@citeark/agent 0.3.20

package/src/compute/codex-account-session.mjs

@@ -0,0 +1,107 @@
+import { readFile, writeFile, mkdir, chmod, unlink } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { pathToFileURL } from "node:url";
+
+export function validateCodexLogin(text) {
+  let value;
+  try { value = JSON.parse(text); } catch { throw new Error("codex.account_invalid_login"); }
+  if (value.auth_mode !== "chatgpt" || !value.tokens?.access_token || !value.tokens?.refresh_token || !value.tokens?.account_id
+      || value.OPENAI_API_KEY) throw new Error("codex.account_invalid_login");
+  return value;
+}
+
+// This file runs as the existing Batch supervisor, never as a model API proxy.
+// The lock has no automatic expiry: a dead VM must be verified before an operator
+// removes its lock, so a delayed worker cannot overwrite another login refresh.
+export async function accountSession(action, { env = process.env, fetchImpl = fetch } = {}) {
+  const id = env.CITEARK_CODEX_ACCOUNT_ID;
+  if (!id) return;
+  if (!/^[a-z0-9][a-z0-9-]{0,47}$/.test(id)) throw new Error("codex.account_invalid_id");
+  const secret = env.CITEARK_CODEX_AUTH_SECRET;
+  if (!/^projects\/[^/]+\/secrets\/citeark-codex-[a-z0-9-]+\/versions\/latest$/.test(secret ?? "")) throw new Error("codex.account_invalid_secret");
+  const bucket = env.CITEARK_CODEX_ACCOUNT_BUCKET;
+  const owner = env.CITEARK_CODEX_ACCOUNT_OWNER;
+  if (!bucket || !owner) throw new Error("codex.account_missing_binding");
+  const home = env.CODEX_HOME;
+  if (!home) throw new Error("codex.account_missing_home");
+  const statePath = env.CITEARK_CODEX_ACCOUNT_STATE ?? `/tmp/citeark-codex-${id}-session.json`;
+  const authPath = `${home}/auth.json`;
+  const coordinatorManaged = env.CITEARK_CODEX_ACCOUNT_LOCK_MODE === "coordinator";
+  const digest = (text) => createHash("sha256").update(text).digest("hex");
+  const response = await fetchImpl("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token", {
+    headers: { "Metadata-Flavor": "Google" }, signal: AbortSignal.timeout(10000),
+  });
+  if (!response.ok) throw new Error("codex.account_metadata_unavailable");
+  const { access_token: token } = await response.json();
+  if (!token) throw new Error("codex.account_metadata_unavailable");
+  const request = (url, options = {}) => fetchImpl(url, { ...options,
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...options.headers }, signal: AbortSignal.timeout(20000) });
+  const object = `codex-accounts/${id}/active.json`;
+  const objectUrl = `https://storage.googleapis.com/storage/v1/b/${encodeURIComponent(bucket)}/o/${encodeURIComponent(object)}`;
+  if (action === "open") {
+    let generation;
+    if (coordinatorManaged) {
+      const lock = await request(`${objectUrl}?alt=media`);
+      if (!lock.ok) throw new Error("codex.account_lock_lost");
+      const current = await lock.json();
+      generation = lock.headers.get("x-goog-generation");
+      if (current?.owner !== owner || !/^\d+$/.test(generation ?? "")) {
+        throw new Error("codex.account_owner_mismatch");
+      }
+    } else {
+      const lock = await request(`https://storage.googleapis.com/upload/storage/v1/b/${encodeURIComponent(bucket)}/o?uploadType=media&name=${encodeURIComponent(object)}&ifGenerationMatch=0`, {
+        method: "POST", body: JSON.stringify({ owner, createdAt: new Date().toISOString() }),
+      });
+      if (!lock.ok) throw new Error(lock.status === 412 ? "codex.account_busy" : "codex.account_lock_failed");
+      ({ generation } = await lock.json());
+    }
+    const state = { owner, generation, digest: null };
+    await writeFile(statePath, JSON.stringify(state), { mode: 0o600 });
+    try {
+      const login = await request(`https://secretmanager.googleapis.com/v1/${secret}:access`);
+      if (!login.ok) throw new Error("codex.account_login_required");
+      const text = Buffer.from((await login.json()).payload.data, "base64").toString("utf8");
+      validateCodexLogin(text);
+      await mkdir(home, { recursive: true });
+      await writeFile(authPath, text, { mode: 0o600 });
+      await chmod(authPath, 0o600);
+      state.digest = digest(text);
+      await writeFile(statePath, JSON.stringify(state), { mode: 0o600 });
+    } catch (error) {
+      if (!coordinatorManaged) {
+        await request(`${objectUrl}?ifGenerationMatch=${generation}`, { method: "DELETE" });
+      }
+      await unlink(statePath).catch(() => {});
+      throw error;
+    }
+    return;
+  }
+  if (!new Set(["save", "close"]).has(action)) throw new Error("codex.account_invalid_action");
+  let state;
+  try { state = JSON.parse(await readFile(statePath, "utf8")); } catch (error) {
+    if (action === "close" && error.code === "ENOENT") return;
+    throw new Error("codex.account_state_missing");
+  }
+  if (state.owner !== owner) throw new Error("codex.account_owner_mismatch");
+  const lock = await request(objectUrl);
+  if (!lock.ok || String((await lock.json()).generation) !== String(state.generation)) throw new Error("codex.account_lock_lost");
+  const text = await readFile(authPath, "utf8");
+  validateCodexLogin(text);
+  if (digest(text) !== state.digest) {
+    const saved = await request(`https://secretmanager.googleapis.com/v1/${secret.replace(/\/versions\/latest$/, "")}:addVersion`, {
+      method: "POST", body: JSON.stringify({ payload: { data: Buffer.from(text).toString("base64") } }),
+    });
+    if (!saved.ok) throw new Error("codex.account_refresh_save_failed");
+    state.digest = digest(text);
+    await writeFile(statePath, JSON.stringify(state), { mode: 0o600 });
+  }
+  if (action === "close" && !coordinatorManaged) {
+    const released = await request(`${objectUrl}?ifGenerationMatch=${state.generation}`, { method: "DELETE" });
+    if (!released.ok) throw new Error("codex.account_release_failed");
+  }
+  if (action === "close") await unlink(statePath);
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  accountSession(process.argv[2]).catch((error) => { console.error(/^codex\.account_[a-z_]+$/.test(error.message) ? error.message : "codex.account_session_failed"); process.exitCode = 1; });
+}

package/src/compute/compiler-profile.mjs

@@ -0,0 +1,38 @@
+export const MINIMUM_COMPILER_BOOT_DISK_GB = 30;
+
+/**
+ * Research Compiler only needs the immutable runtime, fixed paper/repository
+ * snapshot and small audit outputs. It may enlarge a selected profile, but it
+ * must never shrink the boot disk below the immutable image/profile minimum.
+ */
+export function compilerExecutionProfile(profile, {
+  bootDiskGb,
+} = {}) {
+  if (!profile || typeof profile !== "object" || Array.isArray(profile)) {
+    throw new TypeError("Research Compiler 资源规格无效");
+  }
+  const profileDisk = Number(profile.executorConfig?.bootDiskGb);
+  if (
+    !Number.isInteger(profileDisk)
+    || profileDisk < MINIMUM_COMPILER_BOOT_DISK_GB
+    || profileDisk > 500
+  ) {
+    throw new TypeError("Research Compiler 资源规格必须声明 30–500 GiB 的启动盘");
+  }
+  const disk = bootDiskGb === undefined ? profileDisk : Number(bootDiskGb);
+  if (!Number.isInteger(disk) || disk < MINIMUM_COMPILER_BOOT_DISK_GB || disk > 500) {
+    throw new TypeError("Research Compiler 启动盘必须是 30–500 GiB 的整数");
+  }
+  if (disk < profileDisk) {
+    throw new TypeError(
+      `Research Compiler 启动盘 ${disk} GiB 不能小于所选镜像规格 ${profileDisk} GiB`,
+    );
+  }
+  return {
+    ...structuredClone(profile),
+    executorConfig: {
+      ...structuredClone(profile.executorConfig ?? {}),
+      bootDiskGb: disk,
+    },
+  };
+}

package/src/compute/compiler-router.mjs

@@ -0,0 +1,23 @@
+import { CiteArkError } from "../util.mjs";
+import { executeAutoDlProCompilation } from "./autodl-pro-compiler.mjs";
+import { executeGcpBatchCompilation } from "./gcp-batch-compiler.mjs";
+
+const COMPILER_ADAPTERS = new Map([
+  ["gcp-batch", executeGcpBatchCompilation],
+  ["autodl-pro", executeAutoDlProCompilation],
+]);
+
+export function listCompilerExecutors() {
+  return [...COMPILER_ADAPTERS.keys()].sort();
+}
+
+export async function executeScheduledCompilation(options) {
+  const executor = options.computeProfile?.executor;
+  const adapter = COMPILER_ADAPTERS.get(executor);
+  if (!adapter) {
+    throw new CiteArkError(
+      `Research Compiler 选择了尚未注册的 executor：${executor ?? "未指定"}。当前可用：${listCompilerExecutors().join("、")}`,
+    );
+  }
+  return await adapter(options);
+}

package/src/compute/coordinator-recovery.mjs

@@ -0,0 +1,210 @@
+import { mkdir } from "node:fs/promises";
+import path from "node:path";
+import { pathExists, readJson, sha256File, writeJson } from "../util.mjs";
+import { relocateStageValue } from "../pipeline/stage-checkpoint.mjs";
+
+export async function saveRunRecovery(bundle, persist) {
+  if (typeof persist !== "function") return;
+  const value = Object.fromEntries(
+    [
+      "runId",
+      "sessionId",
+      "task",
+      "runtimeTask",
+      "directories",
+      "state",
+      "beforeSnapshot",
+      "repositoryProvenance",
+      "repositoryIdentity",
+      "repairBaselineResearch",
+      "sourceInventory",
+      "attempts",
+      "computeDecision",
+      "executionEnvironment",
+      "sandboxProvider",
+      "sandboxImageIdentity",
+    ]
+      .filter((key) => bundle[key] !== undefined)
+      .map((key) => [key, bundle[key]]),
+  );
+  await writeJson(path.join(bundle.directories.run, "run.json"), bundle.state);
+  await writeJson(path.join(bundle.directories.run, "recovery-bundle.json"), {
+    schemaVersion: "1.0",
+    root: bundle.directories.run,
+    value,
+  });
+  await persist();
+}
+
+export async function restoreRunRecovery({ runsDirectory, runId, task }) {
+  if (!runId) return null;
+  const root = path.resolve(runsDirectory, runId);
+  const filename = path.join(root, "recovery-bundle.json");
+  if (!(await pathExists(filename))) return null;
+  const saved = await readJson(filename);
+  const bundle = relocateStageValue(saved.value, saved.root, root);
+  if (
+    task?.contractDigest &&
+    task.contractDigest !== bundle.task?.contractDigest
+  )
+    throw new Error("Restored run has a different execution contract");
+  bundle.state = await readJson(path.join(root, "run.json"));
+  for (const directory of Object.values(bundle.directories))
+    await mkdir(directory, { recursive: true });
+  bundle.restored = true;
+  return bundle;
+}
+
+// Copy the latest complete remote checkpoint into the coordinator's private
+// content-addressed recovery store. GCS expiry must not erase the only resume
+// path after a worker exits. Its bytes are never public evidence.
+export async function saveRemoteRecovery({
+  bundle,
+  storage,
+  bucket,
+  record,
+  persist,
+  recoveryBucket,
+  recoveryNamespace,
+}) {
+  if (typeof persist !== "function") return;
+  const checkpoint = record.checkpoint;
+  if (
+    checkpoint?.object &&
+    checkpoint.sha256 &&
+    checkpoint.sequence !== bundle.state.durableRemoteCheckpoint?.sequence
+  ) {
+    if (recoveryBucket) {
+      if (typeof storage.copyObject !== "function")
+        throw new Error("Durable cloud recovery copy is unavailable");
+      const sourcePrefix = record.checkpointPrefix;
+      if (!sourcePrefix || !checkpoint.object.startsWith(`${sourcePrefix}-`))
+        throw new Error("Recovery checkpoint prefix mismatch");
+      const namespace = recoveryNamespace ? `${recoveryNamespace}-` : "";
+      if (recoveryNamespace && !/^[a-zA-Z0-9-]{1,200}$/.test(recoveryNamespace))
+        throw new Error("Invalid recovery namespace");
+      const checkpointPrefix = `recovery-${namespace}${sourcePrefix}`;
+      const object =
+        checkpointPrefix + checkpoint.object.slice(sourcePrefix.length);
+      const copied = await storage.copyObject({
+        sourceBucket: bucket,
+        sourceObject: checkpoint.object,
+        destinationBucket: recoveryBucket,
+        destinationObject: object,
+      });
+      if (
+        checkpoint.bytes != null &&
+        Number(copied?.size) !== Number(checkpoint.bytes)
+      )
+        throw new Error("Cloud recovery copy size mismatch");
+      const saved = {
+        ...checkpoint,
+        bucket: recoveryBucket,
+        object,
+        checkpointPrefix,
+        checkpointStatus: `${checkpointPrefix}-status.json`,
+        durable: true,
+      };
+      await storage.writeJsonObject({
+        bucket: recoveryBucket,
+        object: saved.checkpointStatus,
+        value: saved,
+      });
+      bundle.state.durableRemoteCheckpoint = saved;
+      bundle.state.durableRemoteCheckpoints = {
+        ...bundle.state.durableRemoteCheckpoints,
+        [checkpoint.kind === "full" ? "full" : "critical"]: saved,
+      };
+      await saveRunRecovery(bundle, persist);
+      return;
+    }
+    const filename = path.join(
+      bundle.directories.run,
+      "recovery",
+      `remote-recovery-${checkpoint.kind === "full" ? "full" : "critical"}.tar.gz`,
+    );
+    await mkdir(path.dirname(filename), { recursive: true });
+    await storage.downloadFile({
+      bucket,
+      object: checkpoint.object,
+      filePath: filename,
+    });
+    const observed = await sha256File(filename);
+    if (observed !== checkpoint.sha256.replace(/^sha256:/, ""))
+      throw new Error("Remote recovery checkpoint digest mismatch");
+    bundle.state.durableRemoteCheckpoint = {
+      ...checkpoint,
+      bucket,
+      checkpointPrefix: record.checkpointPrefix,
+      checkpointStatus: record.checkpointStatus,
+      localPath: filename,
+    };
+    bundle.state.durableRemoteCheckpoints = {
+      ...bundle.state.durableRemoteCheckpoints,
+      [checkpoint.kind === "full" ? "full" : "critical"]:
+        bundle.state.durableRemoteCheckpoint,
+    };
+    await writeJson(
+      path.join(bundle.directories.run, "run.json"),
+      bundle.state,
+    );
+  }
+  await saveRunRecovery(bundle, persist);
+}
+
+export async function restoreRemoteRecovery({ bundle, storage, bucket }) {
+  const checkpoint = bundle.state.durableRemoteCheckpoint;
+  if (checkpoint?.durable === true)
+    return {
+      bucket: checkpoint.bucket,
+      checkpointPrefix: checkpoint.checkpointPrefix,
+    };
+  if (!checkpoint?.localPath) return null;
+  const generations = bundle.state.durableRemoteCheckpoints ?? {
+    [checkpoint.kind === "full" ? "full" : "critical"]: checkpoint,
+  };
+  const selected = [generations.full, generations.critical].filter(
+    (item) =>
+      item &&
+      (item.kind !== "critical" ||
+        !generations.full ||
+        item.createdAt >= generations.full.createdAt),
+  );
+  for (const item of selected) {
+    const filename = path.join(
+      bundle.directories.run,
+      "recovery",
+      `remote-recovery-${item.kind === "full" ? "full" : "critical"}.tar.gz`,
+    );
+    if (
+      `sha256:${await sha256File(filename)}` !==
+      `sha256:${item.sha256.replace(/^sha256:/, "")}`
+    )
+      throw new Error("Stored remote checkpoint digest mismatch");
+    await storage.uploadFile({
+      bucket,
+      object: item.object,
+      filePath: filename,
+    });
+  }
+  const statusPath = path.join(
+    bundle.directories.run,
+    "recovery",
+    "remote-recovery-status.json",
+  );
+  const {
+    localPath: _path,
+    bucket: _bucket,
+    checkpointPrefix: _prefix,
+    checkpointStatus: _status,
+    ...status
+  } = checkpoint;
+  await writeJson(statusPath, status);
+  await storage.uploadFile({
+    bucket,
+    object: checkpoint.checkpointStatus,
+    filePath: statusPath,
+    contentType: "application/json",
+  });
+  return { bucket, checkpointPrefix: checkpoint.checkpointPrefix };
+}

package/src/compute/executor-router.mjs

@@ -0,0 +1,29 @@
+import { executeReproduction } from "../reproduction/runner.mjs";
+import { executeResearchPhases } from "./research-phases.mjs";
+import { executeAutoDlProReproduction } from "./autodl-pro-executor.mjs";
+import { CiteArkError } from "../util.mjs";
+
+const EXECUTOR_ADAPTERS = new Map([
+  ["local-docker", executeLocalDocker],
+  ["gcp-batch", executeResearchPhases],
+  ["autodl-pro", executeAutoDlProReproduction],
+]);
+
+export function listComputeExecutors() {
+  return [...EXECUTOR_ADAPTERS.keys()].sort();
+}
+
+export async function executeScheduledReproduction(options) {
+  const executor = options.computeDecision?.selectedProfile?.executor ?? "local-docker";
+  const adapter = EXECUTOR_ADAPTERS.get(executor);
+  if (!adapter) {
+    throw new CiteArkError(
+      `计算调度选择了尚未注册执行适配器的 executor：${executor}。当前可用：${listComputeExecutors().join("、")}`,
+    );
+  }
+  return await adapter(options);
+}
+
+async function executeLocalDocker(options) {
+  return await executeReproduction(options);
+}