@dharma-ai-labs/agent-fabric 0.2.183 → 0.2.185

package/dist/index.js

@@ -71,6 +71,7 @@ import { namedSessionPaths, namedSessionRequest, readNamedSession, saveNamedSess
 import { queueNamedSessionEvidence } from './namedSessionEvidence.js';
 import { waitForNamedSessionStartup } from './namedSessionStartup.js';
 import { observeNamedSessionStartupChild } from './namedSessionStartupChild.js';
+import { namedSessionStartupPhaseError } from './namedSessionStartupDiagnostic.js';
 import { verifiedCliProcessArguments } from './cliProcessIdentity.js';
 import { retainNamedSessionRepositoryState } from './namedSessionRepositoryState.js';
 import { syncNamedSessionTaskExports } from './namedSessionTaskExportSync.js';
@@ -98,7 +99,7 @@ import { assertCodexSetupExecutionLease } from './codexSetupAdmission.js';
 import { parseLocalCodexSetupReadiness } from '@dharma-ai-labs/agent-fabric-local-vault/setup-readiness';
 import { writeBootstrapHostJson, writeBootstrapHostText } from './bootstrapHostFiles.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
-const VERSION = '0.2.183';
+const VERSION = '0.2.185';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -5077,7 +5078,8 @@ async function namedSessionCommand(action, flags) {
         }
     }
     await mkdir(paths.root, { recursive: true, mode: 0o700 });
-    const vault = await openBootstrapVault({ root: resolve(dharmaHome(), 'vault') });
+    const vault = await openBootstrapVault({ root: resolve(dharmaHome(), 'vault') })
+        .catch(error => { throw namedSessionStartupPhaseError('vault', error); });
     let releaseLock;
     const controller = new AbortController(), stop = () => controller.abort();
     process.once('SIGTERM', stop);
@@ -5086,100 +5088,117 @@ async function namedSessionCommand(action, flags) {
         process.once('disconnect', stop);
     let transport;
     try {
-        releaseLock = await acquirePidLock(resolve(paths.root, 'service.lock'), 250, 'named_session_already_running');
+        releaseLock = await acquirePidLock(resolve(paths.root, 'service.lock'), 250, 'named_session_already_running')
+            .catch(error => { throw namedSessionStartupPhaseError('lock', error); });
         const startProvider = async (childScope) => {
-            const startupStep = (operation) => childScope ? childScope.step(operation) : operation();
-            if (childScope && existing && existing.identity.membershipId !== childScope.request.membershipId) {
-                throw new Error('setup_child_unavailable');
-            }
-            const fabric = await startupStep(() => AgentFabricClient.open({ configPath: configPath(), statePath: resolve(paths.root, 'protocol-state.json'),
-                hostScope: currentBootstrapHostScope() }));
-            if (fabric.config.organizationId !== config.organizationId || fabric.config.deviceId !== config.deviceId
-                || fabric.config.publicKeyEd25519 !== config.publicKeyEd25519)
-                throw new Error('named_session_trust_scope_mismatch');
-            const trust = createNamedSessionTrust({ configPath: configPath(), identity: fabric.config });
-            await startupStep(() => trust.refresh());
-            await startupStep(() => fabric.openSession(VERSION));
-            const policyPath = resolve(item.path, '.dharma', 'approved-policy.json');
-            const policy = await startupStep(() => refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric));
-            const writeRoots = policy.tasks.writePaths.filter(path => /^[a-zA-Z0-9_-]+\/\*\*$/.test(path))
-                .map(path => path.slice(0, -3));
-            if (!writeRoots.length)
-                throw new Error('named_session_workspace_write_not_authorized');
-            let registration = existing, pending;
-            let ownerReceipt;
-            // Resolve authenticated ownership before opening any provider transport.
-            if (registration) {
-                const response = await startupStep(() => fabric.signedPost('/agent-fabric/provider-sessions', {
-                    schema: 'dharma.provider-session-registration/v1', action: 'inspect', provider: 'codex', mode: 'bridge_owned',
-                    workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
-                    bindingId: registration.bindingId, expectedRevision: 0, leaseSeconds: 60,
-                }));
-                if (!isNamedSessionReconnectReceipt(response, registration.bindingId, registration.identity)) {
-                    throw new Error('named_session_registration_invalid');
+            let startupPhase = 'client';
+            try {
+                const startupStep = (operation) => childScope ? childScope.step(operation) : operation();
+                if (childScope && existing && existing.identity.membershipId !== childScope.request.membershipId) {
+                    throw new Error('setup_child_unavailable');
                 }
-                ownerReceipt = response;
-            }
-            else {
-                const maximumCostCents = boundedInteger(flags.get('session-budget-cents'), 1000, 1, 10000, '--session-budget-cents');
-                const maximumTurnCostCents = boundedInteger(flags.get('turn-budget-cents'), 25, 1, maximumCostCents, '--turn-budget-cents');
-                const bindingId = randomUUID();
-                const response = await startupStep(() => fabric.signedPost('/agent-fabric/provider-sessions', {
-                    schema: 'dharma.provider-session-registration/v1', action: 'attach', provider: 'codex', mode: 'bridge_owned',
-                    workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
-                    bindingId, expectedRevision: 0, leaseSeconds: 60,
-                }));
-                const remote = response.registration;
-                if (!remote || !UUID_PATTERN.test(String(remote.membershipId))
-                    || childScope && remote.membershipId !== childScope.request.membershipId || remote.revision !== 1) {
-                    throw new Error('named_session_registration_invalid');
+                const fabric = await startupStep(() => AgentFabricClient.open({ configPath: configPath(), statePath: resolve(paths.root, 'protocol-state.json'),
+                    hostScope: currentBootstrapHostScope() }));
+                if (fabric.config.organizationId !== config.organizationId || fabric.config.deviceId !== config.deviceId
+                    || fabric.config.publicKeyEd25519 !== config.publicKeyEd25519)
+                    throw new Error('named_session_trust_scope_mismatch');
+                startupPhase = 'trust';
+                const trust = createNamedSessionTrust({ configPath: configPath(), identity: fabric.config });
+                await startupStep(() => trust.refresh());
+                startupPhase = 'session';
+                await startupStep(() => fabric.openSession(VERSION));
+                startupPhase = 'policy';
+                const policyPath = resolve(item.path, '.dharma', 'approved-policy.json');
+                const policy = await startupStep(() => refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric));
+                const writeRoots = policy.tasks.writePaths.filter(path => /^[a-zA-Z0-9_-]+\/\*\*$/.test(path))
+                    .map(path => path.slice(0, -3));
+                if (!writeRoots.length)
+                    throw new Error('named_session_workspace_write_not_authorized');
+                startupPhase = 'registration';
+                let registration = existing, pending;
+                let ownerReceipt;
+                // Resolve authenticated ownership before opening any provider transport.
+                if (registration) {
+                    const response = await startupStep(() => fabric.signedPost('/agent-fabric/provider-sessions', {
+                        schema: 'dharma.provider-session-registration/v1', action: 'inspect', provider: 'codex', mode: 'bridge_owned',
+                        workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
+                        bindingId: registration.bindingId, expectedRevision: 0, leaseSeconds: 60,
+                    }));
+                    if (!isNamedSessionReconnectReceipt(response, registration.bindingId, registration.identity)) {
+                        throw new Error('named_session_registration_invalid');
+                    }
+                    ownerReceipt = response;
                 }
-                const identity = { organizationId: config.organizationId, repositoryBindingId: scope.repositoryBindingId,
-                    workspaceId, endpointId: scope.endpointId, membershipId: String(remote.membershipId), deviceId: config.deviceId,
-                    provider: 'codex' };
-                if (!isNamedSessionOwnerReceipt(response, bindingId, identity))
-                    throw new Error('named_session_registration_invalid');
-                ownerReceipt = response;
-                pending = { schema: 'dharma.named-session/v1', name, bindingId, identity,
-                    maximumCostCents, maximumTurnCostCents, enabled: true };
-            }
-            const environment = namedCodexEnvironment(process.env);
-            const privateRoots = [dharmaHome(), resolve(environment.CODEX_HOME || resolve(homedir(), '.codex'))];
-            if (environment.XDG_RUNTIME_DIR)
-                privateRoots.push(environment.XDG_RUNTIME_DIR);
-            if (environment.DBUS_SESSION_BUS_ADDRESS)
-                privateRoots.push(environment.DBUS_SESSION_BUS_ADDRESS.slice('unix:path='.length));
-            const filesystem = await startupStep(() => namedCodexFilesystem({ environment, workspace: item.path, privateRoots, writeRoots }));
-            await startupStep(async () => {
-                const expectedOwner = registration ?? pending;
-                const ownerConfirmed = registration
-                    ? isNamedSessionReconnectReceipt(ownerReceipt, expectedOwner.bindingId, expectedOwner.identity)
-                    : isNamedSessionOwnerReceipt(ownerReceipt, expectedOwner.bindingId, expectedOwner.identity);
-                if (!ownerConfirmed) {
-                    throw new Error('named_session_registration_invalid');
+                else {
+                    const maximumCostCents = boundedInteger(flags.get('session-budget-cents'), 1000, 1, 10000, '--session-budget-cents');
+                    const maximumTurnCostCents = boundedInteger(flags.get('turn-budget-cents'), 25, 1, maximumCostCents, '--turn-budget-cents');
+                    const bindingId = randomUUID();
+                    const response = await startupStep(() => fabric.signedPost('/agent-fabric/provider-sessions', {
+                        schema: 'dharma.provider-session-registration/v1', action: 'attach', provider: 'codex', mode: 'bridge_owned',
+                        workspaceId, endpointId: scope.endpointId, repositoryBindingId: scope.repositoryBindingId,
+                        bindingId, expectedRevision: 0, leaseSeconds: 60,
+                    }));
+                    const remote = response.registration;
+                    if (!remote || !UUID_PATTERN.test(String(remote.membershipId))
+                        || childScope && remote.membershipId !== childScope.request.membershipId || remote.revision !== 1) {
+                        throw new Error('named_session_registration_invalid');
+                    }
+                    const identity = { organizationId: config.organizationId, repositoryBindingId: scope.repositoryBindingId,
+                        workspaceId, endpointId: scope.endpointId, membershipId: String(remote.membershipId), deviceId: config.deviceId,
+                        provider: 'codex' };
+                    if (!isNamedSessionOwnerReceipt(response, bindingId, identity))
+                        throw new Error('named_session_registration_invalid');
+                    ownerReceipt = response;
+                    pending = { schema: 'dharma.named-session/v1', name, bindingId, identity,
+                        maximumCostCents, maximumTurnCostCents, enabled: true };
                 }
-                transport = await openCodexAppServerTransport({ command: 'codex', cwd: item.path,
-                    environment, experimentalApi: true, toolCallTimeoutMs: 60_000,
-                    argv: [...namedCodexNodeOutputArguments(), '-c', 'allow_login_shell=false', '-c', 'default_permissions="dharma_bridge"',
-                        '-c', `permissions.dharma_bridge.filesystem=${filesystem.peer}`,
-                        '-c', 'permissions.dharma_bridge.network={enabled=false}',
-                        '-c', `permissions.dharma_work.filesystem=${filesystem.work}`,
-                        '-c', 'permissions.dharma_work.network={enabled=false}', 'app-server'] });
-                return transport;
-            });
-            const account = await startupStep(() => transport.request('account/read', { refreshToken: false }));
-            if (!account.account)
-                throw new Error('named_session_provider_authentication_required');
-            if (pending) {
-                const threadId = await startupStep(() => startNamedCodexThread(transport, item.path, name));
-                await startupStep(async () => vault.saveProviderSessionBinding({ schema: 'dharma.local-provider-session-binding/v1', ...pending.identity,
-                    bindingId: pending.bindingId, owner: 'dharma_bridge', sessionId: threadId, workspaceRoot: item.path,
-                    createdAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
-                    maximumProviderCostCents: pending.maximumTurnCostCents }));
-                registration = pending;
-                await startupStep(async () => saveNamedSession(dharmaHome(), registration));
-            }
-            return { registration: registration, filesystem, fabric, trust, policyPath, writeRoots };
+                startupPhase = 'environment';
+                const environment = namedCodexEnvironment(process.env);
+                const privateRoots = [dharmaHome(), resolve(environment.CODEX_HOME || resolve(homedir(), '.codex'))];
+                if (environment.XDG_RUNTIME_DIR)
+                    privateRoots.push(environment.XDG_RUNTIME_DIR);
+                if (environment.DBUS_SESSION_BUS_ADDRESS)
+                    privateRoots.push(environment.DBUS_SESSION_BUS_ADDRESS.slice('unix:path='.length));
+                startupPhase = 'filesystem';
+                const filesystem = await startupStep(() => namedCodexFilesystem({ environment, workspace: item.path, privateRoots, writeRoots }));
+                startupPhase = 'transport';
+                await startupStep(async () => {
+                    const expectedOwner = registration ?? pending;
+                    const ownerConfirmed = registration
+                        ? isNamedSessionReconnectReceipt(ownerReceipt, expectedOwner.bindingId, expectedOwner.identity)
+                        : isNamedSessionOwnerReceipt(ownerReceipt, expectedOwner.bindingId, expectedOwner.identity);
+                    if (!ownerConfirmed) {
+                        throw new Error('named_session_registration_invalid');
+                    }
+                    transport = await openCodexAppServerTransport({ command: filesystem.providerExecutable, cwd: item.path,
+                        environment: filesystem.environment, experimentalApi: true, toolCallTimeoutMs: 60_000,
+                        argv: [...namedCodexNodeOutputArguments(), '-c', 'allow_login_shell=false', '-c', 'default_permissions="dharma_bridge"',
+                            '-c', `permissions.dharma_bridge.filesystem=${filesystem.peer}`,
+                            '-c', 'permissions.dharma_bridge.network={enabled=false}',
+                            '-c', `permissions.dharma_work.filesystem=${filesystem.work}`,
+                            '-c', 'permissions.dharma_work.network={enabled=false}', 'app-server'] });
+                    return transport;
+                });
+                startupPhase = 'account';
+                const account = await startupStep(() => transport.request('account/read', { refreshToken: false }));
+                if (!account.account)
+                    throw new Error('named_session_provider_authentication_required');
+                if (pending) {
+                    startupPhase = 'thread';
+                    const threadId = await startupStep(() => startNamedCodexThread(transport, item.path, name));
+                    startupPhase = 'binding';
+                    await startupStep(async () => vault.saveProviderSessionBinding({ schema: 'dharma.local-provider-session-binding/v1', ...pending.identity,
+                        bindingId: pending.bindingId, owner: 'dharma_bridge', sessionId: threadId, workspaceRoot: item.path,
+                        createdAt: new Date().toISOString(), expiresAt: new Date(Date.now() + 30 * 86400000).toISOString(),
+                        maximumProviderCostCents: pending.maximumTurnCostCents }));
+                    registration = pending;
+                    await startupStep(async () => saveNamedSession(dharmaHome(), registration));
+                }
+                return { registration: registration, filesystem, fabric, trust, policyPath, writeRoots };
+            }
+            catch (error) {
+                throw namedSessionStartupPhaseError(startupPhase, error);
+            }
         };
         const { registration, filesystem, fabric, trust, policyPath, writeRoots } = childMessage
             ? await runCodexSetupChildStartup({ vault: vault, message: childMessage, name, workspaceId,
@@ -5198,7 +5217,7 @@ async function namedSessionCommand(action, flags) {
         };
         const refreshLifetime = () => renewNamedSessionLifetime({ vault, bindingId: registration.bindingId,
             identity: registration.identity, trust, authorize: authorizeLifetime });
-        await refreshLifetime();
+        await refreshLifetime().catch(error => { throw namedSessionStartupPhaseError('lifetime', error); });
         const channelTransport = { async signedPost(route, body) {
                 await trust.refresh();
                 const response = await fabric.signedPost(route, body);
@@ -5323,7 +5342,8 @@ async function namedSessionCommand(action, flags) {
                     return false; consumed.add(id); return true; } },
             authorizeContent: createNamedPeerContentAuthorization({ scope: repositoryRoleScope(item), diagnostics: true,
                 loadCurrentPolicy: () => refreshVerifiedWorkspacePolicyForTransmission(policyPath, workspaceId, fabric),
-                loadCurrentSourceAuthorization: () => fetchRepositorySourceAuthorization(fabric, repositoryRoleScope(item)) }) });
+                loadCurrentSourceAuthorization: () => fetchRepositorySourceAuthorization(fabric, repositoryRoleScope(item)) }) })
+            .catch(error => { throw namedSessionStartupPhaseError('service', error); });
     }
     finally {
         try {