@akagilnc/pi-workflow-roles 0.1.2043 → 0.1.2052

package/src/public-cli/invocation.ts

@@ -47,6 +47,10 @@ import {
 } from "../merger-contracts.ts";
 import { sha256Hex } from "../sha256.ts";
 import { uuidv7 } from "../uuidv7.ts";
+import {
+  appendEngineSessionMaterial,
+  type EngineSessionMaterial,
+} from "../package-resources/engine-material.ts";
 import { CliUsageError } from "./cli-errors.ts";
 import {
   REJECTED_PUBLIC_SPELLINGS,
@@ -809,6 +813,7 @@ export async function admitJudgeInvocation(
 /** Build the Pi prompt transport for an admitted Judge request. */
 export function buildJudgeTransportPrompt(
   admitted: AdmittedJudgeInvocation,
+  engineMaterial?: EngineSessionMaterial,
 ): string {
   const lines: string[] = [admitted.instructionEmpty ? "" : admitted.instruction];
   if (admitted.attachments.length > 0) {
@@ -818,7 +823,7 @@ export function buildJudgeTransportPrompt(
       lines.push(`- ${attachment.frozenPath}`);
     }
   }
-  return lines.join("\n");
+  return appendEngineSessionMaterial(lines, engineMaterial).join("\n");
 }
 
 /** Load admitted-request.json written at admission (Navigator work-context seam). */
@@ -1404,6 +1409,7 @@ export async function admitCollectorInvocation(
 export function buildCollectorTransportPrompt(
   _admitted: AdmittedCollectorInvocation,
 ): string {
+  // Exact historical fixed kickoff bytes (one-shot observation).
   return COLLECTOR_FIXED_KICKOFF;
 }
 

package/src/public-cli/judge-run.ts

@@ -6,6 +6,7 @@
 import { writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
+import { engineSessionMaterialFromOptions } from "../package-resources/engine-material.ts";
 import {
   runExplicitInternalActivation,
   type ExplicitInternalKnownFailure,
@@ -76,6 +77,8 @@ export type JudgeRunEnv = {
   piRunner?: ExplicitInternalPiRunner;
   /** Effective judge seat model (persistent/startup/invocation). */
   model?: SeatModelConfig;
+  /** Optional labor engine name (config→activation; session material only). */
+  engine?: string;
   /**
    * Credential presence for public providers (auth.json shape).
    * Used as the production-owned typed channel when a selected public provider
@@ -100,10 +103,15 @@ export function buildJudgeActivationExtraArgs(
   admitted: AdmittedJudgeInvocation,
   options: {
     model?: SeatModelConfig;
+    engine?: string;
+    packageRoot?: string;
     extraPiArgs?: readonly string[];
   } = {},
 ): string[] {
-  const prompt = buildJudgeTransportPrompt(admitted);
+  const prompt = buildJudgeTransportPrompt(
+    admitted,
+    engineSessionMaterialFromOptions(options),
+  );
   return [
     "--no-skills",
     "--no-prompt-templates",
@@ -436,7 +444,9 @@ export async function runPublicJudge(
   }
 
   const extraArgs = buildJudgeActivationExtraArgs(admitted, {
+    packageRoot: env.packageRoot,
     ...(env.model === undefined ? {} : { model: env.model }),
+    ...(env.engine === undefined ? {} : { engine: env.engine }),
     ...(env.extraPiArgs === undefined ? {} : { extraPiArgs: env.extraPiArgs }),
   });
 

package/src/public-cli/option-definitions.ts

@@ -278,6 +278,20 @@ const GLOBAL_OPTIONS = [
       zh: "覆盖 thinking 档位：off|minimal|low|medium|high|xhigh|max。",
     },
   },
+  {
+    id: "engine",
+    owner: "global",
+    canonical: "--engine",
+    aliases: [],
+    valueMetavar: "name",
+    required: false,
+    repeatable: false,
+    form: "option",
+    description: {
+      en: "Optional Judge labor engine for this invocation (name must exist in packaged engine materials; judge-only).",
+      zh: "本调用可选 Judge 劳动引擎（名字须存在于包内引擎调法材料；仅 Judge）。",
+    },
+  },
   {
     id: "help",
     owner: "global",

package/src/role-runtime.ts

@@ -24,6 +24,7 @@ import {
 import { installPackageOwnedToolRegistration } from "./package-owned-tool-idle.ts";
 import { installWorkerGitHooks } from "./worker-submission-gates.ts";
 import { createReceiptDeliveryPolicy, NO_RECEIPT_LIFECYCLE_ENTRY_TYPE, RECEIPT_DELIVERY_PROMPT } from "./receipt-delivery-policy.ts";
+import { createOAuthKeepalive, type OAuthKeepaliveOptions } from "./oauth-keepalive.ts";
 
 import type { AnyCanonicalSkillBinding } from "./canonical-skill-binding.ts";
 import type { CollectorClock } from "./collector-evidence.ts";
@@ -506,6 +507,12 @@ export type RoleRuntimeDependencies = {
   /** Monotonic ms clock for update throttling; defaults to performance.now (not Date.now). */
   toolExecutionObservationMonoNow?(): number;
   toolExecutionObservationWriter?: ToolExecutionObservationWriter;
+  /**
+   * #351 OAuth keepalive: providers/interval/scheduler.
+   * Production extension root reads oauth-keepalive.json and passes providers here
+   * (default ["kimi-coding"] when the setting file is absent). Tests may inject.
+   */
+  oauthKeepalive?: OAuthKeepaliveOptions;
 };
 
 function abortContext(ctx: ExtensionContext): void {
@@ -577,6 +584,8 @@ export function createRoleRuntimeExtension(
     let reviewerOriginalRequest: string | undefined;
     let reviewerExpansionCaptured = false;
     let navigatorAttendance: NavigatorAttendanceDependency | undefined;
+    // #351: session-lifecycle owner for periodic OAuth refresh (orthogonal to role admission).
+    const oauthKeepalive = createOAuthKeepalive(dependencies.oauthKeepalive);
     let pendingNavigatorPresentation: { event: import("./navigator-attendance.ts").NavigatorEvent; report: import("./navigator-attendance.ts").NavigatorReport } | undefined;
     let pendingNavigatorSettlement: Promise<void> | undefined;
     let navigatorWorkContext: NavigatorWorkContext | undefined;
@@ -809,6 +818,8 @@ export function createRoleRuntimeExtension(
       }, { triggerTurn: false });
     });
     pi.on("session_shutdown", async () => {
+      // #351: stop OAuth keepalive first so shutdown yields zero further ticks.
+      oauthKeepalive.stop();
       // Flush any still-pending affirmative attendance before teardown. Accepted
       // grace-timeout paths normally emit on agent_settled; abort can skip that hook.
       const presentation = pendingNavigatorPresentation;
@@ -1043,6 +1054,9 @@ export function createRoleRuntimeExtension(
       pendingNavigatorSettlement = undefined;
       pendingInfrastructureToolCallIds.clear();
       navigatorWorkContext = undefined;
+      // #351: OAuth keepalive is orthogonal to --ak-role; start before role early-return
+      // so role-less sessions (and reload after shutdown stop) still keep tokens alive.
+      oauthKeepalive.start(ctx);
       const rawRole = pi.getFlag(ROLE_FLAG.name);
       if (rawRole === undefined) return;
       const entry = PACKAGED_ROLE_REGISTRY.find(({ role }) => role === rawRole);