@sigrun/sigrun 0.8.0 → 0.10.0

package/dist/harness/seam-host.js

@@ -17,7 +17,7 @@
  * extension; a throw later (tool execute) surfaces to the caller.
  */
 import { AmbientDoc, AmbientOwnersDoc, validateAmbient, } from "./ambient.js";
-import { InteractionDoc, InteractionsIndexDoc, applyAnswer, asInteractionRecord, indexPending, indexSettled, sweepSecretDelivery, takeSecretDelivery, validateInteraction, } from "./interactions.js";
+import { InteractionDoc, InteractionsIndexDoc, QueuedHumanInputsDoc, applyAnswer, applyDecline, asInteractionRecord, indexPending, indexSettled, sweepSecretDelivery, takeSecretDelivery, validateInteraction, } from "./interactions.js";
 import { toDurableContext } from "./context.js";
 import { scopedExtensionStores, } from "./stores.js";
 /** One seam violation. Name carries the surface ("interaction"/"ambient"). */
@@ -212,11 +212,79 @@ export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools
                 throw new SeamError("interaction", problem);
             context = toDurableContext(context);
             const h = await harness(context);
+            // A declinable record seeded after a human message is immediately
+            // declined when that message is still queued (ask-user Task 2,
+            // spec 5.3): the message was admitted BEFORE the card existed and
+            // must never get stuck behind it. Read each recorded submission's
+            // current status here (outside the commit — submission status is
+            // a table read) and drop any entry that is no longer queued.
+            let preDeclineUser;
+            let preDeclined = false;
+            const stillQueuedIds = new Set();
+            const seen = new Set();
+            if (record.declinable === true) {
+                const queuedDoc = await h.snapshot(QueuedHumanInputsDoc, conversationId, context);
+                const byId = queuedDoc?.byId ?? {};
+                // Snapshot key set: the commit-time cleanup below may only drop
+                // keys THIS read saw. A submission recorded by a concurrent
+                // submitOp ledger commit that lands between the snapshot and our
+                // commit is not in `seen` and must survive.
+                for (const key of Object.keys(byId))
+                    seen.add(key);
+                const stillQueued = [];
+                for (const [submissionId] of Object.entries(byId)) {
+                    const submission = await h.submission(Number(submissionId), context);
+                    if (submission === undefined)
+                        continue; // gone — drop below
+                    const status = await submission.status(context);
+                    // Fork isolation: QueuedHumanInputsDoc forks with the
+                    // conversation, so a child inherits the parent's entries.
+                    // Only same-conversation submissions count as queued here.
+                    if (status.status === "queued" &&
+                        status.conversationId === conversationId) {
+                        stillQueued.push(submissionId);
+                        stillQueuedIds.add(submissionId);
+                    }
+                }
+                if (stillQueued.length > 0) {
+                    // Earliest recorded submission wins (ascending id order).
+                    stillQueued.sort((a, b) => Number(a) - Number(b));
+                    preDeclineUser = byId[stillQueued[0]]?.user;
+                    preDeclined = true;
+                }
+            }
             await h.commit(async (tx) => {
                 // Maintain the index in the SAME commit as the record.
                 const existing = await tx.doc(InteractionDoc, conversationId, record.callId, record.callId);
                 if (existing.status !== "pending")
                     return; // first-write wins
+                if (record.declinable === true) {
+                    // Drop ledger entries whose submission is no longer queued
+                    // (they were read above; only stale ones are removed).
+                    const queuedDraft = await tx.doc(QueuedHumanInputsDoc, conversationId);
+                    const mutableById = queuedDraft.byId;
+                    for (const key of Object.keys(mutableById)) {
+                        if (seen.has(key) && !stillQueuedIds.has(key)) {
+                            delete mutableById[key];
+                        }
+                    }
+                }
+                if (preDeclined) {
+                    // Seed already settled: the human's queued message declines
+                    // the question before it is ever shown. Reuses applyDecline's
+                    // single definition of the settled shape.
+                    Object.assign(existing, record);
+                    // A self-declared-terminal seed (the extension passed a
+                    // non-pending status) must NOT survive the assign: the
+                    // queued human message declined it, so applyDecline stamps
+                    // declinedVia/answeredBy on a pending baseline.
+                    Object.assign(existing, { status: "pending" });
+                    applyDecline(existing, "message", Date.now(), preDeclineUser);
+                    // No index entry — it is not pending. Sweep any secret
+                    // delivery staged for this record (defensive).
+                    sweepSecretDelivery(conversationId, record.callId);
+                    return;
+                }
                 Object.assign(existing, record);
                 const index = await tx.doc(InteractionsIndexDoc);
                 indexPending(index, conversationId, record.callId);
@@ -264,6 +332,22 @@ export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools
                 return true;
             }, context);
         },
+        async declineInteraction(conversationId, callId, context, opts) {
+            context = toDurableContext(context);
+            const h = await harness(context);
+            // Same commit shape as settleInteraction: the sweep lands INSIDE
+            // the commit and only on the applied terminal transition.
+            return await h.commit(async (tx) => {
+                const draft = await tx.doc(InteractionDoc, conversationId, callId, callId);
+                const outcome = applyDecline(draft, "button", Date.now(), opts?.user);
+                if (outcome !== "declined")
+                    return false;
+                const index = await tx.doc(InteractionsIndexDoc);
+                indexSettled(index, conversationId, callId);
+                sweepSecretDelivery(conversationId, callId);
+                return true;
+            }, context);
+        },
         async peekInteraction(conversationId, callId, context) {
             // The non-consuming inspection read (release-readiness-2 §1):
             // the SAME stored projection as snapshotInteraction, with NO
@@ -422,6 +506,12 @@ export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools
             async get(id) {
                 return (await hostBridge("jobs.get")).jobs.get(id);
             },
+            async activeRun(conversationId) {
+                return (await hostBridge("jobs.activeRun")).jobs.activeRun(conversationId);
+            },
+            async isJobRun(conversationId, context) {
+                return (await hostBridge("jobs.isJobRun")).jobs.isJobRun(conversationId, context);
+            },
         },
         users: {
             async list() {
@@ -530,6 +620,29 @@ export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools
             async list() {
                 return (await hostBridge("models.list")).models.list();
             },
+            async complete(input) {
+                return (await hostBridge("models.complete")).models.complete(input);
+            },
+        },
+        // Warden Task 6: the decisions surface delegates to the host
+        // bridge (the bridge owns the registry's body); `caller` is the
+        // identity name read AT CALL TIME (the same rekey-aware pattern as
+        // `publishedHooks.call` — the host rekeys in place), so a calling
+        // extension can never claim another identity.
+        decisions: {
+            async evaluate(request, opts = {}) {
+                const bridge = await hostBridge("decisions.evaluate");
+                if (bridge.decisions === undefined) {
+                    return { ok: false, code: "no_model", error: "no decision provider is registered" };
+                }
+                return bridge.decisions.evaluate(identity.name, request, opts);
+            },
+            async list() {
+                const bridge = await hostBridge("decisions.list");
+                if (bridge.decisions === undefined)
+                    return [];
+                return bridge.decisions.list();
+            },
         },
         commands: {
             async list() {
@@ -587,6 +700,28 @@ export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools
                 });
             },
         },
+        // Knowledge C7: the seam's published-hook surface. `get` reads the
+        // slot directly (undefined while loading still runs); `call` waits
+        // for the registry-ready deferred, then delegates with the caller
+        // identity read AT CALL TIME (the host rekeys in place).
+        publishedHooks: {
+            get(name) {
+                return options?.publishedHooks?.current.registry?.get(name);
+            },
+            async call(name, payload, opts) {
+                const slot = options?.publishedHooks;
+                if (slot === undefined) {
+                    // No registry wiring (a bare-loader test rig): every name is
+                    // absent — `call` never throws.
+                    return { status: "absent" };
+                }
+                await slot.ready;
+                const registry = slot.current.registry;
+                if (registry === undefined)
+                    return { status: "absent" };
+                return registry.call(identity.name, name, payload, opts);
+            },
+        },
         bindBridge(bridge) {
             bridgeBound = true;
             bridgeReleased(bridge);

package/dist/harness/settings.js

@@ -91,6 +91,8 @@ const SETTING_KEYS = [
     "jobHistory",
     "defaultModel",
     "namingModel",
+    "decisionModel",
+    "decisions",
     "defaultProvider",
     "skills",
     "notifications",
@@ -326,6 +328,33 @@ function validate(value) {
             throw new SettingsValidationError("namingModel", "must have a non-empty provider and model id");
         }
     }
+    if (value.decisionModel !== undefined) {
+        // Exactly defaultModel's spec rules (no `false` disable — a
+        // decision call without a default resolves the first-registered
+        // provider's first model).
+        const spec = value.decisionModel;
+        if (typeof spec !== "string" || spec.trim() === "") {
+            throw new SettingsValidationError("decisionModel", "must be a non-empty provider/model-id string");
+        }
+        const trimmed = spec.trim();
+        const slash = trimmed.indexOf("/");
+        if (slash !== -1 &&
+            (trimmed.slice(0, slash) === "" || trimmed.slice(slash + 1) === "")) {
+            throw new SettingsValidationError("decisionModel", "must have a non-empty provider and model id");
+        }
+    }
+    // The decision surface's toggles (warden Task 6): a flat section —
+    // `tool` a boolean.
+    if (value.decisions !== undefined) {
+        const decisions = asRecord(value.decisions);
+        if (decisions === undefined) {
+            throw new SettingsValidationError("decisions", "must be an object");
+        }
+        checkKeys("decisions.", decisions, ["tool"]);
+        if (decisions.tool !== undefined && typeof decisions.tool !== "boolean") {
+            throw new SettingsValidationError("decisions.tool", "must be a boolean");
+        }
+    }
     if (value.defaultProvider !== undefined) {
         const provider = asRecord(value.defaultProvider);
         if (provider === undefined) {
@@ -418,6 +447,7 @@ function validateServer(server) {
         "dev",
         "supervised",
         "backup",
+        "decisions",
     ]);
     // The jobs default timezone (§8.2): an IANA name — `Intl` accepts
     // exactly the names croner's evaluation path resolves, and throws on
@@ -570,6 +600,17 @@ function validateServer(server) {
             }
         }
     }
+    if (record.decisions !== undefined) {
+        const decisions = asRecord(record.decisions);
+        if (decisions === undefined) {
+            throw new SettingsValidationError("server.decisions", "must be an object");
+        }
+        checkKeys("server.decisions.", decisions, ["timeoutMs"]);
+        if (decisions.timeoutMs !== undefined &&
+            !isPositiveInt(decisions.timeoutMs)) {
+            throw new SettingsValidationError("server.decisions.timeoutMs", "must be a positive integer");
+        }
+    }
     if (record.isolation !== undefined) {
         const isolation = asRecord(record.isolation);
         if (isolation === undefined) {

package/dist/history/git.js

@@ -490,8 +490,12 @@ export class GitHistory {
     }
     /** Corrupt git dir → move aside, re-init, snapshot commit (loud log). */
     async recoverCorrupt() {
-        const brokenName = `${this.spec.gitDir.split(sep).pop() ?? "repo"}.broken-${utcStamp(this.now())}`;
-        const brokenPath = `${this.spec.gitDir}.broken-${utcStamp(this.now())}`;
+        // ONE stamp: the summary must name the directory the rename made —
+        // two utcStamp(now) calls can straddle a clock tick and name a
+        // path that was never created (seen as a CI flake).
+        const stamp = utcStamp(this.now());
+        const brokenName = `${this.spec.gitDir.split(sep).pop() ?? "repo"}.broken-${stamp}`;
+        const brokenPath = `${this.spec.gitDir}.broken-${stamp}`;
         await rename(this.spec.gitDir, brokenPath);
         this.logLine(`corrupt git dir moved aside: ${this.spec.gitDir} → ${brokenPath}`);
         await this.run(["init", "--initial-branch=main"]);

package/dist/jobs/fire.js

@@ -38,6 +38,7 @@ import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { parseModelSpec } from "../config.js";
 import { expandInput } from "../commands/expand.js";
 import { SessionMetaDoc } from "../server/session-meta.js";
+import { excludeInteractiveTools } from "../harness/interactive-tools.js";
 import { noteThen } from "../server/turns/submit-turn.js";
 import { recordAuthor } from "../curation/attribution.js";
 import { JobRunDoc, patchJob, readJob } from "./docs.js";
@@ -172,6 +173,11 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
         if (prior === undefined) {
             await deps.harness.commit(async (tx) => {
                 await tx.doc(JobRunDoc, fireKey, run);
+                // NO meta.jobId stamp here (the 2026-11-05 reconciliation with
+                // ask-user's isJobRun): a fire INTO an existing conversation must
+                // not mark every later run of that conversation job-driven. The
+                // runSettled observer settles this run from the submission's
+                // `job:<fireKey>` requestId instead (observe.ts).
             }, context);
             await patchJob(deps.harness, id, (draft) => {
                 draft.lastRun = run;
@@ -233,6 +239,10 @@ async function firePrompt(deps, id, record, fireKey, baseRun, prior, context) {
                 if (owner !== undefined)
                     meta.owner = owner;
                 await deps.rewriteUserSelection?.(tx, newId, undefined, owner);
+                // Ask-user Task 3: the job-run conversation never offers an
+                // interactive tool (the tool is never listed, so the model
+                // never tries — §6's prompt section keys off tool presence).
+                await excludeInteractiveTools(tx, newId, deps.interactiveTools ?? new Set());
                 if (action.runSharing !== undefined)
                     meta.sharing = action.runSharing;
                 meta.name = runName(record.spec.name, deps.now(), record, deps);

package/dist/jobs/index.js

@@ -62,6 +62,9 @@ export function jobWireOf(id, record, owner) {
         id,
         name: record.spec.name,
         source: record.source,
+        ...(record.spec.description === undefined
+            ? {}
+            : { description: record.spec.description }),
         ...(owner === undefined ? {} : { owner }),
         ...(record.sharing === undefined
             ? {}

package/dist/jobs/observe.js

@@ -66,9 +66,34 @@ export function registerJobObservers(deps) {
     // auto-namer — a job observation never delays an extension's).
     const runSettled = async (event) => {
         try {
+            // The job to settle from, in resolution order:
+            //  1. the session meta's `jobId` (a `conversation: "new"` fire —
+            //     the stamp persists for the conversation's life);
+            //  2. a `job:<fireKey>` requestId on one of the run's inputs (the
+            //     FIXED-conversation fire shape — `jobs/fire.ts` stamps the
+            //     prefix on BOTH shapes; a fire INTO an existing conversation
+            //     deliberately leaves the meta unstamped so later ordinary
+            //     runs there are not job runs, per isJobRun's contract).
+            let jobId;
             const meta = await deps.harness.snapshot(SessionMetaDoc, event.conversationId, ctx);
-            const jobId = meta?.jobId;
-            if (typeof jobId !== "string")
+            const metaJobId = meta?.jobId;
+            if (typeof metaJobId === "string") {
+                jobId = metaJobId;
+            }
+            else {
+                for (const id of event.inputs) {
+                    const submission = await deps.harness.submission(id, ctx);
+                    if (submission === undefined)
+                        continue;
+                    const record = await submission.status(ctx);
+                    const requestId = record.requestId;
+                    if (requestId !== undefined && requestId.startsWith("job:")) {
+                        jobId = requestId.slice("job:".length).split(":")[0];
+                        break;
+                    }
+                }
+            }
+            if (jobId === undefined)
                 return;
             const runs = await listRuns(deps.storage, jobId, Number.MAX_SAFE_INTEGER, ctx);
             const run = runs.find((one) => one.outcome === "running" &&

package/dist/jobs/spec.js

@@ -22,7 +22,9 @@ import { createHash } from "node:crypto";
 import { isSharing } from "@sigrun/shared/access";
 import { cronFor, parseEvery } from "./schedule.js";
 /** Job names double as the file/extension id suffix (Global Constraints). */
-const NAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+export const NAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+/** The longest a job description may be (spec §8.2). */
+export const DESCRIPTION_MAX = 500;
 /**
  * Refine `unknown` (a request body, a settings block, an extension
  * declaration) into a `JobSpec`, or reject with the first offending
@@ -59,11 +61,23 @@ export function validateJobSpec(value) {
     if (record.sharing !== undefined && !isSharing(record.sharing)) {
         return invalid("sharing", "sharing must be a Sharing value");
     }
+    if (record.description !== undefined && typeof record.description !== "string") {
+        return invalid("description", "description must be a string");
+    }
+    const description = typeof record.description === "string"
+        ? record.description.trim()
+        : undefined;
+    if (description !== undefined && description.length > DESCRIPTION_MAX) {
+        return invalid("description", `description must be at most ${DESCRIPTION_MAX} characters`);
+    }
     const spec = {
         name: record.name,
         schedule: schedule.schedule,
         action: action.action,
     };
+    if (description !== undefined && description.length > 0) {
+        spec.description = description;
+    }
     if (record.overlap !== undefined)
         spec.overlap = record.overlap;
     if (record.catchUp !== undefined)

package/dist/server/conversation-ops.js

@@ -20,7 +20,9 @@ import { AgentDoc, configure } from "@earendil-works/pi-durable";
 import { accessOf, isSharing, } from "@sigrun/shared/access";
 import { extname } from "node:path";
 import { touchActivity } from "../harness/activity.js";
+import { excludeInteractiveTools } from "../harness/interactive-tools.js";
 import { ensureRequestId, recordAuthor, } from "../curation/attribution.js";
+import { QueuedHumanInputsDoc, declinePendingOnMessage, } from "../harness/interactions.js";
 import { resolveServedModelRefreshing } from "../harness/providers/refresh.js";
 import { isSuperuser } from "./auth/principal.js";
 import { isConfinedPath, parseSubmissionInput } from "./content-parts.js";
@@ -243,6 +245,16 @@ export async function createConversationOp(ctx, input = {}) {
         if (input.source !== undefined)
             draft.source = input.source;
         await opened.rewriteUserSelection(tx, conversation.id, undefined, input.owner);
+        // Ask-user Task 3 (spec §6): a conversation created FOR a job hides
+        // the interactive tools — the creation-time filter edits the stored
+        // enabled-tools filter, so the tool is neither offered nor reachable
+        // from nested `executeTool()` calls. An explicit `agent.tools`
+        // selection naming one loses it the same way. A SECOND commit after
+        // `harness.createConversation` is fine: document access is
+        // unrestricted here.
+        if (input.job !== undefined) {
+            await excludeInteractiveTools(tx, conversation.id, opened.interactiveTools);
+        }
     }, BACKGROUND_CONTEXT);
     const view = await readView(conversation);
     return { id: conversation.id, view };
@@ -390,6 +402,25 @@ export async function submitOp(ctx, conversation, input, opts = {}) {
     // The submit pass-through is retired (§6.7): the memory seam's
     // runSettled owns capture, so submissions admit directly.
     const submission = await conversation.submit(draft, BACKGROUND_CONTEXT);
+    // Ask-user Task 2: a human message (no entry, declinesQuestions: true)
+    // declines every pending declinable question and records itself in the
+    // queued-inputs ledger when it was admitted while busy. A rejected
+    // submit (whenBusy: "reject" while busy) throws above and reaches none
+    // of this.
+    if (opts.declinesQuestions === true && opts.entry === undefined) {
+        const declined = await declinePendingOnMessage(opened.harness, conversation.id, opts.user, Date.now(), BACKGROUND_CONTEXT);
+        void declined; // the returned callIds are observational only
+        const admitted = await submission.status(BACKGROUND_CONTEXT);
+        if (admitted.status === "queued") {
+            await opened.harness.commit(async (tx) => {
+                const doc = await tx.doc(QueuedHumanInputsDoc, conversation.id);
+                const byId = doc.byId;
+                byId[String(submission.id)] = {
+                    ...(opts.user !== undefined ? { user: opts.user } : {}),
+                };
+            }, BACKGROUND_CONTEXT);
+        }
+    }
     await recordAuthor(conversation, { submissionId: submission.id }, opts.user, BACKGROUND_CONTEXT);
     // The implied clear (notices spec §3.2 rule 2): the user's next prompt
     // in a conversation is them dealing with that conversation's notices,