@staix/agent-hub 0.12.21 → 0.12.23

package/src/adapters/codex-appserver.ts

@@ -37,7 +37,7 @@ export interface CodexOptions {
   onItem?: (item: any, nativeTurn?: string) => void;
   /** How often to ask app-server for the rate limits while a TUI is attached. */
   usagePollMs?: number;
-  /** How long a fact's steer waits for app-server's answer (tests shorten it). */
+  /** Facts wait from send; durable steers wait only after their original turn ends (default 10 s). */
   steerTimeoutMs?: number;
   cwd: string;
   /** Optional launch environment; recovery authority is always removed before spawn. */
@@ -63,9 +63,9 @@ const TRACKED = new Set(["thread/start", "thread/resume"]);
  */
 export class CodexPeer extends BasePeer {
   private permissionMode: PermissionMode;
-  private nativeApprovalPolicy: unknown;
-  private approvalOverridden = false;
-  private readonly restoringApprovals = new Set<string | number>();
+  private readonly nativeApprovalPolicies = new Map<string, unknown>();
+  private readonly overriddenApprovals = new Set<string>();
+  private readonly restoringApprovals = new Map<string | number, string>();
   private proc: ChildProcess | undefined;
   private server: Server<Link> | undefined;
   private link: Link | undefined; // the connection that owns the current thread
@@ -84,7 +84,7 @@ export class CodexPeer extends BasePeer {
   private freshThread = false;
   private readonly activeTurns = new Set<string>();
   private nextId = -1;
-  private readonly pending = new Map<number, { resolve: (result?: any) => void; reject: (e: Error) => void; deliveryId?: string; kind?: "deliver" | "steer" }>();
+  private readonly pending = new Map<number, { resolve: (result?: any) => void; reject: (e: Error) => void; deliveryId?: string; kind?: "deliver" | "steer"; expectedTurnId?: string; afterTurn?: () => void }>();
   private usageTimer: ReturnType<typeof setInterval> | undefined;
   private injected: Envelope | undefined; // the hub envelope that started the current turn, if any
   private answering: Envelope[] = []; // everything delivered or steered into the current turn: who its answer is for
@@ -191,7 +191,6 @@ export class CodexPeer extends BasePeer {
       this.pending.set(id, {
         deliveryId, kind: "deliver",
         resolve: (result) => {
-          if (this.restoringApprovals.delete(id) && this.permissionMode === "ask") this.approvalOverridden = false;
           this.primed = true;
           this.injected = replyParent(envs);
           this.answering = [...envs];
@@ -229,12 +228,35 @@ export class CodexPeer extends BasePeer {
       return Promise.reject(new Error(`${this.id} has no steerable turn`));
     }
     const id = this.nextId--;
+    const expectedEpoch = this.contextEpoch;
     this.steers.add(id);
     return new Promise<void>((resolve, reject) => {
+      let timer: ReturnType<typeof setTimeout> | undefined;
+      const settle = () => { clearTimeout(timer); this.steers.delete(id); };
+      const fail = (e: Error) => {
+        settle();
+        if (deliveryId) this.delivery({ id: deliveryId, state: this.knownRejection(e) ? "failed_safe" : "needs_review", reason: e.message });
+        reject(e);
+      };
       this.pending.set(id, {
-        deliveryId, kind: "steer",
-        resolve: () => {
-          this.steers.delete(id);
+        deliveryId, kind: "steer", expectedTurnId,
+        afterTurn: deliveryId ? () => {
+          if (timer !== undefined) return;
+          timer = setTimeout(() => {
+            const pending = this.pending.get(id);
+            this.pending.delete(id);
+            pending?.reject(new Error("steer unanswered: RPC timeout"));
+          }, this.opts.steerTimeoutMs ?? 10_000);
+          timer.unref?.();
+        } : undefined,
+        resolve: (result) => {
+          // Native completion can precede the RPC answer. A late refusal is definitive; a late acceptance is uncertain.
+          if (deliveryId && (this.link !== link || this.contextEpoch !== expectedEpoch || !this.activeTurns.has(expectedTurnId) ||
+            (typeof result?.turnId === "string" && result.turnId !== expectedTurnId))) {
+            fail(new Error("steer accepted after its original native turn ended or changed"));
+            return;
+          }
+          settle();
           this.primed = true;
           // The turn now answers these too; the highest hop wins so a steer cannot reset the hop cap.
           this.injected = replyParent(this.injected ? [this.injected, ...envs] : envs);
@@ -245,11 +267,7 @@ export class CodexPeer extends BasePeer {
           }
           resolve();
         },
-        reject: (e) => {
-          this.steers.delete(id);
-          if (deliveryId) this.delivery({ id: deliveryId, state: this.knownRejection(e) ? "failed_safe" : "needs_review", reason: e.message });
-          reject(e);
-        },
+        reject: fail,
       });
       const input = [{ type: "text", text: this.render(envs) }];
       link.up.send(JSON.stringify({ method: "turn/steer", id, params: { threadId: this.threadId, expectedTurnId, input } }));
@@ -300,6 +318,16 @@ export class CodexPeer extends BasePeer {
     }
   }
 
+  /** An ended native turn bounds only its unanswered durable steers; legacy steers retain their immediate retry. */
+  private endSteers(turnId: string | undefined): void {
+    for (const id of this.steers) {
+      const pending = this.pending.get(id);
+      if (!pending || pending.expectedTurnId !== turnId) continue;
+      if (pending.deliveryId) pending.afterTurn?.();
+      else { this.pending.delete(id); pending.reject(new Error("steer unanswered: turn completed")); }
+    }
+  }
+
   private addTurnDelivery(turnId: string, deliveryId: string): void {
     const ids = this.turnDeliveries.get(turnId) ?? new Set<string>();
     ids.add(deliveryId); this.turnDeliveries.set(turnId, ids); this.unboundDeliveries.delete(deliveryId);
@@ -364,8 +392,8 @@ export class CodexPeer extends BasePeer {
     this.contextEpoch++;
     this.activeTurns.clear();
     for (const p of this.pending.values()) {
-      if (p.deliveryId) this.delivery({ id: p.deliveryId, state: "needs_review", reason: "Codex TUI detached" });
-      p.reject(new Error("codex TUI detached"));
+      if (p.deliveryId && p.kind !== "steer") this.delivery({ id: p.deliveryId, state: "needs_review", reason: "Codex TUI detached" });
+      p.reject(new Error(p.kind === "steer" ? "Codex TUI detached" : "codex TUI detached"));
     }
     this.pending.clear();
     for (const ids of this.turnDeliveries.values()) for (const id of ids) this.delivery({ id, state: "needs_review", reason: "Codex TUI detached" });
@@ -388,44 +416,50 @@ export class CodexPeer extends BasePeer {
 
   /** Reconcile the daemon's current choice after startup, before the returned proxy URL has a TUI. */
   setStartupPermissionMode(mode: PermissionMode): void {
-    if (this.link || this.state !== "offline" || this.approvalOverridden) throw new Error("codex startup mode reconciliation requires a fresh unattached proxy");
+    if (this.link || this.state !== "offline" || this.overriddenApprovals.size) throw new Error("codex startup mode reconciliation requires a fresh unattached proxy");
     this.permissionMode = mode;
   }
 
-  /**
-   * The hub's choice was cleared while no TUI is attached: this proxy sends no override from now on. Returns false
-   * when an override it already sent cannot be undone on that thread (its native policy was never reported): a thread
-   * started or resumed through the proxy afterwards reports its own policy, and that one is left alone.
-   */
+  /** Clear the overlay while detached, retaining each thread's restoration debt across a resume. */
   clearPermissionMode(): boolean {
-    const restorable = !this.approvalOverridden || this.nativeApprovalPolicy !== undefined;
+    const restorable = [...this.overriddenApprovals].every(thread => this.nativeApprovalPolicies.has(thread));
     this.permissionMode = "ask";
     return restorable;
   }
 
   async setPermissionMode(mode: PermissionMode): Promise<void> {
     if (!this.link || this.link.up.readyState !== WebSocket.OPEN) throw new Error("codex permission mode unavailable: attach the TUI through ahub codex first");
-    if (mode === "ask" && this.approvalOverridden && this.nativeApprovalPolicy === undefined) throw new Error("codex cannot restore ask: native approval policy unavailable; restart the Codex session");
+    if (mode === "ask" && [...this.overriddenApprovals].some(thread => !this.nativeApprovalPolicies.has(thread))) throw new Error("codex cannot restore ask: native approval policy unavailable; close the TUI, then run ahub permission codex ask before you restart the Codex session with ahub codex");
     this.permissionMode = mode;
   }
 
   private applyPermissionPolicy(params: Record<string, unknown>, id: string | number): Record<string, unknown> {
+    const thread = typeof params.threadId === "string" ? params.threadId : this.threadId;
     if (this.permissionMode !== "ask") {
-      this.approvalOverridden = true;
+      this.overriddenApprovals.add(thread);
       return { ...params, approvalPolicy: this.permissionMode === "never-ask" ? "never" : "on-request" };
     }
-    if (this.permissionMode === "ask" && this.approvalOverridden) {
-      this.restoringApprovals.add(id);
-      return { ...params, approvalPolicy: this.nativeApprovalPolicy };
+    if (this.overriddenApprovals.has(thread) && this.nativeApprovalPolicies.has(thread)) {
+      this.restoringApprovals.set(id, thread);
+      return { ...params, approvalPolicy: this.nativeApprovalPolicies.get(thread) };
     }
     return params;
   }
 
+  private settlePermissionRestore(id: string | number, failed: boolean): void {
+    const thread = this.restoringApprovals.get(id);
+    this.restoringApprovals.delete(id);
+    if (thread !== undefined && !failed && this.permissionMode === "ask") this.overriddenApprovals.delete(thread);
+  }
+
   private fromTui(link: Link, raw: string): void {
     const msg = parse(raw);
     if (msg?.method === "turn/start" && msg.params && link === this.link) {
-      if (msg.params.approvalPolicy != null) this.nativeApprovalPolicy = msg.params.approvalPolicy;
-      if (this.permissionMode !== "ask" || this.approvalOverridden) {
+      const thread = typeof msg.params.threadId === "string" ? msg.params.threadId : this.threadId;
+      // A resumed TUI can echo the sticky hub overlay. The restoring turn must use the kept baseline.
+      const restoring = this.overriddenApprovals.has(thread) && this.nativeApprovalPolicies.has(thread);
+      if (msg.params.approvalPolicy != null && !restoring) this.nativeApprovalPolicies.set(thread, msg.params.approvalPolicy);
+      if (this.permissionMode !== "ask" || this.overriddenApprovals.has(thread)) {
         // Native turn overrides persist: ask restores the captured native policy once on successful admission.
         msg.params = this.applyPermissionPolicy(msg.params, msg.id);
         raw = JSON.stringify(msg);
@@ -441,6 +475,7 @@ export class CodexPeer extends BasePeer {
     if (this.state === "busy") this.touch();
     if (!msg) return void link.tui.send(raw);
 
+    if (msg.id !== undefined && !msg.method) this.settlePermissionRestore(msg.id, !!msg.error);
     if (typeof msg.id === "number" && msg.id < 0 && !msg.method) {
       const p = this.pending.get(msg.id);
       this.pending.delete(msg.id);
@@ -448,14 +483,13 @@ export class CodexPeer extends BasePeer {
       else p?.resolve(msg.result);
       return; // ours: the TUI never asked for it
     }
-    if (msg.id !== undefined && !msg.method && this.restoringApprovals.delete(msg.id) && !msg.error && this.permissionMode === "ask") this.approvalOverridden = false;
     if (typeof msg.result?.userAgent === "string") this.version = /^[^/\s]+\/(\d+\.\d+\.\d+(?:-[\w.]+)?)/.exec(msg.result.userAgent)?.[1] ?? this.version;
     const tracked = msg.id !== undefined && !msg.method ? link.tracked.get(msg.id) : undefined;
     if (tracked && link.tracked.delete(msg.id)) {
       if (typeof msg.result?.thread?.id === "string") {
-        this.nativeApprovalPolicy = msg.result?.approvalPolicy;
-        this.approvalOverridden = false;
-        this.restoringApprovals.clear();
+        // A resumed response may report the sticky hub override, not the original native choice.
+        const thread = msg.result.thread.id;
+        if (!this.overriddenApprovals.has(thread) && msg.result.approvalPolicy != null) this.nativeApprovalPolicies.set(thread, msg.result.approvalPolicy);
         this.adopt(link, msg.result.thread.id, tracked === "thread/start");
       }
     }
@@ -465,6 +499,7 @@ export class CodexPeer extends BasePeer {
 
   private adopt(link: Link, threadId: unknown, fresh = false): void {
     if (typeof threadId !== "string" || !threadId) return;
+    this.abandonSteers("thread changed");
     this.tokenTotal = undefined;
     this.freshThread = fresh;
     this.link = link;
@@ -554,8 +589,8 @@ export class CodexPeer extends BasePeer {
       if (params.turn?.status === "failed") {
         this.opts.log?.(`[${this.id}] turn failed: ${params.turn.error?.message ?? "unknown error"}`);
       }
+      this.endSteers(nativeTurn);
       if (this.activeTurns.size) return;
-      this.abandonSteers("turn completed");
       if (typeof nativeTurn === "string") {
         for (const id of this.turnDeliveries.get(nativeTurn) ?? []) this.delivery({ id, state: params.turn?.status === "failed" ? "needs_review" : "completed", ...(params.turn?.status === "failed" ? { reason: params.turn?.error?.message ?? "Codex turn failed" } : {}) });
         this.turnDeliveries.delete(nativeTurn);

package/src/adapters/local-worker.ts

@@ -8,7 +8,7 @@ import { renderDigest, replyAudience, replyParent, STANDING_INSTRUCTION, USER, t
 import { CONDUCTOR_TOOL_NAMES, CONDUCTOR_TOOLS, TASK_TOOL_NAMES, TASK_TOOLS } from "../hub/hub-tools.ts";
 import { BasePeer } from "../hub/peers.ts";
 import { profile, proxyEnv, type SandboxNetwork } from "../local/sandbox.ts";
-import { runTool, toolResultFailed, TOOL_SCHEMAS, touchedPaths, type ToolContext } from "../local/tools.ts";
+import { runTool, toolResultFailed, TOOL_SCHEMAS, touchedPaths, ApprovalWaitStop, type ToolApproval, type ApprovalProvenance, type ToolContext } from "../local/tools.ts";
 import type { Capture } from "../memory/capture.ts";
 import type { ChatMessage, ChatResult, OmniRoute, ToolCall } from "../omniroute/client.ts";
 import { safeModelLabel } from "../omniroute/usage.ts";
@@ -32,6 +32,7 @@ export interface LocalOptions {
   onRouteOutcome?: (event: RouteLabelEvent) => void;
   /** The daemon turn id created synchronously on busy, shared with turn_start/end. */
   turnId?: () => string | undefined;
+  onApprovalStop?: (reason: string) => void;
   onTool?: (observation: ToolObservation, task?: string) => void;
   tools: { deny: string[]; permit: ToolContext["permit"]; bashNetwork?: SandboxNetwork; readAllow?: string[] };
   capture?: Capture;
@@ -85,6 +86,9 @@ export class LocalPeer extends BasePeer {
   private abort: AbortController | undefined;
   private budgetTimer?: ReturnType<typeof setTimeout>;
   private budgetStopReason = "";
+  private approvalExpiries = 0;
+  private approvalAnswerEpoch: number | undefined;
+  private approvalStopReason = "";
   private activeDeliveryId: string | undefined;
   private readonly sandboxProfile: string; // built once: profile() spawns git and must stay off the per-call path
   /** What served the last call, for `ahub status`. */
@@ -127,15 +131,15 @@ export class LocalPeer extends BasePeer {
     this.setState("idle");
   }
 
-  async stop(): Promise<void> {
+  async stop(reason?: string): Promise<void> {
     this.endRouteTurn(this.labelTurnId, "failed");
-    if (this.activeDeliveryId) this.delivery({ id: this.activeDeliveryId, state: "needs_review", reason: "turn stopped before settlement" });
+    if (this.activeDeliveryId) this.delivery({ id: this.activeDeliveryId, state: "needs_review", reason: reason ?? "turn stopped before settlement" });
     this.activeDeliveryId = undefined;
     this.turn++;
     clearTimeout(this.budgetTimer); this.budgetTimer = undefined;
     this.abort?.abort();
+    this.setState("offline"); // fence direct delivery before the bounded memory request awaits
     await this.opts.capture?.end();
-    this.setState("offline");
   }
 
   /** Resolves once the turn is claimed; a turn that cannot reach any model hands the envelopes back through onFailed. */
@@ -146,6 +150,7 @@ export class LocalPeer extends BasePeer {
     }
     const turn = ++this.turn;
     this.budgetStopReason = "";
+    this.approvalExpiries = 0; this.approvalAnswerEpoch = undefined; this.approvalStopReason = "";
     clearTimeout(this.budgetTimer); this.budgetTimer = undefined;
     this.activeDeliveryId = deliveryId;
     this.abort = new AbortController();
@@ -172,6 +177,14 @@ export class LocalPeer extends BasePeer {
       })
       .catch((e: Error) => {
         if (turn !== this.turn) return; // aborted by the watchdog or stop(): nothing to report, nothing was committed
+        if (e instanceof ApprovalWaitStop) {
+          this.completeMissingToolResults(msgs, "not run: turn ended after unanswered approvals");
+          msgs.push({ role: "assistant", content: e.message });
+          if (!policy?.pii) this.commit(msgs);
+          this.onMessage?.(e.message, reply);
+          if (deliveryId && this.activeDeliveryId === deliveryId) this.delivery({ id: deliveryId, state: "completed", reason: e.message });
+          return; // even without effects, an unanswered approval must not trigger safe replay
+        }
         if (this.budgetStopReason && !(e instanceof ExecutionBudgetStop)) e = new ExecutionBudgetStop(this.budgetStopReason);
         this.opts.log?.(`[${this.id}] turn failed: ${e.message}`);
         if (e instanceof ExecutionBudgetStop) {
@@ -263,6 +276,7 @@ export class LocalPeer extends BasePeer {
           if (SIDE_EFFECTS.has(call.function.name) && !output.startsWith("error:")) progress.sideEffects++;
           const result: ChatMessage = { role: "tool", tool_call_id: call.id, content: output, is_error: toolResultFailed(name, output) };
           msgs.push(result); results.push(result);
+          if (this.approvalStopReason) { this.abort?.abort(); throw new ApprovalWaitStop(this.approvalStopReason); }
           this.observeTool(call, output, policy, `${this.sessionId}.${turn}.${step}`);
           // Hub tool arguments/results are not capture evidence; Tasks owns its screened memory writes.
           if (name !== "hub_send" && !TASK_TOOL_NAMES.has(name) && !CONDUCTOR_TOOL_NAMES.has(name)) capture?.observe({ tool: call.function.name, args: call.function.arguments, output, id: call.id, paths: touchedPaths(call.function.name, safeParse(call.function.arguments)) });
@@ -277,14 +291,34 @@ export class LocalPeer extends BasePeer {
     return {
       cwd: this.opts.cwd,
       deny: this.opts.tools.deny,
-      permit: async (title, tool, _signal, path) => {
-        if (turnSignal.aborted) return false;
-        return new Promise<boolean>((resolve, reject) => {
-          const finish = (allowed: boolean) => { turnSignal.removeEventListener("abort", onAbort); resolve(allowed); };
-          const onAbort = () => finish(false);
+      permit: async (title, tool, _signal, canonicalTarget) => {
+        if (turnSignal.aborted) return "aborted";
+        const generation = this.turn;
+        let observed = false;
+        const observe = (provenance: ApprovalProvenance) => {
+          observed = true;
+          if (generation !== this.turn || turnSignal.aborted || this.approvalStopReason) return;
+          if (this.approvalAnswerEpoch !== provenance.answerEpoch) {
+            this.approvalExpiries = 0; this.approvalAnswerEpoch = provenance.answerEpoch;
+          }
+          if (provenance.source === "person") this.approvalExpiries = 0;
+          if (provenance.source === "expired" && provenance.eligibleExpiry !== false && ++this.approvalExpiries >= 2) {
+            this.approvalStopReason = "Local turn stopped after two unanswered approvals; no person answered. Do not retry the calls; inspect prior work before handoff or stopping.";
+            try { this.opts.onApprovalStop?.(this.approvalStopReason); } catch { /* stop remains authoritative */ }
+          }
+        };
+        const picked = await new Promise<ToolApproval>((resolve, reject) => {
+          const finish = (decision: ToolApproval) => { turnSignal.removeEventListener("abort", onAbort); resolve(decision); };
+          const onAbort = () => finish("aborted");
           turnSignal.addEventListener("abort", onAbort, { once: true });
-          this.opts.tools.permit(title, tool, turnSignal, path).then(finish, (error) => { turnSignal.removeEventListener("abort", onAbort); reject(error); });
+          this.opts.tools.permit(title, tool, turnSignal, canonicalTarget, observe).then(finish, (error) => { turnSignal.removeEventListener("abort", onAbort); reject(error); });
         });
+        if (generation !== this.turn || (turnSignal.aborted && picked !== "expired")) return "aborted";
+        // Legacy permit callbacks can represent a person's denial without provenance. A true
+        // result may be automatic, so it must never reset the unanswered-request streak.
+        if (!observed && picked === false) observe({ source: "person", answerEpoch: (this.approvalAnswerEpoch ?? 0) + 1 });
+        if (!observed && picked === "expired") observe({ source: "expired", answerEpoch: this.approvalAnswerEpoch ?? 0, eligibleExpiry: true });
+        return picked;
       },
       sandboxProfile: this.sandboxProfile,
       sandboxEnv: { ...proxyEnv(this.opts.tools.bashNetwork ?? false), AGENTHUB_PEER_ID: this.id },