@odla-ai/harness 0.8.1 → 0.9.1

package/dist/code-runtime-cli.cjs

@@ -5,7 +5,7 @@
 var import_node_os3 = require("os");
 var import_promises10 = require("fs/promises");
 
-// src/code-runtime-client.ts
+// src/code-runtime-client-validation.ts
 var import_code = require("@odla-ai/camel/code");
 var CodeRuntimeControlError = class extends Error {
   constructor(message2, status, code = "control_error") {
@@ -17,101 +17,6 @@ var CodeRuntimeControlError = class extends Error {
   code;
   name = "CodeRuntimeControlError";
 };
-function createCodeRuntimeControlClient(options) {
-  const endpoint = validatedEndpoint(options.endpoint);
-  if (!/^odla_code_host_[0-9a-f]{64}$/.test(options.token)) throw new TypeError("invalid Code host credential");
-  const requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
-  if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 1e3 || requestTimeoutMs > 12e4) {
-    throw new TypeError("requestTimeoutMs must be an integer from 1000 to 120000");
-  }
-  const modelRequestTimeoutMs = options.modelRequestTimeoutMs ?? 15 * 6e4;
-  if (!Number.isSafeInteger(modelRequestTimeoutMs) || modelRequestTimeoutMs < 3e4 || modelRequestTimeoutMs > 30 * 6e4) {
-    throw new TypeError("modelRequestTimeoutMs must be an integer from 30000 to 1800000");
-  }
-  const request = options.fetch ?? fetch;
-  const call = async (path, body, timeoutMs = requestTimeoutMs) => {
-    const timeout = AbortSignal.timeout(timeoutMs);
-    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
-    let response2;
-    try {
-      response2 = await request(`${endpoint}${path}`, {
-        method: "POST",
-        headers: { authorization: `Bearer ${options.token}`, "content-type": "application/json" },
-        body: JSON.stringify(body),
-        redirect: "error",
-        signal
-      });
-    } catch (cause) {
-      if (options.signal?.aborted) throw cause;
-      throw new CodeRuntimeControlError("Code runtime control plane is unavailable", 503, "transport_unavailable");
-    }
-    const value = await response2.json().catch(() => null);
-    if (!response2.ok) {
-      const problem = record(record(value)?.error);
-      throw new CodeRuntimeControlError(
-        typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
-        response2.status,
-        typeof problem?.code === "string" ? problem.code : void 0
-      );
-    }
-    return value;
-  };
-  return {
-    heartbeat: async (version, capabilities) => {
-      validateHeartbeat(version, capabilities);
-      return parseSnapshot(await call("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
-    },
-    acknowledge: async (commandId, result) => {
-      if (!/^ccmd_[0-9a-f]{32}$/.test(commandId)) throw new TypeError("invalid Code runtime command id");
-      await call(`/registry/code/runtime/commands/${commandId}/ack`, result);
-    },
-    source: async (sessionId) => parseSource(
-      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
-    ),
-    infer: async (sessionId, inference) => {
-      const value = record(await call(
-        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
-        inference,
-        modelRequestTimeoutMs
-      ));
-      if (!value || value.requestId !== inference.requestId || !record(value.response) || !record(value.receipt)) {
-        throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
-      }
-      return value;
-    },
-    review: async (sessionId, review) => parseReview(
-      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
-    ),
-    submitCandidate: async (sessionId, checkpointId, verification) => {
-      if (!/^cpoint_[0-9a-f]{32}$/.test(checkpointId)) throw new TypeError("invalid Code checkpoint id");
-      return parseCandidate(await call(
-        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/candidates`,
-        { checkpointId, verification }
-      ));
-    },
-    appendSessionEvent: async (sessionId, eventId, event) => {
-      const serialized = JSON.stringify(event);
-      if (!/^[A-Za-z0-9._:-]{1,120}$/.test(eventId) || !event || typeof event !== "object" || new TextEncoder().encode(serialized).byteLength > 24e3) {
-        throw new TypeError("invalid Code session event");
-      }
-      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
-    },
-    recallMemories: async (sessionId, subjects, limit) => {
-      const response2 = await call(
-        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/recall`,
-        { subjects: [...subjects], limit }
-      );
-      return Array.isArray(response2.memories) ? response2.memories : [];
-    },
-    rememberMemory: async (sessionId, memory) => {
-      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
-    },
-    reportSessionFailure: async (sessionId, message2) => {
-      if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
-      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
-    }
-  };
-}
 function validatedEndpoint(value) {
   const endpoint = value.replace(/\/+$/, "");
   let url;
@@ -130,6 +35,10 @@ function validSessionId(value) {
   if (!/^csess_[0-9a-f]{32}$/.test(value)) throw new TypeError("invalid Code session id");
   return value;
 }
+function validCommandId(value) {
+  if (!/^ccmd_[0-9a-f]{32}$/.test(value)) throw new TypeError("invalid Code runtime command id");
+  return value;
+}
 function validateHeartbeat(version, capabilities) {
   if (!version.trim() || version.length > 80) throw new TypeError("runtimeVersion is required and at most 80 characters");
   if (capabilities.protocolVersion !== CODE_RUNTIME_PROTOCOL_VERSION) throw new TypeError("unsupported Code runtime protocol version");
@@ -211,9 +120,211 @@ function parseCandidate(value) {
   }
   return { candidateId: candidate.candidateId, status: candidate.status };
 }
+function parseCollaborationSkills(value) {
+  const items = record(value)?.skills;
+  if (!Array.isArray(items) || items.length > 16) throw invalid("collaboration skills");
+  const skillNames = /* @__PURE__ */ new Set();
+  const toolNames = /* @__PURE__ */ new Set();
+  return items.map((item) => {
+    const skill = record(item);
+    if (!skill || !validManifestName(skill.name) || skillNames.has(skill.name) || skill.instructions !== void 0 && (typeof skill.instructions !== "string" || utf8Bytes(skill.instructions) > 32e3) || !Array.isArray(skill.tools) || !skill.tools.length || skill.tools.length > 128) {
+      throw invalid("collaboration skill");
+    }
+    skillNames.add(skill.name);
+    const tools = skill.tools.map((candidate) => {
+      const tool = record(candidate);
+      const inputSchema = record(tool?.inputSchema);
+      if (!tool || !validManifestName(tool.name) || toolNames.has(tool.name) || typeof tool.description !== "string" || utf8Bytes(tool.description) > 8e3 || !inputSchema || jsonBytes(inputSchema) > 64e3 || tool.concurrency !== void 0 && tool.concurrency !== "parallel") {
+        throw invalid("collaboration tool");
+      }
+      const outputTaint = parseTaintLabels(tool.outputTaint);
+      const acceptsTaint = parseTaintLabels(tool.acceptsTaint);
+      toolNames.add(tool.name);
+      return {
+        name: tool.name,
+        description: tool.description,
+        inputSchema,
+        ...tool.concurrency === "parallel" ? { concurrency: "parallel" } : {},
+        ...outputTaint ? { outputTaint } : {},
+        ...acceptsTaint ? { acceptsTaint } : {}
+      };
+    });
+    return {
+      name: skill.name,
+      ...typeof skill.instructions === "string" ? { instructions: skill.instructions } : {},
+      tools
+    };
+  });
+}
+function validateCollaborationToolRequest(value) {
+  validCommandId(value.commandId);
+  if (typeof value.toolCallId !== "string" || value.toolCallId.length > 256 || !/^[^\s\u0000-\u001f\u007f]+$/.test(value.toolCallId) || !validManifestName(value.skill) || !validManifestName(value.tool) || !record(value.input) || jsonBytes(value.input) > 128e3) {
+    throw new TypeError("invalid Code collaboration tool request");
+  }
+}
+function parseCollaborationToolOutput(value) {
+  const output = record(record(value)?.output);
+  if (!output || output.isError !== void 0 && typeof output.isError !== "boolean") {
+    throw invalid("collaboration tool");
+  }
+  if (typeof output.content === "string") {
+    if (utf8Bytes(output.content) > 1e6) throw invalid("collaboration tool");
+    return { content: output.content, ...output.isError === true ? { isError: true } : {} };
+  }
+  if (!Array.isArray(output.content) || output.content.length > 64 || jsonBytes(output.content) > 1e6 || !output.content.every((block) => {
+    const item = record(block);
+    return item && ["text", "image", "audio", "document", "tool_use", "tool_result", "thinking"].includes(String(item.type));
+  })) throw invalid("collaboration tool");
+  return {
+    content: output.content,
+    ...output.isError === true ? { isError: true } : {}
+  };
+}
+function parseTaintLabels(value) {
+  if (value === void 0) return void 0;
+  if (!Array.isArray(value) || value.length > 16) throw invalid("collaboration tool taint");
+  const labels = value.map((item) => {
+    if (item === "web_untrusted" || item === "operator_pasted_untrusted" || item === "llm_inherited") return item;
+    if (typeof item === "string" && /^tool_untrusted:[^\s\u0000-\u001f\u007f]{1,100}$/.test(item)) {
+      return item;
+    }
+    throw invalid("collaboration tool taint");
+  });
+  return [...new Set(labels)];
+}
+function validManifestName(value) {
+  return typeof value === "string" && /^[A-Za-z][A-Za-z0-9._:-]{0,127}$/.test(value);
+}
+function utf8Bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function jsonBytes(value) {
+  try {
+    return utf8Bytes(JSON.stringify(value));
+  } catch {
+    return Number.POSITIVE_INFINITY;
+  }
+}
 var record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
 var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
 
+// src/code-runtime-client.ts
+function createCodeRuntimeControlClient(options) {
+  const endpoint = validatedEndpoint(options.endpoint);
+  if (!/^odla_code_host_[0-9a-f]{64}$/.test(options.token)) throw new TypeError("invalid Code host credential");
+  const requestTimeoutMs = options.requestTimeoutMs ?? 3e4;
+  if (!Number.isSafeInteger(requestTimeoutMs) || requestTimeoutMs < 1e3 || requestTimeoutMs > 12e4) {
+    throw new TypeError("requestTimeoutMs must be an integer from 1000 to 120000");
+  }
+  const modelRequestTimeoutMs = options.modelRequestTimeoutMs ?? 15 * 6e4;
+  if (!Number.isSafeInteger(modelRequestTimeoutMs) || modelRequestTimeoutMs < 3e4 || modelRequestTimeoutMs > 30 * 6e4) {
+    throw new TypeError("modelRequestTimeoutMs must be an integer from 30000 to 1800000");
+  }
+  const request = options.fetch ?? fetch;
+  const call = async (path, body, timeoutMs = requestTimeoutMs, operationSignal) => {
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const signals = [options.signal, operationSignal, timeout].filter((item) => Boolean(item));
+    const signal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+    let response2;
+    try {
+      response2 = await request(`${endpoint}${path}`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${options.token}`, "content-type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "error",
+        signal
+      });
+    } catch (cause) {
+      if (options.signal?.aborted || operationSignal?.aborted) throw cause;
+      throw new CodeRuntimeControlError("Code runtime control plane is unavailable", 503, "transport_unavailable");
+    }
+    const value = await response2.json().catch(() => null);
+    if (!response2.ok) {
+      const problem = record(record(value)?.error);
+      throw new CodeRuntimeControlError(
+        typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
+        response2.status,
+        typeof problem?.code === "string" ? problem.code : void 0
+      );
+    }
+    return value;
+  };
+  return {
+    heartbeat: async (version, capabilities) => {
+      validateHeartbeat(version, capabilities);
+      return parseSnapshot(await call("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
+    },
+    acknowledge: async (commandId, result) => {
+      await call(`/registry/code/runtime/commands/${validCommandId(commandId)}/ack`, result);
+    },
+    source: async (sessionId) => parseSource(
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
+    ),
+    infer: async (sessionId, inference) => {
+      const value = record(await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
+        inference,
+        modelRequestTimeoutMs
+      ));
+      if (!value || value.requestId !== inference.requestId || !record(value.response) || !record(value.receipt)) {
+        throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
+      }
+      return value;
+    },
+    review: async (sessionId, review) => parseReview(
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
+    ),
+    submitCandidate: async (sessionId, checkpointId, verification) => {
+      if (!/^cpoint_[0-9a-f]{32}$/.test(checkpointId)) throw new TypeError("invalid Code checkpoint id");
+      return parseCandidate(await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/candidates`,
+        { checkpointId, verification }
+      ));
+    },
+    appendSessionEvent: async (sessionId, eventId, event) => {
+      const serialized = JSON.stringify(event);
+      if (!/^[A-Za-z0-9._:-]{1,120}$/.test(eventId) || !event || typeof event !== "object" || new TextEncoder().encode(serialized).byteLength > 24e3) {
+        throw new TypeError("invalid Code session event");
+      }
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
+    },
+    recallMemories: async (sessionId, subjects, limit) => {
+      const response2 = await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/recall`,
+        { subjects: [...subjects], limit }
+      );
+      return Array.isArray(response2.memories) ? response2.memories : [];
+    },
+    rememberMemory: async (sessionId, memory) => {
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
+    },
+    collaborationSkills: async (sessionId, commandId) => {
+      try {
+        return parseCollaborationSkills(await call(
+          `/registry/code/runtime/sessions/${validSessionId(sessionId)}/collaboration/skills`,
+          { commandId: validCommandId(commandId) }
+        ));
+      } catch (cause) {
+        if (cause instanceof CodeRuntimeControlError && cause.status === 404 && cause.code === "not_found") return [];
+        throw cause;
+      }
+    },
+    executeCollaborationTool: async (sessionId, collaboration, signal) => {
+      validateCollaborationToolRequest(collaboration);
+      return parseCollaborationToolOutput(await call(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/collaboration/tools`,
+        collaboration,
+        requestTimeoutMs,
+        signal
+      ));
+    },
+    reportSessionFailure: async (sessionId, message2) => {
+      if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
+      await call(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
+    }
+  };
+}
+
 // src/code-runtime.ts
 var CODE_RUNTIME_PROTOCOL_VERSION = 1;
 async function runCodeRuntimeHeartbeatLoop(options) {
@@ -240,12 +351,14 @@ async function runCodeRuntimeHeartbeatLoop(options) {
   } while (!options.signal?.aborted);
 }
 var CodeRuntimeReconciler = class {
-  constructor(control, engine) {
+  constructor(control, engine, onDiagnostic) {
     this.control = control;
     this.engine = engine;
+    this.onDiagnostic = onDiagnostic;
   }
   control;
   engine;
+  onDiagnostic;
   results = /* @__PURE__ */ new Map();
   async reconcile(snapshot) {
     for (const command of snapshot.commands) {
@@ -263,7 +376,13 @@ var CodeRuntimeReconciler = class {
       }
       await this.control.acknowledge(command.commandId, completed.result);
       if (!completed.notified) {
-        await this.engine.acknowledged?.(command, completed.result);
+        try {
+          await this.engine.acknowledged?.(command, completed.result);
+        } catch (error) {
+          this.onDiagnostic?.(
+            `command ${command.commandId} acknowledged handling failed \xB7 ${error instanceof Error ? error.message : String(error)}`
+          );
+        }
         completed.notified = true;
       }
     }
@@ -1659,6 +1778,36 @@ Finish with a concise, non-empty answer to the owner. Do not call tools or promi
 }
 
 // src/code-runtime-session-skills.ts
+function createCodeRuntimeSessionSkillLoader(control) {
+  const load = control.collaborationSkills?.bind(control);
+  const execute2 = control.executeCollaborationTool?.bind(control);
+  if (!load || !execute2) return async () => [];
+  return async (command) => {
+    const manifests = await load(command.sessionId, command.commandId);
+    return manifests.map((manifest) => ({
+      name: manifest.name,
+      ...manifest.instructions === void 0 ? {} : { instructions: manifest.instructions },
+      tools: manifest.tools.map((tool) => ({
+        name: tool.name,
+        description: tool.description,
+        inputSchema: tool.inputSchema,
+        ...tool.concurrency === void 0 ? {} : { concurrency: tool.concurrency },
+        ...tool.outputTaint === void 0 ? {} : { outputTaint: tool.outputTaint },
+        ...tool.acceptsTaint === void 0 ? {} : { acceptsTaint: tool.acceptsTaint },
+        handler: async (input, context) => {
+          if (!context.toolCallId) throw new TypeError("collaboration tool call identity is required");
+          return execute2(command.sessionId, {
+            commandId: command.commandId,
+            toolCallId: context.toolCallId,
+            skill: manifest.name,
+            tool: tool.name,
+            input
+          }, context.signal);
+        }
+      }))
+    }));
+  };
+}
 async function sessionSkillsFor(options, command) {
   try {
     return await options.sessionSkills?.(command) ?? [];
@@ -2865,6 +3014,76 @@ function codeToolResultPresentation(request, response2) {
   };
 }
 
+// src/code-runtime-acknowledgement-gate.ts
+function codeRuntimeAcknowledgementGate(signal) {
+  let settle;
+  let settled = false;
+  const ready = new Promise((resolve6) => {
+    settle = resolve6;
+  });
+  const release = (run) => {
+    if (settled) return;
+    settled = true;
+    signal.removeEventListener("abort", onAbort);
+    settle(run);
+  };
+  const onAbort = () => release(false);
+  if (signal.aborted) release(false);
+  else signal.addEventListener("abort", onAbort, { once: true });
+  return { ready, release };
+}
+
+// src/code-runtime-session-activity.ts
+function observeCodeRuntimeSessionSkills(command, skills, emit) {
+  return skills.map((skill) => ({
+    ...skill,
+    tools: skill.tools.map((tool) => {
+      if (!tool.handler) return tool;
+      const handler = tool.handler;
+      return {
+        ...tool,
+        handler: async (input, context) => {
+          const startedAt = Date.now();
+          const operationId = digestRuntimeValue(
+            `${command.commandId}:${skill.name}:${tool.name}:${context.toolCallId ?? "missing"}`
+          );
+          await emit({
+            type: "collaboration",
+            phase: "started",
+            skill: skill.name,
+            tool: tool.name,
+            operationId
+          }).catch(() => void 0);
+          try {
+            const output = await handler(input, context);
+            await emit({
+              type: "collaboration",
+              phase: "completed",
+              skill: skill.name,
+              tool: tool.name,
+              operationId,
+              ok: output.isError !== true,
+              durationMs: Date.now() - startedAt
+            }).catch(() => void 0);
+            return output;
+          } catch (cause) {
+            await emit({
+              type: "collaboration",
+              phase: "completed",
+              skill: skill.name,
+              tool: tool.name,
+              operationId,
+              ok: false,
+              durationMs: Date.now() - startedAt
+            }).catch(() => void 0);
+            throw cause;
+          }
+        }
+      };
+    })
+  }));
+}
+
 // src/code-runtime-engine.ts
 var TheseusRuntimeEngine = class {
   constructor(options) {
@@ -2895,6 +3114,8 @@ var TheseusRuntimeEngine = class {
     const active = this.#active.get(command.sessionId);
     if (!active || result.status !== "running") return;
     active.acknowledged = true;
+    active.startGate?.release(true);
+    active.startGate = void 0;
     if (active.failure) await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
   }
   async close() {
@@ -2914,13 +3135,14 @@ var TheseusRuntimeEngine = class {
       control: this.options.control,
       ...this.options.localSource ? { localSource: this.options.localSource } : {}
     });
-    const abort = new AbortController();
+    const abort = new AbortController(), startGate = codeRuntimeAcknowledgementGate(abort.signal);
     const conversationRefs = [];
     const active = {
       workspace,
       abort,
       conversationRefs,
       acknowledged: false,
+      startGate,
       role: metadata.role,
       title: metadata.title,
       maxTokensPerInteraction: metadata.maxTokensPerInteraction,
@@ -2944,7 +3166,7 @@ var TheseusRuntimeEngine = class {
         body: `Source snapshot: local checkout ${requestedLocal.snapshotDigest} \xB7 ${requestedLocal.modified ? "modified" : "clean"} \xB7 Git ${requestedLocal.headCommitSha}`
       }, conversationRefs);
     }
-    active.done = this.#runAttempt(command, metadata, active).catch(async (cause) => {
+    active.done = startGate.ready.then((run) => run ? this.#runAttempt(command, metadata, active) : null).catch(async (cause) => {
       const detail = runtimeErrorMessage(cause);
       await this.#event(command, { type: "message", actor: "system", body: detail }, conversationRefs).catch(() => void 0);
       await this.#diagnostic(command, active, detail);
@@ -3059,7 +3281,7 @@ var TheseusRuntimeEngine = class {
       event: (event) => this.#event(command, event, active.conversationRefs)
     });
     await this.#event(command, { type: "status", status: "running" }, active.conversationRefs);
-    const extraSkills = await sessionSkillsFor(this.options, command);
+    const extraSkills = observeCodeRuntimeSessionSkills(command, await sessionSkillsFor(this.options, command), (event) => this.#event(command, event, active.conversationRefs));
     const result = await this.#attempt({
       inference,
       broker,
@@ -3231,10 +3453,16 @@ async function main() {
     engine,
     recipes: policy.recipes,
     recipeAuthorization: policy.recipeAuthorization,
+    sessionSkills: createCodeRuntimeSessionSkillLoader(control),
     onDiagnostic: (message2) => process.stderr.write(`[odla-code-runtime] agent failed \xB7 ${message2}
 `)
   });
-  const reconciler = new CodeRuntimeReconciler(control, commandEngine);
+  const reconciler = new CodeRuntimeReconciler(
+    control,
+    commandEngine,
+    (message2) => process.stderr.write(`[odla-code-runtime] ${message2}
+`)
+  );
   try {
     await runCodeRuntimeHeartbeatLoop({
       control,