Files
cleveragents-core/tools/controller/worker/opencode_session.py
T
drew 84da774212 fix(controller): batch M — post-Phase-1m adversarial review fixes
Three rounds of adversarial review (Chief Architect / Principal Dev /
Senior Test Engineer) on commits 3ca794be7..db12f45ac surfaced ~35
issues. This commit addresses 25+ across criticals, highs, and
mediums, and adds 40 new tests covering the changes plus key gaps the
review identified.

CRITICALS (M1):
- CA1: stale {role}_output.json from a prior attempt on the same
  per-PR workspace was readable as "fresh" output of the new attempt.
  agent_runner now unlinks the MCP-canonical path AND every fallback
  path BEFORE the session runs.
- CA2/PD5: opencode.json-registered MCP subprocesses persist across
  OpenCode sessions, but BuilderState was module-singleton. Added
  reset_for_new_attempt() + cross-session detection (compare
  identity.attempt_id) to every *_start; force-resets with WARN if
  prior attempt was interrupted (timeout / lost lock).
- PD3: inline-JSON callback could overwrite an MCP-written canonical
  V1 file with adapted-from-prose garbage. Callback now inspects
  existing files and skips when V1 is already present.
- PD4: FORGEJO_URL = .rstrip("/api/v1") is a character-set strip —
  catastrophic for hosts whose path contains /v1 in the middle.
  Replaced with explicit endswith()-based suffix strip.
- CA10: clone URL embedded $FORGEJO_TOKEN, persisted into
  .git/config where any agent could cat it. Token now sourced via
  local credential.helper at clone-time, URL kept clean.
- CA12: state.finalized was set BEFORE the file write, so disk-full
  / OSError left the agent unable to retry finalize. Reordered.

HIGHS (M2):
- CA3/PD12: output_path validation (NUL-byte rejection, must be
  absolute, parent-not-file check) in finalize_and_emit.
- CA6: ci_status_poll SELECT only considered implementer attempts;
  conflict_resolver also pushes commits. SQL now unions both roles.
- PD9: ci_status_poll could advance on a stale "resolved" SHA from a
  blocked attempt (whose head_sha_after == head_sha_before). Added
  outcome='resolved' filter.
- CA8: cancelled/stale CI states mapped to ci_red_retry_same_tier,
  burning pickup_count on healthy PRs. Both now wait (treated as
  operator/system action, not failure). timed_out stays red.
- TE9: unknown Forgejo CI states now WARN-log instead of silently
  being treated as pending — operators see new state strings.
- PD8: ci_status_poll event_type strings standardized to match the
  state-machine event names (ci_green / ci_red_retry_same_tier)
  instead of legacy ci-green / ci-red.
- CA7: inline-JSON callback now checks lost_lock_check BEFORE write
  so a file isn't staged after lock loss.
- PD10: atomic .tmp + os.replace writes in both MCP finalize and
  inline callback so the poller never sees a half-written file.
- PD16: inline_output_callback exceptions now re-raise as WorkerError
  instead of being silently logged (root cause was buried 30s later
  in a canonical-output timeout).
- CA9: WorkerConfig manual rebuild on --max-concurrent/--poll-interval
  silently dropped new fields. Use dataclasses.replace, matching
  round-4 P5 fix in master/__main__.py.

MEDIUMS (M3) — legacy_adapter quality upgrades:
- PD1: unrecognized confidence values now WARN instead of silently
  defaulting to "medium" — surfaces agent prompt drift.
- PD2: estimator recommended_tier clamped to {0,1,2} so an out-of-
  range int doesn't bypass the adapter's whole purpose.
- PD7: reviewer blocking_issues list-of-strings coerced into the
  list-of-BlockingIssue-dict shape strict_parse requires.
- PD13: conflict_resolver prompt defaults tier=1 + warns instead of
  raising; the scheduler always sets it but defends against drift.
- PD14: summarizer summary < 50 chars padded with a clear marker so
  strict_parse accepts it (and the truncation is visible).
- PD15: implementer blockers capped at 4096 chars each so a buggy
  agent can't blow up audit log / DB column.
- PD17: launch script accepts either FORGEJO_TOKEN or GITEA_TOKEN
  with a clear error if both are unset.
- PD22: conflict_resolver adapter accepts singular commit_sha
  fallback, matching implementer.
- CA4: every adapter invocation logs role + payload key fingerprint
  so operators can measure agent-migration progress.
- estimator + summarizer now have explicit _start tools (the prompts
  already referenced them; previously absent → first call would fail).

TESTS (M4) — added 40 tests in test_post_review_fixes.py:
- Cross-session MCP state reset (implementer + reviewer + estimator
  + summarizer; intra-session double-start still rejected).
- finalize_and_emit output_path precedence (arg > env > stdout),
  parent-dir creation, rejection of relative/NUL paths, failed-write
  leaves state retryable.
- legacy_adapter quality: tier clamping, blocker cap, non-string
  commit warning, blocking_issues string coercion, conflict_resolver
  full roundtrip + non-resolved head clearing, summarizer padding,
  confidence warning, V1-passthrough no-log.
- opencode.json registration parity: every MCP the prompts name is
  registered with the correct module path.
- Per-role prompts mention {role}_output.json (canonical poller path)
  + the "DO NOT emit chat-JSON" directive.
- FORGEJO_URL suffix-strip parametrized table.
- agent_runner stale-file cleanup: prior-attempt file is unlinked
  before a new session can read it as phantom output.

Also updated 2 pre-existing tests for the CA8 / PD8 / PD13 behavior
changes (cancelled→wait, event_type renaming, conflict_resolver
default-tier warning).

Total: 741 → 781 tests, 0 regressions.

DEFERRED (M5 follow-up — non-trial-blocking):
- CA5: head_sha verification via git cat-file (requires subprocess).
- CA11: discovery_interval_s wall-time cadence (vs iteration count).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-18 18:26:06 -04:00

211 lines
8.5 KiB
Python

"""OpenCode session adapter — wraps the existing
``_opencode_worker.run_session_blocking`` into the
``run_opencode_session`` protocol the controller's
``production_agent_runner`` expects.
Per plan v9: each attempt spawns a per-attempt MCP subprocess +
drives the LLM via OpenCode pointed at the matching agent. The
controller's responsibility is to map (role, tier) → agent name
and to build the prompt that tells the LLM "use the response-builder
MCP to construct your output."
Role-and-tier-to-agent mapping (matches existing pipeline names):
- implementer + tier 0 → task-implementor-tier-0
- implementer + tier 1 → task-implementor-tier-1
- implementer + tier 2 → task-implementor-tier-2
- reviewer → pr-review-worker
- estimator → estimator-implementation
- conflict_resolver → conflict-resolver-worker
- summarizer → controller-summarizer (new agent name; defined elsewhere)
This module is the wiring layer; the prompt-assembly logic itself
(turning input_payload + role into a worker-friendly text prompt
that instructs the LLM to use the MCP tools) lives in a follow-up
since it requires per-role prompt templates.
"""
from __future__ import annotations
import logging
import os
import sys
import time
from collections.abc import Callable
from pathlib import Path
from typing import Any
from .runner import WorkerError, WorkerLostLock
logger = logging.getLogger(__name__)
# Plan v9: role+tier → OpenCode agent name. Tier-aware for the
# implementer; flat for the rest.
def agent_name_for(role: str, tier: int | None) -> str:
if role == "implementer":
if tier is None:
raise ValueError("implementer role requires tier")
if tier not in {0, 1, 2}:
raise ValueError(f"invalid tier {tier!r}; must be 0/1/2")
return f"task-implementor-tier-{tier}"
if role == "reviewer":
return "pr-review-worker"
if role == "estimator":
return "estimator-implementation"
if role == "conflict_resolver":
return "conflict-resolver-worker"
if role == "summarizer":
return "controller-summarizer"
raise ValueError(f"unknown role {role!r}")
def _default_prompt_for(role: str, tier: int | None, input_payload: dict[str, Any]) -> str:
"""Per-role prompt builder; delegates to ``prompts.build_prompt``."""
from .prompts import build_prompt
return build_prompt(role, tier, input_payload)
# Default tier wallclock budgets (seconds). Per plan v9. Operator
# tunes via env at worker startup.
DEFAULT_TIER_TIMEOUT_S: dict[int | None, int] = {
0: int(os.environ.get("CONTROLLER_TIER_0_TIMEOUT_S", "600")),
1: int(os.environ.get("CONTROLLER_TIER_1_TIMEOUT_S", "1200")),
2: int(os.environ.get("CONTROLLER_TIER_2_TIMEOUT_S", "1800")),
None: int(os.environ.get("CONTROLLER_DEFAULT_AGENT_TIMEOUT_S", "600")),
}
def wire_opencode_session(
*,
opencode_server_url: str,
tag_prefix: str = "controller",
prompt_builder: Callable[[str, int | None, dict], str] | None = None,
run_session_blocking: Callable | None = None,
lost_lock_poll_interval_s: float = 5.0,
) -> Callable:
"""Returns a callable matching the production_agent_runner's
``run_opencode_session`` contract.
Args:
opencode_server_url: e.g. "http://localhost:4096".
tag_prefix: prefix for the OpenCode session title (operator-
visible in OpenCode's session list).
prompt_builder: function (role, tier, input_payload) → prompt
text. None uses the default ``_default_prompt_for``.
run_session_blocking: dependency-injection for the real
``_opencode_worker.run_session_blocking``. None uses the
real function. Tests inject a stub.
lost_lock_poll_interval_s: how often the OpenCode polling
callback checks lost_lock_check.
"""
if run_session_blocking is None:
# Lazy-import the real one. Done only when wire_opencode_session
# is called without an override (i.e., in production).
repo_root = Path(__file__).resolve().parents[3]
if str(repo_root) not in sys.path:
sys.path.insert(0, str(repo_root))
tools_dir = repo_root / "tools"
sys.path.insert(0, str(tools_dir))
from _opencode_worker import run_session_blocking as _real # type: ignore[import-not-found]
run_session_blocking = _real
builder = prompt_builder or _default_prompt_for
def run_opencode_session(
*, role: str, tier: int | None, input_payload: dict[str, Any],
mcp_process, attempt_id: int, instance_id: str,
lost_lock_check: Callable[[], bool],
inline_output_callback: Callable[[dict[str, Any]], None] | None = None,
) -> None:
"""The injected callable. Drives the OpenCode session +
propagates lost_lock_check via the on_poll callback."""
agent = agent_name_for(role, tier)
prompt = builder(role, tier, input_payload)
tag = f"{tag_prefix}-{role}-{attempt_id}"
timeout = DEFAULT_TIER_TIMEOUT_S.get(tier, DEFAULT_TIER_TIMEOUT_S[None])
# The on_poll hook lets us bail out early if the heartbeat
# thread detects the lock has been reaped. Polling happens
# every poll_interval_seconds inside run_session_blocking.
def on_poll() -> None:
if lost_lock_check():
# Raise so run_session_blocking unwinds; the runner
# catches WorkerLostLock and aborts silently.
raise WorkerLostLock(
f"lost lock for attempt {attempt_id} during OpenCode poll"
)
try:
result = run_session_blocking(
server_url=opencode_server_url,
agent=agent, tag=tag, prompt=prompt,
timeout_seconds=timeout,
poll_interval_seconds=lost_lock_poll_interval_s,
on_poll=on_poll,
)
except WorkerLostLock:
raise
except Exception as exc:
raise WorkerError(
f"OpenCode run_session_blocking raised: {exc}",
outcome="worker-internal-error",
) from exc
# Phase 1k++++ trial-path: harvest the inline JSON the agent
# emitted as its final response. Legacy pipeline agents emit a
# single JSON object as their final message; OpenCode worker
# extracts it into ``SessionResult.parsed_json``. Since
# Phase 1m the response-builder MCPs ARE registered in
# opencode.json, so this inline channel is a fallback for
# agents that still emit chat-JSON. The agent_runner's
# callback skips the write if the MCP already wrote
# canonical V1 to the same path.
#
# PD16: re-raise WorkerLostLock from the callback so the
# runner's outer handler aborts properly. Other exceptions are
# converted to WorkerError so they classify as
# ``worker-internal-error`` instead of silently letting the
# canonical poller time out 30s later with no root cause.
parsed = getattr(result, "parsed_json", None)
if parsed is not None and inline_output_callback is not None:
try:
inline_output_callback(parsed)
except WorkerLostLock:
raise
except Exception as exc:
raise WorkerError(
f"inline_output_callback raised: {exc}",
outcome="worker-internal-error",
) from exc
# Inspect SessionResult.status.
status = getattr(result, "status", None)
if status == "completed":
# MCP's finalize emitted to the canonical-output file;
# production_agent_runner reads it after we return.
return
if status == "timeout":
raise WorkerError(
f"OpenCode session timed out after {timeout}s",
outcome="worker-internal-error",
)
if status == "transport-error":
error_kind = getattr(result, "error_kind", "transport-error")
raise WorkerError(
f"OpenCode transport error: {error_kind}",
outcome="worker-internal-error",
)
# Unknown status — be defensive.
raise WorkerError(
f"OpenCode session returned unexpected status: {status!r}",
outcome="worker-internal-error",
)
return run_opencode_session
__all__ = [
"DEFAULT_TIER_TIMEOUT_S",
"agent_name_for",
"wire_opencode_session",
]