@odla-ai/harness 0.11.8 → 0.11.10

package/dist/code-runtime-cli.js

@@ -7,7 +7,7 @@ import {
   createCodeRuntimeControlClient,
   createCodeRuntimeSessionSkillLoader,
   runCodeRuntimeHeartbeatLoop
-} from "./chunk-NUDKRYL4.js";
+} from "./chunk-4IGSN53G.js";
 import "./chunk-INL642J5.js";
 import {
   assertPinnedImage,

package/dist/node.cjs

@@ -25,6 +25,7 @@ __export(node_exports, {
   CodeRuntimeCheckpointManager: () => CodeRuntimeCheckpointManager,
   CodeRuntimeControlError: () => CodeRuntimeControlError,
   CodeRuntimeReconciler: () => CodeRuntimeReconciler,
+  DEPENDENCY_INSTALL_TIMEOUT_MS: () => DEPENDENCY_INSTALL_TIMEOUT_MS,
   DecompositionError: () => DecompositionError,
   MAX_MEMORY_BODY: () => MAX_MEMORY_BODY,
   MEASURED_PREMIUM: () => MEASURED_PREMIUM,
@@ -51,6 +52,8 @@ __export(node_exports, {
   createCodeToolBroker: () => createCodeToolBroker,
   createCodeWorkspaceCheckpoint: () => createCodeWorkspaceCheckpoint,
   createContainerRecipeExecutor: () => createContainerRecipeExecutor,
+  dependencyCacheKey: () => dependencyCacheKey,
+  dependencyInstallArgs: () => dependencyInstallArgs,
   describeCodeRecipes: () => describeCodeRecipes,
   describeGateFailure: () => describeGateFailure,
   describePatchFailure: () => describePatchFailure,
@@ -70,6 +73,7 @@ __export(node_exports, {
   parseRepositoryRecipes: () => parseRepositoryRecipes,
   patchPaths: () => patchPaths,
   planReachCollisions: () => planReachCollisions,
+  prepareContainerDependencies: () => prepareContainerDependencies,
   prepareRuntimeCheckpoint: () => prepareRuntimeCheckpoint,
   racedAttempt: () => racedAttempt,
   readOnlyNotice: () => readOnlyNotice,
@@ -85,6 +89,7 @@ __export(node_exports, {
   runCodeAgentAttempt: () => runCodeAgentAttempt,
   runCodeRuntimeHeartbeatLoop: () => runCodeRuntimeHeartbeatLoop,
   runContainerAttempt: () => runContainerAttempt,
+  runContainerCommand: () => runContainerCommand,
   runGoal: () => runGoal,
   runHarnessRunner: () => runHarnessRunner,
   runLeasedAttempt: () => runLeasedAttempt,
@@ -94,6 +99,7 @@ __export(node_exports, {
   selectWinner: () => selectWinner,
   sessionRecipesFor: () => sessionRecipesFor,
   sessionSkillsFor: () => sessionSkillsFor,
+  stageManifests: () => stageManifests,
   stageWorkspace: () => stageWorkspace,
   stageWorkspacePair: () => stageWorkspacePair,
   straySubGoalFiles: () => straySubGoalFiles,
@@ -1704,8 +1710,9 @@ var import_node_process2 = require("process");
 var import_node_crypto2 = require("crypto");
 var ARTIFACT_PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
 var PRIVATE_ARTIFACT_PART = /^(?:\.git|\.odla|\.wrangler|\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json)$/i;
-function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-recipe-${(0, import_node_crypto2.randomUUID)().slice(0, 12)}`) {
+function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-recipe-${(0, import_node_crypto2.randomUUID)().slice(0, 12)}`, dependencies = null) {
   assertCodeBuildRecipe(recipe2);
+  const mounts = dependencies ? [dependencyMount(engine, dependencies)] : [];
   if (/[,\r\n]/.test(workspaceDir)) throw new TypeError("workspace path contains unsupported mount characters");
   const uid = typeof import_node_process2.getuid === "function" ? (0, import_node_process2.getuid)() : 1e3;
   const gid = typeof import_node_process2.getgid === "function" ? (0, import_node_process2.getgid)() : 1e3;
@@ -1728,6 +1735,7 @@ function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-re
       `--user=${uid}:${gid}`,
       "--tmpfs=/tmp",
       `--mount=type=bind,source=${workspaceDir},target=/workspace`,
+      ...mounts,
       "--workdir=/workspace",
       "--env=CI=1",
       recipe2.image,
@@ -1749,18 +1757,28 @@ function buildRecipeContainerArgs(engine, workspaceDir, recipe2, name = `odla-re
     `--user=${uid}:${gid}`,
     `--tmpfs=/tmp:rw,noexec,nosuid,nodev,size=${limits.tmpfs}`,
     `--mount=type=bind,src=${workspaceDir},dst=/workspace`,
+    ...mounts,
     "--workdir=/workspace",
     "--env=CI=1",
     recipe2.image,
     ...recipe2.command
   ];
 }
-function createContainerRecipeExecutor(engine) {
+var LENDABLE = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage"]);
+function dependencyMount(engine, dependencies) {
+  const mountAs = dependencies.mountAs ?? "node_modules";
+  if (!dependencies.source.startsWith("/") || /[,\r\n]/.test(dependencies.source)) {
+    throw new TypeError("recipe dependency source must be an absolute path without mount separators");
+  }
+  if (!LENDABLE.has(mountAs)) throw new TypeError(`recipe dependencies must mount at a reserved name, not "${mountAs}"`);
+  return engine === "container" ? `--mount=type=bind,source=${dependencies.source},target=/workspace/${mountAs},readonly` : `--mount=type=bind,src=${dependencies.source},dst=/workspace/${mountAs},readonly`;
+}
+function createContainerRecipeExecutor(engine, options = {}) {
   return {
     async run(input) {
       await verifyContainerEngineBoundary(engine);
       const name = `odla-recipe-${(0, import_node_crypto2.randomUUID)().slice(0, 12)}`;
-      const args = buildRecipeContainerArgs(engine, input.workspaceDir, input.recipe, name);
+      const args = buildRecipeContainerArgs(engine, input.workspaceDir, input.recipe, name, options.dependencies ?? null);
       return execute(engine, args, name, input.recipe, input.signal);
     }
   };
@@ -1781,6 +1799,9 @@ function parseMemory(value) {
   return Number(match[1]) * scale;
 }
 function execute(engine, args, name, recipe2, signal) {
+  return runContainerCommand(engine, args, name, { timeoutMs: recipe2.timeoutMs, maxOutputBytes: recipe2.maxOutputBytes }, signal);
+}
+function runContainerCommand(engine, args, name, recipe2, signal) {
   return new Promise((accept, reject) => {
     const started = Date.now();
     const child = (0, import_node_child_process5.spawn)(engine, args, { shell: false, stdio: ["ignore", "pipe", "pipe"] });
@@ -2881,7 +2902,7 @@ function codeSkill(opts) {
     },
     handler: (input, ctx) => call("sandbox.edit", input, ctx.signal)
   };
-  const writeFile6 = {
+  const writeFile7 = {
     name: "odla_write_file",
     description: "Create a file or replace its entire contents with exactly the text given. Use this for a NEW file (a test, a module, a fixture) and for a rewrite where most lines change; use odla_edit_file for a small change inside an existing file. Paths are repository-relative; parent directories are created. The content must be the complete file.",
     inputSchema: {
@@ -2983,7 +3004,7 @@ function codeSkill(opts) {
   ];
   const runsRecipes = opts.recipes ?? !opts.readOnly;
   const effects = [...opts.readOnly ? [] : [applyPatch], ...runsRecipes ? [runRecipe] : []];
-  const tools = opts.surface === "v3" ? [...orientation, searchFiles, read2, ...opts.readOnly ? [] : [editFile, writeFile6], ...effects] : opts.surface === "v2" ? [listFiles, searchFiles, read2, ...effects] : [read2, ...effects];
+  const tools = opts.surface === "v3" ? [...orientation, searchFiles, read2, ...opts.readOnly ? [] : [editFile, writeFile7], ...effects] : opts.surface === "v2" ? [listFiles, searchFiles, read2, ...effects] : [read2, ...effects];
   return { name: "code", tools };
 }
 
@@ -3814,8 +3835,8 @@ async function write(context, request, options, policy, registry) {
   if (options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`))) {
     throw new TypeError("write targets a read-only reference source");
   }
-  const exists = (await registry.files(context.workspaceDir)).includes(path);
-  const current = exists ? await (0, import_promises13.readFile)(resolveCodePath(context.workspaceDir, path), "utf8") : null;
+  const exists2 = (await registry.files(context.workspaceDir)).includes(path);
+  const current = exists2 ? await (0, import_promises13.readFile)(resolveCodePath(context.workspaceDir, path), "utf8") : null;
   const patch2 = writeAsDiff(path, current, content);
   const allowed = await policy.write(policyContext(context, request, options, { patch: patch2 }));
   if (!allowed) return response(request, false, "tool denied by CaMeL policy");
@@ -4769,7 +4790,7 @@ var TheseusRuntimeEngine = class {
     this.#checkpoints = new CodeRuntimeCheckpointManager({
       control: options.control,
       recipes: options.recipes,
-      recipeExecutor: options.recipeExecutor ?? createContainerRecipeExecutor(options.engine),
+      recipeExecutor: options.recipeExecutor ?? createContainerRecipeExecutor(options.engine, { dependencies: options.recipeDependencies ?? null }),
       fallbackPolicyDigest: this.#buildPolicyDigest,
       event: (command, event, refs) => this.#event(command, event, refs)
     });
@@ -4877,7 +4898,7 @@ var TheseusRuntimeEngine = class {
     active.done = startGoalPursuit({
       spec,
       recipes: active.recipes,
-      recipeExecutor: this.options.recipeExecutor ?? createContainerRecipeExecutor(this.options.engine),
+      recipeExecutor: this.options.recipeExecutor ?? createContainerRecipeExecutor(this.options.engine, { dependencies: this.options.recipeDependencies ?? null }),
       workspace: active.workspace,
       baseCommitSha: active.baseCommitSha,
       trustedBaseDigest: active.trustedBaseDigest,
@@ -5347,6 +5368,95 @@ async function installedDependencies(repoRoot) {
   const info = await (0, import_promises17.lstat)(source).catch(() => null);
   return info?.isDirectory() ? { source } : null;
 }
+
+// src/code-recipe-dependency-cache.ts
+var import_node_crypto5 = require("crypto");
+var import_promises18 = require("fs/promises");
+var import_node_process3 = require("process");
+var import_node_path16 = require("path");
+var DEPENDENCY_INSTALL_TIMEOUT_MS = 20 * 6e4;
+var OUTPUT_CAP = 4 * 1024 * 1024;
+var exists = async (path) => Boolean(await (0, import_promises18.stat)(path).catch(() => null));
+async function dependencyCacheKey(repoRoot, image, arch = process.arch) {
+  const lock = await (0, import_promises18.readFile)((0, import_node_path16.join)(repoRoot, "package-lock.json")).catch(() => null);
+  if (!lock) return null;
+  return (0, import_node_crypto5.createHash)("sha256").update(lock).update("\n").update(image).update("\n").update(arch).digest("hex").slice(0, 32);
+}
+async function stageManifests(repoRoot, stageDir) {
+  await (0, import_promises18.mkdir)(stageDir, { recursive: true });
+  const staged = [];
+  for (const name of ["package.json", "package-lock.json", ".npmrc"]) {
+    if (!await exists((0, import_node_path16.join)(repoRoot, name))) continue;
+    await (0, import_promises18.copyFile)((0, import_node_path16.join)(repoRoot, name), (0, import_node_path16.join)(stageDir, name));
+    staged.push(name);
+  }
+  const root = JSON.parse(await (0, import_promises18.readFile)((0, import_node_path16.join)(repoRoot, "package.json"), "utf8"));
+  const globs = Array.isArray(root.workspaces) ? root.workspaces : root.workspaces?.packages ?? [];
+  for (const glob of globs) {
+    const dirs = glob.endsWith("/*") ? (await (0, import_promises18.readdir)((0, import_node_path16.join)(repoRoot, glob.slice(0, -2)), { withFileTypes: true }).catch(() => [])).filter((entry) => entry.isDirectory()).map((entry) => `${glob.slice(0, -2)}/${entry.name}`) : [glob];
+    for (const dir of dirs) {
+      const manifest = (0, import_node_path16.join)(repoRoot, dir, "package.json");
+      if (!await exists(manifest)) continue;
+      await (0, import_promises18.mkdir)((0, import_node_path16.join)(stageDir, dir), { recursive: true });
+      await (0, import_promises18.copyFile)(manifest, (0, import_node_path16.join)(stageDir, dir, "package.json"));
+      staged.push(`${dir}/package.json`);
+    }
+  }
+  return staged;
+}
+function dependencyInstallArgs(engine, image, stageDir, name) {
+  if (/[,\r\n]/.test(stageDir)) throw new TypeError("stage path contains unsupported mount characters");
+  const uid = typeof import_node_process3.getuid === "function" ? (0, import_node_process3.getuid)() : 1e3;
+  const gid = typeof import_node_process3.getgid === "function" ? (0, import_node_process3.getgid)() : 1e3;
+  const mount = engine === "container" ? `--mount=type=bind,source=${stageDir},target=/workspace` : `--mount=type=bind,src=${stageDir},dst=/workspace`;
+  const npm = ["npm", "ci", "--no-audit", "--no-fund", "--ignore-scripts"];
+  return [
+    "run",
+    "--rm",
+    `--name=${name}`,
+    "--cap-drop=ALL",
+    "--memory=2g",
+    "--cpus=2",
+    `--user=${uid}:${gid}`,
+    "--tmpfs=/tmp",
+    mount,
+    "--workdir=/workspace",
+    "--env=CI=1",
+    "--env=npm_config_cache=/tmp/npm-cache",
+    "--env=HOME=/tmp",
+    image,
+    ...npm
+  ];
+}
+async function prepareContainerDependencies(input) {
+  const key = await dependencyCacheKey(input.repoRoot, input.image);
+  if (!key) return null;
+  const dir = (0, import_node_path16.join)(input.cacheRoot, key);
+  const tree = (0, import_node_path16.join)(dir, "node_modules");
+  const stage = (0, import_node_path16.join)(dir, "stage");
+  if (await exists(tree)) return { source: tree };
+  const run = input.run ?? runContainerCommand;
+  await (0, import_promises18.rm)(stage, { recursive: true, force: true });
+  const staged = await stageManifests(input.repoRoot, stage);
+  input.log?.(`installing ${key.slice(0, 12)}: ${staged.length} manifests, npm ci in ${input.image}`);
+  const name = `odla-deps-${key.slice(0, 12)}`;
+  const result = await run(
+    input.engine,
+    dependencyInstallArgs(input.engine, input.image, stage, name),
+    name,
+    { timeoutMs: DEPENDENCY_INSTALL_TIMEOUT_MS, maxOutputBytes: OUTPUT_CAP }
+  );
+  if (result.exitCode !== 0 || result.timedOut || !await exists((0, import_node_path16.join)(stage, "node_modules"))) {
+    input.log?.(`install failed (exit ${result.exitCode}${result.timedOut ? ", timed out" : ""}): ${result.stderr.trim().split("\n").slice(-3).join(" | ").slice(0, 400)}`);
+    await (0, import_promises18.rm)(stage, { recursive: true, force: true });
+    return null;
+  }
+  await (0, import_promises18.rename)((0, import_node_path16.join)(stage, "node_modules"), tree);
+  await (0, import_promises18.rm)(stage, { recursive: true, force: true });
+  await (0, import_promises18.writeFile)((0, import_node_path16.join)(dir, "manifest.json"), JSON.stringify({ image: input.image, key, createdAt: Date.now() }, null, 2));
+  input.log?.(`installed ${key.slice(0, 12)} in ${Math.round(result.durationMs / 1e3)}s`);
+  return { source: tree };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   CODE_PATCH_PATH,
@@ -5354,6 +5464,7 @@ async function installedDependencies(repoRoot) {
   CodeRuntimeCheckpointManager,
   CodeRuntimeControlError,
   CodeRuntimeReconciler,
+  DEPENDENCY_INSTALL_TIMEOUT_MS,
   DecompositionError,
   MAX_MEMORY_BODY,
   MEASURED_PREMIUM,
@@ -5380,6 +5491,8 @@ async function installedDependencies(repoRoot) {
   createCodeToolBroker,
   createCodeWorkspaceCheckpoint,
   createContainerRecipeExecutor,
+  dependencyCacheKey,
+  dependencyInstallArgs,
   describeCodeRecipes,
   describeGateFailure,
   describePatchFailure,
@@ -5399,6 +5512,7 @@ async function installedDependencies(repoRoot) {
   parseRepositoryRecipes,
   patchPaths,
   planReachCollisions,
+  prepareContainerDependencies,
   prepareRuntimeCheckpoint,
   racedAttempt,
   readOnlyNotice,
@@ -5414,6 +5528,7 @@ async function installedDependencies(repoRoot) {
   runCodeAgentAttempt,
   runCodeRuntimeHeartbeatLoop,
   runContainerAttempt,
+  runContainerCommand,
   runGoal,
   runHarnessRunner,
   runLeasedAttempt,
@@ -5423,6 +5538,7 @@ async function installedDependencies(repoRoot) {
   selectWinner,
   sessionRecipesFor,
   sessionSkillsFor,
+  stageManifests,
   stageWorkspace,
   stageWorkspacePair,
   straySubGoalFiles,