@engineeros/connector 0.4.6 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@engineeros/connector",
-  "version": "0.4.6",
+  "version": "0.5.0",
   "description": "Connect a local Codex CLI workspace to EngineerOS over an outbound WebSocket.",
   "private": false,
   "type": "module",

package/src/runner.mjs

@@ -1,4 +1,3 @@
-import { createHash } from "node:crypto";
 import { spawn } from "node:child_process";
 import {
   lstat,
@@ -106,21 +105,117 @@ export async function executeAssignment(assignment, config, callbacks) {
   const changedFiles = await changedFilePaths(runWorkspace);
   if (!changedFiles.length)
     throw new Error("Codex completed without changing any files.");
-  const diffPatch = await boundedDiff(runWorkspace, changedFiles);
-  const archive = await repositoryArchive(runWorkspace);
-  const revision = `worktree-${createHash("sha256").update(diffPatch).digest("hex").slice(0, 55)}`;
+  const committed = await commitRunChange(
+    runWorkspace,
+    assignment.base_revision,
+    assignment.run_id,
+  );
+  const verifier = launchCodexProcess(
+    runWorkspace,
+    verificationPrompt(assignment, committed.revision, committed.changedFiles),
+    "read-only",
+    callbacks,
+  );
+  callbacks.onProcess?.(verifier.child);
+  const verification = await verifier.completed;
+  const proofEvidence = parseVerificationReport(
+    verification.finalMessage,
+    assignment.proof_checks,
+    config.connector_id,
+    assignment.run_id,
+  );
   return {
-    head_revision: revision,
+    head_revision: committed.revision,
     repository_locator: assignment.repository_locator,
     external_reference: `connector:${config.connector_id}/run:${assignment.run_id}`,
-    diff_patch: diffPatch,
-    changed_files: changedFiles,
-    repository_archive_base64: archive.toString("base64"),
-    repository_archive_media_type: "application/zip",
-    proof_evidence: [],
+    diff_patch: committed.diffPatch,
+    changed_files: committed.changedFiles,
+    proof_evidence: proofEvidence,
+    verification_report: verification.finalMessage,
+  };
+}
+
+async function commitRunChange(workspace, baseRevision, runId) {
+  await run("git", ["add", "-A"], workspace);
+  await run(
+    "git",
+    [
+      "-c",
+      "user.name=EngineerOS Codex",
+      "-c",
+      "user.email=codex@engineeros.local",
+      "commit",
+      "-m",
+      `EngineerOS Goal Run ${runId}`,
+    ],
+    workspace,
+  );
+  const head = await run("git", ["rev-parse", "HEAD"], workspace);
+  const revision = head.stdout.trim();
+  const diff = await run(
+    "git",
+    ["diff", "--binary", baseRevision, revision, "--"],
+    workspace,
+  );
+  const paths = await run(
+    "git",
+    ["diff", "--name-only", "-z", baseRevision, revision, "--"],
+    workspace,
+  );
+  return {
+    revision,
+    diffPatch: diff.stdout,
+    changedFiles: gitPathList(paths.stdout).sort(),
   };
 }
 
+export function verificationPrompt(assignment, revision, changedFiles) {
+  const checks = (assignment.proof_checks ?? [])
+    .map(
+      (proof, index) =>
+        `## Proof ${index + 1}\n- Check: ${proof.check ?? ""}\n- Expected: ${proof.expected ?? ""}`,
+    )
+    .join("\n\n");
+  return `# EngineerOS Connected Verification
+
+Independently verify the frozen Goal at Git commit \`${revision}\`. Do not modify files. Run the commands or inspections needed for every Proof item, and check the Goal boundaries and constraints in the supplied packet.
+
+Changed files:
+${changedFiles.map((item) => `- \`${item}\``).join("\n")}
+
+${checks}
+
+Return structured Markdown only, with exactly one section per Proof:
+
+## Proof 1
+- Status: passed or failed
+- Exit code: integer or none
+- Evidence: concise observed output and command
+
+Do not claim a Proof passed unless you observed it directly.`;
+}
+
+export function parseVerificationReport(report, proofChecks, connectorId, runId) {
+  if (!report?.trim()) throw new Error("Codex returned no connected verification report.");
+  return (proofChecks ?? []).map((_, index) => {
+    const start = new RegExp(`^## Proof ${index + 1}\\s*$`, "im").exec(report);
+    const tail = start ? report.slice(start.index + start[0].length) : "";
+    const section = tail.split(/^## Proof \d+\s*$/im)[0] ?? "";
+    const status = /^- Status:\s*(passed|failed)\s*$/im.exec(section)?.[1] ?? "failed";
+    const exitValue = /^- Exit code:\s*(\d+|none)\s*$/im.exec(section)?.[1] ?? "none";
+    const evidence = /^- Evidence:\s*(.+)$/im.exec(section)?.[1]?.trim();
+    return {
+      proof_index: index,
+      status,
+      verifier_type: "agent_reported",
+      verifier_identity: "Connected Codex CLI verifier",
+      locator: `connector:${connectorId}/run:${runId}#proof-${index + 1}`,
+      output_excerpt: evidence || "The connected verifier did not provide evidence for this Proof.",
+      exit_code: exitValue === "none" ? null : Number(exitValue),
+    };
+  });
+}
+
 export async function executeWorkspaceAssessment(
   assignment,
   config,
@@ -585,20 +680,17 @@ function runCodexCommand(command, args, cwd) {
 async function changedFilePaths(workspace) {
   const tracked = await run(
     "git",
-    ["diff", "--name-only", "HEAD", "--"],
+    ["diff", "--name-only", "-z", "HEAD", "--"],
     workspace,
   );
   const untracked = await run(
     "git",
-    ["ls-files", "--others", "--exclude-standard"],
+    ["ls-files", "-z", "--others", "--exclude-standard"],
     workspace,
   );
   return [
     ...new Set(
-      `${tracked.stdout}\n${untracked.stdout}`
-        .split(/\r?\n/)
-        .map(normalizePath)
-        .filter(Boolean),
+      [...gitPathList(tracked.stdout), ...gitPathList(untracked.stdout)],
     ),
   ].sort();
 }
@@ -610,16 +702,15 @@ async function boundedDiff(workspace, changedFiles) {
     workspace,
   );
   const untracked = new Set(
-    (
-      await run(
-        "git",
-        ["ls-files", "--others", "--exclude-standard"],
-        workspace,
-      )
-    ).stdout
-      .split(/\r?\n/)
-      .map(normalizePath)
-      .filter(Boolean),
+    gitPathList(
+      (
+        await run(
+          "git",
+          ["ls-files", "-z", "--others", "--exclude-standard"],
+          workspace,
+        )
+      ).stdout,
+    ),
   );
   const parts = [tracked.stdout];
   for (const relative of changedFiles.filter((item) => untracked.has(item))) {
@@ -638,15 +729,13 @@ async function boundedDiff(workspace, changedFiles) {
   return diff;
 }
 
-async function repositoryArchive(workspace) {
+export async function repositoryArchive(workspace) {
   const listed = await run(
     "git",
-    ["ls-files", "-co", "--exclude-standard"],
+    ["ls-files", "-z", "-co", "--exclude-standard"],
     workspace,
   );
-  const files = [
-    ...new Set(listed.stdout.split(/\r?\n/).map(normalizePath).filter(Boolean)),
-  ].sort();
+  const files = [...new Set(gitPathList(listed.stdout))].sort();
   return createZip(
     await Promise.all(
       files.map(async (relative) => ({
@@ -801,6 +890,13 @@ function normalizePath(value) {
     .replace(/^\.\//, "");
 }
 
+function gitPathList(value) {
+  return String(value ?? "")
+    .split("\0")
+    .map(normalizePath)
+    .filter(Boolean);
+}
+
 function run(command, args, cwd, options = {}) {
   return new Promise((resolve, reject) => {
     const child = spawn(command, args, {