@agentskit/harness 0.12.0 → 0.13.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createHash, randomUUID, createPrivateKey, createPublicKey, sign, verify } from 'crypto';
-import { readFileSync, mkdirSync, existsSync, unlinkSync, openSync, writeFileSync, closeSync, readdirSync, statSync, writeSync, appendFileSync, mkdtempSync, renameSync, rmSync } from 'fs';
+import { readFileSync, mkdirSync, existsSync, unlinkSync, openSync, writeFileSync, closeSync, readdirSync, statSync, writeSync, appendFileSync, mkdtempSync, renameSync, rmSync, accessSync, constants } from 'fs';
 import { resolve, dirname, relative, basename, join, extname, isAbsolute, delimiter, sep } from 'path';
 import { Command } from 'commander';
 import { execFile, spawn, execFileSync } from 'child_process';
@@ -970,9 +970,9 @@ var createDocBridgeContextProvider = ({ root, indexPath = ".doc-bridge/index.jso
     const started = Date.now();
     const ageBudget = maxAgeHours ?? 0;
     const inspection = ageBudget > 0 ? inspectDocBridgeIndex(root, indexPath, now4()) : null;
-    if (inspection?.error) throw new Error(`Doc Bridge index is unreadable: ${inspection.error}`);
+    if (inspection?.error) fail(`Doc Bridge index is unreadable: ${inspection.error}`, "INVALID_STATE");
     if (inspection?.ageHours !== null && inspection?.ageHours !== void 0 && inspection.ageHours > ageBudget) {
-      throw new Error(`Doc Bridge index is ${inspection.ageHours.toFixed(1)}h old; refresh it before resolving context.`);
+      fail(`Doc Bridge index is ${inspection.ageHours.toFixed(1)}h old; refresh it before resolving context.`, "STALE");
     }
     const document = index(root, indexPath);
     const contentHash = sourceHash(document);
@@ -993,7 +993,9 @@ var createDocBridgeContextProvider = ({ root, indexPath = ".doc-bridge/index.jso
 });
 var executable = (path) => {
   try {
-    return statSync(path).isFile();
+    if (!statSync(path).isFile()) return false;
+    accessSync(path, constants.X_OK);
+    return true;
   } catch {
     return false;
   }
@@ -1524,7 +1526,7 @@ var validateIteration = (iteration, index2) => {
     if (typeof result !== "object" || result === null || Array.isArray(result)) return fail(`iterations[${index2}].steps[${stepIndex}] must be an object.`, "INVALID_INPUT");
     if (result.step !== IMPROVEMENT_CYCLE_STEPS[stepIndex]) return fail(`iterations[${index2}].steps[${stepIndex}] must be ${IMPROVEMENT_CYCLE_STEPS[stepIndex]}.`, "INVALID_INPUT");
     if (!["passed", "failed", "blocked", "pending"].includes(result.status)) return fail(`iterations[${index2}].steps[${stepIndex}].status is invalid.`, "INVALID_INPUT");
-    if (result.status !== "passed" && !nonEmpty(result.reason, `iterations[${index2}].steps[${stepIndex}].reason`)) return fail(`iterations[${index2}].steps[${stepIndex}].reason is required when the step does not pass.`, "INVALID_INPUT");
+    if (result.status !== "passed" && (typeof result.reason !== "string" || !result.reason.trim())) return fail(`iterations[${index2}].steps[${stepIndex}].reason is required when the step does not pass.`, "INVALID_INPUT");
   });
   if (iteration.adjustment !== void 0) nonEmpty(iteration.adjustment, `iterations[${index2}].adjustment`);
   return { ...iteration, metrics: validateMetrics(iteration.metrics, index2) };
@@ -1538,8 +1540,10 @@ var assessImprovementCycle = (input) => {
   const iterations = input.iterations.map(validateIteration);
   iterations.forEach((iteration, index2) => {
     if (iteration.iteration !== index2 + 1) return fail("iterations must be sequential and start at 1.", "INVALID_INPUT");
-    if (index2 > 0 && iterations[index2 - 1]?.steps.every((step) => step.status === "passed")) return fail("a completed cycle cannot have later iterations.", "INVALID_INPUT");
-    if (index2 < iterations.length - 1 && !iteration.adjustment) return fail(`iterations[${index2}].adjustment is required before repeating.`, "INVALID_INPUT");
+    const isLast = index2 === iterations.length - 1;
+    const iterationComplete = iteration.steps.every((step) => step.status === "passed");
+    if (iterationComplete && !isLast) return fail("a completed cycle cannot have later iterations.", "INVALID_INPUT");
+    if (!isLast && !iteration.adjustment) return fail(`iterations[${index2}].adjustment is required before repeating.`, "INVALID_INPUT");
   });
   const matrix = iterations.map((iteration) => {
     const statuses = Object.fromEntries(iteration.steps.map((step) => [step.step, step.status]));
@@ -2241,7 +2245,17 @@ var MODEL_ROLES = ["orchestrator", "reviewer", "builder", "watcher"];
 
 // src/kernel/pii.ts
 var PATTERNS = [
-  { kind: "api-key", regex: /\b(?:sk-[A-Za-z0-9]{16,}|gh[opsu]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g },
+  // PEM key blocks first: large, unambiguous, and must claim their content before any narrower pattern below
+  // could otherwise match a substring inside the base64 body (unlikely, but claimed-range order matters).
+  { kind: "private-key", regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g },
+  // `sk-` body allows `-`/`_` (not just alnum) so a project/scoped key like `sk-proj-...`/`sk-live-...` matches
+  // as one token instead of the hyphen splitting it into a too-short fragment. `github_pat_` (fine-grained PAT)
+  // and `AIza…` (Google API key) are current real-world formats missing from the original list entirely.
+  { kind: "api-key", regex: /\b(?:sk-[A-Za-z0-9_-]{16,}|sk_(?:live|test)_[A-Za-z0-9]{16,}|pk_(?:live|test)_[A-Za-z0-9]{16,}|gh[opsu]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|AIza[A-Za-z0-9_-]{30,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g },
+  // The AWS *secret* half (as opposed to the `AKIA…` access-key id above) has no recognizable prefix — a bare
+  // 40-char base64-shaped run is too generic to scan for on its own (matches hashes, tokens, arbitrary base64).
+  // Anchoring on the conventional key name it's almost always assigned to/from keeps this pattern high-signal.
+  { kind: "api-key", regex: /\b(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY|SecretAccessKey)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})["']?/g },
   { kind: "email", regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g },
   { kind: "credit-card", regex: /\b(?:\d[ -]?){13,16}\b/g },
   { kind: "phone", regex: /\b\+?\d{1,3}?[\s().-]?\(?\d{2,4}\)?[\s.-]?\d{3,4}[\s.-]?\d{4}\b/g }
@@ -2389,7 +2403,9 @@ var exportEvidenceBundle = async ({ configPath, runId, outputPath, privateKeyPat
 `, "utf8");
   return bundle;
 };
-var verifyEvidenceBundle = (path, { trustedKeys = [] } = {}) => {
+var EVIDENCE_MAX_FILE_BYTES = 25 * 1048576;
+var EVIDENCE_MAX_TOTAL_BYTES = 200 * 1048576;
+var verifyEvidenceBundle = (path, { trustedKeys = [], maxFileBytes = EVIDENCE_MAX_FILE_BYTES, maxTotalBytes = EVIDENCE_MAX_TOTAL_BYTES } = {}) => {
   const bundle = parseBundle(path);
   if (bundle.type !== "agentskit-harness-evidence-bundle" || bundle.schemaVersion !== EVIDENCE_BUNDLE_SCHEMA_VERSION || !bundle.runId || !validKeyId(bundle.signerKeyId) || !validDigest(bundle.payloadHash) || bundle.signature?.algorithm !== "ed25519" || bundle.signature.keyId !== bundle.signerKeyId || typeof bundle.signature.publicKeyPem !== "string" || typeof bundle.signature.signatureBase64 !== "string" || !Array.isArray(bundle.files)) fail("Evidence bundle metadata is invalid.", "HARNESS_ERROR");
   if (trustedKeys.length) {
@@ -2399,10 +2415,14 @@ var verifyEvidenceBundle = (path, { trustedKeys = [] } = {}) => {
     if (trusted.publicKeyPem !== bundle.signature.publicKeyPem) fail(`Evidence bundle key does not match trust store: ${bundle.signerKeyId}`, "HARNESS_ERROR");
   }
   const paths = /* @__PURE__ */ new Set();
+  let totalBytes = 0;
   for (const file of bundle.files) {
     if (!file || typeof file.path !== "string" || paths.has(file.path) || !validDigest(file.sha256) || typeof file.contentBase64 !== "string") fail("Evidence bundle file metadata is invalid.", "HARNESS_ERROR");
     paths.add(file.path);
+    if (file.contentBase64.length > Math.ceil(maxFileBytes / 3) * 4) fail(`Evidence bundle file exceeds the maximum allowed size: ${file.path}`, "HARNESS_ERROR");
     const content = Buffer.from(file.contentBase64, "base64");
+    totalBytes += content.length;
+    if (totalBytes > maxTotalBytes) fail("Evidence bundle exceeds the maximum total allowed size.", "HARNESS_ERROR");
     if (sha256(content) !== file.sha256) fail(`Evidence bundle file hash mismatch: ${file.path}`, "HARNESS_ERROR");
   }
   if (!paths.has(`runs/${bundle.runId}/run.json`) || !paths.has(`runs/${bundle.runId}/events.ndjson`)) fail("Evidence bundle is missing the run projection or event log.", "HARNESS_ERROR");
@@ -4100,6 +4120,14 @@ var githubCommentExists = async (runner, input, options2 = {}) => {
   const list2 = await ghJson(runner, ["api", "--paginate", `repos/${input.repo}/issues/${input.number}/comments`, "--jq", "[.[].body]"], options2);
   return Array.isArray(list2) && list2.some((body2) => typeof body2 === "string" && body2.includes(input.marker));
 };
+var writeJsonAtomic = (path, value) => {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true });
+  const tmp = join(dir, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
+  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+  renameSync(tmp, path);
+};
 var clip = (text6, max) => text6.length <= max ? text6 : `${text6.slice(0, Math.max(0, max - 1))}\u2026`;
 var createFileMemoryKvStore = (dir) => {
   mkdirSync(dir, { recursive: true });
@@ -4309,9 +4337,7 @@ var readStoredContract = (stateDir, identifier) => {
 };
 var writeStoredContract = (stateDir, stored) => {
   const path = contractPath(stateDir, stored.issue);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(stored, null, 2)}
-`, "utf8");
+  writeJsonAtomic(path, stored);
   return path;
 };
 var contractIsFresh = (stored, issue, reuseHours, now4, memoryDigest) => stored.issueUpdatedAt === issue.updatedAt && (reuseHours === 0 || now4.getTime() - Date.parse(stored.generatedAt) <= reuseHours * 36e5) && (memoryDigest === void 0 || (stored.memoryDigest ?? hashJson([])) === memoryDigest);
@@ -4745,26 +4771,56 @@ var readDispatchRecord = (stateDir, identifier) => {
     return null;
   }
 };
-var writeJson2 = (path, value) => {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-};
 var writeDispatchRecord = (stateDir, record3) => {
   const path = dispatchRecordPath(stateDir, record3.issue);
-  writeJson2(path, record3);
+  writeJsonAtomic(path, record3);
   return path;
 };
 var EVENTS_ROTATE_AT_BYTES = 10 * 1024 * 1024;
+var EVENTS_LOCK_STALE_MS = 5e3;
+var EVENTS_LOCK_MAX_ATTEMPTS = 100;
+var EVENTS_LOCK_RETRY_MS = 10;
+var acquireEventsLock = (lockFilePath) => {
+  for (let attempt = 0; attempt < EVENTS_LOCK_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      return openSync(lockFilePath, "wx");
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        if (Date.now() - statSync(lockFilePath).mtimeMs > EVENTS_LOCK_STALE_MS) unlinkSync(lockFilePath);
+      } catch {
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, EVENTS_LOCK_RETRY_MS);
+    }
+  }
+  return null;
+};
 var appendLoopEvent = (stateDir, event2, bus, now4 = () => /* @__PURE__ */ new Date()) => {
   const path = join(stateDir, "events.ndjson");
   mkdirSync(dirname(path), { recursive: true });
+  const lockFilePath = `${path}.lock`;
+  const lockFd = acquireEventsLock(lockFilePath);
   try {
-    if (statSync(path).size > EVENTS_ROTATE_AT_BYTES) renameSync(path, join(stateDir, `events-archive-${now4().getTime()}.ndjson`));
-  } catch {
-  }
-  appendFileSync(path, `${JSON.stringify(event2)}
+    if (lockFd !== null) {
+      try {
+        if (statSync(path).size > EVENTS_ROTATE_AT_BYTES) renameSync(path, join(stateDir, `events-archive-${now4().getTime()}.ndjson`));
+      } catch {
+      }
+    }
+    appendFileSync(path, `${JSON.stringify(event2)}
 `, "utf8");
+  } finally {
+    if (lockFd !== null) {
+      try {
+        closeSync(lockFd);
+      } catch {
+      }
+      try {
+        unlinkSync(lockFilePath);
+      } catch {
+      }
+    }
+  }
   if (bus && typeof event2["type"] === "string") bus.emit(event2);
 };
 var gatherLoopState = async (input) => {
@@ -5060,7 +5116,7 @@ The loop will not retry this issue until you remove the \`${config.resilience.pa
       if (!launched.accepted) notes.push(`${detail.identifier}: terminal ${launched.terminal} did not confirm the brief; deliver will nudge it if it stays idle`);
       ledger.recordDispatch({ lease: claim.lease, idempotencyKey: plan.idempotencyKey, commandDigest: plan.commandDigest });
       const record3 = { issue: detail.identifier, worktreeId: created.id, worktree, branch: actualBranch, terminal: launched.terminal, provider: builder.provider, model: builder.model, contractDigest: stored.digest, leaseKey: claim.lease.key, leaseId: claim.lease.leaseId, dispatchedAt: now4().toISOString(), url: detail.url, briefDigest, skills: skillRefs(pinnedSkills), setup: setupResult, effort: builder.effort, initialRemainingPercent: builder.remainingPercent, worktreePath: created.path };
-      writeJson2(dispatchRecordPath(loaded.stateDir, detail.identifier), record3);
+      writeJsonAtomic(dispatchRecordPath(loaded.stateDir, detail.identifier), record3);
       appendLoopEvent(loaded.stateDir, { at: record3.dispatchedAt, type: "worker.dispatched", ...record3, command: builder.tui, briefAccepted: launched.accepted, tuiIdle: launched.idle }, bus);
       await bus.runHook("afterDispatch", { issue: detail.identifier, provider: record3.provider, model: record3.model, branch: record3.branch, worktreeId: record3.worktreeId });
       clearIssueFailures(loaded.stateDir, detail.identifier);
@@ -5177,11 +5233,6 @@ var discoverIntake = async (runner, input, options2 = {}) => {
 // src/loop/deliver.ts
 var message3 = (error) => error instanceof HarnessError ? `${error.code}: ${error.message}` : error instanceof Error ? error.message : String(error);
 var isMissingOrcaWorktree = (error) => message3(error).includes("selector_not_found");
-var writeJson3 = (path, value) => {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-};
 var deliveryStatePath = (stateDir, identifier) => join(stateDir, "issues", identifier, "delivery.json");
 var readDeliveryState = (stateDir, identifier) => {
   const path = deliveryStatePath(stateDir, identifier);
@@ -5208,7 +5259,7 @@ var minutesBetween = (later, earlier) => earlier === null ? Number.POSITIVE_INFI
 var orcaOptions = (config) => ({ bin: config.orca.bin, timeoutMs: config.orca.timeoutMs });
 var linearOptions = (config) => ({ bin: config.orca.bin, workspaceId: config.linear.workspaceId, orca: { timeoutMs: config.orca.timeoutMs } });
 var saveState = (ctx, state) => {
-  if (!ctx.dryRun) writeJson3(deliveryStatePath(ctx.loaded.stateDir, state.issue), state);
+  if (!ctx.dryRun) writeJsonAtomic(deliveryStatePath(ctx.loaded.stateDir, state.issue), state);
 };
 var event = (ctx, payload) => {
   if (!ctx.dryRun) appendLoopEvent(ctx.loaded.stateDir, { at: ctx.now().toISOString(), ...payload }, ctx.bus);
@@ -5880,7 +5931,7 @@ var runDeliver = async (input) => {
         const candidates = (await githubOpenPullRequests(input.runner, { repo: config.project.repo, limit: 100 })).filter((item) => item.headRef === record3.branch || item.headRef.endsWith(`/${record3.worktree}`) || item.headRef === record3.worktree);
         if (candidates.length) {
           open = candidates;
-          if (!dryRun) writeJson3(dispatchRecordPath(loaded.stateDir, record3.issue), { ...record3, branch: candidates[0].headRef });
+          if (!dryRun) writeJsonAtomic(dispatchRecordPath(loaded.stateDir, record3.issue), { ...record3, branch: candidates[0].headRef });
           notes.push(`${record3.issue}: PR found on branch ${candidates[0].headRef}; dispatch record updated`);
         }
       }
@@ -6489,7 +6540,7 @@ var parseSince = (value, now4) => {
     return new Date(now4.getTime() - amount * unit);
   }
   const parsed = Date.parse(value);
-  if (Number.isNaN(parsed)) throw new Error(`Unrecognised --since value: ${value} (use 7d, 12h, 30m or an ISO date)`);
+  if (Number.isNaN(parsed)) fail(`Unrecognised --since value: ${value} (use 7d, 12h, 30m or an ISO date)`, "INVALID_INPUT");
   return new Date(parsed);
 };
 var median2 = (values) => {
@@ -6738,6 +6789,7 @@ var phaseOf = (dispatch, delivery2) => {
   return "in-flight";
 };
 var summarize2 = (phase, delivery2, dispatch) => {
+  if (phase === "idle") return "Not yet dispatched";
   if (phase === "merged") return `Merged PR #${delivery2.prNumber ?? "?"}`;
   if (phase === "held" || phase === "held-incomplete-review") {
     if (delivery2.heldFor) return `Held for a human (self-edit or protected path at ${delivery2.heldFor.slice(0, 7)})`;
@@ -6824,7 +6876,7 @@ var buildDebriefReport = (input) => {
         });
         continue;
       }
-      continue;
+      if (!input.issue) continue;
     }
     rows.push(rowFor({ issue, dispatch, delivery: delivery2, intent, repo: config.project.repo, now: now4 }));
   }
@@ -6992,7 +7044,7 @@ var runObservability = async (input) => {
   const events2 = readLoopEvents(loaded.stateDir).filter((event2) => Date.parse(event2.at) >= since.getTime() && Date.parse(event2.at) <= at.getTime());
   const ledger = createDispatchLedger(loaded.stateDir);
   const active = ledger.active();
-  const missingDeliveryIssues = active.filter((lease) => !existsSync(deliveryStatePath(loaded.stateDir, lease.issue))).map((lease) => lease.issue);
+  const missingDeliveryIssues = active.filter((lease) => !existsSync(deliveryStatePath(loaded.stateDir, lease.issue)) && !existsSync(dispatchRecordPath(loaded.stateDir, lease.issue))).map((lease) => lease.issue);
   const records = listDispatched(loaded.stateDir);
   const completed = records.map((record3) => ({ record: record3, state: readDeliveryState(loaded.stateDir, record3.issue) })).filter(({ state }) => state.finishedAt && Date.parse(state.finishedAt) >= since.getTime());
   const leadTimes = completed.map(({ record: record3, state }) => state.finishedAt ? (Date.parse(state.finishedAt) - Date.parse(record3.dispatchedAt)) / 6e4 : null).filter((value) => value !== null && Number.isFinite(value)).sort((a, b) => a - b);
@@ -7515,7 +7567,7 @@ benchmark.command("baseline <taskId>").description("Record one controlled baseli
 program.command("clean").description("Remove only configured task-owned temporary artifacts.").action(() => print(cleanTaskArtifacts(options().config)));
 process.on("SIGINT", () => {
   process.stderr.write("Cancelled.\n");
-  process.exitCode = 130;
+  process.exit(130);
 });
 try {
   await program.parseAsync(process.argv);