@enderfga/claw-orchestrator 7.11.0 → 7.12.1

package/dist/src/session-manager.js

@@ -115,7 +115,7 @@ import { detectRepoLang } from './kernel/repo.js';
 import { RunKernel, runDir as kernelRunDir } from './kernel/engine.js';
 import { registerDefaultExecutors } from './kernel/nodes/index.js';
 import { autoloopStateFromRecord, makeAutoloopExecutor } from './kernel/nodes/autoloop.js';
-import { loadRun, readNodeOutput } from './kernel/store.js';
+import { isValidRunId, loadRun, readNodeOutput } from './kernel/store.js';
 import { LEGACY_NODE, joinFindings, toCouncilSession, toFanoutSession, toUltraplanResult, toUltrareviewResult, } from './kernel/projections.js';
 import { legacyCouncilWorkflow, legacyFanoutWorkflow, legacyUltraplanWorkflow, splitAgentSecrets, } from './kernel/templates/index.js';
 import { normalizeContract } from './verify/contract.js';
@@ -143,7 +143,7 @@ import { isAgyConversationId } from './agy-conversation.js';
 import { Council } from './council.js';
 import { AutoloopRunner } from './autoloop/runner.js';
 import { ClaudeAgentDispatcher } from './autoloop/dispatcher.js';
-import { DEFAULT_PUSH_POLICY, DEFAULT_SEND_TIMEOUT_MS, validateAutoloopTimeoutConfig } from './autoloop/types.js';
+import { DEFAULT_PUSH_POLICY, DEFAULT_SEND_TIMEOUT_MS, MAX_METRIC_HISTORY, validateAutoloopTimeoutConfig, } from './autoloop/types.js';
 import { Msg as AutoloopMsg } from './autoloop/messages.js';
 import { appendPushLog, notifyUserFallbackChain } from './autoloop/notify.js';
 import { UltraappManager } from './ultraapp/manager.js';
@@ -454,6 +454,165 @@ function porcelainHasDisallowedAutoloopDirt(workspace, porcelain, prefix) {
     }
     return false;
 }
+/** Fixed generic refusal — no runId, path, file bytes, or git stderr. */
+const AUTOLOOP_LEDGER_ISOLATION_ERROR = 'Autoloop could not isolate the run ledger from Git';
+function refuseAutoloopLedgerIsolation() {
+    throw new Error(AUTOLOOP_LEDGER_ISOLATION_ERROR);
+}
+/** Ensure absPath is a real directory (not a symlink); mkdir non-recursively if missing. */
+function ensureRealAutoloopDir(absPath) {
+    if (!fs.existsSync(absPath))
+        fs.mkdirSync(absPath);
+    let st;
+    try {
+        st = fs.lstatSync(absPath);
+    }
+    catch {
+        refuseAutoloopLedgerIsolation();
+    }
+    if (!st.isDirectory() || st.isSymbolicLink())
+        refuseAutoloopLedgerIsolation();
+}
+/**
+ * After dirty refusal: create `tasks/<runId>/.gitignore` (`*`) and prove via
+ * check-ignore. Never deletes ledger state. Invalid runIds skip (kernel rejects).
+ */
+function ensureAutoloopRunLedgerIgnored(workspace, runId) {
+    if (!isValidRunId(runId))
+        return;
+    const relLedger = path.posix.join('tasks', runId);
+    const gitEnv = { ...process.env, LC_ALL: 'C' };
+    let tracked;
+    try {
+        tracked = execFileSync('git', ['-C', workspace, '--literal-pathspecs', 'ls-files', '-z', '--', relLedger], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: gitEnv,
+        });
+    }
+    catch {
+        refuseAutoloopLedgerIsolation();
+    }
+    if (tracked.length > 0)
+        refuseAutoloopLedgerIsolation();
+    const tasksAbs = path.join(workspace, 'tasks');
+    const ledgerAbs = path.join(tasksAbs, runId);
+    try {
+        ensureRealAutoloopDir(tasksAbs);
+        ensureRealAutoloopDir(ledgerAbs);
+        if (fs.realpathSync(ledgerAbs) !== path.join(fs.realpathSync(workspace), 'tasks', runId)) {
+            refuseAutoloopLedgerIsolation();
+        }
+    }
+    catch (err) {
+        if (err instanceof Error && err.message === AUTOLOOP_LEDGER_ISOLATION_ERROR)
+            throw err;
+        refuseAutoloopLedgerIsolation();
+    }
+    const ignoreAbs = path.join(ledgerAbs, '.gitignore');
+    try {
+        const fd = fs.openSync(ignoreAbs, 'wx');
+        try {
+            fs.writeFileSync(fd, '*\n');
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch (err) {
+        if (err.code !== 'EEXIST')
+            refuseAutoloopLedgerIsolation();
+        try {
+            const st = fs.lstatSync(ignoreAbs);
+            if (!st.isFile() || st.isSymbolicLink())
+                refuseAutoloopLedgerIsolation();
+            const bytes = fs.readFileSync(ignoreAbs, 'utf8');
+            if (bytes !== '*' && bytes !== '*\n' && bytes !== '*\r\n')
+                refuseAutoloopLedgerIsolation();
+        }
+        catch (inner) {
+            if (inner instanceof Error && inner.message === AUTOLOOP_LEDGER_ISOLATION_ERROR)
+                throw inner;
+            refuseAutoloopLedgerIsolation();
+        }
+    }
+    // check-ignore rejects --literal-pathspecs; valid runIds have no pathspec magic.
+    for (const probe of [
+        `${relLedger}/.gitignore`,
+        `${relLedger}/chat.jsonl`,
+        `${relLedger}/decisions.jsonl`,
+        `${relLedger}/iter/0/verdict.json`,
+        `${relLedger}/reviewer_sandbox/prior_verdict.json`,
+    ]) {
+        try {
+            execFileSync('git', ['-C', workspace, 'check-ignore', '-q', '--', probe], {
+                stdio: ['ignore', 'pipe', 'pipe'],
+                env: gitEnv,
+            });
+        }
+        catch {
+            refuseAutoloopLedgerIsolation();
+        }
+    }
+}
+/**
+ * Fresh-start workspace boundary shared by `autoloopStart` and a fresh workflow
+ * `autoloop` boot: refuse a dirty Git worktree, then isolate the run ledger.
+ * `invalidRunId: 'defer'` skips isolation for invalid ids (direct start — the
+ * kernel rejects them). `'refuse'` fails closed with the fixed isolation error
+ * (fresh workflow path — config.runId is not the kernel run id).
+ */
+function applyAutoloopFreshStartBoundary(workspace, runId, opts) {
+    // Refuse a dirty git worktree before the run directory or Planner exists.
+    // --porcelain=v1 -z keeps paths literal (spaces/quotes). --untracked-files=all
+    // overrides status.showUntrackedFiles=no, while --ignore-submodules=none
+    // prevents repository config from hiding submodule dirt; do not pass
+    // --ignored. Only the deterministic not-a-git-repository error allows the
+    // start; every other status failure rejects. Do not raise maxBuffer:
+    // ENOBUFS or already-nonempty stdout means dirt. Untracked (??) or
+    // index-clean worktree mods
+    // (` M`) under tasks/<id>/ are ignored only when tasks/<id>/goal.json is a
+    // regular file — every other status (staged/rename/copy/delete/conflict/
+    // malformed) rejects.
+    // Nested workspaces: status paths are repo-root-relative; strip a verified
+    // `rev-parse --show-prefix` before the ledger check; paths outside the
+    // workspace still refuse.
+    const dirtyStartError = new Error('Autoloop workspace has uncommitted changes; commit or stash them before starting');
+    let porcelain = '';
+    let inGitRepository = false;
+    try {
+        porcelain = execFileSync('git', ['-C', workspace, 'status', '--porcelain=v1', '-z', '--untracked-files=all', '--ignore-submodules=none'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: { ...process.env, LC_ALL: 'C' },
+        });
+        inGitRepository = true;
+    }
+    catch (err) {
+        const e = err;
+        const partial = typeof e.stdout === 'string' ? e.stdout : Buffer.isBuffer(e.stdout) ? e.stdout.toString('utf8') : '';
+        if (e.code === 'ENOBUFS' || partial.trim() !== '' || !isNotGitRepositoryError(err)) {
+            throw dirtyStartError;
+        }
+        porcelain = '';
+    }
+    if (porcelain.length > 0) {
+        const prefix = readVerifiedGitShowPrefix(workspace);
+        if (prefix === null || porcelainHasDisallowedAutoloopDirt(workspace, porcelain, prefix)) {
+            throw dirtyStartError;
+        }
+    }
+    // Run-local ledger isolation: tasks/<runId>/.gitignore (*) + check-ignore proof.
+    // Git workspaces only; skips invalid ids so kernel.start rejects them unchanged.
+    if (inGitRepository) {
+        if (!isValidRunId(runId)) {
+            if (opts.invalidRunId === 'refuse')
+                refuseAutoloopLedgerIsolation();
+            return;
+        }
+        ensureAutoloopRunLedgerIgnored(workspace, runId);
+    }
+}
 /**
  * The tool calls a turn's `result` event says the engine refused, normalized.
  *
@@ -487,6 +646,128 @@ function readPermissionDenials(evt) {
     }
     return out;
 }
+/** Fixed refusal when a non-fresh boot cannot trust the closed-ledger prefix. */
+const AUTOLOOP_CLOSED_LEDGER_REFUSAL = 'Autoloop resume refused: ledger closed-prefix is incomplete or malformed';
+const REVIEWER_DECISIONS = new Set(['advance', 'hold', 'rollback']);
+/**
+ * One-reader closed-ledger restore for non-fresh `_bootAutoloop`.
+ *
+ * Derives typed `iter` / `metric_history` from the contiguous valid closed
+ * prefix starting at 0. Checkpoint bytes are never progress authority.
+ * Returns null when there is no valid prefix (legacy lone verdict, empty).
+ * Throws {@link AUTOLOOP_CLOSED_LEDGER_REFUSAL} on gap / malformed tail.
+ */
+/** Canonical numeric iter directory names — no leading zeros. */
+const CLOSED_LEDGER_ITER_DIR = /^(0|[1-9][0-9]*)$/;
+function readClosedLedgerRestore(ledgerDir) {
+    const iterRoot = path.join(ledgerDir, 'iter');
+    if (!fs.existsSync(iterRoot))
+        return null;
+    let numericDirs;
+    try {
+        numericDirs = fs
+            .readdirSync(iterRoot)
+            .filter((name) => CLOSED_LEDGER_ITER_DIR.test(name))
+            .map((name) => Number(name))
+            .sort((a, b) => a - b);
+    }
+    catch {
+        return null;
+    }
+    if (numericDirs.length === 0)
+        return null;
+    const present = new Set(numericDirs);
+    const metrics = [];
+    let i = 0;
+    for (;;) {
+        const iterDir = path.join(iterRoot, String(i));
+        if (!fs.existsSync(iterDir)) {
+            // K=-1 / no valid closed prefix: never refuse on higher dirs (base Planner-only).
+            if (i === 0)
+                return null;
+            for (const j of present) {
+                if (j > i)
+                    throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+            }
+            break;
+        }
+        const directivePath = path.join(iterDir, 'directive.json');
+        const verdictPath = path.join(iterDir, 'verdict.json');
+        const hasDirective = fs.existsSync(directivePath);
+        const hasVerdict = fs.existsSync(verdictPath);
+        if (!hasDirective) {
+            if (hasVerdict) {
+                // Legacy lone verdict (or directive-less "closed" appearance).
+                if (i === 0)
+                    return null;
+                throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+            }
+            // Empty/non-closed at 0: prefixless compat before any gap check.
+            if (i === 0)
+                return null;
+            for (const j of present) {
+                if (j > i)
+                    throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+            }
+            break;
+        }
+        if (!hasVerdict) {
+            // Open / directive-only / committed-without-review tail at i.
+            // No closed prefix yet: return null before gap checks (open0+lateriter1 compat).
+            if (i === 0)
+                return null;
+            for (const j of present) {
+                if (j > i)
+                    throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+            }
+            const history = metrics.length > MAX_METRIC_HISTORY ? metrics.slice(metrics.length - MAX_METRIC_HISTORY) : metrics.slice();
+            return { iter: i, metric_history: history };
+        }
+        let raw;
+        try {
+            raw = fs.readFileSync(verdictPath, 'utf8');
+        }
+        catch {
+            // Prefixless unreadable verdict at 0: no-restore / no-refusal (base compat).
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        const verdict = parsed;
+        if (verdict.iter !== i) {
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        if (typeof verdict.decision !== 'string' || !REVIEWER_DECISIONS.has(verdict.decision)) {
+            if (i === 0)
+                return null;
+            throw new Error(AUTOLOOP_CLOSED_LEDGER_REFUSAL);
+        }
+        if (typeof verdict.metric === 'number' && Number.isFinite(verdict.metric)) {
+            metrics.push(verdict.metric);
+        }
+        i += 1;
+    }
+    if (i === 0)
+        return null;
+    const history = metrics.length > MAX_METRIC_HISTORY ? metrics.slice(metrics.length - MAX_METRIC_HISTORY) : metrics.slice();
+    return { iter: i, metric_history: history };
+}
 export class SessionManager {
     sessions = new Map();
     _pendingSessions = new Map();
@@ -1140,12 +1421,17 @@ export class SessionManager {
             // its executor is registered here with a builder closed over `this`
             // rather than living in the kernel.
             kernel.setExecutor('autoloop', makeAutoloopExecutor({
-                boot: (config, secrets) => this._bootAutoloop({
+                boot: (config, secrets, { freshStart }) => this._bootAutoloop({
                     ...config,
                     // Custom-engine configs never reach the spec, so they come from
                     // the run's in-memory secret bag — supplied at start, and
                     // re-supplied by the caller on a resume.
                     ...secrets,
+                    // Internal never-persisted marker LAST so spec.config / secrets
+                    // cannot override the kernel visits===1 fresh-start signal.
+                    // Always set (including false on resume) — omitting false left a
+                    // `_freshStart: true` from config/secrets intact.
+                    _freshStart: freshStart,
                 }),
                 ready: (key, value) => {
                     const deferred = this._autoloopReady.get(key);
@@ -2916,9 +3202,19 @@ export class SessionManager {
             }
         }
         const ledgerDir = path.join(opts.workspace, 'tasks', opts.runId);
+        if (opts._freshStart === true) {
+            applyAutoloopFreshStartBoundary(opts.workspace, opts.runId, { invalidRunId: 'refuse' });
+        }
         if (!fs.existsSync(ledgerDir)) {
             fs.mkdirSync(ledgerDir, { recursive: true });
         }
+        // Non-fresh boots: restore typed progress from the contiguous closed ledger
+        // prefix before any dispatcher/runner/session work. Refusal throws here so
+        // no Planner start or checkpoint publish occurs.
+        let closedLedgerRestore = null;
+        if (opts._freshStart !== true) {
+            closedLedgerRestore = readClosedLedgerRestore(ledgerDir);
+        }
         // Per-run policy object — mutable so Planner's update_push_policy is visible
         // to the runner without re-wiring.
         const pushPolicy = JSON.parse(JSON.stringify(DEFAULT_PUSH_POLICY));
@@ -2990,6 +3286,10 @@ export class SessionManager {
             autoloopHardTimeoutMs: opts.autoloopHardTimeoutMs,
         });
         runnerRef = runner;
+        if (closedLedgerRestore) {
+            runner.state.iter = closedLedgerRestore.iter;
+            runner.state.metric_history = closedLedgerRestore.metric_history.slice();
+        }
         try {
             await runner.start();
             // A reconstructed migration becomes externally visible only after its
@@ -3095,43 +3395,7 @@ export class SessionManager {
                 throw new Error(`Autoloop session name '${sessionName}' is already in use`);
             }
         }
-        // Refuse a dirty git worktree before the run directory or Planner exists.
-        // --porcelain=v1 -z keeps paths literal (spaces/quotes). --untracked-files=all
-        // overrides status.showUntrackedFiles=no, while --ignore-submodules=none
-        // prevents repository config from hiding submodule dirt; do not pass
-        // --ignored. Only the deterministic not-a-git-repository error allows the
-        // start; every other status failure rejects. Do not raise maxBuffer:
-        // ENOBUFS or already-nonempty stdout means dirt. Untracked (??) or
-        // index-clean worktree mods
-        // (` M`) under tasks/<id>/ are ignored only when tasks/<id>/goal.json is a
-        // regular file — every other status (staged/rename/copy/delete/conflict/
-        // malformed) rejects.
-        // Nested workspaces: status paths are repo-root-relative; strip a verified
-        // `rev-parse --show-prefix` before the ledger check; paths outside the
-        // workspace still refuse.
-        const dirtyStartError = new Error('Autoloop workspace has uncommitted changes; commit or stash them before starting');
-        let porcelain = '';
-        try {
-            porcelain = execFileSync('git', ['-C', opts.workspace, 'status', '--porcelain=v1', '-z', '--untracked-files=all', '--ignore-submodules=none'], {
-                encoding: 'utf8',
-                stdio: ['ignore', 'pipe', 'pipe'],
-                env: { ...process.env, LC_ALL: 'C' },
-            });
-        }
-        catch (err) {
-            const e = err;
-            const partial = typeof e.stdout === 'string' ? e.stdout : Buffer.isBuffer(e.stdout) ? e.stdout.toString('utf8') : '';
-            if (e.code === 'ENOBUFS' || partial.trim() !== '' || !isNotGitRepositoryError(err)) {
-                throw dirtyStartError;
-            }
-            porcelain = '';
-        }
-        if (porcelain.length > 0) {
-            const prefix = readVerifiedGitShowPrefix(opts.workspace);
-            if (prefix === null || porcelainHasDisallowedAutoloopDirt(opts.workspace, porcelain, prefix)) {
-                throw dirtyStartError;
-            }
-        }
+        applyAutoloopFreshStartBoundary(opts.workspace, opts.runId, { invalidRunId: 'defer' });
         const tag = `${opts.runId}:${randomUUID()}`;
         const ready = new Promise((resolve, reject) => {
             this._autoloopReady.set(tag, { resolve, reject });