@kylecheng3146/agent-ops 0.5.3 → 0.7.0

package/dist/runtime/src/install/preauth.js

@@ -40,6 +40,9 @@ export const CLAUDE_PREAUTH_UNSANDBOXED = [
     "npx lint-staged",
     "npx lint-staged *"
 ];
+/** Added with the `run` profile: `agent-ops run` starts a launchd supervisor. */
+export const CLAUDE_PREAUTH_RUN_ALLOW = ["Bash(agent-ops run *)"];
+export const CLAUDE_PREAUTH_RUN_UNSANDBOXED = ["agent-ops run", "agent-ops run *"];
 export const CODEX_RULES_PATH = "rules/agent-ops.rules";
 export const CODEX_RULES_MARKER = "# agent-ops managed: regenerated by agent-ops init and update; do not edit.";
 const HOSTS = ["AGENT_OPS_HOST=codex", "AGENT_OPS_HOST=claude", "AGENT_OPS_HOST=agy"];
@@ -129,6 +132,23 @@ export const CODEX_RULES_CONTENT = `${[
         ];
     })
 ].join("\n")}\n`;
+/**
+ * The `run` profile's rule: one argv prefix covers bare `agent-ops run` and
+ * every `agent-ops run *` shape the rules tell Codex to start escalated.
+ */
+export const CODEX_RUN_RULE = rule({
+    withHost: false,
+    command: ["run"],
+    justification: "agent-ops run starts a launchd supervisor and reviews, which need network and loopback outside the sandbox.",
+    match: "env -u CODEX_SANDBOX_NETWORK_DISABLED agent-ops run --goal-file .agent-ops/state/run-goal.md --host codex --wait",
+    notMatch: "env -u CODEX_SANDBOX_NETWORK_DISABLED agent-ops trust grant --scope project --yes"
+});
+/** The rules file for worktree auto mode and the `run` profile, or null for neither. */
+export function codexRulesContent(worktree, run) {
+    if (!run)
+        return worktree ? CODEX_RULES_CONTENT : null;
+    return `${worktree ? CODEX_RULES_CONTENT : `${CODEX_RULES_MARKER}\n`}${CODEX_RUN_RULE}\n`;
+}
 export function codexHomeDirectory(env = process.env) {
     return env.CODEX_HOME ?? join(env.HOME ?? homedir(), ".codex");
 }
@@ -165,7 +185,7 @@ function stringList(value, where) {
  * settings. Nothing else in the file is touched. `null` content means the file
  * held nothing but these entries and should go; `undefined` means no change.
  */
-export function planClaudeLocalSettings(source, desired) {
+export function planClaudeLocalSettings(source, desired, run = false) {
     let settings = {};
     if (source !== null && source.trim() !== "") {
         let parsed;
@@ -188,11 +208,14 @@ export function planClaudeLocalSettings(source, desired) {
     }
     const allow = stringList(permissions.allow, "permissions.allow");
     const excluded = stringList(sandbox.excludedCommands, "sandbox.excludedCommands");
-    const merge = (current, managed) => desired
-        ? [...current, ...managed.filter((entry) => !current.includes(entry))]
-        : current.filter((entry) => !managed.includes(entry));
-    const nextAllow = merge(allow, CLAUDE_PREAUTH_ALLOW);
-    const nextExcluded = merge(excluded, CLAUDE_PREAUTH_UNSANDBOXED);
+    // Run entries leave with the profile, so an update without it strips them.
+    const merge = (current, managed, runManaged) => {
+        const wanted = [...(desired ? managed : []), ...(run ? runManaged : [])];
+        const kept = current.filter((entry) => wanted.includes(entry) || ![...managed, ...runManaged].includes(entry));
+        return [...kept, ...wanted.filter((entry) => !kept.includes(entry))];
+    };
+    const nextAllow = merge(allow, CLAUDE_PREAUTH_ALLOW, CLAUDE_PREAUTH_RUN_ALLOW);
+    const nextExcluded = merge(excluded, CLAUDE_PREAUTH_UNSANDBOXED, CLAUDE_PREAUTH_RUN_UNSANDBOXED);
     if (nextAllow.length === allow.length && nextExcluded.length === excluded.length &&
         nextAllow.every((entry, index) => entry === allow[index]) &&
         nextExcluded.every((entry, index) => entry === excluded[index])) {
@@ -218,15 +241,16 @@ export function planClaudeLocalSettings(source, desired) {
         content: Object.keys(next).length === 0 ? null : `${JSON.stringify(next, null, 2)}\n`
     };
 }
-async function claudeChange(root, desired) {
+async function claudeChange(root, desired, run) {
     const current = await readCurrent(root, CLAUDE_LOCAL_SETTINGS_PATH);
-    const planned = planClaudeLocalSettings(current?.content ?? null, desired);
+    const planned = planClaudeLocalSettings(current?.content ?? null, desired, run);
     if (planned === undefined) {
         return undefined;
     }
-    const summary = desired
+    const summary = desired || run
         ? `Adds to ${CLAUDE_LOCAL_SETTINGS_PATH} (existing entries kept): permissions.allow ` +
-            `${JSON.stringify(CLAUDE_PREAUTH_ALLOW)}; sandbox.excludedCommands ${JSON.stringify(CLAUDE_PREAUTH_UNSANDBOXED)}.`
+            `${JSON.stringify([...(desired ? CLAUDE_PREAUTH_ALLOW : []), ...(run ? CLAUDE_PREAUTH_RUN_ALLOW : [])])}; sandbox.excludedCommands ` +
+            `${JSON.stringify([...(desired ? CLAUDE_PREAUTH_UNSANDBOXED : []), ...(run ? CLAUDE_PREAUTH_RUN_UNSANDBOXED : [])])}.`
         : `Removes the agent-ops entries from ${CLAUDE_LOCAL_SETTINGS_PATH}, keeping everything else.`;
     if (planned.content === null) {
         return current === null
@@ -250,7 +274,8 @@ async function claudeChange(root, desired) {
         ownedContent: false
     };
 }
-async function codexChange(codexHome, desired) {
+async function codexChange(codexHome, desired, run) {
+    const content = codexRulesContent(desired, run);
     const isDirectory = await lstat(codexHome).then((status) => status.isDirectory(), () => false);
     if (!isDirectory) {
         return undefined;
@@ -261,7 +286,7 @@ async function codexChange(codexHome, desired) {
     if (current !== null && !current.content.startsWith(CODEX_RULES_MARKER)) {
         return undefined;
     }
-    if (!desired) {
+    if (content === null) {
         return current === null
             ? undefined
             : {
@@ -271,37 +296,38 @@ async function codexChange(codexHome, desired) {
                 ownedContent: true
             };
     }
-    return current?.content === CODEX_RULES_CONTENT
+    return current?.content === content
         ? undefined
         : {
             root: codexHome,
             operation: {
                 kind: "write",
                 path: CODEX_RULES_PATH,
-                content: CODEX_RULES_CONTENT,
+                content,
                 expectedHash: current?.hash ?? null
             },
-            summary: `Writes ${join(codexHome, CODEX_RULES_PATH)}: allow rules for agent-ops review, batch, doctor --check-auth, worktree commit and lint-staged.`,
+            summary: `Writes ${join(codexHome, CODEX_RULES_PATH)}: allow rules for ${desired ? `agent-ops review, batch, ${run ? "run, " : ""}doctor --check-auth, worktree commit and lint-staged` : "agent-ops run"}.`,
             ownedContent: true
         };
 }
 /**
  * What init, update and uninstall change beyond the manifest: the local Claude
  * settings entries and the Codex rules file. Project scope only; `desired`
- * false plans the removal of what agent-ops wrote.
+ * (worktree auto mode) and `run` false plan the removal of what agent-ops wrote.
  */
 export async function planPreauth(options) {
+    const run = options.run === true;
     if (options.scope !== "project") {
         return [];
     }
     const changes = [];
     if (options.harness.includes("claude")) {
-        changes.push(await claudeChange(options.root, options.desired));
+        changes.push(await claudeChange(options.root, options.desired, run));
     }
     // Codex's home is outside the project, so it is only touched when the caller
     // names it (the CLI does): planning alone must never reach into a real home.
     if (options.harness.includes("codex") && options.codexHome !== undefined) {
-        changes.push(await codexChange(options.codexHome, options.desired));
+        changes.push(await codexChange(options.codexHome, options.desired, run));
     }
     return changes.filter((change) => change !== undefined);
 }

package/dist/runtime/src/install/profiles.js

@@ -1,16 +1,20 @@
 import { AgentOpsError } from "../fs/paths.js";
-const PROFILE_ORDER = ["core", "advisory", "guardrails", "loop"];
+const PROFILE_ORDER = ["core", "advisory", "guardrails", "loop", "run"];
 export const PROFILE_CAPABILITIES = {
     core: ["rules", "task", "verify", "review"],
     advisory: ["lifecycle-summary", "local-log"],
     guardrails: ["command-policy"],
-    loop: ["project-loop"]
+    loop: ["project-loop"],
+    run: ["auto-run"]
 };
 export function resolveProfiles(inputProfiles) {
     if (inputProfiles.length === 0) {
         throw new AgentOpsError("PROFILE_REQUIRED", "At least one installation profile is required.");
     }
     const selectedProfiles = new Set(inputProfiles);
+    if (selectedProfiles.has("run")) {
+        selectedProfiles.add("loop");
+    }
     if (selectedProfiles.has("guardrails") ||
         selectedProfiles.has("loop")) {
         selectedProfiles.add("core");
@@ -30,6 +34,8 @@ export function resolveProfiles(inputProfiles) {
 }
 export function resolveCapabilities(config) {
     const resolved = resolveProfiles(config.profiles);
+    if (config.features.office?.enabled === true)
+        resolved.capabilities.push("office-presence");
     if (config.features.stopVerification.enabled) {
         resolved.capabilities.push("optional-stop-verify");
     }

package/dist/runtime/src/install/update.js

@@ -114,6 +114,7 @@ export async function createUpdatePlan(options) {
         adapters: options.adapters,
         toolkitVersion: options.toolkitVersion ?? targetVersion,
         allowHarnessChange: true,
+        ...(options.officeEnabled === undefined ? {} : { officeEnabled: options.officeEnabled }),
         ...(options.hookRuntimePath === undefined
             ? {}
             : { hookRuntimePath: options.hookRuntimePath }),

package/dist/runtime/src/office/collect.js

@@ -0,0 +1,233 @@
+import { execFile } from "node:child_process";
+import { readdir, readFile, realpath, stat } from "node:fs/promises";
+import { basename, join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { readWorktreeRecord, parseWorktreeListPorcelain } from "../parallel/service.js";
+import { FileRunRepository } from "../run/service.js";
+import { criteriaProgress } from "../run/phase.js";
+import { parseTaskStateSource } from "../task/store.js";
+import { findReviewAttestation } from "../review/attestation.js";
+import { FileEvidenceStore } from "../verify/evidence.js";
+import { readPrivateFile } from "../security/permissions.js";
+import { OFFICE_SESSION_RETENTION_MS, readOfficeSessions } from "./sessions.js";
+const run = promisify(execFile);
+export const officeGit = async (cwd, args) => {
+    try {
+        return { exitCode: 0, stdout: (await run("git", [...args], { cwd, maxBuffer: 8 * 1024 * 1024 })).stdout };
+    }
+    catch {
+        return { exitCode: 1, stdout: "" };
+    }
+};
+const MAX_PATHS = 200;
+const OFFICE_PHASES = new Set(["planning", "implementing", "verifying", "reviewing", "integrating", "unknown"]);
+function officePhase(value) {
+    return value === undefined ? undefined : OFFICE_PHASES.has(value) ? value : "unknown";
+}
+function evidenceValue(value, taskId, criterionId) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return null;
+    const evidence = value;
+    return evidence.taskId === taskId && evidence.criterionId === criterionId &&
+        (evidence.status === "PASS" || evidence.status === "FAIL" || evidence.status === "UNKNOWN")
+        ? value : null;
+}
+async function taskView(root, record) {
+    const store = new FileEvidenceStore(root, root);
+    const loaded = [];
+    for (const criterion of record.task.criteria) {
+        for (const reference of record.evidence[criterion.id] ?? []) {
+            if (reference.startsWith("review:"))
+                continue;
+            const item = await store.load(reference).catch(() => null);
+            const parsed = evidenceValue(item, record.task.id, criterion.id);
+            if (parsed !== null)
+                loaded.push({ reference, evidence: parsed });
+        }
+    }
+    // A task keeps its evidence history. The desk shows the newest observation
+    // for each verifier/acceptance phase so an old failure cannot poison a
+    // later PASS, and a stale review cannot remain current after a new verify.
+    const latest = new Map();
+    for (const item of loaded) {
+        const phase = item.evidence.acceptance?.phase ?? "command";
+        const key = `${item.evidence.criterionId}\0${item.evidence.commandId}\0${phase}`;
+        const previous = latest.get(key);
+        const currentAt = Date.parse(item.evidence.finishedAt);
+        const previousAt = previous === undefined ? Number.NEGATIVE_INFINITY : Date.parse(previous.evidence.finishedAt);
+        if (previous === undefined || currentAt >= previousAt)
+            latest.set(key, item);
+    }
+    const evidence = [...latest.values()].map(item => item.evidence);
+    let passed = 0;
+    for (const criterion of record.task.criteria) {
+        const rows = evidence.filter(item => item.criterionId === criterion.id);
+        const result = criteriaProgress([criterion], {
+            results: rows.map(item => ({ status: item.status })),
+            acceptance: rows.flatMap(item => item.acceptance?.checks.map(check => ({ criterionId: criterion.id, status: check.status })) ?? [])
+        });
+        passed += result.passed;
+    }
+    const total = record.task.criteria.length;
+    const verify = evidence.some(item => item.status === "FAIL" || item.status === "UNKNOWN")
+        ? "FAIL"
+        : total > 0 && passed === total
+            ? "PASS"
+            : null;
+    const newest = evidence.reduce((current, item) => current === null || Date.parse(item.finishedAt) >= Date.parse(current.finishedAt) ? item : current, null);
+    const review = newest !== null &&
+        await findReviewAttestation(root, newest.sourceFingerprint, record.task.id) !== null ? "PASS" : null;
+    const progress = { verify, review, passed, total };
+    const phase = record.status === "complete"
+        ? "integrating"
+        : review === "PASS"
+            ? "reviewing"
+            : verify !== null
+                ? "verifying"
+                : evidence.length > 0
+                    ? "implementing"
+                    : "planning";
+    return { taskId: record.task.id, status: record.status, phase, progress, completedAt: record.completedAt };
+}
+async function taskState(root) {
+    const source = await readPrivateFile(join(root, ".agent-ops", "tasks", "state.json"), root).catch(() => null);
+    if (source === null)
+        return null;
+    try {
+        return parseTaskStateSource(source);
+    }
+    catch {
+        return null;
+    }
+}
+async function attachedTaskView(root, sessionId, fallbackTaskId) {
+    const state = await taskState(root);
+    if (state === null)
+        return null;
+    const taskId = state.sessions.find(session => session.sessionId === sessionId)?.taskId ?? fallbackTaskId;
+    if (taskId === undefined)
+        return null;
+    const record = state.tasks.find(task => task.task.id === taskId);
+    return record === undefined ? null : await taskView(root, record);
+}
+/** Changed paths and line counts against the worktree's base, committed or not. */
+export async function worktreeDiff(git, path, base) {
+    // The record is a file inside the checkout; only a commit id may reach git's argument list.
+    const numstat = /^[0-9a-f]{40,64}$/u.test(base) ? await git(path, ["diff", "--numstat", "-z", base, "--"]) : { exitCode: 1, stdout: "" };
+    const untracked = await git(path, ["ls-files", "--others", "--exclude-standard", "-z"]);
+    let insertions = 0, deletions = 0;
+    const paths = [];
+    // -z numstat: "added\tdeleted\tpath\0", renames as "added\tdeleted\t\0from\0to\0".
+    const fields = numstat.stdout.split("\0");
+    for (let i = 0; i < fields.length; i++) {
+        const match = /^(\d+|-)\t(\d+|-)\t(.*)$/u.exec(fields[i]);
+        if (match === null)
+            continue;
+        insertions += Number(match[1]) || 0;
+        deletions += Number(match[2]) || 0;
+        paths.push(match[3] === "" ? (i += 2, fields[i]) : match[3]);
+    }
+    paths.push(...untracked.stdout.split("\0").filter(p => p !== ""));
+    let recent = null, newest = -1;
+    for (const p of paths.slice(0, MAX_PATHS)) {
+        const mtime = await stat(join(path, p)).then(s => s.mtimeMs, () => -1);
+        if (mtime > newest) {
+            newest = mtime;
+            recent = p;
+        }
+    }
+    return { files: paths.length, insertions, deletions, paths: paths.slice(0, MAX_PATHS), recent: recent ?? paths[0] ?? null };
+}
+/** Each run is read on its own: one unreadable run must not hide the building. */
+export async function readRuns(commonDir) {
+    const directory = join(commonDir, "agent-ops", "runs");
+    const repository = new FileRunRepository(directory, commonDir);
+    const names = await readdir(directory).catch(() => []);
+    const runs = [];
+    for (const name of names.filter(n => n.endsWith(".json"))) {
+        const state = await repository.read(basename(name, ".json")).catch(() => null);
+        if (state !== null)
+            runs.push(state);
+    }
+    return runs.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
+}
+async function readSessions(mainRoot, commonDir, now, trustedRoots = [mainRoot]) {
+    const sessions = await readOfficeSessions(commonDir, now).catch(() => []);
+    const views = await Promise.all(sessions.map(async (session) => {
+        let task = null;
+        for (const root of trustedRoots) {
+            task = await attachedTaskView(root, session.sessionId, root === mainRoot ? session.taskId : undefined);
+            if (task !== null)
+                break;
+        }
+        const observedPhase = session?.phase === undefined ? undefined : officePhase(session.phase) ?? "unknown";
+        const phase = task === null
+            ? observedPhase
+            : task.status === "complete"
+                ? task.phase
+                : observedPhase ?? task.phase;
+        return task === null
+            ? session
+            : { ...session, taskId: task.taskId, phase, taskStatus: task.status, progress: task.progress,
+                completedAt: task.completedAt, status: task.status === "complete" ? "idle" : session.status };
+    }));
+    return views.filter(session => session.completedAt === undefined || session.completedAt === null ||
+        now - Date.parse(session.completedAt) <= OFFICE_SESSION_RETENTION_MS);
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}
+/** Review slots held by a live process (see review/slots.ts). */
+export async function readReviewSlots(commonDir) {
+    const slots = [];
+    for (const name of (await readdir(commonDir).catch(() => [])).sort()) {
+        const match = /^agent-ops-review-slot-(\d+)\.lock$/u.exec(name);
+        if (match === null)
+            continue;
+        try {
+            const owner = JSON.parse(await readFile(join(commonDir, name, "owner.json"), "utf8"));
+            if (typeof owner.pid !== "number" || typeof owner.at !== "number" || !alive(owner.pid))
+                continue;
+            slots.push({ slot: Number(match[1]), since: new Date(owner.at).toISOString(),
+                taskId: typeof owner.taskId === "string" ? owner.taskId : null, root: typeof owner.root === "string" ? owner.root : null });
+        }
+        catch { /* a slot being claimed or released */ }
+    }
+    return slots;
+}
+export async function collectOfficeInput(mainRoot, commonDir, git = officeGit, now = Date.now()) {
+    const worktrees = [];
+    const discovered = [];
+    for (const entry of parseWorktreeListPorcelain((await git(mainRoot, ["worktree", "list", "--porcelain"])).stdout)) {
+        const path = await realpath(resolve(entry.path)).catch(() => resolve(entry.path));
+        const record = await readWorktreeRecord(path).catch(() => null);
+        if (record === null)
+            continue;
+        discovered.push({ path, record });
+    }
+    const sessions = await readSessions(mainRoot, commonDir, now, [mainRoot, ...discovered.map(item => item.path)]);
+    for (const { path, record } of discovered) {
+        const session = sessions.find(item => item.sessionId === record.sessionId);
+        const task = await attachedTaskView(path, record.sessionId, session?.taskId);
+        const base = { name: record.name, path, branch: record.branch, sessionId: record.sessionId,
+            ...(record.runId === undefined ? {} : { runId: record.runId }), diff: await worktreeDiff(git, path, record.base) };
+        const observedPhase = session?.phase === undefined ? undefined : officePhase(session.phase) ?? "unknown";
+        const phase = task === null
+            ? observedPhase
+            : task.status === "complete"
+                ? task.phase
+                : observedPhase ?? task.phase;
+        worktrees.push(task === null
+            ? session === undefined ? base : { ...base, ...(officePhase(session.phase) === undefined ? {} : { phase: officePhase(session.phase) }), status: session.status,
+                ...(session.taskId === undefined ? {} : { taskId: session.taskId }), host: session.host ?? session.harness }
+            : { ...base, phase, status: task.status, taskId: task.taskId, progress: task.progress,
+                ...(task.completedAt === null ? {} : { completedAt: task.completedAt }), host: session?.host ?? session?.harness });
+    }
+    return { runs: await readRuns(commonDir), worktrees, sessions, reviews: await readReviewSlots(commonDir), now };
+}