@harness-mix/cli 0.1.5 → 0.1.7

package/src/main/host/store.js

@@ -3,9 +3,14 @@ const path = require("node:path");
 
 /** 线程记录的 JSON 持久化：折叠排队保存 + tmp 文件原子替换，避免中间状态内存堆积 */
 class Store {
-  constructor(directory, filename = "threads.json") {
+  constructor(directory, filename = "threads.json", options = {}) {
     this.directory = directory;
     this.file = path.join(directory, filename);
+    this.schemaVersion = options.schemaVersion ?? null;
+    this.serialize = options.serialize ?? ((value) => value);
+    this.deserialize = options.deserialize ?? ((value) => value);
+    this.backup = options.backup === true;
+    this.backupPending = false;
     this.writing = false;
     this.pendingData = null;
     this.pendingResolvers = [];
@@ -21,17 +26,24 @@ class Store {
     }
     await fs.mkdir(this.directory, { recursive: true });
     try {
-      const threads = JSON.parse(await fs.readFile(this.file, "utf8"));
-      if (!Array.isArray(threads)) throw new Error('Invalid thread store; original file preserved');
-      return threads;
+      const parsed = JSON.parse(await fs.readFile(this.file, "utf8"));
+      if (!Array.isArray(parsed) && this.schemaVersion != null && parsed?.schemaVersion !== this.schemaVersion) {
+        throw new Error(`Unsupported thread store schema: ${parsed?.schemaVersion ?? 'missing'}; original file preserved`);
+      }
+      const threads = Array.isArray(parsed) ? parsed : parsed?.threads;
+      if (!Array.isArray(threads)) throw new Error('Invalid thread store; original file preserved');
+      if (this.backup && Array.isArray(parsed)) this.backupPending = true;
+      return threads.map((thread) => this.deserialize(thread));
     } catch (error) {
       if (error.code === 'ENOENT') return [];
       throw error;
     }
   }
 
-  save(threads) {
-    this.pendingData = threads;
+  save(threads) {
+    // Capture the serializable projection now. Callers may release heavyweight
+    // in-memory checkpoint fields immediately after save() returns.
+    this.pendingData = threads.map((value) => this.serialize(value));
     const promise = new Promise((resolve, reject) => {
       this.pendingResolvers.push(resolve);
       this.pendingRejecters.push(reject);
@@ -52,16 +64,25 @@ class Store {
       this.pendingRejecters = [];
       const tmpFile = `${this.file}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
       try {
-        const contents = JSON.stringify(data, null, 2);
-        await fs.mkdir(this.directory, { recursive: true });
-        await fs.writeFile(tmpFile, contents);
+        const payload = this.schemaVersion == null
+          ? data
+          : { schemaVersion: this.schemaVersion, savedAt: Date.now(), threads: data };
+        const contents = JSON.stringify(payload, null, 2);
+        await fs.mkdir(this.directory, { recursive: true });
+        await fs.writeFile(tmpFile, contents);
+        if (this.backupPending) {
+          await fs.copyFile(this.file, `${this.file}.bak`).catch((error) => {
+            if (error.code !== 'ENOENT') throw error;
+          });
+        }
         for (let attempt = 0; ; attempt++) {
-          try { await fs.rename(tmpFile, this.file); break; }
+          try { await fs.rename(tmpFile, this.file); break; }
           catch (error) {
             if (!['EPERM', 'EACCES', 'EBUSY'].includes(error.code) || attempt === 9) throw error;
             await new Promise(resolve => setTimeout(resolve, 50));
           }
-        }
+        }
+        this.backupPending = false;
         for (const r of resolvers) r();
       } catch (error) {
         await fs.unlink(tmpFile).catch(() => {});

package/src/main/host/thread-storage.js

@@ -0,0 +1,73 @@
+const { Buffer } = require('node:buffer');
+
+const DERIVED_THREAD_FIELDS = [
+  'tools', 'pendingApprovals', 'interactions', 'currentTurn', 'coreThread',
+  'coreUsage', 'usage', 'capabilities', 'coreEnabled',
+];
+const DERIVED_MESSAGE_FIELDS = [
+  'coreTurn', 'coreItems', 'text', 'thinking', 'artifacts', 'at', 'endedAt',
+  'streaming', 'stopReason', 'items',
+];
+
+function compactThread(thread) {
+  // Use structural sharing while serializing. A deep clone here would recreate the
+  // same large transient allocation this format is intended to avoid.
+  const value = { ...thread };
+  if (value.coreState?.version !== 1) return value;
+  for (const key of DERIVED_THREAD_FIELDS) delete value[key];
+  value.messages = (value.messages ?? []).map((message) => {
+    if (message.role !== 'assistant' || !message.coreTurnId) return message;
+    const compact = { ...message };
+    for (const key of DERIVED_MESSAGE_FIELDS) delete compact[key];
+    return compact;
+  });
+  value.storage = { schemaVersion: 2 };
+  return value;
+}
+
+function hydrateThread(thread) {
+  const value = { ...thread };
+  delete value.storage;
+  value.messages ??= [];
+  value.tools ??= [];
+  value.pendingApprovals ??= [];
+  return value;
+}
+
+function byteLength(value) {
+  return Buffer.byteLength(JSON.stringify(value));
+}
+
+function storageProjection(threads) {
+  const rows = threads.map((thread) => {
+    if (thread._storageStub) return {
+      threadId: thread.id, title: thread.title, updatedAt: thread.updatedAt ?? thread.createdAt ?? 0,
+      archived: thread.archived === true, messageCount: thread.messageCount ?? null,
+      logicalBytes: null, persistedBytes: thread.recordBytes ?? null, savedBytes: null, loaded: false,
+    };
+    const logicalBytes = byteLength(thread);
+    const persistedBytes = byteLength(compactThread(thread));
+    return {
+      threadId: thread.id,
+      title: thread.title,
+      updatedAt: thread.updatedAt ?? thread.createdAt ?? 0,
+      archived: thread.archived === true,
+      messageCount: thread.messages?.length ?? 0,
+      logicalBytes,
+      persistedBytes,
+      savedBytes: Math.max(0, logicalBytes - persistedBytes),
+      loaded: true,
+    };
+  }).sort((a, b) => b.persistedBytes - a.persistedBytes);
+  return {
+    schemaVersion: 2,
+    threadCount: rows.length,
+    loadedThreadCount: rows.filter(row => row.loaded).length,
+    logicalBytes: rows.reduce((sum, row) => sum + (row.logicalBytes ?? 0), 0),
+    persistedBytes: rows.reduce((sum, row) => sum + (row.persistedBytes ?? 0), 0),
+    savedBytes: rows.reduce((sum, row) => sum + (row.savedBytes ?? 0), 0),
+    largestThreads: rows.filter(row => row.persistedBytes != null).sort((a, b) => b.persistedBytes - a.persistedBytes).slice(0, 20),
+  };
+}
+
+module.exports = { compactThread, hydrateThread, storageProjection };

package/src/main/host/thread-store.js

@@ -0,0 +1,123 @@
+const fsSync = require('node:fs');
+const { promises: fs } = fsSync;
+const path = require('node:path');
+const { compactThread, hydrateThread } = require('./thread-storage');
+
+const SCHEMA_VERSION = 3;
+
+async function writeAtomic(file, value) {
+  const tmp = `${file}.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}.tmp`;
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  const contents = JSON.stringify(value, null, 2);
+  await fs.writeFile(tmp, contents);
+  for (let attempt = 0; ; attempt++) {
+    try { await fs.rename(tmp, file); return Buffer.byteLength(contents); }
+    catch (error) {
+      if (!['EPERM', 'EACCES', 'EBUSY'].includes(error.code) || attempt === 9) { await fs.unlink(tmp).catch(() => {}); throw error; }
+      await new Promise(resolve => setTimeout(resolve, 50));
+    }
+  }
+}
+
+function recordName(id) { return `${encodeURIComponent(id)}.json`; }
+
+function summarize(thread) {
+  const firstUser = (thread.messages ?? []).find(message => message.role === 'user');
+  const fields = ['id', 'harnessId', 'title', 'cwd', 'originalCwd', 'nativeSessionId', 'status', 'connectionStatus', 'createdAt', 'updatedAt', 'archived', 'section', 'sectionEnteredAt', 'projectId', 'parentThreadId', 'ephemeral', 'gitInfo', 'workspace', 'isolation', 'harnessChain', 'pendingHandoff', 'options', 'model'];
+  const summary = Object.fromEntries(fields.filter(key => thread[key] !== undefined).map(key => [key, thread[key]]));
+  summary.preview = firstUser?.text || thread.preview || thread.title || '';
+  summary.messageCount = thread.messages?.length ?? thread.messageCount ?? 0;
+  if (thread.recordBytes != null) summary.recordBytes = thread.recordBytes;
+  return summary;
+}
+
+class ThreadStore {
+  constructor(directory) {
+    this.directory = directory;
+    this.legacyFile = path.join(directory, 'threads.json');
+    this.shardDirectory = path.join(directory, 'threads');
+    this.recordsDirectory = path.join(this.shardDirectory, 'records');
+    this.indexFile = path.join(this.shardDirectory, 'index.json');
+    this.file = this.indexFile;
+    this.writing = false;
+    this.pending = null;
+    this.waiters = [];
+  }
+  async #readIndex() {
+    try {
+      const value = JSON.parse(await fs.readFile(this.indexFile, 'utf8'));
+      if (value?.schemaVersion !== SCHEMA_VERSION || !Array.isArray(value.threads)) throw new Error('Unsupported sharded thread store; original files preserved');
+      return value;
+    } catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  }
+  async #readLegacy() {
+    try {
+      const value = JSON.parse(await fs.readFile(this.legacyFile, 'utf8'));
+      const threads = Array.isArray(value) ? value : value?.threads;
+      if (!Array.isArray(threads)) throw new Error('Invalid legacy thread store; original file preserved');
+      return threads.map(hydrateThread);
+    } catch (error) { if (error.code === 'ENOENT') return []; throw error; }
+  }
+  async loadIndex() {
+    const index = await this.#readIndex();
+    if (!index) return this.#readLegacy();
+    return index.threads.map(summary => ({
+      ...summary,
+      status: summary.status === 'working' ? 'interrupted' : summary.status === 'opening' ? 'ready' : summary.status,
+      connectionStatus: 'ready',
+      messages: [], tools: [], pendingApprovals: [], _storageStub: true,
+    }));
+  }
+  async load() {
+    const index = await this.#readIndex();
+    if (!index) return this.#readLegacy();
+    return Promise.all(index.threads.map(async summary => hydrateThread(JSON.parse(await fs.readFile(path.join(this.recordsDirectory, recordName(summary.id)), 'utf8')))));
+  }
+  hydrateInto(thread) {
+    if (!thread?._storageStub) return thread;
+    const record = hydrateThread(JSON.parse(fsSync.readFileSync(path.join(this.recordsDirectory, recordName(thread.id)), 'utf8')));
+    for (const key of Object.keys(thread)) delete thread[key];
+    Object.assign(thread, record);
+    return thread;
+  }
+  save(threads) {
+    this.pending = {
+      index: { schemaVersion: SCHEMA_VERSION, savedAt: Date.now(), threads: threads.map(summarize) },
+      records: threads.filter(thread => !thread._storageStub).map(thread => ({ id: thread.id, value: compactThread(thread) })),
+    };
+    const promise = new Promise((resolve, reject) => this.waiters.push({ resolve, reject }));
+    void this.#drain();
+    return promise;
+  }
+  async #drain() {
+    if (this.writing) return;
+    this.writing = true;
+    while (this.pending) {
+      const snapshot = this.pending; this.pending = null;
+      const waiters = this.waiters; this.waiters = [];
+      try {
+        await fs.mkdir(this.recordsDirectory, { recursive: true });
+        if (snapshot.records.length && !fsSync.existsSync(`${this.legacyFile}.bak`)) await fs.copyFile(this.legacyFile, `${this.legacyFile}.bak`).catch(error => { if (error.code !== 'ENOENT') throw error; });
+        for (const record of snapshot.records) {
+          const bytes = await writeAtomic(path.join(this.recordsDirectory, recordName(record.id)), record.value);
+          const summary = snapshot.index.threads.find(thread => thread.id === record.id);
+          if (summary) summary.recordBytes = bytes;
+        }
+        await writeAtomic(this.indexFile, snapshot.index);
+        for (const waiter of waiters) waiter.resolve();
+      } catch (error) { for (const waiter of waiters) waiter.reject(error); }
+    }
+    this.writing = false;
+  }
+  remove(threadId) { return fs.unlink(path.join(this.recordsDirectory, recordName(threadId))).catch(error => { if (error.code !== 'ENOENT') throw error; }); }
+  async inspectFiles() {
+    const index = await fs.stat(this.indexFile).catch(() => null);
+    const legacy = await fs.stat(this.legacyFile).catch(() => null);
+    const records = await fs.readdir(this.recordsDirectory, { withFileTypes: true }).catch(() => []);
+    let recordBytes = 0;
+    for (const entry of records) if (entry.isFile() && entry.name.endsWith('.json')) recordBytes += (await fs.stat(path.join(this.recordsDirectory, entry.name))).size;
+    return { storageSchemaVersion: SCHEMA_VERSION, indexFile: this.indexFile, indexBytes: index?.size ?? 0, recordsDirectory: this.recordsDirectory, recordCount: records.filter(entry => entry.isFile() && entry.name.endsWith('.json')).length, recordBytes, legacyFile: this.legacyFile, legacyBytes: legacy?.size ?? 0 };
+  }
+}
+
+module.exports = { ThreadStore, summarize, SCHEMA_VERSION };

package/src/main/host/verification-gates.js

@@ -0,0 +1,118 @@
+const { spawn } = require('node:child_process');
+const { createHash, randomUUID } = require('node:crypto');
+const { redactText } = require('../native/redact');
+const { terminateTree } = require('../native/process-utils');
+
+const MODES = new Set(['off', 'advisory', 'required']);
+const DEFAULT_CHECKS = Object.freeze({
+  turnCompleted: true,
+  noPendingInteractions: true,
+  noRunningTools: true,
+  noReviewErrors: true,
+  cleanWorkingTree: false,
+});
+
+function normalizePolicy(input = {}) {
+  const mode = MODES.has(input.mode) ? input.mode : 'off';
+  const checks = { ...DEFAULT_CHECKS };
+  for (const key of Object.keys(checks)) if (typeof input.checks?.[key] === 'boolean') checks[key] = input.checks[key];
+  const commands = (Array.isArray(input.commands) ? input.commands : []).slice(0, 8).map((entry, index) => {
+    const command = typeof entry === 'string' ? entry : entry?.command;
+    if (typeof command !== 'string' || !command.trim() || command.length > 512) throw new Error(`Invalid verification command at index ${index}`);
+    if (redactText(command) !== command) throw new Error(`Verification command at index ${index} contains credential-like data; use the native process environment instead`);
+    const timeoutMs = typeof entry === 'object' && Number.isSafeInteger(entry.timeoutMs)
+      ? Math.min(600_000, Math.max(1_000, entry.timeoutMs)) : 120_000;
+    return { id: typeof entry === 'object' && entry.id ? String(entry.id).slice(0, 64) : `command-${index + 1}`, command: command.trim(), timeoutMs };
+  });
+  return { schemaVersion: 1, mode, autoRun: input.autoRun === true, checks, commands };
+}
+
+function runCommand(command, cwd, timeoutMs) {
+  return new Promise((resolve) => {
+    const startedAt = Date.now();
+    const child = spawn(command, { cwd, shell: true, windowsHide: true, env: process.env });
+    let stdout = '', stderr = '', timedOut = false;
+    const append = (current, chunk) => (current + chunk.toString()).slice(-16_000);
+    child.stdout?.on('data', chunk => { stdout = append(stdout, chunk); });
+    child.stderr?.on('data', chunk => { stderr = append(stderr, chunk); });
+    const timer = setTimeout(() => { timedOut = true; void terminateTree(child.pid); }, timeoutMs);
+    child.on('error', error => { stderr = append(stderr, error.message); });
+    child.on('close', (code, signal) => {
+      clearTimeout(timer);
+      resolve({ command, status: !timedOut && code === 0 ? 'passed' : 'failed', exitCode: code, signal, timedOut, stdout: redactText(stdout), stderr: redactText(stderr), durationMs: Date.now() - startedAt });
+    });
+  });
+}
+
+class VerificationGates {
+  constructor(runtime) { this.runtime = runtime; this.running = new Map(); }
+  policy(thread) { return normalizePolicy(thread.verificationGate?.policy); }
+  configure(thread, policy) {
+    const normalized = normalizePolicy(policy);
+    thread.verificationGate = { policy: normalized, latestReport: null };
+    return normalized;
+  }
+  inspect(thread) {
+    const policy = this.policy(thread);
+    const report = thread.verificationGate?.latestReport ?? null;
+    const latestTurnId = this.runtime.execution.lastTurn(thread.id)?.id ?? null;
+    const current = report !== null && report.turnId === latestTurnId;
+    return { policy, report, current, satisfied: policy.mode !== 'required' || (current && report?.status === 'passed') };
+  }
+  assertSatisfied(thread, operation) {
+    const state = this.inspect(thread);
+    if (!state.satisfied) throw new Error(`验证门禁未通过，不能${operation}；请先运行验证`);
+  }
+  invalidate(thread, reason = 'A newer turn changed the task state') {
+    const gate = thread.verificationGate;
+    const report = gate?.latestReport;
+    if (!report || report.status === 'stale') return null;
+    const invalidatedAt = Date.now();
+    const stale = { ...report, status: 'stale', invalidatedAt, invalidationReason: reason };
+    thread.verificationGate = { policy: this.policy(thread), latestReport: stale };
+    if (stale.turnId && this.runtime.core.getTurn(stale.turnId)) {
+      this.runtime.core.dispatch({ threadId: thread.id, turnId: stale.turnId, type: 'verification.updated', payload: { report: stale }, timestamp: invalidatedAt });
+      this.runtime.execution.sync(thread);
+    }
+    return stale;
+  }
+  run(thread, { turnId } = {}) {
+    if (this.running.has(thread.id)) return this.running.get(thread.id);
+    const task = this.#run(thread, turnId).finally(() => this.running.delete(thread.id));
+    this.running.set(thread.id, task);
+    return task;
+  }
+  async #run(thread, turnId) {
+    const policy = this.policy(thread);
+    const startedAt = Date.now();
+    const turn = turnId ? this.runtime.core.getTurn(turnId) : this.runtime.execution.lastTurn(thread.id);
+    const items = turn ? this.runtime.core.getItemsForTurn(turn.id) : [];
+    const checks = [];
+    const add = (id, enabled, passed, detail) => { if (enabled) checks.push({ id, status: passed ? 'passed' : 'failed', detail }); };
+    add('turnCompleted', policy.checks.turnCompleted, turn?.status === 'completed', turn ? `Turn status: ${turn.status}` : 'No completed Turn');
+    add('noPendingInteractions', policy.checks.noPendingInteractions, !(thread.interactions?.length), `${thread.interactions?.length ?? 0} pending interaction(s)`);
+    add('noRunningTools', policy.checks.noRunningTools, !items.some(item => item.type === 'tool_call' && item.state === 'running'), 'No running tools');
+    add('noReviewErrors', policy.checks.noReviewErrors, !(thread.messages ?? []).some(message => message.coreTurnId === turn?.id && message.reviewError), 'Workspace review settled without error');
+    if (policy.checks.cleanWorkingTree) {
+      const git = await runCommand('git status --porcelain', thread.cwd, 30_000);
+      checks.push({ id: 'cleanWorkingTree', status: git.status === 'passed' && !git.stdout.trim() ? 'passed' : 'failed', detail: git.status === 'passed' ? (git.stdout.trim() || 'Working tree clean') : (git.stderr || 'git status failed') });
+    }
+    const commands = [];
+    for (const entry of policy.commands) commands.push({ id: entry.id, ...await runCommand(entry.command, thread.cwd, entry.timeoutMs) });
+    const failed = [...checks, ...commands].some(result => result.status !== 'passed');
+    const report = {
+      schemaVersion: 1, reportId: `verification_${randomUUID()}`, threadId: thread.id,
+      turnId: turn?.id ?? null, mode: policy.mode, status: failed ? 'failed' : 'passed',
+      startedAt, completedAt: Date.now(), checks, commands,
+    };
+    report.contentDigest = createHash('sha256').update(JSON.stringify(report)).digest('hex');
+    thread.verificationGate = { policy, latestReport: report };
+    if (turn) {
+      this.runtime.core.dispatch({ threadId: thread.id, turnId: turn.id, type: 'verification.updated', payload: { report }, timestamp: report.completedAt });
+      this.runtime.execution.sync(thread);
+    }
+    return report;
+  }
+}
+
+module.exports = { VerificationGates, normalizePolicy, DEFAULT_CHECKS };