alissa-tools-github-devloop 0.6.2__tar.gz → 0.7.0__tar.gz

{alissa_tools_github_devloop-0.6.2/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.6.2
+Version: 0.7.0
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.6.2 → alissa_tools_github_devloop-0.7.0}/src/main/alissa/tools/github/devloop/__main__.py

@@ -165,6 +165,32 @@ def build_parser() -> argparse.ArgumentParser:
         "never auto-resume — a dead-with-PR lane waits for an operator",
     )
 
+    rerequest = over.add_mutually_exclusive_group()
+    rerequest.add_argument(
+        "--rerequest",
+        dest="rerequest_enabled",
+        action="store_true",
+        default=None,
+        help="self-heal a PR whose fix session pushed and then died before "
+        "re-requesting review: once no worker session for it is listed and "
+        "the head has been public past the grace window, re-request review "
+        "mechanically, once per PR/round/head (the default)",
+    )
+    rerequest.add_argument(
+        "--no-rerequest",
+        dest="rerequest_enabled",
+        action="store_false",
+        help="never re-request review mechanically — a push whose session "
+        "died before its terminal act waits for an operator",
+    )
+    over.add_argument(
+        "--rerequest-grace-minutes",
+        type=int,
+        metavar="MINUTES",
+        help="how long the pushed head must have been public before the "
+        "wedge self-heal fires; 0 = use stale_minutes (the default)",
+    )
+
     claims = over.add_mutually_exclusive_group()
     claims.add_argument(
         "--activity-claims",
@@ -221,6 +247,8 @@ def overrides_from(args: argparse.Namespace) -> dict:
         "maintain_label": args.maintain_label,
         "maintain_enabled": args.maintain_enabled,
         "resume_enabled": args.resume_enabled,
+        "rerequest_enabled": args.rerequest_enabled,
+        "rerequest_grace_minutes": args.rerequest_grace_minutes,
         "activity_claims_enabled": args.activity_claims_enabled,
         "dry_run": args.dry_run,
     }
@@ -254,13 +282,15 @@ def log_effective_config(config: Config, login: str) -> None:
     log.info(
         "poll every %ss; dry_run=%s; attempt_cap=%s; stale after %s min; "
         "max_sessions=%s; fix_rounds=%s; maintain=%s (label %r); resume=%s; "
-        "activity_claims=%s",
+        "rerequest=%s (grace %s min); activity_claims=%s",
         config.poll_interval, config.dry_run, config.attempt_cap,
         config.stale_minutes,
         config.max_sessions or "unlimited",
         config.fix_rounds_enabled,
         config.maintain_enabled, config.maintain_label,
         config.resume_enabled,
+        config.rerequest_enabled,
+        config.rerequest_grace_seconds // 60,
         config.activity_claims_enabled,
     )
     log.debug("hub_template: %s", config.hub_template)

{alissa_tools_github_devloop-0.6.2 → alissa_tools_github_devloop-0.7.0}/src/main/alissa/tools/github/devloop/alissa.py

@@ -70,23 +70,45 @@ class Alissa:
 
     def list_sessions(self) -> "list[dict]":
         """Managed tmux sessions as `alissa tmux ls --json` reports them
-        (dicts carrying at least `name` and `status`). Raises CommandError
-        when the CLI cannot answer at all (the caller skips that sweep);
-        unparseable or non-list JSON degrades to an empty list -- a broken
-        listing must read as "nothing to reap", never crash the poll."""
-        out = run(["alissa", "tmux", "ls", "--json"], timeout=60)
+        (dicts carrying at least `name` and `status`).
+
+        Raises CommandError whenever the CLI does not answer USABLY: a
+        non-zero exit, or a zero exit whose stdout is empty, unparseable, or
+        not a JSON list. `--json` serialises its array and returns BEFORE the
+        human-readable empty case, so a working CLI with nothing to report
+        prints `[]`, never nothing -- which makes empty/garbled output a CLI
+        that failed to answer, not an answer of "no sessions". A PARSED empty
+        list is the genuine zero-session listing and is returned as such.
+
+        That distinction is load-bearing, not pedantry: callers feed this to
+        SessionLiveness, where a successful listing missing a name means the
+        session is DEAD. Degrading unusable output to `[]` would hand every
+        caller a confident, empty, WRONG roster -- respawning over sessions
+        that are merely unlistable, which is the double-spawn this daemon's
+        staleness matrix exists to prevent.
+
+        Raising cannot crash a poll: every caller already treats CommandError
+        as skip-this-pass (the reaper skips its sweep, the max_sessions budget
+        fails open, and the roster reads INDETERMINATE, so neither a respawn
+        nor a resume can fire on a listing that did not happen)."""
+        argv = ["alissa", "tmux", "ls", "--json"]
+        out = run(argv, timeout=60)
         if not out.strip():
-            return []
+            raise CommandError(
+                argv, 0, "`alissa tmux ls --json` printed nothing (a working "
+                "CLI prints `[]` when there are no sessions)",
+            )
         try:
             data = json.loads(out)
         except json.JSONDecodeError:
-            log.warning(
-                "`alissa tmux ls --json` returned unparseable output -- "
-                "treating as no sessions this sweep"
+            raise CommandError(
+                argv, 0, "`alissa tmux ls --json` returned unparseable output",
             )
-            return []
         if not isinstance(data, list):
-            return []
+            raise CommandError(
+                argv, 0, "`alissa tmux ls --json` returned "
+                f"{type(data).__name__}, not a JSON list",
+            )
         return [entry for entry in data if isinstance(entry, dict)]
 
     def kill_session(self, name: str) -> None:

{alissa_tools_github_devloop-0.6.2 → alissa_tools_github_devloop-0.7.0}/src/main/alissa/tools/github/devloop/config.py

@@ -63,6 +63,8 @@ CONFIG_KEYS = (
     "maintain_label",
     "maintain_enabled",
     "resume_enabled",
+    "rerequest_enabled",
+    "rerequest_grace_minutes",
     "activity_claims_enabled",
     "dry_run",
 )
@@ -181,6 +183,30 @@ class Config:
     # operator who wants a dead-with-PR lane to wait for a human.
     resume_enabled: bool = True
 
+    # The wedge self-heal (issue #61): the fix edge's crash-recovery net under
+    # FIX_DIRECTIVE's terminal step. A fix session that posted its triage
+    # replies and PUSHED, then died before re-requesting review, leaves the PR
+    # in a state NEITHER daemon can exit -- revloop only sees PRs with a review
+    # requested from its identity, and the fix edge reads the push as "an
+    # implementer is already active". Rather than spawn a session, the daemon
+    # completes the dead one's protocol itself: it re-requests review from the
+    # reviewer whose verdict is being answered, exactly once per (PR, round,
+    # head). Default ON -- it closes a 3+ hour operator-only wedge (observed on
+    # fahera-mx/studio.alissa.app#242, 2026-07-27), it re-requests rather than
+    # spawns (so it can never double-drive a branch), and every side effect
+    # still honors dry_run. false restores the legacy read: the push closes the
+    # edge and a human re-requests.
+    rerequest_enabled: bool = True
+
+    # How long the pushed head must have been public before the self-heal
+    # fires. A live session re-requests SECONDS after its push, so firing on
+    # sight would race it; the window is what turns "a push exists" into "a
+    # push exists and nobody followed it up". 0 means "the fix-session stale
+    # window" (stale_minutes) -- the same clock every other presumed-dead
+    # decision on this edge is made on, and the documented default. Set a
+    # positive value to widen or narrow it independently.
+    rerequest_grace_minutes: int = 0
+
     # Cross-instance spawn dedupe (issue #53): before spawning on any edge,
     # read the trigger artifact's mechanical activity comment and treat a
     # spawn line younger than stale_minutes as an in-flight claim EVEN when
@@ -219,6 +245,15 @@ class Config:
             return default_state_path(self.workspace_root)
         return Path(self.state_path).expanduser()
 
+    @property
+    def rerequest_grace_seconds(self) -> int:
+        """How long a pushed head must have been public before the wedge
+        self-heal fires, in seconds. Read this, never the raw field: 0 is the
+        sentinel for "the fix-session stale window", so the fallback has to
+        live in ONE place or a caller reading the field directly would fire
+        the re-request instantly on a default config."""
+        return (self.rerequest_grace_minutes or self.stale_minutes) * 60
+
     @property
     def manifest_path(self) -> Path:
         return self.workspace_root / "alissa-workspace.yaml"
@@ -321,6 +356,16 @@ class Config:
                 f"max_sessions must be >= 0 (0 = unlimited), got {max_sessions}"
             )
 
+        # 0 is the sentinel for "fall back to stale_minutes" (the documented
+        # default), so the floor is 0 like max_sessions' -- a negative grace
+        # would make the self-heal fire on a head pushed in the future.
+        grace = int(raw.get("rerequest_grace_minutes", cls.rerequest_grace_minutes))
+        if grace < 0:
+            raise ValueError(
+                f"rerequest_grace_minutes must be >= 0 (0 = use stale_minutes), "
+                f"got {grace}"
+            )
+
         interval = int(raw.get("poll_interval", cls.poll_interval))
         if interval < MIN_POLL_INTERVAL:
             raise ValueError(
@@ -353,6 +398,10 @@ class Config:
             resume_enabled=bool(
                 raw.get("resume_enabled", cls.resume_enabled)
             ),
+            rerequest_enabled=bool(
+                raw.get("rerequest_enabled", cls.rerequest_enabled)
+            ),
+            rerequest_grace_minutes=grace,
             activity_claims_enabled=bool(
                 raw.get("activity_claims_enabled", cls.activity_claims_enabled)
             ),

{alissa_tools_github_devloop-0.6.2 → alissa_tools_github_devloop-0.7.0}/src/main/alissa/tools/github/devloop/ghclient.py

@@ -176,6 +176,35 @@ class IdentityMismatch(RuntimeError):
     """Configured developer identity disagrees with the gh token."""
 
 
+class ReviewRequestRejected(RuntimeError):
+    """`request_review` returned 2xx but the reviewer is not on the PR.
+
+    The `requested_reviewers` endpoint answers with the (possibly unchanged)
+    pull request, so a request GitHub declined to honour -- a reviewer without
+    read access, a login that has since been renamed, an author who cannot
+    request themselves -- can come back 2xx with nothing added. The mechanical
+    re-request leans on that field being TRUE afterwards (it is the whole
+    remedy: the reviewer daemon's only entry point is a
+    `review-requested:@me` search), so the response is checked exactly as
+    `assign_self` checks its own.
+
+    The caller's contract is escalate-don't-retry, the same one
+    AssignmentRejected gets on the issue edge and for the same reason: every
+    cause above is PERMANENT and operator-fixable, so retrying achieves
+    nothing but write traffic against an endpoint GitHub has already refused.
+    `loop.DevWatcher._escalate_rerequest_rejected` pages the operator on the
+    PR once and records `loop.rerequest_rejected_kind`, which short-circuits
+    the next poll before any probe is paid for; a NEW head is a new key and
+    gets a fresh attempt.
+
+    What still separates this from AssignmentRejected is the OTHER ledger row
+    it must not write: a refused re-request is never recorded as DONE
+    (`loop.rerequest_kind`). The remedy did not happen, and a row saying it
+    did would re-wedge the PR permanently with nothing left that can see it.
+    Distinct from a transient CommandError on the same call, which keeps the
+    plain retry."""
+
+
 class AssignmentRejected(RuntimeError):
     """`assign_self` returned 2xx but the login is not on the issue.
 
@@ -609,6 +638,79 @@ class GitHub:
             if isinstance(r, dict)
         ]
 
+    def commit_time(self, owner: str, repo: str, sha: str) -> "int | None":
+        """A commit's COMMITTER date as unix seconds, or None when it cannot
+        be read -- the grace window's clock behind the mechanical re-request.
+
+        GitHub's REST API exposes no "when was this ref pushed" field on a pull
+        request, and plain pushes raise no timeline event (only force-pushes
+        do), so the head commit's committer date is the cheapest instant
+        available. It is a LOWER BOUND on the push: a commit created locally
+        and pushed minutes later stamps the earlier moment, so an age measured
+        from it over-estimates how long the head has been public and the grace
+        window can expire marginally early. For the sessions this daemon
+        spawns, commit and push are seconds apart (the directives push
+        immediately after committing), and the caller tightens the bound
+        further by taking the later of this and the review the push answers --
+        the push necessarily postdates that review.
+
+        The GIT-OBJECT endpoint, not `repos/:o/:r/commits/:sha`: the latter
+        ships the commit's full file list and patches (up to 300 files) to
+        deliver one date, while `git/commits/:sha` returns the object alone --
+        a few hundred bytes whatever the commit's size, with the date one
+        level shallower. Immaterial on the steady-state path (the done-marker
+        short-circuits ahead of this call once the remedy has fired) and not
+        immaterial on the transient-retry path, where a poll that keeps
+        failing would otherwise re-fetch a possibly-large merge commit every
+        cycle.
+
+        None on anything unreadable (no such commit, a malformed payload, a
+        date GitHub did not spell in UTC `Z`): the caller treats an unknown
+        push instant as "cannot prove the grace has passed" and defers, which
+        is the fail-safe direction for a call that ends in a mutation."""
+        data = self._api(f"repos/{owner}/{repo}/git/commits/{sha}") or {}
+        committer = data.get("committer") or {}
+        return parse_github_timestamp(committer.get("date"))
+
+    def request_review(self, owner: str, repo: str, number: int, reviewer: str) -> None:
+        """Request review from ONE login on a pull request.
+
+        The API call behind a fix session's terminal step (`gh pr edit
+        --add-reviewer`), performed by the daemon itself when the session that
+        owed it died first. `--input` rather than `-f reviewers[]=...` for the
+        same reason `assign_self` uses it: gh 2.4.0 predates the array syntax
+        and the endpoint wants `{"reviewers": [...]}`.
+
+        The response is the pull request, so the request is verified to have
+        LANDED (see ReviewRequestRejected) -- casefolded, because GitHub logins
+        are case-insensitive while the reviewer set is operator-typed."""
+        payload = json.dumps({"reviewers": [reviewer]})
+        fd, body_path = tempfile.mkstemp(prefix="devloop-rereview-", suffix=".json")
+        try:
+            with os.fdopen(fd, "w") as handle:
+                handle.write(payload)
+            data = self._api(
+                "-X",
+                "POST",
+                f"repos/{owner}/{repo}/pulls/{number}/requested_reviewers",
+                "--input",
+                body_path,
+            )
+        finally:
+            os.unlink(body_path)
+
+        landed = tuple(
+            (r.get("login") or "")
+            for r in ((data or {}).get("requested_reviewers") or [])
+        )
+        if reviewer.casefold() not in {name.casefold() for name in landed}:
+            raise ReviewRequestRejected(
+                f"{owner}/{repo}#{number}: GitHub accepted the request but "
+                f"{reviewer!r} is not among the requested reviewers {landed!r} "
+                f"-- the review request did not land, so the reviewer daemon "
+                f"still cannot see this PR."
+            )
+
     def issue(self, owner: str, repo: str, number: int) -> Issue:
         # `or {}`: run_json returns None on empty stdout, and the siblings
         # (search_issues, assign_self) already guard the same way.