@hilbras/omninode 2.0.0-alpha.3 → 2.0.0-alpha.4

package/README.md

@@ -18,7 +18,9 @@ existing intelligence; it does not try to become another model.
 
 ## Status
 
-**v2.0.0-alpha.3 — v2 Phase 3: Agent Protocol v2** (after Phase 1: architecture & API stabilization, Phase 2: execution reliability) (the v2
+**v2.0.0-alpha.4 — v2 Phase 4: Agent Adapter Hardening**
+(after Phase 1: architecture & API stabilization, Phase 2: execution reliability,
+Phase 3: agent protocol v2 — the reliability & interoperability line) (the v2
 roadmap is [docs/ROADMAP_V2.md](docs/ROADMAP_V2.md); the v1 plan is complete:
 the
 full loop from §28 runs in one command —
@@ -27,14 +29,28 @@ planner → plan → execution → result` — with audit logging, error recover
 production hardening (see [docs/DEVELOPMENT_PLAN.md](docs/DEVELOPMENT_PLAN.md)
 for the plan and [docs/ARCHITECTURE.md](docs/ARCHITECTURE.md) for the design).
 
-### What changed in v2 Phase 1
-
-- All local stores now build on one shared `JsonFileStore` (atomic writes,
-  serialized read-modify-write, schema-versioned files, corruption tolerance)
-  with a `ProjectStores` facade.
-- Dependency direction corrected (adapters no longer import engine modules).
-- API surface stabilized and guarded: [API_STABILITY.md](docs/API_STABILITY.md),
-  [API.md](docs/API.md), [DEPRECATIONS.md](docs/DEPRECATIONS.md).
+### What's new in v2 (so far)
+
+- **Phase 4 — Agent Adapter Hardening**: process-tree cleanup (agents run in
+  their own process group; timeout, cancel and Ctrl-C reap the whole tree, so
+  no orphaned children), explicit environment policies
+  (`inherit` / `allowlist` / `denylist` / `explicit`), working-directory
+  validation against project boundaries, per-stream output limits that kill
+  runaway agents, binary-safe output decoding, human-readable exit/signal
+  reporting, and a native `IAgentAdapter` registry so new integration styles
+  plug in without touching core.
+- **Phase 3 — Agent Protocol v2**: versioned protocol
+  (`omninode-agent-protocol/2`), fully correlated envelopes, the complete
+  message-type set, HELLO handshake, QUESTION/RESPONSE round-trips, and
+  malformed input that can never crash OmniNode. Spec:
+  [PROTOCOL.md](docs/PROTOCOL.md).
+- **Phase 2 — Execution Reliability**: a task killed after dispatch is
+  `unknown`, **not** `failed` — retries never duplicate side effects blindly;
+  bounded retries with backoff, execution identity and history.
+- **Phase 1 — Architecture & API Stabilization**: one shared `JsonFileStore`
+  behind every local store, corrected dependency direction, and a guarded
+  public API ([API_STABILITY.md](docs/API_STABILITY.md), [API.md](docs/API.md),
+  [DEPRECATIONS.md](docs/DEPRECATIONS.md)).
 
 ### What's in v1.0
 

package/dist/cli/index.js

@@ -6,7 +6,7 @@ import { realpathSync } from "fs";
 import { Command } from "commander";
 
 // src/version.ts
-var OMNINODE_VERSION = "2.0.0-alpha.3";
+var OMNINODE_VERSION = "2.0.0-alpha.4";
 
 // src/errors/index.ts
 var OmniNodeError = class extends Error {
@@ -83,6 +83,11 @@ var agentConfigSchema = z.object({
   input_mode: z.enum(["stdin", "arg", "protocol"]).default("stdin"),
   timeout_ms: z.number().int().positive().optional(),
   inherit_env: z.boolean().optional(),
+  env_policy: z.enum(["inherit", "allowlist", "denylist", "explicit"]).optional(),
+  env_allowlist: z.array(z.string()).optional(),
+  env_denylist: z.array(z.string()).optional(),
+  max_output_bytes: z.number().int().positive().optional(),
+  allow_external_cwd: z.boolean().optional(),
   metadata: z.record(z.unknown()).optional()
 }).strict();
 var roleConfigSchema = z.object({
@@ -257,6 +262,11 @@ function toAgentConfig(raw) {
     inputMode: raw.input_mode,
     timeoutMs: raw.timeout_ms,
     inheritEnv: raw.inherit_env,
+    envPolicy: raw.env_policy,
+    envAllowlist: raw.env_allowlist,
+    envDenylist: raw.env_denylist,
+    maxOutputBytes: raw.max_output_bytes,
+    allowExternalCwd: raw.allow_external_cwd,
     metadata: raw.metadata
   };
 }
@@ -1214,20 +1224,94 @@ var ProtocolSession = class {
   sawV2 = false;
 };
 
-// src/agents/process/index.ts
-var DEFAULT_TIMEOUT_MS2 = 6e5;
-var KILL_GRACE_MS = 5e3;
+// src/agents/cwd.ts
+import { statSync } from "fs";
+import { isAbsolute, relative, resolve } from "path";
+function validateWorkingDirectory(cwd, options = {}) {
+  if (!cwd) return void 0;
+  const normalized = isAbsolute(cwd) ? resolve(cwd) : resolve(process.cwd(), cwd);
+  let stats;
+  try {
+    stats = statSync(normalized);
+  } catch (error) {
+    throw new AgentError(
+      "AGENT_NOT_FOUND",
+      `Working directory "${normalized}" does not exist or is not accessible.`,
+      { cause: error, details: { cwd: normalized } }
+    );
+  }
+  if (!stats.isDirectory()) {
+    throw new AgentError("AGENT_NOT_FOUND", `Working directory "${normalized}" is not a directory.`, {
+      details: { cwd: normalized }
+    });
+  }
+  try {
+    statSync(resolve(normalized, "."));
+  } catch (error) {
+    throw new AgentError(
+      "AGENT_NOT_FOUND",
+      `Working directory "${normalized}" is not accessible.`,
+      { cause: error }
+    );
+  }
+  const projectRoot = resolve(options.projectRoot ?? process.cwd());
+  const rel = relative(projectRoot, normalized);
+  const outsideProject = rel.startsWith("..") || isAbsolute(rel);
+  if (outsideProject && options.allowExternal !== true) {
+    throw new AgentError(
+      "AGENT_NOT_FOUND",
+      `Working directory "${normalized}" is outside the project root "${projectRoot}". Set allow_external_cwd: true on the agent to permit this.`,
+      { details: { cwd: normalized, projectRoot } }
+    );
+  }
+  return { cwd: normalized, outsideProject };
+}
+
+// src/agents/env.ts
+var BASELINE_KEYS = ["PATH", "HOME"];
+function resolveEnvPolicy(config) {
+  if (config.envPolicy !== void 0) return config.envPolicy;
+  if (config.inheritEnv === false) return "explicit";
+  return "inherit";
+}
 function buildChildEnv(config) {
   const configured = config.env ?? {};
-  if (config.inheritEnv !== false) {
+  const policy = resolveEnvPolicy(config);
+  if (policy === "inherit") {
     return { ...process.env, ...configured };
   }
-  return {
-    PATH: process.env.PATH ?? "",
-    HOME: process.env.HOME ?? "",
-    ...configured
-  };
+  const base = {};
+  for (const key of BASELINE_KEYS) {
+    const value = process.env[key];
+    if (value !== void 0) base[key] = value;
+  }
+  switch (policy) {
+    case "explicit":
+      return { ...base, ...configured };
+    case "allowlist": {
+      const allowed = { ...base };
+      for (const key of config.envAllowlist ?? []) {
+        const value = process.env[key];
+        if (value !== void 0) allowed[key] = value;
+      }
+      return { ...allowed, ...configured };
+    }
+    case "denylist": {
+      const denied = new Set((config.envDenylist ?? []).map((k) => k.toUpperCase()));
+      const filtered = {};
+      for (const [key, value] of Object.entries(process.env)) {
+        if (denied.has(key.toUpperCase())) continue;
+        filtered[key] = value;
+      }
+      return { ...filtered, ...configured };
+    }
+  }
 }
+
+// src/agents/process/index.ts
+var DEFAULT_TIMEOUT_MS2 = 6e5;
+var KILL_GRACE_MS = 5e3;
+var DEFAULT_MAX_OUTPUT_BYTES = 5 * 1024 * 1024;
 function composeTaskText(input) {
   const sections = [`# Objective
 ${input.objective}`];
@@ -1289,40 +1373,73 @@ var ProcessAgent = class {
     }
     const mode = this.config.inputMode ?? "stdin";
     const timeoutMs = this.config.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
+      let cwd;
+      try {
+        cwd = validateWorkingDirectory(this.config.cwd, {
+          allowExternal: this.config.allowExternalCwd
+        })?.cwd;
+      } catch (error) {
+        reject(error);
+        return;
+      }
       const child = spawn(
         command,
         [...this.config.args ?? [], ...mode === "arg" ? [composeTaskText(input)] : []],
         {
-          cwd: this.config.cwd,
+          ...cwd !== void 0 ? { cwd } : {},
           env: buildChildEnv(this.config),
-          stdio: ["pipe", "pipe", "pipe"]
+          stdio: ["pipe", "pipe", "pipe"],
+          // Own process group so the whole tree can be terminated together
+          // (roadmap §8: no orphaned children).
+          ...process.platform === "win32" ? {} : { detached: true }
         }
       );
       this.running.set(input.taskId, child);
+      GLOBAL_RUNNING.add(child);
+      installSignalForwarding();
       let stdout = "";
       let stderr = "";
       let timedOut = false;
+      let outputLimitExceeded = false;
       let settled = false;
+      const maxOutputBytes = this.config.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
       const timer = setTimeout(() => {
         timedOut = true;
-        this.log.warn(`Task ${input.taskId} exceeded ${timeoutMs}ms \u2014 killing process.`);
-        child.kill("SIGTERM");
-        setTimeout(() => child.kill("SIGKILL"), KILL_GRACE_MS).unref();
+        this.log.warn(`Task ${input.taskId} exceeded ${timeoutMs}ms \u2014 killing process tree.`);
+        killTree(child, "SIGTERM");
+        setTimeout(() => killTree(child, "SIGKILL"), KILL_GRACE_MS).unref();
       }, timeoutMs);
       const settle = (finish) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
         this.running.delete(input.taskId);
+        GLOBAL_RUNNING.delete(child);
         finish();
       };
-      child.stdout?.on("data", (chunk) => {
-        stdout += chunk.toString();
-      });
-      child.stderr?.on("data", (chunk) => {
-        stderr += chunk.toString();
-      });
+      const collect = (into, chunk) => {
+        if (outputLimitExceeded) return;
+        const text = sanitizeChunk(chunk);
+        if (into === "stdout") {
+          if (stdout.length + text.length > maxOutputBytes) {
+            stdout = (stdout + text).slice(0, maxOutputBytes);
+            outputLimitExceeded = true;
+            this.log.warn(`Agent "${this.config.name}" exceeded the ${maxOutputBytes} byte output limit \u2014 killing it.`);
+            killTree(child, "SIGKILL");
+            return;
+          }
+          stdout += text;
+        } else {
+          if (stderr.length + text.length > maxOutputBytes) {
+            stderr = (stderr + text).slice(0, maxOutputBytes);
+            return;
+          }
+          stderr += text;
+        }
+      };
+      child.stdout?.on("data", (chunk) => collect("stdout", chunk));
+      child.stderr?.on("data", (chunk) => collect("stderr", chunk));
       child.stdin?.on("error", () => {
       });
       if (mode !== "arg") {
@@ -1376,7 +1493,7 @@ var ProcessAgent = class {
           const logs = stderr.trim().length > 0 ? stderr.split("\n") : void 0;
           if (mode === "protocol") {
             try {
-              resolve(
+              resolve2(
                 interpretProtocolRun({
                   input,
                   agentName: this.config.name,
@@ -1391,14 +1508,14 @@ var ProcessAgent = class {
             return;
           }
           const trimmed = stdout.trim();
-          resolve({
+          resolve2({
             taskId: input.taskId,
-            status: code === 0 ? "completed" : "failed",
+            status: code === 0 && !outputLimitExceeded ? "completed" : "failed",
             summary: trimmed.length > 0 ? firstLine(trimmed) : void 0,
             rawOutput: trimmed.length > 0 ? trimmed : void 0,
             exitCode: code ?? void 0,
             logs,
-            error: code === 0 ? void 0 : `Process exited with code ${code ?? "unknown"}${signal ? ` (signal: ${signal})` : ""}`
+            ...outputLimitExceeded ? { error: `Agent exceeded the ${maxOutputBytes} byte output limit and was terminated.` } : code === 0 ? {} : { error: describeExit(code, signal) }
           });
         });
       });
@@ -1407,7 +1524,7 @@ var ProcessAgent = class {
   /** Ask the agent to stop current work (SIGTERM). */
   async cancel(taskId) {
     const child = this.running.get(taskId);
-    if (child) child.kill("SIGTERM");
+    if (child) killTree(child, "SIGTERM");
   }
   runningTaskIds() {
     return [...this.running.keys()];
@@ -1482,6 +1599,43 @@ function interpretProtocolRun({
     ...exitCode !== 0 ? { error: `Process exited with code ${exitCode ?? "unknown"}` } : {}
   };
 }
+var GLOBAL_RUNNING = /* @__PURE__ */ new Set();
+var signalForwardingInstalled = false;
+function installSignalForwarding() {
+  if (signalForwardingInstalled) return;
+  signalForwardingInstalled = true;
+  for (const signal of ["SIGINT", "SIGTERM"]) {
+    process.on(signal, () => {
+      for (const child of GLOBAL_RUNNING) {
+        killTree(child, "SIGTERM");
+      }
+    });
+  }
+}
+function killTree(child, signal) {
+  if (child.pid === void 0) return;
+  if (process.platform !== "win32") {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {
+    }
+  }
+  try {
+    child.kill(signal);
+  } catch {
+  }
+}
+function describeExit(code, signal) {
+  if (signal !== null) {
+    return signal === "SIGKILL" ? "Process was killed (SIGKILL) \u2014 usually an external kill or OOM." : `Process terminated by signal ${signal}.`;
+  }
+  if (code === null) return "Process terminated without an exit code.";
+  return `Process exited with code ${code}.`;
+}
+function sanitizeChunk(chunk) {
+  return chunk.toString("utf8").replace(/\u0000/g, "");
+}
 function normalizeReport(payload, taskId, agentName, index) {
   if (payload === null || typeof payload !== "object") return void 0;
   const raw = payload;
@@ -1501,6 +1655,40 @@ function firstLine(text, maxLength = 200) {
   return line.length > maxLength ? `${line.slice(0, maxLength)}\u2026` : line;
 }
 
+// src/agents/adapters.ts
+var AgentAdapterRegistry = class {
+  adapters = /* @__PURE__ */ new Map();
+  register(adapter) {
+    this.adapters.set(adapter.integration, adapter);
+  }
+  get(integration) {
+    return this.adapters.get(integration);
+  }
+  list() {
+    return [...this.adapters.values()];
+  }
+  create(config) {
+    const adapter = this.get(config.integration);
+    if (!adapter) {
+      throw new AgentError(
+        "AGENT_NOT_FOUND",
+        `No agent adapter registered for integration "${config.integration}". Registered: ${[...this.adapters.keys()].join(", ") || "(none)"}.`
+      );
+    }
+    return adapter.create(config);
+  }
+};
+var ProcessAgentAdapter = class {
+  constructor(factory) {
+    this.factory = factory;
+  }
+  factory;
+  integration = "process";
+  create(config) {
+    return this.factory(config);
+  }
+};
+
 // src/agents/registry.ts
 var AgentRegistry = class {
   agents = /* @__PURE__ */ new Map();
@@ -1516,14 +1704,15 @@ var AgentRegistry = class {
 };
 
 // src/agents/factory.ts
-function createAgent(config) {
-  if (config.integration === "process") {
-    return new ProcessAgent(config);
-  }
+var defaultAgentAdapters = new AgentAdapterRegistry();
+defaultAgentAdapters.register(new ProcessAgentAdapter((config) => new ProcessAgent(config)));
+function createAgent(config, adapters = defaultAgentAdapters) {
+  const registered = adapters.get(config.integration);
+  if (registered) return registered.create(config);
   if (config.integration === "native") {
     throw new OmniNodeError(
       "NOT_IMPLEMENTED",
-      `Native agent adapters are planned for a later phase. Use input over stdin/stdout (type "cli") for "${config.name}" for now.`
+      `No native adapter is registered for "${config.name}". Register an IAgentAdapter (createAgent(config, adapters)) or use input over stdin/stdout (type "cli").`
     );
   }
   throw new OmniNodeError("NOT_IMPLEMENTED", `Agent integration "${config.integration}" has no adapter yet.`);
@@ -1566,7 +1755,7 @@ function registerAgentCommands(program) {
     "--input-mode <mode>",
     "How the task is delivered: stdin (prompt on stdin), arg (prompt as last argument) or protocol (\xA721 JSON-lines task protocol).",
     "stdin"
-  ).option(
+  ).option("--env-policy <policy>", "Environment policy: inherit, allowlist, denylist or explicit.").option("--allow-env <name>", "Variable to forward under the allowlist policy (repeatable).", collectArgs).option("--deny-env <name>", "Variable to remove under the denylist policy (repeatable).", collectArgs).option("--max-output-bytes <n>", "Per-stream output budget in bytes (default 5 MiB).", (value) => Number(value)).option("--allow-external-cwd", "Allow a working directory outside the project root.").option(
     "--timeout-ms <ms>",
     "Per-task timeout in milliseconds.",
     (value) => Number(value)
@@ -1581,7 +1770,12 @@ async function addAgent(options) {
     ...options.arg !== void 0 && options.arg.length > 0 ? { args: options.arg } : {},
     ...options.cwd !== void 0 ? { cwd: options.cwd } : {},
     input_mode: options.inputMode,
-    ...options.timeoutMs !== void 0 ? { timeout_ms: options.timeoutMs } : {}
+    ...options.timeoutMs !== void 0 ? { timeout_ms: options.timeoutMs } : {},
+    ...options.envPolicy !== void 0 ? { env_policy: options.envPolicy } : {},
+    ...options.allowEnv !== void 0 && options.allowEnv.length > 0 ? { env_allowlist: options.allowEnv } : {},
+    ...options.denyEnv !== void 0 && options.denyEnv.length > 0 ? { env_denylist: options.denyEnv } : {},
+    ...options.maxOutputBytes !== void 0 ? { max_output_bytes: options.maxOutputBytes } : {},
+    ...options.allowExternalCwd !== void 0 ? { allow_external_cwd: options.allowExternalCwd } : {}
   });
   if (!candidate.success) {
     const issues = candidate.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
@@ -1985,7 +2179,7 @@ function classifyThrown(error) {
   return "failed";
 }
 function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 
 // src/audit/index.ts