@duckmind/dm-windows-x64 0.61.4 → 0.61.9

package/extensions/dm-subagents/src/runs/shared/model-scope.js

@@ -18,47 +18,104 @@ export function checkModelScope(model, scope, source) {
   if (allow.some((pattern) => matchesScopePattern(model, pattern)))
     return;
   const baseModel = stripThinkingSuffix(model);
-  const severity = source === "explicit" ? "error" : "warn";
+  const severity = source === "explicit" || scope.strict === true ? "error" : "warn";
+  const origin = scope.origin ?? "modelScope";
   return {
     model: baseModel,
     severity,
     allowedPatterns: allow,
-    message: `Model '${baseModel}' is outside the configured subagent model scope. ` + `Allowed patterns: ${allow.join(", ")}.`
+    origin,
+    message: `Model '${baseModel}' is outside the configured subagent model scope (${origin}). ` + `Allowed patterns: ${allow.join(", ")}.`
   };
 }
-export function parseModelScopeConfig(value, meta) {
-  if (value === undefined)
-    return;
+function expandInheritPattern(pattern, parentModel) {
+  return pattern === "inherit" && parentModel ? `${parentModel.provider}/${parentModel.id}` : pattern;
+}
+function assertRecord(value, field, meta, expected = "an object") {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope'; expected an object.`);
+    throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}'; expected ${expected}.`);
   }
-  const input = value;
-  const config = {};
-  if ("enforce" in input) {
-    if (typeof input.enforce !== "boolean") {
-      throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.enforce'; expected a boolean.`);
-    }
-    config.enforce = input.enforce;
+  return value;
+}
+function parseAllowList(value, field, meta) {
+  if (!Array.isArray(value)) {
+    throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}'; expected an array of strings.`);
   }
-  if ("allow" in input) {
-    if (!Array.isArray(input.allow)) {
-      throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.allow'; expected an array of strings.`);
+  const allow = [];
+  for (const entry of value) {
+    if (typeof entry !== "string") {
+      throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}'; expected an array of strings.`);
     }
-    const allow = [];
-    for (const entry of input.allow) {
-      if (typeof entry !== "string") {
-        throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.allow'; expected an array of strings.`);
+    const trimmed = entry.trim();
+    if (trimmed)
+      allow.push(trimmed);
+  }
+  if (allow.length === 0) {
+    throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}'; expected a non-empty array of patterns.`);
+  }
+  return allow;
+}
+function parseScopeRule(input, field, meta) {
+  const rule = {};
+  if ("enforce" in input) {
+    if (typeof input.enforce !== "boolean")
+      throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}.enforce'; expected a boolean.`);
+    rule.enforce = input.enforce;
+  }
+  if ("strict" in input) {
+    if (typeof input.strict !== "boolean")
+      throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}.strict'; expected a boolean.`);
+    rule.strict = input.strict;
+  }
+  if ("allow" in input)
+    rule.allow = parseAllowList(input.allow, `${field}.allow`, meta);
+  return rule;
+}
+export function resolveModelScopesForAgent(config, agentName, parentModel) {
+  if (!config)
+    return [];
+  const scopes = [];
+  if (config.allow) {
+    scopes.push({
+      ...config.enforce !== undefined ? { enforce: config.enforce } : {},
+      ...config.strict !== undefined ? { strict: config.strict } : {},
+      allow: config.allow.map((pattern) => expandInheritPattern(pattern, parentModel)),
+      origin: "modelScope"
+    });
+  }
+  const agentScope = config.agents?.[agentName];
+  if (agentScope?.allow) {
+    scopes.push({
+      enforce: agentScope.enforce ?? config.enforce,
+      strict: agentScope.strict ?? config.strict,
+      allow: agentScope.allow.map((pattern) => expandInheritPattern(pattern, parentModel)),
+      origin: `modelScope.agents.${agentName}`
+    });
+  }
+  return scopes;
+}
+export function parseModelScopeConfig(value, meta) {
+  if (value === undefined)
+    return;
+  const input = assertRecord(value, "modelScope", meta);
+  const config = parseScopeRule(input, "modelScope", meta);
+  if ("agents" in input) {
+    const agents = {};
+    for (const [rawName, rawScope] of Object.entries(assertRecord(input.agents, "modelScope.agents", meta, "an object keyed by agent name"))) {
+      const name = rawName.trim();
+      const field = `modelScope.agents.${name}`;
+      if (!name)
+        throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.agents' key; expected a non-empty agent name.`);
+      const agentInput = assertRecord(rawScope, field, meta);
+      if ("agents" in agentInput) {
+        throw new Error(`Subagent settings in '${meta.filePath}' have invalid '${field}.agents'; nested agent scopes are not supported.`);
       }
-      const trimmed = entry.trim();
-      if (trimmed)
-        allow.push(trimmed);
-    }
-    if (allow.length === 0) {
-      throw new Error(`Subagent settings in '${meta.filePath}' have invalid 'modelScope.allow'; expected a non-empty array of patterns.`);
+      agents[name] = parseScopeRule(agentInput, field, meta);
     }
-    config.allow = allow;
+    config.agents = agents;
   }
-  if (config.enforce === true && (!config.allow || config.allow.length === 0)) {
+  const hasAnyAllow = Boolean(config.allow?.length) || Object.values(config.agents ?? {}).some((scope) => Boolean(scope.allow?.length));
+  if (config.enforce === true && !hasAnyAllow) {
     throw new Error(`Subagent settings in '${meta.filePath}' set modelScope.enforce without a non-empty 'allow' list; supply allowed model patterns or disable enforcement.`);
   }
   return Object.keys(config).length > 0 ? config : undefined;

package/extensions/dm-subagents/src/runs/shared/mutation-evidence.js

@@ -0,0 +1,182 @@
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+const MAX_TRACKED_PATHS = 500;
+const MAX_HASH_BYTES = 1024 * 1024;
+const MAX_TIMEOUT_FILES = 20;
+function gitArguments(args) {
+  return ["-c", "core.fsmonitor=false", ...args];
+}
+function gitOutput(cwd, args, maxBuffer = MAX_HASH_BYTES) {
+  return execFileSync("git", gitArguments(args), { cwd, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], maxBuffer, windowsHide: true });
+}
+function splitNul(output) {
+  return output.split("\x00").filter((part) => part.length > 0);
+}
+function hashLargeDiff(cwd, relativePath) {
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "dm-subagents-tracked-diff-"));
+  const diffPath = path.join(tempDir, "diff.patch");
+  try {
+    execFileSync("git", gitArguments(["diff", "--no-ext-diff", "--binary", `--output=${diffPath}`, "HEAD", "--", relativePath]), { cwd, stdio: "ignore", windowsHide: true });
+    const hash = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    const fd = fs.openSync(diffPath, "r");
+    try {
+      for (;; ) {
+        const bytesRead = fs.readSync(fd, buffer, 0, buffer.length, null);
+        if (bytesRead === 0)
+          break;
+        hash.update(buffer.subarray(0, bytesRead));
+      }
+    } finally {
+      fs.closeSync(fd);
+    }
+    return hash.digest("hex");
+  } finally {
+    fs.rmSync(tempDir, { recursive: true, force: true });
+  }
+}
+function listChangedTrackedFiles(cwd) {
+  const paths = splitNul(gitOutput(cwd, ["diff", "--no-ext-diff", "--name-only", "-z", "HEAD", "--"], MAX_HASH_BYTES));
+  return { paths: paths.slice(0, MAX_TRACKED_PATHS), truncated: paths.length > MAX_TRACKED_PATHS };
+}
+function fingerprintPath(cwd, relativePath) {
+  try {
+    const diff = gitOutput(cwd, ["diff", "--no-ext-diff", "--binary", "HEAD", "--", relativePath], MAX_HASH_BYTES);
+    return { kind: "diff", digest: createHash("sha256").update(diff).digest("hex") };
+  } catch {
+    return { kind: "diff", digest: hashLargeDiff(cwd, relativePath) };
+  }
+}
+function sameFingerprint(left, right) {
+  if (!left || left.kind !== "diff" || right.kind !== "diff")
+    return false;
+  return left.digest === right.digest;
+}
+export function snapshotTrackedMutations(cwd) {
+  try {
+    const changed = listChangedTrackedFiles(cwd);
+    const fingerprints = {};
+    for (const file of changed.paths)
+      fingerprints[file] = fingerprintPath(cwd, file);
+    return { source: "tracked-files", trackedOnly: true, cwd, dirtyFiles: changed.paths, fingerprints, truncated: changed.truncated };
+  } catch (error) {
+    return { source: "tracked-files", trackedOnly: true, cwd, dirtyFiles: [], fingerprints: {}, unavailable: error instanceof Error ? error.message : String(error) };
+  }
+}
+export function collectTrackedMutationEvidence(snapshot, cwd = snapshot.cwd) {
+  if (snapshot.unavailable) {
+    return { source: "tracked-files", trackedOnly: true, changedFiles: [], attemptedMutation: false, unavailable: snapshot.unavailable };
+  }
+  try {
+    const current = listChangedTrackedFiles(cwd);
+    const startDirty = new Set(snapshot.dirtyFiles);
+    const candidates = new Set([...snapshot.dirtyFiles, ...current.paths]);
+    const changedFiles = [];
+    for (const file of candidates) {
+      if (!startDirty.has(file)) {
+        if (!snapshot.truncated)
+          changedFiles.push(file);
+        continue;
+      }
+      if (!sameFingerprint(snapshot.fingerprints[file], fingerprintPath(cwd, file)))
+        changedFiles.push(file);
+    }
+    changedFiles.sort();
+    return {
+      source: "tracked-files",
+      trackedOnly: true,
+      changedFiles,
+      attemptedMutation: changedFiles.length > 0,
+      truncated: snapshot.truncated || current.truncated || undefined
+    };
+  } catch (error) {
+    return { source: "tracked-files", trackedOnly: true, changedFiles: [], attemptedMutation: false, unavailable: error instanceof Error ? error.message : String(error) };
+  }
+}
+function formatPathList(paths) {
+  if (paths.length === 0)
+    return "none";
+  const shown = paths.slice(0, MAX_TIMEOUT_FILES).join(", ");
+  return paths.length > MAX_TIMEOUT_FILES ? `${shown}, ... (${paths.length - MAX_TIMEOUT_FILES} more)` : shown;
+}
+export function projectTimeoutRecovery(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return;
+  const source = value;
+  const termination = source.termination === "timed-out" || source.termination === "stopped" ? source.termination : undefined;
+  if (!termination || !Array.isArray(source.changedFiles))
+    return;
+  const allChangedFiles = source.changedFiles.filter((file) => typeof file === "string");
+  const changedFiles = allChangedFiles.slice(0, MAX_TIMEOUT_FILES);
+  const reportStatus = source.reportStatus === "missing" || source.reportStatus === "written" || source.reportStatus === "not-requested" || source.reportStatus === "unknown" ? source.reportStatus : undefined;
+  return {
+    termination,
+    changedFiles,
+    ...source.truncated === true || allChangedFiles.length > changedFiles.length ? { truncated: true } : {},
+    ...source.recoveryNeeded === true ? { recoveryNeeded: true } : {},
+    ...source.reason === "timed-out-with-dirty-worktree" ? { reason: source.reason } : {},
+    ...reportStatus ? { reportStatus } : {}
+  };
+}
+export function formatTimeoutRecoveryLines(value, indent = "") {
+  const recovery = projectTimeoutRecovery(value);
+  if (!recovery?.recoveryNeeded)
+    return [];
+  const changedFiles = recovery.changedFiles.length > 0 ? `${recovery.changedFiles.join(", ")}${recovery.truncated ? ", …" : ""}` : "none";
+  const changedFileCount = recovery.changedFiles.length > 0 ? `${recovery.changedFiles.length}${recovery.truncated ? "+" : ""}` : "0";
+  return [
+    `${indent}Recovery needed: review the diff and artifacts before resuming or launching dependent stages.`,
+    `${indent}Recovery evidence: requested report: ${recovery.reportStatus ?? "unknown"}; changed tracked files: ${changedFiles} (${changedFileCount}); classification: ${recovery.reason ?? recovery.termination}`
+  ];
+}
+export function buildTimeoutRecoverySummary(input) {
+  const warning = "Inspect partial changes before retrying or resuming the child.";
+  const changedFiles = input.evidence.changedFiles.slice(0, MAX_TIMEOUT_FILES);
+  let reportStatus = "not-requested";
+  if (input.requiredOutputMissing === true)
+    reportStatus = "missing";
+  else if (input.requiredOutputMissing === false)
+    reportStatus = "written";
+  const recoveryNeeded = input.termination === "timed-out" && reportStatus === "missing" && input.evidence.changedFiles.length > 0;
+  const lines = [
+    "Recovery summary:",
+    `- termination: ${input.termination}`,
+    `- changed tracked files: ${input.evidence.unavailable ? `unavailable (${input.evidence.unavailable})` : formatPathList(input.evidence.changedFiles)}`
+  ];
+  if (input.requiredOutputMissing !== undefined)
+    lines.push(`- requested report: ${reportStatus}`);
+  if (recoveryNeeded)
+    lines.push("- Recovery needed: review the diff and artifacts before resuming or launching dependent stages.");
+  if (input.currentTool)
+    lines.push(`- active tool: ${input.currentTool}${input.currentToolArgs ? ` — ${input.currentToolArgs}` : ""}`);
+  if (input.currentPath)
+    lines.push(`- active path: ${input.currentPath}`);
+  if (input.sessionFile)
+    lines.push(`- session file: ${input.sessionFile}`);
+  if (input.transcriptPath)
+    lines.push(`- transcript: ${input.transcriptPath}`);
+  if (input.artifactPaths?.outputPath)
+    lines.push(`- output artifact: ${input.artifactPaths.outputPath}`);
+  if (input.artifactPaths?.metadataPath)
+    lines.push(`- metadata artifact: ${input.artifactPaths.metadataPath}`);
+  lines.push(`Warning: ${warning}`);
+  return {
+    termination: input.termination,
+    changedFiles,
+    truncated: input.evidence.changedFiles.length > changedFiles.length || input.evidence.truncated || undefined,
+    ...recoveryNeeded ? { recoveryNeeded: true, reason: "timed-out-with-dirty-worktree" } : {},
+    reportStatus,
+    currentTool: input.currentTool,
+    currentToolArgs: input.currentToolArgs,
+    currentPath: input.currentPath,
+    sessionFile: input.sessionFile,
+    transcriptPath: input.transcriptPath,
+    artifactPaths: input.artifactPaths,
+    warning,
+    message: lines.join(`
+`)
+  };
+}