@claudexor/orchestrator 1.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +7 -0
- package/dist/attemptTelemetry.d.ts +82 -0
- package/dist/attemptTelemetry.d.ts.map +1 -0
- package/dist/attemptTelemetry.js +283 -0
- package/dist/attemptTelemetry.js.map +1 -0
- package/dist/diffReview.d.ts +32 -0
- package/dist/diffReview.d.ts.map +1 -0
- package/dist/diffReview.js +69 -0
- package/dist/diffReview.js.map +1 -0
- package/dist/finalVerifier.d.ts +25 -0
- package/dist/finalVerifier.d.ts.map +1 -0
- package/dist/finalVerifier.js +110 -0
- package/dist/finalVerifier.js.map +1 -0
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +2 -0
- package/dist/index.js.map +1 -0
- package/dist/interaction.d.ts +22 -0
- package/dist/interaction.d.ts.map +1 -0
- package/dist/interaction.js +117 -0
- package/dist/interaction.js.map +1 -0
- package/dist/modelGovernance.d.ts +22 -0
- package/dist/modelGovernance.d.ts.map +1 -0
- package/dist/modelGovernance.js +33 -0
- package/dist/modelGovernance.js.map +1 -0
- package/dist/orchestratePlanner.d.ts +12 -0
- package/dist/orchestratePlanner.d.ts.map +1 -0
- package/dist/orchestratePlanner.js +91 -0
- package/dist/orchestratePlanner.js.map +1 -0
- package/dist/orchestrator.d.ts +380 -0
- package/dist/orchestrator.d.ts.map +1 -0
- package/dist/orchestrator.js +4927 -0
- package/dist/orchestrator.js.map +1 -0
- package/dist/reviewerPanel.d.ts +26 -0
- package/dist/reviewerPanel.d.ts.map +1 -0
- package/dist/reviewerPanel.js +146 -0
- package/dist/reviewerPanel.js.map +1 -0
- package/dist/runSupport.d.ts +178 -0
- package/dist/runSupport.d.ts.map +1 -0
- package/dist/runSupport.js +372 -0
- package/dist/runSupport.js.map +1 -0
- package/dist/runTerminals.d.ts +56 -0
- package/dist/runTerminals.d.ts.map +1 -0
- package/dist/runTerminals.js +124 -0
- package/dist/runTerminals.js.map +1 -0
- package/package.json +58 -0
|
@@ -0,0 +1,380 @@
|
|
|
1
|
+
import type { AccessProfile, Attachment, ControlReviewerPanelEntry, EffortHint, ExternalContextPolicy, HarnessEvent, InteractionAnswerSet, InteractionRequest, ModeKind, Portfolio, ProtectedPathApproval, RunEvent, RunStatus, ProviderFamily } from "@claudexor/schema";
|
|
2
|
+
import { type OrchestrateAutonomy } from "@claudexor/schema";
|
|
3
|
+
import type { AdapterRegistry } from "@claudexor/core";
|
|
4
|
+
import { type DiffReviewInput, type DiffReviewResult } from "./diffReview.js";
|
|
5
|
+
import { type ReviewerSpec } from "@claudexor/review";
|
|
6
|
+
import { type SynthesisMode } from "@claudexor/synthesis";
|
|
7
|
+
export interface OrchestratorDeps {
|
|
8
|
+
registry: AdapterRegistry;
|
|
9
|
+
reviewers?: ReviewerSpec[];
|
|
10
|
+
portfolio?: Portfolio;
|
|
11
|
+
maxUsd?: number | null;
|
|
12
|
+
/** Ordered explicit reviewer panel. Unlike legacy per-family overrides this
|
|
13
|
+
* preserves duplicate harness entries, so one provider can review through
|
|
14
|
+
* multiple requested models in a single panel pass. */
|
|
15
|
+
reviewerPanel?: ControlReviewerPanelEntry[];
|
|
16
|
+
/**
|
|
17
|
+
* Optional per-provider-family reviewer model override. No hardcoded versions: the caller supplies the
|
|
18
|
+
* model id, default keeps each harness's own default reviewer model.
|
|
19
|
+
*/
|
|
20
|
+
reviewerModels?: Partial<Record<ProviderFamily, string>>;
|
|
21
|
+
/** Optional per-provider-family reviewer effort override where the harness supports it. */
|
|
22
|
+
reviewerEfforts?: Partial<Record<ProviderFamily, EffortHint>>;
|
|
23
|
+
}
|
|
24
|
+
export interface RunInput {
|
|
25
|
+
repoRoot: string;
|
|
26
|
+
/**
|
|
27
|
+
* Tree the harness actually executes in, when different from `repoRoot`.
|
|
28
|
+
* `repoRoot` always anchors config/artifacts/contract (the project); for an
|
|
29
|
+
* ISOLATED thread the turn runs in the thread's persistent worktree, so
|
|
30
|
+
* `executionRoot` points there while artifacts still land under the project.
|
|
31
|
+
* Defaults to `repoRoot` (in-place threads and ordinary runs).
|
|
32
|
+
*/
|
|
33
|
+
executionRoot?: string;
|
|
34
|
+
prompt: string;
|
|
35
|
+
/** Files/images attached to this turn, resolved to scoped on-disk paths. */
|
|
36
|
+
attachments?: Attachment[];
|
|
37
|
+
/**
|
|
38
|
+
* Opt this run into the agent-driven browser (Playwright MCP). Honored only
|
|
39
|
+
* for browser-capable harnesses when web policy is not `off`; the orchestrator
|
|
40
|
+
* resolves it to a per-harness `HarnessRunSpec.browser`.
|
|
41
|
+
*/
|
|
42
|
+
browser?: boolean;
|
|
43
|
+
mode?: ModeKind;
|
|
44
|
+
contextMode?: "off" | "auto";
|
|
45
|
+
harnesses?: string[];
|
|
46
|
+
primaryHarness?: string;
|
|
47
|
+
portfolio?: Portfolio;
|
|
48
|
+
n?: number;
|
|
49
|
+
baseRef?: string;
|
|
50
|
+
attempts?: number | null;
|
|
51
|
+
/** agent flag: iterate until the convergence predicate is clean (no fixed cap). */
|
|
52
|
+
untilClean?: boolean;
|
|
53
|
+
/** audit flag: bounded read-only research swarm (the old `explore` mode). */
|
|
54
|
+
swarm?: boolean;
|
|
55
|
+
/** agent flag: create-from-scratch intent (the old `create` mode). */
|
|
56
|
+
create?: boolean;
|
|
57
|
+
synthesis?: SynthesisMode;
|
|
58
|
+
/** Explicit deterministic gate commands from caller-provided run configuration. */
|
|
59
|
+
tests?: string[];
|
|
60
|
+
/** Typed per-run approval for changing auto-protected gate/test paths. */
|
|
61
|
+
protectedPathApprovals?: ProtectedPathApproval[];
|
|
62
|
+
/** Hard per-run spend cap (USD); overrides deps.maxUsd when set. */
|
|
63
|
+
maxUsd?: number | null;
|
|
64
|
+
/** Orchestrate executor: cap on plan tool calls. */
|
|
65
|
+
maxToolCalls?: number | null;
|
|
66
|
+
/** Access profile; e.g. `full` for autonomous terminal tasks (agent and in-place convergence). */
|
|
67
|
+
access?: AccessProfile;
|
|
68
|
+
/** External/web context policy. Separate from shell/network sandboxing. */
|
|
69
|
+
web?: ExternalContextPolicy;
|
|
70
|
+
externalContextPolicy?: ExternalContextPolicy;
|
|
71
|
+
/**
|
|
72
|
+
* Scalar model convenience: expands to the RESOLVED PRIMARY harness only
|
|
73
|
+
* (never the pool). Rejected when no primary is resolvable (INV-103).
|
|
74
|
+
* Cleared during input resolution — routing reads `models`.
|
|
75
|
+
*/
|
|
76
|
+
model?: string;
|
|
77
|
+
/** Harness-scoped model map (harness id → model id). Specific beats general:
|
|
78
|
+
* an entry wins over the scalar `model` and the per-harness settings default. */
|
|
79
|
+
models?: Record<string, string>;
|
|
80
|
+
/** Optional reasoning-effort hint forwarded to harnesses that support it. */
|
|
81
|
+
effort?: EffortHint;
|
|
82
|
+
/** Frozen SpecPack provenance when a run is bound to a hard-locked spec. */
|
|
83
|
+
specId?: string;
|
|
84
|
+
specHash?: string;
|
|
85
|
+
specPath?: string;
|
|
86
|
+
/** Pre-assigned ids so a caller (daemon/control-api) knows them before the run starts. */
|
|
87
|
+
runId?: string;
|
|
88
|
+
taskId?: string;
|
|
89
|
+
/** Thread this run is a turn of (chat/session-first); recorded in events. */
|
|
90
|
+
threadId?: string;
|
|
91
|
+
/** Preferred auth route for harness attempts (subscription/api_key/auto). */
|
|
92
|
+
authPreference?: "subscription" | "api_key" | "auto";
|
|
93
|
+
/**
|
|
94
|
+
* Native CLI session ids to resume, keyed by harness id (the thread's vendor
|
|
95
|
+
* session cache). A routed harness with an entry continues its own native
|
|
96
|
+
* conversation (`codex exec resume` / `claude --resume`) instead of starting fresh.
|
|
97
|
+
*/
|
|
98
|
+
resumeSessions?: Record<string, string>;
|
|
99
|
+
/** Called when a harness emits its native session id (recorded for future resume). */
|
|
100
|
+
onSessionObserved?: (harnessId: string, nativeSessionId: string, observedModel?: string | null) => void;
|
|
101
|
+
/** In-process sink for every RunEvent (mirrors events.jsonl) for live observers. */
|
|
102
|
+
onEvent?: (event: RunEvent) => void;
|
|
103
|
+
/** In-process sink for the full per-harness event stream (richer than RunEvent). */
|
|
104
|
+
onHarnessEvent?: (event: HarnessEvent) => void;
|
|
105
|
+
/** Called once when the run id/dir are known, before any harness work begins. */
|
|
106
|
+
onRunStart?: (info: {
|
|
107
|
+
runId: string;
|
|
108
|
+
taskId: string;
|
|
109
|
+
runDir: string;
|
|
110
|
+
}) => void;
|
|
111
|
+
/**
|
|
112
|
+
* Interactive answer surface (waiting_on_user). When a harness raises a
|
|
113
|
+
* question, the orchestrator emits `interaction.requested`, calls this
|
|
114
|
+
* handler, and blocks ONLY that attempt's tool until answers arrive or the
|
|
115
|
+
* timeout elapses (then a benign decline lets the model continue with
|
|
116
|
+
* assumptions). When absent, runs are non-interactive end to end.
|
|
117
|
+
*/
|
|
118
|
+
onInteraction?: (ctx: PendingInteractionContext) => Promise<InteractionAnswerSet | null>;
|
|
119
|
+
/** Wait budget for one interactive answer (default 900000 ms = 15 min). */
|
|
120
|
+
interactionTimeoutMs?: number;
|
|
121
|
+
/** Cancellation: aborts the run and cancels in-flight harness work. */
|
|
122
|
+
signal?: AbortSignal;
|
|
123
|
+
/**
|
|
124
|
+
* Run the convergence loop against the live `repoRoot` directly (no git worktree).
|
|
125
|
+
* For external stateful harness environments where runtime state, not a patch,
|
|
126
|
+
* is the deliverable. Only honored by convergence modes.
|
|
127
|
+
*/
|
|
128
|
+
inPlace?: boolean;
|
|
129
|
+
/**
|
|
130
|
+
* How much the orchestrate planner may act without confirmation
|
|
131
|
+
* (suggest/auto_safe/auto_full). Honored ONLY by mode=orchestrate; the
|
|
132
|
+
* executor over the typed plan classifies each tool_call via toolRisk and
|
|
133
|
+
* runs safe steps as isolated sub-runs / reads, blocking risky steps under
|
|
134
|
+
* auto_safe. Defaults to `suggest` (plan-only) when unset.
|
|
135
|
+
*/
|
|
136
|
+
autonomy?: OrchestrateAutonomy;
|
|
137
|
+
/**
|
|
138
|
+
* Recursion-depth guard for orchestrate. The executor spawns sub-runs via
|
|
139
|
+
* `this.run`; a sub-run must NOT itself orchestrate (orchestrate-within-
|
|
140
|
+
* orchestrate throws). The top-level orchestrate run is depth 0; sub-runs it
|
|
141
|
+
* spawns inherit depth+1 and are forbidden from mode=orchestrate.
|
|
142
|
+
*/
|
|
143
|
+
orchestrateDepth?: number;
|
|
144
|
+
/**
|
|
145
|
+
* Optional live answer-delivery service for the executor's `answer_question`
|
|
146
|
+
* step (the daemon owns the InteractionRegistry; the engine does not). When
|
|
147
|
+
* absent, an answer_question step is honestly SKIPPED (no live interaction
|
|
148
|
+
* surface in this context) rather than silently claimed done. Read-only
|
|
149
|
+
* w.r.t. the tree. Returns true when the answer was delivered.
|
|
150
|
+
*/
|
|
151
|
+
answerInteraction?: (runId: string, interactionId: string, answers: InteractionAnswerSet) => Promise<boolean>;
|
|
152
|
+
}
|
|
153
|
+
/** Context handed to RunInput.onInteraction for one pending question. */
|
|
154
|
+
export interface PendingInteractionContext {
|
|
155
|
+
runId: string;
|
|
156
|
+
taskId: string;
|
|
157
|
+
attemptId: string;
|
|
158
|
+
harnessId: string;
|
|
159
|
+
request: InteractionRequest;
|
|
160
|
+
requestedAt: string;
|
|
161
|
+
timeoutAt: string;
|
|
162
|
+
}
|
|
163
|
+
export interface OrchestratorResult {
|
|
164
|
+
runId: string;
|
|
165
|
+
taskId: string;
|
|
166
|
+
mode: ModeKind;
|
|
167
|
+
status: RunStatus;
|
|
168
|
+
winner: string | null;
|
|
169
|
+
runDir: string;
|
|
170
|
+
summary: string;
|
|
171
|
+
candidates: {
|
|
172
|
+
attemptId: string;
|
|
173
|
+
harnessId: string;
|
|
174
|
+
status: string;
|
|
175
|
+
}[];
|
|
176
|
+
decisionPath?: string;
|
|
177
|
+
reviewVerified?: boolean;
|
|
178
|
+
/** Settled ledger spend for this run (USD); null when no ledger tracked it.
|
|
179
|
+
* Consumer: the orchestrate executor's aggregate budget across sub-runs. */
|
|
180
|
+
spendUsd?: number | null;
|
|
181
|
+
}
|
|
182
|
+
export declare class Orchestrator {
|
|
183
|
+
private readonly deps;
|
|
184
|
+
private readonly gateway;
|
|
185
|
+
constructor(deps: OrchestratorDeps);
|
|
186
|
+
/** Scoped DIFF review — thin delegate; mechanics live in diffReview.ts. */
|
|
187
|
+
reviewDiff(input: DiffReviewInput): Promise<DiffReviewResult>;
|
|
188
|
+
run(input: RunInput): Promise<OrchestratorResult>;
|
|
189
|
+
private resolveReviewers;
|
|
190
|
+
/**
|
|
191
|
+
* Resolve reviewers INSIDE a strategy, after run-dir creation: an explicit
|
|
192
|
+
* panel whose harness/model/effort fails validation ends the run through
|
|
193
|
+
* the routing-failure artifact path (failure.yaml + summary + run.failed
|
|
194
|
+
* naming the refusal) BEFORE any candidate spends money — never a bare
|
|
195
|
+
* pre-announce throw with no artifacts (artifact clause).
|
|
196
|
+
*/
|
|
197
|
+
private resolveReviewersWithArtifacts;
|
|
198
|
+
private resolveExplicitReviewerPanel;
|
|
199
|
+
private authPreferenceForHarness;
|
|
200
|
+
private artifactStore;
|
|
201
|
+
/** The producing intent a candidate plays (create flag switches it; not hardcoded to implement). */
|
|
202
|
+
private candidateIntent;
|
|
203
|
+
/**
|
|
204
|
+
* Resolve the per-harness browser-tool wiring for a run spec. Returns null
|
|
205
|
+
* (no browser) unless: the run opted in (`input.browser`), the harness has the
|
|
206
|
+
* `browser_tool` capability, AND web policy is not `off` (the browser is live
|
|
207
|
+
* egress and must ride `external_context_policy`). Screenshots/PDFs are written
|
|
208
|
+
* into the run's artifact tree so they surface in the Canvas gallery. Headed by
|
|
209
|
+
* default so the user can watch; `cdp_endpoint` is filled by the headed-Chromium
|
|
210
|
+
* launcher (7B) for the shared, mirrored window.
|
|
211
|
+
*/
|
|
212
|
+
private browserSpecFor;
|
|
213
|
+
/**
|
|
214
|
+
* Session fields for a route's run spec: auth route preference + native
|
|
215
|
+
* resume id. Preference precedence: explicit per-run > per-harness
|
|
216
|
+
* config > global routing config > auto.
|
|
217
|
+
*/
|
|
218
|
+
/** The tree the harness reads/operates in: the thread worktree for an isolated
|
|
219
|
+
* thread, else the project. Config/artifacts/contract stay anchored to repoRoot. */
|
|
220
|
+
/** Per-candidate reservation floor from user config. */
|
|
221
|
+
private estimateUsdFloor;
|
|
222
|
+
private execRootOf;
|
|
223
|
+
private sessionSpecFields;
|
|
224
|
+
/** Record a harness-emitted native session id for future thread resume (observer never fails the run). */
|
|
225
|
+
private observeNativeSession;
|
|
226
|
+
/**
|
|
227
|
+
* Lift an adapter's auth-route override marker into the typed
|
|
228
|
+
* `route.fallback.auth_switched` run event (validated payload). An explicit
|
|
229
|
+
* subscription/api_key preference that could not be honored is never silent;
|
|
230
|
+
* neither is an `auto` choice that selects a smoke-proven paid route over an
|
|
231
|
+
* available native route.
|
|
232
|
+
*/
|
|
233
|
+
/**
|
|
234
|
+
* Resolve candidate adapters: explicit `--harness`, else available real harnesses, then
|
|
235
|
+
* **capability-gate** to those that can actually produce work for `intent` (e.g. a
|
|
236
|
+
* raw-API reviewer with `implement: false` is dropped from an implement race), and
|
|
237
|
+
* expand to n. Fails loudly if nothing can perform the intent.
|
|
238
|
+
*/
|
|
239
|
+
private resolveRunInput;
|
|
240
|
+
private resolveCandidateAdapters;
|
|
241
|
+
/**
|
|
242
|
+
* Order the eligible pool by portfolio routing utility (budget router): an
|
|
243
|
+
* explicit user pool keeps the user's order; an explicit primary harness is
|
|
244
|
+
* always pinned first. Cross-family diversity is encouraged for later slots.
|
|
245
|
+
*/
|
|
246
|
+
private orderPool;
|
|
247
|
+
/**
|
|
248
|
+
* Lazy ContextPack: built ONLY for the read-only report modes
|
|
249
|
+
* (explore/plan/readonly_audit) that consume it. Persisted to
|
|
250
|
+
* context/context_pack.yaml, announced via `context.pack.created`, and
|
|
251
|
+
* rendered as a compact scope-atlas prompt section. Agent modes skip it —
|
|
252
|
+
* candidates explore the live tree inside their own envelopes.
|
|
253
|
+
*/
|
|
254
|
+
private lazyContextSection;
|
|
255
|
+
/**
|
|
256
|
+
* Ledger a routed harness reserves from: harnesses with a configured
|
|
257
|
+
* `max_usd` get a child sub-ledger (spend rolls up to the run cap), so one
|
|
258
|
+
* harness exhausting its own budget cannot drain the whole run.
|
|
259
|
+
*/
|
|
260
|
+
private harnessLedger;
|
|
261
|
+
/**
|
|
262
|
+
* The web mode a routed harness actually executes for a requested policy.
|
|
263
|
+
* Tools-permissioned web (e.g. claude) has no cached index: `cached` upgrades
|
|
264
|
+
* to `live` and MUST be disclosed via a `policy.web.upgraded` event.
|
|
265
|
+
*/
|
|
266
|
+
private effectiveWebMode;
|
|
267
|
+
private discloseWebUpgrade;
|
|
268
|
+
/** Honest cross-family route proof: verified only when ≥2 DISTINCT provider families review. */
|
|
269
|
+
private routeVerified;
|
|
270
|
+
private config;
|
|
271
|
+
private projectConfig;
|
|
272
|
+
private buildContract;
|
|
273
|
+
private gateSpecs;
|
|
274
|
+
private testsEvidence;
|
|
275
|
+
private writeTestsEvidence;
|
|
276
|
+
/**
|
|
277
|
+
* Per-harness settings applied to one route's run spec (model/effort/web
|
|
278
|
+
* defaults, max_turns, tool lists). Knobs the manifest does not support are
|
|
279
|
+
* RETURNED as ignored reasons (disclosed by the caller), never silently sent.
|
|
280
|
+
*/
|
|
281
|
+
private routeSpecKnobs;
|
|
282
|
+
/** Run one candidate inside an already-created envelope. Never creates/disposes the envelope. */
|
|
283
|
+
private runCandidateInEnvelope;
|
|
284
|
+
private toEvidence;
|
|
285
|
+
private interactionChannelFor;
|
|
286
|
+
/**
|
|
287
|
+
* Guarantee a git boundary for write-mode runs. Non-git project folders are
|
|
288
|
+
* initialized in place (`.gitignore` seeded with `.claudexor/`, `git init`,
|
|
289
|
+
* deterministic baseline commit) and the action is announced via a
|
|
290
|
+
* `project.git.initialized` event. Returns the failure message when the
|
|
291
|
+
* boundary cannot be established (the terminal failure events are already
|
|
292
|
+
* emitted); null on success.
|
|
293
|
+
*/
|
|
294
|
+
private ensureWriteModeGitBoundary;
|
|
295
|
+
private runRace;
|
|
296
|
+
/** Single-owner telemetry artifact (final/telemetry.yaml); surfaces project it, never recompute. */
|
|
297
|
+
private writeRunTelemetry;
|
|
298
|
+
/** Review a set of runs and return their evidence (with finalReviewClean + review_verified caveat). */
|
|
299
|
+
/**
|
|
300
|
+
* Deterministic policy findings from the typed diff (no LLM, no regex over
|
|
301
|
+
* prose): protected-path changes and critical-risk diffs escalate NEEDS_HUMAN;
|
|
302
|
+
* a high-risk diff without a cross-family panel escalates as well. Each
|
|
303
|
+
* finding cites the matched files as evidence (BIBLE: evidence beats summaries).
|
|
304
|
+
*/
|
|
305
|
+
private policyFindings;
|
|
306
|
+
/**
|
|
307
|
+
* SINGLE funnel for every reviewer-panel invocation: run it inside a per-review
|
|
308
|
+
* scoped harness HOME (Bible §6) so reviewer children (codex session rollouts,
|
|
309
|
+
* claude config) never write native state into the operator's real ~/.codex /
|
|
310
|
+
* ~/.claude. The codex route-proof transcript is read from this same scoped
|
|
311
|
+
* CODEX_HOME, so cross-family verification is unaffected. Every call site
|
|
312
|
+
* MUST go through here so the scoping cannot drift. Disposed once the panel
|
|
313
|
+
* settles (resolve OR reject).
|
|
314
|
+
*/
|
|
315
|
+
private reviewScoped;
|
|
316
|
+
private reviewRuns;
|
|
317
|
+
private prepareReviewEvidenceDir;
|
|
318
|
+
private requireReviewEvidence;
|
|
319
|
+
private cleanupReviewEvidenceDir;
|
|
320
|
+
private recordReviewEvidenceCleanup;
|
|
321
|
+
private runConvergence;
|
|
322
|
+
/** plan mode: multi-harness planning -> aggregate -> (optional) plan review -> SpecPack. Read-only. */
|
|
323
|
+
/**
|
|
324
|
+
* Wrap the user's goal in an explicit "plan, do not implement" instruction.
|
|
325
|
+
* Without this the raw prompt ("make a racing game") reaches the harness with
|
|
326
|
+
* only a read-only sandbox, so the model tries to BUILD it and dumps code into
|
|
327
|
+
* the plan when writes are blocked — the v0.9 "HTML in the plan" bug. The
|
|
328
|
+
* read-only access still enforces it; this gives the model the right job.
|
|
329
|
+
*/
|
|
330
|
+
private planPrompt;
|
|
331
|
+
private runPlan;
|
|
332
|
+
/** ask: one selected harness answers read-only questions; no patch/apply controls. */
|
|
333
|
+
private runAsk;
|
|
334
|
+
/** audit --swarm: bounded read-only research swarm (the old `explore` mode). */
|
|
335
|
+
private runExplore;
|
|
336
|
+
/** audit: single read-only audit/map report. */
|
|
337
|
+
private runAudit;
|
|
338
|
+
/**
|
|
339
|
+
* orchestrate: the autonomous planner. NOT a privileged harness — the planner
|
|
340
|
+
* is routed like reviewers (doctor-ok + `orchestrate` capability + headroom)
|
|
341
|
+
* and runs READ-ONLY. With default `suggest` autonomy its work product is a
|
|
342
|
+
* typed orchestration plan over the 6-tool belt (start_run / race / status /
|
|
343
|
+
* answer_question / apply / review); execution happens as subsequent thread
|
|
344
|
+
* turns. Degradation contract: any 1 harness works (single-route plan); 2+
|
|
345
|
+
* harnesses unlock cross-family race/review in the plan space.
|
|
346
|
+
*/
|
|
347
|
+
/** ONE owner of the per-run USD cap precedence: explicit input -> embedder deps -> operator config. */
|
|
348
|
+
private resolveMaxUsdCap;
|
|
349
|
+
private runOrchestrate;
|
|
350
|
+
private runReadOnlyReport;
|
|
351
|
+
/**
|
|
352
|
+
* Execute a typed orchestration plan under auto_safe / auto_full. Runs the
|
|
353
|
+
* tool_calls IN ORDER, classifying each via toolRisk (FAIL-CLOSED). Persists
|
|
354
|
+
* final/orchestration_progress.yaml and emits progress events. Returns the
|
|
355
|
+
* executor's terminal status (success / blocked / failed) and a short note.
|
|
356
|
+
*
|
|
357
|
+
* SAFETY INVARIANTS (see CLAUDEXOR doctrine):
|
|
358
|
+
* 1. A SAFE step NEVER mutates the live tree: start_run/race run as isolated
|
|
359
|
+
* ENVELOPE sub-runs (inPlace=false, asserted), review/status/answer are reads.
|
|
360
|
+
* 2. Risk is fail-closed (toolRisk): any unknown/undeclared tool is risky.
|
|
361
|
+
* 3. auto_safe STOPS at the first risky step (apply) without executing it; the
|
|
362
|
+
* run ends `blocked` awaiting a human decision.
|
|
363
|
+
* 4. answer_question / status / review are read-only w.r.t. the tree.
|
|
364
|
+
*/
|
|
365
|
+
private executeOrchestratePlan;
|
|
366
|
+
/**
|
|
367
|
+
* Run one SAFE plan step. start_run/race spawn ISOLATED ENVELOPE sub-runs
|
|
368
|
+
* (inPlace=false, ASSERTED); review/status/answer_question are pure reads /
|
|
369
|
+
* answer delivery that never mutate the live tree.
|
|
370
|
+
*/
|
|
371
|
+
private executeSafeStep;
|
|
372
|
+
/**
|
|
373
|
+
* Execute a RISKY `apply` step (auto_full only) through the SINGLE existing
|
|
374
|
+
* apply gate (`validateApplyGate`) + `deliver` — the same path
|
|
375
|
+
* accept_clean_patch uses. Reads the referenced run's patch + work_product +
|
|
376
|
+
* decision artifacts; refuses unless the gate passes.
|
|
377
|
+
*/
|
|
378
|
+
private executeApplyStep;
|
|
379
|
+
}
|
|
380
|
+
//# sourceMappingURL=orchestrator.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"orchestrator.d.ts","sourceRoot":"","sources":["../src/orchestrator.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EAEV,yBAAyB,EACzB,UAAU,EACV,qBAAqB,EAErB,YAAY,EAEZ,oBAAoB,EACpB,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,qBAAqB,EAGrB,QAAQ,EACR,SAAS,EAET,cAAc,EAIf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAIL,KAAK,mBAAmB,EAmBzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,KAAK,EAAE,eAAe,EAAsC,MAAM,iBAAiB,CAAC;AAqC3F,OAAO,EAAiB,KAAK,eAAe,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAgC7F,OAAO,EAGL,KAAK,YAAY,EAOlB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,KAAK,aAAa,EAAuC,MAAM,sBAAsB,CAAC;AA6B/F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB;;2DAEuD;IACvD,aAAa,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC5C;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,2FAA2F;IAC3F,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,WAAW,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,mFAAmF;IACnF,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,0EAA0E;IAC1E,sBAAsB,CAAC,EAAE,qBAAqB,EAAE,CAAC;IACjD,oEAAoE;IACpE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,oDAAoD;IACpD,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,kGAAkG;IAClG,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAC5B,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;qFACiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,GAAG,MAAM,CAAC;IACrD;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,KAC1B,IAAI,CAAC;IACV,oFAAoF;IACpF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;IACpC,oFAAoF;IACpF,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAC/C,iFAAiF;IACjF,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/E;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,yBAAyB,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACzF,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,CAClB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,KAC1B,OAAO,CAAC,OAAO,CAAC,CAAC;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;gFAC4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAmHD,qBAAa,YAAY;IAGX,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;gBAEZ,IAAI,EAAE,gBAAgB;IAInD,2EAA2E;IACrE,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAS7D,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAuEzC,gBAAgB;IA2E9B;;;;;;OAMG;YACW,6BAA6B;YAiD7B,4BAA4B;IAgB1C,OAAO,CAAC,wBAAwB;IAgBhC,OAAO,CAAC,aAAa;IAOrB,oGAAoG;IACpG,OAAO,CAAC,eAAe;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,cAAc;IAqBtB;;;;OAIG;IACH;wFACoF;IACpF,wDAAwD;IACxD,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,iBAAiB;IAoBzB,0GAA0G;IAC1G,OAAO,CAAC,oBAAoB;IAgB5B;;;;;;OAMG;IACH;;;;;OAKG;IACH,OAAO,CAAC,eAAe;YAiFT,wBAAwB;IAwLtC;;;;OAIG;IACH,OAAO,CAAC,SAAS;IA4DjB;;;;;;OAMG;YACW,kBAAkB;IA0ChC;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAerB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,kBAAkB;IAmB1B,gGAAgG;IAChG,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,aAAa;IAqJrB,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,aAAa;IA0CrB,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAkEtB,iGAAiG;YACnF,sBAAsB;IAmWpC,OAAO,CAAC,UAAU;IAsDlB,OAAO,CAAC,qBAAqB;IAwB7B;;;;;;;OAOG;YACW,0BAA0B;YAiD1B,OAAO;IAk/BrB,oGAAoG;IACpG,OAAO,CAAC,iBAAiB;IAqCzB,uGAAuG;IACvG;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IAwItB;;;;;;;;OAQG;IACH,OAAO,CAAC,YAAY;YAYN,UAAU;IA0IxB,OAAO,CAAC,wBAAwB;IAkBhC,OAAO,CAAC,qBAAqB;IAU7B,OAAO,CAAC,wBAAwB;IAmBhC,OAAO,CAAC,2BAA2B;YAoBrB,cAAc;IA4wB5B,uGAAuG;IACvG;;;;;;OAMG;IACH,OAAO,CAAC,UAAU;YAgBJ,OAAO;IA0iBrB,sFAAsF;YACxE,MAAM;IAWpB,gFAAgF;YAClE,UAAU;IAYxB,gDAAgD;YAClC,QAAQ;IAWtB;;;;;;;;OAQG;IACH,uGAAuG;IACvG,OAAO,CAAC,gBAAgB;YAIV,cAAc;YAkDd,iBAAiB;IAu8B/B;;;;;;;;;;;;;OAaG;YACW,sBAAsB;IA4KpC;;;;OAIG;YACW,eAAe;IA2H7B;;;;;OAKG;YACW,gBAAgB;CAoD/B"}
|