@sanqianx/claude-ai-workbench 0.13.2 → 0.13.3

package/src/backend/lib/native-task-runtime.js

@@ -1,242 +1,242 @@
-'use strict';
-
-// Native task runtime - the per-session coordinator that feeds verified SDK
-// stream messages and sanitized native-trace hook events into the audited
-// NativeTaskRegistry and projects single-task claude/native-task-state events
-// through the session's existing emit path. It owns no transport and decides
-// no ownership: the registry remains the only place facts are judged, and
-// this module only observes it. The runtime is created once per workbench
-// session (never per input), so a resident background query keeps its task
-// owner while later inputs stream into the same session.
-
-const { NativeTaskRegistry } = require('./native-task-registry');
-
-// Only state a consumer can act on gates a new projection: observedEvents
-// counters and diagnostic churn must not re-emit an unchanged task.
-function semanticKey(task) {
-  return JSON.stringify([
-    task.association, task.status, task.statusSource, task.taskKind,
-    task.taskType, task.typeConflict, task.toolUseId, task.ownerRunId, task.taskRef,
-  ]);
-}
-
-// Minimal serializable per-task state for persistence.
-function minimalTask(task) {
-  return {
-    sdkSessionId: task.sdkSessionId,
-    taskId: task.taskId,
-    toolUseId: task.toolUseId,
-    status: task.status,
-    statusSource: task.statusSource,
-    taskKind: task.taskKind,
-    taskType: task.taskType,
-    typeConflict: task.typeConflict === true,
-    association: task.association,
-    taskRef: task.taskRef,
-    ownerRunId: task.ownerRunId,
-    owner: task.owner,
-    mainToolUseId: task.mainToolUseId,
-  };
-}
-
-// Fresh copies only: no consumer of scope(), snapshot() or an emitted event
-// ever holds the internal fixed scope (or a task inside the persisted
-// history) by reference, so external mutation cannot rewrite later output.
-function copyScope(scope) {
-  return { storeScope: scope.storeScope, contextId: scope.contextId, parentSessionId: scope.parentSessionId };
-}
-
-function projection(scope, task, reason) {
-  return {
-    type: 'claude/native-task-state',
-    scope: copyScope(scope),
-    sdkSessionId: task.sdkSessionId,
-    taskId: task.taskId,
-    toolUseId: task.toolUseId,
-    taskKind: task.taskKind,
-    taskType: task.taskType,
-    status: task.status,
-    statusSource: task.statusSource,
-    association: task.association,
-    typeConflict: task.typeConflict === true,
-    taskRef: task.taskRef,
-    ownerRunId: task.ownerRunId,
-    owner: task.owner,
-    reason,
-  };
-}
-
-function clone(task) { return JSON.parse(JSON.stringify(task)); }
-
-function createNativeTaskRuntime({ scope, emit, restoredTasks } = {}) {
-  if (typeof emit !== 'function') throw new Error('createNativeTaskRuntime requires an emit function');
-  // The registry constructor validates the scope; an invalid scope throws,
-  // which the runner reports as an honest attach failure instead of
-  // inventing a weaker fallback. The frozen internal copy is the only
-  // storage - the caller's object is never kept by reference.
-  const registry = new NativeTaskRegistry(scope);
-  const fixedScope = Object.freeze(copyScope(registry.scope));
-  // Restored native tasks are inert persistent history: deep-copied at
-  // attach, never fed into the live registry as running facts, never
-  // re-emitted as new live events, and never overwritten by the live view.
-  const restored = restoredTasks && Array.isArray(restoredTasks.tasks)
-    ? restoredTasks.tasks.filter(task => task && typeof task === 'object').map(clone)
-    : [];
-  const restoredKeys = new Set(restored
-    .filter(task => typeof task.sdkSessionId === 'string' && typeof task.taskId === 'string')
-    .map(task => JSON.stringify([task.sdkSessionId, task.taskId])));
-  const lastProjected = new Map();
-  // Sticky unavailable state: once native history publishing has failed, no
-  // new projections happen and live tasks stop being controllable. A clean
-  // detach from the Service binding sets a NON-sticky unavailable that
-  // resumeFromDetach() clears when the session re-binds to a committer.
-  let unavailable = null;
-  // Delivered-projection state per task: the content of the last projection
-  // that cleared the durable gate, and whether the task's LATEST projection
-  // attempt was delivered. A refusal (emit returned false) keeps the older
-  // content but revokes the durable claim, so no unproven fact ever reaches
-  // a public view (snapshot, live lookup) - the registry stays a raw index,
-  // never the delivered truth.
-  const delivered = new Map();
-
-  const project = reason => {
-    if (unavailable) return;
-    for (const task of registry.list()) {
-      const key = JSON.stringify([task.sdkSessionId, task.taskId]);
-      // A task key already present in restored history stays historical: a
-      // late started for it must not surface as a running live fact.
-      if (restoredKeys.has(key)) continue;
-      const semantic = semanticKey(task);
-      if (lastProjected.get(key) === semantic) continue;
-      const event = projection(fixedScope, task, reason);
-      // Stage the delivered view BEFORE the emit: the emit path itself
-      // persists snapshots (the runner's per-event record), and that
-      // mid-emit snapshot must show exactly the fact being broadcast. The
-      // staged copy is deep and shares nothing with the event object, so a
-      // consumer mutating the event cannot rewrite it. A refusal or a throw
-      // rolls back to the prior content with the durable claim revoked - a
-      // durable-gate refusal is never recorded as delivered, and the same
-      // real fact retries next time.
-      const prior = delivered.get(key) || null;
-      delivered.set(key, { task: clone(minimalTask(task)), durable: true });
-      let ok = false;
-      try {
-        ok = emit(event);
-      } finally {
-        if (ok === false) {
-          if (prior) delivered.set(key, { task: prior.task, durable: false });
-          else delivered.delete(key);
-        }
-      }
-      if (ok === false) return;
-      lastProjected.set(key, semantic);
-    }
-  };
-
-  return {
-    scope: () => copyScope(fixedScope),
-    // Read-only live lookup by canonical NativeTaskRef for trusted
-    // coordinators (first-stage targeted stop): only the CURRENT registry
-    // participates and restored history never becomes live
-    // controllability - a historical key stays excluded even if live facts
-    // later re-bind it. Returns a fresh deep copy, or null for any invalid,
-    // foreign, unbound or unknown ref - never an error leaking internals.
-    getLiveTask(ref) {
-      if (unavailable) return null;
-      try {
-        const task = registry.getTask(ref);
-        if (!task) return null;
-        const key = JSON.stringify([task.sdkSessionId, task.taskId]);
-        if (restoredKeys.has(key)) return null;
-        const state = delivered.get(key);
-        return state ? clone(state.task) : null;
-      } catch (error) {
-        return null;
-      }
-    },
-    // Narrow real-commit-status query for trusted control coordinators:
-    // true only for a task whose latest semantic projection was actually
-    // delivered through a successful durable gate. No default true.
-    isTaskDurable(ref) {
-      if (unavailable) return false;
-      try {
-        const task = registry.getTask(ref);
-        if (!task) return false;
-        const state = delivered.get(JSON.stringify([task.sdkSessionId, task.taskId]));
-        return state ? state.durable === true : false;
-      } catch (error) {
-        return false;
-      }
-    },
-    // Marks native history publishing unavailable: sticky (default) after a
-    // real durable failure - projections stop, live tasks stop being
-    // controllable - or non-sticky for a clean Service detach so a rebind
-    // can resume live projection. A sticky failure is terminal for this
-    // runtime instance: a later clean detach must not downgrade it to a
-    // recoverable state, and the rebind's resumeFromDetach cannot clear it.
-    // The first sticky reason stays the honest record of what failed.
-    markUnavailable(reason, { sticky = true } = {}) {
-      if (unavailable && unavailable.sticky) return;
-      unavailable = { reason: String(reason || 'unknown'), sticky: sticky === true, at: new Date().toISOString() };
-    },
-    // Clears a non-sticky (detach) unavailable state after the runtime
-    // re-bound to a trusted committer; a sticky failure stays for good.
-    resumeFromDetach() {
-      if (unavailable && !unavailable.sticky) unavailable = null;
-    },
-    // Raw SDK stream message (the same object the product stream already
-    // normalized and emitted); recorded after that path, then projected.
-    // Returns false when unavailable so callers know facts were dropped.
-    observeSdkMessage(message) {
-      if (unavailable) return false;
-      registry.observeSdkMessage(message);
-      project('sdk-message');
-      return true;
-    },
-    // Sanitized claude/native-trace event (already emitted as-is); recorded
-    // after the trace itself, then projected. Returns false when
-    // unavailable so callers know facts were dropped.
-    observeTrace(trace) {
-      if (unavailable) return false;
-      registry.observeTrace(trace);
-      project('trace');
-      return true;
-    },
-    // Narrow trusted read-only binding query for the transcript collector:
-    // the registry's own bound agent identities, as fresh copies. Empty when
-    // unavailable - an unavailable runtime must not feed new reads.
-    agentTranscriptBindings() {
-      if (unavailable) return [];
-      return registry.agentBindings();
-    },
-    // Minimal serializable state for session persistence: restored history
-    // first (verbatim, terminal and restart statuses preserved), then live
-    // tasks whose key does not collide with history - both coexist and
-    // neither overwrites the other. Live rows carry a `durable` flag true
-    // only for delivered gated projections, and a sticky unavailable is
-    // persisted so a restored session never resumes as if history were
-    // healthy. Returned copies share nothing with the internal state.
-    snapshot() {
-      // Live rows serve the delivered view: a task whose latest projection
-      // was refused keeps its last proven content with a revoked durable
-      // flag; a task never delivered at all appears with durable false and
-      // never with unproven facts.
-      const live = registry.list()
-        .map(task => ({ task, key: JSON.stringify([task.sdkSessionId, task.taskId]) }))
-        .filter(({ key }) => !restoredKeys.has(key))
-        .map(({ task, key }) => {
-          const state = delivered.get(key);
-          return state
-            ? Object.assign(clone(state.task), { durable: state.durable })
-            : Object.assign(minimalTask(task), { durable: false });
-        });
-      return Object.assign(
-        { version: 1, scope: copyScope(fixedScope) },
-        unavailable ? { unavailable: { reason: unavailable.reason, sticky: unavailable.sticky, at: unavailable.at } } : {},
-        { tasks: restored.map(clone).concat(live) }
-      );
-    },
-  };
-}
-
-module.exports = { createNativeTaskRuntime };
+'use strict';
+
+// Native task runtime - the per-session coordinator that feeds verified SDK
+// stream messages and sanitized native-trace hook events into the audited
+// NativeTaskRegistry and projects single-task claude/native-task-state events
+// through the session's existing emit path. It owns no transport and decides
+// no ownership: the registry remains the only place facts are judged, and
+// this module only observes it. The runtime is created once per workbench
+// session (never per input), so a resident background query keeps its task
+// owner while later inputs stream into the same session.
+
+const { NativeTaskRegistry } = require('./native-task-registry');
+
+// Only state a consumer can act on gates a new projection: observedEvents
+// counters and diagnostic churn must not re-emit an unchanged task.
+function semanticKey(task) {
+  return JSON.stringify([
+    task.association, task.status, task.statusSource, task.taskKind,
+    task.taskType, task.typeConflict, task.toolUseId, task.ownerRunId, task.taskRef,
+  ]);
+}
+
+// Minimal serializable per-task state for persistence.
+function minimalTask(task) {
+  return {
+    sdkSessionId: task.sdkSessionId,
+    taskId: task.taskId,
+    toolUseId: task.toolUseId,
+    status: task.status,
+    statusSource: task.statusSource,
+    taskKind: task.taskKind,
+    taskType: task.taskType,
+    typeConflict: task.typeConflict === true,
+    association: task.association,
+    taskRef: task.taskRef,
+    ownerRunId: task.ownerRunId,
+    owner: task.owner,
+    mainToolUseId: task.mainToolUseId,
+  };
+}
+
+// Fresh copies only: no consumer of scope(), snapshot() or an emitted event
+// ever holds the internal fixed scope (or a task inside the persisted
+// history) by reference, so external mutation cannot rewrite later output.
+function copyScope(scope) {
+  return { storeScope: scope.storeScope, contextId: scope.contextId, parentSessionId: scope.parentSessionId };
+}
+
+function projection(scope, task, reason) {
+  return {
+    type: 'claude/native-task-state',
+    scope: copyScope(scope),
+    sdkSessionId: task.sdkSessionId,
+    taskId: task.taskId,
+    toolUseId: task.toolUseId,
+    taskKind: task.taskKind,
+    taskType: task.taskType,
+    status: task.status,
+    statusSource: task.statusSource,
+    association: task.association,
+    typeConflict: task.typeConflict === true,
+    taskRef: task.taskRef,
+    ownerRunId: task.ownerRunId,
+    owner: task.owner,
+    reason,
+  };
+}
+
+function clone(task) { return JSON.parse(JSON.stringify(task)); }
+
+function createNativeTaskRuntime({ scope, emit, restoredTasks } = {}) {
+  if (typeof emit !== 'function') throw new Error('createNativeTaskRuntime requires an emit function');
+  // The registry constructor validates the scope; an invalid scope throws,
+  // which the runner reports as an honest attach failure instead of
+  // inventing a weaker fallback. The frozen internal copy is the only
+  // storage - the caller's object is never kept by reference.
+  const registry = new NativeTaskRegistry(scope);
+  const fixedScope = Object.freeze(copyScope(registry.scope));
+  // Restored native tasks are inert persistent history: deep-copied at
+  // attach, never fed into the live registry as running facts, never
+  // re-emitted as new live events, and never overwritten by the live view.
+  const restored = restoredTasks && Array.isArray(restoredTasks.tasks)
+    ? restoredTasks.tasks.filter(task => task && typeof task === 'object').map(clone)
+    : [];
+  const restoredKeys = new Set(restored
+    .filter(task => typeof task.sdkSessionId === 'string' && typeof task.taskId === 'string')
+    .map(task => JSON.stringify([task.sdkSessionId, task.taskId])));
+  const lastProjected = new Map();
+  // Sticky unavailable state: once native history publishing has failed, no
+  // new projections happen and live tasks stop being controllable. A clean
+  // detach from the Service binding sets a NON-sticky unavailable that
+  // resumeFromDetach() clears when the session re-binds to a committer.
+  let unavailable = null;
+  // Delivered-projection state per task: the content of the last projection
+  // that cleared the durable gate, and whether the task's LATEST projection
+  // attempt was delivered. A refusal (emit returned false) keeps the older
+  // content but revokes the durable claim, so no unproven fact ever reaches
+  // a public view (snapshot, live lookup) - the registry stays a raw index,
+  // never the delivered truth.
+  const delivered = new Map();
+
+  const project = reason => {
+    if (unavailable) return;
+    for (const task of registry.list()) {
+      const key = JSON.stringify([task.sdkSessionId, task.taskId]);
+      // A task key already present in restored history stays historical: a
+      // late started for it must not surface as a running live fact.
+      if (restoredKeys.has(key)) continue;
+      const semantic = semanticKey(task);
+      if (lastProjected.get(key) === semantic) continue;
+      const event = projection(fixedScope, task, reason);
+      // Stage the delivered view BEFORE the emit: the emit path itself
+      // persists snapshots (the runner's per-event record), and that
+      // mid-emit snapshot must show exactly the fact being broadcast. The
+      // staged copy is deep and shares nothing with the event object, so a
+      // consumer mutating the event cannot rewrite it. A refusal or a throw
+      // rolls back to the prior content with the durable claim revoked - a
+      // durable-gate refusal is never recorded as delivered, and the same
+      // real fact retries next time.
+      const prior = delivered.get(key) || null;
+      delivered.set(key, { task: clone(minimalTask(task)), durable: true });
+      let ok = false;
+      try {
+        ok = emit(event);
+      } finally {
+        if (ok === false) {
+          if (prior) delivered.set(key, { task: prior.task, durable: false });
+          else delivered.delete(key);
+        }
+      }
+      if (ok === false) return;
+      lastProjected.set(key, semantic);
+    }
+  };
+
+  return {
+    scope: () => copyScope(fixedScope),
+    // Read-only live lookup by canonical NativeTaskRef for trusted
+    // coordinators (first-stage targeted stop): only the CURRENT registry
+    // participates and restored history never becomes live
+    // controllability - a historical key stays excluded even if live facts
+    // later re-bind it. Returns a fresh deep copy, or null for any invalid,
+    // foreign, unbound or unknown ref - never an error leaking internals.
+    getLiveTask(ref) {
+      if (unavailable) return null;
+      try {
+        const task = registry.getTask(ref);
+        if (!task) return null;
+        const key = JSON.stringify([task.sdkSessionId, task.taskId]);
+        if (restoredKeys.has(key)) return null;
+        const state = delivered.get(key);
+        return state ? clone(state.task) : null;
+      } catch (error) {
+        return null;
+      }
+    },
+    // Narrow real-commit-status query for trusted control coordinators:
+    // true only for a task whose latest semantic projection was actually
+    // delivered through a successful durable gate. No default true.
+    isTaskDurable(ref) {
+      if (unavailable) return false;
+      try {
+        const task = registry.getTask(ref);
+        if (!task) return false;
+        const state = delivered.get(JSON.stringify([task.sdkSessionId, task.taskId]));
+        return state ? state.durable === true : false;
+      } catch (error) {
+        return false;
+      }
+    },
+    // Marks native history publishing unavailable: sticky (default) after a
+    // real durable failure - projections stop, live tasks stop being
+    // controllable - or non-sticky for a clean Service detach so a rebind
+    // can resume live projection. A sticky failure is terminal for this
+    // runtime instance: a later clean detach must not downgrade it to a
+    // recoverable state, and the rebind's resumeFromDetach cannot clear it.
+    // The first sticky reason stays the honest record of what failed.
+    markUnavailable(reason, { sticky = true } = {}) {
+      if (unavailable && unavailable.sticky) return;
+      unavailable = { reason: String(reason || 'unknown'), sticky: sticky === true, at: new Date().toISOString() };
+    },
+    // Clears a non-sticky (detach) unavailable state after the runtime
+    // re-bound to a trusted committer; a sticky failure stays for good.
+    resumeFromDetach() {
+      if (unavailable && !unavailable.sticky) unavailable = null;
+    },
+    // Raw SDK stream message (the same object the product stream already
+    // normalized and emitted); recorded after that path, then projected.
+    // Returns false when unavailable so callers know facts were dropped.
+    observeSdkMessage(message) {
+      if (unavailable) return false;
+      registry.observeSdkMessage(message);
+      project('sdk-message');
+      return true;
+    },
+    // Sanitized claude/native-trace event (already emitted as-is); recorded
+    // after the trace itself, then projected. Returns false when
+    // unavailable so callers know facts were dropped.
+    observeTrace(trace) {
+      if (unavailable) return false;
+      registry.observeTrace(trace);
+      project('trace');
+      return true;
+    },
+    // Narrow trusted read-only binding query for the transcript collector:
+    // the registry's own bound agent identities, as fresh copies. Empty when
+    // unavailable - an unavailable runtime must not feed new reads.
+    agentTranscriptBindings() {
+      if (unavailable) return [];
+      return registry.agentBindings();
+    },
+    // Minimal serializable state for session persistence: restored history
+    // first (verbatim, terminal and restart statuses preserved), then live
+    // tasks whose key does not collide with history - both coexist and
+    // neither overwrites the other. Live rows carry a `durable` flag true
+    // only for delivered gated projections, and a sticky unavailable is
+    // persisted so a restored session never resumes as if history were
+    // healthy. Returned copies share nothing with the internal state.
+    snapshot() {
+      // Live rows serve the delivered view: a task whose latest projection
+      // was refused keeps its last proven content with a revoked durable
+      // flag; a task never delivered at all appears with durable false and
+      // never with unproven facts.
+      const live = registry.list()
+        .map(task => ({ task, key: JSON.stringify([task.sdkSessionId, task.taskId]) }))
+        .filter(({ key }) => !restoredKeys.has(key))
+        .map(({ task, key }) => {
+          const state = delivered.get(key);
+          return state
+            ? Object.assign(clone(state.task), { durable: state.durable })
+            : Object.assign(minimalTask(task), { durable: false });
+        });
+      return Object.assign(
+        { version: 1, scope: copyScope(fixedScope) },
+        unavailable ? { unavailable: { reason: unavailable.reason, sticky: unavailable.sticky, at: unavailable.at } } : {},
+        { tasks: restored.map(clone).concat(live) }
+      );
+    },
+  };
+}
+
+module.exports = { createNativeTaskRuntime };