@harness-engineering/orchestrator 0.2.2 → 0.2.4

package/README.md

@@ -0,0 +1,135 @@
+# @harness-engineering/orchestrator
+
+Orchestrator daemon for dispatching coding agents to issues. Polls an issue tracker for candidate tasks, manages ephemeral workspaces, runs agents to resolve issues, and updates the tracker with progress.
+
+## Architecture
+
+```
+┌──────────────────────────────────────────────────┐
+│                 Issue Tracker                     │
+│  RoadmapTrackerAdapter · Linear Extension        │
+└──────────────────┬───────────────────────────────┘
+                   ▼
+┌──────────────────────────────────────────────────┐
+│              Core State Machine                   │
+│  Candidate Selection · Concurrency Control       │
+│  Reconciliation · Retry Logic                    │
+│  Event Sourcing (applyEvent → side effects)      │
+└──────────────────┬───────────────────────────────┘
+                   ▼
+┌────────────────┐  ┌─────────────────┐
+│  Agent Runner  │  │   Workspaces    │
+│  Claude Backend│  │  WorkspaceManager│
+│  Mock Backend  │  │  WorkspaceHooks │
+└───────┬────────┘  └────────┬────────┘
+        └────────┬───────────┘
+                 ▼
+┌──────────────────────────────────────────────────┐
+│            Prompt Rendering (LiquidJS)           │
+└──────────────────────────────────────────────────┘
+```
+
+## Quick Start
+
+```ts
+import {
+  Orchestrator,
+  loadWorkflowConfig,
+  WorkspaceManager,
+  WorkspaceHooks,
+  ClaudeBackend,
+  PromptRenderer,
+  RoadmapTrackerAdapter,
+} from '@harness-engineering/orchestrator';
+
+// Load workflow configuration
+const config = loadWorkflowConfig('./workflow.yaml');
+
+// Create and start the orchestrator
+const orchestrator = new Orchestrator(config);
+await orchestrator.start();
+```
+
+## Core Concepts
+
+### Event-Sourced State Machine
+
+The orchestrator uses an event-sourced architecture. All state transitions are modeled as events (`OrchestratorEvent`) that produce side effects (`SideEffect`):
+
+```ts
+import { applyEvent, createEmptyState } from '@harness-engineering/orchestrator';
+
+const state = createEmptyState();
+const { state: next, effects } = applyEvent(state, event);
+// effects: DispatchEffect, StopEffect, ScheduleRetryEffect, etc.
+```
+
+### Candidate Selection
+
+Issues are ranked and filtered before dispatch:
+
+```ts
+import { sortCandidates, selectCandidates, isEligible } from '@harness-engineering/orchestrator';
+
+const ranked = sortCandidates(issues);
+const selected = selectCandidates(ranked, availableSlots);
+```
+
+### Agent Backends
+
+Two backends are available:
+
+- **`ClaudeBackend`** — Production backend using the Claude API
+- **`MockBackend`** — Test backend for deterministic behavior in tests
+
+### Workspace Management
+
+Each agent run gets an ephemeral workspace with lifecycle hooks:
+
+```ts
+import { WorkspaceManager, WorkspaceHooks } from '@harness-engineering/orchestrator';
+
+const manager = new WorkspaceManager(config);
+const hooks = new WorkspaceHooks(config);
+```
+
+## API
+
+### Orchestrator
+
+The main class that ties everything together:
+
+- `start()` — Begin polling and dispatching
+- `stop()` — Gracefully shut down
+- Events: `state_change`, `agent_event`
+
+### Core Functions
+
+| Export                | Description                                                 |
+| --------------------- | ----------------------------------------------------------- |
+| `applyEvent`          | Apply an event to state, returning new state + side effects |
+| `createEmptyState`    | Create an initial empty orchestrator state                  |
+| `sortCandidates`      | Rank issues by priority and eligibility                     |
+| `selectCandidates`    | Select top candidates within concurrency limits             |
+| `isEligible`          | Check if an issue is eligible for dispatch                  |
+| `getAvailableSlots`   | Get number of available agent slots                         |
+| `canDispatch`         | Check if dispatch is possible given current state           |
+| `reconcile`           | Reconcile expected state against actual state               |
+| `calculateRetryDelay` | Compute exponential backoff delay                           |
+
+### Tracker Adapters
+
+| Export                   | Description                              |
+| ------------------------ | ---------------------------------------- |
+| `RoadmapTrackerAdapter`  | Reads issues from `docs/roadmap.md`      |
+| `LinearTrackerExtension` | Extends tracking with Linear integration |
+
+### Prompt Rendering
+
+| Export           | Description                                  |
+| ---------------- | -------------------------------------------- |
+| `PromptRenderer` | Renders LiquidJS templates for agent prompts |
+
+## License
+
+MIT

package/dist/index.js

@@ -988,7 +988,41 @@ var StructuredLogger = class {
   }
 };
 
+// src/workspace/config-scanner.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_core2 = require("@harness-engineering/core");
+var CONFIG_FILES = ["CLAUDE.md", "AGENTS.md", ".gemini/settings.json", "skill.yaml"];
+function scanSingleFile(filePath, targetDir, scanner) {
+  if (!(0, import_node_fs.existsSync)(filePath)) return null;
+  let content;
+  try {
+    content = (0, import_node_fs.readFileSync)(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  const injectionFindings = (0, import_core2.scanForInjection)(content);
+  const findings = (0, import_core2.mapInjectionFindings)(injectionFindings);
+  const secFindings = scanner.scanContent(content, filePath);
+  findings.push(...(0, import_core2.mapSecurityFindings)(secFindings, findings));
+  return {
+    file: (0, import_node_path.relative)(targetDir, filePath).replaceAll("\\", "/"),
+    findings,
+    overallSeverity: (0, import_core2.computeOverallSeverity)(findings)
+  };
+}
+async function scanWorkspaceConfig(workspacePath) {
+  const scanner = new import_core2.SecurityScanner((0, import_core2.parseSecurityConfig)({}));
+  const results = [];
+  for (const configFile of CONFIG_FILES) {
+    const result = scanSingleFile((0, import_node_path.join)(workspacePath, configFile), workspacePath, scanner);
+    if (result) results.push(result);
+  }
+  return { exitCode: (0, import_core2.computeScanExitCode)(results), results };
+}
+
 // src/orchestrator.ts
+var import_core4 = require("@harness-engineering/core");
 var Orchestrator = class extends import_node_events.EventEmitter {
   state;
   config;
@@ -1113,6 +1147,42 @@ var Orchestrator = class extends import_node_events.EventEmitter {
       const workspaceResult = await this.workspace.ensureWorkspace(issue.identifier);
       if (!workspaceResult.ok) throw workspaceResult.error;
       const workspacePath = workspaceResult.value;
+      const scanResult = await scanWorkspaceConfig(workspacePath);
+      if (scanResult.exitCode === 2) {
+        const findingSummary = scanResult.results.flatMap((r) => r.findings.filter((f) => f.severity === "high")).map((f) => `${f.ruleId}: ${f.message}`).join("; ");
+        this.logger.error(
+          `Config scan blocked dispatch for ${issue.identifier}: ${findingSummary}`,
+          { issueId: issue.id }
+        );
+        await this.emitWorkerExit(
+          issue.id,
+          "error",
+          attempt,
+          `Config scan found high-severity injection patterns: ${findingSummary}`
+        );
+        return;
+      }
+      if (scanResult.exitCode === 1) {
+        const findings = scanResult.results.flatMap(
+          (r) => r.findings.filter((f) => f.severity === "medium").map((f) => ({
+            ruleId: f.ruleId,
+            severity: f.severity,
+            match: f.match,
+            ...f.line !== void 0 ? { line: f.line } : {}
+          }))
+        );
+        (0, import_core4.writeTaint)(
+          workspacePath,
+          issue.id,
+          "Medium-severity injection patterns found in workspace config files",
+          findings,
+          "orchestrator:scan-config"
+        );
+        this.logger.warn(
+          `Config scan found medium-severity patterns for ${issue.identifier}. Session tainted.`,
+          { issueId: issue.id }
+        );
+      }
       const hookResult = await this.hooks.beforeRun(workspacePath);
       if (!hookResult.ok) throw hookResult.error;
       const prompt = await this.renderer.render(this.promptTemplate, {

package/dist/index.mjs

@@ -939,7 +939,49 @@ var StructuredLogger = class {
   }
 };
 
+// src/workspace/config-scanner.ts
+import { existsSync, readFileSync } from "fs";
+import { join as join2, relative } from "path";
+import {
+  scanForInjection,
+  SecurityScanner,
+  parseSecurityConfig,
+  mapInjectionFindings,
+  mapSecurityFindings,
+  computeOverallSeverity,
+  computeScanExitCode
+} from "@harness-engineering/core";
+var CONFIG_FILES = ["CLAUDE.md", "AGENTS.md", ".gemini/settings.json", "skill.yaml"];
+function scanSingleFile(filePath, targetDir, scanner) {
+  if (!existsSync(filePath)) return null;
+  let content;
+  try {
+    content = readFileSync(filePath, "utf8");
+  } catch {
+    return null;
+  }
+  const injectionFindings = scanForInjection(content);
+  const findings = mapInjectionFindings(injectionFindings);
+  const secFindings = scanner.scanContent(content, filePath);
+  findings.push(...mapSecurityFindings(secFindings, findings));
+  return {
+    file: relative(targetDir, filePath).replaceAll("\\", "/"),
+    findings,
+    overallSeverity: computeOverallSeverity(findings)
+  };
+}
+async function scanWorkspaceConfig(workspacePath) {
+  const scanner = new SecurityScanner(parseSecurityConfig({}));
+  const results = [];
+  for (const configFile of CONFIG_FILES) {
+    const result = scanSingleFile(join2(workspacePath, configFile), workspacePath, scanner);
+    if (result) results.push(result);
+  }
+  return { exitCode: computeScanExitCode(results), results };
+}
+
 // src/orchestrator.ts
+import { writeTaint } from "@harness-engineering/core";
 var Orchestrator = class extends EventEmitter {
   state;
   config;
@@ -1064,6 +1106,42 @@ var Orchestrator = class extends EventEmitter {
       const workspaceResult = await this.workspace.ensureWorkspace(issue.identifier);
       if (!workspaceResult.ok) throw workspaceResult.error;
       const workspacePath = workspaceResult.value;
+      const scanResult = await scanWorkspaceConfig(workspacePath);
+      if (scanResult.exitCode === 2) {
+        const findingSummary = scanResult.results.flatMap((r) => r.findings.filter((f) => f.severity === "high")).map((f) => `${f.ruleId}: ${f.message}`).join("; ");
+        this.logger.error(
+          `Config scan blocked dispatch for ${issue.identifier}: ${findingSummary}`,
+          { issueId: issue.id }
+        );
+        await this.emitWorkerExit(
+          issue.id,
+          "error",
+          attempt,
+          `Config scan found high-severity injection patterns: ${findingSummary}`
+        );
+        return;
+      }
+      if (scanResult.exitCode === 1) {
+        const findings = scanResult.results.flatMap(
+          (r) => r.findings.filter((f) => f.severity === "medium").map((f) => ({
+            ruleId: f.ruleId,
+            severity: f.severity,
+            match: f.match,
+            ...f.line !== void 0 ? { line: f.line } : {}
+          }))
+        );
+        writeTaint(
+          workspacePath,
+          issue.id,
+          "Medium-severity injection patterns found in workspace config files",
+          findings,
+          "orchestrator:scan-config"
+        );
+        this.logger.warn(
+          `Config scan found medium-severity patterns for ${issue.identifier}. Session tainted.`,
+          { issueId: issue.id }
+        );
+      }
       const hookResult = await this.hooks.beforeRun(workspacePath);
       if (!hookResult.ok) throw hookResult.error;
       const prompt = await this.renderer.render(this.promptTemplate, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harness-engineering/orchestrator",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Orchestrator daemon for dispatching coding agents to issues",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
@@ -41,8 +41,8 @@
     "chokidar": "^3.5.3",
     "ink": "^4.4.1",
     "react": "^18.2.0",
-    "@harness-engineering/core": "0.13.0",
-    "@harness-engineering/types": "0.3.1"
+    "@harness-engineering/core": "0.16.0",
+    "@harness-engineering/types": "0.6.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",