@elu-labs/elu 0.0.0-stage → 0.1.0

package/lib/checks.mjs

@@ -0,0 +1,102 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { baseFile, taskChanges, head, tracked, assertTaskGitSafe } from './git.mjs';
+import { parseConfig } from './config.mjs';
+import { protectedFiles, protectedPath, sensitive, pathAllowed } from './policy.mjs';
+import { hash, noSymlinks, refuse } from './util.mjs';
+import { sandboxRun } from './sandbox.mjs';
+import { taskDir, saveTask, event } from './state.mjs';
+import { MODES } from './modes.mjs';
+import { NOT_APPROVED, trustedText } from './project-trust.mjs';
+
+// The session's mode decides which structural rules apply. A task without
+// permissions is from before modes existed and keeps every rule.
+const modeOf = task => MODES.includes(task?.permissions) ? task.permissions : 'locked';
+
+export function pinnedConfig(repo, base, { current = true, task } = {}) {
+  if (task?.mode === 'automatic' || task?.kind === 'conversation') {
+    const file = path.join(taskDir(repo, task.id), 'policy.yaml'); noSymlinks(file);
+    const text = fs.readFileSync(file, 'utf8');
+    if (hash(text) !== task.configHash) refuse('The saved task policy changed.');
+    return { config: parseConfig(text), configHash: hash(text) };
+  }
+  const text = baseFile(repo.root, base, '.elu-code/config.yaml');
+  const file = path.join(repo.root, '.elu-code', 'config.yaml'); noSymlinks(file);
+  if (current && text !== fs.readFileSync(file, 'utf8')) refuse('Commit policy changes before running a task.');
+  // A new task takes its policy from the project's file only as the owner approved it on
+  // this machine. Nobody is asked here, so it is refused with what to do.
+  if (current && trustedText(repo.root, 'config.yaml') !== text) refuse(NOT_APPROVED);
+  return { config: parseConfig(text), configHash: hash(text) };
+}
+export function structuralChecks(task, config, { mode = 'locked' } = {}) {
+  const change = taskChanges(task);
+  const results = [], full = mode === 'full', dependenciesOpen = ['auto', 'full'].includes(mode);
+  const add = (name, pass, details = []) => results.push({ name, status: pass ? 'passed' : 'failed', details });
+  add('no-ignored-output', !change.ignored.length, change.ignored);
+  if (!full) add('changed-lines', change.lines <= config.limits.changedLines && !change.binary, change.binary ? ['Binary changes require manual review.'] : [`${change.lines} changed lines; limit ${config.limits.changedLines}.`]);
+  const undeclared = change.paths.filter((file) => !pathAllowed(file, config.paths));
+  add('declared-paths', !undeclared.length, undeclared);
+  const protectedChanges = change.paths.filter(file=>protectedPath(file, { mode })||(task.hookProtectedPaths??[]).some(dir=>file===dir||file.startsWith(`${dir}/`)));
+  if (!full) add('protected-paths', !protectedChanges.length, protectedChanges);
+  const secrets = change.paths.filter(sensitive);
+  add('secret-paths', !secrets.length, secrets);
+  const deletedTests = tracked(task.worktree, task.base).filter((file) => /(^|\/)(?:tests?|__tests__)(\/|$)|\.(?:test|spec)\.[^/]+$/.test(file) && !fs.existsSync(path.join(task.worktree, file)));
+  add('no-deleted-tests', !deletedTests.length, deletedTests);
+  const packages = change.paths.filter((file) => /(^|\/)package\.json$/.test(file));
+  const scripts = []; const dependencies = [];
+  for (const file of packages) {
+    const before = JSON.parse(baseFile(task.worktree, task.base, file, { optional: true }) ?? '{}');
+    const full = path.join(task.worktree, file); noSymlinks(full);
+    const after = fs.existsSync(full) ? JSON.parse(fs.readFileSync(full, 'utf8')) : {};
+    if (JSON.stringify(before.scripts ?? {}) !== JSON.stringify(after.scripts ?? {})) scripts.push(file);
+    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies', 'bundledDependencies', 'bundleDependencies', 'workspaces', 'packageManager']) {
+      if (JSON.stringify(before[field] ?? {}) !== JSON.stringify(after[field] ?? {})) dependencies.push(`${file}: ${field}`);
+    }
+  }
+  if (!full) add('unchanged-scripts', !scripts.length, scripts);
+  if (!dependenciesOpen) add('no-dependency-changes', !dependencies.length, dependencies);
+  return { change, results };
+}
+export async function runChecks(repo, task, { signal } = {}) {
+  if (task.kind === 'conversation') refuse('This response has no code changes to verify.');
+  signal?.throwIfAborted();
+  const { config, configHash } = pinnedConfig(repo, task.base, { current: false, task });
+  const hooks=assertTaskGitSafe(repo,task);
+  if (task.configHash !== configHash) refuse('The pinned task policy changed.');
+  if (head(task.worktree) !== (task.commit ?? task.base)) refuse('The task worktree HEAD changed outside ELU Code.');
+  const mode = modeOf(task);
+  const { change, results } = structuralChecks(task, config, { mode });
+  const protectedPaths = [...protectedFiles(tracked(task.worktree, task.base), { mode }),...hooks.protectedPaths];
+  if (results.every((row) => row.status === 'passed')) {
+    for (const check of config.checks) {
+      const logFile = path.join(taskDir(repo, task.id), `check-${check.name}-${crypto.randomUUID()}.log`);
+      const scratch = path.join(task.worktree, '.elu-code', 'tmp',crypto.randomUUID()); noSymlinks(scratch);
+      let run;
+      task.activeRole = 'checks'; task.activeLog = logFile; task.activeSince = new Date().toISOString(); saveTask(repo, task);
+      event(repo, 'check-started', { taskId: task.id, name: check.name });
+      try {
+        run = await sandboxRun({ cwd: task.worktree, protectedPaths, scratch, program: check.command[0], args: check.command.slice(1), logFile, processFile: path.join(taskDir(repo, task.id), 'process.json'), timeoutSeconds: config.roles.lead.timeoutSeconds,config,signal, network: mode === 'full' ? 'on' : 'off' });
+      } finally {
+        if (fs.existsSync(scratch)) fs.rmSync(scratch, { recursive: true });
+        task.activeLog = null; task.activeRole = null; saveTask(repo, task);
+      }
+      results.push({ name: check.name, status: run.code === 0 && !run.timedOut ? 'passed' : 'failed', logFile, ...(run.timedOut ? { details: ['Timed out.'] } : {}) });
+      event(repo, 'check-finished', { taskId: task.id, name: check.name, status: results.at(-1).status });
+      const after = taskChanges(task);
+      if (after.digest !== change.digest) {
+        results.push({ name: 'checks-left-source-unchanged', status: 'failed', details: ['A check changed the source tree.'] }); break;
+      }
+    }
+  } else {
+    for (const check of config.checks) results.push({ name: check.name, status: 'skipped', details: ['Fix structural failures first.'] });
+  }
+  if (task.mode === 'automatic' && !config.checks.length) results.push({ name: 'project-checks', status: 'not-configured', details: ['No test or build command is configured. Edits have not been verified.'] });
+  task.evidence = { base: task.base, digest: taskChanges(task).digest, changedLines: change.lines, results, checkedAt: new Date().toISOString() };
+  saveTask(repo, task); event(repo, 'checked', { taskId: task.id, passed: results.every((row) => row.status === 'passed') });
+  return task.evidence;
+}
+export function evidenceCurrent(task) {
+  if (!task.evidence || task.evidence.base !== task.base || !task.evidence.results.every((row) => row.status === 'passed')) return false;
+  return taskChanges(task).digest === task.evidence.digest;
+}

package/lib/conductor.mjs

@@ -0,0 +1,337 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { atomic, mkdir, noSymlinks, readJson, refuse, exactKeys } from './util.mjs';
+import { lock, readTask, saveTask, tasks, taskDir } from './state.mjs';
+import { processIdentity, recoverProcess } from './process.mjs';
+import { personalDirectory } from './usage.mjs';
+import { ProjectController, registeredProjects } from './projects.mjs';
+import { pendingRequests, saveRequest, updateRequest, removeRequest, joinRequests } from './workspace.mjs';
+import { isPeerRun } from './runner.mjs';
+import { checkFolders, checkMode, checkPlace } from './modes.mjs';
+import { peerFile } from './peer/paths.mjs';
+import { peerSettings } from './peer/settings.mjs';
+import { sanitize } from './peer/peerdata.mjs';
+import { refreshAwake } from './awake.mjs';
+import { pendingApprovals } from './approvals.mjs';
+import { BOT_NAME, chatBots, needBot } from './bots.mjs';
+import { checkModel } from './models.mjs';
+
+// The conductor is one background process per user. It owns every agent run, so work
+// continues after a terminal closes. Terminals talk to it only through files in the
+// personal directory: queued requests, stop commands, and the status it publishes.
+
+export const DEFAULT_SETTINGS = Object.freeze({ maxAgents: 4, stallMinutes: 8, retries: 1 });
+const PROJECT_LIMIT = 4;
+const folder = () => path.join(personalDirectory(), 'conductor');
+const commandFolder = () => path.join(folder(), 'commands');
+const statusFile = () => path.join(folder(), 'state.json');
+const lockFile = () => path.join(personalDirectory(), 'conductor.lock');
+const key = (root, id) => `${root}\0${id}`;
+
+export function conductorSettings() {
+  let value = {};
+  try { const file = path.join(folder(), 'settings.json'); noSymlinks(file); if (fs.existsSync(file)) value = readJson(file); } catch { /* Defaults apply. */ }
+  const pick = (name, min, max) => Number.isInteger(value?.[name]) && value[name] >= min && value[name] <= max ? value[name] : DEFAULT_SETTINGS[name];
+  return { maxAgents: pick('maxAgents', 1, 16), stallMinutes: pick('stallMinutes', 1, 120), retries: pick('retries', 0, 5) };
+}
+export function saveConductorSettings(update) {
+  const next = { ...conductorSettings(), ...update };
+  if (!Number.isInteger(next.maxAgents) || next.maxAgents < 1 || next.maxAgents > 16) refuse('Choose 1 to 16 sessions at once.');
+  mkdir(folder()); atomic(path.join(folder(), 'settings.json'), next); return conductorSettings();
+}
+// Views read this on every redraw, so it never starts a process. A conductor counts
+// as running only while its heartbeat is fresh.
+export function conductorStatus(now = Date.now()) {
+  let value = null;
+  try { const file = statusFile(); noSymlinks(file); if (fs.existsSync(file)) value = readJson(file); } catch { value = null; }
+  const running = Boolean(value?.pid && !value.stopped && Date.parse(value.heartbeatAt) > now - 15000 && alive(value.pid));
+  return { running, pid: running ? value.pid : null, runs: running ? value.runs ?? [] : [], settings: conductorSettings(), error: running ? value.error ?? null : null };
+}
+// A signal-0 check costs no process start, so a conductor killed outright reads as off at once.
+function alive(pid) { try { process.kill(pid, 0); return true; } catch (error) { return error.code === 'EPERM'; } }
+export function conductorAlive() {
+  try {
+    const file = lockFile(); noSymlinks(file); if (!fs.existsSync(file)) return false;
+    const record = readJson(file); return Boolean(record.identity) && processIdentity(record.pid) === record.identity;
+  } catch { return false; }
+}
+// Starts the background conductor unless one is already running.
+export function startConductor() {
+  if (conductorAlive()) return false;
+  mkdir(folder());
+  const log = path.join(folder(), 'conductor.log'); noSymlinks(log);
+  if (fs.existsSync(log) && fs.statSync(log).size > 1024 * 1024) fs.truncateSync(log, 0);
+  const out = fs.openSync(log, 'a', 0o600);
+  try {
+    const bin = fileURLToPath(new URL('../bin/elu-code.mjs', import.meta.url));
+    spawn(process.execPath, [bin, 'conductor', '--daemon'], { cwd: os.homedir(), env: process.env, detached: true, stdio: ['ignore', out, out] }).unref();
+  } finally { fs.closeSync(out); }
+  return true;
+}
+export function sendCommand(command) {
+  if (!['stop', 'shutdown'].includes(command?.type)) refuse('Unknown conductor command.');
+  if (command.type === 'stop' && (typeof command.root !== 'string' || !/^[1-9][0-9]*$/.test(String(command.taskId)))) refuse('Choose a running task to stop.');
+  mkdir(commandFolder());
+  atomic(path.join(commandFolder(), `${Date.now()}-${crypto.randomUUID()}.json`), { ...command, taskId: command.taskId == null ? undefined : String(command.taskId), at: new Date().toISOString() });
+}
+// The peer daemon passes what another machine sent, so every field is checked here.
+const ID = /^[A-Za-z0-9_-]{1,128}$/;
+export function peerOrigin(value) {
+  exactKeys(value, ['kind', 'peer', 'name', 'a2aTaskId', 'threadId', 'hop', 'bot'], 'Request origin');
+  if (!['ask', 'review', 'handoff', 'answer'].includes(value.kind)) refuse('Unknown peer request kind.');
+  if (typeof value.peer !== 'string' || !/^[0-9a-f]{64}$/.test(value.peer)) refuse('A peer request needs the sender key.');
+  if (typeof value.name !== 'string' || !value.name.trim() || value.name.length > 64 || sanitize(value.name, 64) !== value.name || /[\n\t"<>]/.test(value.name)) refuse('A peer request needs a plain sender name.');
+  for (const field of ['a2aTaskId', 'threadId']) if (value[field] != null && (typeof value[field] !== 'string' || !ID.test(value[field]))) refuse('A peer request has an invalid task or thread ID.');
+  if (!Number.isInteger(value.hop) || value.hop < 0 || value.hop > 16) refuse('A peer request has an invalid hop count.');
+  // bot: the owner's shared bot the teammate wrote to. It answers and never edits, so a handoff names none.
+  if (value.bot != null && (typeof value.bot !== 'string' || !BOT_NAME.test(value.bot) || value.kind === 'handoff')) refuse('A peer request names an invalid bot.');
+  return { kind: value.kind, peer: value.peer, name: value.name, a2aTaskId: value.a2aTaskId ?? null, threadId: value.threadId ?? null, hop: value.hop, ...(value.bot != null ? { bot: value.bot } : {}) };
+}
+// Lower priority numbers start first: Chat messages use 0, queued goals 1. A waiting
+// request starts only after the owner accepts it (retryRequest). permissions, place and
+// folders are the owner's session choices; a teammate's question never has them.
+// bots: the bots in the session's chat. bot: the bot this message is written to, which
+// answers it instead of the lead. Both name saved bots, and neither goes with a teammate's request.
+// model: the model a new session runs on, { vendor, model }; without one it starts with the project's default.
+// scheduled: the bot's own schedule wrote this message to it, in a session it is already in.
+// botChat: the message starts the bot's own chat, the session its later messages in Chats continue.
+// approved: the owner approved the session's Task; its work starts with no second planning turn.
+export function enqueue(root, goal, { id, continuationTaskId = null, priority = 0, state = 'queued', origin, readOnly, context, scheduleId, permissions, place, folders, bots, bot, model, scheduled, botChat, approved } = {}) {
+  if (!['queued', 'waiting'].includes(state)) refuse('A new request is queued or waiting.');
+  if (readOnly !== undefined && typeof readOnly !== 'boolean') refuse('readOnly must be true or false.');
+  const peer = origin == null ? null : peerOrigin(origin);
+  if (!peer && context != null) refuse('Peer data needs a request origin.');
+  if (scheduleId !== undefined && (typeof scheduleId !== 'string' || !/^schedule-[a-f0-9]{8}$/.test(scheduleId))) refuse('Invalid schedule ID.');
+  const session = {};
+  if (permissions !== undefined) session.permissions = checkMode(permissions);
+  if (place !== undefined) session.place = checkPlace(place, { mode: session.permissions });
+  if (folders !== undefined) { const dirs = checkFolders(folders); if (dirs.length) session.folders = dirs; }
+  if (model != null) session.model = checkModel(model);
+  if (scheduled !== undefined && scheduled !== true || botChat !== undefined && botChat !== true) refuse('scheduled and botChat are true or left out.');
+  if (scheduled && (bot == null || continuationTaskId == null)) refuse("A bot's scheduled turn names the bot and its session.");
+  if (botChat && (bot == null || continuationTaskId != null)) refuse("A bot's own chat starts with a message to that bot.");
+  if (approved !== undefined && approved !== true || approved && (continuationTaskId == null || origin != null || scheduled || scheduleId || readOnly)) refuse('Only the owner approves a Task, in its own session.');
+  const chat = { ...(bots !== undefined ? { bots: chatBots(bots) } : {}), ...(bot != null ? { bot: needBot(bot).name } : {}), ...(scheduled ? { scheduled: true } : {}), ...(botChat ? { botChat: true } : {}), ...(approved ? { approved: true } : {}) };
+  if (peer && Object.keys(chat).length) refuse("Bots join your own sessions, not a teammate's question.");
+  let fields = { ...(readOnly ? { readOnly: true } : {}), ...(scheduleId ? { scheduleId } : {}), ...session, ...chat };
+  if (peer) {
+    const limit = peer.kind === 'review' ? 160000 : 16000;
+    if (typeof context !== 'string' || !context.trim() || context.length > limit) refuse(`Peer data must be 1 to ${limit} characters.`);
+    if (isPeerRun(peer) && readOnly !== true) refuse('Asks and reviews from a teammate must be read-only.');
+    if (isPeerRun(peer) && Object.keys(session).length) refuse('Teammate questions stay read-only.');
+    // A handoff edits the owner's project, so only the owner can start it: it waits until
+    // the owner accepts it, or is queued when the owner already chose a mode.
+    if (peer.kind === 'handoff') { readOnly = false; if (!session.permissions) state = 'waiting'; }
+    fields = { origin: peer, readOnly: readOnly === true, context, ...session };
+  }
+  const reason = state === 'waiting' ? peer ? `${peer.kind} from @${peer.name}` : 'Ready to review and start.' : 'Waiting to start.';
+  return saveRequest(root, goal, id, { state, priority, continuationTaskId: continuationTaskId == null ? null : String(continuationTaskId), taskId: null, attempts: 0, notBefore: null, queuedAt: new Date().toISOString(), reason, ...fields });
+}
+// The peer daemon reads these and answers the teammate. The request ID becomes a file name.
+function writeOutbox(root, row, { taskId = null, outcome, text = null, costUsd = null, error = null, finishedAt = new Date().toISOString() }) {
+  if (!/^request-[a-f0-9-]+$/.test(row.id)) refuse('Invalid request ID.');
+  atomic(peerFile('outbox', `${row.id}.json`), { requestId: row.id, root, origin: row.origin, taskId, outcome, text, costUsd, finishedAt, error });
+}
+export function retryRequest(root, id) {
+  return updateRequest(root, id, { state: 'queued', attempts: 0, notBefore: null, queuedAt: new Date().toISOString(), reason: 'Waiting to start.' }, { from: ['blocked', 'waiting'] });
+}
+
+export class Conductor {
+  constructor({ tickMs = 500, idleMs = 10 * 60000, stallMs, onExit } = {}) {
+    Object.assign(this, { tickMs, idleMs, stallMs, onExit });
+    this.runs = new Map(); this.controllers = new Map(); this.idleSince = Date.now(); this.queued = 0; this.error = null;
+  }
+  start() {
+    this.release = lock({ state: personalDirectory() }, 'conductor');
+    this.startedAt = new Date().toISOString(); mkdir(commandFolder());
+    // Commands written before this conductor held the lock were for an earlier one (a stop
+    // sent while none ran); obeyed now, they would end this conductor and its first run.
+    for (const name of fs.readdirSync(commandFolder())) fs.rmSync(path.join(commandFolder(), name), { force: true });
+    try { this.recover(); } catch (error) { this.error = error.message; }
+    this.timer = setInterval(() => this.tick(), this.tickMs); this.tick();
+    return this;
+  }
+  async stop() {
+    if (this.closed) return; this.closed = true; clearInterval(this.timer);
+    const runs = [...this.runs.values()];
+    for (const run of runs) run.stopped = true;
+    await Promise.all(runs.map(run => run.controller.stop(run.taskId, 'ELU Code stopped its conductor. Retry to continue.').catch(() => {})));
+    await Promise.all(runs.map(run => run.done));
+    try { this.write(true); } catch { /* Status is best effort. */ }
+    refreshAwake({ busy: false });
+    try { this.release?.(); } catch { /* The lock file is already gone. */ }
+  }
+  tick() {
+    if (this.busy || this.closed) return; this.busy = true;
+    try { this.commands(); if (this.closed) return; this.watch(); this.dispatch(); this.error = null; }
+    catch (error) { this.error = error.message; }
+    finally { this.busy = false; }
+    try { this.write(); } catch { /* Status is best effort. */ }
+    // Keeps the computer awake while agents run: at once when work starts or ends, else every 30 s.
+    const busy = this.runs.size > 0 || this.queued > 0;
+    if (!this.closed && (busy !== this.awake || Date.now() - (this.awakeAt ?? 0) > 30000)) { this.awake = busy; this.awakeAt = Date.now(); refreshAwake({ busy }); }
+    if (!this.closed && !this.runs.size && !this.queued && Date.now() - this.idleSince > this.idleMs) this.onExit?.();
+  }
+  commands() {
+    const names = fs.readdirSync(commandFolder()).filter(name => name.endsWith('.json')).sort();
+    for (const name of names) {
+      const file = path.join(commandFolder(), name); let command = null;
+      try { noSymlinks(file); command = readJson(file); } catch { /* A malformed command is dropped. */ }
+      fs.rmSync(file, { force: true });
+      if (command?.type === 'shutdown') { if (this.onExit) this.onExit(); else this.stop(); return; }
+      if (command?.type === 'stop') {
+        const run = this.runs.get(key(command.root, String(command.taskId)));
+        if (run) { run.stopped = true; run.controller.stop(run.taskId).catch(() => {}); }
+      }
+    }
+  }
+  // A run whose agent log has not grown for the stall time is stopped and retried. A run
+  // waiting for the owner's approval is quiet on purpose, so it is not stalled.
+  watch() {
+    const now = Date.now(), limit = this.stallMs ?? conductorSettings().stallMinutes * 60000;
+    for (const run of this.runs.values()) {
+      if (run.stalled || run.stopped) continue;
+      let task; try { task = readTask(run.controller.repo, run.taskId); } catch { continue; }
+      let size = null; try { if (task.activeLog) size = fs.statSync(task.activeLog).size; } catch { /* Not started yet. */ }
+      const mark = `${task.activeLog}:${size}`;
+      let waiting = false; try { waiting = pendingApprovals({ root: run.controller.repo.project ?? run.root, taskId: run.taskId }).length > 0; } catch { /* Unreadable: counted as quiet. */ }
+      if (!task.activeLog || mark !== run.mark || waiting) { run.mark = mark; run.quietSince = now; continue; }
+      if (now - run.quietSince > limit) {
+        run.stalled = true;
+        run.controller.stop(run.taskId, `No progress for ${Math.round(limit / 60000) || 1} minutes. Retrying.`).catch(() => {});
+      }
+    }
+  }
+  dispatch() {
+    const now = Date.now(), { maxAgents } = conductorSettings(), waiting = [];
+    for (const repo of registeredProjects()) {
+      let rows; try { rows = pendingRequests(repo.root); } catch { continue; }
+      for (const row of rows) {
+        if (row.state === 'queued') waiting.push({ repo, row });
+        if (row.state === 'done' && !(Date.parse(row.finishedAt) > now - 120000)) { try { removeRequest(repo.root, row.id); } catch { /* Next tick. */ } }
+      }
+    }
+    this.queued = waiting.length;
+    if (this.runs.size || waiting.length) this.idleSince = now;
+    const ready = waiting.filter(({ row }) => !(Date.parse(row.notBefore) > now))
+      .sort((a, b) => (a.row.priority ?? 1) - (b.row.priority ?? 1) || Date.parse(a.row.queuedAt ?? a.row.createdAt) - Date.parse(b.row.queuedAt ?? b.row.createdAt));
+    const slots = peerSettings().peerSlots, peerRuns = () => [...this.runs.values()].filter(run => isPeerRun(run.origin)).length;
+    for (const { repo, row } of ready) {
+      if (this.runs.size >= maxAgents) break;
+      if (isPeerRun(row.origin) && peerRuns() >= (Number.isInteger(slots) ? slots : 1)) continue;
+      const mine = [...this.runs.values()].filter(run => run.root === repo.root);
+      if (mine.length >= PROJECT_LIMIT) continue;
+      // A follow-up waits until the current turn of the same chat ends.
+      if (row.continuationTaskId && mine.some(run => run.taskId === row.continuationTaskId)) continue;
+      const turn = this.together(repo, row, ready);
+      if (turn) this.launch(repo, turn);
+    }
+  }
+  // What the owner sent to a session while it worked goes as one turn: the waiting messages
+  // that follow this one, to the same recipient and in the order sent, are joined to it. A
+  // message to someone else ends the join, so nothing overtakes it. A bot's scheduled turn,
+  // a teammate's message, a retry and a message that changes the session's choices each
+  // stay a turn of their own. Returns the request to start, or null when it was taken back.
+  together(repo, row, ready) {
+    const typed = value => Boolean(value.continuationTaskId) && !value.origin && !value.scheduled && !value.scheduleId && !value.botChat && !value.attempts && !value.readOnly
+      && ['permissions', 'place', 'folders', 'bots', 'model'].every(name => value[name] === undefined);
+    if (!typed(row)) return row;
+    const after = ready.filter(value => value.repo.root === repo.root && value.row.continuationTaskId === row.continuationTaskId).map(value => value.row);
+    const ids = [row.id];
+    for (const next of after.slice(after.indexOf(row) + 1)) { if (!typed(next) || (next.bot ?? null) !== (row.bot ?? null) || (next.priority ?? 1) !== (row.priority ?? 1)) break; ids.push(next.id); }
+    return ids.length > 1 ? joinRequests(repo.root, ids) : row;
+  }
+  controller(repo) {
+    let controller = this.controllers.get(repo.root);
+    if (!controller) { controller = new ProjectController(repo); this.controllers.set(repo.root, controller); }
+    else controller.reloadConfig();
+    return controller;
+  }
+  launch(repo, row) {
+    if (!updateRequest(repo.root, row.id, { state: 'starting', reason: 'Starting.' }, { from: ['queued'] })) return;
+    let controller, run;
+    try { controller = this.controller(repo); run = controller.ask(row.goal, row.continuationTaskId ?? null, { readOnly: row.readOnly === true, origin: row.origin ?? null, context: row.context ?? null, permissions: row.permissions, place: row.place, folders: row.folders, bots: row.bots, bot: row.bot ?? null, scheduled: row.scheduled === true, botChat: row.botChat === true, timed: Boolean(row.scheduleId), approved: row.approved === true, ...(row.model ? { model: row.model } : {}) }); }
+    catch (error) {
+      const busy = /At most four tasks|already running|holds this lock/.test(error.message);
+      if (busy) updateRequest(repo.root, row.id, { state: 'queued', notBefore: new Date(Date.now() + 5000).toISOString(), reason: 'Waiting for a free slot in this project.' });
+      // A teammate cannot retry a blocked request here, so they are told it failed.
+      else if (row.origin) { try { writeOutbox(repo.root, row, { outcome: 'failed', error: error.message }); } catch (failure) { this.error = failure.message; } updateRequest(repo.root, row.id, { state: 'done', finishedAt: new Date().toISOString(), reason: error.message }); }
+      // Nobody is there to retry a turn a bot's schedule queued: it ends, and the next run comes at its time.
+      else if (row.scheduled) updateRequest(repo.root, row.id, { state: 'done', finishedAt: new Date().toISOString(), reason: error.message });
+      else updateRequest(repo.root, row.id, { state: 'blocked', reason: error.message });
+      return;
+    }
+    let runsBefore = 0; try { runsBefore = readTask(controller.repo, run.id).runs.length; } catch { /* Counted from the start. */ }
+    const record = { root: repo.root, project: path.basename(repo.root), requestId: row.id, taskId: run.id, goal: row.goal, origin: row.origin ?? null, scheduled: row.scheduled === true, runsBefore, attempts: row.attempts ?? 0, controller, startedAt: new Date().toISOString(), quietSince: Date.now(), mark: null };
+    this.runs.set(key(repo.root, run.id), record);
+    updateRequest(repo.root, row.id, { state: 'running', taskId: run.id, startedAt: record.startedAt, reason: 'Working.' });
+    record.done = run.finished.then(task => this.finish(record, null, task), error => this.finish(record, error));
+  }
+  finish(record, error) {
+    this.runs.delete(key(record.root, record.taskId));
+    const finishedAt = new Date().toISOString();
+    const done = () => {
+      if (record.origin) { try { this.outbox(record, error, finishedAt); } catch (failure) { this.error = failure.message; } }
+      return updateRequest(record.root, record.requestId, { state: 'done', taskId: record.taskId, finishedAt, reason: error ? error.message : 'Finished.' });
+    };
+    try {
+      if (!error || record.stopped) return void done();
+      const retries = conductorSettings().retries, cause = error.details?.cause;
+      if ((record.stalled || cause === 'rate-limit') && record.attempts < retries) {
+        const wait = record.stalled ? 2000 : 60000 * 2 ** record.attempts;
+        updateRequest(record.root, record.requestId, { state: 'queued', attempts: record.attempts + 1, continuationTaskId: record.taskId, taskId: null, notBefore: new Date(Date.now() + wait).toISOString(), reason: record.stalled ? 'It stopped making progress. Retrying.' : 'Rate limited. Retrying shortly.' });
+        return;
+      }
+      // A failure after the message was recorded is shown in the task itself.
+      let recorded = null; try { recorded = readTask(record.controller.repo, record.taskId); } catch { /* Never created. */ }
+      if (recorded && (recorded.goal === record.goal || recorded.messages?.some(row => row.text === record.goal)) || record.origin || record.scheduled) return void done();
+      updateRequest(record.root, record.requestId, { state: 'blocked', taskId: null, reason: error.message });
+    } catch (failure) { this.error = failure.message; }
+  }
+  // The reply for a teammate is written before its request is marked done.
+  outbox(record, error, finishedAt) {
+    let task = null; try { task = readTask(record.controller.repo, record.taskId); } catch { /* Never created. */ }
+    const reply = error ? null : task?.kind === 'conversation' ? task.result : task?.reply ?? task?.result;
+    const runs = task?.runs.slice(record.runsBefore) ?? [];
+    const costUsd = runs.length && runs.every(run => Number.isFinite(run.costUsd)) ? runs.reduce((total, run) => total + run.costUsd, 0) : null;
+    const text = reply?.summary ? reply.outcome === 'needs_input' && reply.question ? `${reply.summary}\n\n${reply.question}` : reply.summary : null;
+    writeOutbox(record.root, { id: record.requestId, origin: record.origin }, { taskId: record.taskId, outcome: error ? record.stopped ? 'stopped' : 'failed' : reply?.outcome ?? 'failed', text, costUsd, error: error?.message ?? null, finishedAt });
+  }
+  // Runs left by a conductor that ended without stopping them are marked stopped.
+  // Runs owned by a live terminal are left alone.
+  recover() {
+    for (const repo of registeredProjects()) {
+      let values = []; try { values = tasks(repo); } catch { continue; }
+      for (const task of values.filter(task => ['running', 'preparing'].includes(task.state))) {
+        if (task.owner?.identity && processIdentity(task.owner.pid) === task.owner.identity) continue;
+        let release; try { release = lock(repo, `task-${task.id}`); } catch { continue; }
+        try {
+          const file = path.join(taskDir(repo, task.id), 'process.json'); noSymlinks(file);
+          if (fs.existsSync(file)) recoverProcess(readJson(file));
+          const current = readTask(repo, task.id);
+          // A shadow bot's turn that was cut off leaves the session where the agent left it.
+          const shadowed = current.shadowing?.state ?? null; delete current.shadowing;
+          Object.assign(current, shadowed ? { state: shadowed, activeRole: null, activeLog: null } : { state: 'stopped', activeRole: null, activeLog: null, error: { message: 'ELU Code stopped before this response finished. Retry to continue.' } });
+          saveTask(repo, current);
+        } finally { release(); }
+      }
+      let rows = []; try { rows = pendingRequests(repo.root); } catch { continue; }
+      for (const row of rows.filter(row => ['starting', 'running'].includes(row.state))) {
+        if (row.origin && row.taskId) { try { writeOutbox(repo.root, row, { taskId: row.taskId, outcome: 'failed', error: 'The run was interrupted.' }); } catch (error) { this.error = error.message; } }
+        updateRequest(repo.root, row.id, row.taskId ? { state: 'done', finishedAt: new Date().toISOString() } : { state: 'queued', reason: 'Waiting to start.' });
+      }
+    }
+  }
+  write(stopped = false) {
+    const runs = [...this.runs.values()].map(({ root, project, taskId, requestId, startedAt, attempts, stalled, origin }) => ({ root, project, taskId, requestId, startedAt, attempts, stalled: Boolean(stalled), origin }));
+    const value = { pid: process.pid, startedAt: this.startedAt, stopped, error: this.error, queued: this.queued, runs };
+    const text = JSON.stringify(value);
+    if (!stopped && text === this.written && Date.now() - this.writtenAt < 2000) return;
+    mkdir(folder()); atomic(statusFile(), { ...value, heartbeatAt: new Date().toISOString() });
+    this.written = text; this.writtenAt = Date.now();
+  }
+}

package/lib/config.mjs

@@ -0,0 +1,147 @@
+import { parseYaml } from './yaml.mjs';
+import { exactKeys, isObject, refuse, relativePath } from './util.mjs';
+import { MODEL_NAME, VENDORS } from './vendors.mjs';
+
+// What no run does, whatever a project's config says. One thing opens, and not from a config
+// file: a bot its owner switched on to merge pull requests may run gh pr merge in its own
+// working turn. Nothing else in the list opens for anyone.
+export const NEVER = Object.freeze(['push', 'force-push', 'tag', 'merge', 'deploy', 'publish']);
+// roles.lead is the model that does the work. Reviews are done by the session's bots, so a
+// new config names no reviewer.
+export function defaultConfig() {
+  return {
+    version: 1,
+    roles: {
+      lead: { vendor: 'claude', access: 'edit', network: 'off', commands: [], writablePaths: ['.'], timeoutSeconds: 900, maxCostUsd: null },
+    },
+    never: [...NEVER],
+    checks: [{ name: 'tests', command: ['npm', 'test'] }, { name: 'build', command: ['npm', 'run', 'build'] }],
+    limits: { changedLines: 400, reviewRounds: 2 },
+    paths: ['.'],
+  };
+}
+function strings(value, label) {
+  if (!Array.isArray(value) || value.some((x) => typeof x !== 'string') || new Set(value).size !== value.length) refuse(`${label} must be a list of distinct strings.`);
+}
+function integer(value, min, max, label) {
+  if (!Number.isInteger(value) || value < min || value > max) refuse(`${label} must be an integer from ${min} to ${max}.`);
+}
+export function validateConfig(value) {
+  exactKeys(value, ['version', 'roles', 'never', 'checks', 'limits', 'paths', 'sandboxHelper', 'mcp', 'mcpOff'], 'Config');
+  // mcpOff: Claude Code MCP servers turned off for this project's lead. mcp is the old opt-in
+  // list, still read so older settings load; every server is now on unless turned off.
+  for (const key of ['mcp', 'mcpOff']) if (value[key] !== undefined) { strings(value[key], key); if (value[key].length > 20 || value[key].some(name => !/^[A-Za-z0-9_.-]{1,64}$/.test(name))) refuse(`${key} lists up to 20 MCP server names.`); }
+  // The key is still read so an older file that holds null loads. A path is refused: this file
+  // comes with the repository, and the helper is started outside the sandbox.
+  if (value.sandboxHelper !== undefined && value.sandboxHelper !== null) refuse('A project file cannot name the sandbox helper. Remove sandboxHelper from .elu-code/config.yaml and set ELU_CODE_SANDBOX_HELPER instead.');
+  if (value.version !== 1) refuse('Config version must be 1.');
+  // An entry other than lead (reviewer, security and so on) is from before bots did the
+  // reviews. It is still checked so an older config loads as it always did; nothing runs it.
+  if (!isObject(value.roles) || Object.keys(value.roles).length > 8 || Object.keys(value.roles).some(name => !/^[a-z][a-z0-9-]{0,29}$/.test(name) || ['constructor', 'prototype'].includes(name))) refuse('The config holds up to eight model entries with plain names.');
+  for (const [name, role] of Object.entries(value.roles)) {
+    // The owner reads "the model" for the entry that does the work; the others go by their name.
+    const who = name === 'lead' ? 'The model' : name, own = name === 'lead' ? "The model's" : name;
+    exactKeys(role, ['vendor', 'access', 'network', 'commands', 'writablePaths', 'timeoutSeconds', 'maxCostUsd', 'model'], `${own} policy`);
+    if (![...VENDORS, ...(name === 'reviewer' ? ['auto', 'none'] : [])].includes(role.vendor)) refuse(`${who} has an unsupported vendor.`);
+    // model: optional, for vendors whose CLI takes one (CAPS.model); the policy check says whether this vendor does.
+    if (role.model !== undefined && (typeof role.model !== 'string' || !MODEL_NAME.test(role.model))) refuse(`${name === 'lead' ? 'The model' : `The ${name} model`} must be a plain model name.`);
+    if (!['read', 'edit'].includes(role.access) || !['off', 'on'].includes(role.network)) refuse(`${who} has invalid access or network rules.`);
+    if (name !== 'lead' && role.access !== 'read') refuse(`${name} must be read-only. Only the model edits.`);
+    strings(role.commands, `${own} commands`); strings(role.writablePaths, `${own} writablePaths`);
+    for (const file of role.writablePaths) relativePath(file);
+    if (role.access === 'read' && role.writablePaths.length) refuse(`${who} is read-only, so it cannot have writable paths.`);
+    integer(role.timeoutSeconds, 1, 3600, `${own} timeoutSeconds`);
+    if (role.maxCostUsd !== null && (typeof role.maxCostUsd !== 'number' || !Number.isFinite(role.maxCostUsd) || role.maxCostUsd <= 0 || role.maxCostUsd > 100)) refuse(`${own} maxCostUsd must be null or from 0 to 100, excluding 0.`);
+  }
+  if (!value.roles.lead) refuse('The config names no model to do the work.');
+  strings(value.never, 'never');
+  if (value.never.length !== NEVER.length || NEVER.some((x) => !value.never.includes(x))) refuse('The fixed never list cannot be weakened or extended.');
+  strings(value.paths, 'paths'); if (!value.paths.length) refuse('Declare at least one allowed path.');
+  for (const p of value.paths) relativePath(p);
+  exactKeys(value.limits, ['changedLines', 'reviewRounds'], 'Limits');
+  integer(value.limits.changedLines, 1, 10000, 'changedLines'); integer(value.limits.reviewRounds, 1, 2, 'reviewRounds');
+  if (!Array.isArray(value.checks) || value.checks.length > 20) refuse('Declare from 0 to 20 checks.');
+  const names = new Set();
+  for (const check of value.checks) {
+    exactKeys(check, ['name', 'command'], 'Check');
+    if (typeof check.name !== 'string' || !/^[a-z][a-z0-9-]{0,39}$/.test(check.name) || names.has(check.name)) refuse('Check names must be distinct plain words.');
+    names.add(check.name);
+    if (!Array.isArray(check.command) || !check.command.length || check.command.some((x) => typeof x !== 'string' || !x || /[\x00-\x1f]/.test(x))) refuse(`Check ${check.name} needs an argument list.`);
+    if (check.command[0].startsWith('-') || check.command[0].includes('/')) refuse('Check programs must be found on PATH.');
+  }
+  return value;
+}
+export function parseConfig(text) { return validateConfig(parseYaml(text)); }
+
+const ASK = { type: 'object', additionalProperties: false, properties: { to: { type: 'string', minLength: 1, maxLength: 64 }, project: { type: 'string', maxLength: 64 }, question: { type: 'string', minLength: 1, maxLength: 2000 } }, required: ['to', 'project', 'question'] };
+// asks is offered only when teammates exist. It is listed as required so strict
+// structured-output modes accept the schema; an empty list means no drafts.
+export function resultSchema({ asks = false } = {}) {
+  const schema = {
+    type: 'object', additionalProperties: false,
+    properties: {
+      outcome: { type: 'string', enum: ['done', 'needs_input', 'blocked'] }, summary: { type: 'string', minLength: 1, maxLength: 4000 },
+      question: { type: ['string', 'null'], maxLength: 2000 }, choices: { type: 'array', items: { type: 'string' }, maxItems: 8 },
+      comments: { type: 'array', maxItems: 30, items: { type: 'object', additionalProperties: false, properties: { id: { type: 'string' }, severity: { type: 'string', enum: ['must_fix', 'suggestion'] }, body: { type: 'string' } }, required: ['id', 'severity', 'body'] } },
+      responses: { type: 'array', maxItems: 30, items: { type: 'object', additionalProperties: false, properties: { id: { type: 'string' }, action: { type: 'string', enum: ['fixed', 'disputed'] }, reason: { type: 'string' } }, required: ['id', 'action', 'reason'] } },
+    }, required: ['outcome', 'summary', 'question', 'choices', 'comments', 'responses'],
+  };
+  if (asks) { schema.properties.asks = { type: 'array', maxItems: 3, items: ASK }; schema.required.push('asks'); }
+  return schema;
+}
+// schedule: offered to a bot that has a schedule when the owner writes to it, so the owner
+// can tell it in plain words to stop or start running by itself in this session.
+const SCHEDULE_WORDS = Object.freeze(['keep', 'off', 'on']);
+// name: offered while the session has no name, so the first reply names it.
+export function conversationSchema({ intents = ['answer', 'edit'], asks = false, schedule = false, name = false } = {}) {
+  const schema = resultSchema({ asks });
+  if (name) { schema.properties.name = { type: 'string' }; schema.required.push('name'); }
+  schema.properties.intent = { type: 'string', enum: intents };
+  schema.required.push('intent');
+  // The project may hold no code: the lead names the repository it would change.
+  if (intents.includes('edit')) { schema.properties.repository = { type: 'string', maxLength: 1000 }; schema.required.push('repository'); }
+  if (schedule) { schema.properties.schedule = { type: 'string', enum: [...SCHEDULE_WORDS] }; schema.required.push('schedule'); }
+  return schema;
+}
+// Peer runs offer only answer, but an edit intent is still parsed so the runner can turn it into an answer.
+// who: what replied, as the owner reads it; a bot is @name.
+export function validateConversation(value, { asks = false, who = 'The model', schedule = false } = {}) {
+  exactKeys(value, ['outcome', 'summary', 'question', 'choices', 'comments', 'responses', 'intent', 'repository', 'name', ...(asks ? ['asks'] : []), ...(schedule ? ['schedule'] : [])], 'Conversation result');
+  if (!['answer', 'edit'].includes(value.intent)) refuse(`${who} returned an invalid conversation intent.`);
+  if (value.repository !== undefined && (typeof value.repository !== 'string' || value.repository.length > 1000 || /[\x00-\x1f\x7f]/.test(value.repository))) refuse(`${who} returned an invalid repository.`);
+  // A reply that leaves schedule out, or says anything but off or on, changes nothing.
+  // A name is passed on as it came and never fails a reply: whoever saves it checks it.
+  const { intent, repository, schedule: word, name, ...result } = value; return { ...validateResult(result, { asks }), intent, ...(repository?.trim() ? { repository: repository.trim() } : {}), ...(schedule && ['off', 'on'].includes(word) ? { schedule: word } : {}), ...(typeof name === 'string' ? { name } : {}) };
+}
+function validateAsks(value) {
+  if (!Array.isArray(value) || value.length > 3) refuse('Draft at most three asks.');
+  for (const row of value) {
+    exactKeys(row, ['to', 'project', 'question'], 'Draft ask');
+    if (typeof row.to !== 'string' || !row.to.trim() || row.to.length > 64 || /[\x00-\x1f\x7f]/.test(row.to)) refuse('A draft ask needs a teammate name.');
+    if (typeof row.project !== 'string' || row.project.length > 64 || /[\x00-\x1f\x7f]/.test(row.project)) refuse('A draft ask has an invalid project.');
+    if (typeof row.question !== 'string' || !row.question.trim() || row.question.length > 2000) refuse('A draft ask needs a question of 1 to 2000 characters.');
+  }
+}
+export function validateResult(value, { asks = false } = {}) {
+  exactKeys(value, ['outcome', 'summary', 'question', 'choices', 'comments', 'responses', ...(asks ? ['asks'] : [])], 'Run result');
+  if (value.asks !== undefined) validateAsks(value.asks);
+  if (!['done', 'needs_input', 'blocked'].includes(value.outcome) || typeof value.summary !== 'string' || !value.summary.trim() || value.summary.length > 4000) refuse('The run returned an invalid outcome or summary.');
+  if (!(value.question === null || (typeof value.question === 'string' && value.question.length <= 2000))) refuse('The run returned an invalid question.');
+  strings(value.choices, 'Result choices'); if (value.choices.length > 8) refuse('Too many choices.');
+  // A needs_input result may leave question empty. After a blocked step a model names what it
+  // needs in the summary, and whatever shows a result falls back to the summary.
+  for (const field of ['comments', 'responses']) {
+    if (!Array.isArray(value[field]) || value[field].length > 30) refuse(`Invalid ${field}.`);
+    const ids = new Set();
+    for (const row of value[field]) {
+      if (!isObject(row)) refuse(`Invalid ${field} entry.`);
+      exactKeys(row, field === 'comments' ? ['id', 'severity', 'body'] : ['id', 'action', 'reason'], field);
+      if (typeof row.id !== 'string' || !/^[a-zA-Z0-9_-]{1,40}$/.test(row.id) || ids.has(row.id)) refuse('Review IDs must be distinct plain words.');
+      ids.add(row.id);
+      const text = field === 'comments' ? row.body : row.reason;
+      if (typeof text !== 'string' || !text.trim() || text.length > 4000) refuse('Review text is missing or too long.');
+      if (field === 'comments' ? !['must_fix', 'suggestion'].includes(row.severity) : !['fixed', 'disputed'].includes(row.action)) refuse('Invalid review decision.');
+    }
+  }
+  return value;
+}