codex: expose auth broker pr preflight contract
This commit is contained in:
Codex
@@ -44,7 +44,7 @@ CLI 可以从 `master` 快速演进，但必须兼容 `deploy.json` 固定的 CI
|
||||
- `schedule list|get|runs|run|retry-run|delete|upsert-pgdata-backup` 管理 backend-core 定时任务和运行历史。`schedule list`、`schedule get`、`schedule runs --limit N` 和 `schedule runs <scheduleId> --limit N` 是只读观察入口；`schedule run`、`schedule retry-run`、`schedule delete` 和 `schedule upsert-pgdata-backup` 会触发运行或写入配置，生产恢复时必须有明确授权。`schedule runs --limit N` 是全局历史视图，返回 `scope=global` 和 `scheduleId=null`；`schedule runs <scheduleId> --limit N` 是指定 schedule 历史视图，返回 `scope=schedule` 和对应 `scheduleId`。CLI 必须拒绝 `schedule runs 50` 这类纯数字位置参数，并提示使用 `schedule runs --limit 50`，避免把空数组误判成“没有历史 run”。`schedule run <id> --wait-ms N` 触发同一 schedule，并且即使 wait 超时也必须返回 `newRunId` 和 `observeCommand`；`schedule retry-run <failedRunId>` 只接受 failed run，从原 run 反查 `scheduleId` 后重触发同一 schedule，并输出 `originalRunId`、`scheduleId`、`newRunId` 和 `observeCommand`。当 backend-core 目标容器缺失或只观察到 verify-only 容器时，schedule/microservice 命令必须以非零退出并返回 `failureKind=target-stack-not-running`、`runnerDisposition=infra-blocked`、`readOnlyCommands` 和 `authorizationRequiredForRecovery`，不得把 Docker 的 `No such container` 当成成功的空历史。
|
||||
- `codex deploy <commitId>` 是旧 Code Queue 兼容部署入口，已禁用以防止维护通道直连 D601 部署 Code Queue；当前 dev 自动化只做 `ci run-dev-e2e` smoke，不提供 Code Queue CD，详细规则见 `docs/reference/codex-deploy.md`。
|
||||
- `codex submit [prompt] [--prompt-file path|--prompt-stdin] [--queue queueId] [--provider-id id] [--cwd path] [--model model] [--reasoning-effort effort] [--execution-mode mode] [--max-attempts N] [--reference-task-id id] [--dry-run]` 通过 backend-core 私有代理向稳定 `code-queue` 用户服务路径提交任务；prompt 必须且只能来自位置参数、文件或 stdin 之一，`--dry-run` 只返回结构化请求且不实际入队。dry-run 会额外输出 `routingRecommendation`，包含推荐 route、runner、model、风险信号、prompt 自包含/issue 非唯一来源/prod-secret-DB 禁止/运行态或 release 禁止/证据要求/中等复杂度候选等 guard 状态；同时输出 `policyContract`，固定暴露 GPT-5.5、DeepSeek、MiniMax 的风险分层、并发上限和外部 provider 429 退避处置。该建议只用于指挥官 preflight，不会改写 payload，不改变 runtime admission，也不假设生产 MiniMax 或 DeepSeek 可用。提交确认和 dry-run 必须返回完整 prompt、字符数和 `truncated=false`，不能套用任务详情的预览截断策略，否则长任务 prompt 无法被人工验收。真实提交会经过本机本地串行化保护和短节流，避免同一指挥端并发 submit 把低内存主机或 `code-queue-mgr` 控制面打抖；返回值会附带 `submitConcurrencyGuard` 说明本次提交的锁与等待信息。backend-core 默认把提交、队列 CRUD、已读状态、历史摘要和轻量 Trace 读取分流到主 server `code-queue-mgr`，由它写入主 PostgreSQL；D601 scheduler 只轮询并执行已入库任务。
|
||||
- `codex pr-preflight [--remote] [--push-dry-run --push-dry-run-ref refs/heads/probe/<name>] [--pr-create-dry-run --pr-create-dry-run-head <head>] [--issue N] [--full]` 通过稳定 `code-queue` proxy 请求 D601 scheduler `/api/runtime-preflight`，用于 PR 型派单 admission。输出会压缩展示 scheduler/runner 的 token 覆盖、工具、agent port、Git worktree、GitHub egress、repo/issue/PR 只读探测、可选 push dry-run，以及可选 PR body/create dry-run guard；只报告 `GH_TOKEN`/`GITHUB_TOKEN` 是否存在和来源 key，不打印值。缺少 env token 时顶层 `ok=false`、`runnerDisposition=infra-blocked`，`tokenCoverage.missing` 同时列出 `GH_TOKEN` 与 `GITHUB_TOKEN`，并输出 `preflight.authBroker.source="broker/auth-broker-needed"`。`preflight.prCapabilityContract` 是 runner-facing 合同摘要，必须包含目标分支、token 来源 key、`systemGhBinaryRequiredForWrites=false`、UniDesk REST `bun scripts/cli.ts gh` 可用性、push dry-run/PR create dry-run 的 `writesRemote=false`、expected PR handoff 和 `gh pr merge` 的 `unsupported-command` 边界；系统 `gh` binary 缺失只进入 `tools.systemGhBinary`，不得误判为 UniDesk REST `gh` CLI 不可用。`--remote` 在 runner-like 环境里不再依赖本地 `unidesk-backend-core`、`unidesk-database`、`baidu-netdisk-backend` 容器存在；这些缺失只作为本地观测证据。若远程控制面可达，则继续走远程控制面结果；若远程控制面不可达，则结构化返回 `failureKind=control-plane-missing` / `degradedReason=remote-control-plane-unreachable`，而不是把本地 `backend-core-container-missing` 当作最终阻塞。`--pr-create-dry-run` 不 POST GitHub，只证明 runner 内 PR body 生成、`scripts/cli.ts gh pr create --dry-run` 和 branch 参数形态可用；服务端创建权限仍以 token auth、repo/issue/PR read、push dry-run 和最终授权后的真实 PR 创建结果为准。
|
||||
- `codex pr-preflight [--remote] [--push-dry-run --push-dry-run-ref refs/heads/probe/<name>] [--pr-create-dry-run --pr-create-dry-run-head <head>] [--issue N] [--full]` 通过稳定 `code-queue` proxy 请求 D601 scheduler `/api/runtime-preflight`，用于 PR 型派单 admission。输出会压缩展示 scheduler/runner 的 token 覆盖、Auth Broker source/capability/nextAction、工具、agent port、Git worktree、GitHub egress、repo/issue/PR 只读探测、可选 push dry-run，以及可选 PR body/create dry-run guard；只报告 `GH_TOKEN`/`GITHUB_TOKEN` 是否存在和来源 key，不打印值。当 auth-broker 配置存在时，`tokenCoverage.source="auth-broker"`、`credentialSource="broker-issued-token"` 且 runner env token 不是成功前提；当仅 env token 存在时，`credentialSource="env-token"` 且 `preflight.authBroker.nextAction="use-env-token-until-auth-broker-live"`；两者都缺失时顶层 `ok=false`、`runnerDisposition=infra-blocked`、`degradedReason=auth-broker-needed`，`tokenCoverage.missing` 同时列出 `GH_TOKEN` 与 `GITHUB_TOKEN`，并输出 `preflight.authBroker.source="broker/auth-broker-needed"`、`capability.source="missing-token"`。`preflight.prCapabilityContract` 是 runner-facing 合同摘要，必须包含目标分支、token/auth 来源、`systemGhBinaryRequiredForWrites=false`、UniDesk REST `bun scripts/cli.ts gh` 可用性、push dry-run/PR create dry-run 的 `writesRemote=false`、expected PR handoff、真实 PR 创建需要 commander 授权和 `gh pr merge` 的 `unsupported-command` 边界；系统 `gh` binary 缺失只进入 `tools.systemGhBinary`，不得误判为 UniDesk REST `gh` CLI 不可用。`--remote` 在 runner-like 环境里不再依赖本地 `unidesk-backend-core`、`unidesk-database`、`baidu-netdisk-backend` 容器存在；这些缺失只作为本地观测证据。若远程控制面可达，则继续走远程控制面结果；若远程控制面不可达，则结构化返回 `failureKind=control-plane-missing` / `degradedReason=remote-control-plane-unreachable`，而不是把本地 `backend-core-container-missing` 当作最终阻塞。`--pr-create-dry-run` 不 POST GitHub，只证明 runner 内 PR body 生成、`scripts/cli.ts gh pr create --dry-run` 和 branch 参数形态可用；服务端创建权限仍以 token/auth broker、repo/issue/PR read、push dry-run 和最终授权后的真实 PR 创建结果为准。
|
||||
- `codex task <taskId>` 通过 Code Queue 私有代理按任务 ID 查询结构化审阅摘要；默认只返回任务身份、执行 Provider、工作目录、attempt 计数、原始 prompt、最终 response、最后错误和渐进披露命令，适合指挥官审阅完成未读任务且避免上下文爆炸。需要旧式详细摘要时显式加 `--detail`；需要完整 prompt/response 文本时加 `--full`；需要工具调用、judge、attempt 全量摘要时使用 `--detail --full --tool-limit N`。该摘要读取默认由主 server `code-queue-mgr` 从 PostgreSQL 返回，不依赖 D601 `code-queue-read` Service 可用。
|
||||
- `codex tasks [--view supervisor|full] [--queue id] [--status succeeded|running|queued|failed|canceled|judging|retry_wait[,..]] [--unread|--unread-only] [--limit N] [--before-id id]` 通过同一私有代理输出渐进式披露视图。默认 `supervisor` 只返回 `running`、`completedUnread`、`recentCompleted`、`queued` 和 `executionDiagnostics` 摘要，不嵌入完整 Trace、final response 或全量 overview；每个条目都带 `commands.show`、`commands.trace`、`commands.output`、`commands.read` 和 `commands.full`。`--unread` 是 `--unread-only` 的别名，必须只保留未读终态；`--status` 必须真实过滤支持的状态，未知参数或未知状态必须结构化失败，不能静默忽略。需要完整当前页任务简表时显式使用 `--view full` 或 `--full`，仍受 `--limit` 和 `--before-id` 分页约束。
|
||||
- `codex task <taskId> --trace --tail|--from-start|--after-seq N|--before-seq N --limit N` 按页拉取 Code Queue 的逻辑 trace；响应会返回 `nextAfterSeq`、`previousBeforeSeq`、`hasMore`、`hasBefore` 和下一页/上一页命令，默认 `--trace` 取最新一页，且仍以分页 trace 为主；需要完整 prompt/最终 response 时加 `--full`，需要详细 task 摘要时加 `--detail`。
|
||||
|
||||
@@ -203,6 +203,10 @@ async function main(): Promise<void> {
|
||||
assertCondition(noTokenData.failureKind === "auth-missing", "missing token should classify as auth-missing", noTokenData);
|
||||
assertCondition(noTokenData.degradedReason === "broker-needed", "missing token should classify as broker-needed", noTokenData);
|
||||
assertCondition(noTokenData.brokerNeeded === true, "missing token should set brokerNeeded", noTokenData);
|
||||
const noTokenAuthBroker = noTokenData.authBroker as Record<string, unknown>;
|
||||
assertCondition(noTokenAuthBroker.source === "broker/auth-broker-needed", "missing broker endpoint should expose broker-needed auth source", noTokenAuthBroker);
|
||||
assertCondition(noTokenAuthBroker.capability === "missing-token", "missing broker endpoint should expose missing-token capability", noTokenAuthBroker);
|
||||
assertCondition(noTokenAuthBroker.nextAction === "configure-auth-broker", "missing broker endpoint should expose next action", noTokenAuthBroker);
|
||||
assertCondition(!noToken.stdout.includes("contract-secret-marker"), "missing-token response must not leak secret marker strings", noToken.stdout);
|
||||
|
||||
const brokerReady = await runCli([
|
||||
@@ -225,13 +229,19 @@ async function main(): Promise<void> {
|
||||
const readyData = dataOf(brokerReady.json ?? {});
|
||||
const tokenCoverage = readyData.tokenCoverage as Record<string, unknown>;
|
||||
const brokerCoverage = readyData.brokerCoverage as Record<string, unknown>;
|
||||
const readyAuthBroker = readyData.authBroker as Record<string, unknown>;
|
||||
const prCapability = readyData.prCapabilityContract as Record<string, unknown>;
|
||||
const brokerProxy = prCapability.brokerProxy as Record<string, unknown>;
|
||||
assertCondition(readyAuthBroker.source === "auth-broker", "ready auth broker source should be auth-broker", readyAuthBroker);
|
||||
assertCondition(readyAuthBroker.capability === "broker-issued-token", "ready auth broker capability should be broker-issued-token", readyAuthBroker);
|
||||
assertCondition(readyAuthBroker.nextAction === "use-auth-broker", "ready auth broker next action should use broker", readyAuthBroker);
|
||||
assertCondition(tokenCoverage.source === "auth-broker", "ready token coverage should come from broker", tokenCoverage);
|
||||
assertCondition(tokenCoverage.runnerEnvTokenRequired === false, "ready token coverage should not require runner env token", tokenCoverage);
|
||||
assertCondition(tokenCoverage.valuesPrinted === false, "ready token coverage must not print values", tokenCoverage);
|
||||
assertCondition(String(brokerCoverage.endpoint).includes("http://***:***@127.0.0.1:4291/?..."), "endpoint should be sanitized", brokerCoverage);
|
||||
assertCondition(prCapability.targetBranch === "master", "P0 capability should preserve target branch", prCapability);
|
||||
assertCondition(prCapability.authSource === "broker-issued-token", "P0 capability should expose broker-issued-token auth source", prCapability);
|
||||
assertCondition(prCapability.realPrCreateRequiresCommanderAuthorization === true, "real PR create should require commander authorization", prCapability);
|
||||
assertCondition(prCapability.preflightCreatesPr === false && prCapability.preflightMergesPr === false, "P0 PR preflight must not write or merge", prCapability);
|
||||
assertCondition(brokerProxy.writesRemote === false, "P0 broker proxy should not write remote", brokerProxy);
|
||||
assertCondition(Array.isArray(brokerProxy.operations) && brokerProxy.operations.includes("github.pr.create"), "P0 broker proxy should include PR create dry-run operation", brokerProxy);
|
||||
|
||||
@@ -189,6 +189,101 @@ function remoteControlPlaneResult(overrides: Partial<JsonRecord> = {}): JsonReco
|
||||
};
|
||||
}
|
||||
|
||||
function rawRuntimePreflightFixture(overrides: Partial<JsonRecord> = {}): JsonRecord {
|
||||
return {
|
||||
ok: true,
|
||||
checkedAt: "2026-05-20T00:00:00.000Z",
|
||||
cwd: "/workspace/unidesk",
|
||||
pid: 123,
|
||||
pullRequestDelivery: {
|
||||
ok: true,
|
||||
checkedAt: "2026-05-20T00:00:00.000Z",
|
||||
tools: {
|
||||
git: { ok: true, path: "/usr/bin/git", version: "git version 2.43.0" },
|
||||
gh: { ok: false, path: null, version: null },
|
||||
hub: { ok: false, path: null, version: null },
|
||||
jq: { ok: true, path: "/usr/bin/jq", version: "jq-1.7" },
|
||||
ssh: { ok: true, path: "/usr/bin/ssh", version: "OpenSSH_9.6" },
|
||||
curl: { ok: true, path: "/usr/bin/curl", version: "curl 8.5.0" },
|
||||
},
|
||||
unideskGhCli: { ok: true, path: "/workspace/unidesk/scripts/cli.ts", present: true },
|
||||
credentials: {
|
||||
ghTokenPresent: false,
|
||||
githubTokenPresent: false,
|
||||
ghHostsConfigPresent: false,
|
||||
gitCredentialsPresent: false,
|
||||
},
|
||||
authBroker: {
|
||||
ok: false,
|
||||
configured: false,
|
||||
source: "broker/auth-broker-needed",
|
||||
endpointEnvKey: null,
|
||||
runnerEnvTokenRequired: false,
|
||||
credentialSource: null,
|
||||
failureKind: "auth-missing",
|
||||
degradedReason: "auth-broker-needed",
|
||||
capability: {
|
||||
source: "missing-token",
|
||||
githubRestAuth: false,
|
||||
operations: ["github.auth.status", "github.issue.read", "github.pr.read", "github.pr.create"],
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
preflightWritesRemote: false,
|
||||
preflightCreatesPr: false,
|
||||
preflightMergesPr: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
nextAction: "configure-auth-broker-or-env-token",
|
||||
next: ["configure UNIDESK_AUTH_BROKER_URL or AUTH_BROKER_URL for broker-backed runner auth"],
|
||||
valuesRead: false,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
git: {
|
||||
insideWorktree: true,
|
||||
branch: "code-queue/issue-35-pr-dry-run-probe",
|
||||
head: "abc1234",
|
||||
originMaster: "def5678",
|
||||
remoteOrigin: "git@github.com:pikasTech/unidesk.git",
|
||||
home: "/root",
|
||||
homeWritable: true,
|
||||
knownHostsPresent: true,
|
||||
privateKeyPresent: true,
|
||||
},
|
||||
githubContext: {
|
||||
host: "github.com",
|
||||
apiBaseUrl: "https://api.github.com",
|
||||
repo: "pikasTech/unidesk",
|
||||
issueProbeNumber: 20,
|
||||
},
|
||||
egress: {
|
||||
proxy: {
|
||||
selectedProxyHost: "d601-provider-egress-proxy.unidesk.svc.cluster.local",
|
||||
selectedProxyPort: "18789",
|
||||
selectedProxyHostResolvable: true,
|
||||
},
|
||||
githubDefault: { command: "curl", args: ["-IsS", "https://github.com"], ok: true, exitCode: 0, signal: null, error: null, stdout: "", stderr: "" },
|
||||
apiDefault: { command: "curl", args: ["-IsS", "https://api.github.com"], ok: true, exitCode: 0, signal: null, error: null, stdout: "", stderr: "" },
|
||||
issueApi: null,
|
||||
},
|
||||
remote: {
|
||||
gitLsRemote: { command: "git", args: ["ls-remote", "--heads", "origin", "master"], ok: true, exitCode: 0, signal: null, error: null, stdout: "abc1234\trefs/heads/master\n", stderr: "" },
|
||||
gitHttpsLsRemote: null,
|
||||
githubSshAuthenticated: true,
|
||||
ghAuthStatus: null,
|
||||
ghRepoView: null,
|
||||
ghIssueView: null,
|
||||
ghPrReadOnly: null,
|
||||
},
|
||||
limitations: [],
|
||||
risks: [
|
||||
"system gh binary is missing; UniDesk REST gh CLI remains the supported PR create/comment path when scripts/cli.ts and GH_TOKEN/GITHUB_TOKEN or auth-broker are available",
|
||||
],
|
||||
},
|
||||
ports: {},
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
async function main(): Promise<void> {
|
||||
let observedLocalPath = "";
|
||||
const remoteFallback = await codexPrPreflightQueryForTest(["--remote", "--issue", "35"], {
|
||||
@@ -493,6 +588,137 @@ async function main(): Promise<void> {
|
||||
assertCondition(asRecord(dryRunPrContract.prCreateDryRun).writesRemote === false, "PR create dry-run must be marked non-writing", dryRunPrContract);
|
||||
assertCondition(asRecord(dryRunPrContract.prCreateDryRun).headBranch === "code-queue/issue-35-pr-dry-run-probe", "PR dry-run head should come from the option", dryRunPrContract);
|
||||
|
||||
const brokerIssuedContract = await codexPrPreflightQueryForTest(["--remote"], {
|
||||
config: null,
|
||||
coreFetch: () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
body: {
|
||||
runtimePreflight: rawRuntimePreflightFixture({
|
||||
pullRequestDelivery: {
|
||||
...asRecord(rawRuntimePreflightFixture().pullRequestDelivery),
|
||||
ok: true,
|
||||
authBroker: {
|
||||
ok: true,
|
||||
configured: true,
|
||||
source: "auth-broker",
|
||||
endpointEnvKey: "UNIDESK_AUTH_BROKER_URL",
|
||||
runnerEnvTokenRequired: false,
|
||||
credentialSource: "broker-held-github-credential",
|
||||
failureKind: null,
|
||||
degradedReason: null,
|
||||
capability: {
|
||||
source: "broker-issued-token",
|
||||
githubRestAuth: true,
|
||||
operations: ["github.auth.status", "github.issue.read", "github.pr.read", "github.pr.create"],
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
preflightWritesRemote: false,
|
||||
preflightCreatesPr: false,
|
||||
preflightMergesPr: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
nextAction: "use-auth-broker",
|
||||
next: ["keep PR preflight read-only; create a real PR only after commander authorization"],
|
||||
valuesRead: false,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
},
|
||||
}),
|
||||
},
|
||||
}),
|
||||
});
|
||||
const brokerIssuedRecord = asRecord(brokerIssuedContract);
|
||||
assertCondition(brokerIssuedRecord.ok === true, "broker-issued token branch should be ready", brokerIssuedRecord);
|
||||
const brokerIssuedPreflight = asRecord(brokerIssuedRecord.preflight);
|
||||
const brokerIssuedTokenCoverage = asRecord(brokerIssuedPreflight.tokenCoverage);
|
||||
const brokerIssuedAuthBroker = asRecord(brokerIssuedPreflight.authBroker);
|
||||
const brokerIssuedCapability = asRecord(brokerIssuedAuthBroker.capability);
|
||||
const brokerIssuedPrContract = asRecord(brokerIssuedPreflight.prCapabilityContract);
|
||||
assertCondition(brokerIssuedTokenCoverage.source === "auth-broker", "broker-issued branch should use auth-broker token coverage", brokerIssuedTokenCoverage);
|
||||
assertCondition(brokerIssuedTokenCoverage.credentialSource === "broker-issued-token", "broker-issued branch should expose broker-issued-token capability", brokerIssuedTokenCoverage);
|
||||
assertCondition(brokerIssuedAuthBroker.source === "auth-broker", "broker-issued branch should expose authBroker.source", brokerIssuedAuthBroker);
|
||||
assertCondition(brokerIssuedAuthBroker.nextAction === "use-auth-broker", "broker-issued branch should expose nextAction", brokerIssuedAuthBroker);
|
||||
assertCondition(brokerIssuedCapability.systemGhBinaryRequiredForWrites === false, "broker-issued branch should not require system gh binary", brokerIssuedCapability);
|
||||
assertCondition(brokerIssuedCapability.realPrCreateRequiresCommanderAuthorization === true, "real PR creation should still require commander authorization", brokerIssuedCapability);
|
||||
assertCondition(asRecord(brokerIssuedPrContract.authBroker).source === "auth-broker", "PR capability should include broker source", brokerIssuedPrContract);
|
||||
|
||||
const envTokenContract = await codexPrPreflightQueryForTest(["--remote"], {
|
||||
config: null,
|
||||
coreFetch: () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
body: {
|
||||
runtimePreflight: rawRuntimePreflightFixture({
|
||||
pullRequestDelivery: {
|
||||
...asRecord(rawRuntimePreflightFixture().pullRequestDelivery),
|
||||
ok: true,
|
||||
credentials: {
|
||||
ghTokenPresent: true,
|
||||
githubTokenPresent: false,
|
||||
ghHostsConfigPresent: false,
|
||||
gitCredentialsPresent: false,
|
||||
},
|
||||
authBroker: {
|
||||
ok: false,
|
||||
configured: false,
|
||||
source: "broker/auth-broker-needed",
|
||||
endpointEnvKey: null,
|
||||
runnerEnvTokenRequired: false,
|
||||
credentialSource: null,
|
||||
failureKind: "auth-missing",
|
||||
degradedReason: "auth-broker-needed",
|
||||
capability: {
|
||||
source: "missing-token",
|
||||
githubRestAuth: false,
|
||||
operations: ["github.auth.status", "github.issue.read", "github.pr.read", "github.pr.create"],
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
preflightWritesRemote: false,
|
||||
preflightCreatesPr: false,
|
||||
preflightMergesPr: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
nextAction: "configure-auth-broker-or-env-token",
|
||||
next: ["configure UNIDESK_AUTH_BROKER_URL or AUTH_BROKER_URL for broker-backed runner auth"],
|
||||
valuesRead: false,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
},
|
||||
}),
|
||||
},
|
||||
}),
|
||||
});
|
||||
const envTokenRecord = asRecord(envTokenContract);
|
||||
assertCondition(envTokenRecord.ok === true, "env token branch should be ready", envTokenRecord);
|
||||
const envTokenPreflight = asRecord(envTokenRecord.preflight);
|
||||
const envTokenCoverage = asRecord(envTokenPreflight.tokenCoverage);
|
||||
const envTokenAuthBroker = asRecord(envTokenPreflight.authBroker);
|
||||
assertCondition(envTokenCoverage.source === "GH_TOKEN", "env token branch should expose GH_TOKEN source", envTokenCoverage);
|
||||
assertCondition(envTokenCoverage.credentialSource === "env-token", "env token branch should expose env-token capability", envTokenCoverage);
|
||||
assertCondition(envTokenAuthBroker.source === "GH_TOKEN", "env token branch should not pretend broker is configured", envTokenAuthBroker);
|
||||
assertCondition(envTokenAuthBroker.nextAction === "use-env-token-until-auth-broker-live", "env token branch should still point at broker migration", envTokenAuthBroker);
|
||||
|
||||
const missingTokenContract = await codexPrPreflightQueryForTest(["--remote"], {
|
||||
config: null,
|
||||
coreFetch: () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
body: { runtimePreflight: rawRuntimePreflightFixture() },
|
||||
}),
|
||||
});
|
||||
const missingTokenRecord = asRecord(missingTokenContract);
|
||||
assertCondition(missingTokenRecord.ok === false, "missing-token branch should fail", missingTokenRecord);
|
||||
assertCondition(missingTokenRecord.failureKind === "auth-missing", "missing-token branch should classify auth-missing", missingTokenRecord);
|
||||
assertCondition(missingTokenRecord.degradedReason === "auth-broker-needed", "missing-token branch should expose broker-needed degraded reason", missingTokenRecord);
|
||||
const missingTokenPreflight = asRecord(missingTokenRecord.preflight);
|
||||
const missingTokenAuthBroker = asRecord(missingTokenPreflight.authBroker);
|
||||
const missingTokenCapability = asRecord(missingTokenAuthBroker.capability);
|
||||
assertCondition(missingTokenAuthBroker.source === "broker/auth-broker-needed", "missing-token branch should expose broker/auth-broker-needed", missingTokenAuthBroker);
|
||||
assertCondition(missingTokenAuthBroker.nextAction === "configure-auth-broker-or-env-token", "missing-token branch should expose nextAction", missingTokenAuthBroker);
|
||||
assertCondition(missingTokenCapability.source === "missing-token", "missing-token branch should expose missing-token capability", missingTokenCapability);
|
||||
assertCondition(missingTokenCapability.systemGhBinaryRequiredForWrites === false, "missing-token branch should still not require system gh binary for UniDesk gh CLI", missingTokenCapability);
|
||||
|
||||
process.stdout.write(`${JSON.stringify({
|
||||
ok: true,
|
||||
checks: [
|
||||
@@ -503,6 +729,7 @@ async function main(): Promise<void> {
|
||||
"proxy failures return proxy-gap",
|
||||
"git remote failures return git-remote-gap",
|
||||
"combined push/PR create dry-run contract stays read-only and separates system gh from UniDesk gh CLI",
|
||||
"broker-issued token, env-token, and missing-token branches expose authBroker source/capability/nextAction",
|
||||
],
|
||||
observedLocalPath,
|
||||
observedDryRunPath,
|
||||
|
||||
@@ -124,6 +124,17 @@ function brokerNeededResult(options: BrokerAdapterOptions): Record<string, unkno
|
||||
message: "No auth broker endpoint is configured for this dry-run contract; runner env token coverage is reported only for migration diagnostics.",
|
||||
tokenCoverage: runnerEnvTokenCoverage(),
|
||||
brokerCoverage: brokerCoverage(options.endpoint),
|
||||
authBroker: {
|
||||
ok: false,
|
||||
source: "broker/auth-broker-needed",
|
||||
capability: "missing-token",
|
||||
nextAction: "configure-auth-broker",
|
||||
runnerEnvTokenRequired: false,
|
||||
brokerIssuedTokenAvailable: false,
|
||||
valuesRead: false,
|
||||
valuesPrinted: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
},
|
||||
next: [
|
||||
"configure UNIDESK_AUTH_BROKER_URL or AUTH_BROKER_URL for broker-backed runner auth",
|
||||
"keep GH_TOKEN/GITHUB_TOKEN out of ordinary runner env once broker mode is enabled",
|
||||
@@ -185,6 +196,17 @@ function readyContract(options: BrokerAdapterOptions): Record<string, unknown> {
|
||||
dryRun: true,
|
||||
mutation: false,
|
||||
capabilities: [...DEFAULT_CAPABILITIES],
|
||||
authBroker: {
|
||||
ok: true,
|
||||
source: "auth-broker",
|
||||
capability: "broker-issued-token",
|
||||
nextAction: "use-auth-broker",
|
||||
runnerEnvTokenRequired: false,
|
||||
brokerIssuedTokenAvailable: true,
|
||||
valuesRead: false,
|
||||
valuesPrinted: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
},
|
||||
tokenCoverage: {
|
||||
ok: true,
|
||||
source: "auth-broker",
|
||||
@@ -199,9 +221,11 @@ function readyContract(options: BrokerAdapterOptions): Record<string, unknown> {
|
||||
prCapabilityContract: {
|
||||
targetBranch: options.base,
|
||||
headBranch: options.head,
|
||||
authSource: "broker-issued-token",
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
preflightCreatesPr: false,
|
||||
preflightMergesPr: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
brokerProxy: {
|
||||
ok: true,
|
||||
operations: ["github.auth.status", "github.issue.read", "github.pr.read", "github.pr.create"],
|
||||
|
||||
+113
-23
@@ -2418,6 +2418,51 @@ function compactUniDeskGhCliStatus(value: unknown): Record<string, unknown> {
|
||||
};
|
||||
}
|
||||
|
||||
function compactAuthBrokerRuntimeStatus(value: unknown): Record<string, unknown> {
|
||||
const broker = asRecord(value);
|
||||
const observed = broker !== null;
|
||||
const capability = asRecord(broker?.capability);
|
||||
const configured = broker?.configured === true || broker?.ok === true && broker?.source === "auth-broker";
|
||||
const operations = Array.isArray(capability?.operations)
|
||||
? capability.operations.map(String)
|
||||
: ["github.auth.status", "github.issue.read", "github.pr.read", "github.pr.create"];
|
||||
return {
|
||||
ok: configured,
|
||||
observed,
|
||||
configured,
|
||||
source: typeof broker?.source === "string" ? broker.source : configured ? "auth-broker" : "broker/auth-broker-needed",
|
||||
endpointEnvKey: typeof broker?.endpointEnvKey === "string" ? broker.endpointEnvKey : null,
|
||||
runnerEnvTokenRequired: broker?.runnerEnvTokenRequired === true,
|
||||
credentialSource: typeof broker?.credentialSource === "string" ? broker.credentialSource : configured ? "broker-held-github-credential" : null,
|
||||
failureKind: configured ? null : broker?.failureKind ?? "auth-missing",
|
||||
degradedReason: configured ? null : broker?.degradedReason ?? "auth-broker-needed",
|
||||
capability: {
|
||||
source: typeof capability?.source === "string" ? capability.source : configured ? "broker-issued-token" : "missing-token",
|
||||
githubRestAuth: capability?.githubRestAuth === true || configured,
|
||||
operations,
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
preflightWritesRemote: false,
|
||||
preflightCreatesPr: false,
|
||||
preflightMergesPr: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
nextAction: typeof broker?.nextAction === "string"
|
||||
? broker.nextAction
|
||||
: configured
|
||||
? "use-auth-broker"
|
||||
: "configure-auth-broker-or-env-token",
|
||||
next: Array.isArray(broker?.next) ? broker.next.map(String) : configured
|
||||
? ["keep PR preflight read-only; create a real PR only after commander authorization"]
|
||||
: [
|
||||
"configure UNIDESK_AUTH_BROKER_URL or AUTH_BROKER_URL for broker-backed runner auth",
|
||||
"or inject GH_TOKEN/GITHUB_TOKEN into the Code Queue scheduler runtime secret until broker mode is live",
|
||||
],
|
||||
valuesRead: false,
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
|
||||
function compactAgentPortStatus(value: unknown): Record<string, unknown> {
|
||||
const port = asRecord(value) ?? {};
|
||||
return {
|
||||
@@ -2428,43 +2473,80 @@ function compactAgentPortStatus(value: unknown): Record<string, unknown> {
|
||||
};
|
||||
}
|
||||
|
||||
function tokenCoverageStatus(credentials: Record<string, unknown>): Record<string, unknown> {
|
||||
function tokenCoverageStatus(credentials: Record<string, unknown>, authBroker: Record<string, unknown>): Record<string, unknown> {
|
||||
const ghTokenPresent = credentials.ghTokenPresent === true;
|
||||
const githubTokenPresent = credentials.githubTokenPresent === true;
|
||||
const anyEnvToken = ghTokenPresent || githubTokenPresent;
|
||||
const anyGhCredentialStore = credentials.ghHostsConfigPresent === true || credentials.gitCredentialsPresent === true;
|
||||
const authBrokerOk = authBroker.ok === true;
|
||||
const effective = authBrokerOk || anyEnvToken;
|
||||
const envSource = ghTokenPresent ? "GH_TOKEN" : githubTokenPresent ? "GITHUB_TOKEN" : null;
|
||||
return {
|
||||
ok: anyEnvToken,
|
||||
source: ghTokenPresent ? "GH_TOKEN" : githubTokenPresent ? "GITHUB_TOKEN" : null,
|
||||
ok: effective,
|
||||
source: authBrokerOk ? "auth-broker" : envSource,
|
||||
credentialSource: authBrokerOk ? "broker-issued-token" : anyEnvToken ? "env-token" : null,
|
||||
ghTokenPresent,
|
||||
githubTokenPresent,
|
||||
ghCredentialStorePresent: anyGhCredentialStore,
|
||||
runnerDisposition: anyEnvToken ? "ready" : "infra-blocked",
|
||||
missing: anyEnvToken ? [] : ["GH_TOKEN", "GITHUB_TOKEN"],
|
||||
scope: "scheduler-runner-env",
|
||||
note: anyEnvToken
|
||||
authBrokerPresent: authBrokerOk,
|
||||
authBrokerSource: authBroker.source ?? null,
|
||||
runnerEnvTokenRequired: !authBrokerOk,
|
||||
runnerDisposition: effective ? "ready" : "infra-blocked",
|
||||
missing: effective ? [] : ["GH_TOKEN", "GITHUB_TOKEN"],
|
||||
envMissing: anyEnvToken ? [] : ["GH_TOKEN", "GITHUB_TOKEN"],
|
||||
scope: authBrokerOk ? "broker-held-github-credential" : "scheduler-runner-env",
|
||||
note: authBrokerOk
|
||||
? "scheduler can use auth-broker for GitHub REST PR preflight without exposing GH_TOKEN/GITHUB_TOKEN to runner env"
|
||||
: anyEnvToken
|
||||
? "scheduler has a GitHub env token that can be forwarded to provider dev containers through CODE_QUEUE_REMOTE_CODEX_ENV_KEYS"
|
||||
: "scheduler is missing GH_TOKEN/GITHUB_TOKEN; provider dev containers cannot receive a GitHub token even though CODE_QUEUE_REMOTE_CODEX_ENV_KEYS includes those keys",
|
||||
: "scheduler is missing GH_TOKEN/GITHUB_TOKEN and auth-broker is not configured; provider dev containers cannot receive a GitHub token even though CODE_QUEUE_REMOTE_CODEX_ENV_KEYS includes those keys",
|
||||
};
|
||||
}
|
||||
|
||||
function authBrokerNeededStatus(tokenCoverage: Record<string, unknown>, systemGhBinary: Record<string, unknown>, unideskGhCli: Record<string, unknown>): Record<string, unknown> {
|
||||
function authBrokerNeededStatus(tokenCoverage: Record<string, unknown>, runtimeAuthBroker: Record<string, unknown>, systemGhBinary: Record<string, unknown>, unideskGhCli: Record<string, unknown>): Record<string, unknown> {
|
||||
const missing = Array.isArray(tokenCoverage.missing) ? tokenCoverage.missing.map(String) : [];
|
||||
const needed = tokenCoverage.ok !== true;
|
||||
const ready = tokenCoverage.ok === true;
|
||||
const authBrokerReady = tokenCoverage.source === "auth-broker";
|
||||
const needed = !ready;
|
||||
const capability = asRecord(runtimeAuthBroker.capability) ?? {};
|
||||
const capabilitySource = tokenCoverage.credentialSource ?? "missing-token";
|
||||
const nextAction = authBrokerReady
|
||||
? "use-auth-broker"
|
||||
: ready
|
||||
? "use-env-token-until-auth-broker-live"
|
||||
: "configure-auth-broker-or-env-token";
|
||||
return {
|
||||
ok: !needed,
|
||||
source: needed ? "broker/auth-broker-needed" : tokenCoverage.source ?? "runner-env-token",
|
||||
ok: ready,
|
||||
source: authBrokerReady ? "auth-broker" : needed ? "broker/auth-broker-needed" : tokenCoverage.source ?? "runner-env-token",
|
||||
needed,
|
||||
configured: false,
|
||||
configured: runtimeAuthBroker.configured === true,
|
||||
runnerDisposition: needed ? "infra-blocked" : "ready",
|
||||
failureKind: needed ? "auth-missing" : null,
|
||||
degradedReason: needed ? "auth-broker-needed" : null,
|
||||
runnerEnvTokenRequiredWithoutBroker: true,
|
||||
brokerCredentialSource: null,
|
||||
runnerEnvTokenRequiredWithoutBroker: !authBrokerReady,
|
||||
brokerCredentialSource: authBrokerReady ? runtimeAuthBroker.credentialSource ?? "broker-held-github-credential" : null,
|
||||
capability: {
|
||||
source: capabilitySource,
|
||||
githubRestAuth: ready,
|
||||
operations: Array.isArray(capability.operations)
|
||||
? capability.operations.map(String)
|
||||
: ["github.auth.status", "github.issue.read", "github.pr.read", "github.pr.create"],
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
unideskGhCliRequired: true,
|
||||
preflightWritesRemote: false,
|
||||
preflightCreatesPr: false,
|
||||
preflightMergesPr: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
nextAction,
|
||||
valuesPrinted: false,
|
||||
evidence: {
|
||||
envTokenMissing: needed,
|
||||
missing,
|
||||
authBrokerObserved: runtimeAuthBroker.observed ?? false,
|
||||
authBrokerConfigured: runtimeAuthBroker.configured ?? false,
|
||||
authBrokerSource: runtimeAuthBroker.source ?? null,
|
||||
systemGhBinaryOk: systemGhBinary.ok === true,
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
unideskGhCliObserved: unideskGhCli.observed ?? false,
|
||||
@@ -2474,10 +2556,12 @@ function authBrokerNeededStatus(tokenCoverage: Record<string, unknown>, systemGh
|
||||
},
|
||||
next: needed
|
||||
? [
|
||||
"inject GH_TOKEN or GITHUB_TOKEN into the Code Queue scheduler runtime secret",
|
||||
"or configure the planned auth-broker so PR preflight can use a broker-held GitHub credential without exposing runner env tokens",
|
||||
"configure UNIDESK_AUTH_BROKER_URL or AUTH_BROKER_URL so PR preflight can use a broker-held GitHub credential without exposing runner env tokens",
|
||||
"or inject GH_TOKEN/GITHUB_TOKEN into the Code Queue scheduler runtime secret until broker mode is live",
|
||||
]
|
||||
: [],
|
||||
: authBrokerReady
|
||||
? ["keep PR preflight read-only; create a real PR only after commander authorization"]
|
||||
: ["env token path is ready; Auth Broker is still needed before removing runner env GitHub credentials"],
|
||||
reference: "docs/reference/auth-broker.md#post-v1githubpr-preflight",
|
||||
};
|
||||
}
|
||||
@@ -2486,6 +2570,7 @@ function compactPrRuntimePreflight(preflight: Record<string, unknown>, options:
|
||||
const pull = asRecord(preflight.pullRequestDelivery) ?? {};
|
||||
const tools = asRecord(pull.tools) ?? {};
|
||||
const unideskGhCli = compactUniDeskGhCliStatus(pull.unideskGhCli);
|
||||
const authBrokerRuntime = compactAuthBrokerRuntimeStatus(pull.authBroker);
|
||||
const systemGhBinary = compactToolStatus(tools.gh);
|
||||
const credentials = asRecord(pull.credentials) ?? {};
|
||||
const git = asRecord(pull.git) ?? {};
|
||||
@@ -2494,7 +2579,7 @@ function compactPrRuntimePreflight(preflight: Record<string, unknown>, options:
|
||||
const proxy = asRecord(egress.proxy) ?? {};
|
||||
const remote = asRecord(pull.remote);
|
||||
const ports = asRecord(preflight.ports) ?? {};
|
||||
const tokenCoverage = tokenCoverageStatus(credentials);
|
||||
const tokenCoverage = tokenCoverageStatus(credentials, authBrokerRuntime);
|
||||
const limitations = Array.isArray(pull.limitations) ? pull.limitations.map(String) : [];
|
||||
const risks = Array.isArray(pull.risks) ? pull.risks.map(String) : [];
|
||||
const ok = preflight.ok === true && tokenCoverage.ok === true;
|
||||
@@ -2506,7 +2591,7 @@ function compactPrRuntimePreflight(preflight: Record<string, unknown>, options:
|
||||
? "proxy-gap"
|
||||
: null;
|
||||
const degradedReason = failureKind === "auth-missing"
|
||||
? "GH_TOKEN/GITHUB_TOKEN missing"
|
||||
? "auth-broker-needed"
|
||||
: failureKind === "git-remote-gap"
|
||||
? "git remote probe failed"
|
||||
: failureKind === "proxy-gap"
|
||||
@@ -2529,12 +2614,15 @@ function compactPrRuntimePreflight(preflight: Record<string, unknown>, options:
|
||||
pid: preflight.pid ?? null,
|
||||
},
|
||||
tokenCoverage,
|
||||
authBroker: authBrokerNeededStatus(tokenCoverage, systemGhBinary, unideskGhCli),
|
||||
authBroker: authBrokerNeededStatus(tokenCoverage, authBrokerRuntime, systemGhBinary, unideskGhCli),
|
||||
prCapabilityContract: {
|
||||
targetBranch,
|
||||
tokenSource: tokenCoverage.source,
|
||||
authSource: tokenCoverage.credentialSource,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
unideskGhCli,
|
||||
authBroker: authBrokerRuntime,
|
||||
pushDryRun: {
|
||||
requested: options.pushDryRun,
|
||||
ref: pushDryRunRef,
|
||||
@@ -2624,8 +2712,10 @@ function compactPrRuntimePreflight(preflight: Record<string, unknown>, options:
|
||||
risks,
|
||||
runnerDisposition: ok ? "ready" : "infra-blocked",
|
||||
recoveryHint: ok
|
||||
? "Runner PR workflow has env-token coverage for the scheduler."
|
||||
: "Inject GH_TOKEN or GITHUB_TOKEN into the Code Queue scheduler runtime secret for the target queue, then rerun this preflight before creating a PR.",
|
||||
? tokenCoverage.source === "auth-broker"
|
||||
? "Runner PR workflow has auth-broker coverage for GitHub REST preflight; real PR creation still requires commander authorization."
|
||||
: "Runner PR workflow has env-token coverage for the scheduler."
|
||||
: "Configure auth-broker or inject GH_TOKEN/GITHUB_TOKEN into the Code Queue scheduler runtime secret for the target queue, then rerun this preflight before creating a PR.",
|
||||
commands: {
|
||||
local: "bun scripts/cli.ts gh auth status --repo pikasTech/unidesk",
|
||||
runner: "bun scripts/cli.ts codex pr-preflight --remote",
|
||||
|
||||
@@ -66,6 +66,7 @@ export interface PullRequestDeliveryPreflight {
|
||||
checkedAt: string;
|
||||
tools: Record<string, RuntimeToolStatus>;
|
||||
unideskGhCli: UniDeskGhCliStatus;
|
||||
authBroker: RuntimeAuthBrokerStatus;
|
||||
credentials: {
|
||||
ghTokenPresent: boolean;
|
||||
githubTokenPresent: boolean;
|
||||
@@ -129,6 +130,32 @@ export interface PullRequestDeliveryPreflight {
|
||||
risks: string[];
|
||||
}
|
||||
|
||||
export interface RuntimeAuthBrokerStatus {
|
||||
ok: boolean;
|
||||
configured: boolean;
|
||||
source: "auth-broker" | "broker/auth-broker-needed";
|
||||
endpointEnvKey: string | null;
|
||||
runnerEnvTokenRequired: boolean;
|
||||
credentialSource: string | null;
|
||||
failureKind: "auth-missing" | null;
|
||||
degradedReason: "auth-broker-needed" | null;
|
||||
capability: {
|
||||
source: "broker-issued-token" | "missing-token";
|
||||
githubRestAuth: boolean;
|
||||
operations: string[];
|
||||
systemGhBinaryRequiredForWrites: false;
|
||||
preflightWritesRemote: false;
|
||||
preflightCreatesPr: false;
|
||||
preflightMergesPr: false;
|
||||
realPrCreateRequiresCommanderAuthorization: true;
|
||||
valuesPrinted: false;
|
||||
};
|
||||
nextAction: "use-auth-broker" | "configure-auth-broker-or-env-token";
|
||||
next: string[];
|
||||
valuesRead: false;
|
||||
valuesPrinted: false;
|
||||
}
|
||||
|
||||
export interface RuntimeToolStatus {
|
||||
name: string;
|
||||
ok: boolean;
|
||||
@@ -137,6 +164,9 @@ export interface RuntimeToolStatus {
|
||||
probe: RuntimeCommandProbe;
|
||||
}
|
||||
|
||||
const AUTH_BROKER_ENV_KEYS = ["UNIDESK_AUTH_BROKER_URL", "AUTH_BROKER_URL"] as const;
|
||||
const AUTH_BROKER_OPERATIONS = ["github.auth.status", "github.issue.read", "github.pr.read", "github.pr.create"] as const;
|
||||
|
||||
function redactSensitive(value: string): string {
|
||||
return value
|
||||
.replace(/gh[pousr]_[A-Za-z0-9_]{20,}/gu, "***")
|
||||
@@ -238,6 +268,48 @@ function boolEnv(name: string): boolean {
|
||||
return value !== undefined && value.trim().length > 0;
|
||||
}
|
||||
|
||||
function authBrokerEndpointEnvKey(): string | null {
|
||||
for (const key of AUTH_BROKER_ENV_KEYS) {
|
||||
if (boolEnv(key)) return key;
|
||||
}
|
||||
return null;
|
||||
}
|
||||
|
||||
function authBrokerStatus(): RuntimeAuthBrokerStatus {
|
||||
const endpointEnvKey = authBrokerEndpointEnvKey();
|
||||
const configured = endpointEnvKey !== null;
|
||||
return {
|
||||
ok: configured,
|
||||
configured,
|
||||
source: configured ? "auth-broker" : "broker/auth-broker-needed",
|
||||
endpointEnvKey,
|
||||
runnerEnvTokenRequired: false,
|
||||
credentialSource: configured ? "broker-held-github-credential" : null,
|
||||
failureKind: configured ? null : "auth-missing",
|
||||
degradedReason: configured ? null : "auth-broker-needed",
|
||||
capability: {
|
||||
source: configured ? "broker-issued-token" : "missing-token",
|
||||
githubRestAuth: configured,
|
||||
operations: [...AUTH_BROKER_OPERATIONS],
|
||||
systemGhBinaryRequiredForWrites: false,
|
||||
preflightWritesRemote: false,
|
||||
preflightCreatesPr: false,
|
||||
preflightMergesPr: false,
|
||||
realPrCreateRequiresCommanderAuthorization: true,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
nextAction: configured ? "use-auth-broker" : "configure-auth-broker-or-env-token",
|
||||
next: configured
|
||||
? ["keep PR preflight read-only; create a real PR only after commander authorization"]
|
||||
: [
|
||||
"configure UNIDESK_AUTH_BROKER_URL or AUTH_BROKER_URL for broker-backed runner auth",
|
||||
"or inject GH_TOKEN/GITHUB_TOKEN into the Code Queue scheduler runtime secret until broker mode is live",
|
||||
],
|
||||
valuesRead: false,
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
|
||||
function fileExistsProbe(path: string): boolean {
|
||||
return shellProbe(`test -s ${shellQuote(path)}`, 2000).ok;
|
||||
}
|
||||
@@ -420,6 +492,7 @@ function collectPullRequestDeliveryPreflight(options: RuntimePreflightOptions, c
|
||||
ghHostsConfigPresent: fileExistsProbe(`${home ?? "/root"}/.config/gh/hosts.yml`),
|
||||
gitCredentialsPresent: fileExistsProbe(`${home ?? "/root"}/.git-credentials`),
|
||||
};
|
||||
const authBroker = authBrokerStatus();
|
||||
const egressProxy = proxySummary();
|
||||
const issueUrl = issueApiUrl(githubApiBaseUrl, githubRepo, issueProbeNumber);
|
||||
const egress = {
|
||||
@@ -467,33 +540,48 @@ function collectPullRequestDeliveryPreflight(options: RuntimePreflightOptions, c
|
||||
const risks: string[] = [];
|
||||
if (!tools.git.ok) limitations.push("missing git CLI");
|
||||
if (!tools.jq.ok) limitations.push("missing jq CLI");
|
||||
if (!tools.gh.ok) risks.push("system gh binary is missing; UniDesk REST gh CLI remains the supported PR create/comment path when scripts/cli.ts and GH_TOKEN/GITHUB_TOKEN are available");
|
||||
if (!tools.gh.ok) risks.push("system gh binary is missing; UniDesk REST gh CLI remains the supported PR create/comment path when scripts/cli.ts and GH_TOKEN/GITHUB_TOKEN or auth-broker are available");
|
||||
if (!unideskGhCli.ok) limitations.push("UniDesk gh CLI is missing at scripts/cli.ts; runner cannot use the repo-native REST PR create/comment path");
|
||||
if (!credentials.ghTokenPresent && !credentials.githubTokenPresent) limitations.push("GH_TOKEN/GITHUB_TOKEN is not present; gh cannot create PRs unless another gh credential store is mounted");
|
||||
if (!credentials.ghHostsConfigPresent && !credentials.gitCredentialsPresent && !credentials.ghTokenPresent && !credentials.githubTokenPresent) limitations.push("no gh hosts config, git credentials file, GH_TOKEN, or GITHUB_TOKEN is visible for GitHub API/issue/PR access");
|
||||
if (!credentials.ghTokenPresent && !credentials.githubTokenPresent && !authBroker.ok) limitations.push("GH_TOKEN/GITHUB_TOKEN is not present and auth-broker is not configured; PR create requires broker, env token, or another gh credential store");
|
||||
if (!credentials.ghHostsConfigPresent && !credentials.gitCredentialsPresent && !credentials.ghTokenPresent && !credentials.githubTokenPresent && !authBroker.ok) limitations.push("no auth-broker, gh hosts config, git credentials file, GH_TOKEN, or GITHUB_TOKEN is visible for GitHub API/issue/PR access");
|
||||
if (!gitInfo.insideWorktree) limitations.push("current directory is not a Git worktree");
|
||||
if (gitInfo.remoteOrigin === null) limitations.push("git remote origin is not configured");
|
||||
if (githubRepo === null) limitations.push("cannot infer GitHub owner/repo from GH_REPO or git remote origin");
|
||||
if (!gitInfo.homeWritable) limitations.push("HOME is not writable");
|
||||
if (!gitInfo.knownHostsPresent) risks.push("GitHub known_hosts is not pre-seeded; first SSH use may need accept-new behavior");
|
||||
if (!gitInfo.privateKeyPresent && !credentials.sshAuthSockPresent && !credentials.ghTokenPresent && !credentials.githubTokenPresent) limitations.push("no SSH key, SSH agent, or GitHub token credential is visible");
|
||||
if (!gitInfo.privateKeyPresent && !credentials.sshAuthSockPresent && !credentials.ghTokenPresent && !credentials.githubTokenPresent && !authBroker.ok) limitations.push("no SSH key, SSH agent, GitHub token credential, or auth-broker credential is visible");
|
||||
if (egress.proxy.selectedProxyHost !== null && egress.proxy.selectedProxyHostResolvable === false) limitations.push(`configured GitHub egress proxy host is not resolvable: ${egress.proxy.selectedProxyHost}`);
|
||||
if (options.includeRemote === true && !egress.githubDefault.ok) limitations.push("GitHub HTTPS probe failed with the default environment/proxy");
|
||||
if (options.includeRemote === true && !egress.apiDefault.ok) limitations.push("GitHub API probe failed with the default environment/proxy");
|
||||
if (options.includeRemote === true && egress.issueApi !== null && !egress.issueApi.ok) limitations.push(`GitHub issue API probe for #${issueProbeNumber} failed; private repo access likely lacks token or egress`);
|
||||
if (options.includeRemote === true && egress.issueApi !== null && !egress.issueApi.ok) {
|
||||
if (authBroker.ok) risks.push(`direct GitHub issue API probe for #${issueProbeNumber} failed without runner env token; auth-broker is the intended REST auth source`);
|
||||
else limitations.push(`GitHub issue API probe for #${issueProbeNumber} failed; private repo access likely lacks token or egress`);
|
||||
}
|
||||
if (remote !== undefined) {
|
||||
if (!remote.gitLsRemote.ok) limitations.push("git ls-remote origin master failed");
|
||||
if (remote.gitHttpsLsRemote !== null && !remote.gitHttpsLsRemote.ok) limitations.push("anonymous HTTPS git ls-remote failed; HTTPS Git access likely needs token credentials");
|
||||
if (!remote.githubSshAuthenticated) limitations.push("GitHub SSH auth probe did not authenticate");
|
||||
if (remote.ghAuthStatus !== null && !remote.ghAuthStatus.ok) limitations.push("gh auth status failed");
|
||||
if (tools.gh.ok && remote.ghRepoView !== null && !remote.ghRepoView.ok) limitations.push("gh repo view failed");
|
||||
if (tools.gh.ok && remote.ghIssueView !== null && !remote.ghIssueView.ok) limitations.push(`gh issue read|view #${issueProbeNumber} failed`);
|
||||
if (tools.gh.ok && remote.ghPrReadOnly !== null && !remote.ghPrReadOnly.ok) limitations.push("gh pr read-only probe failed");
|
||||
if (remote.ghAuthStatus !== null && !remote.ghAuthStatus.ok) {
|
||||
if (authBroker.ok) risks.push("system gh auth status failed; broker-backed UniDesk REST path remains the intended PR preflight auth source");
|
||||
else limitations.push("gh auth status failed");
|
||||
}
|
||||
if (tools.gh.ok && remote.ghRepoView !== null && !remote.ghRepoView.ok) {
|
||||
if (authBroker.ok) risks.push("system gh repo view failed; broker-backed UniDesk REST path remains the intended repo read path");
|
||||
else limitations.push("gh repo view failed");
|
||||
}
|
||||
if (tools.gh.ok && remote.ghIssueView !== null && !remote.ghIssueView.ok) {
|
||||
if (authBroker.ok) risks.push(`system gh issue read|view #${issueProbeNumber} failed; broker-backed UniDesk REST path remains the intended issue read path`);
|
||||
else limitations.push(`gh issue read|view #${issueProbeNumber} failed`);
|
||||
}
|
||||
if (tools.gh.ok && remote.ghPrReadOnly !== null && !remote.ghPrReadOnly.ok) {
|
||||
if (authBroker.ok) risks.push("system gh pr read-only probe failed; broker-backed UniDesk REST path remains the intended PR read path");
|
||||
else limitations.push("gh pr read-only probe failed");
|
||||
}
|
||||
}
|
||||
if (pushDryRun !== undefined && !pushDryRun.ok) limitations.push("git push --dry-run failed for probe branch");
|
||||
if (prCreateDryRun !== undefined && !prCreateDryRun.ok) limitations.push("PR create dry-run body/command guard failed");
|
||||
const prCliReady = unideskGhCli.ok;
|
||||
const tokenOrGhStore = credentials.ghTokenPresent || credentials.githubTokenPresent || credentials.ghHostsConfigPresent || (remote?.ghAuthStatus?.ok === true);
|
||||
const tokenOrGhStore = authBroker.ok || credentials.ghTokenPresent || credentials.githubTokenPresent || credentials.ghHostsConfigPresent || (remote?.ghAuthStatus?.ok === true);
|
||||
const remoteReady = remote === undefined || (egress.githubDefault.ok && egress.apiDefault.ok && remote.gitLsRemote.ok && remote.githubSshAuthenticated);
|
||||
const pushReady = pushDryRun === undefined || pushDryRun.ok;
|
||||
const prCreateDryRunReady = prCreateDryRun === undefined || prCreateDryRun.ok;
|
||||
@@ -502,6 +590,7 @@ function collectPullRequestDeliveryPreflight(options: RuntimePreflightOptions, c
|
||||
checkedAt,
|
||||
tools,
|
||||
unideskGhCli,
|
||||
authBroker,
|
||||
credentials,
|
||||
githubContext: {
|
||||
host: githubHost,
|
||||
|
||||
Reference in New Issue
Block a user