@bongos/core 1.19.870 → 1.19.872

package/scripts/gds/autobongos-run.js

@@ -0,0 +1,317 @@
+#!/usr/bin/env node
+'use strict';
+
+// scripts/gds/autobongos-run.js — the Autobongos supervisor's I/O half
+// (task 1003902; ADR 0307 §1). One iteration is: gauge → pick → claim → spawn
+// one worker → record. No model anywhere in this file; every branch it takes is
+// a branch a person can read.
+//
+//   node scripts/gds/autobongos-run.js --goal 1000119            # one task
+//   node scripts/gds/autobongos-run.js --goal 1000119 --max-tasks 5
+//   node scripts/gds/autobongos-run.js --goal 1000119 --dry-run  # pick only, claim nothing
+//
+// SCOPE, and what deliberately is NOT here:
+//   · the ALLOWLIST is `--goal` / AUTOBONGOS_GOALS for now. Task 1003908 moves it
+//     into the database where the machine cannot edit it, and adds the kill
+//     switch. Until then this refuses to run with no goal named, rather than
+//     defaulting to "anything claimable".
+//   · CONFIRMING a ship against the ledger is autobongos-verify.js (task
+//     1003903), called at step 6. A worker's `shipped` is a CLAIM — recorded here
+//     as `claims_shipped` so nothing can mistake it for a fact — and the ledger
+//     read is what turns it into one, or into a released claim and a blocker.
+//   · BACKOFF and never-terminally-stopping is task 1003904. This exits after
+//     its budget; it does not yet decide when to come back.
+
+const { execFile, spawn } = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+const seq = require('./sequence.js');
+const gauge = require('./autonomy-gauge.js');
+const {
+  buildWorkerArgs, buildWorkerPrompt, classifyRun, DEFAULT_MODEL, DEFAULT_WORKER_TIMEOUT_MS,
+} = require('./autobongos-loop.js');
+const { verifyShip } = require('./autobongos-verify.js');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+function readArgv(argv) {
+  const out = { goals: [], maxTasks: 1, dryRun: false, json: false, model: DEFAULT_MODEL, timeoutMs: DEFAULT_WORKER_TIMEOUT_MS };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--goal') { out.goals.push(Number(argv[++i])); continue; }
+    if (a.startsWith('--goal=')) { out.goals.push(Number(a.slice(7))); continue; }
+    if (a === '--max-tasks') { out.maxTasks = Number(argv[++i]); continue; }
+    if (a === '--model') { out.model = argv[++i]; continue; }
+    if (a === '--timeout-min') { out.timeoutMs = Number(argv[++i]) * 60_000; continue; }
+    if (a === '--dry-run') { out.dryRun = true; continue; }
+    if (a === '--json') { out.json = true; continue; }
+  }
+  if (!out.goals.length && process.env.AUTOBONGOS_GOALS) {
+    out.goals = String(process.env.AUTOBONGOS_GOALS).split(',').map((g) => Number(g.trim())).filter(Boolean);
+  }
+  return out;
+}
+
+const run = (file, args, opts = {}) => new Promise((resolve) => {
+  execFile(file, args, { cwd: REPO_ROOT, maxBuffer: 32 * 1024 * 1024, ...opts },
+    (err, stdout, stderr) => resolve({ ok: !err, code: err ? (err.code ?? 1) : 0, stdout: stdout || '', stderr: stderr || '' }));
+});
+
+// The run log is the supervisor's own record. It is NOT the ledger — Bongos is —
+// but a machine nobody is watching must be able to say afterwards what it did,
+// and an append-only JSONL survives a kill -9 mid-iteration.
+function logPath() {
+  if (process.env.AUTOBONGOS_LOG_FILE) return process.env.AUTOBONGOS_LOG_FILE;
+  try { return require('../../src/instance-config.js').configPath('autobongos-runs.jsonl'); }
+  catch (_) { return path.join(REPO_ROOT, 'autobongos-runs.jsonl'); }
+}
+function record(entry) {
+  const row = { at: new Date().toISOString(), ...entry };
+  try {
+    const p = logPath();
+    fs.mkdirSync(path.dirname(p), { recursive: true });
+    fs.appendFileSync(p, `${JSON.stringify(row)}\n`);
+  } catch (_) { /* a runner that cannot log must still run */ }
+  return row;
+}
+
+// pickTask — the allowlisted goals, in order, through sequence.js's halt matrix.
+// The matrix is reused rather than re-derived: it already refuses thin specs,
+// protected paths, judgement kinds and unmet dependencies, from facts on the row.
+// The assembly below mirrors sequence.js's own --goal --next path step for step,
+// so the runner and a person running /builder-sequence cannot disagree about
+// which task is next.
+//
+// `claimableIds` is fetched because the matrix's `not_claimable` reason defers to
+// the server's own feed rather than re-deriving its filter here. A null (feed
+// unreadable) makes that one reason stay QUIET rather than halt everything —
+// ADR 0153 records the bug where the opposite turned an empty read into a
+// universal halt.
+async function pickTask(goals, deps = {}) {
+  const api = deps.api || await (require('./cli-lib').cliClient)();
+  let rank = deps.rank;
+  if (rank === undefined) {
+    const me = await api.me.getMe();
+    rank = me.ok ? me.data.builder?.rank : null;
+  }
+  const claimableIds = await seq.fetchClaimableIds(api);
+
+  for (const goalId of goals) {
+    let byId;
+    try { byId = await seq.fetchGoalTasks(api, goalId, seq.GOAL_PAGE); }
+    catch (e) { return { error: `goal ${goalId}: ${e.message}` }; }
+
+    const candidates = Array.from(byId.values()).filter((t) => !seq.TERMINAL.has(t.status));
+    const { order } = seq.topoOrder(candidates);
+    const { next, skipped } = seq.pickNext(order, { rank, claimableIds });
+    if (next) return { task: next, goalId, skipped };
+  }
+  return { none: true };
+}
+
+// WORKER_ENV_ALLOW — what a worker is allowed to inherit (grader finding, task
+// 1003902). Spreading `process.env` handed a bypassPermissions session every
+// credential the supervisor happened to hold — DB URLs, npm and git tokens — to a
+// process whose only injection defence is a prompt fence. The fence is good and
+// it is not a technical barrier, so the blast radius of a jailbreak has to be
+// bounded by something that is.
+//
+// The worker needs: to run node and claude (PATH/HOME/SHELL and the platform's
+// own required vars), to reach the instance (BONGOS_API_BASE), and to be told it
+// is a subagent. It does NOT need a git push credential — the road to main is the
+// server-mediated pipeline (ADR 0307 §6) — so none is passed.
+const WORKER_ENV_ALLOW = [
+  'PATH', 'HOME', 'SHELL', 'LANG', 'LC_ALL', 'TZ', 'TMPDIR', 'USER', 'LOGNAME',
+  'SystemRoot', 'windir', 'COMSPEC', 'PATHEXT', 'USERPROFILE', 'APPDATA', 'LOCALAPPDATA', 'TEMP', 'TMP',
+  'BONGOS_API_BASE', 'CLOUDBONGOS_API_BASE',
+  'OTB_CLAUDE_BIN', 'CLAUDE_BIN',
+  'XDG_CONFIG_HOME',
+];
+
+function workerEnv(source = process.env, extra = {}) {
+  const out = {};
+  for (const k of WORKER_ENV_ALLOW) if (source[k] !== undefined) out[k] = source[k];
+  // An operator can widen this deliberately and visibly, never by accident.
+  const widen = String(source.AUTOBONGOS_WORKER_ENV_EXTRA || '').split(',').map((x) => x.trim()).filter(Boolean);
+  for (const k of widen) if (source[k] !== undefined) out[k] = source[k];
+  return { ...out, OTB_SUBAGENT: '1', ...extra };
+}
+
+const MAX_WORKER_OUTPUT = 8 * 1024 * 1024;   // a misbehaving worker must not grow memory until the timeout
+
+// spawnWorker — one headless session, bounded by WALL CLOCK, in the task's own
+// working tree.
+async function spawnWorker({ task, model, timeoutMs, cwd, deps = {} }) {
+  const spawnFn = deps.spawn || spawn;
+  const sessionId = deps.sessionId || crypto.randomUUID();   // pinned, so the session can be resumed
+  const bin = process.env.OTB_CLAUDE_BIN || process.env.CLAUDE_BIN || 'claude';
+  const isRoot = typeof process.getuid === 'function' && process.getuid() === 0;
+  const args = buildWorkerArgs({ sessionId, model, isRoot });
+  const prompt = buildWorkerPrompt({ task });
+
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawnFn(bin, args, {
+        cwd,
+        // stdin is a PIPE we write the prompt into and close. Never inherit: a
+        // `claude -p` with an open inherited stdin waits seconds for input that
+        // never comes, on every single spawn.
+        stdio: ['pipe', 'pipe', 'pipe'],
+        shell: process.platform === 'win32',   // `claude` is a .cmd shim on Windows
+        windowsHide: true,
+        env: workerEnv(),
+      });
+    } catch (e) { return resolve({ spawnError: e.message }); }
+
+    let stdout = ''; let stderr = ''; let timedOut = false; let truncated = false;
+    const cap = (cur, d) => {
+      if (cur.length >= MAX_WORKER_OUTPUT) { truncated = true; return cur; }
+      return cur + String(d).slice(0, MAX_WORKER_OUTPUT - cur.length);
+    };
+    const timer = setTimeout(() => { timedOut = true; try { child.kill('SIGKILL'); } catch (_) {} }, timeoutMs);
+    child.stdout.on('data', (d) => { stdout = cap(stdout, d); });
+    child.stderr.on('data', (d) => { stderr = cap(stderr, d); });
+    child.on('error', (e) => { clearTimeout(timer); resolve({ spawnError: e.message, sessionId }); });
+    child.on('close', (code) => {
+      clearTimeout(timer);
+      resolve({ envelope: stdout, exitCode: code, timedOut, truncated, sessionId, stderr: stderr.slice(-2000) });
+    });
+    child.stdin.end(prompt);
+  });
+}
+
+// worktreeFor — the task gets its OWN linked working tree, and this is not a
+// nicety (grader finding, task 1003902).
+//
+// worktree-per-claim is an ENFORCED project default: worktree-claim-guard.js
+// refuses any claim made from the main checkout, with no escape but `--here`.
+// The natural shape for a long-lived unattended supervisor is one persistent
+// checkout — which is the main checkout — so the first cut of this loop would
+// have taken `claim_failed` on every single iteration and never done any work.
+// Reaching for `--here` would "fix" that by defeating the guard: the worker's
+// branch would land in the supervisor's own tree, which is precisely the strand
+// the guard exists to prevent.
+//
+// The name carries the task id plus a random suffix. Unique by construction, so
+// it cannot collide with another active claim's tree — a collision makes the
+// server store a disambiguated name the ship lock can never match (task 1004031).
+function worktreeName(taskId) {
+  return `autobongos-${taskId}-${crypto.randomBytes(3).toString('hex')}`;
+}
+
+async function iteration(opts, deps = {}) {
+  const runCmd = deps.run || run;
+  const spawnWork = deps.spawnWorker || spawnWorker;
+  const readGauge = deps.gauge || (() => gauge.evaluate());
+  const pick = deps.pickTask || pickTask;
+  const log = deps.record || record;
+
+  // 1. The gauge. Never start a task we cannot pay for out of the window.
+  const g = readGauge();
+  if (!g.decision.go) {
+    return log({ event: 'hold', go: false, unknown: !!g.decision.unknown, reason: g.decision.reason, sleep_until: g.decision.sleepUntil ?? null });
+  }
+
+  // 2. Pick.
+  const picked = await pick(opts.goals, deps.pickDeps || {});
+  if (picked.error) return log({ event: 'pick_failed', reason: picked.error });
+  if (picked.none) return log({ event: 'nothing_claimable', goals: opts.goals });
+  const task = picked.task;
+  if (opts.dryRun) return log({ event: 'dry_run', task_id: task.id, title: task.title, goal_id: picked.goalId });
+
+  // 3. The task's own working tree.
+  const wtName = deps.worktreeName ? deps.worktreeName(task.id) : worktreeName(task.id);
+  const made = await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'add', wtName, '--base', 'origin/main']);
+  if (!made.ok) {
+    return log({ event: 'worktree_failed', task_id: task.id, worktree: wtName, reason: (made.stderr || made.stdout).slice(-400) });
+  }
+  const wtPath = path.join(REPO_ROOT, '.claude', 'worktrees', wtName);
+
+  // 4. Claim FROM that tree, so claim.js records it as the claim's tree and the
+  // ship lock later agrees with where the work actually is.
+  const claimed = await runCmd(process.execPath, [path.join(REPO_ROOT, 'scripts', 'gds', 'claim.js'), String(task.id)], { cwd: wtPath });
+  if (!claimed.ok) {
+    await runCmd(process.execPath, [path.join('scripts', 'gds', 'worktree.js'), 'remove', wtName]);
+    return log({ event: 'claim_failed', task_id: task.id, worktree: wtName, reason: (claimed.stderr || claimed.stdout).slice(-400) });
+  }
+
+  // 5. Work, in that tree.
+  const started = Date.now();
+  const res = await spawnWork({ task, model: opts.model, timeoutMs: opts.timeoutMs, cwd: wtPath, deps });
+  const verdict = classifyRun(res);
+
+  // 6. VERIFY FROM THE LEDGER (task 1003903). Read the task back from Bongos and
+  // let IT say what happened — for every outcome, not only a claimed ship. The
+  // worker's own verdict becomes context in the blocker body, never the branch: a
+  // worker that stopped dead needing a decision and one that finished the job
+  // return structurally identical envelopes, and the ledger is the only thing
+  // that can tell them apart.
+  //
+  // The release decision moved HERE from the worker's verdict, and that move is
+  // the point of the step rather than a tidy-up. `still_held` is a fact about the
+  // ledger; `worker_failed` is a report from the thing being checked. The TREE is
+  // left alone either way — it may hold committed work, and the land/ship
+  // pipeline owns worktree cleanup.
+  const ledger = await verifyShip(
+    { taskId: task.id, taskTitle: task.title, worker: { outcome: verdict.outcome, reason: verdict.reason } },
+    {
+      api: deps.api,
+      cwd: wtPath,
+      release: deps.release || ((id, reason) => runCmd(process.execPath,
+        [path.join(REPO_ROOT, 'scripts', 'gds', 'release.js'), String(id), '--reason', reason], { cwd: wtPath })),
+      ...(deps.verifyDeps || {}),
+    },
+  );
+
+  const row = {
+    event: 'worked', task_id: task.id, title: task.title, goal_id: picked.goalId,
+    worktree: wtName,
+    outcome: verdict.outcome, reason: verdict.reason,
+    session_id: res.sessionId || null, duration_s: Math.round((Date.now() - started) / 1000),
+    cost_usd: verdict.costUsd ?? null,
+    output_truncated: !!res.truncated,
+    undetermined_decisions: verdict.verdict ? verdict.verdict.undetermined_decisions : null,
+    // What the LEDGER says, kept separate from what the worker said, so the run
+    // log can be read afterwards without having to trust either one alone.
+    ledger_status: ledger.status, ledger_shape: ledger.shape, verified: !!ledger.verified,
+    artifact_on_main: ledger.artifact && ledger.artifact.checked ? !!ledger.artifact.onMain : null,
+    claim_released: !!ledger.released,
+    blocker_id: ledger.blocker && ledger.blocker.blockerId ? ledger.blocker.blockerId : null,
+    task_parked: !!(ledger.blocker && ledger.blocker.parked),
+  };
+  // An unreadable ledger stops the run. Picking another task while unable to see
+  // what happened to the last one is how a machine nobody is watching digs.
+  if (ledger.halt) row.event = 'verify_halt';
+  return log(row);
+}
+
+async function main(argv) {
+  const opts = readArgv(argv);
+  if (!opts.goals.length) {
+    console.error('autobongos-run: name at least one allowlisted goal (--goal N, or AUTOBONGOS_GOALS).');
+    console.error('  Refusing to run against "anything claimable" — the allowlist is half of what makes this safe to leave alone.');
+    return 2;
+  }
+  for (let i = 0; i < opts.maxTasks; i++) {
+    const row = await iteration(opts);
+    if (opts.json) console.log(JSON.stringify(row));
+    else console.log(`${row.event}${row.task_id ? ` task ${row.task_id}` : ''}${row.outcome ? ` → ${row.outcome}` : ''}${row.reason ? `: ${row.reason}` : ''}`);
+    // Anything that is not a completed piece of work ends this run — including
+    // `verify_halt`, which is the ledger being unreadable. Deciding when to come
+    // back is task 1003904's job, not this one's.
+    if (row.event !== 'worked') break;
+  }
+  return 0;
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).then((c) => process.exit(c)).catch((e) => {
+    console.error(`autobongos-run: ${e && e.message ? e.message : e}`);
+    process.exit(1);
+  });
+}
+
+module.exports = { readArgv, pickTask, iteration, record, logPath, spawnWorker, workerEnv, WORKER_ENV_ALLOW, worktreeName };