@akagilnc/pi-workflow-roles 0.1.5212 → 0.1.5235

package/src/host-session-record.ts

@@ -1,41 +1,341 @@
 /**
- * Non-pi host turn events → sitian sole entry (ADR 0065 / 0077 / #811).
- * Adapters capture host-native structured events; this helper only packages
- * the common sitianReport call. session.jsonl stays header-only (#617 DK-4).
- * Write failures propagate (SitianInfrastructureError) — not best-effort.
+ * Host conversation dossiers are native file copies; sitian append-only (ADR 0086).
+ * Replaces live event streaming (ADR 0077) with post-exit CLI original copy.
+ * Writes native-session-pointer when session ID is obtained.
+ * Writes native-session-copy (or native-session-warning on retry failure) after CLI exit.
+ * Log line write failures declare to stderr and never abort the leg.
  */
+import { spawnSync } from "node:child_process";
+import {
+  appendFileSync,
+  copyFileSync,
+  closeSync,
+  existsSync,
+  openSync,
+  readFileSync,
+  mkdirSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  type Dirent,
+} from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+import type { RoleTurnContinuation } from "./host-contracts.ts";
 import { sitianReport } from "./sitian-facade.ts";
+import type { SitianRecordInput } from "./sitian-contracts.ts";
 
 /** Volume category under `<run>/session/<kind>/records.jsonl`. */
 export const HOST_SESSION_RECORD_KIND = "host-session" as const;
 
-function eventField(event: unknown, key: string): string | undefined {
-  if (typeof event !== "object" || event === null || Array.isArray(event)) return undefined;
-  const value = (event as Record<string, unknown>)[key];
-  return typeof value === "string" && value.length > 0 ? value : undefined;
+function declareHostSessionFailure(error: unknown): void {
+  const message = error instanceof Error ? (error.stack || error.message) : String(error);
+  process.stderr.write(`[host-session] Dossier record failure: ${message}\n`);
+}
+
+/** Declare sitian record failure once to stderr without aborting the leg (ADR 0086). */
+export function sitianReportSafe(input: SitianRecordInput): void {
+  try {
+    sitianReport(input);
+  } catch (error) {
+    declareHostSessionFailure(error);
+  }
+}
+
+/** Recursively scan for Codex rollout file matching sessionId under sessionsDir. */
+function findCodexRollout(sessionsDir: string, sessionId: string): string | undefined {
+  if (!existsSync(sessionsDir)) return undefined;
+  const matches: Array<{ path: string; mtime: number }> = [];
+  function scan(dir: string, depth = 0): void {
+    if (depth > 6) return;
+    let entries: Dirent[];
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const fullPath = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        scan(fullPath, depth + 1);
+      } else if (entry.isFile() && entry.name.endsWith(".jsonl") && entry.name.includes(sessionId)) {
+        try {
+          const stat = statSync(fullPath);
+          matches.push({ path: fullPath, mtime: stat.mtimeMs });
+        } catch {
+          matches.push({ path: fullPath, mtime: 0 });
+        }
+      }
+    }
+  }
+  scan(sessionsDir);
+  if (matches.length === 0 || matches[0] === undefined) return undefined;
+  matches.sort((a, b) => b.mtime - a.mtime);
+  return matches[0]?.path;
+}
+
+/**
+ * Sanitize working directory to match Claude Code's project directory name layout.
+ * Claude Code replaces all non-alphanumeric characters (slashes, dots, underscores, spaces, etc.) with '-'.
+ */
+export function sanitizeClaudeCwd(cwd: string): string {
+  return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
 
-/** Live write of one host-emitted structured event. Throws on sitian persistence failure. */
-export function reportHostSessionEvent(input: {
+/**
+ * Resolve the CLI native session original path.
+ * Codex: single file rollout from ~/.codex/sessions/** /rollout-*-${sessionId}.jsonl
+ * Claude: single file transcript from ~/.claude/projects/<sanitized-cwd>/${sessionId}.jsonl
+ * Grok: directory ~/.grok/sessions/<encoded-cwd>/${sessionId}
+ * Pi / Hermes: undefined (Pi directly lands in session.jsonl; Hermes is state.db excluded from ADR 0086)
+ */
+export function resolveNativeSessionPath(options: {
   readonly host: string;
+  readonly sessionId: string;
+  readonly cwd: string;
+  readonly home?: string | undefined;
+}): string | undefined {
+  const home = options.home || homedir();
+  if (options.host === "claude") {
+    const configDir = process.env.CLAUDE_CONFIG_DIR || join(home, ".claude");
+    const sanitizedCwd = sanitizeClaudeCwd(options.cwd);
+    return join(configDir, "projects", sanitizedCwd, `${options.sessionId}.jsonl`);
+  }
+  if (options.host === "codex") {
+    return findCodexRollout(codexSessionsDirectory(home), options.sessionId);
+  }
+  if (options.host === "grok-build") {
+    const grokHome = process.env.GROK_HOME || join(home, ".grok");
+    return join(grokHome, "sessions", encodeURIComponent(options.cwd), options.sessionId);
+  }
+  return undefined;
+}
+
+function codexSessionsDirectory(home?: string): string {
+  return join(process.env.CODEX_HOME || join(home || homedir(), ".codex"), "sessions");
+}
+
+/** Count each host activation, including Pi turns without an external copy. */
+export function recordRunStart(runDirectory: string): void {
+  try { appendFileSync(join(runDirectory, ".run-starts"), "\n"); }
+  catch (error) { declareHostSessionFailure(error); }
+}
+
+/**
+ * Resolve the host dossier landing destination under `<run>/session/`.
+ * Format: `<run>/session/<host>-<model>-<n>` (single file adds .jsonl; model slashes replaced with -).
+ * Ordinal n is the start/resume count in the run (initial 1, each resume +1).
+ */
+export function resolveHostDossierLandingPath(options: {
+  readonly host: string;
+  readonly model?: { readonly model?: string; readonly thinking?: string } | undefined;
+  readonly sessionDirectory: string;
+  readonly continuation: RoleTurnContinuation;
+}): { readonly landingPath: string; readonly ordinal: number; readonly sanitizedModel: string } {
+  const sanitizedModel = (options.model?.model ?? "default").replace(/[\/\\]+/g, "-");
+  let maxOrdinal = 0;
+
+  if (existsSync(options.sessionDirectory)) {
+    try {
+      const entries = readdirSync(options.sessionDirectory);
+      for (const entry of entries) {
+        const match = entry.match(/-(\d+)(?:\.jsonl|\.failed)?$/);
+        const first = match?.[1];
+        if (first !== undefined) {
+          const val = parseInt(first, 10);
+          if (!isNaN(val) && val > maxOrdinal) {
+            maxOrdinal = val;
+          }
+        }
+      }
+    } catch {
+      // Ignore directory read errors
+    }
+  }
+
+  const startsPath = join(dirname(options.sessionDirectory), ".run-starts");
+  let starts = 0;
+  if (existsSync(startsPath)) starts = readFileSync(startsPath, "utf8").length;
+  const ordinal = Math.max(maxOrdinal + 1, starts, options.continuation.kind === "resume" ? 2 : 1);
+
+  const baseName = `${options.host}-${sanitizedModel}-${ordinal}`;
+  const landingPath = options.host === "grok-build"
+    ? join(options.sessionDirectory, baseName)
+    : join(options.sessionDirectory, `${baseName}.jsonl`);
+
+  return { landingPath, ordinal, sanitizedModel };
+}
+
+/** Record native session pointer line to Sitian as soon as session ID is known. */
+export function recordNativeSessionPointer(options: {
+  readonly host: string;
+  readonly sessionId: string;
   readonly cwd: string;
   readonly sessionParent: string;
-  readonly source: string;
-  readonly event: unknown;
-  readonly identity?: string;
-  readonly timestamp?: string;
-}): void {
-  const identity = input.identity ?? eventField(input.event, "uuid");
-  const timestamp = input.timestamp ?? eventField(input.event, "timestamp");
-  sitianReport({
+  readonly home?: string | undefined;
+}): string | undefined {
+  if (options.host === "pi" || options.host === "hermes") {
+    return undefined;
+  }
+  const nativePath = options.host === "codex"
+    ? codexSessionsDirectory(options.home)
+    : resolveNativeSessionPath(options);
+  if (nativePath === undefined) return undefined;
+
+  sitianReportSafe({
     level: "event",
     kind: HOST_SESSION_RECORD_KIND,
-    host: input.host,
-    cwd: input.cwd,
-    sessionParent: input.sessionParent,
-    source: input.source,
-    payload: input.event,
-    ...(identity === undefined ? {} : { identity }),
-    ...(timestamp === undefined ? {} : { timestamp }),
+    host: options.host,
+    cwd: options.cwd,
+    sessionParent: options.sessionParent,
+    source: `${options.host}-dossier`,
+    payload: {
+      type: "native-session-pointer",
+      nativePath,
+      sessionId: options.sessionId,
+    },
   });
+  return nativePath;
+}
+
+/** File clone via APFS `cp -c` with fallback to `copyFileSync`. */
+function copyFileCloneOrFallback(src: string, dest: string): void {
+  try {
+    const res = spawnSync("cp", ["-c", src, dest]);
+    if (res.status === 0) return;
+  } catch {
+    // cp execution failed, fall back
+  }
+  copyFileSync(src, dest);
+}
+
+/** Copy both grok-build originals: chat_history.jsonl and usage.json into destDir. */
+function copyGrokDossier(srcDir: string, destDir: string): void {
+  const chatHistorySrc = join(srcDir, "chat_history.jsonl");
+  if (!existsSync(chatHistorySrc)) {
+    throw new Error(`Grok native chat_history.jsonl missing at ${chatHistorySrc}`);
+  }
+  mkdirSync(destDir, { recursive: true });
+  const chatHistoryDest = join(destDir, "chat_history.jsonl");
+  copyFileCloneOrFallback(chatHistorySrc, chatHistoryDest);
+
+  const usageSrc = join(srcDir, "usage.json");
+  if (!existsSync(usageSrc)) {
+    throw new Error(`Grok native usage.json missing at ${usageSrc}`);
+  }
+  copyFileCloneOrFallback(usageSrc, join(destDir, "usage.json"));
+}
+
+/**
+ * Copy native host session original to run session dossier after child process exits.
+ * If copy fails, retries once.
+ * On success, appends native-session-copy line to Sitian.
+ * On repeated failure, appends native-session-warning line to Sitian.
+ * Does not throw; turn outcome is never altered by copy success or failure.
+ */
+export function copyAndRecordHostDossier(options: {
+  readonly host: string;
+  readonly sessionId: string;
+  readonly cwd: string;
+  readonly sessionDirectory: string;
+  readonly sessionParent: string;
+  readonly continuation: RoleTurnContinuation;
+  readonly model?: { readonly model?: string; readonly thinking?: string } | undefined;
+  readonly home?: string | undefined;
+}): void {
+  if (options.host === "pi" || options.host === "hermes") {
+    return;
+  }
+  const nativePath = resolveNativeSessionPath({
+    host: options.host,
+    sessionId: options.sessionId,
+    cwd: options.cwd,
+    ...(options.home !== undefined ? { home: options.home } : {}),
+  });
+  if (nativePath === undefined && options.host !== "codex") return;
+
+  let destination: ReturnType<typeof resolveHostDossierLandingPath>;
+  try {
+    destination = resolveHostDossierLandingPath(options);
+  } catch (error) {
+    sitianReportSafe({
+      level: "event",
+      kind: HOST_SESSION_RECORD_KIND,
+      host: options.host,
+      cwd: options.cwd,
+      sessionParent: options.sessionParent,
+      source: `${options.host}-dossier`,
+      payload: {
+        type: "native-session-warning",
+        sessionId: options.sessionId,
+        error: error instanceof Error ? error.message : String(error),
+      },
+    });
+    return;
+  }
+  const { landingPath, ordinal, sanitizedModel } = destination;
+
+  let lastError: unknown;
+  let copySuccess = false;
+  for (let attempt = 1; attempt <= 2; attempt++) {
+    try {
+      if (options.host === "grok-build") {
+        copyGrokDossier(nativePath!, landingPath);
+      } else {
+        if (nativePath === undefined || !existsSync(nativePath)) {
+          throw new Error(`Native session file missing for ${options.host} session ${options.sessionId}`);
+        }
+        mkdirSync(dirname(landingPath), { recursive: true });
+        copyFileCloneOrFallback(nativePath, landingPath);
+      }
+      copySuccess = true;
+      break;
+    } catch (error) {
+      lastError = error;
+    }
+  }
+
+  if (copySuccess) {
+    sitianReportSafe({
+      level: "event",
+      kind: HOST_SESSION_RECORD_KIND,
+      host: options.host,
+      cwd: options.cwd,
+      sessionParent: options.sessionParent,
+      source: `${options.host}-dossier`,
+      payload: {
+        type: "native-session-copy",
+        nativePath,
+        landingPath,
+        ordinal,
+        sessionId: options.sessionId,
+      },
+    });
+  } else {
+    // A partial first attempt must not masquerade as a complete native original.
+    try { rmSync(landingPath, { recursive: options.host === "grok-build", force: true }); }
+    catch { /* warning below reports the original copy failure */ }
+    // Reserve the failed ordinal outside the native dossier landing namespace.
+    try {
+      mkdirSync(options.sessionDirectory, { recursive: true });
+      closeSync(openSync(join(options.sessionDirectory, `${options.host}-${sanitizedModel}-${ordinal}.failed`), "a"));
+    } catch { /* the warning below retains the original copy failure */ }
+    sitianReportSafe({
+      level: "event",
+      kind: HOST_SESSION_RECORD_KIND,
+      host: options.host,
+      cwd: options.cwd,
+      sessionParent: options.sessionParent,
+      source: `${options.host}-dossier`,
+      payload: {
+        type: "native-session-warning",
+        nativePath,
+        landingPath,
+        ordinal,
+        sessionId: options.sessionId,
+        error: lastError instanceof Error ? lastError.message : String(lastError),
+      },
+    });
+  }
 }

package/src/pi/role-turn-host.ts

@@ -22,7 +22,6 @@ import type {
   RoleTurnResult,
 } from "../host-contracts.ts";
 import { ExplicitInternalActivationError } from "../host-contracts.ts";
-import { isOfficerReviewSeat } from "../packaged-role-registry.ts";
 import { applyEngineChildEnv, ENGINE_MODEL_FLAG_NAME, normalizeEngineName } from "../engine-detour.ts";
 import { projectActivationFlags } from "../role-activation-flags.ts";
 import { encodeUserDialogueStdin } from "../user-dialogue-stdin.ts";
@@ -377,30 +376,7 @@ export function createPiRoleTurnHost(config: PiRoleTurnHostConfig): RoleTurnHost
 
   return {
     async executeTurn(request: RoleTurnRequest): Promise<RoleTurnResult> {
-      // #617 DK-7: Pi argv gets projected native paths once; never record bytes.
-      // Pi already owns its own session file, so only sitian prior volume rides in.
-      // #879: station-child officer dialogue keeps peer words — do not splice
-      // host-transition priorNativePaths into the review prompt body.
-      let turnRequest = request;
-      const officerStationChild =
-        request.stationChild === true && isOfficerReviewSeat(request.activation.role);
-      const paths =
-        !officerStationChild && request.hostTransition?.priorNativeKind === "sitian"
-          ? request.hostTransition.priorNativePaths
-          : undefined;
-      if (
-        request.continuation.kind === "resume"
-        && paths !== undefined
-        && paths.length > 0
-      ) {
-        turnRequest = {
-          ...request,
-          continuation: {
-            ...request.continuation,
-            prompt: `${request.continuation.prompt}\n${paths.join("\n")}`,
-          },
-        };
-      }
+      const turnRequest = request;
       const roleEntry = await realpath(resolveInternalRoleEntrypoint(config.packageRoot));
       const extraArgs = buildPiTurnExtraArgs(
         turnRequest,

package/src/public-cli/post-admission.ts

@@ -69,10 +69,8 @@ function isStationChildOfficerDialogue(
 }
 import {
   mintEngineDetourInvocationScope,
-  readInvocationSelectedHost,
   withEngineDetourInvocationScope,
 } from "../engine-detour-usage.ts";
-import { projectHostTransitionPriorNative } from "../host-transition-prior-native.ts";
 import type { CredentialProviders, SeatModelConfig } from "./config.ts";
 import {
   clearCurrentCourt,
@@ -92,6 +90,7 @@ import {
   type CatchableProcessSignal,
 } from "./process-cancel.ts";
 import { homeFromRunDirectory } from "../activation-ledger-topology.ts";
+import { recordRunStart } from "../host-session-record.ts";
 import {
   attemptProducedFreshSubmission,
   classifyPostAdmissionFailure,
@@ -808,53 +807,11 @@ export async function dispatchPostAdmissionTurn<
   try {
     // #987: do not pre-block or classify host dispatch from AK credential
     // catalog facts. Per-invocation runner/host evidence owns provider identity.
-    // #617 DK-4: capture previous invocation host before markRunRunning overwrites it.
-    // Single authority projectHostTransitionPriorNative classifies the prior native volume.
-    // Same-run resume (#637) keeps host identity on the run's invocation page.
-    let previousHost: string | undefined;
-    const liveHost = env.host;
-    const principalCoordinates =
-      admitted.principal === undefined
-        ? undefined
-        : env.principalAuthority.decode(admitted.principal);
-    let hostTransition: RoleTurnRequest["hostTransition"];
-    try {
-      previousHost = readInvocationSelectedHost(admitted.runDirectory);
-      hostTransition =
-        previousHost !== undefined && liveHost !== undefined && principalCoordinates !== undefined
-          ? await projectHostTransitionPriorNative({
-              previousHost,
-              liveHost,
-              piSessionFile: principalCoordinates.sessionFile,
-            })
-          : undefined;
-    } catch (error) {
-      // prior-native IO is on the public one-shot path — controlled failure, not bare throw.
-      return {
-        ...(await presentControlledFailure(
-          admitted,
-          withEngineDetourInvocationScope({
-            timedOut: false,
-            code: null,
-            stderr: "",
-            thrown: error,
-          }, request.invocationScopeId),
-          adapters,
-          env.principalAuthority,
-          io,
-          persistRunState,
-        )) as { exitCode: number; admitted: A; terminal: T },
-        ...deferredPersist,
-      };
-    }
-
     await clearTypedProviderHttpObservation(admitted.runDirectory);
     // The authoritative host write (markRunRunning) is delayed to just before
     // executeTurn — not merely past beforeDispatch (#840 r9 判词 class 2). Any
-    // pre-turn retry (beforeDispatch, dossier projection, continuation
-    // assembly) must still see the prior invocation host on its next attempt;
-    // committing env.host earlier would make readInvocationSelectedHost read back the
-    // new host on the retry and silently drop hostTransition.
+    // pre-turn retry (beforeDispatch, continuation assembly) must not commit a host
+    // identity until the turn is ready.
     // Failures settle the run (presentControlledFailure); they must not leave it
     // permanently running. Call-local auto-resume retries this hook until it
     // succeeds; only an exhausted nested station child skips the parent loop
@@ -903,13 +860,10 @@ export async function dispatchPostAdmissionTurn<
     if (env.stationChild !== undefined) {
       turnRequest = { ...turnRequest, stationChild: env.stationChild };
     }
-    if (hostTransition !== undefined) {
-      turnRequest = { ...turnRequest, hostTransition };
-    }
     // Selected host axis rides the shared Host envelope for in-turn tools
     // (detour usage ledger) — never a pre-spawn invocation.json reread.
-    if (typeof liveHost === "string" && liveHost.trim() !== "") {
-      turnRequest = { ...turnRequest, host: liveHost.trim() };
+    if (typeof env.host === "string" && env.host.trim() !== "") {
+      turnRequest = { ...turnRequest, host: env.host.trim() };
     }
     // 0081 non-dialogue face: freeze pointer section under run/attachments/.
     // Seat consumes via loadCaseDossierReadingMaterial → existing agent-start
@@ -939,6 +893,7 @@ export async function dispatchPostAdmissionTurn<
 
     let result: RoleTurnResult;
     try {
+      recordRunStart(admitted.runDirectory);
       result = await env.roleTurnHost.executeTurn(turnRequest);
     } catch (error) {
       const processCancelName = processCancelSignalName(env.signal);

package/src/public-role-summons.ts

@@ -796,8 +796,7 @@ export async function summonGateOfficer(options: {
     // Hard path resolve: fail loud — never fall through to packageMachineHome (#604 / #675).
     home = homeFromRunDirectory(options.sourceRunDirectory);
   }
-  // Officer host is seat-owned only (#821). Parent invocation.json.host stays a
-  // hostTransition consumer in post-admission — not an officer override channel.
+  // Officer host is seat-owned only (#821), not a parent override channel.
   // #879: binding pointer = parent run directory; dialogue content = submission body.
   // Conclusion re-ask keeps sole ownership of reviewReask when present.
   let gateReviewInstruction: string | undefined;