@fitlab-ai/agent-infra 0.9.5 → 0.9.6

package/dist/lib/sandbox/worktree-safety.js

@@ -0,0 +1,196 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { runProbe } from './shell.js';
+function probeText(probe, cwd, args) {
+    const result = probe('git', ['-C', cwd, ...args], { encoding: 'utf8' });
+    if (result.error)
+        throw result.error;
+    if (result.status !== 0) {
+        const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : result.stderr.toString('utf8').trim();
+        throw new Error(stderr || `git ${args[0] ?? 'command'} failed with exit code ${result.status ?? 'unknown'}`);
+    }
+    return typeof result.stdout === 'string' ? result.stdout : result.stdout.toString('utf8');
+}
+function parseStatus(raw) {
+    const records = raw.split('\0');
+    const changes = [];
+    for (let index = 0; index < records.length; index += 1) {
+        const record = records[index] ?? '';
+        if (!record || record.startsWith('# '))
+            continue;
+        if (record.startsWith('? ')) {
+            changes.push({ indexStatus: '?', worktreeStatus: '?', path: record.slice(2) });
+            continue;
+        }
+        if (record.startsWith('1 ')) {
+            const match = /^1 (..) \S+ \S+ \S+ \S+ \S+ \S+ (.*)$/s.exec(record);
+            if (!match)
+                throw new Error('Unable to parse git porcelain v2 ordinary record');
+            changes.push({ indexStatus: match[1][0], worktreeStatus: match[1][1], path: match[2] });
+            continue;
+        }
+        if (record.startsWith('2 ')) {
+            const match = /^2 (..) \S+ \S+ \S+ \S+ \S+ \S+ \S+ (.*)$/s.exec(record);
+            const originalPath = records[++index];
+            if (!match || originalPath === undefined || originalPath === '') {
+                throw new Error('Unable to parse git porcelain v2 rename record');
+            }
+            changes.push({
+                indexStatus: match[1][0],
+                worktreeStatus: match[1][1],
+                path: match[2],
+                originalPath
+            });
+            continue;
+        }
+        if (record.startsWith('u ')) {
+            const match = /^u (..) \S+ \S+ \S+ \S+ \S+ \S+ \S+ \S+ (.*)$/s.exec(record);
+            if (!match)
+                throw new Error('Unable to parse git porcelain v2 unmerged record');
+            changes.push({ indexStatus: match[1][0], worktreeStatus: match[1][1], path: match[2] });
+            continue;
+        }
+        throw new Error(`Unsupported git porcelain v2 record '${record[0] ?? ''}'`);
+    }
+    return changes;
+}
+function updatePart(hash, label, value) {
+    const data = Buffer.isBuffer(value) ? value : Buffer.from(value, 'utf8');
+    hash.update(`${label.length}:${label}:${data.length}:`, 'utf8');
+    hash.update(data);
+}
+function resolveSnapshotPath(worktree, relativePath) {
+    const resolved = path.resolve(worktree, relativePath);
+    const relative = path.relative(worktree, resolved);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Git reported a path outside the worktree: ${JSON.stringify(relativePath)}`);
+    }
+    return resolved;
+}
+function hashPath(hash, worktree, relativePath, probe) {
+    updatePart(hash, 'path', relativePath);
+    const target = resolveSnapshotPath(worktree, relativePath);
+    let stat;
+    try {
+        stat = fs.lstatSync(target);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            updatePart(hash, 'kind', 'absent');
+            return;
+        }
+        throw error;
+    }
+    updatePart(hash, 'mode', String(stat.mode & 0o7777));
+    if (stat.isFile()) {
+        updatePart(hash, 'kind', 'file');
+        updatePart(hash, 'content', fs.readFileSync(target));
+        return;
+    }
+    if (stat.isSymbolicLink()) {
+        updatePart(hash, 'kind', 'symlink');
+        updatePart(hash, 'target', fs.readlinkSync(target));
+        return;
+    }
+    if (stat.isDirectory()) {
+        updatePart(hash, 'kind', 'git-directory');
+        const nestedHead = probeText(probe, target, ['rev-parse', '--verify', 'HEAD']).trim();
+        const nestedStatus = probeText(probe, target, [
+            'status', '--porcelain=v2', '-z', '--branch', '--untracked-files=all', '--ignore-submodules=none'
+        ]);
+        const nestedIndex = probeText(probe, target, ['ls-files', '--stage', '-z']);
+        updatePart(hash, 'nested-head', nestedHead);
+        updatePart(hash, 'nested-status', nestedStatus);
+        updatePart(hash, 'nested-index', nestedIndex);
+        for (const change of parseStatus(nestedStatus)) {
+            hashPath(hash, target, change.path, probe);
+            if (change.originalPath)
+                hashPath(hash, target, change.originalPath, probe);
+        }
+        return;
+    }
+    throw new Error(`Unsupported file type in dirty snapshot: ${JSON.stringify(relativePath)}`);
+}
+function captureOnce(worktree, probe) {
+    const resolvedWorktree = path.resolve(worktree);
+    const branch = probeText(probe, resolvedWorktree, ['rev-parse', '--abbrev-ref', 'HEAD']).trim();
+    const head = probeText(probe, resolvedWorktree, ['rev-parse', '--verify', 'HEAD']).trim();
+    const status = probeText(probe, resolvedWorktree, [
+        'status', '--porcelain=v2', '-z', '--branch', '--untracked-files=all', '--ignore-submodules=none'
+    ]);
+    const index = probeText(probe, resolvedWorktree, ['ls-files', '--stage', '-z']);
+    if (!branch)
+        throw new Error('Unable to determine worktree branch');
+    if (!head)
+        throw new Error('Unable to determine worktree HEAD');
+    const changes = parseStatus(status);
+    const hash = createHash('sha256');
+    updatePart(hash, 'worktree', resolvedWorktree);
+    updatePart(hash, 'branch', branch);
+    updatePart(hash, 'head', head);
+    updatePart(hash, 'status', status);
+    updatePart(hash, 'index', index);
+    for (const change of changes) {
+        hashPath(hash, resolvedWorktree, change.path, probe);
+        if (change.originalPath)
+            hashPath(hash, resolvedWorktree, change.originalPath, probe);
+    }
+    return { worktree: resolvedWorktree, branch, head, changes, identity: hash.digest('hex') };
+}
+function inspectWorktree(worktree, { probe = runProbe } = {}) {
+    const resolvedWorktree = path.resolve(worktree);
+    try {
+        const first = captureOnce(resolvedWorktree, probe);
+        const second = captureOnce(resolvedWorktree, probe);
+        if (first.identity !== second.identity) {
+            return { status: 'failed', worktree: resolvedWorktree, message: 'Snapshot changed while inspecting worktree' };
+        }
+        return { status: second.changes.length === 0 ? 'clean' : 'dirty', snapshot: second };
+    }
+    catch (error) {
+        return {
+            status: 'failed',
+            worktree: resolvedWorktree,
+            message: error instanceof Error ? error.message : String(error)
+        };
+    }
+}
+function inspectWorktrees(worktrees) {
+    return [...new Set(worktrees.map((worktree) => path.resolve(worktree)))].sort()
+        .map((worktree) => inspectWorktree(worktree));
+}
+function createCleanPermit(snapshot) {
+    if (snapshot.changes.length > 0)
+        throw new Error('Cannot create a clean permit for a dirty worktree');
+    return { mode: 'clean', snapshot };
+}
+function createDiscardPermit(snapshot) {
+    if (snapshot.changes.length === 0)
+        throw new Error('Cannot create a discard permit for a clean worktree');
+    return { mode: 'discard', snapshot };
+}
+function verifyWorktreePermit(permit, options = {}) {
+    const current = inspectWorktree(permit.snapshot.worktree, options);
+    if (current.status === 'failed')
+        throw new Error(`Unable to verify worktree permit: ${current.message}`);
+    if (current.snapshot.identity !== permit.snapshot.identity || (permit.mode === 'clean' && current.status !== 'clean')) {
+        throw new Error(`Worktree changed after authorization: ${permit.snapshot.worktree}`);
+    }
+    return current.snapshot;
+}
+function formatWorktreeSnapshot(snapshot) {
+    const lines = snapshot.changes.map((change) => {
+        const rename = change.originalPath ? ` <- ${JSON.stringify(change.originalPath)}` : '';
+        return `  ${change.indexStatus}${change.worktreeStatus} ${JSON.stringify(change.path)}${rename}`;
+    });
+    return [
+        `Worktree: ${JSON.stringify(snapshot.worktree)}`,
+        `Branch: ${snapshot.branch}`,
+        `HEAD: ${snapshot.head}`,
+        ...lines,
+        `Snapshot identity: ${snapshot.identity}`
+    ].join('\n');
+}
+export { createCleanPermit, createDiscardPermit, formatWorktreeSnapshot, inspectWorktree, inspectWorktrees, verifyWorktreePermit };
+//# sourceMappingURL=worktree-safety.js.map

package/dist/lib/server/process-control.js

@@ -4,6 +4,12 @@ import { loadServerConfig } from './config.js';
 import { runDaemon } from './daemon.js';
 import { getProcessStartTime, isProcessAlive, processIdentityMatches, readProcessState, removePidFileIfMatches, writePidRecord } from './process-state.js';
 export { isProcessAlive } from './process-state.js';
+export function buildProcessTreeStopCommand(pid, platform) {
+    if (platform === 'win32') {
+        return { kind: 'exec', command: 'taskkill', args: ['/PID', String(pid), '/T', '/F'] };
+    }
+    return { kind: 'group-signal', pid: -pid, signal: 'SIGTERM' };
+}
 export function buildStopCommand(pid, platform) {
     if (platform === 'win32') {
         return { kind: 'exec', command: 'taskkill', args: ['/PID', String(pid), '/T', '/F'] };

package/dist/lib/task/artifact-lifecycle.js

@@ -13,6 +13,7 @@ const artifactFamilyCatalog = [
     { family: 'code', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['实现报告', 'Implementation Report'] },
     { family: 'review-code', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['代码审查', 'Code Review'] },
     { family: 'manual-validation', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['人工验证', 'Manual Validation'] },
+    { family: 'validation-run', sectionAliases: ['实现备注', 'Implementation Notes'], heading: '实现备注', labels: ['验证运行证据', 'Validation Run Evidence'] },
     { family: 'pr-review', sectionAliases: ['审查反馈', 'Review Feedback'], heading: '审查反馈', labels: ['PR 审查报告', 'PR Review Report'] }
 ];
 const FAMILY_SET = new Set(artifactFamilyCatalog.map((item) => item.family));
@@ -191,7 +192,8 @@ const OPTIONAL_CONTEXT = {
     analysis: { family: 'review-analysis', requireReference: true },
     plan: { family: 'review-plan', requireReference: true },
     'review-code': { family: 'review-plan' },
-    'manual-validation': { family: 'review-code' }
+    'manual-validation': { family: 'review-code' },
+    'validation-run': { family: 'review-code' }
 };
 function resolveArtifactContext(taskRef, family, options = {}) {
     const inventory = inspectTaskArtifacts(taskRef, family, options);
@@ -306,12 +308,11 @@ function resolveDecisionImplementationInput(inventory, review) {
     const activity = locateActivityLog(content);
     if (!activity)
         return { error: 'task has no unique Activity Log section' };
-    const reviewEntries = activity.entries.filter((entry) => /^Review Code \(Round \d+\)$/.test(entry.step) && entry.note.includes(`→ ${review.name}`));
-    const completed = reviewEntries.at(-1);
+    const completed = activity.entries.some((entry) => /^Review Code \(Round \d+\)$/.test(entry.step) && entry.note.includes(`→ ${review.name}`));
     if (!completed)
         return { error: `cannot find completed Activity Log identity for ${review.name}` };
     try {
-        return { input: selectPendingImplementationInput(rows, completed.time) };
+        return { input: selectPendingImplementationInput(rows) };
     }
     catch (error) {
         return { error: error instanceof Error ? error.message : String(error) };

package/dist/lib/task/codex-orchestration.js

@@ -0,0 +1,161 @@
+import { preflightCodexLifecycleEvidence, resolveCodexSpawnedChild, resolveCodexTerminal, resolveCodexThread } from '../agent-clients/adapters/codex-lifecycle/app-server.js';
+import { createCodexLifecycleStore } from '../agent-clients/adapters/codex-lifecycle/store.js';
+import { activateMatchingOrchestrationDelegation, pauseMatchingOrchestrationDelegation, prepareOrchestrationDelegation, reconcileMatchingOrchestrationDelegation, sealMatchingOrchestrationDelegationWithHostEvidence } from './orchestration.js';
+function coreOptions(options) {
+    return { ...options.orchestrationOptions, repoRoot: options.repoRoot ?? options.orchestrationOptions?.repoRoot };
+}
+function bridgeFailure(code, message) {
+    return {
+        status: 'failed', changed: false, taskId: null, run: null, next: null,
+        error: { code, message }
+    };
+}
+function pauseBridge(code, message, options) {
+    const paused = pauseMatchingOrchestrationDelegation('codex', code, message, coreOptions(options));
+    return paused.error?.code === 'ORCHESTRATION_DELEGATION_MISSING'
+        ? bridgeFailure(code, message)
+        : paused;
+}
+function requiredStore(options) {
+    if (!options.store)
+        throw new Error('Codex lifecycle store is required for orchestration bridge events');
+    return options.store;
+}
+async function prepareCodexOrchestrationDelegation(taskRef, input, options = {}) {
+    if (input.client !== 'codex')
+        return prepareOrchestrationDelegation(taskRef, input, coreOptions(options));
+    try {
+        await (options.preflight ?? preflightCodexLifecycleEvidence)(options.repoRoot ?? process.cwd());
+    }
+    catch (error) {
+        return bridgeFailure('ORCHESTRATION_CLIENT_PREFLIGHT_FAILED', error instanceof Error ? error.message : String(error));
+    }
+    return prepareOrchestrationDelegation(taskRef, input, coreOptions(options));
+}
+async function activateCodexOrchestrationDelegation(childThreadId, options = {}) {
+    try {
+        const store = requiredStore(options);
+        const resolved = await (options.resolveThread ?? resolveCodexThread)(childThreadId);
+        store.apply(resolved.resolution.thread);
+        for (const reroute of resolved.reroutes)
+            store.apply(reroute);
+        store.apply(resolved.resolution.settings);
+        const record = store.read(childThreadId);
+        const evidence = record.state.startEvidence;
+        if (record.state.status !== 'start-ready' || !evidence) {
+            return pauseBridge('ORCHESTRATION_CODEX_START_EVIDENCE_INVALID', 'Codex lifecycle start evidence is not ready', options);
+        }
+        return activateMatchingOrchestrationDelegation('codex', {
+            nativeAgent: evidence.nativeAgent,
+            childId: evidence.childThreadId,
+            parentId: evidence.parentThreadId,
+            spawnMode: evidence.spawnMode,
+            actualModel: evidence.actualModel.value,
+            actualReasoningEffort: evidence.actualReasoningEffort.value,
+            ...(evidence.modelFallbackReason ? { modelFallbackReason: evidence.modelFallbackReason } : {}),
+            ...(evidence.reasoningEffortFallbackReason
+                ? { reasoningEffortFallbackReason: evidence.reasoningEffortFallbackReason }
+                : {}),
+            hostEvidence: {
+                kind: 'codex-lifecycle-v1',
+                hookDefinitionHash: evidence.hookDefinitionHash,
+                startRevision: record.revision
+            }
+        }, coreOptions(options));
+    }
+    catch (error) {
+        return pauseBridge('ORCHESTRATION_CODEX_START_FAILED', error instanceof Error ? error.message : String(error), options);
+    }
+}
+async function activateCodexSpawnDelegation(spawn, options = {}) {
+    try {
+        const store = requiredStore(options);
+        const childThreadId = resolveCodexSpawnedChild(spawn.transcriptPath, spawn);
+        const resolved = await (options.resolveThread ?? resolveCodexThread)(childThreadId);
+        store.applyToSpawn(spawn, {
+            type: 'hook-child',
+            sessionId: spawn.sessionId,
+            turnId: spawn.turnId,
+            childThreadId,
+            parentThreadId: resolved.resolution.thread.parentThreadId,
+            nativeAgent: spawn.nativeAgent,
+            source: 'parent-rollout'
+        });
+        return activateCodexOrchestrationDelegation(childThreadId, {
+            ...options,
+            store,
+            resolveThread: async () => resolved
+        });
+    }
+    catch (error) {
+        return pauseBridge('ORCHESTRATION_CODEX_START_FAILED', error instanceof Error ? error.message : String(error), options);
+    }
+}
+async function sealCodexOrchestrationDelegation(childThreadId, options = {}) {
+    try {
+        const store = requiredStore(options);
+        const existing = store.read(childThreadId);
+        if (!existing.consumer) {
+            store.apply(await (options.resolveTerminal ?? resolveCodexTerminal)(childThreadId));
+        }
+        const record = store.read(childThreadId);
+        const evidence = record.state.stopEvidence;
+        if (record.state.status !== 'stop-ready' || !evidence || !record.state.startEvidence) {
+            return pauseBridge('ORCHESTRATION_CODEX_STOP_EVIDENCE_INVALID', 'Codex lifecycle stop evidence is not ready', options);
+        }
+        return sealMatchingOrchestrationDelegationWithHostEvidence('codex', { nativeAgent: record.state.startEvidence.nativeAgent, childId: childThreadId }, (receipt) => {
+            const consumed = store.consume(childThreadId, receipt.id, receipt.hostEvidence?.hookDefinitionHash);
+            return {
+                stopRevision: consumed.revision,
+                consumer: consumed.consumer,
+                consumedAt: consumed.consumedAt
+            };
+        }, coreOptions(options));
+    }
+    catch (error) {
+        return pauseBridge('ORCHESTRATION_CODEX_STOP_FAILED', error instanceof Error ? error.message : String(error), options);
+    }
+}
+async function sealCodexParentDelegation(parentThreadId, options = {}) {
+    try {
+        const store = requiredStore(options);
+        const candidates = store.findByParent(parentThreadId);
+        if (!candidates.length)
+            return bridgeFailure('ORCHESTRATION_DELEGATION_MISSING', 'No matching Codex delegation is active');
+        for (const consumed of candidates.filter((record) => record.consumer)) {
+            const replayed = await sealCodexOrchestrationDelegation(consumed.state.startEvidence.childThreadId, options);
+            if (replayed.error?.code !== 'ORCHESTRATION_DELEGATION_MISSING')
+                return replayed;
+        }
+        const active = candidates.find((record) => !record.consumer);
+        if (!active)
+            return bridgeFailure('ORCHESTRATION_DELEGATION_MISSING', 'No matching Codex delegation is active');
+        const start = active.state.startEvidence;
+        const child = active.state.child;
+        if (!active.state.terminal) {
+            store.apply(await (options.resolveTerminal ?? resolveCodexTerminal)(start.childThreadId));
+        }
+        if (!store.read(start.childThreadId).state.stop) {
+            store.apply({
+                type: 'hook-stop',
+                sessionId: parentThreadId,
+                turnId: child.turnId,
+                childThreadId: start.childThreadId,
+                nativeAgent: start.nativeAgent,
+                source: 'parent-rollout'
+            });
+        }
+        return sealCodexOrchestrationDelegation(start.childThreadId, options);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message === 'CODEX_TURN_NOT_TERMINAL') {
+            return bridgeFailure('ORCHESTRATION_DELEGATION_MISSING', 'The matching Codex child has not completed');
+        }
+        return pauseBridge('ORCHESTRATION_CODEX_STOP_FAILED', error instanceof Error ? error.message : String(error), options);
+    }
+}
+function reconcileCodexOrchestrationDelegation(childThreadId, options = {}) {
+    return reconcileMatchingOrchestrationDelegation('codex', childThreadId, coreOptions(options));
+}
+export { activateCodexOrchestrationDelegation, activateCodexSpawnDelegation, prepareCodexOrchestrationDelegation, reconcileCodexOrchestrationDelegation, sealCodexParentDelegation, sealCodexOrchestrationDelegation };
+//# sourceMappingURL=codex-orchestration.js.map

package/dist/lib/task/commands/status.js

@@ -59,6 +59,7 @@ const STAGE_ORDER = [
     'review-plan',
     'code',
     'review-code',
+    'validation-run',
     'task',
     'other'
 ];
@@ -72,6 +73,8 @@ function stageOf(name) {
         return 'review-plan';
     if (stem.startsWith('review-code'))
         return 'review-code';
+    if (stem.startsWith('validation-run'))
+        return 'validation-run';
     if (stem.startsWith('analysis'))
         return 'analysis';
     if (stem.startsWith('plan'))