@indigoai-us/hq-cli 5.239.0 → 5.241.0

package/dist/lib/agent-kit/creds.js

@@ -7,6 +7,22 @@
  * module reads `~/.hq/cognito-tokens.json` — a human's session is never
  * consulted, copied, or reused by an agent identity (policy
  * never-extract-stored-session-tokens-to-forge-privileged-calls).
+ *
+ * NOT EVERY FILESYSTEM CAN KEEP THAT PROMISE. A CIFS/SMB mount (Azure Files
+ * is the one that found this) is mounted with a fixed `file_mode` and fails
+ * `chmod` outright with EPERM; an NFS export or a Docker volume may accept
+ * the call and ignore it. A bot whose only persistent storage is such a
+ * share used to be unable to enroll at all — enrollment died on the chmod,
+ * leaving a stray temp file behind, and the only alternative was to keep the
+ * identity on disposable storage where a rebuild erases it.
+ *
+ * So the write no longer fails there: it reports whether owner-only
+ * permissions actually took, and the caller says so out loud. The file is
+ * still requested 0600 at creation, the outcome is read back from the
+ * filesystem rather than assumed, and a host that cannot honour it learns
+ * that its credential is readable by anything else with access to the same
+ * share. Refusing to enroll would not have made that credential safer; it
+ * would only have moved it somewhere it silently disappears.
  */
 import { createHash, createPublicKey, generateKeyPairSync } from "node:crypto";
 import * as fs from "node:fs";
@@ -23,20 +39,73 @@ export function generateHostKeyPair() {
     const publicPem = publicKey.export({ type: "spki", format: "pem" }).toString();
     return { privatePem, publicPem, fingerprint: hostFingerprint(publicPem) };
 }
+/**
+ * chmod failures that mean "this filesystem does not do modes" rather than
+ * "something is wrong". Anything else still throws: a refused chmod on a
+ * local disk is a real fault and must not be swallowed.
+ */
+const MODE_UNSUPPORTED_CODES = new Set([
+    "EPERM",
+    "EACCES",
+    "EINVAL",
+    "ENOTSUP",
+    "EOPNOTSUPP",
+]);
 /** Write a file atomically with the given mode, replacing any existing one. */
 function writePrivateFile(dest, contents, mode) {
     fs.mkdirSync(path.dirname(dest), { recursive: true, mode: 0o700 });
-    const tmp = `${dest}.tmp.${process.pid}`;
-    fs.writeFileSync(tmp, contents, { mode });
-    fs.chmodSync(tmp, mode);
-    fs.renameSync(tmp, dest);
+    // Date.now() as well as the pid: two writes from one process must not
+    // collide on a temp name, and a leftover from a crashed run must not be
+    // adopted by the next one.
+    const tmp = `${dest}.tmp.${process.pid}.${Date.now()}`;
+    let chmodError;
+    try {
+        fs.writeFileSync(tmp, contents, { mode });
+        try {
+            fs.chmodSync(tmp, mode);
+        }
+        catch (err) {
+            const code = err.code ?? "";
+            if (!MODE_UNSUPPORTED_CODES.has(code))
+                throw err;
+            chmodError = code;
+        }
+        // Read the truth back rather than trusting either call: a mount can
+        // accept chmod and ignore it just as easily as it can refuse.
+        let observedMode;
+        try {
+            observedMode = fs.statSync(tmp).mode & 0o777;
+        }
+        catch {
+            /* stat is not worth failing a write over */
+        }
+        fs.renameSync(tmp, dest);
+        return {
+            enforced: observedMode === undefined ? !chmodError : (observedMode & 0o077) === 0,
+            ...(observedMode === undefined ? {} : { observedMode }),
+            ...(chmodError ? { chmodError } : {}),
+        };
+    }
+    catch (err) {
+        // Never leave the temp file behind — it holds the same secret as the
+        // file that failed to land.
+        try {
+            fs.unlinkSync(tmp);
+        }
+        catch {
+            /* already gone */
+        }
+        throw err;
+    }
 }
 export function writeHostKeyPair(paths, pair) {
-    writePrivateFile(paths.hostKeyPath, pair.privatePem, 0o600);
+    const key = writePrivateFile(paths.hostKeyPath, pair.privatePem, 0o600);
+    // The public half is public; its mode is not a promise worth reporting.
     writePrivateFile(paths.hostKeyPubPath, pair.publicPem, 0o644);
+    return key;
 }
 export function writeMachineCreds(paths, creds) {
-    writePrivateFile(paths.machineCredsPath, `${JSON.stringify(creds, null, 2)}\n`, 0o600);
+    return writePrivateFile(paths.machineCredsPath, `${JSON.stringify(creds, null, 2)}\n`, 0o600);
 }
 /**
  * Read the creds file without trusting it: returns null unless it is an

package/dist/lib/lanes/approval-gate.d.ts

@@ -0,0 +1,8 @@
+import type { LaneEnvelope, LaneRecord } from "./types.js";
+export interface RegistryApprovalGateResult {
+    envelope: LaneEnvelope;
+    approvedIdsToConsume: string[];
+    violation: boolean;
+}
+export declare function enforceRegistryApprovalGate(lane: LaneRecord, envelope: LaneEnvelope): RegistryApprovalGateResult;
+//# sourceMappingURL=approval-gate.d.ts.map

package/dist/lib/lanes/approval-gate.js

@@ -0,0 +1,90 @@
+function record(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function text(value) {
+    return typeof value === "string" && value.trim() !== "" ? value.trim() : undefined;
+}
+function externalActionCheckpoint(artifactValue) {
+    const artifact = record(artifactValue);
+    if (!artifact)
+        return undefined;
+    const kind = (text(artifact.kind) ?? text(artifact.type) ?? "").toLowerCase().replace(/[\s-]+/g, "_");
+    const status = (text(artifact.status) ?? text(artifact.state) ?? "").toLowerCase();
+    const hasDate = (...keys) => keys.some((key) => text(artifact[key]) !== undefined);
+    const url = text(artifact.url) ?? "";
+    const mergedPr = (["pr", "pull_request", "merged_pr"].includes(kind) ||
+        /\/(?:pull|pulls|merge_requests)\/\d+(?:\/|$)/i.test(url)) &&
+        (status === "merged" || artifact.merged === true || hasDate("merged_at")) ||
+        artifact.merged === true || status === "merged";
+    const pushedTag = (["tag", "git_tag"].includes(kind) ||
+        text(artifact.tag) !== undefined || text(artifact.tag_name) !== undefined) &&
+        (status === "pushed" || artifact.pushed === true || hasDate("pushed_at"));
+    const publishedPackage = (["package", "npm_package", "published_package"].includes(kind) ||
+        text(artifact.package) !== undefined || text(artifact.package_name) !== undefined) &&
+        (status === "published" || artifact.published === true || hasDate("published_at"));
+    const deployment = ["deploy", "deployment", "deployed"].includes(kind) &&
+        (status === "" || ["deployed", "success", "succeeded", "successful", "complete", "completed", "live"].includes(status) ||
+            artifact.deployed === true || hasDate("deployed_at"));
+    if (!mergedPr && !pushedTag && !publishedPackage && !deployment)
+        return undefined;
+    return text(artifact.checkpoint) ?? null;
+}
+function approvedEvents(history, workerId, workerYamlSha256) {
+    const consumed = new Set(history.flatMap((entry) => entry.event === "consumed" ? [entry.approval_id] : []));
+    return history.filter((entry) => entry.event === "approved" &&
+        entry.registry_worker_id === workerId &&
+        entry.worker_yaml_sha256 === workerYamlSha256 &&
+        !consumed.has(entry.approval_id));
+}
+export function enforceRegistryApprovalGate(lane, envelope) {
+    const registryWorker = lane.registry_worker;
+    const gateEnabled = registryWorker !== undefined &&
+        (registryWorker.approval_required || registryWorker.human_checkpoints.length > 0);
+    if (!gateEnabled || envelope.decision !== "done") {
+        return { envelope, approvedIdsToConsume: [], violation: false };
+    }
+    const actionCheckpoints = envelope.artifacts
+        .map(externalActionCheckpoint)
+        .filter((checkpoint) => checkpoint !== undefined);
+    if (actionCheckpoints.length === 0) {
+        return { envelope, approvedIdsToConsume: [], violation: false };
+    }
+    const missingCheckpoint = actionCheckpoints.includes(null);
+    const requiredCheckpoints = [...new Set(actionCheckpoints.filter((checkpoint) => checkpoint !== null))];
+    const configuredCheckpoints = registryWorker.human_checkpoints.length > 0
+        ? new Set(registryWorker.human_checkpoints)
+        : new Set(["external_publish"]);
+    const approvals = approvedEvents(lane.registry_worker_approval_history ?? [], registryWorker.id, registryWorker.worker_yaml_sha256);
+    const used = [];
+    const missing = missingCheckpoint ? ["(checkpoint missing)"] : [];
+    for (const checkpoint of requiredCheckpoints) {
+        if (!configuredCheckpoints.has(checkpoint)) {
+            missing.push(checkpoint);
+            continue;
+        }
+        const approval = approvals.find((entry) => entry.checkpoint === checkpoint && !used.includes(entry.approval_id));
+        if (!approval)
+            missing.push(checkpoint);
+        else
+            used.push(approval.approval_id);
+    }
+    if (missing.length === 0) {
+        return { envelope, approvedIdsToConsume: used, violation: false };
+    }
+    return {
+        envelope: {
+            ...envelope,
+            decision: "blocked",
+            summary: `External action requires senior approval at checkpoint: ${missing.join(", ")}.`,
+            story_status: "review",
+            blocked_reason: "approval_gate_violated",
+            story_complete: false,
+            story_complete_reason: "The reported external action has no matching recorded approval.",
+        },
+        approvedIdsToConsume: [],
+        violation: true,
+    };
+}
+//# sourceMappingURL=approval-gate.js.map

package/dist/lib/lanes/claude-balance.d.ts

@@ -70,6 +70,8 @@ export declare function selectClaudeAccount(input: {
     config: LanesConfig;
     allowedAccounts?: readonly string[];
     model?: string;
+    /** Keep the recorded account eligible for its already-running CLI model. */
+    recordedModelAccount?: string;
     explicitAccount?: string;
     unavailableHosts?: readonly BalanceHostGap[];
 }): ClaudeAccountSelection;

package/dist/lib/lanes/claude-balance.js

@@ -104,7 +104,8 @@ function buildLoads(input) {
         const hosts = input.hosts.map((host) => accountHostLoad(host, account));
         const targetLoad = hosts.find((host) => sameHost(host.host, targetHost));
         const configuredModel = configAccounts[account]?.model;
-        const ineligible = targetIneligibilityReason(account, configAccounts[account]?.enabled === true, input.allowedAccounts, targetLoad) ?? (input.model !== undefined && configuredModel !== undefined && configuredModel !== input.model
+        const ineligible = targetIneligibilityReason(account, configAccounts[account]?.enabled === true, input.allowedAccounts, targetLoad) ?? (account !== input.recordedModelAccount &&
+            input.model !== undefined && configuredModel !== undefined && configuredModel !== input.model
             ? "model_mismatch"
             : undefined);
         if (ineligible !== undefined)

package/dist/lib/lanes/errors.d.ts

@@ -34,6 +34,6 @@ export declare class AccountResolutionError extends LanesError {
     constructor(error: "unknown_account" | "account_disabled" | "no_enabled_account" | "account_model_unavailable" | "account_quota_exhausted", message: string, details?: Record<string, unknown>);
 }
 export declare class WorkerResolutionError extends LanesError {
-    constructor(error: "worker_not_found" | "worker_tenancy_unresolved" | "worker_not_available" | "worker_not_active" | "worker_id_conflict" | "worker_profile_invalid" | "worker_policy_invalid" | "worker_profile_ambiguous" | "package_workers_unmounted" | "worker_registry_unreadable", message: string, details?: Record<string, unknown>);
+    constructor(error: "worker_not_found" | "worker_tenancy_unresolved" | "worker_not_available" | "worker_not_active" | "worker_id_conflict" | "worker_profile_invalid" | "worker_policy_invalid" | "worker_profile_ambiguous" | "package_workers_unmounted" | "worker_registry_unreadable" | "registry_worker_not_found" | "registry_worker_company_mismatch" | "registry_worker_inactive" | "registry_worker_invalid" | "registry_worker_unreadable" | "registry_worker_ambiguous", message: string, details?: Record<string, unknown>);
 }
 //# sourceMappingURL=errors.d.ts.map

package/dist/lib/lanes/index.d.ts

@@ -56,8 +56,10 @@ export type { KnownModels, KnownModelsDeps, ProbeCommand, ProbeResult } from "./
 export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export type { SessionCopyPlan, SessionCopyResult } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
-export { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, personalWorkerProfileDir, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, materializeWorkerProfile, personalWorkerProfileDir, REGISTRY_PERSONA_PROMPT_MAX_CHARS, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { loadRegistryPersonaFromRecord, registryWorkerRecord, resolveRegistryPersona, } from "./registry-persona.js";
 export type { WorkerProfile, WorkerProfileMeta, WorkerProfileRuntime, } from "./profile.js";
+export type { RegistryPersona } from "./registry-persona.js";
 export type { RegistryWorkerEntry, ResolvedLaneWorker, WorkerTenancy, WorkerYaml, } from "./registry.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export type { QuestionBody, RaiseLaneQuestionInput } from "./questions.js";

package/dist/lib/lanes/index.js

@@ -31,7 +31,8 @@ export { PROVIDER_REJECTED_REASON, PROVIDER_REJECTION_MESSAGE_CAP, parseClaudeRe
 export { CODEX_MODELS_CACHE_NAME, MODEL_PROBE_TIMEOUT_MS, claudeKnownModels, codexKnownModels, defaultProbe, grokKnownModels, knownModels, modelIsKnown, parseClaudeHelpModels, parseGrokModelsOutput, validateLaneModel, } from "./models.js";
 export { SESSION_MOVE_REASON, copySessionFiles, encodeClaudeProjectDir, findCodexRollout, planClaudeSessionCopy, planCodexSessionCopy, planSessionCopy, } from "./move-account.js";
 export { WORKER_REGISTRY_REL, personalWorkerDir, personalWorkerExists, readWorkerRegistryFile, registryPath, resolveContextBasePaths, resolveLaneWorker, resolveSkillFiles, tenancyFromRegistryPath, } from "./registry.js";
-export { ignoredWorkerProfileFields, loadWorkerProfile, materializeWorkerProfile, personalWorkerProfileDir, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { ignoredWorkerProfileFields, loadWorkerProfile, loadWorkerProfileWithRegistry, materializeWorkerProfile, personalWorkerProfileDir, REGISTRY_PERSONA_PROMPT_MAX_CHARS, workerProfileMarker, workerProfilePrompt, } from "./profile.js";
+export { loadRegistryPersonaFromRecord, registryWorkerRecord, resolveRegistryPersona, } from "./registry-persona.js";
 export { bodyStoreForLane, envelopeQuestionId, parseQuestionBodyStore, questionBodyAbsPath, questionBodyRef, raiseEnvelopeQuestions, raiseLaneQuestion, sha256Text, writeQuestionBody, } from "./questions.js";
 export { LANE_DELIVERY_MECHANISMS, LAUNCH_TRIGGERS, PROVIDER_SESSION_RESUME, PROVIDER_SESSION_PORTABLE, providerSessionPortable, sessionNotPortableMessage, parseGrokResultOutput, RESUMABLE_LANE_STATES, RESUME_COMMAND_STATES, SESSION_ID_ABSENT_REASONS, claimableStatesFor, deliveryRefusalReason, hasRecordedSessionId, isResumableLaneState, isResumeCommandState, laneDeliveryMechanism, parseClaudeResultOutput, parseCodexEventOutput, parseWorkerRunOutput, planLaneLaunch, providerSupportsSessionResume, readWorkerRunResult, resumeCommandRefusal, } from "./delivery.js";
 export { DROPBOX_DIR, INBOX_NAME, appendDropboxMessage, answerDropboxMessage, drainDropbox, dropboxDir, dropboxInboxPath, formatOperatorInstruction, hookAdditionalContextJson, laneAcceptsDropboxDelivery, laneAcceptsOperatorMessage, laneIdForAnswerDelivery, operatorMessageRefusalReason, readToolActivity, recordToolActivity, runDrainHook, toolActivityPath, TOOL_ACTIVITY_NAME, } from "./dropbox.js";

package/dist/lib/lanes/outpost-dispatch.d.ts

@@ -27,7 +27,7 @@ export interface OutpostDispatchResult {
     stderr: string;
 }
 export interface OutpostLaneCommand {
-    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target" | "reparent-target";
+    action: "message" | "resume" | "stop" | "show" | "grant" | "grant-target" | "reparent-target" | "approve-target";
     laneId: string;
     hqBinary?: string;
     text?: string;
@@ -43,6 +43,7 @@ export interface OutpostLaneCommand {
     hire?: string;
     grantContext?: string;
     profileRepinContext?: string;
+    approvalContext?: string;
     senior?: string;
     reason?: string;
     compact?: boolean;

package/dist/lib/lanes/outpost-dispatch.js

@@ -151,6 +151,7 @@ export function buildOutpostLaneCommand(input) {
         ["--hire", input.hire],
         ["--grant-context", input.grantContext],
         ["--profile-repin-context", input.profileRepinContext],
+        ["--approval-context", input.approvalContext],
         ["--failed-resume-context", input.failedResumeContext],
         ["--senior", input.senior],
         ["--reason", input.reason],

package/dist/lib/lanes/outpost-registry-worker-approval.d.ts

@@ -0,0 +1,18 @@
+import { type SeniorRef } from "./types.js";
+declare const APPROVAL_CONTEXT_SCHEMA: "hq-lane-registry-worker-approval-context.v1";
+export interface OutpostRegistryWorkerApprovalContext {
+    schema_version: typeof APPROVAL_CONTEXT_SCHEMA;
+    lane_id: string;
+    expected_senior: SeniorRef;
+    actor: string;
+    checkpoint: string;
+    reason: string;
+    approval_id: string;
+    registry_worker_id: string;
+    worker_yaml_sha256: string;
+    at: string;
+}
+export declare function createOutpostRegistryWorkerApprovalContext(input: Omit<OutpostRegistryWorkerApprovalContext, "schema_version">): string;
+export declare function parseOutpostRegistryWorkerApprovalContext(encoded: string, expectedLaneId: string): OutpostRegistryWorkerApprovalContext;
+export {};
+//# sourceMappingURL=outpost-registry-worker-approval.d.ts.map

package/dist/lib/lanes/outpost-registry-worker-approval.js

@@ -0,0 +1,109 @@
+import { LanesError } from "./errors.js";
+import { isSeniorKind } from "./types.js";
+const APPROVAL_CONTEXT_SCHEMA = "hq-lane-registry-worker-approval-context.v1";
+const MAX_CONTEXT_BYTES = 16 * 1024;
+function contextError(message) {
+    return new LanesError("registry_worker_approval_context_invalid", message, {});
+}
+function copySenior(senior) {
+    return senior.id === undefined
+        ? { kind: senior.kind }
+        : { kind: senior.kind, id: senior.id };
+}
+function parseSenior(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    if (Object.keys(record).some((key) => key !== "kind" && key !== "id"))
+        return null;
+    if (!isSeniorKind(record.kind))
+        return null;
+    if (record.id !== undefined &&
+        (typeof record.id !== "string" || !record.id.trim() || record.id.trim() !== record.id))
+        return null;
+    if ((record.kind === "session" || record.kind === "lane") && record.id === undefined)
+        return null;
+    if (record.kind === "user" && record.id !== undefined)
+        return null;
+    return copySenior({ kind: record.kind, ...(record.id === undefined ? {} : { id: record.id }) });
+}
+function nonEmpty(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+export function createOutpostRegistryWorkerApprovalContext(input) {
+    if (!nonEmpty(input.lane_id) ||
+        !nonEmpty(input.actor) ||
+        !nonEmpty(input.checkpoint) ||
+        !nonEmpty(input.reason) ||
+        !nonEmpty(input.approval_id) ||
+        !nonEmpty(input.registry_worker_id) ||
+        !/^sha256:[a-f0-9]{64}$/.test(input.worker_yaml_sha256) ||
+        !Number.isFinite(Date.parse(input.at))) {
+        throw contextError("Outpost registry worker approval fields are incomplete");
+    }
+    const context = {
+        schema_version: APPROVAL_CONTEXT_SCHEMA,
+        ...input,
+        expected_senior: copySenior(input.expected_senior),
+    };
+    const encoded = Buffer.from(JSON.stringify(context), "utf8").toString("base64url");
+    if (Buffer.byteLength(encoded, "utf8") > MAX_CONTEXT_BYTES) {
+        throw contextError(`Registry worker approval context for lane ${input.lane_id} is too large`);
+    }
+    return encoded;
+}
+export function parseOutpostRegistryWorkerApprovalContext(encoded, expectedLaneId) {
+    if (encoded.length === 0 ||
+        encoded.length > MAX_CONTEXT_BYTES ||
+        !/^[A-Za-z0-9_-]+$/.test(encoded) ||
+        Buffer.from(encoded, "base64url").toString("base64url") !== encoded) {
+        throw contextError("Registry worker approval context must be bounded canonical base64url text");
+    }
+    let raw;
+    try {
+        const decoded = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(encoded, "base64url"));
+        raw = JSON.parse(decoded);
+    }
+    catch {
+        throw contextError("Registry worker approval context is not valid UTF-8 JSON");
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        throw contextError("Registry worker approval context must be a JSON object");
+    }
+    const record = raw;
+    const allowed = [
+        "schema_version", "lane_id", "expected_senior", "actor", "checkpoint", "reason",
+        "approval_id", "registry_worker_id", "worker_yaml_sha256", "at",
+    ];
+    if (Object.keys(record).some((key) => !allowed.includes(key))) {
+        throw contextError("Registry worker approval context contains unknown fields");
+    }
+    const expectedSenior = parseSenior(record.expected_senior);
+    if (record.schema_version !== APPROVAL_CONTEXT_SCHEMA ||
+        record.lane_id !== expectedLaneId ||
+        expectedSenior === null ||
+        !nonEmpty(record.actor) ||
+        !nonEmpty(record.checkpoint) ||
+        !nonEmpty(record.reason) ||
+        !nonEmpty(record.approval_id) ||
+        !nonEmpty(record.registry_worker_id) ||
+        typeof record.worker_yaml_sha256 !== "string" ||
+        !/^sha256:[a-f0-9]{64}$/.test(record.worker_yaml_sha256) ||
+        typeof record.at !== "string" ||
+        !Number.isFinite(Date.parse(record.at))) {
+        throw contextError(`Registry worker approval context is invalid for lane ${expectedLaneId}`);
+    }
+    return {
+        schema_version: APPROVAL_CONTEXT_SCHEMA,
+        lane_id: expectedLaneId,
+        expected_senior: expectedSenior,
+        actor: record.actor,
+        checkpoint: record.checkpoint,
+        reason: record.reason,
+        approval_id: record.approval_id,
+        registry_worker_id: record.registry_worker_id,
+        worker_yaml_sha256: record.worker_yaml_sha256,
+        at: record.at,
+    };
+}
+//# sourceMappingURL=outpost-registry-worker-approval.js.map

package/dist/lib/lanes/profile.d.ts

@@ -7,6 +7,9 @@
  * must be re-read for every spawn.
  */
 import { type LaneRecord, type LaneProvider } from "./types.js";
+import type { RegistryWorkerRecord } from "./types.js";
+import { type RegistryPersona } from "./registry-persona.js";
+export declare const REGISTRY_PERSONA_PROMPT_MAX_CHARS = 12000;
 export interface WorkerProfileMeta {
     version?: string;
     provider: LaneProvider;
@@ -18,6 +21,7 @@ export interface WorkerProfileMeta {
     source?: string;
     accounts?: string[];
     keep_alive?: boolean;
+    registry_worker?: string;
 }
 export interface WorkerProfile {
     id: string;
@@ -28,6 +32,7 @@ export interface WorkerProfile {
     policyFiles: string[];
     hookFiles: string[];
     contentHash: string;
+    registryWorker?: RegistryPersona;
 }
 export interface WorkerProfileRuntime {
     settingsPath?: string;
@@ -41,6 +46,11 @@ export declare function personalWorkerProfileDir(hqRoot: string, id: string): st
 /** A meta.yaml file is the explicit marker for a personal worker profile. */
 export declare function workerProfileMarker(hqRoot: string, id: string): "absent" | "present";
 export declare function loadWorkerProfile(hqRoot: string, id: string, options?: LoadWorkerProfileOptions): WorkerProfile;
+export declare function loadWorkerProfileWithRegistry(hqRoot: string, id: string, options?: {
+    laneCompany?: string;
+    registryWorkerRecord?: RegistryWorkerRecord;
+    onUnknownMetaFields?: (fields: readonly string[]) => void;
+}): WorkerProfile;
 export interface EffectiveLaneKeepAlive {
     enabled: boolean;
     source: "lane" | "none";

package/dist/lib/lanes/profile.js

@@ -13,11 +13,13 @@ import { parseUserYaml } from "../../utils/user-yaml-error.js";
 import { WorkerResolutionError } from "./errors.js";
 import { PROVIDER_EFFORT_LEVELS } from "./effort.js";
 import { LANE_PROVIDERS, isLaneProvider, } from "./types.js";
+import { loadRegistryPersonaFromRecord, registryWorkerRecord, resolveRegistryPersona, } from "./registry-persona.js";
 const PROFILE_META = "meta.yaml";
 const PROFILE_SYSTEM_PROMPT = "system-prompt.md";
 const PROFILE_SETTINGS = "settings.json";
 const PROFILE_POLICIES = "policies";
 const PROFILE_HOOKS = "hooks";
+export const REGISTRY_PERSONA_PROMPT_MAX_CHARS = 12_000;
 const PROFILE_META_KEYS = new Set([
     "version",
     "provider",
@@ -29,6 +31,7 @@ const PROFILE_META_KEYS = new Set([
     "source",
     "accounts",
     "keep_alive",
+    "registry_worker",
 ]);
 function isPlainObject(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -214,6 +217,7 @@ function parseMeta(id, dir, raw, options = {}) {
         }
         accounts = raw.accounts.map((item) => item.trim());
     }
+    const registryWorker = optionalString("registry_worker");
     return {
         ...(version !== undefined ? { version } : {}),
         provider: providerValue,
@@ -225,6 +229,7 @@ function parseMeta(id, dir, raw, options = {}) {
         ...(maxConcurrent !== undefined ? { max_concurrent: maxConcurrent } : {}),
         ...(source !== undefined ? { source } : {}),
         ...(accounts !== undefined ? { accounts } : {}),
+        ...(registryWorker !== undefined ? { registry_worker: registryWorker } : {}),
     };
 }
 function validatePolicyFrontmatter(id, profileDir, relative) {
@@ -373,6 +378,39 @@ export function loadWorkerProfile(hqRoot, id, options = {}) {
         contentHash: hashProfileFiles(dir, hashFiles),
     };
 }
+export function loadWorkerProfileWithRegistry(hqRoot, id, options = {}) {
+    const profile = loadWorkerProfile(hqRoot, id, options);
+    const requestedId = profile.meta.registry_worker;
+    if (requestedId === undefined) {
+        if (options.registryWorkerRecord !== undefined) {
+            throw new WorkerResolutionError("registry_worker_invalid", `Worker profile ${JSON.stringify(id)} no longer names its recorded registry worker`, { worker: id, registry_worker: options.registryWorkerRecord.id });
+        }
+        return profile;
+    }
+    const persona = options.registryWorkerRecord !== undefined
+        ? (() => {
+            if (options.registryWorkerRecord?.id !== requestedId) {
+                throw new WorkerResolutionError("registry_worker_invalid", `Worker profile ${JSON.stringify(id)} names registry worker ${JSON.stringify(requestedId)}, but the lane records ${JSON.stringify(options.registryWorkerRecord?.id)}`, {
+                    worker: id,
+                    profile_registry_worker: requestedId,
+                    lane_registry_worker: options.registryWorkerRecord?.id,
+                });
+            }
+            return loadRegistryPersonaFromRecord(hqRoot, options.registryWorkerRecord);
+        })()
+        : resolveRegistryPersona(hqRoot, requestedId, options.laneCompany);
+    const record = registryWorkerRecord(persona);
+    const hash = createHash("sha256")
+        .update(profile.contentHash)
+        .update("\0registry_worker\0")
+        .update(JSON.stringify({ id: record.id, path: record.path, worker_yaml_sha256: record.worker_yaml_sha256 }))
+        .digest("hex");
+    return {
+        ...profile,
+        registryWorker: persona,
+        contentHash: `sha256:${hash}`,
+    };
+}
 /** Resolve keep-alive from the lane record; profile metadata only seeds new spawns. */
 export function resolveLaneKeepAlive(_hqRoot, lane) {
     return lane.keep_alive === undefined
@@ -381,6 +419,9 @@ export function resolveLaneKeepAlive(_hqRoot, lane) {
 }
 export function workerProfilePrompt(profile, delivery = "prompt") {
     const parts = [profile.systemPrompt.trimEnd()];
+    if (profile.registryWorker !== undefined) {
+        parts.push(formatRegistryWorkerPrompt(profile.registryWorker));
+    }
     if (delivery === "hook")
         return parts.join("\n");
     for (const relative of profile.policyFiles) {
@@ -389,6 +430,53 @@ export function workerProfilePrompt(profile, delivery = "prompt") {
     }
     return parts.join("\n");
 }
+function formatRegistryWorkerPrompt(persona) {
+    const lines = [
+        "## Registry worker",
+        `Description: ${persona.description}`,
+        "",
+        "Instructions:",
+        persona.instructions || "No additional instructions were supplied.",
+    ];
+    if (persona.skillFiles.length > 0) {
+        lines.push("", "Skills (path references only; do not inline these files):");
+        for (const file of persona.skillFiles)
+            lines.push(`- ${file}`);
+    }
+    if (persona.postExecute.length > 0) {
+        lines.push("", "Done criteria:");
+        for (const command of persona.postExecute)
+            lines.push(`- ${command}`);
+    }
+    const safetyLines = [];
+    if (persona.humanCheckpoints.length > 0) {
+        safetyLines.push("Human checkpoints:");
+        for (const checkpoint of persona.humanCheckpoints) {
+            safetyLines.push(`- STOP before proceeding with ${checkpoint}. Report that this checkpoint is reached to the senior and wait for approval. Do not perform the action before it is approved.`);
+        }
+    }
+    else if (persona.approvalRequired) {
+        safetyLines.push("Human checkpoint:", "- STOP before any external publish action. Report checkpoint external_publish to the senior and wait for approval. Do not perform the action before it is approved.");
+    }
+    if (persona.approvalRequired || persona.humanCheckpoints.length > 0) {
+        safetyLines.push("For an approved external action, include the exact approved checkpoint in the artifact's checkpoint field. Each approval applies to the next matching envelope only.");
+    }
+    if (safetyLines.length > 0)
+        lines.push("");
+    const complete = [...lines, ...safetyLines].join("\n");
+    if (complete.length <= REGISTRY_PERSONA_PROMPT_MAX_CHARS)
+        return complete;
+    const suffix = [
+        "",
+        `[Registry worker section truncated at ${REGISTRY_PERSONA_PROMPT_MAX_CHARS} characters; descriptive material, skill paths, or done criteria may be omitted.]`,
+        ...(safetyLines.length > 0 ? ["", ...safetyLines] : []),
+    ].join("\n");
+    const prefixBudget = REGISTRY_PERSONA_PROMPT_MAX_CHARS - suffix.length;
+    if (prefixBudget < 0) {
+        throw new WorkerResolutionError("registry_worker_invalid", `Registry worker ${JSON.stringify(persona.id)} checkpoint instructions exceed the bounded prompt limit`, { worker: persona.id, max_chars: REGISTRY_PERSONA_PROMPT_MAX_CHARS });
+    }
+    return `${lines.join("\n").slice(0, prefixBudget).trimEnd()}${suffix}`;
+}
 export function ignoredWorkerProfileFields(provider) {
     return provider === "claude" ? [] : ["settings", "hooks"];
 }