@abelxiaoxing/cadence 1.0.12 → 1.0.13

package/src/safe-path.ts

@@ -0,0 +1,66 @@
+import { lstatSync } from "node:fs";
+import path from "node:path";
+
+import { isValidRelativePath } from "./contracts.ts";
+
+export type SafePathObservation =
+  | { kind: "file" }
+  | { kind: "directory" }
+  | { kind: "absent" }
+  | {
+      kind: "unsafe";
+      reason:
+        | "invalid-path"
+        | "root-unavailable"
+        | "path-unavailable"
+        | "symlink"
+        | "parent-not-directory"
+        | "special-file";
+    };
+
+export function observeSafePath(
+  root: string,
+  relative: string,
+): SafePathObservation {
+  if (!isValidRelativePath(relative)) {
+    return { kind: "unsafe", reason: "invalid-path" };
+  }
+  try {
+    const resolvedRoot = path.resolve(root);
+    const rootStat = lstatSync(resolvedRoot, { throwIfNoEntry: false });
+    if (!rootStat?.isDirectory() || rootStat.isSymbolicLink()) {
+      return { kind: "unsafe", reason: "root-unavailable" };
+    }
+    if (relative === ".") return { kind: "directory" };
+
+    let current = resolvedRoot;
+    const parts = relative.split("/");
+    for (const [index, part] of parts.entries()) {
+      current = path.join(current, part);
+      if (!current.startsWith(`${resolvedRoot}${path.sep}`)) {
+        return { kind: "unsafe", reason: "invalid-path" };
+      }
+      const stat = lstatSync(current, { throwIfNoEntry: false });
+      if (!stat) return { kind: "absent" };
+      if (stat.isSymbolicLink()) {
+        return { kind: "unsafe", reason: "symlink" };
+      }
+      if (index < parts.length - 1) {
+        if (!stat.isDirectory()) {
+          return { kind: "unsafe", reason: "parent-not-directory" };
+        }
+        continue;
+      }
+      if (stat.isFile()) return { kind: "file" };
+      if (stat.isDirectory()) return { kind: "directory" };
+      return { kind: "unsafe", reason: "special-file" };
+    }
+  } catch {
+    return { kind: "unsafe", reason: "path-unavailable" };
+  }
+  return { kind: "unsafe", reason: "invalid-path" };
+}
+
+export function isSafeRegularFile(root: string, relative: string): boolean {
+  return observeSafePath(root, relative).kind === "file";
+}

package/src/submit-tool.ts

@@ -4,6 +4,8 @@ import {
   type CandidateFailure,
   type DiffResult,
   type EvidenceResult,
+  type SubmitFinalCategory,
+  type SubmitSchemaState,
   validateDiffResult,
   validateEvidenceResult,
 } from "./contracts.ts";
@@ -74,12 +76,7 @@ const diffSchema = Type.Object({
   contractCompliant: Type.Literal(true),
 });
 
-export type FinalCategory =
-  | "no-final-assistant"
-  | "text-only"
-  | "mixed"
-  | "multiple-submit"
-  | "single-submit-only";
+export type FinalCategory = SubmitFinalCategory;
 
 export interface IdentityOutcome {
   request: boolean;
@@ -91,7 +88,7 @@ export interface IdentityOutcome {
 export interface SubmitClassification {
   finalCategory: FinalCategory;
   attempts: number;
-  schema: "valid" | "invalid";
+  schema: SubmitSchemaState;
   identity: IdentityOutcome;
 }
 
@@ -105,7 +102,7 @@ export function createSubmitTool(input: {
   let submitted: EvidenceResult | DiffResult | undefined;
   let failure: CandidateFailure | undefined;
   let attempts = 0;
-  let schema: "valid" | "invalid" = "invalid";
+  let schema: SubmitSchemaState = "not-submitted";
   const identity: IdentityOutcome = {
     request: true,
     role: true,
@@ -134,7 +131,11 @@ export function createSubmitTool(input: {
         identity.task = false;
         identity.phase = false;
         schema = "invalid";
-        failure = { kind: "artifact", code: "invalid-structural-result" };
+        failure = {
+          kind: "artifact",
+          code: "invalid-structural-result",
+          stage: "structural-submit",
+        };
         throw new Error("submitted result is not an object");
       }
       if (value.id !== input.requestId) identity.request = false;
@@ -158,15 +159,27 @@ export function createSubmitTool(input: {
       const matches =
         identity.request && identity.role && identity.task && identity.phase;
       if (!validation.ok || !matches) {
-        failure =
-          validation.failure ??
-          ({ kind: "artifact", code: "invalid-structural-result" } as const);
+        failure = validation.ok
+          ? {
+              kind: "artifact",
+              code: "structural-identity-mismatch",
+              stage: "structural-submit",
+            }
+          : (validation.failure ?? {
+              kind: "artifact",
+              code: "invalid-structural-result",
+              stage: "structural-submit",
+            });
         throw new Error(
           validation.reason ?? "submitted result identity does not match",
         );
       }
       if (submitted) {
-        failure = { kind: "artifact", code: "invalid-structural-result" };
+        failure = {
+          kind: "artifact",
+          code: "invalid-structural-result",
+          stage: "structural-submit",
+        };
         throw new Error("duplicate structural submission");
       }
       submitted = structuredClone(value) as unknown as

package/src/verification-capability.ts

@@ -2,12 +2,13 @@ import { lstatSync, readFileSync, realpathSync } from "node:fs";
 import path from "node:path";
 import {
   type AtomicVerificationContract,
-  isValidRelativePath,
+  type StructuredVerificationContract,
   type VerificationAdapterCode,
   validateVerificationContract,
   verificationInputPaths,
   verificationSteps,
 } from "./contracts.ts";
+import { isSafeRegularFile, observeSafePath } from "./safe-path.ts";
 
 export type VerificationCapabilityDiagnostic =
   | {
@@ -37,11 +38,6 @@ export interface VerificationRunnerBinding {
   mountSource?: string;
 }
 
-export interface VerificationReadiness {
-  taskContractsExecutable: boolean;
-  diagnostics: VerificationCapabilityDiagnostic[];
-}
-
 const SHELL_OPERATOR = /[;&|`$<>\n\r\0]/u;
 const SIMPLE_TOKEN =
   /^(?:[a-z0-9][a-z0-9._:@/=-]*|--?[a-z0-9][a-z0-9._:@/=-]*)$/iu;
@@ -88,18 +84,9 @@ function fileStatus(
   root: string,
   relative: string,
 ): "regular" | "absent" | "unsafe" {
-  if (!isValidRelativePath(relative)) return "unsafe";
-  const resolvedRoot = path.resolve(root);
-  const absolute = path.resolve(resolvedRoot, relative);
-  if (
-    absolute === resolvedRoot ||
-    !absolute.startsWith(`${resolvedRoot}${path.sep}`)
-  ) {
-    return "unsafe";
-  }
-  const stat = lstatSync(absolute, { throwIfNoEntry: false });
-  if (!stat) return "absent";
-  return stat.isFile() && !stat.isSymbolicLink() ? "regular" : "unsafe";
+  const observation = observeSafePath(root, relative);
+  if (observation.kind === "file") return "regular";
+  return observation.kind === "absent" ? "absent" : "unsafe";
 }
 
 function regularFile(root: string, relative: string): boolean {
@@ -287,7 +274,7 @@ function validatePackageScript(
   verificationId: string,
   packageManager: string,
   script: string,
-  approvedCommand?: string,
+  approvedCommand: string,
   dependencyOwner = root,
 ): VerificationCapabilityResult {
   const packageRunner = resolveVerificationRunner(packageManager);
@@ -311,7 +298,7 @@ function validatePackageScript(
       `package.json script ${script} is missing`,
     );
   }
-  if (approvedCommand !== undefined && actual !== approvedCommand) {
+  if (actual !== approvedCommand) {
     return adapterFailure(
       verificationId,
       "script-command-mismatch",
@@ -336,21 +323,7 @@ function validateAtomicCapability(
   root: string,
   step: AtomicVerificationContract,
   dependencyOwner: string,
-  allowedMissingInputs: ReadonlySet<string>,
 ): VerificationCapabilityResult {
-  for (const input of verificationInputPaths(step)) {
-    const status = fileStatus(root, input);
-    if (
-      status !== "regular" &&
-      !(status === "absent" && allowedMissingInputs.has(input))
-    ) {
-      return adapterFailure(
-        step.id,
-        "input-missing",
-        `verification input ${input} is missing or unsafe`,
-      );
-    }
-  }
   if (step.kind === "package-script") {
     return validatePackageScript(
       root,
@@ -419,8 +392,24 @@ export function validateVerificationCapability(
   value: unknown,
   options: {
     dependencyOwner?: string;
-    allowedMissingInputs?: readonly string[];
   } = {},
+): VerificationCapabilityResult {
+  return validateCapability(root, value, options, true);
+}
+
+export function validateVerificationAdapterCapability(
+  root: string,
+  value: unknown,
+  options: { dependencyOwner?: string } = {},
+): VerificationCapabilityResult {
+  return validateCapability(root, value, options, false);
+}
+
+function validateCapability(
+  root: string,
+  value: unknown,
+  options: { dependencyOwner?: string },
+  requireInputAvailability: boolean,
 ): VerificationCapabilityResult {
   const validation = validateVerificationContract(value);
   if (!validation.ok) {
@@ -442,40 +431,36 @@ export function validateVerificationCapability(
     };
   }
   const dependencyOwner = options.dependencyOwner ?? root;
-  const allowedMissingInputs = new Set(options.allowedMissingInputs ?? []);
+  return validateAcceptedVerificationCapability(
+    root,
+    validation.value,
+    dependencyOwner,
+    requireInputAvailability,
+  );
+}
+
+function validateAcceptedVerificationCapability(
+  root: string,
+  verification: StructuredVerificationContract,
+  dependencyOwner: string,
+  requireInputAvailability: boolean,
+): VerificationCapabilityResult {
+  if (requireInputAvailability) {
+    for (const input of verificationInputPaths(verification)) {
+      if (!isSafeRegularFile(root, input)) {
+        return adapterFailure(
+          verification.id,
+          "input-missing",
+          `verification input ${input} is missing or unsafe`,
+        );
+      }
+    }
+  }
   const runnerBindings: VerificationRunnerBinding[] = [];
-  for (const step of verificationSteps(validation.value)) {
-    const capability = validateAtomicCapability(
-      root,
-      step,
-      dependencyOwner,
-      allowedMissingInputs,
-    );
+  for (const step of verificationSteps(verification)) {
+    const capability = validateAtomicCapability(root, step, dependencyOwner);
     if (!capability.ok) return capability;
     runnerBindings.push(...capability.runnerBindings);
   }
-  return capabilitySuccess(validation.value.id, runnerBindings);
-}
-
-export function assessVerificationReadiness(
-  root: string,
-  contracts: readonly unknown[],
-  options: {
-    dependencyOwner?: string;
-    allowedMissingInputs?: readonly string[];
-  } = {},
-): VerificationReadiness {
-  const diagnostics = contracts
-    .map((contract) => validateVerificationCapability(root, contract, options))
-    .filter(
-      (
-        result,
-      ): result is Extract<VerificationCapabilityResult, { ok: false }> =>
-        !result.ok,
-    )
-    .map((result) => result.diagnostic);
-  return {
-    taskContractsExecutable: diagnostics.length === 0,
-    diagnostics,
-  };
+  return capabilitySuccess(verification.id, runnerBindings);
 }

package/src/worker.ts

@@ -3,6 +3,7 @@
 import type {
   CandidateFailure,
   ImplementationPhase,
+  ImplementGraphBoundary,
   PhaseAttempt,
   TaskBoundary,
   TaskFailure,
@@ -42,6 +43,22 @@ export interface TaskRecord {
   state: TaskState;
 }
 
+export interface ImplementGraphRecord {
+  key: string;
+  workspaceRoot: string;
+  graphHash: string;
+  boundary: ImplementGraphBoundary;
+  completedTasks: Set<string>;
+  blockedTasks: Set<string>;
+}
+
+export function graphRecordKey(
+  workspaceRoot: string,
+  changeId: string,
+): string {
+  return `${workspaceRoot}\0${changeId}`;
+}
+
 export function taskRecordKey(
   workspaceRoot: string,
   changeId: string,
@@ -97,6 +114,37 @@ export function workerIdentity(model: {
 
 export class WorkerRegistry {
   private readonly tasks = new Map<string, TaskRecord>();
+  private readonly graphs = new Map<string, ImplementGraphRecord>();
+
+  admitGraph(
+    boundary: ImplementGraphBoundary,
+    graphHash: string,
+    workspaceRoot: string,
+    state: {
+      completedTasks: readonly string[];
+      blockedTasks: readonly string[];
+    },
+  ): ImplementGraphRecord {
+    const key = graphRecordKey(workspaceRoot, boundary.changeId);
+    if (this.graphs.has(key)) throw new Error("duplicate graph admission");
+    const record: ImplementGraphRecord = {
+      key,
+      workspaceRoot,
+      graphHash,
+      boundary: structuredClone(boundary),
+      completedTasks: new Set(state.completedTasks),
+      blockedTasks: new Set(state.blockedTasks),
+    };
+    this.graphs.set(key, record);
+    return record;
+  }
+
+  getGraph(
+    workspaceRoot: string,
+    changeId: string,
+  ): ImplementGraphRecord | undefined {
+    return this.graphs.get(graphRecordKey(workspaceRoot, changeId));
+  }
 
   has(key: string): boolean {
     return this.tasks.has(key);
@@ -151,5 +199,6 @@ export class WorkerRegistry {
 
   clear(): void {
     this.tasks.clear();
+    this.graphs.clear();
   }
 }