@proagentstore/cli 0.4.105 → 0.4.106

package/dist/browser-runner/coding/headless.js

@@ -1,3 +1,4 @@
+import { InputLedger } from "./input-ledger.js";
 import { runObjectiveBlock } from "./run-objective.js";
 import { spawn } from "node:child_process";
 import { classifyCommand, commandFromToolInput, fillTargetFromResult, toolCallOk, toolResultMark } from "./engine-acts.js";
@@ -22,8 +23,6 @@ export { defaultStatePath } from "./headless-state.js";
  * (refusing new records) would lose the turns that just happened rather than ancient ones.
  */
 const MAX_PENDING_USAGE = 200;
-/** How many consumed-input ids a session reports (#1019). Re-sent on every snapshot, so bounded; the oldest fall off. */
-export const MAX_CONSUMED_INPUTS = 50;
 /**
  * How many un-drained consequential acts a session holds (#294).
  *
@@ -102,10 +101,8 @@ export class HeadlessSession {
     pendingInputs = [];
     /** The id of the input the current one-shot turn was spawned for (#1019). */
     turnInputId = null;
-    /** Ids of inputs a COMPLETED turn consumed, newest last and bounded (#1019). See {@link consumedInputs}. */
-    consumed = [];
-    /** Ids of inputs handed to the engine, newest last and bounded (#1019): what a retry is reconciled against. */
-    accepted = [];
+    /** Inputs accepted and consumed, bound to their content and the engine process that read them (#1019). */
+    inputs = new InputLedger();
     /**
      * The engine's own last output line of the turn in flight (#545).
      *
@@ -321,18 +318,11 @@ export class HeadlessSession {
      * credit for something it had not read.
      */
     get consumedInputs() {
-        return this.consumed;
+        return this.inputs.consumedIds;
     }
     /** Inputs this session accepted — handed to the engine, whether or not a turn has finished on them. */
     get acceptedInputs() {
-        return this.accepted;
-    }
-    credit(id) {
-        if (!id)
-            return;
-        this.consumed.push(id);
-        if (this.consumed.length > MAX_CONSUMED_INPUTS)
-            this.consumed.shift();
+        return this.inputs.acceptedIds;
     }
     /** The engine process's pid while one is running — what per-session resource attribution reads (#924). */
     get pid() {
@@ -433,6 +423,7 @@ export class HeadlessSession {
             return;
         // A new process has read none of what the old one was sent, and owns none of its half-read line.
         this.pendingInputs = [];
+        this.inputs.newEngine();
         this.buf = "";
         const args = this.adapter.buildLaunchArgs(this.cmdArgs, this.claudeSessionId);
         const proc = spawn(this.cmdBin, args, {
@@ -512,11 +503,6 @@ export class HeadlessSession {
      * session-start brief, being the same record composed later.
      */
     input(text, opts = {}) {
-        if (opts.inputId) {
-            this.accepted.push(opts.inputId);
-            if (this.accepted.length > MAX_CONSUMED_INPUTS)
-                this.accepted.shift();
-        }
         // The Engine reads the preamble, the pane the short marker; the instruction stays evidence.
         const sent = authoredTurn(text, opts.author);
         // The brief leads the turn and is spent in the reading (#693). It goes to the ENGINE only:
@@ -529,6 +515,8 @@ export class HeadlessSession {
         this.pendingSeed = null;
         if (!this.alive)
             this.start();
+        if (opts.inputId)
+            this.inputs.accept(opts.inputId, opts.digest ?? ""); // after start(): accepted by the process that will read it
         if (replay)
             this.push("[pags] this engine keeps no memory between turns, so ProAgentStore's record of the conversation so far was delivered with this turn — a reconstruction, not the engine's own memory");
         else if (seed)
@@ -700,7 +688,7 @@ export class HeadlessSession {
             this.turnReport = turnReportFromExit(code, signal, this.turnLastLine, Date.now(), this.turnTail);
             // A turn we killed did not finish reading its input (#1019).
             if (this.turnReport.verdict !== "killed")
-                this.credit(inputId);
+                this.inputs.consume(inputId);
             this.run = "idle";
             this.proc = null;
         });
@@ -875,7 +863,7 @@ export class HeadlessSession {
                     // own `is_error` — the same claim, in the words the engine states it in. Without
                     // this the field would exist for three engines and silently not for the flagship.
                     this.turnReport = turnReportFromResult(ev.isError, failure, Date.now(), this.turnTail);
-                    this.credit(this.pendingInputs.shift() ?? null);
+                    this.inputs.consume(this.pendingInputs.shift() ?? null);
                     // The same event that ends the turn also reports what the turn COST (#267). It was
                     // parsed and thrown away, which is why Engine spend was absent from the ledger.
                     // An errored turn still burned tokens, so this is recorded regardless of is_error.

package/dist/browser-runner/coding/input-ledger.js

@@ -0,0 +1,65 @@
+// What a coding session accepted and consumed, bound to CONTENT and to the engine PROCESS (#1019).
+import { createHash, randomUUID } from "node:crypto";
+/** Bound on each list, as before: enough to reconcile the latest acts, never a growing history. */
+export const MAX_LEDGER_INPUTS = 50;
+/** How many of the newest entries ride every snapshot — a retry reconciles the act it just sent. */
+export const REPORTED_LEDGER_INPUTS = 16;
+const str = (v) => (typeof v === "string" ? v : null);
+/**
+ * sha256 of an act's EXECUTABLE content — text, author and objective — as received, never its delivery
+ * metadata (id, replay). The same id with different content is a conflict, not a retry. Mirrored by the
+ * cloud's `actDigest` (workers/api/src/lib/coding-act-send.ts); the two must agree byte for byte.
+ */
+export function actDigest(a) {
+    const o = a.objective;
+    const objective = o && typeof o === "object" ? [str(o.runId), str(o.text), str(o.origin?.kind), str(o.origin?.by), Array.isArray(o.constraints) ? o.constraints.filter((c) => typeof c === "string") : []] : null;
+    return createHash("sha256").update(JSON.stringify([str(a.text), str(a.author), objective])).digest("hex");
+}
+/**
+ * One session's input record. `ledger` names THIS record: an id absent from it proves only that this
+ * ledger never accepted it — a different runner, or this session re-created after a runner restart, starts
+ * empty and cannot speak for its predecessor. `epoch` names the engine process: a replacement process has
+ * read nothing its predecessor read, so consumption is credited to the process that did the reading.
+ * Ids are never forgotten across a process change, so a retried id is still refused rather than run twice.
+ */
+export class InputLedger {
+    ledger = randomUUID();
+    epoch = 0;
+    accepted = [];
+    consumed = [];
+    /** `duplicate`: this id with this content was already accepted. `conflict`: this id, different content. */
+    check(id, digest) {
+        const hit = this.accepted.find((a) => a.id === id);
+        return !hit ? "new" : hit.digest === digest ? "duplicate" : "conflict";
+    }
+    accept(id, digest) {
+        this.accepted.push({ id, digest, epoch: this.epoch });
+        if (this.accepted.length > MAX_LEDGER_INPUTS)
+            this.accepted.shift();
+    }
+    consume(id) {
+        if (!id)
+            return;
+        this.consumed.push({ id, epoch: this.epoch });
+        if (this.consumed.length > MAX_LEDGER_INPUTS)
+            this.consumed.shift();
+    }
+    /** A new engine process replaced the old one. */
+    newEngine() {
+        this.epoch++;
+    }
+    get acceptedIds() {
+        return this.accepted.map((a) => a.id);
+    }
+    get consumedIds() {
+        return this.consumed.map((c) => c.id);
+    }
+    report() {
+        return {
+            ledger: this.ledger,
+            epoch: this.epoch,
+            accepted: this.accepted.slice(-REPORTED_LEDGER_INPUTS).map((a) => [a.id, a.digest, a.epoch]),
+            consumed: this.consumed.slice(-REPORTED_LEDGER_INPUTS).map((c) => [c.id, c.epoch]),
+        };
+    }
+}

package/dist/browser-runner/coding/run-objective.js

@@ -1,5 +1,8 @@
 // The run's objective, delivered verbatim with a turn and attributed to the platform (#1019).
 const ORIGIN_KINDS = new Set(["account", "supervisor", "trigger", "unverified"]);
+/** Bounds on the constraint lines a run objective may carry: they are labels, never an essay. */
+const MAX_CONSTRAINTS = 20;
+const MAX_CONSTRAINT_CHARS = 500;
 /** A run objective as the cloud sent it, or undefined — narrowed, because any caller can POST here (#1019). */
 export function runObjective(raw) {
     const o = raw;
@@ -10,7 +13,9 @@ export function runObjective(raw) {
     // A label longer than a label is not shortened into a different claim — it is dropped.
     const label = typeof origin?.by === "string" ? origin.by.replace(/\s+/g, " ").trim() : "";
     const by = label.length <= 128 ? label : "";
-    return { runId: o.runId, text: o.text, origin: by ? { kind, by } : { kind } };
+    // Over-long or excess lines are dropped, never shortened: a truncated constraint is a different one.
+    const lines = Array.isArray(o.constraints) ? o.constraints.filter((c) => typeof c === "string" && !!c.trim() && c.length <= MAX_CONSTRAINT_CHARS).slice(0, MAX_CONSTRAINTS) : [];
+    return { runId: o.runId, text: o.text, origin: by ? { kind, by } : { kind }, ...(lines.length ? { constraints: lines } : {}) };
 }
 /** The attribution sentence: only what the platform verified about the author, never more. */
 function attribution(runId, origin) {
@@ -28,14 +33,19 @@ function attribution(runId, origin) {
 }
 /**
  * The run's objective as the engine reads it (#1019): verbatim, fenced, attributed only as far as the
- * platform verified — the Pilot's instruction that follows is its own turn, and owner directives sent
- * later outrank both.
+ * platform verified — the Pilot's instruction that follows is its own turn. The owner's standing rules and
+ * directives, earlier or later, outrank both, and the constraints in force when this turn was sent are
+ * spelled out beneath the fence so the precedence is not only a sentence.
  */
 export function runObjectiveBlock(o) {
+    const constraints = o.constraints?.length
+        ? ["[pags] CONSTRAINTS IN FORCE NOW — from the owner's rules and directives of this run, however old. Where the objective above conflicts with one, the constraint wins:", ...o.constraints]
+        : [];
     return [
-        `[pags] RUN OBJECTIVE — ${attribution(o.runId, o.origin ?? { kind: "unverified" })} It is not the Pilot's instruction, which follows as its own turn. Instructions the owner sends later in this run take precedence over it.`,
+        `[pags] RUN OBJECTIVE — ${attribution(o.runId, o.origin ?? { kind: "unverified" })} It is not the Pilot's instruction, which follows as its own turn. The owner's standing rules and directives — earlier in this run or later — take precedence over it.`,
         "<<<OBJECTIVE",
         o.text,
         "OBJECTIVE>>>",
+        ...constraints,
     ].join("\n");
 }

package/dist/browser-runner/coding/runtime.js

@@ -1,3 +1,4 @@
+import { actDigest } from "./input-ledger.js";
 import { runObjective } from "./run-objective.js";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
@@ -71,7 +72,9 @@ export class CodingRuntime {
         // sends the objective only to a v2 runner, so an older one is never made to call it the owner's.
         // `coding.input-idempotent`: a message whose inputId this session already accepted is not run again,
         // and every snapshot lists the accepted ids, so a retry after a lost reply can be reconciled.
-        return ["coding.sessions", "coding.stream", "human.takeover", "coding.inspect", "coding.repo-write", "coding.run-objective", "coding.run-objective.v2", "coding.input-idempotent"];
+        // `.v3` renders the owner's constraints in force with the objective; `coding.engine-identity`: every snapshot
+        // names its input ledger and engine process, and an id is deduplicated together with its content (input-ledger.ts).
+        return ["coding.sessions", "coding.stream", "human.takeover", "coding.inspect", "coding.repo-write", "coding.run-objective", "coding.run-objective.v2", "coding.run-objective.v3", "coding.input-idempotent", "coding.engine-identity"];
     }
     /**
      * Resolve the workDir for a read-only inspection. Prefer the tracked session's real
@@ -248,6 +251,7 @@ export class CodingRuntime {
             ...(session.lastTurn ? { lastTurn: session.lastTurn } : {}),
             ...(session.consumedInputs.length ? { consumedInputs: [...session.consumedInputs] } : {}),
             acceptedInputs: [...session.acceptedInputs],
+            engine: session.inputs.report(),
             ...(opts.drainUsage ? { usage: session.takeUsage(), acts: session.takeActs() } : {}),
         };
     }
@@ -257,15 +261,19 @@ export class CodingRuntime {
         switch (action.kind) {
             case "message": {
                 const inputId = typeof action.inputId === "string" && action.inputId.length <= 128 ? action.inputId : undefined;
-                // The same input twice is a retry after a lost reply, not a second instruction (#1019).
-                if (inputId && session.acceptedInputs.includes(inputId))
-                    return { ...this.snapshot(sessionId), duplicateInput: inputId };
+                // The same input twice is a retry after a lost reply, not a second instruction (#1019) — but only with
+                // the same content: a changed payload under an accepted id is refused, never credited as the first.
+                const digest = actDigest(action);
+                const seen = inputId ? session.inputs.check(inputId, digest) : "new";
+                if (seen !== "new")
+                    return { ...this.snapshot(sessionId), ...(seen === "duplicate" ? { duplicateInput: inputId } : { inputConflict: inputId }) };
                 // Narrowed rather than trusted: this runner is a published package any caller can
                 // POST to, and an unrecognised author must read as "unstated", not become a label.
                 session.input(action.text, {
                     author: asTurnAuthor(action.author),
                     replay: typeof action.replay === "string" ? action.replay : undefined,
                     inputId,
+                    digest,
                     objective: runObjective(action.objective),
                 });
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.105",
+  "version": "0.4.106",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",