xab 7.0.0 → 8.0.0

package/dist/index.js

@@ -433,11 +433,65 @@ function parseJson(raw, fallback) {
   }
   return fallback;
 }
+async function runStreamedWithProgress(thread, prompt, onProgress, turnOpts) {
+  if (!onProgress) {
+    const turn = await thread.run(prompt, turnOpts);
+    return turn.finalResponse;
+  }
+  const { events } = await thread.runStreamed(prompt, turnOpts);
+  let finalResponse = "";
+  for await (const event of events) {
+    if (event.type === "item.started" || event.type === "item.updated" || event.type === "item.completed") {
+      const item = event.item;
+      switch (item.type) {
+        case "command_execution": {
+          const cmd = item.command ?? "";
+          const status = item.status;
+          if (status === "in_progress") {
+            onProgress("exec", `$ ${cmd}`);
+          } else if (status === "completed") {
+            const output = item.aggregated_output ?? "";
+            if (output) {
+              const lines = output.split(`
+`).filter(Boolean);
+              for (const line of lines.slice(-3)) {
+                onProgress("exec", `  ${line.slice(0, 120)}`);
+              }
+            }
+          }
+          break;
+        }
+        case "file_change": {
+          const changes = item.changes ?? [];
+          for (const c of changes) {
+            onProgress("file", `${c.kind} ${c.path}`);
+          }
+          break;
+        }
+        case "reasoning": {
+          const text = item.text ?? "";
+          if (text && event.type === "item.completed") {
+            onProgress("think", text.split(`
+`)[0].slice(0, 120));
+          }
+          break;
+        }
+        case "agent_message": {
+          if (event.type === "item.completed") {
+            finalResponse = item.text ?? "";
+          }
+          break;
+        }
+      }
+    }
+  }
+  return finalResponse;
+}
 async function analyzeCommit(opts) {
   const codex = new Codex;
   const thread = codex.startThread({
     workingDirectory: opts.worktreePath,
-    sandboxMode: "read-only",
+    sandboxMode: "danger-full-access",
     model: "gpt-5.4",
     modelReasoningEffort: "high"
   });
@@ -481,7 +535,7 @@ You are looking at a worktree based on the TARGET branch "${opts.targetBranch}".
    - Config files that need manual updates on servers? \u2192 note which
    - Dependencies on external services being added or removed? \u2192 note what
    - If the commit is just normal code changes that only need a deploy+restart, leave opsNotes as []`;
-  let turn;
+  let response;
   if (diffChunks.length > 1) {
     await thread.run(firstPrompt);
     for (let i = 1;i < diffChunks.length - 1; i++) {
@@ -493,17 +547,17 @@ ${diffChunks[i]}
 Continue reading. More parts coming.`);
     }
     const lastIdx = diffChunks.length - 1;
-    turn = await thread.run(`### Diff (part ${lastIdx + 1}/${diffChunks.length} \u2014 final):
+    response = await runStreamedWithProgress(thread, `### Diff (part ${lastIdx + 1}/${diffChunks.length} \u2014 final):
 \`\`\`diff
 ${diffChunks[lastIdx]}
 \`\`\`
 
-You now have the complete diff. Analyze and produce your structured response.`, { outputSchema: analysisSchema });
+You now have the complete diff. Analyze and produce your structured response.`, opts.onProgress, { outputSchema: analysisSchema });
   } else {
-    turn = await thread.run(firstPrompt, { outputSchema: analysisSchema });
+    response = await runStreamedWithProgress(thread, firstPrompt, opts.onProgress, { outputSchema: analysisSchema });
   }
-  return parseJson(turn.finalResponse, {
-    summary: turn.finalResponse.slice(0, 500),
+  return parseJson(response, {
+    summary: response.slice(0, 500),
     alreadyInTarget: "no",
     reasoning: "Could not parse structured output",
     applicationStrategy: "Manual review recommended",
@@ -515,7 +569,7 @@ async function applyCommit(opts) {
   const codex = new Codex;
   const thread = codex.startThread({
     workingDirectory: opts.worktreePath,
-    sandboxMode: "workspace-write",
+    sandboxMode: "danger-full-access",
     model: "gpt-5.4",
     modelReasoningEffort: "high"
   });
@@ -560,7 +614,7 @@ ${diffChunks[0]}
 \`\`\`
 
 ${diffChunks.length > 1 ? "I will send the remaining diff parts next. Read them all before applying." : instructions}`;
-  let turn;
+  let response;
   if (diffChunks.length > 1) {
     await thread.run(firstPrompt);
     for (let i = 1;i < diffChunks.length - 1; i++) {
@@ -572,22 +626,22 @@ ${diffChunks[i]}
 Continue reading. More parts coming.`);
     }
     const lastIdx = diffChunks.length - 1;
-    turn = await thread.run(`### Diff (part ${lastIdx + 1}/${diffChunks.length} \u2014 final):
+    response = await runStreamedWithProgress(thread, `### Diff (part ${lastIdx + 1}/${diffChunks.length} \u2014 final):
 \`\`\`diff
 ${diffChunks[lastIdx]}
 \`\`\`
 
 You now have the complete diff.
 
-${instructions}`, { outputSchema: applyResultSchema });
+${instructions}`, opts.onProgress, { outputSchema: applyResultSchema });
   } else {
-    turn = await thread.run(firstPrompt, { outputSchema: applyResultSchema });
+    response = await runStreamedWithProgress(thread, firstPrompt, opts.onProgress, { outputSchema: applyResultSchema });
   }
-  return parseJson(turn.finalResponse, {
+  return parseJson(response, {
     applied: false,
     filesChanged: [],
     commitMessage: commitMsg,
-    notes: turn.finalResponse.slice(0, 1000),
+    notes: response.slice(0, 1000),
     adaptations: ""
   });
 }
@@ -595,7 +649,7 @@ async function fixFromReview(opts) {
   const codex = new Codex;
   const thread = codex.startThread({
     workingDirectory: opts.worktreePath,
-    sandboxMode: "workspace-write",
+    sandboxMode: "danger-full-access",
     model: "gpt-5.4",
     modelReasoningEffort: "high"
   });
@@ -714,7 +768,7 @@ function writeReviewPacket(audit, packet, attempt) {
     audit.writeAppliedPatch(commitHash, attempt, packet.appliedDiff);
   }
 }
-async function reviewAppliedDiff(worktreePath, packet) {
+async function reviewAppliedDiff(worktreePath, packet, onProgress) {
   const strictnessInstructions = {
     strict: "Be very strict. Any questionable change should be rejected. Err on the side of caution.",
     normal: "Be thorough but reasonable. Reject clear issues, accept minor style differences.",
@@ -800,14 +854,20 @@ You can:
 - Run tests, linters, type-checkers, and build commands via Bash to verify correctness
 - Run any read-only shell command (cat, ls, git diff, git log, etc.)
 
-You MUST NOT modify the worktree in any way. No file writes, no git commits, no destructive commands.
+You MUST NOT modify the worktree. Specifically:
+- NO file writes, edits, or creates
+- NO git commit, git add, git reset, or any git mutation
+- NO npm install, bun install, yarn install, pnpm install, or any package manager install
+- NO rm, mv, cp, or any file mutation commands
+- NO pip install, cargo build, go get, or anything that writes to disk
 
 Testing guidelines:
+- Only run tests that work without installing dependencies (assume deps are already installed if node_modules exists)
 - Only run tests that work without API keys, secrets, or external service connections
 - Before running a test, check if it needs env vars by reading the test file or relevant .env.example
-- If a test needs keys, only run it if you can see a .env file with those vars already populated
 - Prefer: type-checks (tsc --noEmit), linters (eslint), unit tests, build checks (forge build, go build)
 - Avoid: integration tests hitting external APIs, tests requiring running databases/services
+- Do NOT run bun install, npm install, or equivalent \u2014 deps are already there if they exist
 - If you can't determine whether a test needs keys, skip it \u2014 don't run and fail
 
 Your objections will be sent back to the apply agent for fixing, so be specific and actionable.`
@@ -815,6 +875,34 @@ Your objections will be sent back to the apply agent for fixing, so be specific
   });
   let resultText = "";
   for await (const message of q) {
+    if (onProgress && message.type === "assistant") {
+      const betaMsg = message.message;
+      const content = betaMsg?.content;
+      if (content) {
+        for (const block of content) {
+          if (block.type === "tool_use") {
+            const name = block.name;
+            const input = block.input;
+            if (name === "Bash") {
+              onProgress("review", `$ ${(input.command ?? "").slice(0, 120)}`);
+            } else if (name === "Read") {
+              onProgress("review", `read ${(input.file_path ?? "").replace(worktreePath + "/", "")}`);
+            } else if (name === "Grep") {
+              onProgress("review", `grep "${(input.pattern ?? "").slice(0, 60)}"`);
+            } else if (name === "Glob") {
+              onProgress("review", `glob ${(input.pattern ?? "").slice(0, 60)}`);
+            } else {
+              onProgress("review", `${name}`);
+            }
+          } else if (block.type === "text" && typeof block.text === "string" && block.text.length > 0) {
+            const firstLine = block.text.split(`
+`)[0].slice(0, 120);
+            if (firstLine)
+              onProgress("review", firstLine);
+          }
+        }
+      }
+    }
     if (message.type === "result") {
       if ("result" in message) {
         resultText = message.result;
@@ -848,17 +936,22 @@ async function verifyReviewIntegrity(wtGit, expectedHead) {
     return `Review mutated HEAD: expected ${expectedHead.slice(0, 8)}, got ${currentHead.slice(0, 8)}`;
   }
   const status = await wtGit.status();
-  const dirty = status.modified.length + status.created.length + status.deleted.length + status.not_added.length + status.conflicted.length;
+  const isInfra = (f) => f.startsWith(".backmerge/") || f.startsWith(".git-local/") || f.startsWith("node_modules/") || f.startsWith(".cache/") || f.startsWith("dist/") || f.startsWith("build/") || f.startsWith("target/");
+  const modified = status.modified.filter((f) => !isInfra(f));
+  const created = status.created.filter((f) => !isInfra(f));
+  const deleted = status.deleted.filter((f) => !isInfra(f));
+  const notAdded = status.not_added.filter((f) => !isInfra(f));
+  const dirty = modified.length + created.length + deleted.length + notAdded.length + status.conflicted.length;
   if (dirty > 0) {
     const parts = [];
-    if (status.modified.length)
-      parts.push(`${status.modified.length} modified`);
-    if (status.created.length)
-      parts.push(`${status.created.length} staged`);
-    if (status.not_added.length)
-      parts.push(`${status.not_added.length} untracked`);
-    if (status.deleted.length)
-      parts.push(`${status.deleted.length} deleted`);
+    if (modified.length)
+      parts.push(`${modified.length} modified`);
+    if (notAdded.length)
+      parts.push(`${notAdded.length} untracked`);
+    if (deleted.length)
+      parts.push(`${deleted.length} deleted`);
+    if (status.conflicted.length)
+      parts.push(`${status.conflicted.length} conflicted`);
     return `Review left dirty worktree: ${parts.join(", ")}`;
   }
   return null;
@@ -1501,7 +1594,8 @@ async function processOneCommit(o) {
       sourceBranch: o.sourceRef,
       targetBranch: o.targetRef,
       sourceLatestDiff: o.sourceLatestDiff,
-      repoContext: commitCtx.promptBlock
+      repoContext: commitCtx.promptBlock,
+      onProgress: o.cb.onProgress ? (phase, msg) => o.cb.onProgress("analyze", `[${phase}] ${msg}`) : undefined
     });
     audit.writeAnalysis(commit.hash, 1, analysis);
     cb.onAnalysis(commit, analysis);
@@ -1564,7 +1658,8 @@ async function processOneCommit(o) {
         sourceBranch: o.sourceRef,
         targetBranch: o.targetRef,
         repoContext: commitCtx.promptBlock,
-        commitPrefix: o.commitPrefix
+        commitPrefix: o.commitPrefix,
+        onProgress: o.cb.onProgress ? (phase, msg) => o.cb.onProgress("apply", `[${phase}] ${msg}`) : undefined
       });
       audit.writeAnalysis(commit.hash, attempt, { ...analysis, applyResult });
     } catch (e) {
@@ -1630,7 +1725,7 @@ async function processOneCommit(o) {
         };
         writeReviewPacket(audit, packet, attempt);
         const headBeforeReview = await getHead(o.wtGit);
-        reviewResult = await reviewAppliedDiff(o.wtPath, packet);
+        reviewResult = await reviewAppliedDiff(o.wtPath, packet, o.cb.onProgress);
         audit.writeReviewResult(commit.hash, attempt, reviewResult);
         const mutation = await verifyReviewIntegrity(o.wtGit, headBeforeReview);
         if (mutation) {
@@ -1682,7 +1777,7 @@ async function processOneCommit(o) {
               appliedDiffStat: fixedStat
             };
             const headBeforeReReview = await getHead(o.wtGit);
-            reviewResult = await reviewAppliedDiff(o.wtPath, fixPacket);
+            reviewResult = await reviewAppliedDiff(o.wtPath, fixPacket, o.cb.onProgress);
             audit.writeReviewResult(commit.hash, attempt, {
               ...reviewResult,
               fixRound
@@ -1877,6 +1972,12 @@ async function runBatch(opts) {
   log(`  ${divider()}`);
   log("");
   const cb = {
+    onProgress(phase, msg) {
+      if (jsonl)
+        emitJsonl({ event: "progress", phase, msg });
+      const icon = phase === "apply" ? chalk.green("\u25B8") : chalk.blue("\u25B8");
+      log(`  ${ts()} ${icon} ${chalk.dim(msg)}`);
+    },
     onLog(msg, color) {
       if (jsonl)
         emitJsonl({ event: "log", msg, color });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xab",
-  "version": "7.0.0",
+  "version": "8.0.0",
   "description": "AI-powered curated branch reconciliation engine",
   "type": "module",
   "bin": {