@dharma-ai-labs/agent-fabric 0.2.111 → 0.2.113

package/dist/index.js

@@ -18,6 +18,7 @@ import { executeTask, FileActionExecutionJournal, FileTaskReceiptStore, provider
 import { CLI_USAGE } from './usage.js';
 import { superviseRelay } from './relaySupervisor.js';
 import { disableRelayAutostart, enableRelayAutostart, relayAutostartStatus, startRelayAutostart } from './relayAutostart.js';
+import { assertStudyExactPoll, studyTaskIdFromFlags } from './studyExactTaskSelector.js';
 import { initializeRepositoryKnowledge, readRepositoryKnowledgeSource } from './repositoryKnowledge.js';
 import { inventoryRepositoryPackage, readRepositoryPackageSnapshot, readRepositorySourceBaselineSnapshot, writeRepositoryPackageSnapshot } from './repositoryPackage.js';
 import { validateRepositorySourceAuthorization } from './repositorySourceAuthorization.js';
@@ -47,8 +48,12 @@ import { runDemoSupervisor } from './demoSupervisor.js';
 import { demoWatchRegistrationKey, listDemoWatchRegistrations } from './demoWatchRegistry.js';
 import { createDemoWatchHealthRecorder } from './demoWatchHealth.js';
 import { demoWatchStatus, disableDemoWatch, enableDemoWatch, inspectDemoWatchSupervisor } from './demoWatchControl.js';
+import { namedSessionPaths, namedSessionRequest, readNamedSession, saveNamedSession, runNamedSessionService } from './namedSessionService.js';
+import { openCodexAppServerTransport } from '@dharma-ai-labs/agent-fabric-provider-adapters/experimental/codex-transport';
+import { createNamedSessionTrust, isNamedSessionOwnerReceipt, renewNamedSessionLifetime } from './namedSessionTrust.js';
+import { startNamedCodexThread } from './namedCodexThread.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.111';
+const VERSION = '0.2.113';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -1667,7 +1672,9 @@ async function relaySupervise(flags) {
             }),
         }) : Promise.resolve({ restarts: 0 });
         services.push(standard);
-        const [demoResult, standardResult] = await Promise.all([demo, standard]);
+        const sessions = policyPath ? superviseNamedSessions(controller.signal) : Promise.resolve();
+        services.push(sessions);
+        const [demoResult, standardResult] = await Promise.all([demo, standard, sessions]);
         return { ok: true, stopped: true, ...standardResult, demo: demoResult };
     }
     finally {
@@ -1683,6 +1690,42 @@ async function relaySupervise(flags) {
         await releaseLease();
     }
 }
+async function superviseNamedSessions(signal) {
+    if (process.platform !== 'linux')
+        return;
+    while (!signal.aborted) {
+        const root = resolve(dharmaHome(), 'sessions');
+        const entries = await readdir(root, { withFileTypes: true }).catch(error => {
+            if (error.code === 'ENOENT')
+                return [];
+            throw error;
+        });
+        for (const entry of entries.slice(0, 50)) {
+            if (signal.aborted)
+                break;
+            if (!entry.isDirectory() || !/^[a-z][a-z0-9-]{0,47}$/.test(entry.name))
+                continue;
+            try {
+                const registration = await readNamedSession(dharmaHome(), entry.name);
+                if (!registration?.enabled)
+                    continue;
+                await namedSessionCommand('start', new Map([
+                    ['name', registration.name], ['workspace-id', registration.identity.workspaceId], ['apply', true],
+                ]));
+            }
+            catch {
+                process.stderr.write(`${JSON.stringify({ event: 'named_session_reconnect_pending', name: entry.name })}\n`);
+            }
+        }
+        await new Promise(resolveWait => {
+            const finish = () => { clearTimeout(timer); signal.removeEventListener('abort', finish); resolveWait(); };
+            const timer = setTimeout(finish, 10_000);
+            signal.addEventListener('abort', finish, { once: true });
+            if (signal.aborted)
+                finish();
+        });
+    }
+}
 async function relayStop() {
     const home = dharmaHome();
     const supervisor = await relaySupervisorProcessState(home);
@@ -2035,12 +2078,22 @@ async function bootstrap(flags) {
         usage,
     });
     const operatingContract = await loadAgentFabricOnboardingContract();
+    const namedSession = provider === 'codex' && process.platform === 'linux' && sharedRepositoryReady
+        ? await withOnboardingStage('named_session', String(onboarded.workspaceId), `dharma bootstrap --resume --complete --portal-url ${hqUrl} --organization-id ${organizationId} --workspace . --policy-revision ${policyRevision}`, () => namedSessionCommand('start', new Map([
+            ['name', String(flags.get('session-name') || `codex-${String(onboarded.workspaceId).slice(0, 8)}`)],
+            ['workspace-id', String(onboarded.workspaceId)], ['apply', true],
+            ...(typeof flags.get('session-budget-cents') === 'string'
+                ? [['session-budget-cents', String(flags.get('session-budget-cents'))]] : []),
+        ])))
+        : null;
     const repositoryReceipt = onboarded;
+    const namedSessionReady = provider !== 'codex' || process.platform !== 'linux'
+        || Boolean(namedSession?.ok === true && ['running', 'executing'].includes(String(namedSession.state)));
     const firstLearning = repositoryReceipt.firstLearningEvidence;
     const role = repositoryReceipt.repositoryRole;
     return {
-        ok: repositoryReadiness?.outcome !== 'blocked',
-        stage: sharedRepositoryReady ? 'complete'
+        ok: repositoryReadiness?.outcome !== 'blocked' && namedSessionReady,
+        stage: sharedRepositoryReady ? namedSessionReady ? 'complete' : 'named_session_pending'
             : repositoryReadiness?.outcome === 'blocked' ? 'shared_repository_blocked' : 'shared_repository_pending',
         localStage: 'complete',
         sharedRepositoryReady,
@@ -2065,6 +2118,7 @@ async function bootstrap(flags) {
         },
         relayProbe: relay.probe,
         relay,
+        namedSession,
         repositoryReadiness,
         organizationApi,
         operatingContract: {
@@ -2079,6 +2133,8 @@ async function bootstrap(flags) {
                 ? Number(firstLearning.discovered || 0) > 0 ? 'synchronized' : 'no_eligible_history'
                 : String(firstLearning?.state || 'pending'),
             synchronization: relay.state === 'running' ? 'running' : 'pending',
+            namedSession: namedSession && namedSessionReady ? 'ready'
+                : provider === 'codex' && process.platform === 'linux' ? 'pending' : 'not_supported',
         },
     };
 }
@@ -3161,6 +3217,17 @@ async function repositoryRoleCommand(action, flags) {
     if (!item)
         throw new Error('Repository role workspace is not registered locally.');
     const scope = repositoryRoleScope(item), transport = await client();
+    if (['ask', 'reply'].includes(action) && flags.has('session-name')) {
+        const name = required(flags, 'session-name');
+        const registered = await readNamedSession(dharmaHome(), name);
+        if (!registered || registered.identity.workspaceId !== workspaceId)
+            throw new Error('named_session_scope_mismatch');
+        return namedSessionRequest(dharmaHome(), name, action === 'ask' ? {
+            action: 'ask', targetBindingId: required(flags, 'target-session-binding-id'),
+            taskId: required(flags, 'task-id'), category: required(flags, 'category'), question: required(flags, 'question'),
+        } : { action: 'read', questionId: required(flags, 'question-id'),
+            taskId: required(flags, 'task-id'), targetBindingId: required(flags, 'target-session-binding-id') });
+    }
     if (action === 'register') {
         const categories = required(flags, 'question-categories').split(',').map(value => value.trim()).filter(Boolean);
         return registerRepositoryRoleMetadata(transport, scope, { expectedRevision: Number(flags.get('expected-revision') || 0),
@@ -3177,6 +3244,201 @@ async function repositoryRoleCommand(action, flags) {
             targetEndpointId: typeof flags.get('target-endpoint-id') === 'string' ? String(flags.get('target-endpoint-id')) : undefined });
     return readRepositoryRoleReply({ transport, scope, questionId: required(flags, 'question-id') });
 }
+async function namedSessionCommand(action, flags) {
+    const name = String(flags.get('name') || 'codex');
+    const paths = namedSessionPaths(dharmaHome(), name);
+    if (process.platform !== 'linux')
+        throw new Error('codex_session_sandbox_unqualified');
+    const workspaceId = required(flags, 'workspace-id');
+    const item = (await registry()).find(row => row.workspaceId === workspaceId);
+    const config = await readDeviceConfig();
+    if (!item || !config || item.organizationId !== config.organizationId)
+        throw new Error('named_session_scope_mismatch');
+    const scope = repositoryRoleScope(item);
+    const existing = await readNamedSession(dharmaHome(), name);
+    if (existing && (existing.identity.workspaceId !== item.workspaceId
+        || existing.identity.organizationId !== config.organizationId || existing.identity.deviceId !== config.deviceId
+        || existing.identity.endpointId !== scope.endpointId || existing.identity.repositoryBindingId !== scope.repositoryBindingId)) {
+        throw new Error('named_session_scope_mismatch');
+    }
+    if (action === 'status') {
+        try {
+            return await namedSessionRequest(dharmaHome(), name, { action: 'status' });
+        }
+        catch {
+            return { ok: true, name, state: 'stopped', registered: Boolean(existing), enabled: existing?.enabled ?? false,
+                bindingId: existing?.bindingId ?? null };
+        }
+    }
+    if (action === 'work')
+        return namedSessionRequest(dharmaHome(), name, { action: 'work',
+            workId: String(flags.get('work-id') || randomUUID()), prompt: required(flags, 'prompt') });
+    if (action === 'stop') {
+        if (!flags.has('apply'))
+            return { ok: true, planned: true, name, action: 'stop' };
+        if (existing)
+            await saveNamedSession(dharmaHome(), { ...existing, enabled: false });
+        try {
+            return await namedSessionRequest(dharmaHome(), name, { action: 'stop' });
+        }
+        catch {
+            return { ok: true, name, state: 'stopped', enabled: false };
+        }
+    }
+    if (!['start', 'serve'].includes(action))
+        throw new Error('named_session_action_invalid');
+    if (!flags.has('apply'))
+        return { ok: true, planned: true, name, workspaceId,
+            provider: 'codex', localWork: 'workspace_write', peerQuestions: 'read_only', network: 'deny' };
+    if (!await repositorySharedReady(item))
+        throw new Error('named_session_repository_package_pending');
+    if (action === 'start') {
+        if (existing && !existing.enabled)
+            await saveNamedSession(dharmaHome(), { ...existing, enabled: true });
+        try {
+            return await namedSessionRequest(dharmaHome(), name, { action: 'status' });
+        }
+        catch { /* Start an owned worker below. */ }
+        const args = [fileURLToPath(import.meta.url), 'sessions', 'serve', '--name', name,
+            '--workspace-id', workspaceId, '--apply'];
+        for (const key of ['session-budget-cents', 'turn-budget-cents']) {
+            if (flags.has(key))
+                args.push(`--${key}`, required(flags, key));
+        }
+        const child = spawn(process.execPath, args, { cwd: item.path, detached: true, stdio: 'ignore', env: process.env });
+        child.on('error', () => { });
+        child.unref();
+        for (let attempt = 0; attempt < 80; attempt++) {
+            await new Promise(resolveWait => setTimeout(resolveWait, 250));
+            try {
+                return await namedSessionRequest(dharmaHome(), name, { action: 'status' });
+            }
+            catch { /* Await service initialization. */ }
+        }
+        throw new Error('named_session_startup_failed');
+    }
+    await mkdir(paths.root, { recursive: true, mode: 0o700 });
+    const releaseLock = await acquirePidLock(resolve(paths.root, 'service.lock'), 250, 'named_session_already_running');
+    const { LocalVault, loadOrCreateVaultMasterKey } = await loadVaultModule();
+    const vault = await LocalVault.open({ root: resolve(dharmaHome(), 'vault'), masterKey: await loadOrCreateVaultMasterKey() });
+    const controller = new AbortController(), stop = () => controller.abort();
+    process.once('SIGTERM', stop);
+    process.once('SIGINT', stop);
+    let transport;
+    try {
+        const fabric = await AgentFabricClient.open({ configPath: configPath(), statePath: resolve(paths.root, 'protocol-state.json') });
+        if (fabric.config.organizationId !== config.organizationId || fabric.config.deviceId !== config.deviceId
+            || fabric.config.publicKeyEd25519 !== config.publicKeyEd25519)
+            throw new Error('named_session_trust_scope_mismatch');
+        const trust = createNamedSessionTrust({ configPath: configPath(), identity: fabric.config });
+        await trust.refresh();
+        await fabric.openSession(VERSION);
+        const policyPath = resolve(item.path, '.dharma', 'approved-policy.json');
+        const policy = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
+        const writeRoots = policy.tasks.writePaths.filter(path => /^[a-zA-Z0-9_-]+\/\*\*$/.test(path))
+            .map(path => path.slice(0, -3));
+        if (!writeRoots.length)
+            throw new Error('named_session_workspace_write_not_authorized');
+        const workRoots = ['"."="read"', ...writeRoots.map(root => `${JSON.stringify(root)}="write"`)].join(',');
+        transport = await openCodexAppServerTransport({ command: 'codex', cwd: item.path,
+            environment: providerProcessEnvironment(process.env), experimentalApi: true,
+            argv: ['-c', 'default_permissions="dharma_bridge"',
+                '-c', 'permissions.dharma_bridge.filesystem={":minimal"="read",":workspace_roots"={"."="read"}}',
+                '-c', 'permissions.dharma_bridge.network={enabled=false}',
+                '-c', `permissions.dharma_work.filesystem={":minimal"="read",":workspace_roots"={${workRoots}}}`,
+                '-c', 'permissions.dharma_work.network={enabled=false}', 'app-server'] });
+        const account = await transport.request('account/read', { refreshToken: false });
+        if (!account.account)
+            throw new Error('named_session_provider_authentication_required');
+        let registration = existing;
+        if (!registration) {
+            const maximumCostCents = boundedInteger(flags.get('session-budget-cents'), 1000, 1, 10000, '--session-budget-cents');
+            const maximumTurnCostCents = boundedInteger(flags.get('turn-budget-cents'), 25, 1, maximumCostCents, '--turn-budget-cents');
+            const threadId = await startNamedCodexThread(transport, item.path, name);
+            const bindingId = randomUUID();
+            const response = await fabric.signedPost('/agent-fabric/provider-sessions', {
+                schema: 'dharma.provider-session-registration/v1', action: 'attach', provider: 'codex', mode: 'bridge_owned',
+                workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
+                bindingId, expectedRevision: 0, leaseSeconds: 60,
+            });
+            const remote = response.registration;
+            if (response.ok !== true || response.organizationId !== config.organizationId || !remote
+                || remote.bindingId !== bindingId || remote.workspaceId !== workspaceId || remote.endpointId !== scope.endpointId
+                || remote.repositoryBindingId !== scope.repositoryBindingId || remote.deviceId !== config.deviceId
+                || !UUID_PATTERN.test(String(remote.membershipId)) || remote.provider !== 'codex'
+                || remote.mode !== 'bridge_owned' || remote.state !== 'attached' || remote.revision !== 1) {
+                throw new Error('named_session_registration_invalid');
+            }
+            const identity = { organizationId: config.organizationId, repositoryBindingId: scope.repositoryBindingId,
+                workspaceId, endpointId: scope.endpointId, membershipId: String(remote.membershipId), deviceId: config.deviceId,
+                provider: 'codex' };
+            vault.saveProviderSessionBinding({ schema: 'dharma.local-provider-session-binding/v1', ...identity,
+                bindingId, owner: 'dharma_bridge', sessionId: threadId, workspaceRoot: item.path,
+                createdAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
+                maximumProviderCostCents: maximumTurnCostCents });
+            registration = { schema: 'dharma.named-session/v1', name, bindingId, identity,
+                maximumCostCents, maximumTurnCostCents, enabled: true };
+            await saveNamedSession(dharmaHome(), registration);
+        }
+        const authorizeLifetime = async () => {
+            const current = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
+            if (!writeRoots.every(root => current.tasks.writePaths.includes(`${root}/**`)))
+                return false;
+            const response = await fabric.signedPost('/agent-fabric/provider-sessions', {
+                schema: 'dharma.provider-session-registration/v1', action: 'inspect', provider: 'codex', mode: 'bridge_owned',
+                workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
+                bindingId: registration.bindingId, expectedRevision: 0, leaseSeconds: 60,
+            });
+            return isNamedSessionOwnerReceipt(response, registration.bindingId, registration.identity);
+        };
+        const refreshLifetime = () => renewNamedSessionLifetime({ vault, bindingId: registration.bindingId,
+            identity: registration.identity, trust, authorize: authorizeLifetime });
+        await refreshLifetime();
+        const channelTransport = { async signedPost(route, body) {
+                await trust.refresh();
+                const response = await fabric.signedPost(route, body);
+                await trust.refresh();
+                return response;
+            } };
+        // The durable reservation already suppresses duplicate provider execution.
+        const consumed = new Set();
+        return await runNamedSessionService({ home: dharmaHome(), registration, vault, signal: controller.signal,
+            localWriteRoots: writeRoots,
+            withActivationBoundary: operation => withWorkspaceSkillActivationLock(workspaceId, 'codex', async () => {
+                await refreshLifetime();
+                const skill = await verifyAgentFabricSkillInstallation({ provider: 'codex', workspace: item.path });
+                if (!skill.ready || !await repositorySharedReady(item))
+                    throw new Error('named_session_repository_package_pending');
+                return operation();
+            }),
+            authorizeLocalWork: async () => {
+                const current = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
+                return writeRoots.every(root => current.tasks.writePaths.includes(`${root}/**`));
+            },
+            openTransport: async () => transport, channelTransport,
+            verifier: { resolvePublicKey: trust.resolvePublicKey, consume: async (id) => { if (consumed.has(id))
+                    return false; consumed.add(id); return true; } },
+            authorizeContent: async (content) => {
+                const current = await refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric);
+                return current.evidence.automaticDisclosure?.mode === 'customer_authorized_content'
+                    && !containsDisallowedLocalPath(content)
+                    && canonicalize(redactValue(content, { classes: new Set(), redactedValues: 0,
+                        excludedPaths: 0, inputBytes: 0, outputBytes: 0 })) === canonicalize(content);
+            } });
+    }
+    finally {
+        try {
+            if (transport)
+                await transport.close();
+        }
+        finally {
+            vault.close();
+            await releaseLock();
+            process.removeListener('SIGTERM', stop);
+            process.removeListener('SIGINT', stop);
+        }
+    }
+}
 async function workspaceSync(flags, positional) {
     const workspaceId = positional[0] || required(flags, 'workspace-id');
     const policyRevision = required(flags, 'policy-revision');
@@ -4246,8 +4508,10 @@ async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, only
     }
     return finalized;
 }
-async function executeOneTask(fabric, leaseSeconds) {
-    const polled = await fabric.pollTask(leaseSeconds);
+async function executeOneTask(fabric, leaseSeconds, exactStudyTask) {
+    const polled = await fabric.pollTask(leaseSeconds, exactStudyTask?.taskId);
+    if (exactStudyTask)
+        assertStudyExactPoll(polled, exactStudyTask.taskId, exactStudyTask.workspaceId);
     const taskRow = polled.task;
     if (!taskRow?.envelope)
         return { ok: true, task: null };
@@ -4384,10 +4648,11 @@ async function runOneTask(flags) {
         && (!requestedWorkspaceId || item.workspaceId === requestedWorkspaceId)));
     if (!selectedWorkspace)
         throw new Error('Task policy must be the canonical policy of one registered workspace.');
+    const studyTaskId = studyTaskIdFromFlags(flags, selectedWorkspace.workspaceId);
     const policy = await loadVerifiedWorkspacePolicy(policyPath, selectedWorkspace.workspaceId);
     const fabric = await client();
-    const recoveredTaskTrajectories = await finalizeRecoveredSignedTaskTrajectories(fabric, policy);
-    const result = await executeOneTask(fabric, Number(flags.get('lease-seconds') || 120));
+    const recoveredTaskTrajectories = studyTaskId ? [] : await finalizeRecoveredSignedTaskTrajectories(fabric, policy);
+    const result = await executeOneTask(fabric, Number(flags.get('lease-seconds') || 120), studyTaskId ? { taskId: studyTaskId, workspaceId: selectedWorkspace.workspaceId } : undefined);
     return recoveredTaskTrajectories.length ? { ...result, recoveredTaskTrajectories } : result;
 }
 export function nativeSkillDirectory(provider, env = process.env, home = homedir()) {
@@ -6064,6 +6329,8 @@ export async function run(argv) {
     }
     if (command === 'bootstrap')
         return bootstrap(flags);
+    if (command === 'sessions')
+        return namedSessionCommand(String(subcommand), flags);
     if (command === 'onboard')
         return onboard(flags);
     if (command === 'login')