@inflexa-ai/harness 0.45.1 → 0.46.2

package/dist/state/purge-analysis.d.ts

@@ -43,7 +43,7 @@ import type { Logger } from "../lib/logger.js";
  * behind, and rows written under a workflow the purge already deleted, which trip
  * their foreign key.
  */
-export interface AnalysisPurgeOutcome {
+export type AnalysisPurgeOutcome = {
     readonly threads: number;
     readonly messages: number;
     /**
@@ -54,14 +54,14 @@ export interface AnalysisPurgeOutcome {
      */
     readonly workflows: number;
     readonly vectorIndexDropped: boolean;
-}
-export interface AnalysisPurgeDeps {
+};
+export type AnalysisPurgeDeps = {
     readonly pool: Pool;
     /** The workflow-ledger seam. Cancellation and deletion by id, engine-agnostic. */
     readonly workflows: WorkflowPurger;
     readonly logger?: Logger;
-}
-export interface AnalysisPurge {
+};
+export type AnalysisPurge = {
     /**
      * Remove the analysis's entire persisted Postgres footprint. Absence is a
      * normal outcome: an unknown or already-purged analysis succeeds with zeroes.
@@ -69,5 +69,5 @@ export interface AnalysisPurge {
      * it did not achieve. The caller quiesces the analysis first (module note).
      */
     purgeAnalysis(analysisId: string): ResultAsync<AnalysisPurgeOutcome, DbError>;
-}
+};
 export declare function createAnalysisPurge({ pool, workflows, logger: injected }: AnalysisPurgeDeps): AnalysisPurge;

package/dist/state/purge-analysis.js

@@ -56,7 +56,11 @@ import { isSqlIdentifier } from "./vector-store.js";
  * Empty is outside the shape too: it derives the bare table prefix, which is a
  * perfectly legal identifier and belongs to no analysis.
  */
-const PURGEABLE_ANALYSIS_ID = /^[a-z0-9_-]+$/;
+function isPurgeableAnalysisIdShape(analysisId) {
+    if (analysisId.length === 0)
+        return false;
+    return Array.from(analysisId).every((char) => (char >= "a" && char <= "z") || (char >= "0" && char <= "9") || char === "_" || char === "-");
+}
 /**
  * The analysis-keyed deletes that follow the thread/message pair, in the order
  * they run.
@@ -80,6 +84,10 @@ const ANALYSIS_KEYED_DELETES = [
     { op: "purgeAnalysis.askGrants", sql: "DELETE FROM cortex_ask_grants WHERE analysis_id = $1" },
     // By its own analysis id, not through the thread rows: a kept text of a run names no thread.
     { op: "purgeAnalysis.toolOutputs", sql: "DELETE FROM cortex_tool_outputs WHERE analysis_id = $1" },
+    { op: "purgeAnalysis.editIntents", sql: "DELETE FROM cortex_edit_intents WHERE analysis_id = $1" },
+    { op: "purgeAnalysis.appliedMemoryEdits", sql: "DELETE FROM cortex_applied_memory_edits WHERE analysis_id = $1" },
+    { op: "purgeAnalysis.authoringResults", sql: "DELETE FROM cortex_authoring_results WHERE analysis_id = $1" },
+    { op: "purgeAnalysis.pausedWork", sql: "DELETE FROM cortex_paused_work WHERE analysis_id = $1" },
     { op: "purgeAnalysis.plans", sql: "DELETE FROM cortex_plans WHERE analysis_id = $1" },
     { op: "purgeAnalysis.reportVersions", sql: "DELETE FROM cortex_report_versions WHERE analysis_id = $1" },
     { op: "purgeAnalysis.reportSessionState", sql: "DELETE FROM cortex_report_session_state WHERE analysis_id = $1" },
@@ -170,7 +178,7 @@ export function createAnalysisPurge({ pool, workflows, logger: injected }) {
         await pool.query(`DROP TABLE IF EXISTS "${indexName}"`);
     }).map(() => present));
     const purgeAnalysis = (analysisId) => {
-        if (!PURGEABLE_ANALYSIS_ID.test(analysisId)) {
+        if (!isPurgeableAnalysisIdShape(analysisId)) {
             return refuse("purgeAnalysis.analysisId", `purge-analysis: refusing unpurgeable analysis id "${analysisId}"`);
         }
         const indexName = searchIndexName(analysisId);

package/dist/state/report-session-state.d.ts

@@ -31,20 +31,24 @@
  * lands only when the row still holds it. Thus two concurrent turns cannot both land,
  * and the loser reads the state again.
  *
+ * A persist that names an authoring call stores the result of the call in
+ * `cortex_authoring_results`, in the transaction of the document and under the lock
+ * of the row. A second persist of the same call finds that result and writes nothing.
+ *
  * A purge of the analysis removes the row through the analysis-id cascade.
  */
 import { type ResultAsync } from "neverthrow";
-import type { Pool } from "pg";
-import { type DbError } from "../lib/db-result.js";
+import type { Querier } from "../state/db.js";
+import { type Connectable, type DbError } from "../lib/db-result.js";
 import type { Logger } from "../lib/logger.js";
 import { type DraftDocument } from "../report-model/draft.js";
 import type { ReportSnapshot } from "../report-model/reference-resolver.js";
 import { type SchemaIssue } from "./snapshot-parse.js";
 /** One source of a derivation: the pinned path that the script read, and the hash of that path. */
-export interface DerivationSource {
+export type DerivationSource = {
     readonly path: string;
     readonly hash: string;
-}
+};
 /**
  * One derivation of a session.
  *
@@ -54,21 +58,25 @@ export interface DerivationSource {
  *
  * `outputPath` is the workspace-root-relative path of the derived file, and it is the key that the served
  * membership holds. A record is immutable, thus a new derivation takes a new output path.
+ *
+ * `toolCallId` names the call that made the record, thus a rerun of that call finds its own table. A stored
+ * record can lack it, and such a record matches no call.
  */
-export interface DerivationRecord {
+export type DerivationRecord = {
     readonly outputPath: string;
     readonly outputHash: string;
     readonly sources: readonly DerivationSource[];
     readonly scriptHash: string;
     readonly script: string;
-}
+    readonly toolCallId?: string;
+};
 /**
  * The outcome of an append. `appended` landed the record. `duplicate` means that a record already holds the
  * output path, thus the list stays as it is. `absent` means that no row holds the thread.
  */
 export type AppendDerivationOutcome = "appended" | "duplicate" | "absent";
 /** The state of one report session, as the store gives it back. */
-export interface ReportSessionState {
+export type ReportSessionState = {
     readonly threadId: string;
     readonly analysisId: string;
     /** The in-progress draft document, or `null` before the first document lands. */
@@ -82,16 +90,16 @@ export interface ReportSessionState {
     /** The hash that the last eyes capture saw, or `null` before the first look. */
     readonly seenDocumentHash: string | null;
     readonly createdAt: Date;
-}
+};
 /** The snapshot and the anchor of a row to create. */
-export interface WriteSnapshotInput {
+export type WriteSnapshotInput = {
     readonly threadId: string;
     readonly analysisId: string;
     /** The pinned snapshot, stored as given. */
     readonly snapshot: ReportSnapshot;
-}
+};
 /** The document to persist against an existing row, and the prior document that the load read. */
-export interface PersistDocumentInput {
+export type PersistDocumentInput = {
     readonly threadId: string;
     /** The draft document, stored as given. */
     readonly document: DraftDocument;
@@ -101,13 +109,26 @@ export interface PersistDocumentInput {
      * landed first turns this persist into a conflict.
      */
     readonly expected: DraftDocument | null;
-}
+    /**
+     * The authoring call that lands the document, keyed by its durable step. Its result
+     * lands in the transaction of the document, under the lock of the row.
+     */
+    readonly call?: AuthoringCall;
+};
+/** One authoring call that a durable step runs, and the result that it gives when its document lands. */
+export type AuthoringCall = {
+    readonly key: string;
+    /** The result, stored as given. */
+    readonly result: unknown;
+};
 /**
  * The outcome of a persist. `persisted` landed the document. `conflict` means the row
  * no longer holds the expected prior document, thus a concurrent turn landed first and
  * this turn must read the state again. `absent` means no row holds the thread.
+ * `replayed` means that the row already holds a result for the call, thus an earlier
+ * run of the call landed, and the persist wrote nothing.
  */
-export type PersistOutcome = "persisted" | "conflict" | "absent";
+export type PersistOutcome = "persisted" | "conflict" | "absent" | "replayed";
 /**
  * The outcome of a stamp. `stamped` wrote the hash on the row. `absent` means that no row holds the
  * thread, thus the stamp wrote nothing. A stamp reads nothing before the write.
@@ -130,7 +151,7 @@ export type SessionStateReadError = {
     readonly part: "document" | "snapshot" | "derivations";
     readonly issues: readonly SchemaIssue[];
 };
-export interface ReportSessionStateStore {
+export type ReportSessionStateStore = {
     /**
      * The state of a thread, or `null` when no row holds it. A parse failure on a
      * stored column reads as a typed error, and an absent row reads as a normal
@@ -150,6 +171,10 @@ export interface ReportSessionStateStore {
      * concurrent turn landed first, and `absent` means no row holds the thread.
      */
     persistDocument(input: PersistDocumentInput): ResultAsync<PersistOutcome, DbError>;
+    /** The stored result of one authoring call of a thread, or `null` when that call landed no document. */
+    readCallResult(threadId: string, callKey: string): ResultAsync<{
+        readonly result: unknown;
+    } | null, DbError>;
     /**
      * Stamp the rendered-document hash on the row. The preview calls it when the page lands, thus the row
      * holds the hash of the draft that the page shows. `absent` means that no row holds the thread.
@@ -168,11 +193,11 @@ export interface ReportSessionStateStore {
      * that no row holds the thread.
      */
     appendDerivation(threadId: string, record: DerivationRecord): ResultAsync<AppendDerivationOutcome, DbError>;
-}
-export interface ReportSessionStateStoreDeps {
-    readonly pool: Pool;
+};
+export type ReportSessionStateStoreDeps = {
+    readonly pool: Querier & Connectable;
     readonly logger?: Logger;
-}
+};
 /**
  * Create a `ReportSessionStateStore` bound to a Postgres pool. The
  * `cortex_report_session_state` table is provisioned by the state-init DDL.

package/dist/state/report-session-state.js

@@ -31,11 +31,15 @@
  * lands only when the row still holds it. Thus two concurrent turns cannot both land,
  * and the loser reads the state again.
  *
+ * A persist that names an authoring call stores the result of the call in
+ * `cortex_authoring_results`, in the transaction of the document and under the lock
+ * of the row. A second persist of the same call finds that result and writes nothing.
+ *
  * A purge of the analysis removes the row through the analysis-id cascade.
  */
-import { err, ok } from "neverthrow";
+import { err, ok, okAsync } from "neverthrow";
 import { z } from "zod";
-import { tryMutation, tryQuery } from "../lib/db-result.js";
+import { tryMutation, tryQuery, withTransaction } from "../lib/db-result.js";
 import { DraftDocumentSchema } from "../report-model/draft.js";
 import { parseSnapshot, reduceIssues } from "./snapshot-parse.js";
 const DerivationSourceSchema = z.object({ path: z.string(), hash: z.string() });
@@ -45,6 +49,7 @@ const DerivationRecordSchema = z.object({
     sources: z.array(DerivationSourceSchema),
     scriptHash: z.string(),
     script: z.string(),
+    toolCallId: z.string().optional(),
 });
 const DerivationListSchema = z.array(DerivationRecordSchema);
 const _assertReadError = true;
@@ -155,6 +160,40 @@ export function createReportSessionStateStore({ pool }) {
         });
     }
     function persistDocument(input) {
+        const { call } = input;
+        if (call === undefined)
+            return swapDocument(pool, input);
+        return withTransaction(pool, "report-session-state.persistDocument", (client) => 
+        // The row lock serializes each persist of the thread, thus a second run of one
+        // call waits for the first and then finds its result.
+        tryQuery("report-session-state.persistDocument.lock", () => client.query({
+            text: `SELECT (SELECT COUNT(*) FROM cortex_authoring_results WHERE thread_id = $1 AND call_key = $2)::int AS held, analysis_id
+  FROM cortex_report_session_state WHERE thread_id = $1 FOR UPDATE`,
+            values: [input.threadId, call.key],
+        })).andThen(({ rows }) => {
+            const row = rows[0];
+            if (row === undefined)
+                return okAsync("absent");
+            if (row.held > 0)
+                return okAsync("replayed");
+            return swapDocument(client, input).andThen((outcome) => outcome !== "persisted"
+                ? okAsync(outcome)
+                : tryMutation("report-session-state.persistDocument.result", () => client.query({
+                    text: "INSERT INTO cortex_authoring_results (thread_id, call_key, analysis_id, result) VALUES ($1, $2, $3, $4::jsonb)",
+                    values: [input.threadId, call.key, row.analysis_id, JSON.stringify(call.result)],
+                })).map(() => "persisted"));
+        }));
+    }
+    function readCallResult(threadId, callKey) {
+        return tryQuery("report-session-state.readCallResult", () => pool.query({
+            text: "SELECT result FROM cortex_authoring_results WHERE thread_id = $1 AND call_key = $2",
+            values: [threadId, callKey],
+        })).map(({ rows }) => {
+            const row = rows[0];
+            return row === undefined ? null : { result: row.result };
+        });
+    }
+    function swapDocument(querier, input) {
         return tryMutation("report-session-state.persistDocument", async () => {
             // The prior document rides as SQL NULL when absent, thus the compare-and-swap
             // matches a fresh row whose document column is null. A JSON `null` would be a
@@ -163,7 +202,7 @@ export function createReportSessionStateStore({ pool }) {
             // One statement tells a conflict from an absence. `existed` counts the row, and
             // `updated` counts the compare-and-swap. A row that exists but did not update
             // holds a different prior document, thus a concurrent turn landed first.
-            const { rows } = await pool.query({
+            const { rows } = await querier.query({
                 text: `WITH target AS (
     SELECT 1 FROM cortex_report_session_state WHERE thread_id = $1
   ), updated AS (
@@ -241,5 +280,5 @@ export function createReportSessionStateStore({ pool }) {
             return row.appended > 0 ? "appended" : "duplicate";
         });
     }
-    return { readState, writeSnapshot, persistDocument, stampRendered, stampSeen, appendDerivation };
+    return { readState, writeSnapshot, persistDocument, readCallResult, stampRendered, stampSeen, appendDerivation };
 }

package/dist/state/report-versions.d.ts

@@ -29,9 +29,9 @@ import { type DbError } from "../lib/db-result.js";
 import type { Logger } from "../lib/logger.js";
 import type { ReportSnapshot } from "../report-model/reference-resolver.js";
 import { type SchemaIssue } from "./snapshot-parse.js";
-export type { SchemaIssue };
+export type { SchemaIssue } from "./snapshot-parse.js";
 /** The anchor and the payload of a version to record. */
-export interface RecordVersionInput {
+export type RecordVersionInput = {
     /** The block document. It rides as `unknown`, and the record parses it. */
     readonly document: unknown;
     /** The pinned snapshot, stored as given. */
@@ -44,16 +44,21 @@ export interface RecordVersionInput {
     readonly parentSeq: number | null;
     /** The earlier version that this one reuses. The parent must belong to the same analysis. */
     readonly parentVersionId?: string;
-}
+    /**
+     * The id of the version when the record makes the row. A record that replaces the
+     * version of the thread keeps the stored id. Omitted, the record mints a random id.
+     */
+    readonly versionId?: string;
+};
 /** The stable reference of a recorded version, and how the record landed. */
-export interface RecordedVersionRef {
+export type RecordedVersionRef = {
     readonly versionId: string;
     /**
      * `created` minted the row. `replaced` wrote over the one version of the
      * thread, under the same version id.
      */
     readonly outcome: "created" | "replaced";
-}
+};
 /**
  * A record the store refuses as data, before or in place of a row. Distinct from
  * `DbError`: the request describes a version that the store will not write.
@@ -97,7 +102,7 @@ export type VersionReadError = {
     readonly issues: readonly SchemaIssue[];
 };
 /** One recorded version, as the store gives it back. */
-export interface RecordedVersion {
+export type RecordedVersion = {
     readonly versionId: string;
     readonly analysisId: string;
     readonly threadId: string;
@@ -108,8 +113,8 @@ export interface RecordedVersion {
     readonly document: ReportDocument;
     readonly snapshot: ReportSnapshot;
     readonly createdAt: Date;
-}
-export interface ReportVersionStore {
+};
+export type ReportVersionStore = {
     /**
      * Record a version. The record parses the document, refuses a malformed value
      * as data with no row, and refuses a parent from a different analysis. It reads
@@ -122,11 +127,11 @@ export interface ReportVersionStore {
     getVersion(versionId: string): ResultAsync<RecordedVersion | null, DbError | VersionReadError>;
     /** The one version of a thread, or `null` for a thread with no version. */
     getThreadVersion(threadId: string): ResultAsync<RecordedVersion | null, DbError | VersionReadError>;
-}
-export interface ReportVersionStoreDeps {
+};
+export type ReportVersionStoreDeps = {
     readonly pool: Pool;
     readonly logger?: Logger;
-}
+};
 /**
  * Create a `ReportVersionStore` bound to a Postgres pool. The
  * `cortex_report_versions` table is provisioned by the state-init DDL.

package/dist/state/report-versions.js

@@ -50,8 +50,10 @@ const VERSION_COLUMNS = "version_id, analysis_id, thread_id, parent_thread_id, p
  * It writes neither `version_id` nor `created_at`: the version keeps its name, and
  * the row keeps the time of its first record.
  *
- * The returned id names the row that stands. It equals the minted id on the insert
- * arm alone, thus the caller reads which arm ran.
+ * The returned id names the row that stands. It equals the given id on the insert
+ * arm, and the stored id on the replace arm, thus the caller reads which arm ran. A
+ * second record with the id of the stored version reads as the record that made it,
+ * thus a rerun of one durable step does not read as a replacement.
  */
 const RECORD_SQL = `INSERT INTO cortex_report_versions
     (version_id, analysis_id, thread_id, parent_thread_id, parent_seq,
@@ -115,7 +117,7 @@ export function createReportVersionStore({ pool }) {
             return errAsync({ type: "malformed_snapshot", op: "report-versions.record", issues: parsedSnapshot.error });
         }
         const write = () => {
-            const minted = randomUUID();
+            const minted = input.versionId ?? randomUUID();
             return tryMutation("report-versions.record.write", async () => {
                 const { rows } = await pool.query({
                     text: RECORD_SQL,

package/dist/state/runs.d.ts

@@ -10,29 +10,40 @@
  * `err(constraint_violation)` via `tryMutation`.
  */
 import type { ResultAsync } from "neverthrow";
+import type { QueryConfig } from "pg";
 import type { DbError } from "../lib/db-result.js";
 import type { Querier } from "./db.js";
-import type { CortexRunRow, SynthesisStatus } from "./schema.js";
-export interface InsertRunInput {
+import { type CortexRunRow, type SynthesisStatus } from "./schema.js";
+/**
+ * The row-reading surface of this module: one query over the text or config form, whose rows the mapRunRow
+ * parser types. A computed test fake satisfies this shape directly, where the row-generic of `Querier`
+ * cannot be implemented by a fake that computes its rows.
+ */
+export type RunRowQuerier = {
+    query(queryTextOrConfig: string | QueryConfig, values?: unknown[]): Promise<{
+        rows: Record<string, unknown>[];
+        rowCount: number | null;
+    }>;
+};
+export type InsertRunInput = {
     runId: string;
     analysisId: string;
     threadId?: string | null;
     workflowName: string;
     planId?: string | null;
-    mandateJti?: string | null;
-    mandateExpiresAt?: string | null;
+    mandateId?: string | null;
     /** The start time as an ISO string. Without it, the row gets the clock of the host. */
     startedAt?: string;
-}
-export interface RunReservation {
+};
+export type RunReservation = {
     readonly row: CortexRunRow;
     readonly inserted: boolean;
-}
+};
 /** Bounded run rows paired with the true count before limit/offset. */
-export interface RunPage {
+export type RunPage = {
     readonly runs: CortexRunRow[];
     readonly total: number;
-}
+};
 export declare class RunIdentityCollisionError extends Error {
     readonly runId: string;
     constructor(runId: string);
@@ -67,10 +78,10 @@ export declare function reserveRunById(pool: Querier, input: InsertRunInput): Re
  */
 export declare function queryActiveRun(pool: Querier, analysisId: string, planId: string | null): ResultAsync<CortexRunRow | null, DbError>;
 /** The optional text filter of the run reads. */
-export interface RunTextFilter {
+export type RunTextFilter = {
     /** A part of the run id or of the plan title, with no regard to case. Each character matches only itself. */
     q?: string;
-}
+};
 /**
  * Every NON-TERMINAL run of an analysis, newest-first and deliberately unbounded.
  *
@@ -118,7 +129,7 @@ export declare function reconcileOrphanedRuns(pool: Querier, opts?: {
  * of a run wins: a row that already holds a terminal status keeps its status, its `completed_at`, and its error.
  * The error text loses each NUL character, because Postgres rejects a NUL in text and the write must not fail for its own value.
  */
-export declare function updateRunStatus(pool: Querier, runId: string, status: "running" | "completed" | "partial" | "failed" | "canceled" | "suspended_insufficient_funds", error?: string | null): ResultAsync<boolean, DbError>;
+export declare function updateRunStatus(pool: Querier, runId: string, status: "running" | "completed" | "partial" | "failed" | "canceled", error?: string | null): ResultAsync<boolean, DbError>;
 /**
  * Conditionally transition an ACTIVE run to `canceled`, stamping `completed_at`
  * and recording `reason` in `error` (the same column `collectAndComplete`
@@ -129,7 +140,7 @@ export declare function updateRunStatus(pool: Querier, runId: string, status: "r
  */
 export declare function markRunCanceledIfActive(pool: Querier, runId: string, reason: string): ResultAsync<boolean, DbError>;
 export declare function promoteFailedToPartial(pool: Querier, runId: string): ResultAsync<boolean, DbError>;
-export declare function queryRun(pool: Querier, runId: string): ResultAsync<CortexRunRow | null, DbError>;
+export declare function queryRun(pool: RunRowQuerier, runId: string): ResultAsync<CortexRunRow | null, DbError>;
 /**
  * One window of the runs of an analysis, newest start first. With `q`, the window holds only the runs that the text
  * filter selects: the filter applies before `limit` and `offset`, and it does not change the order.
@@ -175,7 +186,7 @@ export declare function queryNonTerminalRunsByAnalysis(pool: Querier, analysisId
  * {@link queryRunsByAnalysis}, whose chronological order is an embedder/UI
  * contract.
  */
-export declare function queryRunsForInspection(pool: Querier, analysisId: string, { limit, offset }?: {
+export declare function queryRunsForInspection(pool: RunRowQuerier, analysisId: string, { limit, offset }?: {
     limit?: number;
     offset?: number;
 }): ResultAsync<RunPage, DbError>;
@@ -185,12 +196,12 @@ export declare function queryRunsByThread(pool: Querier, analysisId: string, thr
     offset?: number;
 } & RunTextFilter): ResultAsync<CortexRunRow[], DbError>;
 /**
- * Persist the run mandate jti + expiry for a run. oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
- * Called by `authorizeForRun` after a successful mint so the cancel
- * handler can revoke the mandate by `runId → jti` lookup. oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
- * The JWT itself is NOT persisted — it rides in DBOS workflow input.
+ * Persist the run mandate reference for a run. oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+ * Called by the host authorizer after it authorizes the run, so the cancel
+ * handler can revoke the mandate by `runId → mandate id` lookup. oss-core-managed-ok: run-mandate ledger (nullable; OSS leaves null)
+ * The reference has no expiry here: the run does not depend on a clock.
  */
-export declare function setRunMandate(pool: Querier, runId: string, jti: string, expiresAt: string): ResultAsync<void, DbError>;
+export declare function setRunMandate(pool: Querier, runId: string, mandateId: string): ResultAsync<void, DbError>;
 /**
  * Record the run-level synthesis outcome on the run ledger. `synthesisReason`
  * carries operator-facing detail for a skipped/failed outcome; it stays null