@dharma-ai-labs/agent-fabric 0.2.112 → 0.2.114

package/dist/index.js

@@ -18,11 +18,13 @@ import { executeTask, FileActionExecutionJournal, FileTaskReceiptStore, provider
 import { CLI_USAGE } from './usage.js';
 import { superviseRelay } from './relaySupervisor.js';
 import { disableRelayAutostart, enableRelayAutostart, relayAutostartStatus, startRelayAutostart } from './relayAutostart.js';
+import { assertStudyExactPoll, studyTaskIdFromFlags } from './studyExactTaskSelector.js';
 import { initializeRepositoryKnowledge, readRepositoryKnowledgeSource } from './repositoryKnowledge.js';
 import { inventoryRepositoryPackage, readRepositoryPackageSnapshot, readRepositorySourceBaselineSnapshot, writeRepositoryPackageSnapshot } from './repositoryPackage.js';
 import { validateRepositorySourceAuthorization } from './repositorySourceAuthorization.js';
 import { advanceRepositorySourceBaseline, BlockedRepositorySourceRetry, fetchRepositorySourceAuthorization, recoverPublishedLocalSourceBaseline, RepositorySourceWatcher, scanRepositorySourceChanges, seedRepositorySourceWatcher } from './repositorySourceSync.js';
 import { assertRepositoryInstallerOwnership, writeRepositoryInstallerFile } from './repositoryInstallerFiles.js';
+import { onboardingResumeCommand, selectDeviceWorkspace, workspaceIdForDevice } from './onboardingWorkspace.js';
 import { receiveRepositoryPackageDelivery } from './repositoryPackageDelivery.js';
 import { selectInstalledRepositoryKnowledge } from './repositoryInstalledKnowledge.js';
 import { prepareProvidersIndependently, startSkillPreparationPump } from './skillPreparationPump.js';
@@ -52,7 +54,7 @@ import { openCodexAppServerTransport } from '@dharma-ai-labs/agent-fabric-provid
 import { createNamedSessionTrust, isNamedSessionOwnerReceipt, renewNamedSessionLifetime } from './namedSessionTrust.js';
 import { startNamedCodexThread } from './namedCodexThread.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.112';
+const VERSION = '0.2.114';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -1133,13 +1135,6 @@ function providerAdapter(provider) {
         return hermesAdapter;
     return null;
 }
-function deterministicUuid(value) {
-    const bytes = createHash('sha256').update(value).digest().subarray(0, 16);
-    bytes[6] = ((bytes[6] ?? 0) & 0x0f) | 0x50;
-    bytes[8] = ((bytes[8] ?? 0) & 0x3f) | 0x80;
-    const hex = bytes.toString('hex');
-    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
-}
 export function normalizeGitRemoteIdentity(value) {
     const raw = value.trim();
     if (!raw || /[\u0000-\u001f\u007f]/.test(raw))
@@ -1627,13 +1622,20 @@ async function relaySupervise(flags) {
     if (demoOnly && flags.has('policy'))
         throw new Error('Demo-only supervision cannot select a standard policy.');
     const policyPath = demoOnly ? null : resolve(required(flags, 'policy'));
-    const selectedWorkspace = policyPath
-        ? (await registry()).find((item) => resolve(item.path, '.dharma', 'approved-policy.json') === policyPath) : null;
+    const config = policyPath ? await readDeviceConfig() : null;
+    const policyWorkspace = policyPath ? dirname(dirname(policyPath)) : null;
+    const selectedWorkspace = policyPath && config && policyWorkspace
+        ? selectDeviceWorkspace(await registry(), {
+            organizationId: config.organizationId, deviceId: config.deviceId, path: policyWorkspace,
+        }) : null;
     if (policyPath) {
-        if (!await readDeviceConfig())
+        if (!config)
             throw new Error('Relay supervision requires an enrolled device.');
         if (!selectedWorkspace)
             throw new Error('Relay policy must be the canonical policy of one registered workspace.');
+        if (resolve(selectedWorkspace.path, '.dharma', 'approved-policy.json') !== policyPath) {
+            throw new Error('Relay policy must be the canonical policy of one registered workspace.');
+        }
     }
     else if (!(await listDemoWatchRegistrations(dharmaHome())).length) {
         throw new Error('Relay supervision requires at least one registered Demo repository.');
@@ -2601,7 +2603,9 @@ async function capture(flags, batch = false) {
     }
     const session = sessions.at(-1);
     const device = JSON.parse(await readFile(configPath(), 'utf8'));
-    const registered = (await registry()).find((item) => item.path === workspace);
+    const registered = selectDeviceWorkspace(await registry(), {
+        organizationId: device.organizationId, deviceId: device.deviceId, path: workspace,
+    });
     if (!registered)
         throw new Error('Workspace is not registered locally. Run dharma workspace add.');
     const captureProvenance = (collectedAt) => ({
@@ -2758,7 +2762,9 @@ async function evidencePreview(flags) {
     const policyPath = flags.get('policy');
     if (typeof policyPath === 'string') {
         const device = JSON.parse(await readFile(configPath(), 'utf8'));
-        const registered = (await registry()).find((item) => item.path === workspace);
+        const registered = selectDeviceWorkspace(await registry(), {
+            organizationId: device.organizationId, deviceId: device.deviceId, path: workspace,
+        });
         if (!registered)
             throw new Error('Workspace is not registered locally. Run dharma workspace add.');
         const policy = await loadVerifiedWorkspacePolicy(policyPath, registered?.workspaceId);
@@ -2836,7 +2842,7 @@ async function workspaceAdd(flags, positional) {
     const organizationId = String(flags.get('organization-id') || device.organizationId);
     if (organizationId !== device.organizationId)
         throw new Error('Workspace organization must match the enrolled device.');
-    const workspaceId = deterministicUuid(`${organizationId}:${device.deviceId}:${path}`);
+    const workspaceId = workspaceIdForDevice({ organizationId, deviceId: device.deviceId, path });
     const remote = await gitValue(path, ['config', '--get', 'remote.origin.url']);
     const identity = sourceRepositoryFingerprint(remote, typeof flags.get('repository-key') === 'string' ? String(flags.get('repository-key')) : null);
     const entry = {
@@ -3769,17 +3775,29 @@ async function onboard(flags) {
     const providerIds = parseSelectedProviderIds(typeof flags.get('providers') === 'string'
         ? [String(flags.get('providers'))]
         : typeof flags.get('provider') === 'string' ? [String(flags.get('provider'))] : []);
-    let registered = (await registry()).find((item) => item.path === workspace);
-    if (!registered || (!registered.repositoryRemoteHash && typeof flags.get('repository-key') === 'string')) {
+    const repositoryKey = typeof flags.get('repository-key') === 'string' ? String(flags.get('repository-key')) : null;
+    const repositoryIdentity = await preflightBootstrapWorkspaceIdentity(workspace, repositoryKey);
+    let registered = selectDeviceWorkspace(await registry(), {
+        organizationId,
+        deviceId: config.deviceId,
+        path: workspace,
+        repositoryRemoteHash: repositoryIdentity.fingerprint,
+    });
+    if (!registered) {
         const addFlags = new Map([
             ['organization-id', organizationId],
             ['path', workspace],
             ['name', String(flags.get('name') || basename(workspace))],
         ]);
-        if (typeof flags.get('repository-key') === 'string')
-            addFlags.set('repository-key', String(flags.get('repository-key')));
+        if (repositoryKey)
+            addFlags.set('repository-key', repositoryKey);
         await workspaceAdd(addFlags, [workspace]);
-        registered = (await registry()).find((item) => item.path === workspace);
+        registered = selectDeviceWorkspace(await registry(), {
+            organizationId,
+            deviceId: config.deviceId,
+            path: workspace,
+            repositoryRemoteHash: repositoryIdentity.fingerprint,
+        });
     }
     if (!registered)
         throw new Error('Workspace registration failed.');
@@ -3807,8 +3825,12 @@ async function onboard(flags) {
     }
     const boundRepository = registered;
     const onboardWorkspaceId = registered.workspaceId;
-    const providerOption = providerIds?.length ? ` --providers ${providerIds.join(',')}` : '';
-    const resumeCommand = `dharma onboard --resume --organization-id ${organizationId} --workspace . --policy-revision ${authoritativeRevision}${providerOption}`;
+    const resumeCommand = onboardingResumeCommand({
+        organizationId,
+        policyRevision: authoritativeRevision,
+        repositoryKey,
+        providerIds,
+    });
     const staged = (stage, operation) => withOnboardingStage(stage, onboardWorkspaceId, resumeCommand, operation);
     const installed = await staged('local_skill_inventory', async () => installRepositoryAgentFabricSkill({
         workspace,
@@ -4507,8 +4529,10 @@ async function finalizeRecoveredSignedTaskTrajectories(fabric, vaultPolicy, only
     }
     return finalized;
 }
-async function executeOneTask(fabric, leaseSeconds) {
-    const polled = await fabric.pollTask(leaseSeconds);
+async function executeOneTask(fabric, leaseSeconds, exactStudyTask) {
+    const polled = await fabric.pollTask(leaseSeconds, exactStudyTask?.taskId);
+    if (exactStudyTask)
+        assertStudyExactPoll(polled, exactStudyTask.taskId, exactStudyTask.workspaceId);
     const taskRow = polled.task;
     if (!taskRow?.envelope)
         return { ok: true, task: null };
@@ -4641,14 +4665,23 @@ async function executeOneTask(fabric, leaseSeconds) {
 async function runOneTask(flags) {
     const policyPath = resolve(required(flags, 'policy'));
     const requestedWorkspaceId = typeof flags.get('workspace-id') === 'string' ? String(flags.get('workspace-id')) : undefined;
-    const selectedWorkspace = (await registry()).find((item) => (resolve(item.path, '.dharma', 'approved-policy.json') === policyPath
-        && (!requestedWorkspaceId || item.workspaceId === requestedWorkspaceId)));
+    const records = await registry();
+    const config = await readDeviceConfig();
+    const selectedWorkspace = requestedWorkspaceId
+        ? records.find(item => item.workspaceId === requestedWorkspaceId
+            && resolve(item.path, '.dharma', 'approved-policy.json') === policyPath)
+        : config
+            ? selectDeviceWorkspace(records, {
+                organizationId: config.organizationId, deviceId: config.deviceId, path: dirname(dirname(policyPath)),
+            })
+            : null;
     if (!selectedWorkspace)
         throw new Error('Task policy must be the canonical policy of one registered workspace.');
+    const studyTaskId = studyTaskIdFromFlags(flags, selectedWorkspace.workspaceId);
     const policy = await loadVerifiedWorkspacePolicy(policyPath, selectedWorkspace.workspaceId);
     const fabric = await client();
-    const recoveredTaskTrajectories = await finalizeRecoveredSignedTaskTrajectories(fabric, policy);
-    const result = await executeOneTask(fabric, Number(flags.get('lease-seconds') || 120));
+    const recoveredTaskTrajectories = studyTaskId ? [] : await finalizeRecoveredSignedTaskTrajectories(fabric, policy);
+    const result = await executeOneTask(fabric, Number(flags.get('lease-seconds') || 120), studyTaskId ? { taskId: studyTaskId, workspaceId: selectedWorkspace.workspaceId } : undefined);
     return recoveredTaskTrajectories.length ? { ...result, recoveredTaskTrajectories } : result;
 }
 export function nativeSkillDirectory(provider, env = process.env, home = homedir()) {
@@ -5753,9 +5786,17 @@ async function takeCachedSkillUpdate(input) {
 }
 async function relayStart(flags) {
     const policyPath = resolve(required(flags, 'policy'));
-    const selectedWorkspace = (await registry()).find((item) => resolve(item.path, '.dharma', 'approved-policy.json') === policyPath);
+    const declaredPolicy = await loadOrganizationPolicy(policyPath);
+    const declaredWorkspaceId = declaredPolicy.serverAuthorization?.workspaceId;
+    const selectedWorkspace = declaredWorkspaceId
+        ? (await registry()).find(item => item.workspaceId === declaredWorkspaceId
+            && item.organizationId === declaredPolicy.organizationId)
+        : null;
     if (!selectedWorkspace)
         throw new Error('Relay policy must be the canonical policy of one registered workspace.');
+    if (resolve(selectedWorkspace.path, '.dharma', 'approved-policy.json') !== policyPath) {
+        throw new Error('Relay policy must be the canonical policy of one registered workspace.');
+    }
     let canonicalWorkspace = selectedWorkspace;
     let policy = await loadVerifiedWorkspacePolicy(policyPath, canonicalWorkspace.workspaceId);
     const fabric = await client();