@gilbertgt/dsh-plan-orchestrator 1.0.0 → 1.0.2

package/lib/index.js

@@ -1,5 +1,5 @@
 import { A as validatePlanArtifact, C as git, D as normalizeOwnedPath, E as extractPlanArtifact, O as parseValidationCommand, S as fullHead, _ as readJson, b as changedPaths, c as trustedIssueTexts, d as hashBytes, f as assertOwnedPaths, g as confined, h as atomicJson, i as ghRepository, k as schedulerPathIdentity, l as assertTrustedReceipts, m as RunStore, n as ghPreflight, o as prepareIssueBranch, p as disjointOwnership, s as remotePr, t as fetchIssue, u as receiptIndex, v as stateRoot, w as repoRoot, x as decodeUtf8Strict, y as assertRepoPathsConfined } from "./github-Cy4Pm35G.js";
-import { n as validateFixedRoute, r as eligibleTransportFailure, t as installPlannerRoute } from "./planner-route-B9z5GziX.js";
+import { n as validateFixedRoute, r as eligibleTransportFailure, t as installPlannerRoute } from "./planner-route-Z9MMuA1e.js";
 import { createRequire } from "node:module";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -862,6 +862,23 @@ const defaultRoute = () => ({
 	mode: "current",
 	fallbacks: []
 });
+/**
+* Rebuild one route choice with every optional field present only when it holds
+* a real value. Every DSH boundary this plugin crosses — `Session.append`,
+* subagent descriptor snapshots, `llm.resolveCallConfig` and SDK child options —
+* validates lossless JSON, where an explicitly `undefined` property is rejected
+* while an absent one is fine. An unresolved (inherited) route legitimately has
+* no provider/model yet, so those are omitted too rather than written as
+* `undefined`; `routeChoices` filters such a candidate out before use.
+*/
+function losslessRouteChoice(choice) {
+	const route = {};
+	if (choice.provider !== void 0) route.provider = choice.provider;
+	if (choice.model !== void 0) route.model = choice.model;
+	if (choice.reasoningEffort !== void 0) route.reasoningEffort = choice.reasoningEffort;
+	if (choice.maxTokens !== void 0) route.maxTokens = choice.maxTokens;
+	return route;
+}
 const DEFAULT_SETTINGS = Object.freeze({
 	enabled: true,
 	roles: {
@@ -1311,6 +1328,39 @@ var PlannerReadOnlyGuard = class {
 function isPlanxEvent(event) {
 	return Boolean(event && typeof event.type === "string" && event.type.startsWith("planx/") && event.data && typeof event.data.runId === "string");
 }
+/**
+* Reject the payload shapes this plugin is known to produce accidentally.
+*
+* This is deliberately NOT a reimplementation of the DSH lossless-JSON
+* validator: it catches an explicitly `undefined` optional property (the shape
+* that caused the PREFLIGHT wedge), plus non-finite numbers, non-JSON
+* primitives, circular references, sparse arrays, symbol keys and non-plain
+* objects. It does not claim to match every DSH rule. `Session.append` remains
+* the authoritative boundary; this guard exists only so a bad payload fails
+* earlier with a path that names the offending field.
+*/
+function assertNoUndefinedEventData(value, label) {
+	const seen = /* @__PURE__ */ new Set();
+	const walk = (node, path) => {
+		if (node === void 0) throw new Error(`${label} carries an undefined value at ${path}; omit the optional property instead`);
+		if (typeof node === "number" && !Number.isFinite(node)) throw new Error(`${label} carries a non-finite number at ${path}`);
+		if (typeof node === "bigint" || typeof node === "function" || typeof node === "symbol") throw new Error(`${label} carries a non-JSON ${typeof node} at ${path}`);
+		if (typeof node !== "object" || node === null) return;
+		if (seen.has(node)) throw new Error(`${label} carries a circular reference at ${path}`);
+		seen.add(node);
+		if (Array.isArray(node)) {
+			if (node.length !== Object.keys(node).length) throw new Error(`${label} carries a sparse array at ${path}`);
+			node.forEach((item, index) => walk(item, `${path}[${index}]`));
+		} else {
+			const prototype = Object.getPrototypeOf(node);
+			if (prototype !== Object.prototype && prototype !== null) throw new Error(`${label} carries a non-plain object at ${path}`);
+			if (Object.getOwnPropertySymbols(node).length) throw new Error(`${label} carries a symbol key at ${path}`);
+			for (const [key, item] of Object.entries(node)) walk(item, `${path}.${key}`);
+		}
+		seen.delete(node);
+	};
+	walk(value, label);
+}
 function reducePlanxEvents(sessionId, events) {
 	const rows = /* @__PURE__ */ new Map();
 	for (const event of events) {
@@ -1523,6 +1573,28 @@ async function cleanupRunWorktrees(repo, runId, root = stateRoot()) {
 }
 //#endregion
 //#region src/orchestration/service.ts
+const TERMINAL_PHASES = /* @__PURE__ */ new Set([
+	"COMPLETE",
+	"BLOCKED",
+	"FAILED",
+	"INTERRUPTED",
+	"CANCELLED"
+]);
+/** Runner errors matching this shape are safety boundaries, not plain faults. */
+const BLOCKING_FAILURE = /(drift|ownership|blocked|inconclusive|unsafe|conflict|escape|checkpoint|tampered|stale)/i;
+function failureMessage(error) {
+	if (error instanceof Error && error.message) return error.message;
+	if (typeof error === "string" && error) return error;
+	try {
+		const encoded = JSON.stringify(error);
+		if (encoded && encoded !== "{}" && encoded !== "null") return encoded;
+	} catch {}
+	return "unknown orchestration failure";
+}
+function terminalPhaseFor(aborted, message) {
+	if (aborted) return "CANCELLED";
+	return BLOCKING_FAILURE.test(message) ? "BLOCKED" : "FAILED";
+}
 var OrchestrationService = class {
 	store;
 	runner;
@@ -1618,7 +1690,7 @@ var OrchestrationService = class {
 			this.append(session, "planx/run-phase", {
 				runId,
 				phase: view.phase,
-				message: data.message,
+				...data.message !== void 0 ? { message: String(data.message) } : {},
 				reviewRound: view.reviewRound,
 				at: now
 			});
@@ -1704,7 +1776,15 @@ var OrchestrationService = class {
 			return false;
 		}
 		if (pending.cancelled || this.#pending.get(sessionId) !== pending) return false;
-		const started = await this.start(pending.launch, pending.runId);
+		let started;
+		try {
+			started = await this.start(pending.launch, pending.runId);
+		} catch (error) {
+			const message = `maintenance launch failed: ${failureMessage(error)}`;
+			if (this.#pending.get(sessionId) === pending) this.#pending.delete(sessionId);
+			await this.finalize(pending.launch, pending.runId, terminalPhaseFor(false, message), message).catch(() => {});
+			return false;
+		}
 		if (pending.cancelled) {
 			if (this.#pending.get(sessionId) === pending) this.#pending.delete(sessionId);
 			return false;
@@ -1793,7 +1873,15 @@ var OrchestrationService = class {
 			message: `Safe resume from ${diagnosis.resumeFrom}`,
 			at: now
 		});
-		await this.start(launch, runId);
+		try {
+			await this.start(launch, runId);
+		} catch (error) {
+			await this.finalize(launch, runId, terminalPhaseFor(false, failureMessage(error)), failureMessage(error));
+			return {
+				ok: false,
+				reason: failureMessage(error)
+			};
+		}
 		return {
 			ok: true,
 			resumeFrom: diagnosis.resumeFrom
@@ -1837,40 +1925,103 @@ var OrchestrationService = class {
 		return true;
 	}
 	async run(launch, runId, signal) {
-		const initial = await this.store.readManifest(launch.sessionId, runId);
-		initial.phase = launch.resumeFrom ?? "PREFLIGHT";
-		initial.terminal = false;
-		await this.store.writeManifest(initial);
-		this.recordEvent("phase", {
-			runId,
-			phase: initial.phase
-		});
 		let terminalPhase = "COMPLETE";
 		let terminalMessage;
 		let thrown;
+		let failed = false;
+		try {
+			try {
+				const initial = await this.store.readManifest(launch.sessionId, runId);
+				initial.phase = launch.resumeFrom ?? "PREFLIGHT";
+				initial.terminal = false;
+				await this.store.writeManifest(initial);
+				this.recordEvent("phase", {
+					runId,
+					phase: initial.phase
+				});
+			} catch (error) {
+				thrown = error;
+				failed = true;
+				terminalMessage = failureMessage(error);
+				terminalPhase = terminalPhaseFor(signal.aborted, terminalMessage);
+			}
+			if (!failed) try {
+				await this.runner(launch, runId, signal);
+				if (signal.aborted && terminalPhase === "COMPLETE") {
+					terminalMessage = "run aborted before completion";
+					terminalPhase = "CANCELLED";
+				}
+			} catch (error) {
+				thrown = error;
+				failed = true;
+				terminalMessage = failureMessage(error);
+				terminalPhase = terminalPhaseFor(signal.aborted, terminalMessage);
+			}
+		} finally {
+			await this.finalize(launch, runId, terminalPhase, terminalMessage);
+		}
+		if (failed) throw thrown;
+	}
+	/**
+	* Best-effort terminal manifest write. Returns the failure instead of
+	* throwing so the caller can decide how to converge.
+	*/
+	async writeTerminal(launch, runId, phase) {
 		try {
-			await this.runner(launch, runId, signal);
+			const latest = await this.store.readManifest(launch.sessionId, runId);
+			latest.phase = phase;
+			latest.terminal = true;
+			await this.store.writeManifest(latest);
+			return { ok: true };
 		} catch (error) {
-			thrown = error;
-			terminalMessage = error.message;
-			terminalPhase = signal.aborted ? "CANCELLED" : /(drift|ownership|blocked|inconclusive|unsafe|conflict|escape|checkpoint|tampered|stale)/i.test(terminalMessage) ? "BLOCKED" : "FAILED";
+			return {
+				ok: false,
+				error
+			};
 		}
-		const latest = await this.store.readManifest(launch.sessionId, runId);
-		latest.phase = terminalPhase;
-		latest.terminal = true;
-		await this.store.writeManifest(latest);
-		this.recordEvent("phase", {
-			runId,
-			phase: terminalPhase,
-			message: terminalMessage
-		});
-		this.append(launch.agent.session, "planx/run-terminal", {
-			runId,
-			phase: terminalPhase,
-			...terminalMessage ? { message: terminalMessage } : {},
-			at: (/* @__PURE__ */ new Date()).toISOString()
-		});
-		if (thrown !== void 0) throw thrown;
+	}
+	/**
+	* Persist the terminal state. Never throws: a session whose append is
+	* unavailable must still not be left with a non-terminal manifest.
+	*/
+	async finalize(launch, runId, phase, message) {
+		if (!TERMINAL_PHASES.has(phase)) throw new Error(`plan-orchestrator refusing non-terminal finalize phase: ${phase}`);
+		const at = (/* @__PURE__ */ new Date()).toISOString();
+		let effectivePhase = phase;
+		let effectiveMessage = message;
+		const written = await this.writeTerminal(launch, runId, effectivePhase);
+		if (!written.ok) {
+			effectivePhase = "FAILED";
+			effectiveMessage = `terminal manifest persistence failed: ${failureMessage(written.error)}`;
+			const retry = await this.writeTerminal(launch, runId, effectivePhase);
+			if (!retry.ok) effectiveMessage = `${effectiveMessage}; retry failed: ${failureMessage(retry.error)}`;
+			try {
+				launch.agent?.session?.append?.("planx/finalize-error", {
+					runId,
+					phase: effectivePhase,
+					message: effectiveMessage,
+					at
+				});
+			} catch {}
+			try {
+				this.failView(runId, "FAILED", effectiveMessage, at);
+			} catch {}
+		}
+		try {
+			this.recordEvent("phase", {
+				runId,
+				phase: effectivePhase,
+				...effectiveMessage !== void 0 ? { message: effectiveMessage } : {}
+			});
+		} catch {}
+		try {
+			this.append(launch.agent.session, "planx/run-terminal", {
+				runId,
+				phase: effectivePhase,
+				...effectiveMessage ? { message: effectiveMessage } : {},
+				at
+			});
+		} catch {}
 	}
 	async persistApproval(launch, runId, now) {
 		const dir = this.store.runDir(launch.sessionId, runId);
@@ -1918,21 +2069,24 @@ var OrchestrationService = class {
 	}
 	append(session, type, data) {
 		if (!session || typeof session.append !== "function") throw new Error(`plan-orchestrator cannot persist ${type}: session append unavailable`);
+		assertNoUndefinedEventData(data, type);
 		session.append(type, data);
 	}
-	failView(runId, phase, message) {
+	failView(runId, phase, message, at = (/* @__PURE__ */ new Date()).toISOString()) {
 		const view = this.#views.get(runId);
 		if (!view) return;
 		view.phase = phase;
 		view.status = phase;
 		view.message = message;
-		view.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-		this.append(this.#agents.get(view.sessionId)?.session, "planx/run-terminal", {
-			runId,
-			phase,
-			message,
-			at: view.updatedAt
-		});
+		view.updatedAt = at;
+		try {
+			this.append(this.#agents.get(view.sessionId)?.session, "planx/run-terminal", {
+				runId,
+				phase,
+				message,
+				at
+			});
+		} catch {}
 	}
 	async latestReview(dir, round) {
 		for (let index = round; index >= 0; index--) {
@@ -2122,14 +2276,18 @@ function buildTaskPacket(plan, task, dependencyHandoff = []) {
 }
 //#endregion
 //#region src/contract/role-result.ts
+/**
+* Model-facing structured-output schema. DeepSeek Harness intentionally accepts
+* only a constrained raw JSON Schema vocabulary for subagent outputSchema.
+* Size/count limits therefore stay in validateRoleResult(), where they are
+* enforced after structured output is returned instead of being expressed with
+* unsupported maxLength/maxItems keywords here.
+*/
 const ROLE_RESULT_SCHEMA = {
 	type: "object",
 	additionalProperties: false,
 	properties: {
-		taskId: {
-			type: "string",
-			maxLength: 200
-		},
+		taskId: { type: "string" },
 		status: {
 			type: "string",
 			enum: [
@@ -2140,11 +2298,7 @@ const ROLE_RESULT_SCHEMA = {
 		},
 		changed: {
 			type: "array",
-			items: {
-				type: "string",
-				maxLength: 512
-			},
-			maxItems: 200
+			items: { type: "string" }
 		},
 		validation: {
 			type: "array",
@@ -2152,10 +2306,7 @@ const ROLE_RESULT_SCHEMA = {
 				type: "object",
 				additionalProperties: false,
 				properties: {
-					id: {
-						type: "string",
-						maxLength: 200
-					},
+					id: { type: "string" },
 					status: {
 						type: "string",
 						enum: [
@@ -2164,30 +2315,18 @@ const ROLE_RESULT_SCHEMA = {
 							"INCONCLUSIVE"
 						]
 					},
-					detail: {
-						type: "string",
-						maxLength: 2e3
-					}
+					detail: { type: "string" }
 				},
 				required: ["id", "status"]
-			},
-			maxItems: 30
+			}
 		},
 		remaining: {
 			type: "array",
-			items: {
-				type: "string",
-				maxLength: 1e3
-			},
-			maxItems: 30
+			items: { type: "string" }
 		},
 		contextExpansion: {
 			type: "array",
-			items: {
-				type: "string",
-				maxLength: 1e3
-			},
-			maxItems: 30
+			items: { type: "string" }
 		}
 	},
 	required: [
@@ -2607,9 +2746,9 @@ function routeChoices(route, current) {
 	return [route.mode === "current" ? current : {
 		provider: route.provider,
 		model: route.model,
-		reasoningEffort: route.reasoningEffort,
-		maxTokens: route.maxTokens
-	}, ...route.fallbacks].filter((v, i, a) => v.provider && v.model && a.findIndex((x) => x.provider === v.provider && x.model === v.model && x.reasoningEffort === v.reasoningEffort) === i);
+		...route.reasoningEffort !== void 0 ? { reasoningEffort: route.reasoningEffort } : {},
+		...route.maxTokens !== void 0 ? { maxTokens: route.maxTokens } : {}
+	}, ...route.fallbacks].map(losslessRouteChoice).filter((v, i, a) => v.provider && v.model && a.findIndex((x) => x.provider === v.provider && x.model === v.model && x.reasoningEffort === v.reasoningEffort) === i);
 }
 async function preflightRoute(llm, choice) {
 	if (typeof llm?.resolveCallConfig !== "function") throw new Error("llm.resolveCallConfig unavailable");
@@ -2747,12 +2886,25 @@ function aggregateUsage(samples) {
 //#endregion
 //#region src/orchestration/engine.ts
 const unionOwnership = (plan) => [...new Set(plan.tasks.flatMap((task) => task.modify))].sort();
-const currentRoute = (agent) => ({
-	provider: agent.options?.provider,
-	model: agent.options?.model,
-	reasoningEffort: agent.options?.reasoningEffort,
-	maxTokens: agent.options?.maxTokens
-});
+/**
+* Absent route fields must not exist at all. An explicit `reasoningEffort:
+* undefined` is rejected by every DSH lossless-JSON boundary (subagent
+* descriptors, the session log, SDK child options), so each property is
+* constructed only when the live agent actually carries a value — including
+* provider/model, which an unresolved inherited agent legitimately lacks.
+*/
+const currentRoute = (agent) => {
+	const provider = agent?.options?.provider;
+	const model = agent?.options?.model;
+	const reasoningEffort = agent?.options?.reasoningEffort;
+	const maxTokens = agent?.options?.maxTokens;
+	return {
+		...provider !== void 0 ? { provider: String(provider) } : {},
+		...model !== void 0 ? { model: String(model) } : {},
+		...reasoningEffort !== void 0 ? { reasoningEffort: String(reasoningEffort) } : {},
+		...maxTokens !== void 0 ? { maxTokens: Number(maxTokens) } : {}
+	};
+};
 async function resolvedChoices(ctx, settings, role, agent) {
 	const candidates = routeChoices(settings.roles[role], currentRoute(agent));
 	const good = [];
@@ -3715,7 +3867,7 @@ function apply(ctx) {
 	c.inject(["connection"], (scope) => scope.effect(() => {
 		let disposed = false;
 		let disposeTransport;
-		import("./rpc-server-CGs2ndXP.js").then(({ registerRpc }) => {
+		import("./rpc-server-Bdtz9NqI.js").then(({ registerRpc }) => {
 			if (disposed) return;
 			disposeTransport = registerRpc(scope.connection, {
 				ctx: scope,

package/lib/{planner-route-B9z5GziX.js → planner-route-Z9MMuA1e.js}

@@ -11,10 +11,10 @@ async function validateFixedRoute(llm, route) {
 	if (!route.provider || !route.model) throw new Error("fixed route needs provider and model");
 	const requested = {
 		provider: route.provider,
-		model: route.model,
-		...route.reasoningEffort ? { reasoningEffort: route.reasoningEffort } : {},
-		...route.maxTokens ? { maxTokens: route.maxTokens } : {}
+		model: route.model
 	};
+	if (route.reasoningEffort !== void 0) requested.reasoningEffort = route.reasoningEffort;
+	if (route.maxTokens !== void 0) requested.maxTokens = route.maxTokens;
 	if (typeof llm?.resolveCallConfig !== "function") throw new Error("DSH llm.resolveCallConfig is unavailable");
 	await llm.resolveCallConfig(requested);
 	for (const fallback of route.fallbacks) await llm.resolveCallConfig(fallback);
@@ -27,15 +27,15 @@ function routeAt(route, current, index) {
 			return {
 				provider: current.provider,
 				model: current.model,
-				reasoningEffort: current.reasoningEffort,
-				maxTokens: current.maxTokens
+				...current.reasoningEffort !== void 0 ? { reasoningEffort: current.reasoningEffort } : {},
+				...current.maxTokens !== void 0 ? { maxTokens: current.maxTokens } : {}
 			};
 		}
 		return {
 			provider: route.provider,
 			model: route.model,
-			reasoningEffort: route.reasoningEffort,
-			maxTokens: route.maxTokens
+			...route.reasoningEffort !== void 0 ? { reasoningEffort: route.reasoningEffort } : {},
+			...route.maxTokens !== void 0 ? { maxTokens: route.maxTokens } : {}
 		};
 	}
 	return route.fallbacks[index - 1];
@@ -51,12 +51,13 @@ function installPlannerRoute(ctx, getRoute, isPlanActive, isEnabled = () => true
 		const selected = routeAt(getRoute(agent), current, fallbackIndex.get(agent) ?? 0);
 		if (!selected) return current;
 		await ctx.llm.resolveCallConfig(selected);
+		const { reasoningEffort: _inheritedEffort, maxTokens: inheritedMaxTokens, ...rest } = current;
 		return {
-			...current,
+			...rest,
 			provider: selected.provider,
 			model: selected.model,
-			reasoningEffort: selected.reasoningEffort,
-			maxTokens: selected.maxTokens ?? current.maxTokens
+			...selected.reasoningEffort !== void 0 ? { reasoningEffort: selected.reasoningEffort } : {},
+			...selected.maxTokens !== void 0 ? { maxTokens: selected.maxTokens } : inheritedMaxTokens !== void 0 ? { maxTokens: inheritedMaxTokens } : {}
 		};
 	});
 	const assembly = ctx.on("system-prompt/assemble", async (assembled, context, next) => {

package/lib/{rpc-server-CGs2ndXP.js → rpc-server-Bdtz9NqI.js}

@@ -1,4 +1,4 @@
-import { n as validateFixedRoute } from "./planner-route-B9z5GziX.js";
+import { n as validateFixedRoute } from "./planner-route-Z9MMuA1e.js";
 //#region src/contract/rpc.ts
 const RPC_METHODS = [
 	"model-catalog",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gilbertgt/dsh-plan-orchestrator",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Product-grade orchestration layer for DeepSeek Harness native Plan Mode",
   "type": "module",
   "main": "./lib/index.js",