@kbediako/codex-orchestrator 0.1.3 → 0.1.4

package/dist/orchestrator/src/cli/control/controlState.js

@@ -0,0 +1,46 @@
+export class ControlStateStore {
+    now;
+    state;
+    constructor(options) {
+        this.now = options.now ?? (() => new Date().toISOString());
+        this.state = {
+            run_id: options.runId,
+            control_seq: options.controlSeq ?? 0,
+            latest_action: options.latestAction ?? null,
+            feature_toggles: options.featureToggles ?? null
+        };
+    }
+    updateAction(input) {
+        this.state.control_seq += 1;
+        this.state.latest_action = {
+            request_id: input.requestId ?? null,
+            requested_by: input.requestedBy,
+            requested_at: this.now(),
+            action: input.action,
+            reason: input.reason ?? null
+        };
+    }
+    updateFeatureToggles(toggles) {
+        const current = this.state.feature_toggles ?? {};
+        this.state.feature_toggles = mergeObjects(current, toggles);
+    }
+    snapshot() {
+        return structuredClone(this.state);
+    }
+}
+function mergeObjects(base, update) {
+    const merged = { ...base };
+    for (const [key, value] of Object.entries(update)) {
+        if (Array.isArray(value)) {
+            merged[key] = [...value];
+            continue;
+        }
+        if (value && typeof value === 'object' && !Array.isArray(value)) {
+            const current = merged[key] ?? {};
+            merged[key] = mergeObjects(current, value);
+            continue;
+        }
+        merged[key] = value;
+    }
+    return merged;
+}

package/dist/orchestrator/src/cli/control/controlWatcher.js

@@ -0,0 +1,222 @@
+import { readFile } from 'node:fs/promises';
+import { isoTimestamp } from '../utils/time.js';
+import { appendSummary } from '../run/manifest.js';
+import { logger } from '../../logger.js';
+export class ControlWatcher {
+    paths;
+    manifest;
+    persist;
+    eventStream;
+    onEntry;
+    now;
+    pollIntervalMs;
+    lastControlSeq = 0;
+    paused = false;
+    lastPauseRequestId = null;
+    lastPauseReason = null;
+    cancelRequested = false;
+    failureRequested = false;
+    constructor(options) {
+        this.paths = options.paths;
+        this.manifest = options.manifest;
+        this.persist = options.persist;
+        this.eventStream = options.eventStream;
+        this.onEntry = options.onEntry;
+        this.now = options.now ?? isoTimestamp;
+        this.pollIntervalMs = options.pollIntervalMs ?? 1000;
+    }
+    isCanceled() {
+        return this.cancelRequested;
+    }
+    isFailed() {
+        return this.failureRequested;
+    }
+    async sync() {
+        const snapshot = await readControlFile(this.paths.controlPath);
+        if (!snapshot) {
+            return;
+        }
+        const controlSeq = snapshot.control_seq ?? 0;
+        if (controlSeq <= this.lastControlSeq) {
+            return;
+        }
+        this.lastControlSeq = controlSeq;
+        const latest = snapshot.latest_action;
+        if (latest &&
+            typeof latest === 'object' &&
+            (Object.prototype.hasOwnProperty.call(latest, 'confirm_nonce') ||
+                Object.prototype.hasOwnProperty.call(latest, 'confirmNonce'))) {
+            await this.safeAppend({
+                event: 'security_violation',
+                actor: 'runner',
+                payload: {
+                    kind: 'confirm_nonce_present',
+                    summary: 'confirm_nonce present in control action',
+                    severity: 'high',
+                    related_request_id: latest.request_id ?? null,
+                    details_redacted: true
+                },
+                timestamp: this.now()
+            });
+            return;
+        }
+        const action = latest?.action;
+        if (!action) {
+            return;
+        }
+        if (action === 'pause') {
+            await this.handlePause(snapshot);
+            return;
+        }
+        if (action === 'resume') {
+            await this.handleResume(snapshot);
+            return;
+        }
+        if (action === 'cancel') {
+            await this.handleCancel(snapshot);
+            return;
+        }
+        if (action === 'fail') {
+            await this.handleFail(snapshot);
+        }
+    }
+    async waitForResume() {
+        if (!this.paused) {
+            return;
+        }
+        while (this.paused && !this.cancelRequested && !this.failureRequested) {
+            await delay(this.pollIntervalMs);
+            await this.sync();
+        }
+    }
+    async handlePause(snapshot) {
+        const nextRequestId = snapshot.latest_action?.request_id ?? null;
+        const nextReason = snapshot.latest_action?.reason ?? null;
+        if (this.paused && nextRequestId === this.lastPauseRequestId && nextReason === this.lastPauseReason) {
+            return;
+        }
+        const wasPaused = this.paused;
+        this.paused = true;
+        this.lastPauseRequestId = nextRequestId;
+        this.lastPauseReason = nextReason;
+        const nextDetail = nextReason ?? 'paused';
+        if (!wasPaused || this.manifest.status_detail !== nextDetail) {
+            this.manifest.status_detail = nextDetail;
+            if (!wasPaused) {
+                appendSummary(this.manifest, 'Run paused by control request.');
+            }
+            await this.persist();
+        }
+        await this.safeAppend({
+            event: 'pause_requested',
+            actor: snapshot.latest_action?.requested_by ?? 'user',
+            payload: {
+                request_id: snapshot.latest_action?.request_id ?? null,
+                control_seq: snapshot.control_seq ?? null,
+                requested_by: snapshot.latest_action?.requested_by ?? null,
+                reason: snapshot.latest_action?.reason ?? null
+            },
+            timestamp: this.now()
+        });
+        await this.safeAppend({
+            event: 'run_paused',
+            actor: 'runner',
+            payload: {
+                reason: 'control_request',
+                request_id: snapshot.latest_action?.request_id ?? null,
+                control_seq: snapshot.control_seq ?? null,
+                requested_reason: snapshot.latest_action?.reason ?? null
+            },
+            timestamp: this.now()
+        });
+    }
+    async handleResume(snapshot) {
+        if (!this.paused) {
+            return;
+        }
+        this.paused = false;
+        this.lastPauseRequestId = null;
+        this.lastPauseReason = null;
+        this.manifest.status_detail = null;
+        appendSummary(this.manifest, 'Run resumed by control request.');
+        await this.persist();
+        await this.safeAppend({
+            event: 'run_resumed',
+            actor: 'runner',
+            payload: {
+                request_id: snapshot.latest_action?.request_id ?? null,
+                control_seq: snapshot.control_seq ?? null,
+                requested_by: snapshot.latest_action?.requested_by ?? null,
+                requested_reason: snapshot.latest_action?.reason ?? null
+            },
+            timestamp: this.now()
+        });
+    }
+    async handleCancel(snapshot) {
+        if (this.cancelRequested) {
+            return;
+        }
+        this.cancelRequested = true;
+        appendSummary(this.manifest, 'Run cancellation requested.');
+        await this.persist();
+        await this.safeAppend({
+            event: 'run_canceled',
+            actor: 'runner',
+            payload: {
+                request_id: snapshot.latest_action?.request_id ?? null,
+                control_seq: snapshot.control_seq ?? null,
+                requested_by: snapshot.latest_action?.requested_by ?? null,
+                requested_reason: snapshot.latest_action?.reason ?? null
+            },
+            timestamp: this.now()
+        });
+    }
+    async handleFail(snapshot) {
+        if (this.failureRequested) {
+            return;
+        }
+        this.failureRequested = true;
+        this.manifest.status_detail = snapshot.latest_action?.reason ?? 'control_failed';
+        appendSummary(this.manifest, 'Run failed by control request.');
+        await this.persist();
+        await this.safeAppend({
+            event: 'run_failed',
+            actor: 'runner',
+            payload: {
+                reason: 'control_request',
+                request_id: snapshot.latest_action?.request_id ?? null,
+                control_seq: snapshot.control_seq ?? null,
+                requested_by: snapshot.latest_action?.requested_by ?? null,
+                requested_reason: snapshot.latest_action?.reason ?? null
+            },
+            timestamp: this.now()
+        });
+    }
+    async safeAppend(entry) {
+        try {
+            const appended = await this.eventStream?.append(entry);
+            if (appended) {
+                this.onEntry?.(appended);
+            }
+        }
+        catch (error) {
+            logger.warn(`[ControlWatcher] Failed to append event: ${error?.message ?? String(error)}`);
+        }
+    }
+}
+async function readControlFile(pathname) {
+    try {
+        const raw = await readFile(pathname, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return null;
+        }
+        logger.warn(`[ControlWatcher] Failed to read control file: ${error?.message ?? String(error)}`);
+        return null;
+    }
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/dist/orchestrator/src/cli/control/delegationTokens.js

@@ -0,0 +1,62 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+export class DelegationTokenStore {
+    now;
+    records = new Map();
+    constructor(options = {}) {
+        this.now = options.now ?? (() => new Date().toISOString());
+        if (options.seed) {
+            for (const record of options.seed) {
+                this.records.set(record.token_id, { ...record });
+            }
+        }
+    }
+    issue(parentRunId, childRunId) {
+        const token = randomBytes(32).toString('hex');
+        const record = {
+            token_id: `dlt-${randomBytes(8).toString('hex')}`,
+            token_hash: hashToken(token),
+            parent_run_id: parentRunId,
+            child_run_id: childRunId,
+            created_at: this.now(),
+            expires_at: null
+        };
+        this.records.set(record.token_id, record);
+        return { token, record };
+    }
+    register(token, parentRunId, childRunId) {
+        const record = {
+            token_id: `dlt-${randomBytes(8).toString('hex')}`,
+            token_hash: hashToken(token),
+            parent_run_id: parentRunId,
+            child_run_id: childRunId,
+            created_at: this.now(),
+            expires_at: null
+        };
+        this.records.set(record.token_id, record);
+        return { ...record };
+    }
+    validate(token, parentRunId, childRunId) {
+        const tokenHash = hashToken(token);
+        for (const record of this.records.values()) {
+            if (record.parent_run_id !== parentRunId || record.child_run_id !== childRunId) {
+                continue;
+            }
+            if (timingSafeEqualStrings(record.token_hash, tokenHash)) {
+                return { ...record };
+            }
+        }
+        return null;
+    }
+    list() {
+        return Array.from(this.records.values()).map((record) => ({ ...record }));
+    }
+}
+function hashToken(token) {
+    return createHash('sha256').update(token).digest('hex');
+}
+function timingSafeEqualStrings(left, right) {
+    if (left.length !== right.length) {
+        return false;
+    }
+    return timingSafeEqual(Buffer.from(left, 'utf8'), Buffer.from(right, 'utf8'));
+}

package/dist/orchestrator/src/cli/control/questions.js

@@ -0,0 +1,106 @@
+export class QuestionQueue {
+    now;
+    records = new Map();
+    counter = 0;
+    constructor(options = {}) {
+        this.now = options.now ?? (() => new Date().toISOString());
+        if (options.seed) {
+            this.hydrate(options.seed);
+        }
+    }
+    enqueue(input) {
+        const queuedAt = this.now();
+        const expiresAt = typeof input.expiresInMs === 'number' && input.expiresInMs > 0
+            ? new Date(Date.parse(queuedAt) + input.expiresInMs).toISOString()
+            : null;
+        const question = {
+            question_id: this.nextId(),
+            parent_run_id: input.parentRunId,
+            from_run_id: input.fromRunId,
+            from_manifest_path: input.fromManifestPath ?? null,
+            prompt: input.prompt,
+            urgency: input.urgency,
+            status: 'queued',
+            queued_at: queuedAt,
+            expires_at: expiresAt,
+            expires_in_ms: typeof input.expiresInMs === 'number' ? input.expiresInMs : null,
+            auto_pause: input.autoPause ?? true,
+            expiry_fallback: input.expiryFallback ?? null
+        };
+        this.records.set(question.question_id, question);
+        return question;
+    }
+    get(questionId) {
+        return this.records.get(questionId);
+    }
+    list() {
+        return Array.from(this.records.values());
+    }
+    answer(questionId, answer, answeredBy) {
+        const record = this.records.get(questionId);
+        if (!record) {
+            throw new Error('question_not_found');
+        }
+        if (record.status !== 'queued') {
+            throw new Error('question_closed');
+        }
+        const now = this.now();
+        record.status = 'answered';
+        record.answer = answer;
+        record.answered_by = answeredBy;
+        record.answered_at = now;
+        record.closed_at = now;
+    }
+    dismiss(questionId, dismissedBy) {
+        const record = this.records.get(questionId);
+        if (!record) {
+            throw new Error('question_not_found');
+        }
+        if (record.status !== 'queued') {
+            throw new Error('question_closed');
+        }
+        const now = this.now();
+        record.status = 'dismissed';
+        record.dismissed_by = dismissedBy;
+        record.closed_at = now;
+    }
+    expire() {
+        const nowIso = this.now();
+        const now = Date.parse(nowIso);
+        const expired = [];
+        for (const record of this.records.values()) {
+            if (record.status !== 'queued' || !record.expires_at) {
+                continue;
+            }
+            if (Date.parse(record.expires_at) <= now) {
+                record.status = 'expired';
+                record.closed_at = nowIso;
+                expired.push({ ...record });
+            }
+        }
+        return expired;
+    }
+    hydrate(records) {
+        for (const record of records) {
+            this.records.set(record.question_id, { ...record });
+        }
+        this.counter = Math.max(this.counter, resolveCounter(records));
+    }
+    nextId() {
+        this.counter += 1;
+        return `q-${this.counter.toString().padStart(4, '0')}`;
+    }
+}
+function resolveCounter(records) {
+    let max = 0;
+    for (const record of records) {
+        const match = /^q-(\d+)/.exec(record.question_id);
+        if (match) {
+            const value = Number.parseInt(match[1] ?? '0', 10);
+            if (Number.isFinite(value)) {
+                max = Math.max(max, value);
+            }
+        }
+    }
+    return max;
+}