@odla-ai/cli 0.46.9 → 0.46.11

package/dist/bin.js

@@ -172,7 +172,7 @@ function absoluteEntryPath(entryPath) {
 
 // src/bin.ts
 var argv = process.argv.slice(2);
-requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-CDIXAFN4.js")).runCli()).catch((err) => {
+requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-BI26ENP4.js")).runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/{chunk-OW5WW5ET.js → chunk-J6GIGX6T.js}

@@ -6319,7 +6319,7 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 
-// ../harness/dist/chunk-IWVGSWY6.js
+// ../harness/dist/chunk-J7XU5QB7.js
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
 import { relative as relative4, resolve as resolve10 } from "path";
@@ -6656,7 +6656,7 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-IWVGSWY6.js
+// ../harness/dist/chunk-J7XU5QB7.js
 import { spawn as spawn4 } from "child_process";
 import { lstat as lstat2 } from "fs/promises";
 import { resolve as resolve23, sep as sep3 } from "path";
@@ -6963,7 +6963,7 @@ function looksLikeDestination(value2) {
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text4) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text4);
 }
 
-// ../harness/dist/chunk-IWVGSWY6.js
+// ../harness/dist/chunk-J7XU5QB7.js
 import { readFile as readFile4, stat as stat2 } from "fs/promises";
 import { readFile as readFile3 } from "fs/promises";
 import { join as join33 } from "path";
@@ -7231,7 +7231,7 @@ async function buildCodeGraph(input) {
   return builder.build();
 }
 
-// ../harness/dist/chunk-IWVGSWY6.js
+// ../harness/dist/chunk-J7XU5QB7.js
 import { createHash as createHash32 } from "crypto";
 async function digestStagedWorkspace(root, limits) {
   const files = [];
@@ -7259,86 +7259,6 @@ async function digestStagedWorkspace(root, limits) {
   }
   return `sha256:${hash.digest("hex")}`;
 }
-var CODE_RUNTIME_PROTOCOL_VERSION = 1;
-async function runCodeRuntimeHeartbeatLoop(options) {
-  const heartbeatMs = options.heartbeatMs ?? 15e3;
-  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3 || heartbeatMs > 3e5) {
-    throw new TypeError("heartbeatMs must be an integer from 1000 to 300000");
-  }
-  let retryMs = 1e3;
-  do {
-    if (options.signal?.aborted) return;
-    try {
-      const snapshot = await options.control.heartbeat(options.runtimeVersion, options.capabilities);
-      await options.onSnapshot?.(snapshot);
-      retryMs = 1e3;
-      if (options.once) return;
-      await wait(heartbeatMs, options.signal);
-    } catch (error) {
-      if (options.signal?.aborted) return;
-      if (options.once || !retryableControlFailure(error)) throw error;
-      await options.onRetry?.(error, retryMs);
-      await wait(retryMs, options.signal);
-      retryMs = Math.min(retryMs * 2, 3e4);
-    }
-  } while (!options.signal?.aborted);
-}
-var CodeRuntimeReconciler = class {
-  constructor(control, engine) {
-    this.control = control;
-    this.engine = engine;
-  }
-  control;
-  engine;
-  results = /* @__PURE__ */ new Map();
-  async reconcile(snapshot) {
-    for (const command of snapshot.commands) {
-      let completed = this.results.get(command.commandId);
-      if (!completed) {
-        let result;
-        try {
-          result = await this.engine.execute(command);
-        } catch (error) {
-          result = { status: "failed", message: (error instanceof Error ? error.message : String(error)).slice(0, 2e3) };
-        }
-        completed = { result, notified: false };
-        this.results.set(command.commandId, completed);
-        if (this.results.size > 1024) this.results.delete(this.results.keys().next().value);
-      }
-      await this.control.acknowledge(command.commandId, completed.result);
-      if (!completed.notified) {
-        await this.engine.acknowledged?.(command, completed.result);
-        completed.notified = true;
-      }
-    }
-  }
-};
-function retryableControlFailure(value2) {
-  if (!value2 || typeof value2 !== "object") return false;
-  const failure = value2;
-  if (failure.code === "invalid_response" || typeof failure.status !== "number") return false;
-  return failure.status === 408 || failure.status === 425 || failure.status === 429 || failure.status >= 500;
-}
-function wait(ms, signal) {
-  return new Promise((resolve52) => {
-    if (signal?.aborted) return resolve52();
-    const timer = setTimeout(resolve52, ms);
-    signal?.addEventListener("abort", () => {
-      clearTimeout(timer);
-      resolve52();
-    }, { once: true });
-  });
-}
-var CodeRuntimeControlError = class extends Error {
-  constructor(message2, status, code = "control_error") {
-    super(message2);
-    this.status = status;
-    this.code = code;
-  }
-  status;
-  code;
-  name = "CodeRuntimeControlError";
-};
 function createCodeRuntimeControlClient(options) {
   const endpoint = validatedEndpoint(options.endpoint);
   if (!/^odla_code_host_[0-9a-f]{64}$/.test(options.token)) throw new TypeError("invalid Code host credential");
@@ -7351,9 +7271,10 @@ function createCodeRuntimeControlClient(options) {
     throw new TypeError("modelRequestTimeoutMs must be an integer from 30000 to 1800000");
   }
   const request3 = options.fetch ?? fetch;
-  const call4 = async (path, body, timeoutMs = requestTimeoutMs) => {
+  const call4 = async (path, body, timeoutMs = requestTimeoutMs, operationSignal) => {
     const timeout = AbortSignal.timeout(timeoutMs);
-    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    const signals = [options.signal, operationSignal, timeout].filter((item) => Boolean(item));
+    const signal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
     let response2;
     try {
       response2 = await request3(`${endpoint}${path}`, {
@@ -7364,7 +7285,7 @@ function createCodeRuntimeControlClient(options) {
         signal
       });
     } catch (cause) {
-      if (options.signal?.aborted) throw cause;
+      if (options.signal?.aborted || operationSignal?.aborted) throw cause;
       throw new CodeRuntimeControlError("Code runtime control plane is unavailable", 503, "transport_unavailable");
     }
     const value2 = await response2.json().catch(() => null);
@@ -7384,8 +7305,7 @@ function createCodeRuntimeControlClient(options) {
       return parseSnapshot(await call4("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
     },
     acknowledge: async (commandId, result) => {
-      if (!/^ccmd_[0-9a-f]{32}$/.test(commandId)) throw new TypeError("invalid Code runtime command id");
-      await call4(`/registry/code/runtime/commands/${commandId}/ack`, result);
+      await call4(`/registry/code/runtime/commands/${validCommandId(commandId)}/ack`, result);
     },
     source: async (sessionId) => parseSource(
       await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
@@ -7428,12 +7348,120 @@ function createCodeRuntimeControlClient(options) {
     rememberMemory: async (sessionId, memory) => {
       await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
     },
+    collaborationSkills: async (sessionId, commandId) => {
+      try {
+        return parseCollaborationSkills(await call4(
+          `/registry/code/runtime/sessions/${validSessionId(sessionId)}/collaboration/skills`,
+          { commandId: validCommandId(commandId) }
+        ));
+      } catch (cause) {
+        if (cause instanceof CodeRuntimeControlError && cause.status === 404 && cause.code === "not_found") return [];
+        throw cause;
+      }
+    },
+    executeCollaborationTool: async (sessionId, collaboration, signal) => {
+      validateCollaborationToolRequest(collaboration);
+      return parseCollaborationToolOutput(await call4(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/collaboration/tools`,
+        collaboration,
+        requestTimeoutMs,
+        signal
+      ));
+    },
     reportSessionFailure: async (sessionId, message2) => {
       if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
       await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
     }
   };
 }
+var CODE_RUNTIME_PROTOCOL_VERSION = 1;
+async function runCodeRuntimeHeartbeatLoop(options) {
+  const heartbeatMs = options.heartbeatMs ?? 15e3;
+  if (!Number.isSafeInteger(heartbeatMs) || heartbeatMs < 1e3 || heartbeatMs > 3e5) {
+    throw new TypeError("heartbeatMs must be an integer from 1000 to 300000");
+  }
+  let retryMs = 1e3;
+  do {
+    if (options.signal?.aborted) return;
+    try {
+      const snapshot = await options.control.heartbeat(options.runtimeVersion, options.capabilities);
+      await options.onSnapshot?.(snapshot);
+      retryMs = 1e3;
+      if (options.once) return;
+      await wait(heartbeatMs, options.signal);
+    } catch (error) {
+      if (options.signal?.aborted) return;
+      if (options.once || !retryableControlFailure(error)) throw error;
+      await options.onRetry?.(error, retryMs);
+      await wait(retryMs, options.signal);
+      retryMs = Math.min(retryMs * 2, 3e4);
+    }
+  } while (!options.signal?.aborted);
+}
+var CodeRuntimeReconciler = class {
+  constructor(control, engine, onDiagnostic) {
+    this.control = control;
+    this.engine = engine;
+    this.onDiagnostic = onDiagnostic;
+  }
+  control;
+  engine;
+  onDiagnostic;
+  results = /* @__PURE__ */ new Map();
+  async reconcile(snapshot) {
+    for (const command of snapshot.commands) {
+      let completed = this.results.get(command.commandId);
+      if (!completed) {
+        let result;
+        try {
+          result = await this.engine.execute(command);
+        } catch (error) {
+          result = { status: "failed", message: (error instanceof Error ? error.message : String(error)).slice(0, 2e3) };
+        }
+        completed = { result, notified: false };
+        this.results.set(command.commandId, completed);
+        if (this.results.size > 1024) this.results.delete(this.results.keys().next().value);
+      }
+      await this.control.acknowledge(command.commandId, completed.result);
+      if (!completed.notified) {
+        try {
+          await this.engine.acknowledged?.(command, completed.result);
+        } catch (error) {
+          this.onDiagnostic?.(
+            `command ${command.commandId} acknowledged handling failed \xB7 ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
+        completed.notified = true;
+      }
+    }
+  }
+};
+function retryableControlFailure(value2) {
+  if (!value2 || typeof value2 !== "object") return false;
+  const failure = value2;
+  if (failure.code === "invalid_response" || typeof failure.status !== "number") return false;
+  return failure.status === 408 || failure.status === 425 || failure.status === 429 || failure.status >= 500;
+}
+function wait(ms, signal) {
+  return new Promise((resolve52) => {
+    if (signal?.aborted) return resolve52();
+    const timer = setTimeout(resolve52, ms);
+    signal?.addEventListener("abort", () => {
+      clearTimeout(timer);
+      resolve52();
+    }, { once: true });
+  });
+}
+var CodeRuntimeControlError = class extends Error {
+  constructor(message2, status, code = "control_error") {
+    super(message2);
+    this.status = status;
+    this.code = code;
+  }
+  status;
+  code;
+  name = "CodeRuntimeControlError";
+};
 function validatedEndpoint(value2) {
   const endpoint = value2.replace(/\/+$/, "");
   let url;
@@ -7452,6 +7480,10 @@ function validSessionId(value2) {
   if (!/^csess_[0-9a-f]{32}$/.test(value2)) throw new TypeError("invalid Code session id");
   return value2;
 }
+function validCommandId(value2) {
+  if (!/^ccmd_[0-9a-f]{32}$/.test(value2)) throw new TypeError("invalid Code runtime command id");
+  return value2;
+}
 function validateHeartbeat(version, capabilities) {
   if (!version.trim() || version.length > 80) throw new TypeError("runtimeVersion is required and at most 80 characters");
   if (capabilities.protocolVersion !== CODE_RUNTIME_PROTOCOL_VERSION) throw new TypeError("unsupported Code runtime protocol version");
@@ -7533,6 +7565,91 @@ function parseCandidate(value2) {
   }
   return { candidateId: candidate.candidateId, status: candidate.status };
 }
+function parseCollaborationSkills(value2) {
+  const items = record5(value2)?.skills;
+  if (!Array.isArray(items) || items.length > 16) throw invalid("collaboration skills");
+  const skillNames2 = /* @__PURE__ */ new Set();
+  const toolNames = /* @__PURE__ */ new Set();
+  return items.map((item) => {
+    const skill = record5(item);
+    if (!skill || !validManifestName(skill.name) || skillNames2.has(skill.name) || skill.instructions !== void 0 && (typeof skill.instructions !== "string" || utf8Bytes(skill.instructions) > 32e3) || !Array.isArray(skill.tools) || !skill.tools.length || skill.tools.length > 128) {
+      throw invalid("collaboration skill");
+    }
+    skillNames2.add(skill.name);
+    const tools = skill.tools.map((candidate) => {
+      const tool = record5(candidate);
+      const inputSchema = record5(tool?.inputSchema);
+      if (!tool || !validManifestName(tool.name) || toolNames.has(tool.name) || typeof tool.description !== "string" || utf8Bytes(tool.description) > 8e3 || !inputSchema || jsonBytes(inputSchema) > 64e3 || tool.concurrency !== void 0 && tool.concurrency !== "parallel") {
+        throw invalid("collaboration tool");
+      }
+      const outputTaint = parseTaintLabels(tool.outputTaint);
+      const acceptsTaint = parseTaintLabels(tool.acceptsTaint);
+      toolNames.add(tool.name);
+      return {
+        name: tool.name,
+        description: tool.description,
+        inputSchema,
+        ...tool.concurrency === "parallel" ? { concurrency: "parallel" } : {},
+        ...outputTaint ? { outputTaint } : {},
+        ...acceptsTaint ? { acceptsTaint } : {}
+      };
+    });
+    return {
+      name: skill.name,
+      ...typeof skill.instructions === "string" ? { instructions: skill.instructions } : {},
+      tools
+    };
+  });
+}
+function validateCollaborationToolRequest(value2) {
+  validCommandId(value2.commandId);
+  if (typeof value2.toolCallId !== "string" || value2.toolCallId.length > 256 || !/^[^\s\u0000-\u001f\u007f]+$/.test(value2.toolCallId) || !validManifestName(value2.skill) || !validManifestName(value2.tool) || !record5(value2.input) || jsonBytes(value2.input) > 128e3) {
+    throw new TypeError("invalid Code collaboration tool request");
+  }
+}
+function parseCollaborationToolOutput(value2) {
+  const output = record5(record5(value2)?.output);
+  if (!output || output.isError !== void 0 && typeof output.isError !== "boolean") {
+    throw invalid("collaboration tool");
+  }
+  if (typeof output.content === "string") {
+    if (utf8Bytes(output.content) > 1e6) throw invalid("collaboration tool");
+    return { content: output.content, ...output.isError === true ? { isError: true } : {} };
+  }
+  if (!Array.isArray(output.content) || output.content.length > 64 || jsonBytes(output.content) > 1e6 || !output.content.every((block2) => {
+    const item = record5(block2);
+    return item && ["text", "image", "audio", "document", "tool_use", "tool_result", "thinking"].includes(String(item.type));
+  })) throw invalid("collaboration tool");
+  return {
+    content: output.content,
+    ...output.isError === true ? { isError: true } : {}
+  };
+}
+function parseTaintLabels(value2) {
+  if (value2 === void 0) return void 0;
+  if (!Array.isArray(value2) || value2.length > 16) throw invalid("collaboration tool taint");
+  const labels = value2.map((item) => {
+    if (item === "web_untrusted" || item === "operator_pasted_untrusted" || item === "llm_inherited") return item;
+    if (typeof item === "string" && /^tool_untrusted:[^\s\u0000-\u001f\u007f]{1,100}$/.test(item)) {
+      return item;
+    }
+    throw invalid("collaboration tool taint");
+  });
+  return [...new Set(labels)];
+}
+function validManifestName(value2) {
+  return typeof value2 === "string" && /^[A-Za-z][A-Za-z0-9._:-]{0,127}$/.test(value2);
+}
+function utf8Bytes(value2) {
+  return new TextEncoder().encode(value2).byteLength;
+}
+function jsonBytes(value2) {
+  try {
+    return utf8Bytes(JSON.stringify(value2));
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+}
 var record5 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
 var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
@@ -8547,6 +8664,46 @@ Finish with a concise, non-empty answer to the owner. Do not call tools or promi
     return { status: "failed", finalText: "", error };
   }
 }
+function createCodeRuntimeSessionSkillLoader(control) {
+  const load = control.collaborationSkills?.bind(control);
+  const execute2 = control.executeCollaborationTool?.bind(control);
+  if (!load || !execute2) return async () => [];
+  return async (command) => {
+    const manifests = await load(command.sessionId, command.commandId);
+    return manifests.map((manifest) => ({
+      name: manifest.name,
+      ...manifest.instructions === void 0 ? {} : { instructions: manifest.instructions },
+      tools: manifest.tools.map((tool) => ({
+        name: tool.name,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+        ...tool.concurrency === void 0 ? {} : { concurrency: tool.concurrency },
+        ...tool.outputTaint === void 0 ? {} : { outputTaint: tool.outputTaint },
+        ...tool.acceptsTaint === void 0 ? {} : { acceptsTaint: tool.acceptsTaint },
+        handler: async (input, context) => {
+          if (!context.toolCallId) throw new TypeError("collaboration tool call identity is required");
+          return execute2(command.sessionId, {
+            commandId: command.commandId,
+            toolCallId: context.toolCallId,
+            skill: manifest.name,
+            tool: tool.name,
+            input
+          }, context.signal);
+        }
+      }))
+    }));
+  };
+}
+async function sessionSkillsFor(options, command) {
+  try {
+    return await options.sessionSkills?.(command) ?? [];
+  } catch (cause) {
+    options.onDiagnostic?.(
+      `session skills unavailable, continuing with code tools only: ${cause instanceof Error ? cause.message : String(cause)}`
+    );
+    return [];
+  }
+}
 async function handleCodeRuntimeInference(input) {
   const { command, request: request3, state: state2 } = input;
   const startedAt = Date.now();
@@ -9410,16 +9567,6 @@ function assertBudget(budget) {
     throw new TypeError("goal budget deadline must be epoch milliseconds");
   }
 }
-async function sessionSkillsFor(options, command) {
-  try {
-    return await options.sessionSkills?.(command) ?? [];
-  } catch (cause) {
-    options.onDiagnostic?.(
-      `session skills unavailable, continuing with code tools only: ${cause instanceof Error ? cause.message : String(cause)}`
-    );
-    return [];
-  }
-}
 function createCodeRuntimeToolBroker(input, lease, role) {
   const broker = createCodeToolBroker({
     recipes: input.recipes,
@@ -9710,6 +9857,23 @@ function codeToolResultPresentation(request3, response2) {
     ...excerpt(output, true) ? { excerpt: excerpt(output, true) } : {}
   };
 }
+function codeRuntimeAcknowledgementGate(signal) {
+  let settle;
+  let settled = false;
+  const ready = new Promise((resolve52) => {
+    settle = resolve52;
+  });
+  const release = (run) => {
+    if (settled) return;
+    settled = true;
+    signal.removeEventListener("abort", onAbort);
+    settle(run);
+  };
+  const onAbort = () => release(false);
+  if (signal.aborted) release(false);
+  else signal.addEventListener("abort", onAbort, { once: true });
+  return { ready, release };
+}
 var TheseusRuntimeEngine = class {
   constructor(options) {
     this.options = options;
@@ -9739,6 +9903,8 @@ var TheseusRuntimeEngine = class {
     const active = this.#active.get(command.sessionId);
     if (!active || result.status !== "running") return;
     active.acknowledged = true;
+    active.startGate?.release(true);
+    active.startGate = void 0;
     if (active.failure) await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
   }
   async close() {
@@ -9758,13 +9924,14 @@ var TheseusRuntimeEngine = class {
       control: this.options.control,
       ...this.options.localSource ? { localSource: this.options.localSource } : {}
     });
-    const abort = new AbortController();
+    const abort = new AbortController(), startGate = codeRuntimeAcknowledgementGate(abort.signal);
     const conversationRefs = [];
     const active = {
       workspace,
       abort,
       conversationRefs,
       acknowledged: false,
+      startGate,
       role: metadata2.role,
       title: metadata2.title,
       maxTokensPerInteraction: metadata2.maxTokensPerInteraction,
@@ -9788,7 +9955,7 @@ var TheseusRuntimeEngine = class {
         body: `Source snapshot: local checkout ${requestedLocal.snapshotDigest} \xB7 ${requestedLocal.modified ? "modified" : "clean"} \xB7 Git ${requestedLocal.headCommitSha}`
       }, conversationRefs);
     }
-    active.done = this.#runAttempt(command, metadata2, active).catch(async (cause) => {
+    active.done = startGate.ready.then((run) => run ? this.#runAttempt(command, metadata2, active) : null).catch(async (cause) => {
       const detail = runtimeErrorMessage(cause);
       await this.#event(command, { type: "message", actor: "system", body: detail }, conversationRefs).catch(() => void 0);
       await this.#diagnostic(command, active, detail);
@@ -10423,10 +10590,15 @@ async function runCodeRuntime(input) {
     engine: input.engine,
     recipes: CODE_BUILD_RECIPES,
     recipeAuthorization: "registered_recipe",
+    sessionSkills: createCodeRuntimeSessionSkillLoader(control),
     localSource: input.localSource,
     onDiagnostic: (message2) => input.stdout.error(`Theseus runtime failed \xB7 ${message2}`)
   });
-  const reconciler = new CodeRuntimeReconciler(control, commandEngine);
+  const reconciler = new CodeRuntimeReconciler(
+    control,
+    commandEngine,
+    (message2) => input.stdout.error(`Theseus runtime \xB7 ${message2}`)
+  );
   try {
     await runCodeRuntimeHeartbeatLoop({
       control,
@@ -16264,4 +16436,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-OW5WW5ET.js.map
+//# sourceMappingURL=chunk-J6GIGX6T.js.map