@atolis-hq/wake 0.4.30 → 0.4.32

package/dist/src/bootstrap/initialise.js

@@ -401,7 +401,7 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \\"\${WAKE_HOME_INIT_DIRS:-}\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"\${WAKE_HOME_INIT_ROOT:-}\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \\"$WAKE_MAIN_JS\\" sandbox-entrypoint --wake-root /wake'"]
 `;
 const packagedDockerfile = `# syntax=docker/dockerfile:1
 FROM node:24-bookworm-slim
@@ -468,7 +468,7 @@ EXPOSE 4317
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \\"$WAKE_HOME_INIT_DIRS\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"$WAKE_HOME_INIT_ROOT\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \\"\${WAKE_HOME_INIT_DIRS:-}\\" ]; then printf '%s\\n' \\"$WAKE_HOME_INIT_DIRS\\" | while IFS= read -r directory; do case \\"$directory\\" in \\"\${WAKE_HOME_INIT_ROOT:-}\\"/*) mkdir -p \\"$directory\\"; chown wake:wake \\"$directory\\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint'"]
 `;
 const userDockerfile = `# User-owned sandbox extension. Wake updates the managed runtime image separately.
 FROM wake-sandbox-runtime:managed

package/dist/src/bootstrap/integration-runtime.js

@@ -4,7 +4,7 @@ import { join } from 'node:path';
 import { ControlStreamKind, ScheduleService, createIntakePipeline, createRunnerPipeline, createWorkCancellationPolicy, } from '../control-plane/index.js';
 import { RunRepository, createRuntimeMemoryProfile, } from '../execution/index.js';
 import { AgentRunPublicationReactor, ArtifactRegistrationReactor, DeliveryOutcomeReactor, DeliveryService, IntegrationStreamKind, PollService, ProviderRegistry, deliveryProjectionDefinitions, fakeProviderDefinition, } from '../integrations/index.js';
-import { compileWorkflowSelectors, createPullRequestTransitionEvidence, createResourceTransitionReactor, createWatchReactor, createWatchReconciler, selectWorkflow, workflowName, } from '../orchestration/index.js';
+import { compileWorkflowSelectors, createConversationCommandReactor, createPullRequestTransitionEvidence, createResourceTransitionReactor, createWatchReactor, createWatchReconciler, selectWorkflow, workflowName, } from '../orchestration/index.js';
 import { BuiltInResourceCapability, resourceId, } from '../resources/index.js';
 import { hydrateFakeProviderEvidence } from './fake-provider-files.js';
 import { createRuntimeProjectionSubscriptions, } from './projection-runtime.js';
@@ -109,6 +109,7 @@ export async function composeIntegrationRuntime(input) {
         return operation();
     });
     const outcomes = new DeliveryOutcomeReactor(input.journal, input.orchestration, input.projections, input.processorState, input.conversations, input.subscriptionRunSerialiser);
+    const conversationCommands = createConversationCommandReactor(input.orchestration);
     // Only poll hits a rate-limited external API, so only this half of the
     // Tick needs a backing-off host; see bootstrap/surface-cli-applications.ts.
     // Inbound translation reads durable provider facts through its own services,
@@ -163,6 +164,7 @@ export async function composeIntegrationRuntime(input) {
             artifacts.processor,
             outcomes.processor,
             agentRunPublications.processor,
+            conversationCommands.processor,
             ...providers.map((provider) => provider.inbound.processor),
         ],
         providers,

package/dist/src/bootstrap/version.js

@@ -124,6 +124,6 @@ export function resolveWakeVersion(options = {}) {
         return `g${headHash.slice(0, 7)}`;
     return '0.1.0-dev';
 }
-export const wakeVersion = "v0.4.30";
+export const wakeVersion = "v0.4.32";
 /** The registry-installable version used by packaged sandbox images. */
 export const wakePackageVersion = packageVersion(defaultRepoRoot) ?? wakeVersion;

package/dist/src/conversations/contracts/events.js

@@ -39,6 +39,8 @@ const origin = z.discriminatedUnion('kind', [
         resourceId: z.string().min(1),
         threadId: z.string().min(1),
         messageId: z.string().min(1),
+        authorized: z.boolean().optional(),
+        capabilities: z.array(z.string().min(1)).readonly().optional(),
         location: z
             .object({
             path: z.string().min(1),

package/dist/src/conversations/contracts/identifiers.d.ts

@@ -3,3 +3,4 @@ import type { WorkItemId } from '../../work/index.js';
 export type ConversationId = Brand<string, 'ConversationId'>;
 export declare function conversationId(value: string): ConversationId;
 export declare function conversationIdForWorkItem(workItemId: WorkItemId): ConversationId;
+export declare function workItemIdForConversation(conversationIdValue: ConversationId): WorkItemId;

package/dist/src/conversations/contracts/identifiers.js

@@ -6,3 +6,6 @@ export function conversationId(value) {
 export function conversationIdForWorkItem(workItemId) {
     return conversationId(`conversation-${String(workItemId).slice('work-'.length)}`);
 }
+export function workItemIdForConversation(conversationIdValue) {
+    return `work-${String(conversationIdValue).slice('conversation-'.length)}`;
+}

package/dist/src/conversations/contracts/views.d.ts

@@ -16,6 +16,10 @@ export type ConversationEntryOrigin = {
     readonly resourceId: string;
     readonly threadId: string;
     readonly messageId: string;
+    /** Authority established by the receiving surface before the entry is recorded. */
+    readonly authorized?: boolean | undefined;
+    /** Commands available to this entry's receiving surface. */
+    readonly capabilities?: readonly string[] | undefined;
     readonly location?: {
         readonly path: string;
         readonly line: number;

package/dist/src/integrations/github/application/inbound-translator.d.ts

@@ -75,7 +75,6 @@ export declare class InboundTranslator {
     private recordConversationDeferred;
     private appendConversationRecordFact;
     private recordConversationEntry;
-    private applyConversationCommand;
     private failureRecorded;
     private retryRecorded;
     private recordTranslationRecovery;

package/dist/src/integrations/github/application/inbound-translator.js

@@ -110,7 +110,8 @@ export class InboundTranslator {
             if (isGitHubAdapterEventType(owned, GitHubEventType.WorkObserved))
                 await this.apply(owned);
             if (isGitHubAdapterEventType(owned, GitHubEventType.CommentObserved)) {
-                if (!(await this.suppressWorkItemEffects(owned)))
+                if (owned.event.payload.reviewKind === 'formal' &&
+                    !(await this.suppressWorkItemEffects(owned)))
                     await applyReviewSignal({
                         event: owned,
                         journal: this.journal,
@@ -226,7 +227,7 @@ export class InboundTranslator {
             entry.origin.messageId === externalId);
         if (existing?.entries.some((entry) => entry.representations.some((representation) => representation.resourceId === resource.resourceId &&
             representation.externalId === externalId)))
-            return this.applyConversationCommand(correlation.workItemId, event);
+            return;
         if (priorEntry !== undefined) {
             if (priorEntry.body !== event.event.payload.body)
                 await this.conversations.revise({
@@ -234,7 +235,7 @@ export class InboundTranslator {
                     entryId: priorEntry.entryId,
                     body: event.event.payload.body,
                 }, commandContext(event));
-            return this.applyConversationCommand(correlation.workItemId, event);
+            return;
         }
         await this.conversations.record({
             conversationId,
@@ -247,24 +248,14 @@ export class InboundTranslator {
                 resourceId: resource.resourceId,
                 threadId: resource.externalKey.key,
                 messageId: externalId,
+                authorized: isAuthorizedConversationActor(event),
+                capabilities: this.conversationCapabilities,
                 ...(event.event.payload.reviewKind !== 'issue' ||
                     event.event.payload.location === undefined
                     ? {}
                     : { location: event.event.payload.location }),
             },
         }, commandContext(event));
-        await this.applyConversationCommand(correlation.workItemId, event);
-    }
-    async applyConversationCommand(workItemId, event) {
-        // Native formal reviews already carry their own verified decision and workflow signal.
-        if (event.event.payload.reviewKind !== 'issue')
-            return;
-        await this.orchestration?.applyConversationCommand(workItemId, {
-            body: event.event.payload.body,
-            actorId: event.event.payload.actor.id,
-            capabilities: this.conversationCapabilities,
-            authorized: isAuthorizedConversationActor(event),
-        }, commandContext(event));
     }
     async failureRecorded(sourceEventId) {
         return (await this.journal.readStream(integrationStream(this.adapter))).some((event) => {

package/dist/src/orchestration/application/conversation-command-reactor.d.ts

@@ -0,0 +1,6 @@
+import { type EventProcessor } from '@atolis-hq/eventing';
+import type { OrchestrationService } from './orchestration-service.js';
+/** Applies human commands only after their external message is canonical conversation history. */
+export declare function createConversationCommandReactor(orchestration: OrchestrationService): {
+    readonly processor: EventProcessor;
+};

package/dist/src/orchestration/application/conversation-command-reactor.js

@@ -0,0 +1,59 @@
+import { EventActorKind, EventProcessorCategory, EventProcessorReplayPolicy, correlationId, defineEventProcessor, } from '@atolis-hq/eventing';
+import { ConversationEventType, ConversationOriginKind, selectConversationEvent, workItemIdForConversation, } from '../../conversations/index.js';
+import { conversationCommand } from './conversation-command.js';
+/** Applies human commands only after their external message is canonical conversation history. */
+export function createConversationCommandReactor(orchestration) {
+    return {
+        processor: defineEventProcessor({
+            consumer: 'reactor:orchestration.conversation-command',
+            name: 'orchestration.conversation-command',
+            owner: 'orchestration',
+            category: EventProcessorCategory.Reactor,
+            replayPolicy: EventProcessorReplayPolicy.Idempotent,
+            select(event) {
+                const conversation = selectConversationEvent(event);
+                if (conversation?.event.eventType !== ConversationEventType.EntryRecorded)
+                    return null;
+                return {
+                    conversationId: conversation.stream.id,
+                    eventId: conversation.event.eventId,
+                    correlationId: conversation.event.correlationId,
+                    occurredAt: conversation.event.occurredAt,
+                    entry: conversation.event.payload,
+                };
+            },
+            async handle(event) {
+                if (event === null)
+                    return;
+                const { entry } = event;
+                if (entry.origin.kind !== ConversationOriginKind.External)
+                    return;
+                const workItemId = workItemIdForConversation(event.conversationId);
+                const input = {
+                    body: entry.body,
+                    actorId: entry.origin.actorId,
+                    capabilities: (entry.origin.capabilities ?? []),
+                    authorized: entry.origin.authorized === true,
+                };
+                await orchestration.applyConversationCommand(workItemId, input, {
+                    commandId: `${event.eventId}:conversation-command`,
+                    correlationId: correlationId(event.correlationId),
+                    occurredAt: event.occurredAt,
+                    actor: { kind: EventActorKind.Integration, id: entry.origin.adapter },
+                });
+                if (conversationCommand(entry.body) !== null || !input.authorized)
+                    return;
+                for (const workflow of await orchestration.listAll()) {
+                    if (workflow.workItemId !== workItemId)
+                        continue;
+                    await orchestration.resumeBlockedStageForChanges(workflow.workflowInstanceId, {
+                        commandId: `${event.eventId}:conversation-reply`,
+                        correlationId: correlationId(event.correlationId),
+                        occurredAt: event.occurredAt,
+                        actor: { kind: EventActorKind.Integration, id: entry.origin.adapter },
+                    });
+                }
+            },
+        }),
+    };
+}

package/dist/src/orchestration/index.d.ts

@@ -11,6 +11,7 @@ export * from './application/signal-reactor.js';
 export * from './application/watch-reactor.js';
 export * from './application/trigger-workflow-instance.js';
 export * from './application/conversation-command.js';
+export * from './application/conversation-command-reactor.js';
 export * from './application/workflow-definition-registry.js';
 export * from './contracts/activity-outcome.js';
 export * from './contracts/commands.js';

package/dist/src/orchestration/index.js

@@ -11,6 +11,7 @@ export * from './application/signal-reactor.js';
 export * from './application/watch-reactor.js';
 export * from './application/trigger-workflow-instance.js';
 export * from './application/conversation-command.js';
+export * from './application/conversation-command-reactor.js';
 export * from './application/workflow-definition-registry.js';
 export * from './contracts/activity-outcome.js';
 export * from './contracts/commands.js';

package/docker/Dockerfile.runtime

@@ -84,4 +84,4 @@ ENV WAKE_MAIN_JS=/app/dist/src/main.js
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \"$WAKE_HOME_INIT_DIRS\" ]; then printf '%s\\n' \"$WAKE_HOME_INIT_DIRS\" | while IFS= read -r directory; do case \"$directory\" in \"$WAKE_HOME_INIT_ROOT\"/*) mkdir -p \"$directory\"; chown wake:wake \"$directory\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \"$WAKE_MAIN_JS\" sandbox-entrypoint --wake-root /wake'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \"${WAKE_HOME_INIT_DIRS:-}\" ]; then printf '%s\\n' \"$WAKE_HOME_INIT_DIRS\" | while IFS= read -r directory; do case \"$directory\" in \"${WAKE_HOME_INIT_ROOT:-}\"/*) mkdir -p \"$directory\"; chown wake:wake \"$directory\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec node \"$WAKE_MAIN_JS\" sandbox-entrypoint --wake-root /wake'"]

package/docker/Dockerfile.runtime.packaged

@@ -65,4 +65,4 @@ EXPOSE 4317
 # Startup ownership repair is best effort because bind-mounted paths or host
 # permissions may prevent chown. The bounded direct-child pass avoids traversing
 # accumulated runtime data.
-ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \"$WAKE_HOME_INIT_DIRS\" ]; then printf '%s\\n' \"$WAKE_HOME_INIT_DIRS\" | while IFS= read -r directory; do case \"$directory\" in \"$WAKE_HOME_INIT_ROOT\"/*) mkdir -p \"$directory\"; chown wake:wake \"$directory\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint --wake-root /wake'"]
+ENTRYPOINT ["sh", "-c", "set -eu; mkdir -p /wake/.wake /wake/workspaces /wake/.wake/auth; chown wake:wake /wake/.wake /wake/workspaces /wake/.wake/auth || true; find /wake/.wake -mindepth 1 -maxdepth 1 -type d -exec chown wake:wake {} + || true; find /wake/.wake/auth -mindepth 1 -maxdepth 1 -type f -exec chown wake:wake {} + || true; if [ -n \"${WAKE_HOME_INIT_DIRS:-}\" ]; then printf '%s\\n' \"$WAKE_HOME_INIT_DIRS\" | while IFS= read -r directory; do case \"$directory\" in \"${WAKE_HOME_INIT_ROOT:-}\"/*) mkdir -p \"$directory\"; chown wake:wake \"$directory\" ;; *) exit 1 ;; esac; done; fi; exec su wake -s /bin/sh -c 'HOME=/home/wake exec wake sandbox-entrypoint --wake-root /wake'"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atolis-hq/wake",
-  "version": "0.4.30",
+  "version": "0.4.32",
   "description": "Local autonomous agent control plane for software development",
   "license": "Apache-2.0",
   "repository": {