xab 6.0.0 → 8.0.0

package/dist/index.js

@@ -43,7 +43,7 @@ var init_config = __esm(() => {
     promptHints: [],
     pathRemaps: [],
     reviewStrictness: "normal",
-    maxAttempts: 2,
+    maxAttempts: undefined,
     commitPrefix: "backmerge:"
   };
 });
@@ -433,11 +433,65 @@ function parseJson(raw, fallback) {
   }
   return fallback;
 }
+async function runStreamedWithProgress(thread, prompt, onProgress, turnOpts) {
+  if (!onProgress) {
+    const turn = await thread.run(prompt, turnOpts);
+    return turn.finalResponse;
+  }
+  const { events } = await thread.runStreamed(prompt, turnOpts);
+  let finalResponse = "";
+  for await (const event of events) {
+    if (event.type === "item.started" || event.type === "item.updated" || event.type === "item.completed") {
+      const item = event.item;
+      switch (item.type) {
+        case "command_execution": {
+          const cmd = item.command ?? "";
+          const status = item.status;
+          if (status === "in_progress") {
+            onProgress("exec", `$ ${cmd}`);
+          } else if (status === "completed") {
+            const output = item.aggregated_output ?? "";
+            if (output) {
+              const lines = output.split(`
+`).filter(Boolean);
+              for (const line of lines.slice(-3)) {
+                onProgress("exec", `  ${line.slice(0, 120)}`);
+              }
+            }
+          }
+          break;
+        }
+        case "file_change": {
+          const changes = item.changes ?? [];
+          for (const c of changes) {
+            onProgress("file", `${c.kind} ${c.path}`);
+          }
+          break;
+        }
+        case "reasoning": {
+          const text = item.text ?? "";
+          if (text && event.type === "item.completed") {
+            onProgress("think", text.split(`
+`)[0].slice(0, 120));
+          }
+          break;
+        }
+        case "agent_message": {
+          if (event.type === "item.completed") {
+            finalResponse = item.text ?? "";
+          }
+          break;
+        }
+      }
+    }
+  }
+  return finalResponse;
+}
 async function analyzeCommit(opts) {
   const codex = new Codex;
   const thread = codex.startThread({
     workingDirectory: opts.worktreePath,
-    sandboxMode: "read-only",
+    sandboxMode: "danger-full-access",
     model: "gpt-5.4",
     modelReasoningEffort: "high"
   });
@@ -481,7 +535,7 @@ You are looking at a worktree based on the TARGET branch "${opts.targetBranch}".
    - Config files that need manual updates on servers? \u2192 note which
    - Dependencies on external services being added or removed? \u2192 note what
    - If the commit is just normal code changes that only need a deploy+restart, leave opsNotes as []`;
-  let turn;
+  let response;
   if (diffChunks.length > 1) {
     await thread.run(firstPrompt);
     for (let i = 1;i < diffChunks.length - 1; i++) {
@@ -493,17 +547,17 @@ ${diffChunks[i]}
 Continue reading. More parts coming.`);
     }
     const lastIdx = diffChunks.length - 1;
-    turn = await thread.run(`### Diff (part ${lastIdx + 1}/${diffChunks.length} \u2014 final):
+    response = await runStreamedWithProgress(thread, `### Diff (part ${lastIdx + 1}/${diffChunks.length} \u2014 final):
 \`\`\`diff
 ${diffChunks[lastIdx]}
 \`\`\`
 
-You now have the complete diff. Analyze and produce your structured response.`, { outputSchema: analysisSchema });
+You now have the complete diff. Analyze and produce your structured response.`, opts.onProgress, { outputSchema: analysisSchema });
   } else {
-    turn = await thread.run(firstPrompt, { outputSchema: analysisSchema });
+    response = await runStreamedWithProgress(thread, firstPrompt, opts.onProgress, { outputSchema: analysisSchema });
   }
-  return parseJson(turn.finalResponse, {
-    summary: turn.finalResponse.slice(0, 500),
+  return parseJson(response, {
+    summary: response.slice(0, 500),
     alreadyInTarget: "no",
     reasoning: "Could not parse structured output",
     applicationStrategy: "Manual review recommended",
@@ -515,7 +569,7 @@ async function applyCommit(opts) {
   const codex = new Codex;
   const thread = codex.startThread({
     workingDirectory: opts.worktreePath,
-    sandboxMode: "workspace-write",
+    sandboxMode: "danger-full-access",
     model: "gpt-5.4",
     modelReasoningEffort: "high"
   });
@@ -543,7 +597,9 @@ After making all file changes, you MUST run these two commands as your FINAL act
 If you do not run both commands, your work will be discarded. This is not optional.
 The validation system checks for exactly one new git commit. Zero commits = failure.
 
-Report what you did.`;
+Report what you did.
+
+MAKE SURE TO ACTUALLY GIT COMMIT, NOT JUST MODIFY FILES.`;
   const firstPrompt = `${MERGE_PREAMBLE}
 ${opts.repoContext ? `## Repository context
 ${opts.repoContext}
@@ -558,7 +614,7 @@ ${diffChunks[0]}
 \`\`\`
 
 ${diffChunks.length > 1 ? "I will send the remaining diff parts next. Read them all before applying." : instructions}`;
-  let turn;
+  let response;
   if (diffChunks.length > 1) {
     await thread.run(firstPrompt);
     for (let i = 1;i < diffChunks.length - 1; i++) {
@@ -570,22 +626,22 @@ ${diffChunks[i]}
 Continue reading. More parts coming.`);
     }
     const lastIdx = diffChunks.length - 1;
-    turn = await thread.run(`### Diff (part ${lastIdx + 1}/${diffChunks.length} \u2014 final):
+    response = await runStreamedWithProgress(thread, `### Diff (part ${lastIdx + 1}/${diffChunks.length} \u2014 final):
 \`\`\`diff
 ${diffChunks[lastIdx]}
 \`\`\`
 
 You now have the complete diff.
 
-${instructions}`, { outputSchema: applyResultSchema });
+${instructions}`, opts.onProgress, { outputSchema: applyResultSchema });
   } else {
-    turn = await thread.run(firstPrompt, { outputSchema: applyResultSchema });
+    response = await runStreamedWithProgress(thread, firstPrompt, opts.onProgress, { outputSchema: applyResultSchema });
   }
-  return parseJson(turn.finalResponse, {
+  return parseJson(response, {
     applied: false,
     filesChanged: [],
     commitMessage: commitMsg,
-    notes: turn.finalResponse.slice(0, 1000),
+    notes: response.slice(0, 1000),
     adaptations: ""
   });
 }
@@ -593,7 +649,7 @@ async function fixFromReview(opts) {
   const codex = new Codex;
   const thread = codex.startThread({
     workingDirectory: opts.worktreePath,
-    sandboxMode: "workspace-write",
+    sandboxMode: "danger-full-access",
     model: "gpt-5.4",
     modelReasoningEffort: "high"
   });
@@ -622,7 +678,9 @@ After making all fixes, you MUST run these two commands as your FINAL action:
 
 If you do not run both commands, your fixes will be discarded. This is not optional.
 
-Report what you fixed.`;
+Report what you fixed.
+
+MAKE SURE TO ACTUALLY GIT COMMIT, NOT JUST MODIFY FILES.`;
   const turn = await thread.run(prompt, { outputSchema: applyResultSchema });
   return parseJson(turn.finalResponse, {
     applied: false,
@@ -710,7 +768,7 @@ function writeReviewPacket(audit, packet, attempt) {
     audit.writeAppliedPatch(commitHash, attempt, packet.appliedDiff);
   }
 }
-async function reviewAppliedDiff(worktreePath, packet) {
+async function reviewAppliedDiff(worktreePath, packet, onProgress) {
   const strictnessInstructions = {
     strict: "Be very strict. Any questionable change should be rejected. Err on the side of caution.",
     normal: "Be thorough but reasonable. Reject clear issues, accept minor style differences.",
@@ -783,7 +841,7 @@ If you have ANY objections, be specific about what's wrong and how to fix it. Yo
     options: {
       cwd: worktreePath,
       model: "claude-opus-4-6",
-      maxTurns: 30,
+      maxTurns: undefined,
       permissionMode: "default",
       outputFormat: reviewSchema,
       tools: ["Read", "Glob", "Grep", "Bash"],
@@ -796,14 +854,20 @@ You can:
 - Run tests, linters, type-checkers, and build commands via Bash to verify correctness
 - Run any read-only shell command (cat, ls, git diff, git log, etc.)
 
-You MUST NOT modify the worktree in any way. No file writes, no git commits, no destructive commands.
+You MUST NOT modify the worktree. Specifically:
+- NO file writes, edits, or creates
+- NO git commit, git add, git reset, or any git mutation
+- NO npm install, bun install, yarn install, pnpm install, or any package manager install
+- NO rm, mv, cp, or any file mutation commands
+- NO pip install, cargo build, go get, or anything that writes to disk
 
 Testing guidelines:
+- Only run tests that work without installing dependencies (assume deps are already installed if node_modules exists)
 - Only run tests that work without API keys, secrets, or external service connections
 - Before running a test, check if it needs env vars by reading the test file or relevant .env.example
-- If a test needs keys, only run it if you can see a .env file with those vars already populated
 - Prefer: type-checks (tsc --noEmit), linters (eslint), unit tests, build checks (forge build, go build)
 - Avoid: integration tests hitting external APIs, tests requiring running databases/services
+- Do NOT run bun install, npm install, or equivalent \u2014 deps are already there if they exist
 - If you can't determine whether a test needs keys, skip it \u2014 don't run and fail
 
 Your objections will be sent back to the apply agent for fixing, so be specific and actionable.`
@@ -811,6 +875,34 @@ Your objections will be sent back to the apply agent for fixing, so be specific
   });
   let resultText = "";
   for await (const message of q) {
+    if (onProgress && message.type === "assistant") {
+      const betaMsg = message.message;
+      const content = betaMsg?.content;
+      if (content) {
+        for (const block of content) {
+          if (block.type === "tool_use") {
+            const name = block.name;
+            const input = block.input;
+            if (name === "Bash") {
+              onProgress("review", `$ ${(input.command ?? "").slice(0, 120)}`);
+            } else if (name === "Read") {
+              onProgress("review", `read ${(input.file_path ?? "").replace(worktreePath + "/", "")}`);
+            } else if (name === "Grep") {
+              onProgress("review", `grep "${(input.pattern ?? "").slice(0, 60)}"`);
+            } else if (name === "Glob") {
+              onProgress("review", `glob ${(input.pattern ?? "").slice(0, 60)}`);
+            } else {
+              onProgress("review", `${name}`);
+            }
+          } else if (block.type === "text" && typeof block.text === "string" && block.text.length > 0) {
+            const firstLine = block.text.split(`
+`)[0].slice(0, 120);
+            if (firstLine)
+              onProgress("review", firstLine);
+          }
+        }
+      }
+    }
     if (message.type === "result") {
       if ("result" in message) {
         resultText = message.result;
@@ -844,17 +936,22 @@ async function verifyReviewIntegrity(wtGit, expectedHead) {
     return `Review mutated HEAD: expected ${expectedHead.slice(0, 8)}, got ${currentHead.slice(0, 8)}`;
   }
   const status = await wtGit.status();
-  const dirty = status.modified.length + status.created.length + status.deleted.length + status.not_added.length + status.conflicted.length;
+  const isInfra = (f) => f.startsWith(".backmerge/") || f.startsWith(".git-local/") || f.startsWith("node_modules/") || f.startsWith(".cache/") || f.startsWith("dist/") || f.startsWith("build/") || f.startsWith("target/");
+  const modified = status.modified.filter((f) => !isInfra(f));
+  const created = status.created.filter((f) => !isInfra(f));
+  const deleted = status.deleted.filter((f) => !isInfra(f));
+  const notAdded = status.not_added.filter((f) => !isInfra(f));
+  const dirty = modified.length + created.length + deleted.length + notAdded.length + status.conflicted.length;
   if (dirty > 0) {
     const parts = [];
-    if (status.modified.length)
-      parts.push(`${status.modified.length} modified`);
-    if (status.created.length)
-      parts.push(`${status.created.length} staged`);
-    if (status.not_added.length)
-      parts.push(`${status.not_added.length} untracked`);
-    if (status.deleted.length)
-      parts.push(`${status.deleted.length} deleted`);
+    if (modified.length)
+      parts.push(`${modified.length} modified`);
+    if (notAdded.length)
+      parts.push(`${notAdded.length} untracked`);
+    if (deleted.length)
+      parts.push(`${deleted.length} deleted`);
+    if (status.conflicted.length)
+      parts.push(`${status.conflicted.length} conflicted`);
     return `Review left dirty worktree: ${parts.join(", ")}`;
   }
   return null;
@@ -1173,12 +1270,12 @@ async function validateApply(worktreeGit, beforeHash) {
     errors.push(`Failed to check commits: ${e.message}`);
   }
   const status = await worktreeGit.status();
-  const isOurs = (f) => f.startsWith(".backmerge/") || f.startsWith(".backmerge\\");
-  const modified = status.modified.filter((f) => !isOurs(f));
-  const created = status.created.filter((f) => !isOurs(f));
-  const deleted = status.deleted.filter((f) => !isOurs(f));
-  const notAdded = status.not_added.filter((f) => !isOurs(f));
-  const conflicted = status.conflicted.filter((f) => !isOurs(f));
+  const isInfra = (f) => f.startsWith(".backmerge/") || f.startsWith(".backmerge\\") || f.startsWith(".git-local/") || f.startsWith(".git-local\\");
+  const modified = status.modified.filter((f) => !isInfra(f));
+  const created = status.created.filter((f) => !isInfra(f));
+  const deleted = status.deleted.filter((f) => !isInfra(f));
+  const notAdded = status.not_added.filter((f) => !isInfra(f));
+  const conflicted = status.conflicted.filter((f) => !isInfra(f));
   const worktreeClean = modified.length === 0 && created.length === 0 && deleted.length === 0 && conflicted.length === 0 && notAdded.length === 0;
   const dirtyFiles = [];
   if (!worktreeClean) {
@@ -1228,7 +1325,7 @@ async function getAppliedDiffStat(worktreeGit, beforeHash) {
 }
 async function resetHard(git, ref) {
   await git.raw(["reset", "--hard", ref]);
-  await git.raw(["clean", "-fd", "--exclude=.backmerge"]);
+  await git.raw(["clean", "-fd", "--exclude=.backmerge", "--exclude=.git-local"]);
 }
 async function fetchOrigin(git) {
   await git.fetch(["--all", "--prune"]);
@@ -1268,7 +1365,7 @@ async function runEngine(opts, cb) {
     autoSkip = true
   } = opts;
   const config = loadConfig(repoPath, opts.configPath);
-  const effectiveMaxAttempts = opts.maxAttempts ?? config.maxAttempts ?? 2;
+  const effectiveMaxAttempts = opts.maxAttempts ?? config.maxAttempts ?? Infinity;
   const effectiveWorkBranch = opts.workBranch ?? config.workBranch;
   const commitPrefix = config.commitPrefix ?? "backmerge:";
   if (!checkCodexInstalled())
@@ -1497,7 +1594,8 @@ async function processOneCommit(o) {
       sourceBranch: o.sourceRef,
       targetBranch: o.targetRef,
       sourceLatestDiff: o.sourceLatestDiff,
-      repoContext: commitCtx.promptBlock
+      repoContext: commitCtx.promptBlock,
+      onProgress: o.cb.onProgress ? (phase, msg) => o.cb.onProgress("analyze", `[${phase}] ${msg}`) : undefined
     });
     audit.writeAnalysis(commit.hash, 1, analysis);
     cb.onAnalysis(commit, analysis);
@@ -1548,7 +1646,7 @@ async function processOneCommit(o) {
   }
   for (let attempt = 1;attempt <= o.maxAttempts; attempt++) {
     const headBefore = await getHead(o.wtGit);
-    cb.onStatus(`Applying ${commit.hash.slice(0, 8)} (attempt ${attempt}/${o.maxAttempts})...`);
+    cb.onStatus(`Applying ${commit.hash.slice(0, 8)} (attempt ${attempt})...`);
     let applyResult;
     try {
       applyResult = await applyCommit({
@@ -1560,7 +1658,8 @@ async function processOneCommit(o) {
         sourceBranch: o.sourceRef,
         targetBranch: o.targetRef,
         repoContext: commitCtx.promptBlock,
-        commitPrefix: o.commitPrefix
+        commitPrefix: o.commitPrefix,
+        onProgress: o.cb.onProgress ? (phase, msg) => o.cb.onProgress("apply", `[${phase}] ${msg}`) : undefined
       });
       audit.writeAnalysis(commit.hash, attempt, { ...analysis, applyResult });
     } catch (e) {
@@ -1571,7 +1670,26 @@ async function processOneCommit(o) {
       continue;
     }
     cb.onStatus(`Validating ${commit.hash.slice(0, 8)}...`);
-    const validation = await validateApply(o.wtGit, headBefore);
+    let validation = await validateApply(o.wtGit, headBefore);
+    if (!validation.valid && validation.newCommitCount === 0 && !validation.worktreeClean && validation.dirtyFiles.length > 0) {
+      const realChanges = validation.dirtyFiles.filter((f) => !f.includes(".git-local/"));
+      if (realChanges.length > 0) {
+        cb.onLog(`Codex left ${realChanges.length} changed files without committing \u2014 creating rescue commit`, "yellow");
+        for (const f of realChanges)
+          cb.onLog(`  ${f}`, "yellow");
+        const commitMsg = `${o.commitPrefix} ${commit.message} (from ${commit.hash.slice(0, 8)})`;
+        try {
+          await o.wtGit.raw(["add", "-A", "--", ".", ":!.git-local"]);
+          await o.wtGit.raw(["commit", "-m", commitMsg]);
+          validation = await validateApply(o.wtGit, headBefore);
+          if (validation.valid) {
+            cb.onLog(`Rescue commit succeeded`, "green");
+          }
+        } catch (e) {
+          cb.onLog(`Rescue commit failed: ${e.message}`, "red");
+        }
+      }
+    }
     if (!validation.valid) {
       cb.onLog(`Validation failed: ${validation.errors.join("; ")}`, "red");
       if (validation.dirtyFiles.length > 0) {
@@ -1607,7 +1725,7 @@ async function processOneCommit(o) {
         };
         writeReviewPacket(audit, packet, attempt);
         const headBeforeReview = await getHead(o.wtGit);
-        reviewResult = await reviewAppliedDiff(o.wtPath, packet);
+        reviewResult = await reviewAppliedDiff(o.wtPath, packet, o.cb.onProgress);
         audit.writeReviewResult(commit.hash, attempt, reviewResult);
         const mutation = await verifyReviewIntegrity(o.wtGit, headBeforeReview);
         if (mutation) {
@@ -1625,10 +1743,10 @@ async function processOneCommit(o) {
       }
       if (!reviewResult.approved) {
         cb.onLog(`Review rejected: ${reviewResult.issues.join("; ")}`, "red");
-        const maxFixRounds = 2;
+        const maxFixRounds = Infinity;
         let fixed = false;
         for (let fixRound = 1;fixRound <= maxFixRounds; fixRound++) {
-          cb.onStatus(`Codex fixing review issues (round ${fixRound}/${maxFixRounds})...`);
+          cb.onStatus(`Codex fixing review issues (round ${fixRound})...`);
           try {
             await fixFromReview({
               worktreePath: o.wtPath,
@@ -1659,7 +1777,7 @@ async function processOneCommit(o) {
               appliedDiffStat: fixedStat
             };
             const headBeforeReReview = await getHead(o.wtGit);
-            reviewResult = await reviewAppliedDiff(o.wtPath, fixPacket);
+            reviewResult = await reviewAppliedDiff(o.wtPath, fixPacket, o.cb.onProgress);
             audit.writeReviewResult(commit.hash, attempt, {
               ...reviewResult,
               fixRound
@@ -1690,7 +1808,7 @@ async function processOneCommit(o) {
                 kind: "failed",
                 commitHash: commit.hash,
                 commitMessage: commit.message,
-                reason: `Review rejected after ${maxFixRounds} fix rounds: ${reviewResult.issues.join("; ")}`,
+                reason: `Review rejected after fix attempts: ${reviewResult.issues.join("; ")}`,
                 failedPhase: "review",
                 reviewApproved: false,
                 reviewIssues: reviewResult.issues,
@@ -1704,7 +1822,7 @@ async function processOneCommit(o) {
               kind: "failed",
               commitHash: commit.hash,
               commitMessage: commit.message,
-              reason: `Review rejected after ${maxFixRounds} fix rounds: ${reviewResult.issues.join("; ")}`,
+              reason: `Review rejected after fix attempts: ${reviewResult.issues.join("; ")}`,
               failedPhase: "review",
               reviewApproved: false,
               reviewIssues: reviewResult.issues,
@@ -1854,6 +1972,12 @@ async function runBatch(opts) {
   log(`  ${divider()}`);
   log("");
   const cb = {
+    onProgress(phase, msg) {
+      if (jsonl)
+        emitJsonl({ event: "progress", phase, msg });
+      const icon = phase === "apply" ? chalk.green("\u25B8") : chalk.blue("\u25B8");
+      log(`  ${ts()} ${icon} ${chalk.dim(msg)}`);
+    },
     onLog(msg, color) {
       if (jsonl)
         emitJsonl({ event: "log", msg, color });
@@ -2883,7 +3007,7 @@ Behavior:
   --no-fetch              Skip fetch (default)
   --no-review             Skip Claude review pass
   --no-auto-skip          Don't auto-skip commits AI identifies as present
-  --max-attempts <n>      Max retries per commit (default: 2)
+  --max-attempts <n>      Max retries per commit (default: unlimited)
   --no-resume             Don't resume from interrupted runs (default: auto-resume)
   --config <path>         Path to config file (default: auto-discover)
   --help, -h              Show this help

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xab",
-  "version": "6.0.0",
+  "version": "8.0.0",
   "description": "AI-powered curated branch reconciliation engine",
   "type": "module",
   "bin": {