@sema-agent/server 7.43.0 → 7.44.0

package/dist/leader/repair-wire.js

@@ -1,70 +1,19 @@
-/**
- * The WIRE that wraps core `runRepairLoop` onto the leader's single-agent path
- * (`sema-internal server/docs/LEADER-REPAIRLOOP-INTEGRATION.md` §3.3 + the authoritative §10 layer). It owns the three things the
- * `RepairOracle` closure (`repair-oracle.ts`) and the core engine CANNOT resolve themselves:
- *
- *  1. **The grader handle (R1, §10.1)** — the reused integration sandbox's writeFile/exec + `integBase`, bound by
- *     the caller (`attachRepairLoopDeps` is handed the integration env). The closure grades there; the worker env
- *     stays distinct so the §5.1 identity check (`graderEnv !== workerEnv`) is LIVE.
- *  2. **The worker diff source** — `pullWorkerDiff`, the same `pullDiff`/self-upload path the merge uses, so the
- *     closure materializes the worker's LATEST committed `base..HEAD` diff every grade (§10.1; never a stale diff).
- *  3. **De-correlation model ids (§10.9 mechanics)** — the closure receives NO model ids (roles→models resolve
- *     INSIDE `Runner.runTask`, AFTER the closure returns), so the WIRE resolves `generatorModelId` +
- *     `verifierModelId` from `cfg.roles`/`cfg.models` and passes them to `mkRepairOracle.l3`. v1 ships L3 OFF
- *     (`cfg.l3` unset) → L2 `trusted_hidden` is the sole clearer; `terminalForTier` caps every PASS at
- *     `candidate_only`.
- *
- * §10.2 — for v1 SAFE-tier `candidate_only` we OMIT `immutableOraclePaths` (the bare `graderEnv !== workerEnv`
- * identity check suffices; the structural bash write-probe is vacuous across distinct sandboxes and matters only
- * for the mandate-OFF auto-accept path). `workerEnv` IS passed so the identity check runs.
- *
- * §10.7 — the surfaced `candidatePatch.patch` is worker-authored code reaching a human-read HTTP body / durable-
- * approval row, so it is DELIMITED (`delimitUntrusted(...)`); `reason` comes ONLY from the core-sanitized
- * `RepairResult.verification.findings[0]`, never the raw oracle trace.
- *
- * §10.8 — `attachRepairLoopDeps(deps, integEnv, cfg)` is the SINGLE wire-call helper so `wire.ts` gains one line
- * per integration-sandbox path instead of in-place edits to its dense provision spreads. Stage-2 calls it.
- *
- * Everything here is gated by the caller behind `LEADER_REPAIR_LOOP` (default OFF): when the dep is not attached
- * the leader's single-agent paths are byte-identical to today.
- */
 import { runRepairLoop, delimitUntrusted, } from "@sema-agent/core";
 import { mkRepairOracle } from "./repair-oracle.js";
-/**
- * §10.6 status mapping. A SAFE-tier `candidate_only`/`fixed` maps to status `completed` (back-compat — there is no
- * `candidate_only` status member; the candidate state rides on `repairTerminal`, and the merge push chokepoint
- * holds the push). Every other terminal is a NON-mergeable abstain/failure → `failed` (quarantined), carrying the
- * terminal as the WHY (no-silent-failures). `gave_up`/`oracle.unprotected` → `failed`; `needs_human_oracle`/
- * `conflict` → `failed` too (the HTTP layer re-reads `repairTerminal` to surface `needs_human`, `endpoint.ts:75`).
- */
 function statusForTerminal(t) {
     return t === "fixed" || t === "candidate_only" ? "completed" : "failed";
 }
-/**
- * §3.3 — run the bounded single-agent self-repair loop over the solo worker and map the result to a `WorkerReport`
- * (with `repairTerminal` set — §10.6). Builds the `RepairOracle` closure (capturing the worker-diff source, the
- * grader handle, `integBase`, the trusted steps, the resolved model ids), then calls `runRepairLoop` with
- * `graderEnv` = the integration sandbox, `workerEnv` = the solo worker's env (so the identity check is LIVE),
- * OMITTING `immutableOraclePaths` (§10.2). Never throws — a thrown engine error maps to a `failed` report so the
- * leader's "never throws" contract holds. The held candidate (`candidate_only` etc.) is surfaced DELIMITED (§10.7).
- */
 export async function runRepairLoopForLeader(solo, implSpec, cfg) {
     try {
         return await runRepairLoopForLeaderInner(solo, implSpec, cfg);
     }
     finally {
-        // Reap the dedicated grader sandbox on EVERY path (success, abstain, or a thrown engine error). The grader is
-        // a separate provisioned sandbox the wire minted for this loop; the inner fn never throws (its own try/catch
-        // maps an engine error to a failed report), so this `finally` runs once per loop.
         if (cfg.graderDestroy)
             await cfg.graderDestroy().catch(() => { });
     }
 }
 async function runRepairLoopForLeaderInner(solo, implSpec, cfg) {
     const base = { workerId: solo.workerId, sessionId: solo.sessionId, branch: solo.branch, baseSha: solo.baseSha };
-    // fork2.2 — capture the EXACT bytes the oracle graded (the last verdict) so the surfaced
-    // candidate == the graded artifact: a human reviews the bytes that produced the terminal, never a later re-pull
-    // that may have drifted. Updated on every oracle call; the last one is the artifact the terminal is about.
     let graded;
     const oracle = mkRepairOracle({
         pullWorkerDiff: cfg.pullWorkerDiff,
@@ -73,7 +22,7 @@ async function runRepairLoopForLeaderInner(solo, implSpec, cfg) {
         integBase: cfg.grader.integBase,
         oracleSteps: cfg.oracleSteps,
         passTier: cfg.passTier,
-        ...(cfg.oraclePaths ? { oraclePaths: cfg.oraclePaths } : {}), // fork1.2 — refuse a patch that touches the oracle
+        ...(cfg.oraclePaths ? { oraclePaths: cfg.oraclePaths } : {}),
         onGraded: (info) => { graded = { diff: info.diff, hash: info.hash }; },
         ...(cfg.flakyK !== undefined ? { flakyK: cfg.flakyK } : {}),
         ...(cfg.l3 ? { l3: cfg.l3 } : {}),
@@ -84,11 +33,6 @@ async function runRepairLoopForLeaderInner(solo, implSpec, cfg) {
         result = await runRepairLoop(cfg.runner, implSpec, {
             oracle,
             graderEnv: cfg.grader.env,
-            // §10.2 — pass workerEnv ONLY when present (the static E2B lane, where the leader owns the worker env) so
-            // the LIVE identity check runs; OMIT it on the factory lane where the worker's raw env is not surfaced
-            // (runRepairLoop then SKIPS the check + fires onWarn — fine, the grader is a separate sandbox by
-            // construction). Either way OMIT immutableOraclePaths (the structural probe is vacuous across distinct
-            // sandboxes; the bare graderEnv !== workerEnv check is sufficient SAFE-tier).
             ...(cfg.workerEnv ? { workerEnv: cfg.workerEnv } : {}),
             maxAttempts: cfg.maxAttempts,
             ...(cfg.resumeBundle ? { resumeBundle: cfg.resumeBundle } : {}),
@@ -112,15 +56,8 @@ async function runRepairLoopForLeaderInner(solo, implSpec, cfg) {
         ...(result.stats ? { stats: result.stats } : {}),
         ...(result.errorMessage ? { error: result.errorMessage } : {}),
     };
-    // §10.7 — surface a held candidate DELIMITED. `reason` is sourced ONLY from the core-sanitized verification
-    // findings (never the raw oracle trace tail, which is untrusted worker-adjacent text). Surface on any non-
-    // auto-accepting terminal that still carries usable worker output (candidate_only / needs_human_oracle /
-    // gave_up / conflict). `oracle.unprotected` is an infra-isolation failure → no candidate to surface.
     let candidatePatch;
     if (terminal !== "oracle.unprotected" && terminal !== "fixed") {
-        // fork2.2 — surface the EXACT bytes the oracle graded (the last verdict's diff + its hash), so the human
-        // reviews the artifact that produced this terminal — never a later re-pull that may have drifted. Fall back
-        // to a fresh pull only if the loop somehow reached here without a graded diff (defensive; hash unknown).
         const g = graded ??
             (await (async () => {
                 const d = await cfg.pullWorkerDiff().catch((e) => ({ ok: false, error: e instanceof Error ? e.message : String(e) }));
@@ -139,25 +76,11 @@ async function runRepairLoopForLeaderInner(solo, implSpec, cfg) {
     cfg.log?.("repair_loop_outcome", { terminal, status: report.status, hasCandidate: candidatePatch !== undefined });
     return { report, result, ...(candidatePatch ? { candidatePatch } : {}) };
 }
-/**
- * §10.8 — the SINGLE wire-call helper. Attaches the `LeaderDeps.repairLoop` dep (the opt-in single-agent repair
- * loop) using the integration sandbox as the grader (R1). `wire.ts` calls this ONCE per integration-sandbox path
- * instead of editing its dense provision spreads. When `cfg` is absent (LEADER_REPAIR_LOOP off) it is a NO-OP →
- * `deps.repairLoop` stays unset → the leader's single-agent paths are byte-identical to today.
- *
- * The wire supplies a `resolve(solo, sub)` that, per solo worker, produces the concrete `RepairWireCfg` (the real
- * Runner + the worker env ref + the worker diff source bound to THAT worker). Kept as a callback so the grader
- * handle / steps / model ids the wire already holds are closed over once, and only the per-worker bindings are
- * resolved at call time.
- */
 export function attachRepairLoopDeps(deps, resolve) {
     if (!resolve)
-        return; // LEADER_REPAIR_LOOP off → no-op → byte-identical default path
+        return;
     deps.repairLoop = {
         run: async (solo, sub) => {
-            // `resolve` is ASYNC: it provisions a DEDICATED grader sandbox (seed + inject-oracle) for THIS loop, which
-            // is async. The grader lifecycle (destroy) rides on the returned `RepairWireCfg.graderDestroy`, reaped in
-            // `runRepairLoopForLeader`'s `finally`.
             const cfg = await resolve(solo, sub);
             const implSpec = { ...sub.spec, sessionId: solo.sessionId };
             return runRepairLoopForLeader(solo, implSpec, cfg);