@odla-ai/harness 0.10.3 → 0.11.0

package/README.md

@@ -109,6 +109,30 @@ before approval:
 }
 ~~~
 
+A repository can replace that release-owned list with its own. Code reads
+`odla.recipes.json` from the root of the trusted base (the default-branch
+snapshot it staged, never the candidate's working tree) when a session starts:
+
+~~~json
+{
+  "version": 1,
+  "recipes": [
+    { "id": "engine-tests", "command": ["node", "--test", "test/"] },
+    { "id": "gates", "command": ["node", "scripts/gates.mjs"], "timeoutMs": 60000 }
+  ]
+}
+~~~
+
+The repository chooses each recipe's `id`, argv `command`, and optional
+`timeoutMs` (default 120000, at most 900000, up to 16 recipes); the host
+supplies the digest-pinned image and the resource limits, and a declaration that
+names an `image` or any other field is refused. A malformed file fails the
+session start with the fault named rather than falling back, and the session
+thread's first system message says which list gates it and where that list came
+from. Every declared recipe runs in the same fresh, networkless container as the
+release list, so a repository whose tests need `node_modules` still cannot run
+them here.
+
 The runtime validates HTTPS, never places its credential in a request body,
 never opens a listener, and rejects malformed or cross-host binding responses.
 Theseus reads, patches, and runs only registered build recipes through the typed

package/dist/{chunk-TMBYA5JX.js → chunk-IXYKIPRA.js}

@@ -1148,8 +1148,8 @@ var CodeRuntimeCheckpointManager = class {
       trustedBaseDigest: active.trustedBaseDigest,
       planningInputDigest: active.planningInputDigest,
       conversationRefs: active.conversationRefs,
-      fallbackPolicyDigest: this.options.fallbackPolicyDigest,
-      recipes: this.options.recipes,
+      fallbackPolicyDigest: active.buildPolicyDigest ?? this.options.fallbackPolicyDigest,
+      recipes: active.recipes ?? this.options.recipes,
       recipeExecutor: this.options.recipeExecutor,
       review: (patch2, verification) => this.options.control.review(command.sessionId, { patch: patch2, verification })
     });
@@ -1978,6 +1978,10 @@ import {
   keepRecentExchanges,
   runAgent
 } from "@odla-ai/ai";
+function readOnlyNotice(readOnly, recipes) {
+  if (!readOnly) return "";
+  return recipes ? "\n\nThis session is read-only: inspect and report; repository mutation is intentionally unavailable. The registered proof recipes are available through odla_run_recipe and must be run before any verdict." : "\n\nThis session is read-only. Inspect and report; repository mutation and recipe execution are intentionally unavailable.";
+}
 async function runCodeAgent(options) {
   const toolCalls = [];
   const surface = options.surface ?? "v1";
@@ -1987,6 +1991,7 @@ async function runCodeAgent(options) {
     workspaceDir: options.workspaceDir,
     surface,
     ...options.readOnly === void 0 ? {} : { readOnly: options.readOnly },
+    ...options.recipes === void 0 ? {} : { recipes: options.recipes },
     ...options.recipeIds ? { recipeIds: options.recipeIds } : {},
     onToolCall: (call) => {
       toolCalls.push(call);
@@ -1999,7 +2004,7 @@ async function runCodeAgent(options) {
     {
       name: "odla-code",
       model: options.model,
-      system: options.system ?? `${SYSTEM_PROMPT_FOR[surface]}${options.readOnly ? "\n\nThis session is read-only. Inspect and report; repository mutation and recipe execution are intentionally unavailable." : ""}`,
+      system: options.system ?? `${SYSTEM_PROMPT_FOR[surface]}${readOnlyNotice(options.readOnly, options.recipes)}`,
       skills: [skill, ...options.extraSkills ?? []],
       maxSteps: options.maxSteps ?? 24,
       maxTokens: options.maxTokens ?? 16384
@@ -2084,13 +2089,19 @@ function createCodeRuntimeSessionSkillLoader(control) {
         ...tool.acceptsTaint === void 0 ? {} : { acceptsTaint: tool.acceptsTaint },
         handler: async (input, context) => {
           if (!context.toolCallId) throw new TypeError("collaboration tool call identity is required");
-          return execute2(command.sessionId, {
-            commandId: command.commandId,
-            toolCallId: context.toolCallId,
-            skill: manifest.name,
-            tool: tool.name,
-            input
-          }, context.signal);
+          try {
+            return await execute2(command.sessionId, {
+              commandId: command.commandId,
+              toolCallId: context.toolCallId,
+              skill: manifest.name,
+              tool: tool.name,
+              input
+            }, context.signal);
+          } catch (cause) {
+            if (context.signal?.aborted) throw cause;
+            const detail = (cause instanceof Error ? cause.message : String(cause)).slice(0, 500);
+            return { content: `Tool "${tool.name}" failed: ${detail}`, isError: true };
+          }
         }
       }))
     }));
@@ -3145,6 +3156,110 @@ function assertBudget(budget) {
   }
 }
 
+// src/code-repository-recipes.ts
+import { readFile as readFile6 } from "fs/promises";
+import { join as join6 } from "path";
+
+// src/code-runtime-events.ts
+import { createHash as createHash3 } from "crypto";
+async function appendCodeRuntimeEvent(control, command, event, refs) {
+  const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
+  refs.push(eventId);
+  const attributed = { ...event, interactionId: command.commandId };
+  const bounded = attributed.type === "message" ? { ...attributed, body: attributed.body.trim().slice(0, 2e4) || `${attributed.actor} event` } : attributed;
+  await control.appendSessionEvent(command.sessionId, eventId, bounded);
+}
+var digestRuntimeValue = (value) => `sha256:${createHash3("sha256").update(value).digest("hex")}`;
+var runtimeErrorMessage = (value) => value instanceof Error ? value.message : String(value);
+
+// src/code-repository-recipes.ts
+var REPOSITORY_RECIPES_FILE = "odla.recipes.json";
+var MAX_RECIPES = 16;
+var DEFAULT_TIMEOUT_MS = 12e4;
+var MAX_TIMEOUT_MS = 15 * 6e4;
+var ID2 = /^[A-Za-z0-9._:-]{1,120}$/;
+var RECIPE_FIELDS = /* @__PURE__ */ new Set(["id", "command", "timeoutMs"]);
+var fault = (detail) => new TypeError(`${REPOSITORY_RECIPES_FILE} is malformed: ${detail}`);
+function parseRepositoryRecipes(text, envelope) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw fault("not valid JSON");
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw fault("the document must be an object");
+  const document = parsed;
+  if (document.version !== 1) throw fault("version must be 1");
+  const entries = document.recipes;
+  if (!Array.isArray(entries) || entries.length < 1) throw fault("recipes must be a non-empty array");
+  if (entries.length > MAX_RECIPES) throw fault(`at most ${MAX_RECIPES} recipes may be declared`);
+  const recipes = [];
+  const seen = /* @__PURE__ */ new Set();
+  entries.forEach((entry, index) => {
+    const label = `recipe ${index + 1}`;
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) throw fault(`${label} must be an object`);
+    const row = entry;
+    const unknown = Object.keys(row).filter((key) => !RECIPE_FIELDS.has(key));
+    if (unknown.length) throw fault(`${label} has unsupported field ${unknown[0]}; the host owns image and resource limits`);
+    if (typeof row.id !== "string" || !ID2.test(row.id)) throw fault(`${label} needs an id of 1 to 120 letters, digits, . _ : or -`);
+    if (seen.has(row.id)) throw fault(`${label} repeats id ${row.id}`);
+    seen.add(row.id);
+    if (!Array.isArray(row.command) || row.command.length < 1 || row.command.some((part) => typeof part !== "string" || !part)) {
+      throw fault(`${label} (${row.id}) needs command as a non-empty array of non-empty strings`);
+    }
+    const timeoutMs = row.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > MAX_TIMEOUT_MS) {
+      throw fault(`${label} (${row.id}) timeoutMs must be an integer from 1 to ${MAX_TIMEOUT_MS}`);
+    }
+    const recipe2 = {
+      id: row.id,
+      command: [...row.command],
+      timeoutMs,
+      image: envelope.image,
+      maxOutputBytes: envelope.maxOutputBytes,
+      cpus: envelope.cpus,
+      memory: envelope.memory,
+      pids: envelope.pids
+    };
+    try {
+      assertCodeBuildRecipe(recipe2);
+    } catch (cause) {
+      throw fault(`${label} (${row.id}) is not a runnable recipe: ${cause instanceof Error ? cause.message : String(cause)}`);
+    }
+    recipes.push(recipe2);
+  });
+  return recipes;
+}
+async function readRepositoryRecipes(baselineDir, envelope) {
+  let text;
+  try {
+    text = await readFile6(join6(baselineDir, REPOSITORY_RECIPES_FILE), "utf8");
+  } catch (cause) {
+    if (cause.code === "ENOENT") return null;
+    throw cause;
+  }
+  return parseRepositoryRecipes(text, envelope);
+}
+async function resolveCodeRecipes(baselineDir, release, envelope) {
+  const declared = envelope ? await readRepositoryRecipes(baselineDir, envelope) : null;
+  return declared ? { recipes: declared, source: "repository" } : { recipes: release, source: "release" };
+}
+function describeCodeRecipes(resolved) {
+  const ids = resolved.recipes.map((recipe2) => recipe2.id).join(", ");
+  return resolved.source === "repository" ? `Verification recipes: declared by the repository in ${REPOSITORY_RECIPES_FILE} \xB7 ${ids}` : `Verification recipes: release-owned (the repository declares none in ${REPOSITORY_RECIPES_FILE}) \xB7 ${ids}`;
+}
+async function sessionRecipesFor(workspace, options, resume) {
+  const resolved = await resolveCodeRecipes(workspace.baselineDir, options.recipes, options.repositoryRecipes ?? null).catch(async (cause) => {
+    await workspace.cleanup();
+    throw cause;
+  });
+  return {
+    ...resolved,
+    buildPolicyDigest: digestRuntimeValue(JSON.stringify(resolved.recipes)),
+    note: !resume && resolved.source === "repository" ? describeCodeRecipes(resolved) : null
+  };
+}
+
 // src/code-runtime-broker.ts
 function createCodeRuntimeToolBroker(input, lease, role) {
   const broker = createCodeToolBroker({
@@ -3154,16 +3269,17 @@ function createCodeRuntimeToolBroker(input, lease, role) {
     readerId: `code-session:${lease.task.taskId}`,
     readOnlyPrefixes: [".odla-references"]
   });
-  const reviewReads = /* @__PURE__ */ new Set([
+  const reviewTools = /* @__PURE__ */ new Set([
     "sandbox.read",
     "sandbox.list",
     "sandbox.search",
     "sandbox.overview",
     "sandbox.where_is",
     "sandbox.who_imports",
-    "sandbox.who_touches"
+    "sandbox.who_touches",
+    "sandbox.run_recipe"
   ]);
-  return role === "coding" ? broker : { execute: (context, request) => reviewReads.has(request.tool) ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
+  return role === "coding" ? broker : { execute: (context, request) => reviewTools.has(request.tool) ? broker.execute(context, request) : Promise.resolve({ requestId: request.requestId, ok: false, content: "review sessions are read-only" }) };
 }
 
 // src/code-runtime-goal.ts
@@ -3325,18 +3441,6 @@ async function startGoalPursuit(input) {
   return { status: run.met ? "completed" : "failed", finalText: "" };
 }
 
-// src/code-runtime-events.ts
-import { createHash as createHash3 } from "crypto";
-async function appendCodeRuntimeEvent(control, command, event, refs) {
-  const eventId = `${command.commandId.slice(0, 45)}:${refs.length + 1}`;
-  refs.push(eventId);
-  const attributed = { ...event, interactionId: command.commandId };
-  const bounded = attributed.type === "message" ? { ...attributed, body: attributed.body.trim().slice(0, 2e4) || `${attributed.actor} event` } : attributed;
-  await control.appendSessionEvent(command.sessionId, eventId, bounded);
-}
-var digestRuntimeValue = (value) => `sha256:${createHash3("sha256").update(value).digest("hex")}`;
-var runtimeErrorMessage = (value) => value instanceof Error ? value.message : String(value);
-
 // src/code-runtime-acknowledgement-gate.ts
 function codeRuntimeAcknowledgementGate(signal) {
   let settle;
@@ -3458,6 +3562,7 @@ var TheseusRuntimeEngine = class {
       control: this.options.control,
       ...this.options.localSource ? { localSource: this.options.localSource } : {}
     });
+    const resolvedRecipes = await sessionRecipesFor(workspace, this.options, resume);
     const abort = new AbortController(), startGate = codeRuntimeAcknowledgementGate(abort.signal);
     const conversationRefs = [];
     const active = {
@@ -3466,6 +3571,8 @@ var TheseusRuntimeEngine = class {
       conversationRefs,
       acknowledged: false,
       startGate,
+      recipes: resolvedRecipes.recipes,
+      buildPolicyDigest: resolvedRecipes.buildPolicyDigest,
       role: metadata.role,
       readOnly: metadata.readOnly,
       title: metadata.title,
@@ -3483,6 +3590,7 @@ var TheseusRuntimeEngine = class {
       done: Promise.resolve(null)
     };
     this.#active.set(command.sessionId, active);
+    if (resolvedRecipes.note) await this.#event(command, { type: "message", actor: "system", body: resolvedRecipes.note }, conversationRefs);
     if (requestedLocal) {
       await this.#event(command, {
         type: "message",
@@ -3518,7 +3626,7 @@ var TheseusRuntimeEngine = class {
     const active = await this.#takeOver(command, "pursue requires an active Code session");
     active.done = startGoalPursuit({
       spec,
-      recipes: this.options.recipes,
+      recipes: active.recipes,
       recipeExecutor: this.options.recipeExecutor ?? createContainerRecipeExecutor(this.options.engine),
       workspace: active.workspace,
       baseCommitSha: active.baseCommitSha,
@@ -3597,7 +3705,7 @@ var TheseusRuntimeEngine = class {
   async #runAttempt(command, metadata, active) {
     const lease = fakeCodeLease(command, metadata);
     const broker = this.#observed(command, active, createCodeRuntimeToolBroker({
-      recipes: this.options.recipes,
+      recipes: active.recipes,
       engine: this.options.engine,
       recipeAuthorization: this.options.recipeAuthorization
     }, lease, metadata.role));
@@ -3623,7 +3731,7 @@ var TheseusRuntimeEngine = class {
       // A review-role session is read-only and still runs the proof; a planner
       // marked read-only by its payload runs nothing.
       recipes: metadata.role === "review" || !metadata.readOnly,
-      recipeIds: this.options.recipes.map((recipe2) => recipe2.id),
+      recipeIds: active.recipes.map((recipe2) => recipe2.id),
       ...extraSkills.length ? { extraSkills } : {}
     });
     const closing = result.finalText.trim();
@@ -3720,6 +3828,7 @@ export {
   V3_SYSTEM_PROMPT,
   SYSTEM_PROMPT_FOR,
   codeSkill,
+  readOnlyNotice,
   runCodeAgent,
   runCodeAgentAttempt,
   createCodeRuntimeSessionSkillLoader,
@@ -3733,6 +3842,12 @@ export {
   renderMemories,
   hazardFromAttempt,
   runGoal,
+  REPOSITORY_RECIPES_FILE,
+  parseRepositoryRecipes,
+  readRepositoryRecipes,
+  resolveCodeRecipes,
+  describeCodeRecipes,
+  sessionRecipesFor,
   TheseusRuntimeEngine
 };
-//# sourceMappingURL=chunk-TMBYA5JX.js.map
+//# sourceMappingURL=chunk-IXYKIPRA.js.map