@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.3

package/src/filtered-tasks.js

@@ -0,0 +1,576 @@
+import { createHash, randomBytes } from "node:crypto";
+import { execFile } from "node:child_process";
+import { constants } from "node:fs";
+import { lstat, mkdir, open, readdir, realpath, rename, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { CODEFLOW_HOME } from "./config.js";
+import { childEnv } from "./env.js";
+import { allowsFilePolicy, normalizePolicyPath, validateFilePolicySnapshot } from "./filesystem-policy.js";
+import { sensitiveContextPath } from "./context-inspection.js";
+import { getAdapter } from "./adapters/index.js";
+import { filteredTaskContainer } from "./agent-container.js";
+import { redactExport } from "./privacy.js";
+import { inspectFilteredWorkspace, monitorFilteredWorkspace } from "./filtered-task-limits.js";
+import { durableWorkerDirectory } from "./remote-workers/durability.js";
+const MAX_FILES = 500, MAX_FILE = 512 * 1024, MAX_TOTAL = 16 * 1024 * 1024, MAX_JOBS = 100;
+const sha = (value) => createHash("sha256").update(value).digest("hex");
+const idPattern = /^filtered-[a-f0-9]{24}$/;
+class FilteredTaskError extends Error {
+  constructor(message, status = 409) {
+    super(message);
+    this.status = status;
+  }
+}
+const safeEnv = (extra = {}) => {
+  const environment = childEnv();
+  for (const key of Object.keys(environment)) if (key.startsWith("GIT_")) delete environment[key];
+  return { ...environment, GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null", GIT_CONFIG_NOSYSTEM: "1", GIT_CONFIG_COUNT: "0", GIT_ATTR_NOSYSTEM: "1", GIT_NO_REPLACE_OBJECTS: "1", GIT_NO_LAZY_FETCH: "1", GIT_TERMINAL_PROMPT: "0", GIT_OPTIONAL_LOCKS: "0", ...extra };
+};
+function execute(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = execFile(command, args, { cwd: options.cwd, env: options.env ?? safeEnv(), encoding: "buffer", timeout: options.timeout ?? 3e4, maxBuffer: options.maxBuffer ?? MAX_TOTAL + 1024 * 1024 }, (error, stdout, stderr) => error ? reject(new FilteredTaskError(`${command} failed: ${String(stderr).slice(-2e3) || error.message}`, 422)) : resolve(stdout));
+    child.stdin?.on("error", () => void 0);
+    child.stdin?.end(options.input);
+  });
+}
+async function git(repo, args, options = {}) {
+  return execute("git", ["--no-replace-objects", "-c", "core.fsmonitor=false", "-c", "core.hooksPath=/dev/null", "-c", "core.attributesFile=/dev/null", "-c", "core.sparseCheckout=false", "-c", "protocol.allow=never", "-c", "gc.auto=0", "-c", "maintenance.auto=false", "-c", "commit.gpgSign=false", ...args], { cwd: repo, ...options, env: safeEnv(options.env) });
+}
+const dockerFilteredRuntime = {
+  async pinImage(image) {
+    if (!/^[a-zA-Z0-9][\w./:@-]{0,199}$/.test(image)) throw new FilteredTaskError("Choose an explicitly prepared local Docker image", 400);
+    if (process.env.DOCKER_HOST && !/^(unix|npipe):\/\//.test(process.env.DOCKER_HOST)) throw new FilteredTaskError("Filtered tasks require a local Docker daemon");
+    const endpoint = (await execute("docker", ["context", "inspect", "--format", "{{.Endpoints.docker.Host}}"], { timeout: 1e4 })).toString().trim();
+    if (!/^(unix|npipe):\/\//.test(endpoint)) throw new FilteredTaskError("Filtered tasks require a local Docker context");
+    const id = (await execute("docker", ["image", "inspect", "--format", "{{.Id}}", image], { timeout: 1e4 })).toString().trim();
+    if (!/^sha256:[a-f0-9]{64}$/.test(id)) throw new FilteredTaskError("Docker did not return an immutable image identity");
+    return id;
+  },
+  async run(job, workspace, signal, onEvent) {
+    const container = filteredTaskContainer({ image: job.imageId, network: job.network, memoryMb: 4096, cpus: 2 }, job.id, job.base.filter((file) => !permitted(job.policies, "write", file.path)).map((file) => file.path));
+    return getAdapter(job.agent).run({ cwd: workspace, prompt: `This is a filtered committed repository snapshot. Original history, ignored files, denied paths, host credentials and private application memory are absent. Work only in this directory. Changes outside the permitted import paths will be rejected. Do not modify .git.
+
+Task:
+${job.task}`, mode: "write", trust: "safe", signal, timeoutMs: job.maxMinutes * 6e4, agentContainer: container, questionProtocol: "structured", interactiveApprovals: false }, onEvent);
+  },
+  async stop(jobId) {
+    if (!idPattern.test(jobId)) throw new FilteredTaskError("Invalid filtered task identity", 400);
+    const listed = (await execute("docker", ["ps", "-aq", "--filter", "label=codeflow.managed-agent=true", "--filter", `label=codeflow.filtered-task=${jobId}`], { timeout: 1e4 })).toString().trim().split(/\s+/).filter(Boolean);
+    if (listed.some((id) => !/^[a-f0-9]{12,64}$/.test(id))) throw new FilteredTaskError("Docker returned an ambiguous container receipt");
+    if (listed.length) await execute("docker", ["rm", "--force", ...listed], { timeout: 15e3 });
+    const remaining = (await execute("docker", ["ps", "-aq", "--filter", `label=codeflow.filtered-task=${jobId}`], { timeout: 1e4 })).toString().trim();
+    if (remaining) throw new FilteredTaskError("The filtered task's daemon container could not be confirmed stopped");
+  }
+};
+const policyIdentity = (policies) => sha(JSON.stringify(policies.map((policy) => [policy.projectId, policy.revision, policy.hash]).sort()));
+const permitted = (policies, operation, path) => !sensitiveContextPath(path) && policies.every((policy) => allowsFilePolicy(policy, operation, path));
+const resultIdentity = (files) => sha(JSON.stringify(files.map(({ path, hash, mode, bytes }) => ({ path, hash, mode, bytes })).sort((a, b) => a.path.localeCompare(b.path))));
+class FilteredTasks {
+  constructor(options) {
+    this.options = options;
+    this.directory = join(options.home ?? CODEFLOW_HOME, "filtered-tasks");
+    this.runtime = options.runtime ?? dockerFilteredRuntime;
+  }
+  jobs = /* @__PURE__ */ new Map();
+  controllers = /* @__PURE__ */ new Map();
+  work = /* @__PURE__ */ new Map();
+  writes = /* @__PURE__ */ new Map();
+  preparations = /* @__PURE__ */ new Map();
+  importClaims = /* @__PURE__ */ new Set();
+  importWork = /* @__PURE__ */ new Map();
+  mutations = /* @__PURE__ */ new Map();
+  reservations = 0;
+  loaded = false;
+  closing = false;
+  directory;
+  runtime;
+  directoryFor(id) {
+    if (!idPattern.test(id)) throw new FilteredTaskError("Invalid filtered task", 400);
+    return join(this.directory, id);
+  }
+  workspace(id) {
+    return join(this.directoryFor(id), "workspace");
+  }
+  list(project) {
+    return [...this.jobs.values()].filter((job) => !project || job.project === project).sort((a, b) => b.createdAt - a.createdAt).map((job) => this.get(job.id));
+  }
+  summaries(project) {
+    return [...this.jobs.values()].filter((job) => !project || job.project === project).sort((a, b) => b.createdAt - a.createdAt).map(({ id, revision, project: project2, status, createdAt, updatedAt, containerStopped, importBranch, importCommit }) => ({ id, revision, project: project2, status, createdAt, updatedAt, containerStopped, importBranch, importCommit }));
+  }
+  async read(id) {
+    const job = this.require(id);
+    const policies = await this.options.authorize(job.project, job.repo);
+    if (policyIdentity(policies) !== policyIdentity(job.policies)) throw new FilteredTaskError("Historical task content is unavailable after its filesystem policy changed; metadata and explicit cancellation remain available", 403);
+    return this.get(id);
+  }
+  get(id) {
+    const job = this.require(id);
+    const { base: _base, result: _result, policies: _policies, ...view } = job;
+    return structuredClone({ ...view, exportedFiles: job.base.length, exportedBytes: job.base.reduce((sum, file) => sum + file.bytes, 0), policyRevisions: job.policies.map(({ projectId, revision, hash }) => ({ projectId, revision, hash })) });
+  }
+  active() {
+    return !!this.reservations || !!this.importClaims.size || !!this.mutations.size || [...this.jobs.values()].some((job) => ["preparing", "running", "importing"].includes(job.status) || !job.containerStopped);
+  }
+  mutation(id, operation) {
+    this.require(id);
+    if (this.closing || this.mutations.has(id) || this.importClaims.has(id)) throw new FilteredTaskError("Another import or task mutation is already claimed, or the service is closing");
+    const work = Promise.resolve().then(operation);
+    this.mutations.set(id, work);
+    void work.finally(() => {
+      if (this.mutations.get(id) === work) this.mutations.delete(id);
+    }).catch(() => void 0);
+    return work;
+  }
+  require(id) {
+    const job = this.jobs.get(id);
+    if (!job) throw new FilteredTaskError("Filtered task not found", 404);
+    return job;
+  }
+  async load() {
+    await durableWorkerDirectory(this.directory);
+    const info = await lstat(this.directory);
+    if (!info.isDirectory() || info.isSymbolicLink()) throw new FilteredTaskError("Filtered task storage is not a private regular directory", 503);
+    const storageParent = await open(dirname(this.directory), "r");
+    try {
+      await storageParent.sync();
+    } finally {
+      await storageParent.close();
+    }
+    const entries = await readdir(this.directory);
+    if (entries.length > MAX_JOBS) throw new FilteredTaskError("Filtered task history exceeds its bound", 503);
+    for (const id of entries) {
+      if (!idPattern.test(id)) throw new FilteredTaskError("Unrecognized filtered task storage entry", 503);
+      const folder = this.directoryFor(id);
+      const metadata = await lstat(folder);
+      if (!metadata.isDirectory() || metadata.isSymbolicLink()) throw new FilteredTaskError("Symbolic filtered task storage is refused", 503);
+      const handle = await open(join(folder, "job.json"), constants.O_RDONLY | constants.O_NOFOLLOW);
+      let job;
+      try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.size > 2 * 1024 * 1024) throw new Error("Unbounded job record");
+        job = JSON.parse(await handle.readFile("utf8"));
+      } finally {
+        await handle.close();
+      }
+      if (job.version !== 1 || job.id !== id || !Number.isSafeInteger(job.revision) || !Array.isArray(job.base) || job.base.length > MAX_FILES || !Array.isArray(job.policies) || !Array.isArray(job.events) || job.events.length > 100 || !["preparing", "running", "completed", "failed", "cancelled", "unknown", "importing", "imported"].includes(job.status)) throw new FilteredTaskError("Invalid filtered task metadata; repair private storage", 503);
+      job.policies = job.policies.map(validateFilePolicySnapshot);
+      const records = (files, baseline) => {
+        let bytes = 0;
+        const paths = /* @__PURE__ */ new Set();
+        if (!Array.isArray(files) || files.length > MAX_FILES) throw new FilteredTaskError("Unbounded filtered task manifest", 503);
+        for (const file of files) {
+          if (!file || normalizePolicyPath(file.path) !== file.path || sensitiveContextPath(file.path) || paths.has(file.path) || !/^[a-f0-9]{64}$/.test(file.hash) || !["100644", "100755"].includes(file.mode) || !Number.isSafeInteger(file.bytes) || file.bytes < 0 || file.bytes > MAX_FILE || (bytes += file.bytes) > MAX_TOTAL || baseline && !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(file.blob ?? "")) throw new FilteredTaskError("Invalid filtered task manifest", 503);
+          paths.add(file.path);
+        }
+      };
+      records(job.base, true);
+      if (job.result) records(job.result, false);
+      if (job.sourceHead && !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(job.sourceHead) || job.importBranch && job.importBranch !== `codeflow/${id}` || job.importCommit && !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(job.importCommit)) throw new FilteredTaskError("Invalid filtered task source/import identity", 503);
+      this.jobs.set(id, job);
+      if (["preparing", "running", "importing"].includes(job.status)) await this.save(job, { status: "unknown", error: "Application restarted during an effectful phase. Inspect an import receipt or cancel and confirm the owned Docker container stopped; this task will not retry automatically." });
+    }
+    this.loaded = true;
+  }
+  async save(job, patch) {
+    const work = (this.writes.get(job.id) ?? Promise.resolve()).catch(() => void 0).then(async () => {
+      const next = { ...job, ...patch, revision: job.revision + 1, updatedAt: Date.now() }, folder = this.directoryFor(job.id), file = join(folder, "job.json"), temp = join(folder, `.job-${randomBytes(6).toString("hex")}.tmp`);
+      const handle = await open(temp, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify(next));
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      try {
+        await rename(temp, file);
+        const directory = await open(folder, "r");
+        try {
+          await directory.sync();
+        } finally {
+          await directory.close();
+        }
+        Object.assign(job, next);
+      } finally {
+        await rm(temp, { force: true }).catch(() => void 0);
+      }
+    });
+    this.writes.set(job.id, work);
+    try {
+      await work;
+    } finally {
+      if (this.writes.get(job.id) === work) this.writes.delete(job.id);
+    }
+  }
+  async current(job) {
+    const policies = await this.options.authorize(job.project, job.repo);
+    if (policyIdentity(policies) !== policyIdentity(job.policies)) throw new FilteredTaskError("Filesystem policy revision or project membership changed; prepare a new filtered task");
+    job.policies = structuredClone(policies);
+    if ((await git(job.repo, ["rev-parse", "--verify", "HEAD^{commit}"])).toString().trim() !== job.sourceHead) throw new FilteredTaskError("Original source revision changed; prepare a new filtered task");
+    const source = (await git(job.repo, ["ls-tree", "-rz", "-l", "--full-tree", job.sourceHead], { maxBuffer: 8 * 1024 * 1024 })).toString("utf8").split("\0").filter(Boolean);
+    const records = new Map(source.map((entry) => {
+      const match = /^(\d{6}) (blob|commit) ([a-f0-9]+)\s+(\d+|-)\t([\s\S]+)$/.exec(entry);
+      if (!match) throw new FilteredTaskError("Source tree contains an unsupported record");
+      return [match[5], { mode: match[1], blob: match[3], bytes: Number(match[4]) }];
+    }));
+    for (const file of job.base) {
+      const original = records.get(file.path);
+      if (!permitted(policies, "read", file.path) || !original || original.blob !== file.blob || original.mode !== file.mode || original.bytes !== file.bytes) throw new FilteredTaskError("Stored export manifest does not match the authorized source revision");
+    }
+  }
+  async create(raw) {
+    if (!this.loaded || this.closing) throw new FilteredTaskError("Filtered task service is unavailable or closing", 503);
+    if (this.jobs.size + this.reservations >= MAX_JOBS || this.reservations || this.active()) throw new FilteredTaskError("Wait for the current filtered task; history is bounded to 100 tasks");
+    if (typeof raw.project !== "string" || typeof raw.repo !== "string" || !raw.repo.startsWith("/") || typeof raw.task !== "string" || !raw.task.trim() || Buffer.byteLength(raw.task) > 24 * 1024 || !["claude", "codex", "agy"].includes(String(raw.agent)) || typeof raw.image !== "string" || raw.network !== void 0 && typeof raw.network !== "boolean" || raw.maxMinutes !== void 0 && (!Number.isInteger(raw.maxMinutes) || raw.maxMinutes < 1 || raw.maxMinutes > 30)) throw new FilteredTaskError("Choose a project, repository, task, supported provider, prepared image and 1\u201330 minute limit", 400);
+    this.reservations++;
+    const id = `filtered-${randomBytes(12).toString("hex")}`, folder = this.directoryFor(id);
+    let repo = raw.repo;
+    const controller = new AbortController();
+    this.controllers.set(id, controller);
+    let preparationDone;
+    this.preparations.set(id, new Promise((resolve) => {
+      preparationDone = resolve;
+    }));
+    const checkPreparation = () => {
+      if (this.closing || controller.signal.aborted) throw new FilteredTaskError("Filtered task preparation cancelled before provider dispatch");
+    };
+    const job = { version: 1, id, revision: 0, project: raw.project, repo, task: raw.task.trim(), agent: raw.agent, image: raw.image, network: raw.network === true, maxMinutes: raw.maxMinutes ?? 10, status: "preparing", createdAt: Date.now(), updatedAt: Date.now(), policies: [], base: [], events: [], containerStopped: true };
+    try {
+      checkPreparation();
+      repo = await realpath(repo);
+      job.repo = repo;
+      job.policies = await this.options.authorize(job.project, repo);
+      if (!job.policies.length) throw new FilteredTaskError("Assign this repository to the selected project before preparing a filtered task");
+      await mkdir(folder, { mode: 448 });
+      const directory = await open(this.directory, "r");
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+      this.jobs.set(id, job);
+      await this.save(job, {});
+      await this.options.withRepository(repo, async () => {
+        checkPreparation();
+        job.sourceHead = (await git(repo, ["rev-parse", "--verify", "HEAD^{commit}"])).toString().trim();
+        job.imageId = await this.runtime.pinImage(job.image);
+        checkPreparation();
+        if (!/^sha256:[a-f0-9]{64}$/.test(job.imageId)) throw new FilteredTaskError("Runtime image identity is not immutable");
+        await mkdir(this.workspace(id), { mode: 448 });
+        const tree = (await git(repo, ["ls-tree", "-rz", "-l", "--full-tree", job.sourceHead], { maxBuffer: 8 * 1024 * 1024 })).toString("utf8").split("\0").filter(Boolean);
+        let bytes = 0;
+        for (const entry of tree) {
+          checkPreparation();
+          const match = /^(\d{6}) (blob|commit) ([a-f0-9]+)\s+(\d+|-)\t([\s\S]+)$/.exec(entry);
+          if (!match) throw new FilteredTaskError("Source tree contains an unsupported record");
+          const path = normalizePolicyPath(match[5]);
+          if (!permitted(job.policies, "read", path)) continue;
+          if (!["100644", "100755"].includes(match[1]) || match[2] !== "blob") throw new FilteredTaskError("Readable symlinks and Gitlinks are unsupported in a filtered snapshot");
+          const size = Number(match[4]);
+          if (job.base.length >= MAX_FILES || size > MAX_FILE || (bytes += size) > MAX_TOTAL) throw new FilteredTaskError("Filtered source exceeds 500 files, 512 KB per file or 16 MB total");
+          const contents = await git(repo, ["cat-file", "blob", match[3]], { maxBuffer: MAX_FILE + 1 });
+          if (contents.length !== size) throw new FilteredTaskError("Source blob size changed");
+          const target = join(this.workspace(id), path);
+          await mkdir(dirname(target), { recursive: true, mode: 448 });
+          const handle = await open(target, "wx", match[1] === "100755" ? 448 : 384);
+          try {
+            await handle.writeFile(contents);
+          } finally {
+            await handle.close();
+          }
+          job.base.push({ path, hash: sha(contents), mode: match[1], bytes: size, blob: match[3] });
+        }
+        await git(this.workspace(id), ["init", "-q", "--template=", "-b", "main"]);
+        await git(this.workspace(id), ["add", "--force", "-A", "--", "."]);
+        await git(this.workspace(id), ["-c", "user.name=code-flow filtered snapshot", "-c", "user.email=filtered@localhost", "commit", "--allow-empty", "-qm", "Filtered committed snapshot"]);
+        await this.current(job);
+        checkPreparation();
+        await this.save(job, { sourceHead: job.sourceHead, imageId: job.imageId, base: job.base, policies: job.policies, status: "running", containerStopped: false });
+        checkPreparation();
+      });
+      checkPreparation();
+      const work = this.launch(job, controller);
+      this.work.set(id, work);
+      void work.finally(() => {
+        this.controllers.delete(id);
+        this.work.delete(id);
+      }).catch(() => void 0);
+      return this.get(id);
+    } catch (error) {
+      if (this.jobs.has(id)) await this.save(job, { status: controller.signal.aborted || this.closing ? "cancelled" : "failed", error: error.message, containerStopped: true });
+      throw error;
+    } finally {
+      this.reservations--;
+      preparationDone();
+      this.preparations.delete(id);
+      if (!this.work.has(id)) this.controllers.delete(id);
+    }
+  }
+  async scan(job) {
+    const root = await lstat(this.workspace(job.id));
+    if (!root.isDirectory() || root.isSymbolicLink()) throw new FilteredTaskError("Filtered export root must be a regular private directory");
+    await inspectFilteredWorkspace(this.workspace(job.id));
+    const files = [];
+    let bytes = 0;
+    const walk = async (relative, depth) => {
+      if (depth > 30) throw new FilteredTaskError("Result directory depth exceeds its bound");
+      const folder = join(this.workspace(job.id), relative);
+      const entries = await readdir(folder, { withFileTypes: true });
+      if (entries.length > 1e3) throw new FilteredTaskError("Result directory exceeds its entry bound");
+      for (const entry of entries) {
+        const path = normalizePolicyPath(relative ? `${relative}/${entry.name}` : entry.name);
+        const absolute = join(this.workspace(job.id), path), info = await lstat(absolute);
+        if (info.isSymbolicLink()) throw new FilteredTaskError("Result symlinks are refused");
+        if (info.isDirectory()) {
+          if (sensitiveContextPath(path) || !job.policies.every((policy) => allowsFilePolicy(policy, "read", path) || policy.read.allow.some((root2) => root2.startsWith(`${path}/`)) && !policy.read.deny.some((root2) => path === root2 || path.startsWith(`${root2}/`)))) throw new FilteredTaskError("Result contains a forbidden directory");
+          await walk(path, depth + 1);
+          continue;
+        }
+        if (!permitted(job.policies, "read", path)) throw new FilteredTaskError("Result contains a forbidden path; no changes will be imported");
+        if (!info.isFile() || info.nlink !== 1 || info.size > MAX_FILE || files.length >= MAX_FILES || (bytes += info.size) > MAX_TOTAL) throw new FilteredTaskError("Result contains a special/hard-linked file or exceeds its bounded file count/size");
+        const handle = await open(absolute, constants.O_RDONLY | constants.O_NOFOLLOW);
+        let content;
+        try {
+          content = await handle.readFile();
+        } finally {
+          await handle.close();
+        }
+        if (content.length !== info.size || content.length > MAX_FILE) throw new FilteredTaskError("Result file changed during validation");
+        files.push({ path, hash: sha(content), mode: info.mode & 73 ? "100755" : "100644", bytes: content.length });
+      }
+    };
+    await walk("", 0);
+    for (const path of new Set([...job.base, ...files].map((file) => file.path))) {
+      const before = job.base.find((file) => file.path === path), after = files.find((file) => file.path === path);
+      if ((!before || !after || before.hash !== after.hash || before.mode !== after.mode) && !permitted(job.policies, "write", path)) throw new FilteredTaskError("Result modified a path outside the write policy; nothing will be imported");
+    }
+    return files.sort((a, b) => a.path.localeCompare(b.path));
+  }
+  async launch(job, controller) {
+    try {
+      await this.current(job);
+      if (await this.runtime.pinImage(job.imageId) !== job.imageId) throw new FilteredTaskError("Pinned Docker image changed");
+      if (controller.signal.aborted || this.closing) throw new FilteredTaskError("Filtered task cancelled before provider dispatch");
+      await this.current(job);
+      if (controller.signal.aborted || this.closing) throw new FilteredTaskError("Filtered task cancelled before provider dispatch");
+      let exceeded;
+      const monitor = monitorFilteredWorkspace(this.workspace(job.id), { signal: controller.signal, onExceeded: (error) => {
+        exceeded = error;
+        controller.abort();
+      } });
+      let result;
+      try {
+        result = await this.runtime.run(structuredClone(job), this.workspace(job.id), controller.signal, (event) => {
+          const text = event.kind === "status" || event.kind === "text" ? event.text : event.kind === "error" ? event.message : void 0;
+          if (text) job.events = [...job.events, { at: Date.now(), text: String(redactExport(text)).slice(0, 1e3) }].slice(-100);
+        });
+      } finally {
+        await monitor.stop();
+      }
+      if (exceeded) throw exceeded;
+      await this.runtime.stop(job.id);
+      await this.save(job, { containerStopped: true });
+      if (controller.signal.aborted) {
+        await this.save(job, { status: "cancelled", error: "Cancelled after confirming the daemon container stopped" });
+        return;
+      }
+      await rm(join(this.workspace(job.id), ".git"), { recursive: true, force: true });
+      await this.current(job);
+      if (!result.ok) throw new FilteredTaskError(result.error || "Provider turn failed");
+      const files = await this.scan(job);
+      await this.save(job, { status: "completed", result: files, resultHash: resultIdentity(files), finalText: String(redactExport(result.finalText)).slice(0, 32 * 1024) });
+    } catch (error) {
+      let stopped = false;
+      try {
+        await this.runtime.stop(job.id);
+        stopped = true;
+      } catch {
+      }
+      await this.save(job, { status: stopped ? controller.signal.aborted ? "cancelled" : "failed" : "unknown", containerStopped: stopped, error: error.message });
+    }
+  }
+  async cancel(id, revision) {
+    return this.mutation(id, async () => {
+      const job = this.require(id);
+      if (revision !== job.revision) throw new FilteredTaskError("Filtered task changed; refresh its current state");
+      if (this.importClaims.has(id) || job.status === "importing" || job.importCommit && job.status === "unknown") throw new FilteredTaskError("Inspect the interrupted import receipt before changing this job");
+      this.controllers.get(id)?.abort();
+      await this.preparations.get(id);
+      await this.work.get(id);
+      await this.runtime.stop(id);
+      await this.save(job, { status: "cancelled", containerStopped: true, error: "Owner cancelled; daemon container absence confirmed" });
+      return this.get(id);
+    });
+  }
+  async preview(id) {
+    const job = this.require(id);
+    if (job.status !== "completed") throw new FilteredTaskError("Only a completed validated task has an import preview");
+    await this.current(job);
+    const files = await this.scan(job);
+    if (resultIdentity(files) !== job.resultHash) throw new FilteredTaskError("Result changed after completion; import is refused");
+    const changes = [];
+    let previewBytes = 0;
+    for (const path of [...new Set([...job.base, ...files].map((file) => file.path))].sort()) {
+      const before = job.base.find((file) => file.path === path), after = files.find((file) => file.path === path);
+      if (before?.hash === after?.hash && before?.mode === after?.mode) continue;
+      const change = { path, status: !before ? "added" : !after ? "deleted" : "modified", beforeHash: before?.hash, afterHash: after?.hash, mode: after?.mode, bytes: after?.bytes ?? 0 };
+      const source = before ? await git(job.repo, ["cat-file", "blob", before.blob], { maxBuffer: MAX_FILE + 1 }) : Buffer.alloc(0), target = after ? await this.content(job, after) : Buffer.alloc(0);
+      change.binary = source.includes(0) || target.includes(0);
+      if (!change.binary && previewBytes < 512 * 1024) {
+        change.before = source.toString("utf8").slice(0, 2e4);
+        change.after = target.toString("utf8").slice(0, 2e4);
+        previewBytes += Buffer.byteLength(change.before) + Buffer.byteLength(change.after);
+        change.truncated = source.length > 2e4 || target.length > 2e4;
+      } else change.truncated = true;
+      changes.push(change);
+    }
+    return { job: this.get(id), sourceHead: job.sourceHead, resultHash: job.resultHash, changes, importBehavior: "Creates a new review branch; original checkout and index remain unchanged" };
+  }
+  async content(job, file) {
+    const handle = await open(join(this.workspace(job.id), file.path), constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+      const bytes = await handle.readFile();
+      if (bytes.length > MAX_FILE || sha(bytes) !== file.hash) throw new FilteredTaskError("Result changed before import");
+      return bytes;
+    } finally {
+      await handle.close();
+    }
+  }
+  async import(id, input) {
+    const job = this.require(id);
+    if (job.status !== "completed" || input.revision !== job.revision || input.expectedHead !== job.sourceHead || input.resultHash !== job.resultHash) throw new FilteredTaskError("Refresh and review the exact current completed result before import");
+    if (this.closing || this.importClaims.has(id) || this.mutations.has(id)) throw new FilteredTaskError("An import or task mutation is already claimed or the service is closing");
+    this.importClaims.add(id);
+    const work = this.importClaimed(job);
+    this.importWork.set(id, work);
+    void work.finally(() => {
+      this.importClaims.delete(id);
+      this.importWork.delete(id);
+    }).catch(() => void 0);
+    return work;
+  }
+  async importClaimed(job) {
+    const id = job.id;
+    return this.options.withRepository(job.repo, async () => {
+      if (this.closing) throw new FilteredTaskError("Import stopped before publication");
+      await this.current(job);
+      const preview = await this.preview(id);
+      if (!preview.changes.length) throw new FilteredTaskError("The filtered task has no changes to import");
+      const assertOriginalFiles = async () => {
+        const staged = (await git(job.repo, ["ls-files", "--stage", "-z"])).toString().split("\0").filter(Boolean);
+        const index = new Map(staged.map((entry) => {
+          const match = /^(\d+) ([a-f0-9]+) (\d)\t([\s\S]+)$/.exec(entry);
+          if (!match || match[3] !== "0") throw new FilteredTaskError("Resolve the original index's conflicts before importing");
+          return [match[4], { mode: match[1], blob: match[2] }];
+        }));
+        for (const change of preview.changes) {
+          const baseline = job.base.find((file) => file.path === change.path);
+          let currentPath = job.repo;
+          for (const component of change.path.split("/")) {
+            currentPath = join(currentPath, component);
+            const entry = await lstat(currentPath).catch((error) => {
+              if (error.code === "ENOENT") return void 0;
+              throw error;
+            });
+            if (entry?.isSymbolicLink()) throw new FilteredTaskError("Original source path became symbolic; import refused");
+          }
+          const info = await lstat(currentPath).catch((error) => {
+            if (error.code === "ENOENT") return void 0;
+            throw error;
+          });
+          if (!baseline) {
+            if (info || index.has(change.path)) throw new FilteredTaskError("A new result path already exists in the original checkout/index");
+          } else {
+            if (!info?.isFile() || info.size > MAX_FILE || index.get(change.path)?.blob !== baseline.blob || index.get(change.path)?.mode !== baseline.mode || (info.mode & 73 ? "100755" : "100644") !== baseline.mode) throw new FilteredTaskError("Original file mode/index changed; import refused");
+            const file = await open(currentPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+            try {
+              if (sha(await file.readFile()) !== baseline.hash) throw new FilteredTaskError("Original file contents changed; import refused");
+            } finally {
+              await file.close();
+            }
+          }
+        }
+      };
+      await assertOriginalFiles();
+      const temporaryIndex = join(this.directoryFor(id), `index-${randomBytes(6).toString("hex")}`), env = { GIT_INDEX_FILE: temporaryIndex };
+      let commit;
+      try {
+        await git(job.repo, ["read-tree", job.sourceHead], { env });
+        for (const change of preview.changes) {
+          const file = job.result.find((file2) => file2.path === change.path);
+          if (!file) await git(job.repo, ["update-index", "--force-remove", "--", change.path], { env });
+          else {
+            const blob = (await git(job.repo, ["hash-object", "--no-filters", "-w", "--stdin"], { input: await this.content(job, file), env })).toString().trim();
+            await git(job.repo, ["update-index", "--add", "--cacheinfo", file.mode, blob, file.path], { env });
+          }
+        }
+        const tree = (await git(job.repo, ["write-tree"], { env })).toString().trim();
+        commit = (await git(job.repo, ["-c", "user.name=code-flow filtered task", "-c", "user.email=filtered@localhost", "commit-tree", tree, "-p", job.sourceHead], { input: `Filtered task ${job.id}
+`, env })).toString().trim();
+      } finally {
+        await rm(temporaryIndex, { force: true });
+        await rm(`${temporaryIndex}.lock`, { force: true });
+      }
+      await this.current(job);
+      if (resultIdentity(await this.scan(job)) !== job.resultHash) throw new FilteredTaskError("Result changed during import preparation");
+      const branch = `codeflow/${job.id}`;
+      if (this.closing) throw new FilteredTaskError("Import stopped before publication");
+      await this.save(job, { status: "importing", importBranch: branch, importCommit: commit });
+      try {
+        if (this.closing) throw new FilteredTaskError("Import stopped before publication");
+        await this.current(job);
+        await assertOriginalFiles();
+        if (this.closing) throw new FilteredTaskError("Import stopped before publication");
+        await git(job.repo, ["update-ref", "--stdin"], { input: `start
+verify HEAD ${job.sourceHead}
+create refs/heads/${branch} ${commit}
+prepare
+commit
+` });
+        await this.save(job, { status: "imported" });
+      } catch (error) {
+        await this.save(job, { status: "unknown", error: "Import receipt is ambiguous. Inspect it explicitly; no automatic retry is allowed." });
+        throw error;
+      }
+      return this.get(id);
+    });
+  }
+  async reconcile(id, revision) {
+    return this.mutation(id, async () => {
+      const job = this.require(id);
+      if (job.status !== "unknown" || revision !== job.revision || !job.importCommit || !job.importBranch) throw new FilteredTaskError("There is no matching interrupted import receipt");
+      await this.options.authorize(job.project, job.repo);
+      const ref = await git(job.repo, ["show-ref", "--verify", "--hash", `refs/heads/${job.importBranch}`]).then((buffer) => buffer.toString().trim(), () => "");
+      if (ref && ref !== job.importCommit) throw new FilteredTaskError("The review branch no longer matches the saved import receipt");
+      await this.save(job, { status: ref ? "imported" : "completed", error: ref ? void 0 : "The atomic branch transaction did not publish a ref; review again before an explicit retry.", ...ref ? {} : { importBranch: void 0, importCommit: void 0 } });
+      return this.get(id);
+    });
+  }
+  async delete(id, revision) {
+    return this.mutation(id, async () => {
+      const job = this.require(id);
+      if (revision !== job.revision || this.importClaims.has(id) || this.preparations.has(id) || this.work.has(id) || !job.containerStopped || ["preparing", "running", "importing", "unknown"].includes(job.status)) throw new FilteredTaskError("Only a terminal task with a confirmed stopped container and no ambiguous import may be deleted");
+      await this.writes.get(id);
+      await rm(this.directoryFor(id), { recursive: true, force: false });
+      const directory = await open(this.directory, "r");
+      try {
+        await directory.sync();
+      } finally {
+        await directory.close();
+      }
+      this.jobs.delete(id);
+      return { deleted: true, preservedReviewBranch: job.importBranch };
+    });
+  }
+  async close() {
+    this.closing = true;
+    for (const controller of this.controllers.values()) controller.abort();
+    await Promise.allSettled([...this.preparations.values()]);
+    await Promise.allSettled([...this.work.values(), ...this.importWork.values(), ...this.mutations.values()]);
+    await Promise.allSettled([...this.writes.values()]);
+  }
+}
+export {
+  FilteredTaskError,
+  FilteredTasks,
+  dockerFilteredRuntime
+};

package/src/frame-policy.js

@@ -0,0 +1,66 @@
+import { lookup } from "node:dns/promises";
+import { request as httpRequest } from "node:http";
+import { request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { addressKind, snapshotUrl } from "./snapshot.js";
+function embeddingBlocked(headers, page, parent) {
+  const origin = new URL(page).origin, parentUrl = new URL(parent);
+  const policies = [headers["content-security-policy"] ?? []].flat().flatMap((policy) => policy.split(","));
+  const ancestors = policies.flatMap((policy) => {
+    const directive = policy.split(";").map((value) => value.trim()).find((value) => /^frame-ancestors(?:\s|$)/i.test(value));
+    return directive ? [directive] : [];
+  });
+  const allows = (source) => {
+    if (source === "*") return true;
+    if (source === "'self'") return origin === parentUrl.origin;
+    if (/^https?:$/.test(source)) return parentUrl.protocol === source;
+    try {
+      const candidate = new URL(source.includes("://") ? source.replace(/:\*(?=\/|$)/, ":65535") : `${new URL(page).protocol}//${source}`);
+      const host = candidate.hostname;
+      return candidate.protocol === parentUrl.protocol && (host === parentUrl.hostname || host.startsWith("*.") && parentUrl.hostname.endsWith(host.slice(1))) && (/:\*(?:\/|$)/.test(source) || candidate.port === parentUrl.port);
+    } catch {
+      return false;
+    }
+  };
+  if (ancestors.length) return ancestors.some((policy) => !policy.split(/\s+/).slice(1).some(allows)) ? "Content-Security-Policy frame-ancestors" : void 0;
+  const frame = [headers["x-frame-options"] ?? []].flat().flatMap((value) => value.toUpperCase().split(",")).map((value) => value.trim());
+  const restriction = frame.find((value) => value === "DENY" || value === "SAMEORIGIN" && origin !== parentUrl.origin);
+  return restriction ? `X-Frame-Options: ${restriction}` : void 0;
+}
+async function inspectFramePolicy(address, parent) {
+  let url = new URL(snapshotUrl(address));
+  for (let redirects = 0; redirects <= 5; redirects++) {
+    if (url.username || url.password) throw new Error("Page inspection does not accept credentials in URLs");
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    const addresses = isIP(host) ? [{ address: host, family: isIP(host) }] : await lookup(host, { all: true });
+    if (!addresses.length || addresses.some((value) => addressKind(value.address))) throw new Error("External page inspection cannot reach loopback or link-local addresses");
+    const destination = addresses.find((value) => value.family === 4) ?? addresses[0];
+    const response = await new Promise((resolve, reject) => {
+      const request = (url.protocol === "https:" ? httpsRequest : httpRequest)(url, {
+        method: "HEAD",
+        agent: false,
+        family: destination.family,
+        signal: AbortSignal.timeout(5e3),
+        maxHeaderSize: 32 * 1024,
+        // Pin the checked DNS answer so a second resolution cannot redirect the request locally.
+        lookup: (_hostname, _options, callback) => callback(null, destination.address, destination.family)
+      }, (result) => {
+        result.destroy();
+        resolve({ status: result.statusCode ?? 0, headers: result.headers });
+      });
+      request.on("error", reject);
+      request.end();
+    });
+    if ([301, 302, 303, 307, 308].includes(response.status) && response.headers.location) {
+      url = new URL(snapshotUrl(new URL(response.headers.location, url).href));
+      continue;
+    }
+    const reason = embeddingBlocked(response.headers, url.href, parent);
+    return { blocked: !!reason, reason, url: url.href };
+  }
+  throw new Error("The external page redirected too many times");
+}
+export {
+  embeddingBlocked,
+  inspectFramePolicy
+};