@proagentstore/cli 0.4.104 → 0.4.106

package/dist/browser-runner/coding/headless.js

@@ -1,3 +1,4 @@
+import { InputLedger } from "./input-ledger.js";
 import { runObjectiveBlock } from "./run-objective.js";
 import { spawn } from "node:child_process";
 import { classifyCommand, commandFromToolInput, fillTargetFromResult, toolCallOk, toolResultMark } from "./engine-acts.js";
@@ -22,8 +23,6 @@ export { defaultStatePath } from "./headless-state.js";
  * (refusing new records) would lose the turns that just happened rather than ancient ones.
  */
 const MAX_PENDING_USAGE = 200;
-/** How many consumed-input ids a session reports (#1019). Re-sent on every snapshot, so bounded; the oldest fall off. */
-export const MAX_CONSUMED_INPUTS = 50;
 /**
  * How many un-drained consequential acts a session holds (#294).
  *
@@ -102,8 +101,8 @@ export class HeadlessSession {
     pendingInputs = [];
     /** The id of the input the current one-shot turn was spawned for (#1019). */
     turnInputId = null;
-    /** Ids of inputs a COMPLETED turn consumed, newest last and bounded (#1019). See {@link consumedInputs}. */
-    consumed = [];
+    /** Inputs accepted and consumed, bound to their content and the engine process that read them (#1019). */
+    inputs = new InputLedger();
     /**
      * The engine's own last output line of the turn in flight (#545).
      *
@@ -319,14 +318,11 @@ export class HeadlessSession {
      * credit for something it had not read.
      */
     get consumedInputs() {
-        return this.consumed;
+        return this.inputs.consumedIds;
     }
-    credit(id) {
-        if (!id)
-            return;
-        this.consumed.push(id);
-        if (this.consumed.length > MAX_CONSUMED_INPUTS)
-            this.consumed.shift();
+    /** Inputs this session accepted — handed to the engine, whether or not a turn has finished on them. */
+    get acceptedInputs() {
+        return this.inputs.acceptedIds;
     }
     /** The engine process's pid while one is running — what per-session resource attribution reads (#924). */
     get pid() {
@@ -427,6 +423,7 @@ export class HeadlessSession {
             return;
         // A new process has read none of what the old one was sent, and owns none of its half-read line.
         this.pendingInputs = [];
+        this.inputs.newEngine();
         this.buf = "";
         const args = this.adapter.buildLaunchArgs(this.cmdArgs, this.claudeSessionId);
         const proc = spawn(this.cmdBin, args, {
@@ -518,6 +515,8 @@ export class HeadlessSession {
         this.pendingSeed = null;
         if (!this.alive)
             this.start();
+        if (opts.inputId)
+            this.inputs.accept(opts.inputId, opts.digest ?? ""); // after start(): accepted by the process that will read it
         if (replay)
             this.push("[pags] this engine keeps no memory between turns, so ProAgentStore's record of the conversation so far was delivered with this turn — a reconstruction, not the engine's own memory");
         else if (seed)
@@ -689,7 +688,7 @@ export class HeadlessSession {
             this.turnReport = turnReportFromExit(code, signal, this.turnLastLine, Date.now(), this.turnTail);
             // A turn we killed did not finish reading its input (#1019).
             if (this.turnReport.verdict !== "killed")
-                this.credit(inputId);
+                this.inputs.consume(inputId);
             this.run = "idle";
             this.proc = null;
         });
@@ -864,7 +863,7 @@ export class HeadlessSession {
                     // own `is_error` — the same claim, in the words the engine states it in. Without
                     // this the field would exist for three engines and silently not for the flagship.
                     this.turnReport = turnReportFromResult(ev.isError, failure, Date.now(), this.turnTail);
-                    this.credit(this.pendingInputs.shift() ?? null);
+                    this.inputs.consume(this.pendingInputs.shift() ?? null);
                     // The same event that ends the turn also reports what the turn COST (#267). It was
                     // parsed and thrown away, which is why Engine spend was absent from the ledger.
                     // An errored turn still burned tokens, so this is recorded regardless of is_error.

package/dist/browser-runner/coding/input-ledger.js

@@ -0,0 +1,65 @@
+// What a coding session accepted and consumed, bound to CONTENT and to the engine PROCESS (#1019).
+import { createHash, randomUUID } from "node:crypto";
+/** Bound on each list, as before: enough to reconcile the latest acts, never a growing history. */
+export const MAX_LEDGER_INPUTS = 50;
+/** How many of the newest entries ride every snapshot — a retry reconciles the act it just sent. */
+export const REPORTED_LEDGER_INPUTS = 16;
+const str = (v) => (typeof v === "string" ? v : null);
+/**
+ * sha256 of an act's EXECUTABLE content — text, author and objective — as received, never its delivery
+ * metadata (id, replay). The same id with different content is a conflict, not a retry. Mirrored by the
+ * cloud's `actDigest` (workers/api/src/lib/coding-act-send.ts); the two must agree byte for byte.
+ */
+export function actDigest(a) {
+    const o = a.objective;
+    const objective = o && typeof o === "object" ? [str(o.runId), str(o.text), str(o.origin?.kind), str(o.origin?.by), Array.isArray(o.constraints) ? o.constraints.filter((c) => typeof c === "string") : []] : null;
+    return createHash("sha256").update(JSON.stringify([str(a.text), str(a.author), objective])).digest("hex");
+}
+/**
+ * One session's input record. `ledger` names THIS record: an id absent from it proves only that this
+ * ledger never accepted it — a different runner, or this session re-created after a runner restart, starts
+ * empty and cannot speak for its predecessor. `epoch` names the engine process: a replacement process has
+ * read nothing its predecessor read, so consumption is credited to the process that did the reading.
+ * Ids are never forgotten across a process change, so a retried id is still refused rather than run twice.
+ */
+export class InputLedger {
+    ledger = randomUUID();
+    epoch = 0;
+    accepted = [];
+    consumed = [];
+    /** `duplicate`: this id with this content was already accepted. `conflict`: this id, different content. */
+    check(id, digest) {
+        const hit = this.accepted.find((a) => a.id === id);
+        return !hit ? "new" : hit.digest === digest ? "duplicate" : "conflict";
+    }
+    accept(id, digest) {
+        this.accepted.push({ id, digest, epoch: this.epoch });
+        if (this.accepted.length > MAX_LEDGER_INPUTS)
+            this.accepted.shift();
+    }
+    consume(id) {
+        if (!id)
+            return;
+        this.consumed.push({ id, epoch: this.epoch });
+        if (this.consumed.length > MAX_LEDGER_INPUTS)
+            this.consumed.shift();
+    }
+    /** A new engine process replaced the old one. */
+    newEngine() {
+        this.epoch++;
+    }
+    get acceptedIds() {
+        return this.accepted.map((a) => a.id);
+    }
+    get consumedIds() {
+        return this.consumed.map((c) => c.id);
+    }
+    report() {
+        return {
+            ledger: this.ledger,
+            epoch: this.epoch,
+            accepted: this.accepted.slice(-REPORTED_LEDGER_INPUTS).map((a) => [a.id, a.digest, a.epoch]),
+            consumed: this.consumed.slice(-REPORTED_LEDGER_INPUTS).map((c) => [c.id, c.epoch]),
+        };
+    }
+}

package/dist/browser-runner/coding/run-objective.js

@@ -1,18 +1,51 @@
 // The run's objective, delivered verbatim with a turn and attributed to the platform (#1019).
+const ORIGIN_KINDS = new Set(["account", "supervisor", "trigger", "unverified"]);
+/** Bounds on the constraint lines a run objective may carry: they are labels, never an essay. */
+const MAX_CONSTRAINTS = 20;
+const MAX_CONSTRAINT_CHARS = 500;
 /** A run objective as the cloud sent it, or undefined — narrowed, because any caller can POST here (#1019). */
 export function runObjective(raw) {
     const o = raw;
-    return o && typeof o.runId === "string" && o.runId.length <= 128 && typeof o.text === "string" && o.text.trim() ? { runId: o.runId, text: o.text } : undefined;
+    if (!(o && typeof o.runId === "string" && o.runId.length <= 128 && typeof o.text === "string" && o.text.trim()))
+        return undefined;
+    const origin = o.origin;
+    const kind = typeof origin?.kind === "string" && ORIGIN_KINDS.has(origin.kind) ? origin.kind : "unverified";
+    // A label longer than a label is not shortened into a different claim — it is dropped.
+    const label = typeof origin?.by === "string" ? origin.by.replace(/\s+/g, " ").trim() : "";
+    const by = label.length <= 128 ? label : "";
+    // Over-long or excess lines are dropped, never shortened: a truncated constraint is a different one.
+    const lines = Array.isArray(o.constraints) ? o.constraints.filter((c) => typeof c === "string" && !!c.trim() && c.length <= MAX_CONSTRAINT_CHARS).slice(0, MAX_CONSTRAINTS) : [];
+    return { runId: o.runId, text: o.text, origin: by ? { kind, by } : { kind }, ...(lines.length ? { constraints: lines } : {}) };
+}
+/** The attribution sentence: only what the platform verified about the author, never more. */
+function attribution(runId, origin) {
+    const by = origin.by ? ` (${origin.by})` : "";
+    switch (origin.kind) {
+        case "account":
+            return `the objective submitted for run ${runId} through the owner's authenticated account${by}, exactly as ProAgentStore accepted it. Who composed the text is not verified.`;
+        case "supervisor":
+            return `the objective a supervising agent${by} delegated for run ${runId}, exactly as ProAgentStore accepted it. A supervisor's goal is not an instruction from the owner.`;
+        case "trigger":
+            return `the objective a trigger${by} composed for run ${runId}, exactly as ProAgentStore accepted it — standing wiring plus facts about another run, not a message from the owner.`;
+        default:
+            return `the objective ProAgentStore accepted for run ${runId}. Who wrote it is not verified.`;
+    }
 }
 /**
- * The run's objective as the engine reads it (#1019): verbatim, fenced, and attributed to the platform —
- * the Pilot's instruction that follows is its own turn, and owner directives sent later outrank both.
+ * The run's objective as the engine reads it (#1019): verbatim, fenced, attributed only as far as the
+ * platform verified — the Pilot's instruction that follows is its own turn. The owner's standing rules and
+ * directives, earlier or later, outrank both, and the constraints in force when this turn was sent are
+ * spelled out beneath the fence so the precedence is not only a sentence.
  */
 export function runObjectiveBlock(o) {
+    const constraints = o.constraints?.length
+        ? ["[pags] CONSTRAINTS IN FORCE NOW — from the owner's rules and directives of this run, however old. Where the objective above conflicts with one, the constraint wins:", ...o.constraints]
+        : [];
     return [
-        `[pags] RUN OBJECTIVE — the owner's objective for run ${o.runId}, exactly as ProAgentStore accepted it. It was not written by the Pilot. Owner instructions sent later in this run take precedence over it.`,
+        `[pags] RUN OBJECTIVE — ${attribution(o.runId, o.origin ?? { kind: "unverified" })} It is not the Pilot's instruction, which follows as its own turn. The owner's standing rules and directives — earlier in this run or later — take precedence over it.`,
         "<<<OBJECTIVE",
         o.text,
         "OBJECTIVE>>>",
+        ...constraints,
     ].join("\n");
 }

package/dist/browser-runner/coding/runtime.js

@@ -1,3 +1,4 @@
+import { actDigest } from "./input-ledger.js";
 import { runObjective } from "./run-objective.js";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
@@ -67,8 +68,13 @@ export class CodingRuntime {
         // cloud still never trusts it, because an older runner simply 404s and the policy reports
         // that it asked and was not answered.
         // `coding.run-objective` (#1019): a message may carry the run's objective, delivered verbatim and
-        // attributed to the platform. Advertised so the cloud never claims delivery to a runner without it.
-        return ["coding.sessions", "coding.stream", "human.takeover", "coding.inspect", "coding.repo-write", "coding.run-objective"];
+        // attributed to the platform. `.v2`: attributed by its VERIFIED origin (run-objective.ts) — a cloud
+        // sends the objective only to a v2 runner, so an older one is never made to call it the owner's.
+        // `coding.input-idempotent`: a message whose inputId this session already accepted is not run again,
+        // and every snapshot lists the accepted ids, so a retry after a lost reply can be reconciled.
+        // `.v3` renders the owner's constraints in force with the objective; `coding.engine-identity`: every snapshot
+        // names its input ledger and engine process, and an id is deduplicated together with its content (input-ledger.ts).
+        return ["coding.sessions", "coding.stream", "human.takeover", "coding.inspect", "coding.repo-write", "coding.run-objective", "coding.run-objective.v2", "coding.run-objective.v3", "coding.input-idempotent", "coding.engine-identity"];
     }
     /**
      * Resolve the workDir for a read-only inspection. Prefer the tracked session's real
@@ -244,6 +250,8 @@ export class CodingRuntime {
             // the omitted-when-null shape keeps "not measured" distinguishable from a verdict.
             ...(session.lastTurn ? { lastTurn: session.lastTurn } : {}),
             ...(session.consumedInputs.length ? { consumedInputs: [...session.consumedInputs] } : {}),
+            acceptedInputs: [...session.acceptedInputs],
+            engine: session.inputs.report(),
             ...(opts.drainUsage ? { usage: session.takeUsage(), acts: session.takeActs() } : {}),
         };
     }
@@ -251,16 +259,25 @@ export class CodingRuntime {
     act(sessionId, action) {
         const session = this.require(sessionId);
         switch (action.kind) {
-            case "message":
+            case "message": {
+                const inputId = typeof action.inputId === "string" && action.inputId.length <= 128 ? action.inputId : undefined;
+                // The same input twice is a retry after a lost reply, not a second instruction (#1019) — but only with
+                // the same content: a changed payload under an accepted id is refused, never credited as the first.
+                const digest = actDigest(action);
+                const seen = inputId ? session.inputs.check(inputId, digest) : "new";
+                if (seen !== "new")
+                    return { ...this.snapshot(sessionId), ...(seen === "duplicate" ? { duplicateInput: inputId } : { inputConflict: inputId }) };
                 // Narrowed rather than trusted: this runner is a published package any caller can
                 // POST to, and an unrecognised author must read as "unstated", not become a label.
                 session.input(action.text, {
                     author: asTurnAuthor(action.author),
                     replay: typeof action.replay === "string" ? action.replay : undefined,
-                    inputId: typeof action.inputId === "string" && action.inputId.length <= 128 ? action.inputId : undefined,
+                    inputId,
+                    digest,
                     objective: runObjective(action.objective),
                 });
                 break;
+            }
             case "keys": {
                 // A snapshot is no longer the whole answer (#448). `key()` records the attempt and
                 // reports that it was not delivered; answering 200 with a pane that simply did not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.104",
+  "version": "0.4.106",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",