alissa-tools-github-devloop 0.8.25__tar.gz → 0.8.27__tar.gz

{alissa_tools_github_devloop-0.8.25/src/main/alissa_tools_github_devloop.egg-info → alissa_tools_github_devloop-0.8.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: alissa-tools-github-devloop
-Version: 0.8.25
+Version: 0.8.27
 Summary: ALISSA-TOOLS-GITHUB-DEVLOOP
 Home-page: https://alissa.app
 Author: Fahera

{alissa_tools_github_devloop-0.8.25 → alissa_tools_github_devloop-0.8.27}/src/main/alissa/tools/github/devloop/__main__.py

@@ -194,6 +194,40 @@ def build_parser() -> argparse.ArgumentParser:
         "sessions, even if the config enables it",
     )
 
+    over.add_argument(
+        "--revert-label",
+        metavar="LABEL",
+        help="label an operator applies to a MERGED PR to request a revert "
+        "session (a `TASK-<n>-REVERT-PR<k>` branch reverting the merge "
+        "commit, opened as a ready PR); the session removes the label on "
+        "completion. Env ALISSA_REVERT_LABEL (non-blank) wins over this flag",
+    )
+    revert = over.add_mutually_exclusive_group()
+    revert.add_argument(
+        "--revert",
+        dest="revert_enabled",
+        action="store_true",
+        default=None,
+        help="poll merged PRs carrying the revert label and spawn revert "
+        "sessions (the default)",
+    )
+    revert.add_argument(
+        "--no-revert",
+        dest="revert_enabled",
+        action="store_false",
+        help="never search for the revert label or spawn revert sessions, "
+        "even if the config enables it",
+    )
+    over.add_argument(
+        "--revert-any-author",
+        dest="revert_any_author",
+        action="store_true",
+        default=None,
+        help="let the revert lever act on merged PRs by ANY author, not only "
+        "the daemon's own (default off: a foreign-authored PR is refused "
+        "with a comment and unlabelled)",
+    )
+
     resume = over.add_mutually_exclusive_group()
     resume.add_argument(
         "--resume",
@@ -431,6 +465,9 @@ def overrides_from(args: argparse.Namespace) -> dict:
         "fix_rounds_enabled": args.fix_rounds_enabled,
         "maintain_label": args.maintain_label,
         "maintain_enabled": args.maintain_enabled,
+        "revert_label": args.revert_label,
+        "revert_enabled": args.revert_enabled,
+        "revert_any_author": args.revert_any_author,
         "resume_enabled": args.resume_enabled,
         "wedge_minutes": args.wedge_minutes,
         "rerequest_enabled": args.rerequest_enabled,
@@ -532,7 +569,7 @@ def log_effective_config(config: Config, login: str) -> None:
     log.info(
         "poll every %ss; dry_run=%s; attempt_cap=%s; stale after %s min; "
         "max_sessions=%s; reap_grace=%s min; fix_rounds=%s; maintain=%s "
-        "(label %r); resume=%s; "
+        "(label %r); revert=%s (label %r, any_author=%s); resume=%s; "
         "rerequest=%s (grace %s min); orphan_sweep=%s (grace %s min); "
         "activity_claims=%s; janitor=%s (grace %s min, every %s min, cache "
         "cap %s MiB, warn at %s%%)",
@@ -542,6 +579,7 @@ def log_effective_config(config: Config, login: str) -> None:
         config.reap_grace_seconds // 60,
         config.fix_rounds_enabled,
         config.maintain_enabled, config.maintain_label,
+        config.revert_enabled, config.revert_label, config.revert_any_author,
         config.resume_enabled,
         config.rerequest_enabled,
         config.rerequest_grace_seconds // 60,

{alissa_tools_github_devloop-0.8.25 → alissa_tools_github_devloop-0.8.27}/src/main/alissa/tools/github/devloop/alissa.py

@@ -8,12 +8,93 @@ from __future__ import annotations
 
 import json
 import logging
+import os
+import re
 from pathlib import Path
 
 from .proc import CommandError, run
+from .prompts import ALLOWED_KEYS
 
 log = logging.getLogger(__name__)
 
+# The prefix `alissa tmux` gives every session it manages: the roster's
+# `name` is the MANAGED name (`develop-…`, what `alissa tmux kill` takes) and
+# the real tmux session is that name under this prefix (`ali-develop-…`).
+# The raw-tmux surface below targets the REAL session, so a managed name is
+# prefixed and a name already carrying the prefix is used as is.
+MANAGED_PREFIX = "ali-"
+
+# The console's session-name rule (webui.server._SAFE_SESSION), stated once
+# where the raw tmux argv is built: starts with a letter/digit/dot/underscore,
+# carries only those and `-`, bounded length. Validating here makes the argv
+# impossible to weaponise -- a `-flag`-shaped name or one with a space,
+# `;` or `/` never reaches tmux -- and the console re-checks the same rule.
+SAFE_SESSION = re.compile(r"\A[A-Za-z0-9._][A-Za-z0-9._-]{0,199}\Z")
+
+
+def tmux_socket() -> str:
+    """The path of the tmux server socket the worker sessions live on:
+    `$TMUX_TMPDIR/tmux-<uid>/default` (tmux's own default). Spelled out
+    rather than left to tmux because the daemon may run without `TMUX` in
+    its environment and must still reach the SAME server `alissa tmux new`
+    created for the workers -- same container, same user, same socket."""
+    base = os.environ.get("TMUX_TMPDIR", "").strip() or "/tmp"
+    return os.path.join(base, f"tmux-{os.getuid()}", "default")
+
+
+def tmux_target(name: str) -> str:
+    """The `-t` target for a managed session: the real tmux name, prefixed
+    with `=` so tmux matches it EXACTLY (its default is prefix matching, and
+    `develop-acme-widgets-i7-a1` is a prefix of `…-a10`) and suffixed with
+    `:` so the target is the session's CURRENT WINDOW (and its active pane)
+    -- a bare `=name` is a session target, which `capture-pane` and
+    `send-keys` refuse with "can't find pane" (tmux 3.3a)."""
+    real = name if name.startswith(MANAGED_PREFIX) else MANAGED_PREFIX + name
+    return "=" + real + ":"
+
+
+def check_session_name(name: "str | None") -> str:
+    """`name` when it passes SAFE_SESSION, else ValueError. Every raw tmux
+    argv builder calls this first."""
+    if not name or not SAFE_SESSION.match(name):
+        raise ValueError(f"invalid session name {name!r}")
+    return name
+
+
+def capture_pane_argv(name: str, lines: int) -> "list[str]":
+    """`tmux -S <socket> capture-pane -p -t =<real> -S -<lines>`: the last
+    `lines` lines of the session's active pane, printed to stdout, with
+    escape sequences stripped (`-p` without `-e`)."""
+    check_session_name(name)
+    return [
+        "tmux", "-S", tmux_socket(), "capture-pane", "-p",
+        "-t", tmux_target(name), "-S", f"-{max(1, int(lines))}",
+    ]
+
+
+def pane_path_argv(name: str) -> "list[str]":
+    check_session_name(name)
+    return [
+        "tmux", "-S", tmux_socket(), "display-message", "-p",
+        "-t", tmux_target(name), "#{pane_current_path}",
+    ]
+
+
+def send_keys_argv(name: str, keys: "tuple[str, ...]") -> "list[str]":
+    """`tmux -S <socket> send-keys -t =<real> <key>…` with every key drawn
+    from `prompts.ALLOWED_KEYS`. Anything else -- a letter, a word, a path --
+    is a ValueError before any process is spawned: the responder presses a
+    dialog's buttons and can never type into a worker."""
+    check_session_name(name)
+    if not keys:
+        raise ValueError("send_keys needs at least one key")
+    bad = [k for k in keys if k not in ALLOWED_KEYS]
+    if bad:
+        raise ValueError(
+            f"key(s) not in the allowlist {sorted(ALLOWED_KEYS)}: {bad!r}"
+        )
+    return ["tmux", "-S", tmux_socket(), "send-keys", "-t", tmux_target(name), *keys]
+
 
 class Alissa:
     def enqueue_developer(
@@ -149,6 +230,72 @@ class Alissa:
         `tmux kill`); the reaper treats kills as best-effort."""
         run(["alissa", "tmux", "kill", name], timeout=60)
 
+    def capture_pane(self, name: str, lines: int = 40) -> str:
+        """The last `lines` of ONE managed session's pane over raw tmux
+        (`capture-pane -p`), or "" when tmux cannot answer (no such session,
+        the socket gone, a timeout).
+
+        The responder's evidence seam (issue #127). Like `tail_session` it
+        returns UNTRUSTED, possibly sensitive terminal content: the caller
+        classifies it and lets only the classification -- plus a scrubbed
+        signature line -- reach an operator-facing level. A READ, so it runs
+        under dry-run too: a dry pass has to classify what a live one would.
+        Raw tmux rather than the `alissa` CLI because the CLI's `tail` is a
+        convenience without `send-keys` beside it, and the answer has to land
+        on the very pane the capture read."""
+        try:
+            argv = capture_pane_argv(name, lines)
+        except ValueError as exc:
+            log.warning("capture_pane refused: %s", exc)
+            return ""
+        try:
+            out = run(argv, timeout=15)
+        except CommandError as exc:
+            log.debug("could not capture the pane of %s (%s)", name, exc)
+            return ""
+        return out.rstrip("\n")
+
+    def pane_path(self, name: str) -> str:
+        """The session's pane current path (`#{pane_current_path}`), or ""
+        when tmux cannot answer. One leg of the lane's worktree resolution:
+        a worker that `cd`ed into its `TASK-*` worktree names it here."""
+        try:
+            argv = pane_path_argv(name)
+        except ValueError as exc:
+            log.warning("pane_path refused: %s", exc)
+            return ""
+        try:
+            return run(argv, timeout=15).strip()
+        except CommandError as exc:
+            log.debug("could not read the pane path of %s (%s)", name, exc)
+            return ""
+
+    def send_keys(self, name: str, *keys: str, dry_run: bool = False) -> bool:
+        """Press `keys` -- each one of `prompts.ALLOWED_KEYS`, nothing else
+        -- on ONE managed session's pane. True when tmux accepted them.
+
+        The ONLY key-pressing surface in the fleet, and deliberately narrow:
+        an allowlisted enum, a validated session name, an exact-match target,
+        one `send-keys` per call. A key outside the allowlist is refused
+        before any process is spawned and logged at WARNING (it is a
+        programming error, never a pane's doing -- keys come from the
+        policy table, not from the screen). Dry-run logs the intent and
+        sends nothing."""
+        try:
+            argv = send_keys_argv(name, tuple(keys))
+        except ValueError as exc:
+            log.warning("send_keys refused for %s: %s", name, exc)
+            return False
+        if dry_run:
+            log.info("[dry-run] would send keys %s to %s", " ".join(keys), name)
+            return False
+        try:
+            run(argv, timeout=15)
+        except CommandError as exc:
+            log.warning("could not send keys %s to %s (%s)", " ".join(keys), name, exc)
+            return False
+        return True
+
     def worker_running(self) -> bool:
         """The queue only drains while `alissa worker` reconciles it."""
         try:

{alissa_tools_github_devloop-0.8.25 → alissa_tools_github_devloop-0.8.27}/src/main/alissa/tools/github/devloop/config.py

@@ -24,6 +24,8 @@ through to the config rather than fail the daemon's boot on a mode of `''`.
 `loop_events_enabled` rides the same shape of rail through
 `ALISSA_DEV_LOOP_EVENTS_ENABLED`, with the same blank-falls-through rule, and
 `fleet_vitals_enabled` through `ALISSA_DEV_FLEET_VITALS_ENABLED` likewise.
+`revert_label` rides `ALISSA_REVERT_LABEL` the same way (issue #131): a
+non-blank value wins over the CLI and the file, a blank one falls through.
 """
 
 from __future__ import annotations
@@ -108,6 +110,25 @@ ENV_LOOP_EVENTS = "ALISSA_DEV_LOOP_EVENTS_ENABLED"
 # non-blank-wins / blank-falls-through rule, same config error on a typo.
 ENV_FLEET_VITALS = "ALISSA_DEV_FLEET_VITALS_ENABLED"
 
+# The revert lever's label rail (issue #131): `revert_label` ridden the way
+# ALISSA_DEV_REPOS_SOURCE rides repos_source -- a NON-BLANK value wins over
+# the CLI and the file, a blank one falls through. Spelled as the issue names
+# it (no `_DEV_` infix), because that is the name the operator runbook gives.
+ENV_REVERT_LABEL = "ALISSA_REVERT_LABEL"
+
+# The prompt responder's master switch (issue #127): `on` answers, `observe`
+# classifies and narrates but sends nothing, `off` never captures a pane.
+PROMPT_ON = "on"
+PROMPT_OBSERVE = "observe"
+PROMPT_OFF = "off"
+_PROMPT_MODES = frozenset((PROMPT_ON, PROMPT_OBSERVE, PROMPT_OFF))
+
+# Where lane W1's hooks leave the "this session is waiting for input" marker
+# (`docker/claude/hooks/note-waiting.py`): `${ALISSA_WAITING_DIR}/<tmux
+# session>.json`. The daemon reads the same directory, so the two halves
+# agree by construction on a default deployment.
+DEFAULT_WAITING_DIR = "/workspace/.waiting"
+
 _ENV_BOOL_TRUE = frozenset(("1", "true"))
 _ENV_BOOL_FALSE = frozenset(("0", "false"))
 
@@ -179,8 +200,16 @@ CONFIG_KEYS = (
     "fix_rounds_enabled",
     "maintain_label",
     "maintain_enabled",
+    "revert_label",
+    "revert_enabled",
+    "revert_any_author",
     "resume_enabled",
     "wedge_minutes",
+    "prompt_responder",
+    "prompt_quiet_seconds",
+    "prompt_kill_minutes",
+    "prompt_max_answers",
+    "waiting_dir",
     "rerequest_enabled",
     "rerequest_grace_minutes",
     "orphan_sweep_enabled",
@@ -469,6 +498,20 @@ class Config:
     maintain_label: str = "alissa:maintain"
     maintain_enabled: bool = True
 
+    # The revert lever (issue #131, the fourth polled edge): an operator
+    # labels a MERGED PR `revert_label` to request a session that reverts its
+    # merge commit on a fresh `TASK-<n>-REVERT-PR<k>` branch and opens the
+    # revert PR ready for review. One spawn per label application (the ledger
+    # keys on the labeled-at instant), no stale retry -- the operator's retry
+    # is unlabel + re-label. `revert_any_author` widens the lever past the
+    # loop's own PRs: off by default in `merge_author_logins`' spirit, because
+    # the daemon reverting a human's merge is a decision a human should make
+    # explicitly, in config, not by applying a label. Default ON like the
+    # maintenance edge, and every side effect still honors dry_run.
+    revert_label: str = "alissa:revert"
+    revert_enabled: bool = True
+    revert_any_author: bool = False
+
     # The third staleness signal (session liveness, read from the reaper's own
     # tmux listing) and the auto-resume it unlocks: a stale attempt whose
     # ledger session is provably gone is respawned with RESUME_DIRECTIVE /
@@ -514,6 +557,39 @@ class Config:
     # never this field.
     wedge_minutes: int = 0
 
+    # The prompt responder (issue #127): every poll, for every ALIVE worker
+    # session this daemon owns, a waiting marker from lane W1's hook OR a
+    # session quiet for `prompt_quiet_seconds` triggers a pane capture, the
+    # classifier and the policy table (`prompts.py`), and the answer lands
+    # in seconds -- no SSH, no LLM in the loop. `on` (the default) answers;
+    # `observe` classifies and narrates but sends no key, kills nothing and
+    # pages nobody; `off` never captures a pane. Every side effect honours
+    # dry_run (a dry pass classifies and logs, sends nothing).
+    prompt_responder: str = PROMPT_ON
+
+    # How long a worker session must have been quiet (`lastActivity` in the
+    # roster) before its pane is read WITHOUT a waiting marker. The marker
+    # is the fast path (seconds); this is the net under it, for a hook that
+    # did not fire. Floored at 30 so a session between two tool calls is not
+    # read as parked.
+    prompt_quiet_seconds: int = 90
+
+    # The unknown-dialog ladder's last rung: a dialog no signature knows is
+    # waited out one poll, dismissed with Escape on its second sighting, and
+    # after this many minutes still on screen the session is killed so the
+    # ordinary retry/resume edge takes over. Floored at 1.
+    prompt_kill_minutes: int = 10
+
+    # The per-session answer cap: after this many keystroke answers the
+    # session is killed-and-retried -- a worker that keeps producing prompts
+    # is diverging, and the narration says so. Floored at 1.
+    prompt_max_answers: int = 5
+
+    # Where the waiting markers are (see DEFAULT_WAITING_DIR). The hooks
+    # read ALISSA_WAITING_DIR at run time; the container's config generator
+    # writes the same value here so the daemon looks where the hooks wrote.
+    waiting_dir: str = DEFAULT_WAITING_DIR
+
     # The wedge self-heal (issue #61): the fix edge's crash-recovery net under
     # FIX_DIRECTIVE's terminal step. A fix session that posted its triage
     # replies and PUSHED, then died before re-requesting review, leaves the PR
@@ -735,6 +811,23 @@ class Config:
             return 0
         return max(self.wedge_minutes, self.stale_minutes) * 60
 
+    @property
+    def prompt_kill_seconds(self) -> int:
+        """The unknown-dialog kill rung in seconds, floored at one minute
+        here as well as in `build()` so a Config assembled without it can
+        never kill a session on its first sighting."""
+        return max(1, self.prompt_kill_minutes) * 60
+
+    @property
+    def prompt_quiet_floor(self) -> int:
+        """`prompt_quiet_seconds` with the 30 s floor applied again (the
+        `wedge_seconds` contract: `build()` clamps, and so does the read)."""
+        return max(30, self.prompt_quiet_seconds)
+
+    @property
+    def prompt_answer_cap(self) -> int:
+        return max(1, self.prompt_max_answers)
+
     @property
     def janitor_grace_seconds(self) -> int:
         """How long an anchor must have been terminal before its workspace may
@@ -893,6 +986,14 @@ class Config:
             env_map, ENV_FLEET_VITALS,
             bool(raw.get("fleet_vitals_enabled", cls.fleet_vitals_enabled)),
         )
+        # The revert label's rail (issue #131): repos_source's shape -- a
+        # non-blank ALISSA_REVERT_LABEL wins, blank falls through.
+        revert_label = str(raw.get("revert_label", cls.revert_label))
+        env_revert_label = env_map.get(ENV_REVERT_LABEL, "").strip()
+        if env_revert_label:
+            revert_label = env_revert_label
+        if not revert_label.strip():
+            raise ValueError("revert_label must not be blank")
 
         bow_owners = normalize_bow_owners(raw.get("bow_owners", cls.bow_owners))
 
@@ -1014,6 +1115,47 @@ class Config:
             )
             wedge = stale
 
+        # The prompt responder's knobs (issue #127). The mode is an enum
+        # validated by NAME like foreign_session_policy (a typo must not read
+        # as "off"); the three numbers have FLOORS rather than 0-sentinels --
+        # none of them has a meaningful "off" value, and each floor is the
+        # smallest value that cannot answer a session that is merely between
+        # two tool calls -- and are clamped up with a warning, the wedge
+        # window's contract, because none of them is worth failing a boot.
+        prompt_mode = str(raw.get("prompt_responder", cls.prompt_responder)).strip()
+        if prompt_mode not in _PROMPT_MODES:
+            raise ValueError(
+                f"prompt_responder must be one of {sorted(_PROMPT_MODES)}, "
+                f"got {prompt_mode!r}"
+            )
+        prompt_quiet = int(raw.get("prompt_quiet_seconds", cls.prompt_quiet_seconds))
+        if prompt_quiet < 30:
+            log.warning(
+                "prompt_quiet_seconds=%d is below the 30 s floor — a shorter "
+                "window would read a session between two tool calls as "
+                "parked; clamping up to 30", prompt_quiet,
+            )
+            prompt_quiet = 30
+        prompt_kill = int(raw.get("prompt_kill_minutes", cls.prompt_kill_minutes))
+        if prompt_kill < 1:
+            log.warning(
+                "prompt_kill_minutes=%d is below the 1 min floor — the "
+                "unknown-dialog ladder needs at least one poll between the "
+                "dismissal and the kill; clamping up to 1", prompt_kill,
+            )
+            prompt_kill = 1
+        prompt_answers = int(raw.get("prompt_max_answers", cls.prompt_max_answers))
+        if prompt_answers < 1:
+            log.warning(
+                "prompt_max_answers=%d is below the floor of 1 — a cap of 0 "
+                "would kill every session on its first prompt; clamping up "
+                "to 1", prompt_answers,
+            )
+            prompt_answers = 1
+        waiting_dir = str(raw.get("waiting_dir", cls.waiting_dir)).strip()
+        if not waiting_dir:
+            raise ValueError("waiting_dir must be a non-empty path")
+
         # The janitor's grace, the reaper's sentinel one rung longer (0 = use
         # reap_grace_minutes). Negative is the only invalid value, and it is
         # the dangerous one: it would license reclaiming a workspace the
@@ -1106,10 +1248,20 @@ class Config:
             maintain_enabled=bool(
                 raw.get("maintain_enabled", cls.maintain_enabled)
             ),
+            revert_label=revert_label,
+            revert_enabled=bool(raw.get("revert_enabled", cls.revert_enabled)),
+            revert_any_author=bool(
+                raw.get("revert_any_author", cls.revert_any_author)
+            ),
             resume_enabled=bool(
                 raw.get("resume_enabled", cls.resume_enabled)
             ),
             wedge_minutes=wedge,
+            prompt_responder=prompt_mode,
+            prompt_quiet_seconds=prompt_quiet,
+            prompt_kill_minutes=prompt_kill,
+            prompt_max_answers=prompt_answers,
+            waiting_dir=waiting_dir,
             rerequest_enabled=bool(
                 raw.get("rerequest_enabled", cls.rerequest_enabled)
             ),

{alissa_tools_github_devloop-0.8.25 → alissa_tools_github_devloop-0.8.27}/src/main/alissa/tools/github/devloop/fleet_vitals.py

@@ -208,7 +208,7 @@ def build_snapshot(
     ledgers = sources.ledgers()
 
     repo_by_session: "dict[str, str]" = {}
-    for table in ("spawns", "fix_spawns", "maintain_spawns"):
+    for table in ("spawns", "fix_spawns", "maintain_spawns", "revert_spawns"):
         for row in ledgers[table]:
             session = row.get("session")
             if session and session not in repo_by_session:
@@ -243,6 +243,7 @@ def build_snapshot(
             int(latest.get("issue_candidates") or 0)
             + int(latest.get("pr_candidates") or 0)
             + int(latest.get("maintain_candidates") or 0)
+            + int(latest.get("revert_candidates") or 0)
         )
 
     drift = sources.drift()