@humain/humain-code 0.3.7 → 0.4.0

package/dist/core/tools/subagent.js

@@ -122,20 +122,44 @@ function findNearestProjectAgentsDir(cwd) {
         currentDir = parentDir;
     }
 }
+/**
+ * Absolute directory of trusted packaged agents, set by a parent process that ships personas (Flow). Loaded at
+ * user trust: below the user agents dir, above project agents, which can never shadow a name defined here.
+ */
+export const TRUSTED_AGENTS_DIR_ENV = "HUMAIN_TERMINAL_TRUSTED_AGENTS_DIR";
+function loadTrustedAgents() {
+    const dir = process.env[TRUSTED_AGENTS_DIR_ENV];
+    if (!dir)
+        return { agents: [], diagnostics: [] };
+    if (!path.isAbsolute(dir)) {
+        return {
+            agents: [],
+            diagnostics: [{ type: "warning", message: `${TRUSTED_AGENTS_DIR_ENV} must be an absolute path`, path: dir }],
+        };
+    }
+    return loadAgentsFromDir(dir, "user");
+}
 export function discoverAgents(cwd, scope) {
     const userDir = path.join(getAgentDir(), "agents");
     const projectAgentsDir = findNearestProjectAgentsDir(cwd);
     const emptyResult = { agents: [], diagnostics: [] };
+    const trustedResult = scope === "project" ? emptyResult : loadTrustedAgents();
     const userResult = scope === "project" ? emptyResult : loadAgentsFromDir(userDir, "user");
     const projectResult = scope === "user" || !projectAgentsDir ? emptyResult : loadAgentsFromDir(projectAgentsDir, "project");
     const agentMap = new Map();
     if (scope === "both") {
-        for (const agent of userResult.agents)
+        for (const agent of trustedResult.agents)
             agentMap.set(agent.name, agent);
-        for (const agent of projectResult.agents)
+        for (const agent of userResult.agents)
             agentMap.set(agent.name, agent);
+        for (const agent of projectResult.agents) {
+            if (!trustedResult.agents.some((trusted) => trusted.name === agent.name))
+                agentMap.set(agent.name, agent);
+        }
     }
     else if (scope === "user") {
+        for (const agent of trustedResult.agents)
+            agentMap.set(agent.name, agent);
         for (const agent of userResult.agents)
             agentMap.set(agent.name, agent);
     }
@@ -146,7 +170,7 @@ export function discoverAgents(cwd, scope) {
     return {
         agents: Array.from(agentMap.values()),
         projectAgentsDir,
-        diagnostics: [...userResult.diagnostics, ...projectResult.diagnostics],
+        diagnostics: [...trustedResult.diagnostics, ...userResult.diagnostics, ...projectResult.diagnostics],
     };
 }
 // --- Formatting helpers ---
@@ -266,6 +290,7 @@ export function toProgressDetails(results) {
         attempt: result.attempt,
         exitCode: result.exitCode,
         usage: result.usage,
+        ...(result.usageIncomplete ? { usageIncomplete: true } : {}),
         model: result.model,
         stopReason: result.stopReason,
         errorMessage: result.errorMessage,
@@ -343,6 +368,59 @@ function getResultDisplayItems(result) {
 function getResultFinalOutput(result) {
     return isProgressResult(result) ? result.latestText : getFinalOutput(result.messages);
 }
+/** Env var Flow sets to the verified approved-inputs file; inherited by every nested child. */
+export const FLOW_APPROVED_INPUTS_ENV = "HUMAIN_FLOW_APPROVED_INPUTS_FILE";
+/** Mirrors MAX_APPROVED_INPUT_BYTES in packages/flow/src/run-admission.ts; coding-agent must not import @humain/flow. */
+export const MAX_FLOW_APPROVED_INPUT_BYTES = 256 * 1024;
+/** Mirrors APPROVED_INPUTS_HEADER in packages/flow/src/run-admission.ts (first line of approvedInputsBlock). */
+export const FLOW_APPROVED_INPUTS_HEADER = "## Approved inputs (mandatory)";
+/**
+ * Snapshot the Flow approved-inputs file named by the env var. Unset -> undefined. Set but anything fails
+ * (absolute path, basename, no symlink, regular file, owner, mode 0600, size, header) -> throws, so a child
+ * never launches without its mandatory inputs. Bytes are read once from the opened fd.
+ */
+export function readFlowApprovedInputs(env) {
+    const file = env[FLOW_APPROVED_INPUTS_ENV];
+    if (file === undefined)
+        return undefined;
+    const refuse = (why) => {
+        throw new Error(`Refusing to launch subagent: Flow approved inputs (${FLOW_APPROVED_INPUTS_ENV}) ${why}.`);
+    };
+    if (!path.isAbsolute(file) || path.basename(file) !== "approved-inputs.md")
+        return refuse("must be an absolute path to approved-inputs.md");
+    let fd;
+    try {
+        fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile())
+            return refuse("is not a regular file");
+        if (process.getuid && (stat.uid !== process.getuid() || (stat.mode & 0o777) !== 0o600))
+            return refuse("must be owned by the current user with mode 0600");
+        if (stat.size > MAX_FLOW_APPROVED_INPUT_BYTES)
+            return refuse("is too large");
+        const buffer = Buffer.alloc(MAX_FLOW_APPROVED_INPUT_BYTES + 1);
+        let size = 0;
+        while (size <= MAX_FLOW_APPROVED_INPUT_BYTES) {
+            const n = fs.readSync(fd, buffer, size, MAX_FLOW_APPROVED_INPUT_BYTES + 1 - size, null);
+            if (n === 0)
+                break;
+            size += n;
+        }
+        if (size > MAX_FLOW_APPROVED_INPUT_BYTES)
+            return refuse("is too large");
+        const text = buffer.subarray(0, size).toString("utf-8");
+        return text.startsWith(FLOW_APPROVED_INPUTS_HEADER) ? text : refuse("lacks the approved-inputs header");
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("Refusing to launch subagent"))
+            throw error;
+        return refuse(`cannot be read (${error.code ?? "error"})`);
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
 async function writePromptToTempFile(agentName, prompt) {
     const tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "humain-subagent-"));
     const safeName = agentName.replace(/[^\w.-]+/g, "_");
@@ -437,6 +515,8 @@ async function runSingleAgent(defaultCwd, agents, agentDiagnostics, agentName, t
         args.push("--thinking", options.thinking);
     let tmpPromptDir = null;
     let tmpPromptPath = null;
+    let tmpInputsDir = null;
+    let tmpInputsPath = null;
     const currentResult = {
         agent: agentName,
         agentSource: agent.source,
@@ -481,6 +561,14 @@ async function runSingleAgent(defaultCwd, agents, agentDiagnostics, agentName, t
             currentResult.isolationDegradedReason = isolationDegradedReason;
         if (signal?.aborted)
             throw new Error("Subagent was aborted");
+        // Snapshot into a subagent-owned temp file; the env path itself is never passed on the command line.
+        const approvedInputs = readFlowApprovedInputs(process.env);
+        if (approvedInputs !== undefined) {
+            const tmp = await writePromptToTempFile("flow-approved-inputs", approvedInputs);
+            tmpInputsDir = tmp.dir;
+            tmpInputsPath = tmp.filePath;
+            args.push("--append-system-prompt", tmpInputsPath);
+        }
         if (agent.systemPrompt.trim()) {
             const tmp = await writePromptToTempFile(agent.name, agent.systemPrompt);
             tmpPromptDir = tmp.dir;
@@ -548,6 +636,16 @@ async function runSingleAgent(defaultCwd, agents, agentDiagnostics, agentName, t
                     /* observation never affects execution */
                 }
             };
+            const addUsage = (usage) => {
+                for (const key of ["input", "output", "cacheRead", "cacheWrite"]) {
+                    const count = usage?.[key];
+                    if (typeof count === "number" && Number.isSafeInteger(count) && count >= 0)
+                        currentResult.usage[key] += count;
+                    else
+                        currentResult.usageIncomplete = true;
+                }
+                currentResult.usage.cost += usage?.cost?.total || 0;
+            };
             const processLine = (line) => {
                 if (!line.trim())
                     return;
@@ -558,20 +656,20 @@ async function runSingleAgent(defaultCwd, agents, agentDiagnostics, agentName, t
                 catch {
                     return;
                 }
+                if (!event || typeof event !== "object")
+                    return;
+                if (event.type === "compaction_end" && event.result?.usage) {
+                    addUsage(event.result.usage);
+                    emitUpdate();
+                }
                 if (event.type === "message_end" && event.message) {
                     const msg = event.message;
                     currentResult.messages.push(msg);
                     if (msg.role === "assistant") {
                         currentResult.usage.turns++;
-                        const usage = msg.usage;
-                        if (usage) {
-                            currentResult.usage.input += usage.input || 0;
-                            currentResult.usage.output += usage.output || 0;
-                            currentResult.usage.cacheRead += usage.cacheRead || 0;
-                            currentResult.usage.cacheWrite += usage.cacheWrite || 0;
-                            currentResult.usage.cost += usage.cost?.total || 0;
-                            currentResult.usage.contextTokens = usage.totalTokens || 0;
-                        }
+                        addUsage(msg.usage);
+                        if (msg.usage)
+                            currentResult.usage.contextTokens = msg.usage.totalTokens || 0;
                         if (msg.model)
                             currentResult.model = msg.responseModel ?? msg.model;
                         if (msg.stopReason)
@@ -785,6 +883,20 @@ async function runSingleAgent(defaultCwd, agents, agentDiagnostics, agentName, t
             catch {
                 /* ignore */
             }
+        if (tmpInputsPath)
+            try {
+                fs.unlinkSync(tmpInputsPath);
+            }
+            catch {
+                /* ignore */
+            }
+        if (tmpInputsDir)
+            try {
+                fs.rmdirSync(tmpInputsDir);
+            }
+            catch {
+                /* ignore */
+            }
     }
     options.traceChild?.finishAttempt(currentResult, isFailedResult(currentResult));
     return currentResult;