@dharma-ai-labs/agent-fabric 0.2.124 → 0.2.126

package/dist/index.js

@@ -30,6 +30,7 @@ import { advanceRepositorySourceBaseline, BlockedRepositorySourceRetry, fetchRep
 import { assertRepositoryInstallerOwnership, writeRepositoryInstallerFile } from './repositoryInstallerFiles.js';
 import { recoverLegacyRepositoryInstaller, selectLegacyInstallerRecoveryWorkspace } from './legacyInstallerRecovery.js';
 import { onboardingResumeCommand, selectDeviceWorkspace, workspaceIdForDevice } from './onboardingWorkspace.js';
+import { resolveBootstrapRepositoryWorkspace } from './bootstrapRepositorySelection.js';
 import { receiveRepositoryPackageDelivery } from './repositoryPackageDelivery.js';
 import { selectInstalledRepositoryKnowledge } from './repositoryInstalledKnowledge.js';
 import { prepareProvidersIndependently, startSkillPreparationPump } from './skillPreparationPump.js';
@@ -60,7 +61,7 @@ import { openCodexAppServerTransport } from '@dharma-ai-labs/agent-fabric-provid
 import { createNamedSessionTrust, isNamedSessionOwnerReceipt, renewNamedSessionLifetime } from './namedSessionTrust.js';
 import { startNamedCodexThread } from './namedCodexThread.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.124';
+const VERSION = '0.2.126';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -116,6 +117,17 @@ export function portalUrl(flags, fallback = 'https://www.dharma-ai.io') {
 function print(value) {
     process.stdout.write(typeof value === 'string' ? `${value}\n` : `${JSON.stringify(value, null, 2)}\n`);
 }
+export function commandExitCode(argv, value) {
+    const { positional, flags } = parseCliOptions(argv);
+    if (positional[0] !== 'bootstrap' || flags.has('help') || flags.has('version'))
+        return 0;
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return 1;
+    const receipt = value;
+    if (receipt.ok !== true)
+        return 1;
+    return flags.has('complete') && (receipt.stage !== 'complete' || receipt.sharedRepositoryReady !== true) ? 1 : 0;
+}
 async function loadVaultModule() {
     const original = process.emitWarning;
     process.emitWarning = ((warning, ...args) => {
@@ -350,8 +362,16 @@ export async function syncPendingRetentionCapsules(vault, fabric, policy, worksp
                     : 'An unsent oversized trajectory capsule was retired from the upload queue. Encrypted raw evidence remains local and eligible sessions can be recaptured under the current policy.\n');
                 continue;
             }
-            await reserveDailyContentUpload(item.capsule, policy);
-            await fabric.syncTrajectory(item.capsule);
+            try {
+                await reserveDailyContentUpload(item.capsule, policy);
+                await fabric.syncTrajectory(item.capsule);
+            }
+            catch (error) {
+                if (!isDefinitiveSecretDisclosureRejection(error))
+                    throw error;
+                vault.discardPendingCapsuleSync(item.trajectoryId, item.revision, 'secret_disclosure_forbidden');
+                continue;
+            }
             vault.markCapsuleSynced(item.trajectoryId, item.revision);
             synced += 1;
         }
@@ -1398,10 +1418,30 @@ export async function retryBootstrapOnboarding(operation, options = {}) {
     }
 }
 function bootstrapEvidenceErrorCode(error) {
+    if (isDefinitiveSecretDisclosureRejection(error))
+        return 'secret_disclosure_forbidden';
     const message = String(error?.message || error || '');
     const candidate = message.match(/(?:^|\n)([a-z][a-z0-9_]{2,80})(?=:)/)?.[1];
     return candidate || 'evidence_capture_failed';
 }
+function isDefinitiveSecretDisclosureRejection(error) {
+    return isDefinitiveAgentFabricRejection(error)
+        && /^policy_boundary:\s*secret_disclosure_forbidden(?:\s|\.|$)/.test(String(error.message));
+}
+export function publishedPackageCanDeferSecretEvidence(evidence, repositoryPackage, sourcePolicyGenerationId) {
+    return evidence.state === 'deferred' && evidence.errorCode === 'secret_disclosure_forbidden'
+        && repositoryPackage.state === 'published' && Boolean(repositoryPackage.releaseId)
+        && repositoryPackage.sourcePolicyGenerationId === sourcePolicyGenerationId;
+}
+export function initialBootstrapEvidenceDisposition(discovered, disclosureReady) {
+    if (!Number.isSafeInteger(discovered) || discovered < 0) {
+        throw new Error('Evidence preview returned an invalid trajectory count.');
+    }
+    return discovered > 0 && !disclosureReady
+        ? { state: 'denied_disclosure', captured: 0, synced: 0,
+            reason: 'policy_boundary', errorCode: 'automatic_disclosure_not_ready' }
+        : { state: 'synchronized', captured: 0, synced: 0 };
+}
 export async function synchronizeBootstrapEvidence(operation) {
     try {
         const result = await operation();
@@ -1413,8 +1453,8 @@ export async function synchronizeBootstrapEvidence(operation) {
         const retentionNotReady = errorCode === 'agent_fabric_retention_not_ready';
         return {
             state: 'deferred',
-            captured: 0,
-            synced: 0,
+            captured: null,
+            synced: null,
             reason: retentionNotReady ? 'retention_not_ready' : policyBoundary ? 'policy_boundary' : 'capture_unavailable',
             errorCode,
         };
@@ -2006,7 +2046,38 @@ async function bootstrap(flags) {
     const organizationId = required(flags, 'organization-id');
     const resuming = flags.has('resume');
     const bootstrapToken = resuming ? null : required(flags, 'grant');
-    const workspace = await realpath(String(flags.get('workspace') || '.'));
+    const selectedRemote = flags.get('repository-url-base64url');
+    let repositorySelection;
+    try {
+        if (flags.has('repository-url-base64url') && typeof selectedRemote !== 'string') {
+            throw new Error('repository_selection_invalid_url: selected repository URL is missing.');
+        }
+        if (selectedRemote && flags.has('repository-key')) {
+            throw new Error('repository_selection_invalid_url: selected remote cannot be combined with a repository key.');
+        }
+        repositorySelection = typeof selectedRemote === 'string'
+            ? await resolveBootstrapRepositoryWorkspace({
+                workspace: String(flags.get('workspace') || '.'),
+                selectedRemoteBase64url: selectedRemote,
+                organizationId,
+                home: dharmaHome(),
+                normalizeRemote: normalizeGitRemoteIdentity,
+                withLock: (path) => acquirePidLock(path, 30_000, 'repository_checkout_busy: another setup is selecting this repository; retry after it finishes.'),
+            })
+            : { workspace: await realpath(String(flags.get('workspace') || '.')), selection: 'provided' };
+    }
+    catch (error) {
+        const message = error && typeof error === 'object' && 'message' in error && typeof error.message === 'string'
+            ? error.message : '';
+        const code = /^repository_[a-z_]+:/.exec(message)?.[0].slice(0, -1) || 'repository_selection_failed';
+        return { ok: false, stage: 'repository_selection', code, grantRedeemed: false,
+            message: code === 'repository_checkout_failed'
+                ? 'Git could not clone the selected repository with this device\'s existing access. Confirm repository access or use a matching checkout; the grant was not redeemed.'
+                : message.startsWith('repository_') ? message : 'Selected repository could not be verified; the grant was not redeemed.' };
+    }
+    const workspace = repositorySelection.workspace;
+    if (selectedRemote)
+        process.stderr.write(`Agent Fabric repository checkout: ${workspace}\n`);
     const policyRevision = required(flags, 'policy-revision');
     const repositoryIdentity = await preflightBootstrapWorkspaceIdentity(workspace, typeof flags.get('repository-key') === 'string' ? String(flags.get('repository-key')) : null);
     const requestedProvider = String(flags.get('provider') || 'auto').trim().toLowerCase();
@@ -2116,6 +2187,7 @@ async function bootstrap(flags) {
         return {
             ok: false,
             stage: 'organization_api_credentials',
+            repositorySelection,
             code: credentialFailure,
             message: 'The enrolled device is preserved, but its organization API credential is unavailable. Contact Dharma support for device-bound credential recovery; do not repeat enrollment or use another member\'s token.',
             sharedRepositoryReady: false,
@@ -2137,6 +2209,7 @@ async function bootstrap(flags) {
         return {
             ok: onboarded.ok === true,
             stage: onboarded.stage,
+            repositorySelection,
             code: onboarded.code,
             sharedRepositoryReady: false,
             enrollment: {
@@ -2190,6 +2263,7 @@ async function bootstrap(flags) {
         return {
             ok: true,
             stage: sharedRepositoryReady ? onboarded.stage : 'shared_repository_pending',
+            repositorySelection,
             localStage: onboarded.localStage ?? onboarded.stage,
             sharedRepositoryReady,
             enrollment: {
@@ -2210,16 +2284,8 @@ async function bootstrap(flags) {
     if (!skill.ready)
         throw new Error(`Provider skill did not become ready: ${JSON.stringify(skill)}`);
     const policyPath = resolve(workspace, '.dharma', 'approved-policy.json');
-    const evidenceFlags = new Map([
-        ['workspace', workspace], ['provider', provider], ['policy', policyPath], ['maximum-sessions', '20'],
-    ]);
-    const preview = await evidencePreview(evidenceFlags);
-    let synchronized = { state: 'synchronized', captured: 0, synced: 0 };
-    if (Number(preview.trajectoryCount || 0) > 0
-        && preview.automaticDisclosure?.ready === true) {
-        evidenceFlags.set('sync', true);
-        synchronized = await synchronizeBootstrapEvidence(async () => await retryBootstrapOnboarding(async () => await capture(evidenceFlags, true)));
-    }
+    const firstLearning = onboarded.firstLearningEvidence;
+    const firstLearningReady = firstLearning?.state === 'synchronized' || firstLearning?.state === 'denied_disclosure';
     const relay = flags.has('no-relay-daemon')
         ? { started: false, ...(await waitForRelayReadiness()) }
         : await startRelayDaemon(policyPath);
@@ -2252,7 +2318,6 @@ async function bootstrap(flags) {
         runOrganizationCommand('skills', 'list', apiFlags),
         runOrganizationCommand('usage', 'list', apiFlags),
     ]);
-    requireCompletedBootstrapEvidence(synchronized, Number(preview.trajectoryCount || 0));
     const organizationApi = summarizeBootstrapOrganizationApi({
         organizationId,
         organization,
@@ -2275,12 +2340,12 @@ async function bootstrap(flags) {
     const repositoryReceipt = onboarded;
     const namedSessionReady = provider !== 'codex' || process.platform !== 'linux'
         || Boolean(namedSession?.ok === true && ['running', 'executing'].includes(String(namedSession.state)));
-    const firstLearning = repositoryReceipt.firstLearningEvidence;
     const role = repositoryReceipt.repositoryRole;
     return {
-        ok: repositoryReadiness?.outcome !== 'blocked' && namedSessionReady,
-        stage: sharedRepositoryReady ? namedSessionReady ? 'complete' : 'named_session_pending'
+        ok: sharedRepositoryReady && namedSessionReady && firstLearningReady,
+        stage: sharedRepositoryReady ? namedSessionReady ? firstLearningReady ? 'complete' : 'first_learning_pending' : 'named_session_pending'
             : repositoryReadiness?.outcome === 'blocked' ? 'shared_repository_blocked' : 'shared_repository_pending',
+        repositorySelection,
         localStage: 'complete',
         sharedRepositoryReady,
         enrollment: {
@@ -2298,9 +2363,9 @@ async function bootstrap(flags) {
         provider,
         skill,
         evidence: {
-            discovered: Number(preview.trajectoryCount || 0),
-            synchronized,
-            automaticDisclosure: preview.automaticDisclosure,
+            discovered: Number(firstLearning?.discovered || 0),
+            synchronized: firstLearning,
+            automaticDisclosure: { ready: firstLearning?.disclosureReady === true },
         },
         relayProbe: relay.probe,
         relay,
@@ -2880,10 +2945,18 @@ async function capture(flags, batch = false) {
             capsules.push(capsule);
             if (fabric) {
                 vault.queueCapsuleSync(capsule.trajectoryId, capsule.revision);
-                await reserveDailyContentUpload(capsule, policy);
-                // An unknown delivery outcome retains the local advisory reservation.
-                // HQ performs the authoritative, idempotent organization/day charge.
-                syncResults.push(await fabric.syncTrajectory(capsule));
+                try {
+                    await reserveDailyContentUpload(capsule, policy);
+                    // An unknown delivery outcome retains the local advisory reservation.
+                    // HQ performs the authoritative, idempotent organization/day charge.
+                    syncResults.push(await fabric.syncTrajectory(capsule));
+                }
+                catch (error) {
+                    if (isDefinitiveSecretDisclosureRejection(error)) {
+                        vault.discardPendingCapsuleSync(capsule.trajectoryId, capsule.revision, 'secret_disclosure_forbidden');
+                    }
+                    throw error;
+                }
                 vault.markCapsuleSynced(capsule.trajectoryId, capsule.revision);
             }
         }
@@ -4179,19 +4252,24 @@ async function onboard(flags) {
         controlBranch: boundRepository.controlBranch,
         policyRevision: authoritativeRevision,
     }));
+    const canonicalPackage = registered.repositoryPackage;
     const onboardingProvider = providerIds?.[0] || 'codex';
     const onboardingEvidenceFlags = new Map([
         ['workspace', workspace], ['provider', onboardingProvider],
         ['policy', resolve(workspace, '.dharma', 'approved-policy.json')], ['maximum-sessions', '20'],
     ]);
     const onboardingEvidencePreview = await staged('first_learning_preview', async () => evidencePreview(onboardingEvidenceFlags));
-    let onboardingEvidence = { state: 'synchronized', captured: 0, synced: 0 };
-    if (Number(onboardingEvidencePreview.trajectoryCount || 0) > 0
-        && onboardingEvidencePreview.automaticDisclosure?.ready === true) {
+    const discoveredTrajectories = Number(onboardingEvidencePreview.trajectoryCount || 0);
+    const disclosureReady = onboardingEvidencePreview.automaticDisclosure?.ready === true;
+    let onboardingEvidence = initialBootstrapEvidenceDisposition(discoveredTrajectories, disclosureReady);
+    if (discoveredTrajectories > 0 && disclosureReady) {
         onboardingEvidenceFlags.set('sync', true);
         onboardingEvidence = await staged('first_learning_sync', async () => {
             const result = await synchronizeBootstrapEvidence(async () => await retryBootstrapOnboarding(async () => await capture(onboardingEvidenceFlags, true)));
-            requireCompletedBootstrapEvidence(result, Number(onboardingEvidencePreview.trajectoryCount || 0));
+            if (publishedPackageCanDeferSecretEvidence(result, canonicalPackage, sourceAuthorization.generationId)) {
+                return { ...result, state: 'denied_disclosure' };
+            }
+            requireCompletedBootstrapEvidence(result, discoveredTrajectories);
             return result;
         });
     }
@@ -4203,7 +4281,6 @@ async function onboard(flags) {
     const candidateScope = { organizationId, workspaceId: registered.workspaceId,
         repositoryBindingId: registered.repositoryBindingId, repositoryAgentId: registered.repositoryAgentId };
     const outboxRoot = resolve(dharmaHome(), 'relay', 'repository-candidates');
-    const canonicalPackage = registered.repositoryPackage;
     const refreshPolicy = repositoryPackageNeedsPolicyRefresh(canonicalPackage, sourceAuthorization.generationId);
     const retryBlockedInitial = canonicalPackage.state === 'blocked' && canonicalPackage.generation === 0
         && canonicalPackage.consolidationMode === 'initial_repository';
@@ -4309,8 +4386,8 @@ async function onboard(flags) {
         repositorySkill: installed,
         repositoryCandidate: candidate,
         firstLearningEvidence: {
-            discovered: Number(onboardingEvidencePreview.trajectoryCount || 0),
-            disclosureReady: onboardingEvidencePreview.automaticDisclosure?.ready === true,
+            discovered: discoveredTrajectories,
+            disclosureReady,
             ...onboardingEvidence,
         },
         repositoryRole: role,
@@ -6961,7 +7038,11 @@ export async function run(argv) {
     throw new Error(USAGE);
 }
 if (isDirectExecution(process.argv[1], import.meta.url)) {
-    run(process.argv.slice(2)).then(print).catch((error) => {
+    const argv = process.argv.slice(2);
+    run(argv).then((value) => {
+        print(value);
+        process.exitCode = commandExitCode(argv, value);
+    }).catch((error) => {
         const message = error instanceof Error ? error.message : String(error);
         process.stderr.write(`${message}\n`);
         process.exitCode = 2;