@abelxiaoxing/cadence 2.0.12 → 2.0.14

package/src/conversation-context.mjs

@@ -0,0 +1,147 @@
+/** Private ordinary-chat context. No Pi session import, hidden thinking or provider envelopes. */
+import { closeSync, constants, fstatSync, openSync, readSync } from "node:fs";
+import {
+  canonicalJson,
+  closed,
+  integer,
+  list,
+  oneOf,
+  parseWireJson,
+  text,
+} from "./worker-public.mjs";
+import { DetailSanitizer, sanitizeText } from "./worker-redaction.mjs";
+
+export const CONTEXT_BYTES = 2 * 1024 * 1024;
+const clean = (s, secrets, max = CONTEXT_BYTES) =>
+  sanitizeText(text(s, max), secrets);
+function argumentsData(value, secrets) {
+  const sanitizer = new DetailSanitizer("canonical-json", secrets);
+  const source =
+    sanitizer.write(canonicalJson(value, 64 * 1024)) + sanitizer.end();
+  if (sanitizer.limited) throw new Error("Unsupported context arguments");
+  return parseWireJson(source, 64 * 1024);
+}
+/** Deliberately retain text and tool exchanges, not just last assistant prose. */
+export function conversationMessages(messages, secrets = []) {
+  return list(messages, 4096, (message) => {
+    if (!message || typeof message !== "object")
+      throw new Error("Invalid context");
+    const role = oneOf(message.role, ["user", "assistant", "toolResult"]);
+    const timestamp = integer(message.timestamp, 0);
+    const content =
+      typeof message.content === "string"
+        ? [{ type: "text", text: clean(message.content, secrets) }]
+        : list(message.content, 256, (block) => {
+            if (block.type === "text")
+              return { type: "text", text: clean(block.text, secrets) };
+            if (role === "assistant" && block.type === "toolCall")
+              return {
+                type: "toolCall",
+                id: clean(block.id, secrets, 512),
+                name: clean(block.name, secrets, 128),
+                arguments: argumentsData(block.arguments, secrets),
+              };
+            // Images, hidden thinking and opaque provider signatures never become retained context.
+            return null;
+          }).filter(Boolean);
+    if (role === "user") return { role, timestamp, content };
+    if (role === "toolResult")
+      return {
+        role,
+        timestamp,
+        content,
+        toolCallId: clean(message.toolCallId, secrets, 512),
+        toolName: clean(message.toolName, secrets, 128),
+        isError: message.isError === true,
+      };
+    const usage = closed(message.usage, [
+      "input",
+      "output",
+      "cacheRead",
+      "cacheWrite",
+      "totalTokens",
+      "cost",
+    ]);
+    const cost = closed(usage.cost, [
+      "input",
+      "output",
+      "cacheRead",
+      "cacheWrite",
+      "total",
+    ]);
+    for (const value of [
+      ...Object.values(usage).filter((v) => typeof v !== "object"),
+      ...Object.values(cost),
+    ])
+      if (typeof value !== "number" || !Number.isFinite(value) || value < 0)
+        throw new Error("Invalid usage");
+    return {
+      role,
+      timestamp,
+      content,
+      api: clean(message.api, secrets, 128),
+      provider: clean(message.provider, secrets, 128),
+      model: clean(message.model, secrets, 256),
+      usage,
+      stopReason: oneOf(message.stopReason, [
+        "stop",
+        "length",
+        "toolUse",
+        "error",
+        "aborted",
+      ]),
+    };
+  });
+}
+export function readConversationContext(path) {
+  if (path === null) return [];
+  const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const st = fstatSync(fd);
+    if (
+      !st.isFile() ||
+      st.nlink !== 1 ||
+      st.size > CONTEXT_BYTES ||
+      (process.platform !== "win32" &&
+        (st.mode & 0o077 || st.uid !== process.getuid()))
+    )
+      throw new Error("Invalid context file");
+    const buffer = Buffer.alloc(st.size + 1);
+    let size = 0;
+    while (size < buffer.length) {
+      const n = readSync(fd, buffer, size, buffer.length - size, null);
+      if (!n) break;
+      size += n;
+    }
+    const after = fstatSync(fd);
+    if (
+      size !== st.size ||
+      after.size !== st.size ||
+      after.mtimeMs !== st.mtimeMs
+    )
+      throw new Error("Changed context file");
+    const o = closed(
+      parseWireJson(
+        new TextDecoder("utf-8", { fatal: true }).decode(
+          buffer.subarray(0, size),
+        ),
+        CONTEXT_BYTES,
+      ),
+      ["schema", "messages"],
+    );
+    if (o.schema !== "cadence-conversation-context/1")
+      throw new Error("Invalid context format");
+    return conversationMessages(o.messages);
+  } finally {
+    closeSync(fd);
+  }
+}
+export function encodeConversationContext(messages, secrets) {
+  return canonicalJson(
+    {
+      schema: "cadence-conversation-context/1",
+      messages: conversationMessages(messages, secrets),
+    },
+    CONTEXT_BYTES,
+  );
+}

package/src/conversation-resources.mjs

@@ -0,0 +1,47 @@
+/** Ordinary Pi context only: no extension/plugin executor, persona or prompt composer. */
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import {
+  loadProjectContextFiles,
+  loadSkills,
+} from "@earendil-works/pi-coding-agent";
+
+function optional(path) {
+  try {
+    if (!statSync(path).isFile() || statSync(path).size > 64 * 1024)
+      throw new Error("Resource too large");
+    return readFileSync(path, "utf8");
+  } catch (error) {
+    if (error?.code === "ENOENT") return undefined;
+    throw error;
+  }
+}
+export function conversationResources(base, cwd, agentDir) {
+  const project = join(cwd, ".pi");
+  const system =
+    optional(join(project, "SYSTEM.md")) ??
+    optional(join(agentDir, "SYSTEM.md"));
+  const append = [
+    optional(join(agentDir, "APPEND_SYSTEM.md")),
+    optional(join(project, "APPEND_SYSTEM.md")),
+  ].filter((v) => v !== undefined);
+  const agentsFiles = loadProjectContextFiles({ cwd, agentDir });
+  const skills = loadSkills({
+    cwd,
+    agentDir,
+    skillPaths: [],
+    includeDefaults: true,
+  });
+  if (
+    Buffer.byteLength(JSON.stringify({ system, append, agentsFiles, skills })) >
+    256 * 1024
+  )
+    throw new Error("Resources too large");
+  return {
+    ...base,
+    getSystemPrompt: () => system,
+    getAppendSystemPrompt: () => append,
+    getAgentsFiles: () => ({ agentsFiles }),
+    getSkills: () => skills,
+  };
+}

package/src/native-build.ts

@@ -2,5 +2,5 @@
 export const nativeBuild = {
   kind: "native",
   contractHash:
-    "e9b1ea4bb8d1c275a0cb0cf70947f9ac58e5de0cc438d551dc96809f3e82dd7c",
+    "9c917c085d034e08764de359cee49aea748c395a63ed629fe67d149b97850fa1",
 } as const;

package/src/native-client.ts

@@ -192,8 +192,8 @@ export class NativeConnection {
     // Failed detach keeps its exact transport/slot. Explicit re-entry may retry
     // detach, but never forget it and allocate a replacement on uncertainty.
     await this.detach();
-    // Pi started in the home directory attaches to the ~/cadence landing owner,
-    // the same one the management client starts there. Observation only.
+    // Native clients require an explicit project; never create or redirect to
+    // a default workspace. Observation only.
     const access = new ServiceCoordination(
       effectiveWorkspace(cwd).workspace,
     ).localAccess();

package/src/operator-cli.mjs

@@ -288,13 +288,10 @@ function stateHomeInside(root, stateHome = defaultStateHome()) {
 function privateWorkspace(requested, stateHome = defaultStateHome()) {
   return contains(join(canonicalAmbientRoot(stateHome), "cadence-assistant-v1"), canonicalAmbientRoot(requested));
 }
-var LANDING_WORKSPACE = "cadence";
-function effectiveWorkspace(requested, stateHome, home = homedir()) {
-  if (privateWorkspace(requested, stateHome))
-    throw new Error("Private state cannot be a workspace");
-  if (!stateHomeInside(resolveWorkspace(requested).root, stateHome))
-    return { workspace: requested, redirected: false };
-  return { workspace: join(home, LANDING_WORKSPACE), redirected: true };
+function effectiveWorkspace(requested, stateHome, _home) {
+  if (privateWorkspace(requested, stateHome) || stateHomeInside(resolveWorkspace(requested).root, stateHome))
+    throw new Error("Choose a project outside Cadence private state; no default workspace was created");
+  return { workspace: requested, redirected: false };
 }
 
 class TaskStore {

package/src/sdk-worker.mjs

@@ -1,4 +1,6 @@
-// Ordinary SDK child, not Pi CLI startup. No discovery, credential files or fallback executor.
+// Isolated SDK child, not Pi CLI startup. Task discovery stays disabled;
+// ordinary conversations explicitly load only context/skills, never extensions.
+import { writeFileSync } from "node:fs";
 import {
   createProvider,
   InMemoryCredentialStore,
@@ -12,6 +14,11 @@ import {
   SessionManager,
   SettingsManager,
 } from "@earendil-works/pi-coding-agent";
+import {
+  encodeConversationContext,
+  readConversationContext,
+} from "./conversation-context.mjs";
+import { conversationResources } from "./conversation-resources.mjs";
 import { CaptureEmitter, SdkCapture } from "./worker-capture.mjs";
 import {
   closed,
@@ -185,13 +192,27 @@ try {
     if (inputBytes > 128 * 1024) refuse("parse", "input-bound");
     chunks.push(chunk);
   }
+  const parsed = parseWireJson(
+    new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)),
+    LIMITS.workerRequestBytes,
+  );
   const envelope = closed(
-    parseWireJson(
-      new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks)),
-      LIMITS.workerRequestBytes,
-    ),
-    ["request", "cwd", "model", "auth"],
+    parsed,
+    Object.hasOwn(parsed ?? {}, "conversation")
+      ? ["request", "cwd", "model", "auth", "conversation"]
+      : ["request", "cwd", "model", "auth"],
   );
+  const conversation =
+    envelope.conversation === undefined
+      ? null
+      : closed(envelope.conversation, ["previous", "agentDir"]);
+  if (
+    conversation &&
+    ((conversation.previous !== null &&
+      typeof conversation.previous !== "string") ||
+      typeof conversation.agentDir !== "string")
+  )
+    refuse("parse", "invalid-conversation");
   const publicRequest = decodeWorkerPublicRequest(envelope.request);
   const request = {
     ...envelope,
@@ -329,6 +350,10 @@ try {
   process.stdout.on("error", stdoutFailureListener);
   stage = "session";
   const requestedThinkingLevel = thinkingLevel ?? "off";
+  const manager = SessionManager.inMemory(cwd);
+  if (conversation)
+    for (const message of readConversationContext(conversation.previous))
+      manager.appendMessage(message);
   const created = await createAgentSession({
     cwd,
     agentDir: cwd,
@@ -351,8 +376,10 @@ try {
             ),
           ]
         : [],
-    resourceLoader,
-    sessionManager: SessionManager.inMemory(cwd),
+    resourceLoader: conversation
+      ? conversationResources(resourceLoader, cwd, conversation.agentDir)
+      : resourceLoader,
+    sessionManager: manager,
     settingsManager: SettingsManager.inMemory({
       compaction: { enabled: false },
       retry: { enabled: false },
@@ -483,6 +510,12 @@ try {
   stage = "assistant-final";
   if (failure || terminalStopReason !== "stop" || ingress.frames !== 0)
     refuse("assistant-final", "terminal-incomplete");
+  // Anonymous pipe only. The owner applies its access-secret sanitizer before
+  // any checkpoint reaches disk; worker output cannot contain owner credentials.
+  if (conversation) {
+    stage = "conversation-context";
+    writeFileSync(3, encodeConversationContext(session.messages, secrets));
+  }
   await capture.final();
   await emitter.drain();
 } catch {

package/src/service/contracts/workbench.ts

@@ -0,0 +1,303 @@
+/** Finite, authenticated workbench API. Ordinary chat is not task admission. */
+import {
+  bool,
+  canonicalJson,
+  closed,
+  decodeId,
+  integer,
+  list,
+  nullable,
+  oneOf,
+  text,
+} from "./core.ts";
+import { type ChoiceVersion, decodeChoiceVersion } from "./models.ts";
+
+export type WorkbenchRead =
+  | { kind: "conversations" }
+  | { kind: "task-origin"; taskId: string }
+  | { kind: "conversation"; id: string; before: string | null }
+  | { kind: "files"; path: string }
+  | { kind: "file"; path: string }
+  | { kind: "directories"; path: string }
+  | { kind: "projects" };
+export type WorkbenchCommand =
+  | {
+      kind: "link-task";
+      commandId: string;
+      epoch: string;
+      taskId: string;
+      conversationId: string;
+    }
+  | {
+      kind: "send";
+      commandId: string;
+      conversationId: string;
+      head: string | null;
+      text: string;
+      model: ChoiceVersion;
+    }
+  | {
+      kind: "interrupt";
+      commandId: string;
+      conversationId: string;
+      turnId: string;
+      epoch: string;
+    }
+  | { kind: "open-project"; commandId: string; path: string; epoch: string };
+export type ChatStatus =
+  | "queued"
+  | "running"
+  | "completed"
+  | "failed"
+  | "canceled"
+  | "timeout"
+  | "unknown";
+export interface ChatItem {
+  id: string;
+  role: "user" | "assistant" | "tool";
+  text: string;
+  name: string;
+  args: string;
+  error: boolean;
+}
+export interface ChatTurn {
+  id: string;
+  epoch: string;
+  status: ChatStatus;
+  items: ChatItem[];
+  notice: string;
+}
+export interface ChatSummary {
+  id: string;
+  title: string;
+  head: string;
+  status: ChatStatus;
+  updatedAt: number;
+}
+export interface FileEntry {
+  name: string;
+  path: string;
+  directory: boolean;
+}
+export type WorkbenchResult =
+  | { kind: "task-origin"; taskId: string; conversationId: string | null }
+  | { kind: "conversations"; entries: ChatSummary[] }
+  | {
+      kind: "conversation";
+      summary: ChatSummary | null;
+      turns: ChatTurn[];
+      before: string | null;
+    }
+  | {
+      kind: "files" | "directories";
+      path: string;
+      parent: string | null;
+      entries: FileEntry[];
+      limited: boolean;
+    }
+  | { kind: "file"; path: string; text: string; limited: boolean }
+  | { kind: "projects"; entries: { path: string; current: boolean }[] }
+  | { kind: "accepted"; commandId: string }
+  | { kind: "project"; commandId: string; path: string; link: string };
+export interface WorkbenchPort {
+  read(request: WorkbenchRead): WorkbenchResult;
+  command(
+    request: WorkbenchCommand,
+  ): WorkbenchResult | Promise<WorkbenchResult>;
+}
+const statuses = [
+  "queued",
+  "running",
+  "completed",
+  "failed",
+  "canceled",
+  "timeout",
+  "unknown",
+] as const;
+export function decodeWorkbenchRead(v: unknown): WorkbenchRead {
+  const kind = Object.getOwnPropertyDescriptor(v ?? {}, "kind")?.value;
+  switch (kind) {
+    case "conversations":
+    case "projects":
+      closed(v, ["kind"]);
+      return { kind };
+    case "task-origin": {
+      const o = closed(v, ["kind", "taskId"]);
+      return { kind, taskId: decodeId(o.taskId) };
+    }
+    case "conversation": {
+      const o = closed(v, ["kind", "id", "before"]);
+      return { kind, id: decodeId(o.id), before: nullable(o.before, decodeId) };
+    }
+    default: {
+      const o = closed(v, ["kind", "path"]);
+      return {
+        kind: oneOf(o.kind, ["files", "file", "directories"]),
+        path: text(o.path, 4096),
+      };
+    }
+  }
+}
+export function decodeWorkbenchCommand(v: unknown): WorkbenchCommand {
+  const kind = Object.getOwnPropertyDescriptor(v ?? {}, "kind")?.value;
+  if (kind === "link-task") {
+    const o = closed(v, [
+      "kind",
+      "commandId",
+      "epoch",
+      "taskId",
+      "conversationId",
+    ]);
+    return {
+      kind,
+      commandId: decodeId(o.commandId),
+      epoch: decodeId(o.epoch),
+      taskId: decodeId(o.taskId),
+      conversationId: decodeId(o.conversationId),
+    };
+  }
+  if (kind === "send") {
+    const o = closed(v, [
+      "kind",
+      "commandId",
+      "conversationId",
+      "head",
+      "text",
+      "model",
+    ]);
+    return {
+      kind,
+      commandId: decodeId(o.commandId),
+      conversationId: decodeId(o.conversationId),
+      head: nullable(o.head, decodeId),
+      text: text(o.text, 16 * 1024, true),
+      model: decodeChoiceVersion(o.model),
+    };
+  }
+  if (kind === "interrupt") {
+    const o = closed(v, [
+      "kind",
+      "commandId",
+      "conversationId",
+      "turnId",
+      "epoch",
+    ]);
+    return {
+      kind,
+      commandId: decodeId(o.commandId),
+      conversationId: decodeId(o.conversationId),
+      turnId: decodeId(o.turnId),
+      epoch: decodeId(o.epoch),
+    };
+  }
+  const o = closed(v, ["kind", "commandId", "path", "epoch"]);
+  return {
+    kind: oneOf(o.kind, ["open-project"]),
+    commandId: decodeId(o.commandId),
+    path: text(o.path, 4096, true),
+    epoch: decodeId(o.epoch),
+  };
+}
+export function decodeChatTurn(v: unknown): ChatTurn {
+  const o = closed(v, ["id", "epoch", "status", "items", "notice"]);
+  return {
+    id: decodeId(o.id),
+    epoch: decodeId(o.epoch),
+    status: oneOf(o.status, statuses),
+    notice: text(o.notice, 1024),
+    items: list(o.items, 256, (v) => {
+      const i = closed(v, ["id", "role", "text", "name", "args", "error"]);
+      return {
+        id: text(i.id, 160, true),
+        role: oneOf(i.role, ["user", "assistant", "tool"]),
+        text: text(i.text, 256 * 1024),
+        name: text(i.name, 128),
+        args: text(i.args, 64 * 1024),
+        error: bool(i.error),
+      };
+    }),
+  };
+}
+export function decodeChatSummary(v: unknown): ChatSummary {
+  const o = closed(v, ["id", "title", "head", "status", "updatedAt"]);
+  return {
+    id: decodeId(o.id),
+    title: text(o.title, 512, true),
+    head: decodeId(o.head),
+    status: oneOf(o.status, statuses),
+    updatedAt: integer(o.updatedAt, 0),
+  };
+}
+export function decodeWorkbenchResult(v: unknown): WorkbenchResult {
+  // A complete finite reply fits the existing page ceiling. No arbitrary file body.
+  canonicalJson(v, 512 * 1024);
+  const kind = Object.getOwnPropertyDescriptor(v ?? {}, "kind")?.value;
+  if (kind === "task-origin") {
+    const o = closed(v, ["kind", "taskId", "conversationId"]);
+    return {
+      kind,
+      taskId: decodeId(o.taskId),
+      conversationId: nullable(o.conversationId, decodeId),
+    };
+  }
+  if (kind === "conversations") {
+    const o = closed(v, ["kind", "entries"]);
+    return { kind, entries: list(o.entries, 200, decodeChatSummary) };
+  }
+  if (kind === "conversation") {
+    const o = closed(v, ["kind", "summary", "turns", "before"]);
+    return {
+      kind,
+      summary: nullable(o.summary, decodeChatSummary),
+      turns: list(o.turns, 20, decodeChatTurn),
+      before: nullable(o.before, decodeId),
+    };
+  }
+  if (kind === "files" || kind === "directories") {
+    const o = closed(v, ["kind", "path", "parent", "entries", "limited"]);
+    return {
+      kind,
+      path: text(o.path, 4096),
+      parent: nullable(o.parent, (p) => text(p, 4096)),
+      limited: bool(o.limited),
+      entries: list(o.entries, 200, (v) => {
+        const e = closed(v, ["name", "path", "directory"]);
+        return {
+          name: text(e.name, 1024, true),
+          path: text(e.path, 4096, true),
+          directory: bool(e.directory),
+        };
+      }),
+    };
+  }
+  if (kind === "file") {
+    const o = closed(v, ["kind", "path", "text", "limited"]);
+    return {
+      kind,
+      path: text(o.path, 4096),
+      text: text(o.text, 256 * 1024),
+      limited: bool(o.limited),
+    };
+  }
+  if (kind === "projects") {
+    const o = closed(v, ["kind", "entries"]);
+    return {
+      kind,
+      entries: list(o.entries, 128, (v) => {
+        const e = closed(v, ["path", "current"]);
+        return { path: text(e.path, 4096, true), current: bool(e.current) };
+      }),
+    };
+  }
+  if (kind === "accepted") {
+    const o = closed(v, ["kind", "commandId"]);
+    return { kind, commandId: decodeId(o.commandId) };
+  }
+  const o = closed(v, ["kind", "commandId", "path", "link"]);
+  return {
+    kind: oneOf(o.kind, ["project"]),
+    commandId: decodeId(o.commandId),
+    path: text(o.path, 4096, true),
+    link: text(o.link, 8192, true),
+  };
+}

package/src/service/coordination.ts

@@ -295,6 +295,7 @@ export class ServiceCoordination {
       "access.json",
       "host-config.json",
       "history-v2",
+      "conversations-v1",
     ]);
     this.files.directory(join(this.directory, "history-v2"), false, walks);
   }