@openrig/cli 0.6.12 → 0.6.13

package/daemon/dist/domain/seat-lifecycle-service.js

@@ -1,4 +1,5 @@
 import { shellQuote } from "../adapters/shell-quote.js";
+import { EFFORT_SHAPE, piThinkingValue } from "../adapters/pi-runner-protocol.js";
 import { deriveCanonicalFromEntry, getNodeInventory } from "./node-inventory.js";
 import { deriveSessionName, parseSessionName } from "./session-name.js";
 import { resolveStartupProof } from "./startup-resolver.js";
@@ -8,13 +9,18 @@ import { observeSolePane } from "./pane-binding-observation.js";
 import { createHash } from "node:crypto";
 import { NativePermissionStore } from "./native-permission-store.js";
 import { validateNativePermissionSelection, unresolvedClaudePermissionModes } from "./native-permission-selection.js";
+import fs from "node:fs";
+import path from "node:path";
+import { resolveConcreteHint } from "./runtime-adapter.js";
+import { ProjectionManifestStore } from "./projection-manifest-store.js";
+import { planCwdPreparation } from "./seat-cwd-preparation.js";
 import { resolvePermissionPolicyAttachment, validatePermissionPolicyRef } from "./permission-policy/policy-ref.js";
 import { effortPrecedence, emittedEffortFromArgv, readNativeEffort, resolveSeatEffort, unknownLevelWarning, } from "./seat-effort.js";
 import { claudeCommandSessionToken, codexCommandResumeToken, observeClaudePaneRuntime, observeCodexPaneProcess, processArgv, } from "./native-process-lineage.js";
 import { defaultInPlaceRestartIo } from "./seat-restart-in-place.js";
 import nodePath from "node:path";
 import { CodexInPlaceRestart, } from "./seat-restart-in-place.js";
-import { seatAdapter } from "../adapters/community-harness-runtime-adapter.js";
+import { CommunityHarnessRuntimeAdapter, seatAdapter } from "../adapters/community-harness-runtime-adapter.js";
 import { sessionCommunityHarnessSelect } from "./session-registry.js";
 /**
  * S5 (OPR.0.5.4.7) — the seat-lifecycle verb surface: set-model, single-seat stop,
@@ -49,6 +55,7 @@ export class SeatLifecycleService {
     inPlaceRestartTiming;
     inPlaceRestartDaemonStartedAt;
     transcripts;
+    piRecords;
     constructor(deps) {
         if (deps.db !== deps.rigRepo.db)
             throw new Error("SeatLifecycleService: rigRepo must share the same db handle");
@@ -71,6 +78,7 @@ export class SeatLifecycleService {
         this.inPlaceRestartTiming = deps.inPlaceRestartTiming;
         this.inPlaceRestartDaemonStartedAt = deps.inPlaceRestartDaemonStartedAt;
         this.transcripts = deps.transcripts ?? null;
+        this.piRecords = deps.piRecords ?? null;
     }
     async setModel(input) {
         const required = this.requireReason(input.reason);
@@ -108,6 +116,127 @@ export class SeatLifecycleService {
             this.eventBus.notifySubscribers(persisted);
         return { ok: true, seat, from, to: model, changed: true };
     }
+    /**
+     * Save an existing seat's launch directory for its next fresh launch or rebuild handover, keeping its identity,
+     * address, queue and history. Like set-model it validates, then persists the cwd and an audited event in one
+     * transaction. Before that, set-cwd's read-only preflight policy refuses the change when the new directory holds an
+     * operator-edited, unrecorded-and-different or doubly sourced copy that launch would place there. It creates the
+     * folder and writes no startup files: launch does that, as it does today. The running occupant keeps its directory
+     * until it's relaunched.
+     */
+    async setCwd(input) {
+        const required = this.requireReason(input.reason);
+        if (required)
+            return required;
+        if (!input.cwd?.trim())
+            return { ok: false, code: "missing_cwd", message: "An absolute working directory is required (--cwd)." };
+        if (!path.isAbsolute(input.cwd) || input.cwd.includes("\0")) {
+            return { ok: false, code: "invalid_cwd", message: "The working directory must be an absolute path on the daemon's host." };
+        }
+        let to = path.resolve(input.cwd);
+        if (to === path.parse(to).root) {
+            return { ok: false, code: "invalid_cwd", message: "Choose a project directory, not a filesystem root, for managed startup files." };
+        }
+        const resolved = this.resolveSeat(input.seatRef);
+        if ("code" in resolved)
+            return resolved;
+        const seat = this.describe(resolved);
+        const node = this.rigRepo.getRig(seat.rigId)?.nodes.find(candidate => candidate.id === seat.nodeId);
+        if (!node)
+            return { ok: false, code: "seat_not_found", message: "The seat no longer exists.", guidance: SEAT_LOOKUP_GUIDANCE };
+        const from = node.cwd;
+        try {
+            fs.mkdirSync(to, { recursive: true });
+            to = fs.realpathSync(to);
+            if (to === path.parse(to).root || !fs.statSync(to).isDirectory())
+                throw new Error("Destination must be a project directory.");
+        }
+        catch (error) {
+            return { ok: false, code: "invalid_cwd", message: `Cannot use the requested working directory: ${error.message}` };
+        }
+        const startup = this.readStartupContext(node.id, to);
+        if (!startup.ok)
+            return startup.refusal;
+        if (!node.runtime || startup.context.runtime !== node.runtime) {
+            return { ok: false, code: "startup_context_runtime_mismatch", message: "The saved startup context belongs to a different runtime." };
+        }
+        // Resolved as launch resolves it, so a recorded community harness finds its adapter too.
+        const adapter = seatAdapter(this.runtimeAdapters, node.runtime, this.latestSession(node.id)?.community_harness);
+        if (!adapter)
+            return { ok: false, code: "runtime_adapter_missing", message: "The configured runtime adapter is unavailable." };
+        const warnings = [];
+        // The filesystem startup files the next fresh launch would deliver (never send_text or actions), with legacy auto
+        // hints resolved, for the read-only destination check.
+        const files = [];
+        // A community harness takes no startup files at launch (its adapter delivers none), so there's nothing to check.
+        const takesStartupFiles = !(adapter instanceof CommunityHarnessRuntimeAdapter);
+        for (const file of takesStartupFiles ? startup.context.resolvedStartupFiles : []) {
+            if (!file.appliesOn.includes("fresh_start") || file.deliveryHint === "send_text")
+                continue;
+            try {
+                const hint = file.deliveryHint === "auto"
+                    ? resolveConcreteHint(file.path, fs.readFileSync(file.absolutePath, "utf8")) : file.deliveryHint;
+                if (hint !== "send_text")
+                    files.push({ ...file, deliveryHint: hint });
+            }
+            catch (error) {
+                const detail = `Startup file ${file.path}: ${error.message}`;
+                if (file.required)
+                    return { ok: false, code: "cwd_check_failed", message: detail, warnings };
+                warnings.push(detail);
+            }
+        }
+        const oldBinding = this.sessionRegistry.getBindingForNode(node.id);
+        const binding = {
+            id: oldBinding?.id ?? `cwd:${node.id}`, nodeId: node.id,
+            attachmentType: oldBinding?.attachmentType ?? "tmux",
+            tmuxSession: oldBinding?.tmuxSession ?? deriveCanonicalFromEntry(resolved.entry),
+            tmuxWindow: null, tmuxPane: null, cmuxWorkspace: null, cmuxSurface: null,
+            updatedAt: oldBinding?.updatedAt ?? new Date().toISOString(), cwd: to,
+        };
+        const inspect = `Inspect the configured directory with: rig seat status ${input.seatRef}`;
+        try {
+            const check = planCwdPreparation({ ...startup.context.plan, cwd: to }, files, binding, adapter, new ProjectionManifestStore(this.db));
+            warnings.push(...check.warnings);
+            if (check.conflicts.length) {
+                warnings.push(...check.conflicts.map(copy => `Protected destination file: ${copy.targetPath}`));
+                return { ok: false, code: "cwd_destination_conflict", warnings,
+                    message: "The new directory holds files set-cwd's preflight policy protects; no startup file was written and the cwd was not changed.",
+                    guidance: "Use a clean destination, or inspect and move or merge the reported files before retrying." };
+            }
+        }
+        catch (error) {
+            return { ok: false, code: "cwd_check_failed", message: `The new directory couldn't be checked; the cwd was not changed: ${error.message}`, warnings };
+        }
+        let persisted = null;
+        const changed = from !== to;
+        try {
+            const refusal = this.db.transaction(() => {
+                // Another writer (an import, another connection) must not be silently overwritten.
+                const current = this.resolveSeat(input.seatRef);
+                const currentStartup = this.readStartupContext(node.id, to);
+                if ("code" in current || current.nodeId !== node.id || current.entry.cwd !== from
+                    || current.entry.runtime !== node.runtime || !currentStartup.ok || currentStartup.context.hash !== startup.context.hash) {
+                    return { ok: false, code: "cwd_configuration_changed", message: "The seat's configuration changed while its new directory was checked; the cwd was not changed.", guidance: inspect };
+                }
+                if (changed) {
+                    if (!this.rigRepo.setNodeCwd(node.id, to, from))
+                        throw new Error("The seat's saved working directory changed.");
+                    persisted = this.eventBus.persistWithinTransaction({ type: "node.cwd_changed", rigId: seat.rigId,
+                        nodeId: node.id, logicalId: seat.logicalId, from, to, reason: input.reason.trim(), operator: input.operator ?? null });
+                }
+                return null;
+            })();
+            if (refusal)
+                return { ...refusal, warnings };
+        }
+        catch (error) {
+            return { ok: false, code: "cwd_persistence_failed", message: `The working directory was not changed: ${error.message}`, guidance: inspect, warnings };
+        }
+        if (persisted)
+            this.eventBus.notifySubscribers(persisted);
+        return { ok: true, seat, from, to, changed, effect: "next_launch", warnings };
+    }
     /** OPR.0.7.0.7 — save one seat's effort for its next managed continuation. Like set-model it
      *  validates, writes, and persists an audited event in the same transaction; it never restarts
      *  the seat or touches its peers, model or account. `effort: null` clears the explicit choice. */
@@ -120,7 +249,7 @@ export class SeatLifecycleService {
             if (!requested)
                 return { ok: false, code: "missing_effort", message: "An effort level is required (--effort <level>), or pass --clear." };
             // Levels are the runtime's own (they differ by model and client), so only the shape is checked here.
-            if (!/^[A-Za-z][A-Za-z0-9_-]{0,31}$/.test(requested)) {
+            if (!EFFORT_SHAPE.test(requested)) {
                 return { ok: false, code: "invalid_effort", message: `"${requested}" isn't an effort level: use the runtime's level name, such as low, medium or high.` };
             }
         }
@@ -129,8 +258,8 @@ export class SeatLifecycleService {
             return resolved;
         const seat = this.describe(resolved);
         const runtime = resolved.entry.runtime ?? "unknown";
-        if (runtime !== "claude-code" && runtime !== "codex") {
-            return { ok: false, code: "effort_unsupported_runtime", message: `Seat "${input.seatRef}" runs ${runtime}; reasoning effort applies to claude-code and codex seats only.` };
+        if (runtime !== "claude-code" && runtime !== "codex" && runtime !== "pi") {
+            return { ok: false, code: "effort_unsupported_runtime", message: `Seat "${input.seatRef}" runs ${runtime}; reasoning effort applies to claude-code, codex and pi seats only.` };
         }
         const from = this.readEffort(seat.nodeId);
         if (!from) {
@@ -180,8 +309,8 @@ export class SeatLifecycleService {
             return resolved;
         const seat = this.describe(resolved);
         const runtime = resolved.entry.runtime ?? "unknown";
-        if (runtime !== "claude-code" && runtime !== "codex") {
-            return { ok: false, code: "effort_unsupported_runtime", message: `Seat "${seatRef}" runs ${runtime}; reasoning effort applies to claude-code and codex seats only.` };
+        if (runtime !== "claude-code" && runtime !== "codex" && runtime !== "pi") {
+            return { ok: false, code: "effort_unsupported_runtime", message: `Seat "${seatRef}" runs ${runtime}; reasoning effort applies to claude-code, codex and pi seats only.` };
         }
         const saved = this.readEffort(seat.nodeId);
         if (!saved) {
@@ -198,6 +327,9 @@ export class SeatLifecycleService {
             emitted = { state: "unknown", detail: "The seat has no running session, so no launch to read." };
             observed = { state: "not_verified", detail: "The seat has no running session." };
         }
+        else if (runtime === "pi") {
+            ({ emitted, observed } = await this.piEffort(seat.nodeId, session.session_name, saved));
+        }
         else {
             const observe = runtime === "claude-code" ? observeClaudePaneRuntime : observeCodexPaneProcess;
             const process = (await observe({ target, tmux: this.tmuxAdapter, ...(this.listProcesses ? { listProcesses: this.listProcesses } : {}) }))?.process;
@@ -216,7 +348,60 @@ export class SeatLifecycleService {
                 observed = native.state === "observed" ? { ...native, matchesEmitted: native.value === value } : native;
             }
         }
-        return { ok: true, seat, runtime, requested, saved, emitted, observed, precedence, summary: effortSummary(saved, emitted, observed) };
+        return { ok: true, seat, runtime, requested, saved, emitted, observed, precedence, summary: effortSummary(saved, emitted, observed, runtime) };
+    }
+    /** A Pi seat's launch flag and native level, both from the identity-verified current runner: its
+     *  own command line, and the newest assistant record of this launch in its own session file. */
+    async piEffort(nodeId, sessionName, saved) {
+        if (!this.piRecords) {
+            return {
+                emitted: { state: "unknown", detail: "The seat's Pi runner can't be read here." },
+                observed: { state: "not_verified", detail: "The seat's Pi runner can't be read here, so no turn can be tied to its launch." },
+            };
+        }
+        let selection;
+        try {
+            selection = await this.piRecords.currentPiRecord(nodeId, sessionName);
+        }
+        catch {
+            selection = { ok: false, reason: "the pane's processes could not be read" };
+        }
+        if (!selection.ok) {
+            return {
+                emitted: { state: "unknown", detail: `No verified Pi runner for this seat: ${selection.reason}.` },
+                observed: { state: "not_verified", detail: `No verified Pi runner for this seat, so no turn can be tied to its launch: ${selection.reason}.` },
+            };
+        }
+        const tokens = processArgv(selection.command);
+        const flag = emittedEffortFromArgv("pi", tokens);
+        const value = flag.flag === "present" ? flag.value : null;
+        // ps joins argv with spaces: a bare word after the value may be the rest of a value with whitespace.
+        // Scanned as emittedEffortFromArgv does, so a value is never taken for the flag.
+        let after;
+        for (let index = 1; index < tokens.length; index += 1) {
+            if (tokens[index] === "--thinking") {
+                after = tokens[index + 2];
+                index += 1;
+            }
+            else if (tokens[index].startsWith("--thinking="))
+                after = tokens[index + 1];
+        }
+        const emitted = value !== null && after !== undefined && !after.startsWith("--")
+            ? { state: "unknown", detail: "The launch command's --thinking value can't be read unambiguously (it contains whitespace)." }
+            // Compared with what the launch guard sends for the saved value, not the saved value itself.
+            : { state: "observed", value, pid: selection.pid, startedAt: selection.startedAt, matchesSaved: value === (piThinkingValue(saved.effective) ?? null) };
+        const read = selection.observation;
+        if (!read.ok)
+            return { emitted, observed: { state: "not_verified", detail: `No Pi turn from this launch can be read: ${read.reason}.` } };
+        if (!read.thinkingLevel) {
+            return { emitted, observed: { state: "not_verified", detail: "This Pi doesn't record the thinking level on its turns (Pi 0.99.0 and later do), so the level it ran at can't be shown." } };
+        }
+        // No flag sent: Pi's level comes from the model suffix or its default, so there is nothing to mismatch.
+        return { emitted, observed: {
+                state: "observed", value: read.thinkingLevel, at: read.observedAt ?? "unknown time", source: "Pi session (latest successful assistant turn; error and aborted turns are skipped)", outcome: "recorded",
+                detail: "Pi recorded this level with the turn's request: the session's level after Pi's own cap, not proof the provider applied it.",
+                ...(emitted.state === "observed" && value !== null ? { matchesEmitted: read.thinkingLevel === value } : {}),
+            } };
     }
     lastRequestedEffort(nodeId) {
         const row = this.db.prepare("SELECT payload, created_at FROM events WHERE node_id = ? AND type = 'node.effort_changed' ORDER BY seq DESC LIMIT 1")
@@ -1516,22 +1701,28 @@ function isStringArrayOf(value, allowed) {
     return Array.isArray(value) && value.every((entry) => isOneOf(entry, allowed));
 }
 /** One line naming where the four values agree, and where they can't be seen. */
-function effortSummary(saved, emitted, observed) {
+function effortSummary(saved, emitted, observed, runtime) {
     const savedText = saved.effective ? `${saved.effective} (${saved.source === "seat_choice" ? "seat choice" : "authored"})` : "no flag (the runtime's own default)";
-    if (emitted.state !== "observed")
-        return `Saved: ${savedText}. Launch: unknown (${emitted.detail}) Native effort: NOT VERIFIED.`;
+    if (emitted.state !== "observed") {
+        // Only a Pi launch value that can't be read back unambiguously leaves the native turn readable.
+        const native = observed.state === "observed" ? `${observed.value} (${observed.source}, ${observed.at})` : "NOT VERIFIED";
+        return `Saved: ${savedText}. Launch: unknown (${emitted.detail}) Native effort: ${native}.`;
+    }
     const launch = emitted.value ?? "no flag";
-    const launchNote = emitted.matchesSaved ? "" : " This differs from the saved value: it applies at the seat's next managed continuation.";
+    // A Pi saved value the launch guard leaves out never applies, so it isn't reported as pending.
+    const launchNote = runtime === "pi" && saved.effective && !piThinkingValue(saved.effective) ? " The saved value isn't sent: it doesn't pass the check set-effort uses (a letter, then up to 31 letters, digits, - or _)."
+        : emitted.matchesSaved ? "" : " This differs from the saved value: it applies at the seat's next managed continuation.";
     if (observed.state !== "observed")
         return `Saved: ${savedText}. Launch sent: ${launch}.${launchNote} Native effort: NOT VERIFIED (${observed.detail})`;
-    const sent = observed.matchesEmitted === false
-        ? `${observed.value}, not the ${launch} the launch sent (changed or overridden inside the session)`
-        : observed.value;
+    const sent = observed.matchesEmitted !== false ? observed.value
+        : runtime === "pi" ? `${observed.value}, not the ${launch} sent at launch (Pi caps a level the model doesn't offer, ignores one it doesn't know, and the level can change inside the session)`
+            : `${observed.value}, not the ${launch} the launch sent (changed or overridden inside the session)`;
     const verdict = observed.outcome === "accepted" ? "accepted by the service for that turn"
         : observed.outcome === "rejected" ? `REJECTED (${observed.detail})`
             : observed.outcome === "failed" || observed.outcome === "interrupted" ? (observed.detail ?? "not judged").replace(/\.$/, "")
                 : observed.outcome === "pending" ? "its turn hasn't finished, so not yet known whether it was taken"
-                    : "applied level NOT VERIFIED (whether this is after any model fallback isn't shown)";
+                    : runtime === "pi" ? "applied level NOT VERIFIED (Pi records the level it requested, not what the provider ran)"
+                        : "applied level NOT VERIFIED (whether this is after any model fallback isn't shown)";
     return `Saved: ${savedText}. Launch sent: ${launch}.${launchNote} The session sent ${sent} with its latest turn (${observed.source}, ${observed.at}): ${verdict}.`;
 }
 //# sourceMappingURL=seat-lifecycle-service.js.map