merged ${shortBranchLabel(result.branchName)} (fallback)`);
+                    }
+                    catch (error) {
+                        const err = error;
+                        logger.warn(`merge conflict on ${shortBranchLabel(result.branchName)}: ${err.message}`);
+                    }
+                }
+            }
+            return unmerged;
+        }
+        try {
+            this.resetUnmergedState();
+            await this.worktreeManager.switchBranch(context.mainBranch);
+            // Stash all changes (including untracked files like .copilot-instructions.md)
+            // so they don't block incoming merges that introduce files with the same names.
+            let stashed = false;
+            try {
+                const stashResult = (0, child_process_1.execSync)('git stash push --include-untracked -m "pre-wave-merge stash"', {
+                    cwd: this.workingDir, encoding: 'utf8', stdio: 'pipe'
+                });
+                stashed = !stashResult.includes('No local changes');
+            }
+            catch {
+                // Clean working tree; expected
+            }
+            for (const result of completedResults) {
+                if (result.branchName) {
+                    const label = shortBranchLabel(result.branchName);
+                    try {
+                        await this.mergeBranch(result.branchName, context);
+                        // Per-step merge confirmations are diagnostic; the final summary
+                        // already reports completed/total. Keep them visible with --verbose.
+                        logger.debug(`merged ${label}`);
+                    }
+                    catch (error) {
+                        const err = error;
+                        try {
+                            (0, child_process_1.execSync)('git merge --abort', { cwd: this.workingDir, stdio: 'pipe' });
+                        }
+                        catch { /* no merge in progress */ }
+                        logger.debug(`rebasing ${label} onto ${context.mainBranch}`);
+                        const rebased = this.tryRebaseAndMerge(result.branchName, context);
+                        if (rebased) {
+                            logger.debug(`merged ${label} (rebased)`);
+                        }
+                        else {
+                            logger.warn(`  could not merge ${label} after rebase: ${err.message}`);
+                            logger.warn(`    step ${result.stepNumber} work preserved on ${result.branchName}`);
+                            unmerged.push({
+                                stepNumber: result.stepNumber,
+                                branchName: result.branchName,
+                                agentName: result.agentName,
+                                reason: err.message,
+                            });
+                        }
+                    }
+                }
+            }
+            if (stashed) {
+                try {
+                    (0, child_process_1.execSync)('git stash pop', { cwd: this.workingDir, stdio: 'pipe' });
+                }
+                catch {
+                    // Stash pop conflicted (common with binary .pyc files after merges).
+                    // Reset the conflicted state and drop the stash; merged content takes priority.
+                    this.resetUnmergedState();
+                    try {
+                        (0, child_process_1.execSync)('git stash drop', { cwd: this.workingDir, stdio: 'pipe' });
+                    }
+                    catch { /* already gone */ }
+                }
+            }
+        }
+        finally {
+            // switchBranch and mergeBranch pass cwd explicitly; no global state to restore
+        }
+        return unmerged;
+    }
+    /**
+     * Final merge phase: remove worktrees, merge all remaining branches to main,
+     * with stash/pop to preserve working directory state.
+     */
+    async mergeAllBranches(results, runDir, context) {
+        const unmerged = [];
+        // Remove all worktrees before branch operations
+        const worktreesDir = path.join(runDir, 'worktrees');
+        if (fs.existsSync(worktreesDir)) {
+            for (const result of results) {
+                if (result.branchName) {
+                    const worktreePath = path.join(worktreesDir, `step-${result.stepNumber}`);
+                    await this.worktreeManager.removeAgentWorktree(worktreePath);
+                }
+            }
+        }
+        this.resetUnmergedState();
+        await this.worktreeManager.switchBranch(context.mainBranch);
+        // Stash all changes including untracked files so they don't block
+        // incoming merges that introduce files with the same names.
+        let stashed = false;
+        try {
+            const stashResult = (0, child_process_1.execSync)('git stash push --include-untracked -m "pre-final-merge stash"', {
+                cwd: this.workingDir, encoding: 'utf8', stdio: 'pipe'
+            });
+            stashed = !stashResult.includes('No local changes');
+        }
+        catch {
+            // Clean working tree; expected
+        }
+        // Determine already-merged branches to avoid double-merge
+        let mergedBranches = [];
+        try {
+            const merged = (0, child_process_1.execSync)(`git branch --merged ${context.mainBranch}`, {
+                cwd: this.workingDir, encoding: 'utf8', stdio: 'pipe'
+            });
+            mergedBranches = merged.split('\n').map(b => b.trim().replace(/^\* /, ''));
+        }
+        catch {
+            // Shallow clones or empty repos; safe to attempt all merges
+        }
+        for (const result of results) {
+            if (result.status === 'completed' && result.branchName) {
+                const label = shortBranchLabel(result.branchName);
+                if (mergedBranches.includes(result.branchName)) {
+                    // Skip silently. The wave loop already announced this merge; a
+                    // second "(already merged)" line on top is just noise.
+                    continue;
+                }
+                const mergeSpinner = new spinner_1.Spinner(`merging ${label}...`, { style: 'dots', prefix: '  ' });
+                mergeSpinner.start();
+                try {
+                    await this.mergeBranch(result.branchName, context);
+                    mergeSpinner.stop(`merged ${label}`);
+                }
+                catch (error) {
+                    const err = error;
+                    try {
+                        (0, child_process_1.execSync)('git merge --abort', { cwd: this.workingDir, stdio: 'pipe' });
+                    }
+                    catch { /* no merge in progress */ }
+                    const rebased = this.tryRebaseAndMerge(result.branchName, context);
+                    if (rebased) {
+                        mergeSpinner.stop(`merged ${label} (rebased)`);
+                    }
+                    else {
+                        mergeSpinner.stop(`conflict on ${label}: ${err.message}`);
+                        logger.error(`    work preserved on ${result.branchName}`);
+                        unmerged.push({
+                            stepNumber: result.stepNumber,
+                            branchName: result.branchName,
+                            agentName: result.agentName,
+                            reason: err.message,
+                        });
+                    }
+                }
+            }
+        }
+        if (stashed) {
+            try {
+                (0, child_process_1.execSync)('git stash pop', { cwd: this.workingDir, stdio: 'pipe' });
+            }
+            catch {
+                this.resetUnmergedState();
+                try {
+                    (0, child_process_1.execSync)('git stash drop', { cwd: this.workingDir, stdio: 'pipe' });
+                }
+                catch { /* already gone */ }
+            }
+        }
+        return unmerged;
+    }
+    /**
+     * Three-strategy conflict resolution:
+     * 1. Rebase onto main, fast-forward merge
+     * 2. merge -X theirs (accept branch version of conflicting hunks)
+     * 3. Manual modify/delete conflict resolution
+     */
+    tryRebaseAndMerge(branchName, context) {
+        const gitEnv = { ...process.env, GIT_TERMINAL_PROMPT: '0' };
+        const mergeEnv = { ...gitEnv, GIT_MERGE_AUTOEDIT: 'no' };
+        // Strategy 1: rebase + fast-forward
+        try {
+            (0, child_process_1.execSync)(`git rebase ${context.mainBranch} "${branchName}"`, {
+                cwd: this.workingDir, stdio: 'pipe', timeout: 120000, env: gitEnv
+            });
+            (0, child_process_1.execSync)(`git checkout "${context.mainBranch}"`, {
+                cwd: this.workingDir, stdio: 'pipe', env: gitEnv
+            });
+            (0, child_process_1.execSync)(`git merge --no-ff "${branchName}" -m "Merge ${branchName} (rebased)"`, {
+                cwd: this.workingDir, stdio: 'pipe', timeout: 120000, env: mergeEnv
+            });
+            return true;
+        }
+        catch {
+            try {
+                (0, child_process_1.execSync)('git rebase --abort', { cwd: this.workingDir, stdio: 'pipe' });
+            }
+            catch { /* none in progress */ }
+            try {
+                (0, child_process_1.execSync)('git merge --abort', { cwd: this.workingDir, stdio: 'pipe' });
+            }
+            catch { /* none in progress */ }
+            try {
+                (0, child_process_1.execSync)(`git checkout "${context.mainBranch}"`, { cwd: this.workingDir, stdio: 'pipe', env: gitEnv });
+            }
+            catch { /* best-effort */ }
+        }
+        // Strategy 2: -X theirs auto-resolution
+        try {
+            logger.info(`  \u{1F500} Retrying merge of ${branchName} with conflict auto-resolution...`);
+            (0, child_process_1.execSync)(`git merge -X theirs --no-ff "${branchName}" -m "Merge ${branchName} (auto-resolved)"`, {
+                cwd: this.workingDir, stdio: 'pipe', timeout: 120000, env: mergeEnv
+            });
+            return true;
+        }
+        catch {
+            // Handle modify/delete conflicts that -X theirs can't resolve
+            try {
+                const statusOutput = (0, child_process_1.execSync)('git status --porcelain', {
+                    cwd: this.workingDir, encoding: 'utf8', stdio: 'pipe'
+                });
+                const conflictLines = statusOutput.split('\n').filter(l => l.startsWith('UD') || l.startsWith('DU') || l.startsWith('UU') || l.startsWith('AA'));
+                if (conflictLines.length > 0) {
+                    for (const line of conflictLines) {
+                        const filePath = line.slice(3).trim();
+                        if (line.startsWith('UD')) {
+                            // Ours modified, theirs deleted: accept deletion
+                            (0, child_process_1.execSync)(`git rm -f "${filePath}"`, { cwd: this.workingDir, stdio: 'pipe' });
+                        }
+                        else {
+                            // DU, UU, AA: accept theirs (binary .pyc, .db, or text conflicts)
+                            (0, child_process_1.execSync)(`git checkout --theirs "${filePath}" && git add "${filePath}"`, {
+                                cwd: this.workingDir, stdio: 'pipe', shell: '/bin/bash'
+                            });
+                        }
+                    }
+                    try {
+                        (0, child_process_1.execSync)('git add -u', { cwd: this.workingDir, stdio: 'pipe' });
+                    }
+                    catch { /* ignore */ }
+                    (0, child_process_1.execSync)(`git commit --no-edit -m "Merge ${branchName} (auto-resolved conflicts)"`, { cwd: this.workingDir, stdio: 'pipe', env: mergeEnv });
+                    logger.info(`  \u2705 Resolved merge conflicts for ${branchName}`);
+                    return true;
+                }
+            }
+            catch {
+                // Manual resolution failed; fall through to abort
+            }
+            try {
+                (0, child_process_1.execSync)('git merge --abort', { cwd: this.workingDir, stdio: 'pipe' });
+            }
+            catch { /* none in progress */ }
+            try {
+                (0, child_process_1.execSync)(`git checkout "${context.mainBranch}"`, { cwd: this.workingDir, stdio: 'pipe', env: gitEnv });
+            }
+            catch { /* best-effort */ }
+            return false;
+        }
+    }
+    /**
+     * Merge a single branch via git merge --no-ff, with git lock coordination.
+     */
+    async mergeBranch(branchName, context) {
+        const lockId = await context.contextBroker.acquireGitLock('orchestrator', `merge ${branchName}`);
+        if (!lockId) {
+            throw new Error('Failed to acquire git lock for merge');
+        }
+        try {
+            (0, child_process_1.execSync)(`git merge --no-ff "${branchName}" -m "Merge ${branchName}"`, {
+                cwd: this.workingDir,
+                stdio: 'pipe',
+                timeout: 120000,
+                env: {
+                    ...process.env,
+                    GIT_TERMINAL_PROMPT: '0',
+                    GIT_MERGE_AUTOEDIT: 'no'
+                }
+            });
+        }
+        catch (err) {
+            const e = err;
+            if (e.killed) {
+                throw new Error(`Timeout merging ${branchName}`, { cause: err });
+            }
+            throw new Error(`Merge conflict: ${e.stderr?.toString() || e.message || 'unknown error'}`, { cause: err });
+        }
+        finally {
+            context.contextBroker.releaseGitLock(lockId);
+        }
+    }
+}
+exports.BranchMerger = BranchMerger;
+exports.default = BranchMerger;

package/dist/src/cli/attest-handlers.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleAttestCommand = handleAttestCommand;
+const verification_1 = require("../verification");
+/**
+ * Handle `swarm attest verify <commit>`.
+ *
+ * @param args - CLI argv segment beginning with `attest`.
+ * @returns Process exit code.
+ */
+async function handleAttestCommand(args) {
+    const subcommand = args[1];
+    if (subcommand !== 'verify') {
+        console.error('Usage: swarm attest verify <commit>');
+        return 1;
+    }
+    const commit = args[2];
+    if (!commit) {
+        console.error('Usage: swarm attest verify <commit>');
+        return 1;
+    }
+    const result = await (0, verification_1.verifyAttestation)(process.cwd(), commit);
+    if (!result.found) {
+        console.error(`No attestation found for ${commit}`);
+        return 1;
+    }
+    const attestation = result.attestation;
+    if (!attestation) {
+        console.error(`No attestation found for ${commit}`);
+        return 1;
+    }
+    const metadata = attestation.envelope.predicate.metadata;
+    const agent = attestation.envelope.predicate.buildConfig;
+    console.log(`Commit: ${commit}`);
+    console.log(`Verified: ${result.verified ? 'yes' : 'no'}`);
+    console.log(`Reason: ${result.reason}`);
+    console.log(`Agent: ${agent.tool} ${agent.version} (${agent.model})`);
+    console.log(`Composite score: ${metadata.compositeScore}`);
+    console.log(`Timestamp: ${metadata.timestamp}`);
+    for (const layer of metadata.layerResults) {
+        console.log(`- ${layer.layer}: ${layer.status} (${layer.durationMs}ms) ${layer.evidenceSummary}`);
+    }
+    return result.verified ? 0 : 1;
+}

package/dist/src/cli/cost-prompt.js

@@ -0,0 +1,51 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmCostPrompt = confirmCostPrompt;
+const readline = __importStar(require("readline"));
+function confirmCostPrompt(estimateLow, estimateHigh, model, skipConfirm) {
+    if (skipConfirm)
+        return Promise.resolve(true);
+    if (!process.stdin.isTTY)
+        return Promise.resolve(true);
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        rl.question(`\n⚡ This will use ${estimateLow}-${estimateHigh} premium requests (${model}). Proceed? [Y/n] `, (answer) => {
+            rl.close();
+            const normalized = (answer || 'y').trim().toLowerCase();
+            resolve(normalized === 'y' || normalized === 'yes' || normalized === '');
+        });
+    });
+}