84da774212
Three rounds of adversarial review (Chief Architect / Principal Dev /
Senior Test Engineer) on commits 3ca794be7..db12f45ac surfaced ~35
issues. This commit addresses 25+ across criticals, highs, and
mediums, and adds 40 new tests covering the changes plus key gaps the
review identified.
CRITICALS (M1):
- CA1: stale {role}_output.json from a prior attempt on the same
per-PR workspace was readable as "fresh" output of the new attempt.
agent_runner now unlinks the MCP-canonical path AND every fallback
path BEFORE the session runs.
- CA2/PD5: opencode.json-registered MCP subprocesses persist across
OpenCode sessions, but BuilderState was module-singleton. Added
reset_for_new_attempt() + cross-session detection (compare
identity.attempt_id) to every *_start; force-resets with WARN if
prior attempt was interrupted (timeout / lost lock).
- PD3: inline-JSON callback could overwrite an MCP-written canonical
V1 file with adapted-from-prose garbage. Callback now inspects
existing files and skips when V1 is already present.
- PD4: FORGEJO_URL = .rstrip("/api/v1") is a character-set strip —
catastrophic for hosts whose path contains /v1 in the middle.
Replaced with explicit endswith()-based suffix strip.
- CA10: clone URL embedded $FORGEJO_TOKEN, persisted into
.git/config where any agent could cat it. Token now sourced via
local credential.helper at clone-time, URL kept clean.
- CA12: state.finalized was set BEFORE the file write, so disk-full
/ OSError left the agent unable to retry finalize. Reordered.
HIGHS (M2):
- CA3/PD12: output_path validation (NUL-byte rejection, must be
absolute, parent-not-file check) in finalize_and_emit.
- CA6: ci_status_poll SELECT only considered implementer attempts;
conflict_resolver also pushes commits. SQL now unions both roles.
- PD9: ci_status_poll could advance on a stale "resolved" SHA from a
blocked attempt (whose head_sha_after == head_sha_before). Added
outcome='resolved' filter.
- CA8: cancelled/stale CI states mapped to ci_red_retry_same_tier,
burning pickup_count on healthy PRs. Both now wait (treated as
operator/system action, not failure). timed_out stays red.
- TE9: unknown Forgejo CI states now WARN-log instead of silently
being treated as pending — operators see new state strings.
- PD8: ci_status_poll event_type strings standardized to match the
state-machine event names (ci_green / ci_red_retry_same_tier)
instead of legacy ci-green / ci-red.
- CA7: inline-JSON callback now checks lost_lock_check BEFORE write
so a file isn't staged after lock loss.
- PD10: atomic .tmp + os.replace writes in both MCP finalize and
inline callback so the poller never sees a half-written file.
- PD16: inline_output_callback exceptions now re-raise as WorkerError
instead of being silently logged (root cause was buried 30s later
in a canonical-output timeout).
- CA9: WorkerConfig manual rebuild on --max-concurrent/--poll-interval
silently dropped new fields. Use dataclasses.replace, matching
round-4 P5 fix in master/__main__.py.
MEDIUMS (M3) — legacy_adapter quality upgrades:
- PD1: unrecognized confidence values now WARN instead of silently
defaulting to "medium" — surfaces agent prompt drift.
- PD2: estimator recommended_tier clamped to {0,1,2} so an out-of-
range int doesn't bypass the adapter's whole purpose.
- PD7: reviewer blocking_issues list-of-strings coerced into the
list-of-BlockingIssue-dict shape strict_parse requires.
- PD13: conflict_resolver prompt defaults tier=1 + warns instead of
raising; the scheduler always sets it but defends against drift.
- PD14: summarizer summary < 50 chars padded with a clear marker so
strict_parse accepts it (and the truncation is visible).
- PD15: implementer blockers capped at 4096 chars each so a buggy
agent can't blow up audit log / DB column.
- PD17: launch script accepts either FORGEJO_TOKEN or GITEA_TOKEN
with a clear error if both are unset.
- PD22: conflict_resolver adapter accepts singular commit_sha
fallback, matching implementer.
- CA4: every adapter invocation logs role + payload key fingerprint
so operators can measure agent-migration progress.
- estimator + summarizer now have explicit _start tools (the prompts
already referenced them; previously absent → first call would fail).
TESTS (M4) — added 40 tests in test_post_review_fixes.py:
- Cross-session MCP state reset (implementer + reviewer + estimator
+ summarizer; intra-session double-start still rejected).
- finalize_and_emit output_path precedence (arg > env > stdout),
parent-dir creation, rejection of relative/NUL paths, failed-write
leaves state retryable.
- legacy_adapter quality: tier clamping, blocker cap, non-string
commit warning, blocking_issues string coercion, conflict_resolver
full roundtrip + non-resolved head clearing, summarizer padding,
confidence warning, V1-passthrough no-log.
- opencode.json registration parity: every MCP the prompts name is
registered with the correct module path.
- Per-role prompts mention {role}_output.json (canonical poller path)
+ the "DO NOT emit chat-JSON" directive.
- FORGEJO_URL suffix-strip parametrized table.
- agent_runner stale-file cleanup: prior-attempt file is unlinked
before a new session can read it as phantom output.
Also updated 2 pre-existing tests for the CA8 / PD8 / PD13 behavior
changes (cancelled→wait, event_type renaming, conflict_resolver
default-tier warning).
Total: 741 → 781 tests, 0 regressions.
DEFERRED (M5 follow-up — non-trial-blocking):
- CA5: head_sha verification via git cat-file (requires subprocess).
- CA11: discovery_interval_s wall-time cadence (vs iteration count).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
211 lines
8.5 KiB
Python
211 lines
8.5 KiB
Python
"""OpenCode session adapter — wraps the existing
|
|
``_opencode_worker.run_session_blocking`` into the
|
|
``run_opencode_session`` protocol the controller's
|
|
``production_agent_runner`` expects.
|
|
|
|
Per plan v9: each attempt spawns a per-attempt MCP subprocess +
|
|
drives the LLM via OpenCode pointed at the matching agent. The
|
|
controller's responsibility is to map (role, tier) → agent name
|
|
and to build the prompt that tells the LLM "use the response-builder
|
|
MCP to construct your output."
|
|
|
|
Role-and-tier-to-agent mapping (matches existing pipeline names):
|
|
- implementer + tier 0 → task-implementor-tier-0
|
|
- implementer + tier 1 → task-implementor-tier-1
|
|
- implementer + tier 2 → task-implementor-tier-2
|
|
- reviewer → pr-review-worker
|
|
- estimator → estimator-implementation
|
|
- conflict_resolver → conflict-resolver-worker
|
|
- summarizer → controller-summarizer (new agent name; defined elsewhere)
|
|
|
|
This module is the wiring layer; the prompt-assembly logic itself
|
|
(turning input_payload + role into a worker-friendly text prompt
|
|
that instructs the LLM to use the MCP tools) lives in a follow-up
|
|
since it requires per-role prompt templates.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import logging
|
|
import os
|
|
import sys
|
|
import time
|
|
from collections.abc import Callable
|
|
from pathlib import Path
|
|
from typing import Any
|
|
|
|
from .runner import WorkerError, WorkerLostLock
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
|
|
# Plan v9: role+tier → OpenCode agent name. Tier-aware for the
|
|
# implementer; flat for the rest.
|
|
def agent_name_for(role: str, tier: int | None) -> str:
|
|
if role == "implementer":
|
|
if tier is None:
|
|
raise ValueError("implementer role requires tier")
|
|
if tier not in {0, 1, 2}:
|
|
raise ValueError(f"invalid tier {tier!r}; must be 0/1/2")
|
|
return f"task-implementor-tier-{tier}"
|
|
if role == "reviewer":
|
|
return "pr-review-worker"
|
|
if role == "estimator":
|
|
return "estimator-implementation"
|
|
if role == "conflict_resolver":
|
|
return "conflict-resolver-worker"
|
|
if role == "summarizer":
|
|
return "controller-summarizer"
|
|
raise ValueError(f"unknown role {role!r}")
|
|
|
|
|
|
def _default_prompt_for(role: str, tier: int | None, input_payload: dict[str, Any]) -> str:
|
|
"""Per-role prompt builder; delegates to ``prompts.build_prompt``."""
|
|
from .prompts import build_prompt
|
|
return build_prompt(role, tier, input_payload)
|
|
|
|
|
|
# Default tier wallclock budgets (seconds). Per plan v9. Operator
|
|
# tunes via env at worker startup.
|
|
DEFAULT_TIER_TIMEOUT_S: dict[int | None, int] = {
|
|
0: int(os.environ.get("CONTROLLER_TIER_0_TIMEOUT_S", "600")),
|
|
1: int(os.environ.get("CONTROLLER_TIER_1_TIMEOUT_S", "1200")),
|
|
2: int(os.environ.get("CONTROLLER_TIER_2_TIMEOUT_S", "1800")),
|
|
None: int(os.environ.get("CONTROLLER_DEFAULT_AGENT_TIMEOUT_S", "600")),
|
|
}
|
|
|
|
|
|
def wire_opencode_session(
|
|
*,
|
|
opencode_server_url: str,
|
|
tag_prefix: str = "controller",
|
|
prompt_builder: Callable[[str, int | None, dict], str] | None = None,
|
|
run_session_blocking: Callable | None = None,
|
|
lost_lock_poll_interval_s: float = 5.0,
|
|
) -> Callable:
|
|
"""Returns a callable matching the production_agent_runner's
|
|
``run_opencode_session`` contract.
|
|
|
|
Args:
|
|
opencode_server_url: e.g. "http://localhost:4096".
|
|
tag_prefix: prefix for the OpenCode session title (operator-
|
|
visible in OpenCode's session list).
|
|
prompt_builder: function (role, tier, input_payload) → prompt
|
|
text. None uses the default ``_default_prompt_for``.
|
|
run_session_blocking: dependency-injection for the real
|
|
``_opencode_worker.run_session_blocking``. None uses the
|
|
real function. Tests inject a stub.
|
|
lost_lock_poll_interval_s: how often the OpenCode polling
|
|
callback checks lost_lock_check.
|
|
"""
|
|
if run_session_blocking is None:
|
|
# Lazy-import the real one. Done only when wire_opencode_session
|
|
# is called without an override (i.e., in production).
|
|
repo_root = Path(__file__).resolve().parents[3]
|
|
if str(repo_root) not in sys.path:
|
|
sys.path.insert(0, str(repo_root))
|
|
tools_dir = repo_root / "tools"
|
|
sys.path.insert(0, str(tools_dir))
|
|
from _opencode_worker import run_session_blocking as _real # type: ignore[import-not-found]
|
|
run_session_blocking = _real
|
|
|
|
builder = prompt_builder or _default_prompt_for
|
|
|
|
def run_opencode_session(
|
|
*, role: str, tier: int | None, input_payload: dict[str, Any],
|
|
mcp_process, attempt_id: int, instance_id: str,
|
|
lost_lock_check: Callable[[], bool],
|
|
inline_output_callback: Callable[[dict[str, Any]], None] | None = None,
|
|
) -> None:
|
|
"""The injected callable. Drives the OpenCode session +
|
|
propagates lost_lock_check via the on_poll callback."""
|
|
agent = agent_name_for(role, tier)
|
|
prompt = builder(role, tier, input_payload)
|
|
tag = f"{tag_prefix}-{role}-{attempt_id}"
|
|
timeout = DEFAULT_TIER_TIMEOUT_S.get(tier, DEFAULT_TIER_TIMEOUT_S[None])
|
|
|
|
# The on_poll hook lets us bail out early if the heartbeat
|
|
# thread detects the lock has been reaped. Polling happens
|
|
# every poll_interval_seconds inside run_session_blocking.
|
|
def on_poll() -> None:
|
|
if lost_lock_check():
|
|
# Raise so run_session_blocking unwinds; the runner
|
|
# catches WorkerLostLock and aborts silently.
|
|
raise WorkerLostLock(
|
|
f"lost lock for attempt {attempt_id} during OpenCode poll"
|
|
)
|
|
|
|
try:
|
|
result = run_session_blocking(
|
|
server_url=opencode_server_url,
|
|
agent=agent, tag=tag, prompt=prompt,
|
|
timeout_seconds=timeout,
|
|
poll_interval_seconds=lost_lock_poll_interval_s,
|
|
on_poll=on_poll,
|
|
)
|
|
except WorkerLostLock:
|
|
raise
|
|
except Exception as exc:
|
|
raise WorkerError(
|
|
f"OpenCode run_session_blocking raised: {exc}",
|
|
outcome="worker-internal-error",
|
|
) from exc
|
|
|
|
# Phase 1k++++ trial-path: harvest the inline JSON the agent
|
|
# emitted as its final response. Legacy pipeline agents emit a
|
|
# single JSON object as their final message; OpenCode worker
|
|
# extracts it into ``SessionResult.parsed_json``. Since
|
|
# Phase 1m the response-builder MCPs ARE registered in
|
|
# opencode.json, so this inline channel is a fallback for
|
|
# agents that still emit chat-JSON. The agent_runner's
|
|
# callback skips the write if the MCP already wrote
|
|
# canonical V1 to the same path.
|
|
#
|
|
# PD16: re-raise WorkerLostLock from the callback so the
|
|
# runner's outer handler aborts properly. Other exceptions are
|
|
# converted to WorkerError so they classify as
|
|
# ``worker-internal-error`` instead of silently letting the
|
|
# canonical poller time out 30s later with no root cause.
|
|
parsed = getattr(result, "parsed_json", None)
|
|
if parsed is not None and inline_output_callback is not None:
|
|
try:
|
|
inline_output_callback(parsed)
|
|
except WorkerLostLock:
|
|
raise
|
|
except Exception as exc:
|
|
raise WorkerError(
|
|
f"inline_output_callback raised: {exc}",
|
|
outcome="worker-internal-error",
|
|
) from exc
|
|
|
|
# Inspect SessionResult.status.
|
|
status = getattr(result, "status", None)
|
|
if status == "completed":
|
|
# MCP's finalize emitted to the canonical-output file;
|
|
# production_agent_runner reads it after we return.
|
|
return
|
|
if status == "timeout":
|
|
raise WorkerError(
|
|
f"OpenCode session timed out after {timeout}s",
|
|
outcome="worker-internal-error",
|
|
)
|
|
if status == "transport-error":
|
|
error_kind = getattr(result, "error_kind", "transport-error")
|
|
raise WorkerError(
|
|
f"OpenCode transport error: {error_kind}",
|
|
outcome="worker-internal-error",
|
|
)
|
|
# Unknown status — be defensive.
|
|
raise WorkerError(
|
|
f"OpenCode session returned unexpected status: {status!r}",
|
|
outcome="worker-internal-error",
|
|
)
|
|
|
|
return run_opencode_session
|
|
|
|
|
|
__all__ = [
|
|
"DEFAULT_TIER_TIMEOUT_S",
|
|
"agent_name_for",
|
|
"wire_opencode_session",
|
|
]
|