@ckanner/dsh-plugin-flywheel 0.0.0-stage → 0.28.0

package/dist/policy.js

@@ -0,0 +1,37 @@
+// Loaded only in the independently owned SDK process, never in the desktop host.
+// Public rc.5 Cordis services; the worker verifies this acknowledgement before prompt().
+export const inject = ['sandboxPolicy', 'approval', 'shell'];
+
+export async function apply(ctx, config) {
+  const { permissionMode, cwd } = config;
+  if (!['read-only', 'workspace-write'].includes(permissionMode) || typeof cwd !== 'string' ||
+      ctx.shell.sandboxMode === undefined) {
+    throw new Error('Flywheel requires a confined DSH shell and explicit workspace policy');
+  }
+  // This local no-op proves that the actual runner starts and reports full
+  // enforcement. Merely selecting a policy value is not readiness evidence.
+  const probe = await ctx.shell.execute(ctx.shell.resolve({
+    command: ':', workdir: cwd, timeoutMs: 5000,
+    sandboxPolicy: { mode: permissionMode, workspaceRoot: cwd },
+  }));
+  const result = await probe.result();
+  if (result.exitCode !== 0 || result.timedOut || result.aborted ||
+      result.sandbox?.mode !== permissionMode || result.sandbox?.enforcement !== 'full') {
+    throw new Error('Flywheel sandbox readiness probe did not prove full enforcement');
+  }
+  ctx.on('session/created', session => {
+    // A fresh SDK session has no inherited permission facts. Pin both canonical
+    // knobs, rather than relying on saved UI preferences or a prompt instruction.
+    session.append('sandbox/mode', { mode: permissionMode });
+    session.append('approval/policy', { policy: 'never' });
+    const policy = ctx.sandboxPolicy.resolve({ session });
+    session.append('flywheel/policy', {
+      protocol: 1,
+      cwd: policy.workspaceRoot,
+      permissionMode: policy.mode,
+      approvalPolicy: ctx.approval.effectivePolicy(session),
+      confinedShell: ctx.shell.sandboxMode !== undefined,
+      enforcement: result.sandbox.enforcement,
+    });
+  });
+}

package/dist/protocol.js

@@ -0,0 +1,174 @@
+import { realpath, stat } from 'node:fs/promises';
+import { isAbsolute } from 'node:path';
+
+export const PROTOCOL = 1;
+export const MAX_FRAME_BYTES = 8 * 1024 * 1024;
+export const ERROR_CODES = new Set([
+  'AUTH', 'QUOTA', 'RATE_LIMIT', 'SERVER', 'TRANSPORT', 'TIMEOUT',
+  'EMPTY_RESPONSE', 'INVALID_REQUEST', 'CONTEXT_WINDOW_EXCEEDED',
+]);
+
+export class BridgeError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+}
+
+export function record(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+export function nonempty(value, label, max = 512) {
+  if (typeof value !== 'string' || value.length > max || value.trim() === '' || value.includes('\0')) {
+    throw new BridgeError('INVALID_REQUEST', `${label} must be a non-empty string (max ${max})`);
+  }
+  return value;
+}
+
+export async function directory(value, label) {
+  nonempty(value, label, 4096);
+  if (!isAbsolute(value)) throw new BridgeError('INVALID_REQUEST', `${label} must be absolute`);
+  const resolved = await realpath(value);
+  if (!(await stat(resolved)).isDirectory()) {
+    throw new BridgeError('INVALID_REQUEST', `${label} must be a directory`);
+  }
+  return resolved;
+}
+
+export async function validateStart(value) {
+  if (!record(value) || value.type !== 'start' || value.protocol !== PROTOCOL) {
+    throw new BridgeError('INVALID_REQUEST', 'expected one protocol 1 start request');
+  }
+  const allowed = new Set(['type', 'protocol', 'requestId', 'cwd', 'provider', 'model',
+    'reasoningEffort', 'permissionMode', 'prompt', 'maxTokens', 'timeoutMs']);
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw new BridgeError('INVALID_REQUEST', `unsupported start field: ${key}`);
+  }
+  const requestId = nonempty(value.requestId, 'requestId', 128);
+  const provider = nonempty(value.provider, 'provider');
+  const model = nonempty(value.model, 'model');
+  const prompt = nonempty(value.prompt, 'prompt', MAX_FRAME_BYTES);
+  if (!['read-only', 'workspace-write'].includes(value.permissionMode)) {
+    throw new BridgeError('INVALID_REQUEST', 'permissionMode must be read-only or workspace-write');
+  }
+  if (value.reasoningEffort !== undefined) nonempty(value.reasoningEffort, 'reasoningEffort', 64);
+  if (value.maxTokens !== undefined && (!Number.isSafeInteger(value.maxTokens) || value.maxTokens < 1)) {
+    throw new BridgeError('INVALID_REQUEST', 'maxTokens must be a positive integer');
+  }
+  const timeoutMs = value.timeoutMs ?? 30 * 60 * 1000;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 24 * 60 * 60 * 1000) {
+    throw new BridgeError('INVALID_REQUEST', 'timeoutMs must be between 1 and 86400000');
+  }
+  return { ...value, requestId, provider, model, prompt, timeoutMs, cwd: await directory(value.cwd, 'cwd') };
+}
+
+export function normalizedError(error) {
+  return {
+    code: ERROR_CODES.has(error?.code) ? error.code : 'TRANSPORT',
+    message: error instanceof Error ? error.message : String(error),
+  };
+}
+
+export function modelErrorCode(code) {
+  if (ERROR_CODES.has(code)) return code;
+  if (code === 'MISSING_CREDENTIAL' || code === 'INVALID_CREDENTIAL') return 'AUTH';
+  if (code === 'ACCOUNT_QUOTA') return 'QUOTA';
+  if (code === 'NO_ADAPTER' || code === 'UNSUPPORTED_REASONING_EFFORT') return 'INVALID_REQUEST';
+  return 'SERVER';
+}
+
+/** Fold committed per-call records; streamed usage snapshots are never summed. */
+export class SessionFold {
+  constructor(sessionId) {
+    this.sessionId = sessionId;
+    this.seen = new Set();
+    this.receipts = new Set();
+    this.policy = null;
+    this.text = '';
+    this.assistantCount = 0;
+    this.usageComplete = true;
+    this.usage = { input_tokens: 0, output_tokens: 0, reasoning_tokens: 0,
+      cache_read_tokens: 0, cache_write_tokens: 0, total_tokens: 0 };
+    this.terminal = null;
+  }
+
+  accept(params) {
+    if (!record(params) || params.sessionId !== this.sessionId) return false;
+    const event = params.event;
+    if (!record(event) || typeof event.type !== 'string' ||
+        !Number.isSafeInteger(event.seq) || event.seq < 0 || !record(event.data)) {
+      throw new BridgeError('TRANSPORT', 'malformed DSH session event');
+    }
+    if (this.seen.has(event.seq)) return false;
+    this.seen.add(event.seq);
+    const data = event.data;
+    if (event.type === 'flywheel/policy') this.policy = data;
+    if (event.type === 'agent/inbox/spliced' && Array.isArray(data.inserted)) {
+      for (const message of data.inserted) if (typeof message?.id === 'string') this.receipts.add(message.id);
+    }
+    if (event.type === 'assistant/message') {
+      if (!Array.isArray(data.message?.content) || !data.message.content.every(block =>
+        record(block) && typeof block.type === 'string' &&
+        (block.type !== 'text' || typeof block.text === 'string'))) {
+        throw new BridgeError('TRANSPORT', 'malformed committed assistant message');
+      }
+      this.assistantCount += 1;
+      this.text = data.message.content.filter(block => block.type === 'text').map(block => block.text).join('');
+      this.addUsage(data.usage);
+    }
+    if (event.type === 'turn/end') {
+      if (!record(data.reason) || typeof data.reason.kind !== 'string') {
+        throw new BridgeError('TRANSPORT', 'malformed DSH turn terminal');
+      }
+      this.terminal = data.reason;
+    }
+    return true;
+  }
+
+  addUsage(usage) {
+    const valid = value => Number.isSafeInteger(value) && value >= 0;
+    const fields = ['inputTokens', 'outputTokens', 'cacheReadTokens', 'cacheWriteTokens', 'reasoningTokens', 'totalTokens'];
+    if (!record(usage) || !valid(usage.inputTokens) || !valid(usage.outputTokens) ||
+        fields.some(key => usage[key] !== undefined && !valid(usage[key]))) {
+      this.usageComplete = false;
+      return;
+    }
+    const cacheRead = usage.cacheReadTokens ?? 0;
+    const cacheWrite = usage.cacheWriteTokens ?? 0;
+    const input = usage.inputTokens + cacheRead + cacheWrite;
+    const values = {
+      input_tokens: input, output_tokens: usage.outputTokens,
+      reasoning_tokens: usage.reasoningTokens ?? 0,
+      cache_read_tokens: cacheRead, cache_write_tokens: cacheWrite,
+      total_tokens: usage.totalTokens ?? input + usage.outputTokens,
+    };
+    for (const [key, value] of Object.entries(values)) {
+      if (!Number.isSafeInteger(this.usage[key] + value)) this.usageComplete = false;
+      else this.usage[key] += value;
+    }
+  }
+
+  verifiedPolicy(request) {
+    const policy = this.policy;
+    if (!policy || policy.protocol !== PROTOCOL || policy.permissionMode !== request.permissionMode ||
+        policy.cwd !== request.cwd || policy.approvalPolicy !== 'never' ||
+        policy.confinedShell !== true || policy.enforcement !== 'full') {
+      throw new BridgeError('INVALID_REQUEST', 'DSH did not attest the requested cwd and confined permission policy; prompt withheld');
+    }
+  }
+
+  finish(messageId) {
+    if (!this.receipts.has(messageId)) throw new BridgeError('TRANSPORT', 'missing durable prompt receipt');
+    if (!this.terminal) throw new BridgeError('TRANSPORT', 'idle without committed turn/end');
+    if (this.terminal.kind !== 'completed') {
+      const detail = this.terminal.error;
+      throw new BridgeError(modelErrorCode(detail?.code),
+        detail?.message ?? `DSH turn ended as ${this.terminal.kind}`);
+    }
+    if (!this.assistantCount || this.text.trim() === '') {
+      throw new BridgeError('EMPTY_RESPONSE', 'DSH completed without assistant text');
+    }
+    return { text: this.text, usage: this.usageComplete ? this.usage : null };
+  }
+}

package/dist/worker.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { runWorker } from './bridge.js';
+import { BridgeError, MAX_FRAME_BYTES, normalizedError } from './protocol.js';
+
+const controller = new AbortController();
+process.once('SIGTERM', () => controller.abort());
+process.once('SIGINT', () => controller.abort());
+// The engine writes exactly one request then closes stdin. EOF after admission
+// is normal and must not cancel an in-flight model turn.
+async function readInput() {
+  const chunks = [];
+  let bytes = 0;
+  const admission = setTimeout(() => process.stdin.destroy(new BridgeError('TIMEOUT', 'no complete worker request within 10 seconds')), 10000);
+  try {
+    for await (const chunk of process.stdin) {
+      bytes += chunk.length;
+      if (bytes > MAX_FRAME_BYTES) throw new BridgeError('INVALID_REQUEST', 'worker request exceeds 8 MiB');
+      chunks.push(chunk);
+    }
+    const lines = Buffer.concat(chunks).toString('utf8').trim().split('\n');
+    if (lines.length !== 1 || !lines[0]) throw new BridgeError('INVALID_REQUEST', 'expected exactly one JSON line then EOF');
+    try { return JSON.parse(lines[0]); } catch {
+      throw new BridgeError('INVALID_REQUEST', 'worker request is not valid JSON');
+    }
+  } finally {
+    clearTimeout(admission);
+  }
+}
+
+const emit = value => process.stdout.write(JSON.stringify(value) + '\n');
+try {
+  if (process.argv.slice(2).some(arg => arg !== '--doctor') || process.argv.length > 3) {
+    throw new BridgeError('INVALID_REQUEST', 'worker accepts only optional --doctor');
+  }
+  const request = await readInput();
+  const result = await runWorker(request, {
+    emit, signal: controller.signal, doctor: process.argv.includes('--doctor'),
+    stderr: chunk => process.stderr.write(chunk),
+  });
+  process.exitCode = result.status === 'ok' ? 0 : result.status === 'cancelled' ? 143 : 1;
+} catch (error) {
+  emit({ protocol: 1, requestId: 'invalid-request', type: 'result', status: 'error', settled: true,
+    text: '', usage: null, costUsd: null, error: normalizedError(error) });
+  process.exitCode = 1;
+}

package/package.json

@@ -1,6 +1,78 @@
 {
   "name": "@ckanner/dsh-plugin-flywheel",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.28.0",
+  "description": "Flywheel engine controls with owned DSH SDK and Codex Pro machine workers",
+  "type": "module",
+  "license": "UNLICENSED",
+  "engines": {
+    "node": ">=22.18.0",
+    "dsh": "0.2.1-rc.5"
+  },
+  "exports": {
+    ".": "./dist/index.js",
+    "./client": "./dist/client.js",
+    "./worker-policy": "./dist/policy.js",
+    "./worker": "./dist/worker.js",
+    "./codex-pro-worker": "./dist/codex-pro-worker.js",
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "flywheel-dsh-worker": "./dist/worker.js",
+    "flywheel-codex-pro-worker": "./dist/codex-pro-worker.js"
+  },
+  "files": [
+    "dist",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md",
+    "PROTOCOL.md"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-chat",
+        "@deepseek-ai/dsh-client-ui-commands",
+        "@deepseek-ai/dsh-api-remotes"
+      ],
+      "platform": "web"
+    }
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "~4.0.5",
+    "@deepseek-ai/dsh-commands": "0.2.1-rc.5",
+    "@deepseek-ai/dsh-tools": "0.2.1-rc.5"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/cordis": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-commands": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-tools": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "test": "npm run build && node --test test/*.test.js",
+    "check": "npm test",
+    "prepack": "npm run build"
+  },
+  "dependencies": {
+    "dsh-subagent-codex-pro": "0.8.0"
+  },
+  "devDependencies": {
+    "jsdom": "26.1.0",
+    "react": "18.3.1",
+    "react-dom": "18.3.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ckanner/flywheel.git",
+    "directory": "plugins/dsh"
+  }
+}