@staix/agent-hub 0.19.0 → 0.20.0

package/src/hub/ci-watch.ts

@@ -0,0 +1,140 @@
+import { parsePrEvidence, type SdlcGh } from "./sdlc.ts";
+
+/**
+ * #785 P1b: one bounded watcher per exact PR head. It starts when `hub_task_done` names a head whose CI was not green,
+ * ends on the first CI result or on this deadline, and is cancelled by a newer head or any task move. It is a timer in the
+ * hub, never a peer turn, and its gh reads (one `gh pr view` per poll) are the only periodic gh calls the hub makes.
+ * The longest hosted run is about 30 minutes (the job limits in `.github/workflows/check.yml` are 35 and 40 minutes).
+ */
+export const CI_WATCH_DEADLINE_MS = 45 * 60_000;
+export const CI_WATCH_POLL_MS = 60_000;
+/** Same default set as `readReviewReadiness`, which is the authoritative read the review admission makes. */
+const DEFAULT_CHECKS = ["check (ubuntu-latest)", "check (macos-latest)", "seeded guards"];
+const REPO = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+/** How many finished heads are remembered, so one head never notifies twice. */
+const SETTLED_CAP = 256;
+
+/** What one poll found. `incomplete` is every required check finished with none failed and not all passed (skipped, neutral, duplicated). */
+export type CiPoll = "pending" | "passed" | "failed" | "incomplete" | "superseded" | "closed";
+export type CiOutcome = "passed" | "failed" | "incomplete" | "deadline";
+
+export interface CiWatch { id: number; head: string; repo: string; pr: number; deadlineAt: number }
+
+/** One read of the PR: the head, its state and the required checks of that head. A failed or unreadable read is `pending`; the deadline bounds the retries. */
+export async function pollCi(target: { repo: string; pr: number }, head: string, required: readonly string[], run: SdlcGh): Promise<CiPoll> {
+  if (!REPO.test(target.repo) || !Number.isSafeInteger(target.pr) || target.pr < 1) return "closed";
+  try {
+    const view = await run(["pr", "view", String(target.pr), "--repo", target.repo, "--json", "headRefOid,state,statusCheckRollup"], 10_000, undefined, 512 * 1024);
+    if (view.code !== 0) return "pending";
+    const body = JSON.parse(view.stdout);
+    if (body?.headRefOid !== head) return "superseded";
+    if (body.state !== "OPEN") return "closed";
+    // The same check-state mapping as every other PR read; files are not requested here.
+    const evidence = parsePrEvidence({ ...body, files: [], changedFiles: 0 });
+    const rows = (required.length ? required : DEFAULT_CHECKS).map(name => evidence.checks.filter(check => check.name === name));
+    if (rows.some(row => row.some(check => check.state === "failed"))) return "failed";
+    if (rows.some(row => row.length === 0 || row.some(check => check.state === "pending"))) return "pending";
+    return rows.every(row => row.length === 1 && row[0]!.state === "passed") ? "passed" : "incomplete";
+  } catch { return "pending"; }
+}
+
+export interface CiWatchersOptions {
+  deadlineMs?: number;
+  pollMs?: number;
+  now?: () => number;
+  poll: (watch: CiWatch) => Promise<CiPoll>;
+  /** False once the task moved or its head changed: the watcher ends without a notice. */
+  current: (watch: CiWatch) => boolean;
+  finish: (watch: CiWatch, outcome: CiOutcome) => void | Promise<void>;
+}
+
+/**
+ * At most one watcher per task, and one per exact head. Timers are chained `setTimeout`s (never an interval), unref'd, and cleared
+ * on every end, so nothing outlives its deadline, a newer head or `stopAll`. Watchers are not restored after a hub restart:
+ * the next `hub_task_done` starts one (ponytail: persist them only if restarts during CI turn out to be common).
+ */
+export class CiWatchers {
+  private readonly active = new Map<number, { watch: CiWatch; timer?: ReturnType<typeof setTimeout> }>();
+  private readonly settled = new Map<number, { head: string; outcome: CiOutcome }>();
+  private readonly deadlineMs: number;
+  private readonly pollMs: number;
+  private readonly now: () => number;
+
+  constructor(private readonly o: CiWatchersOptions) {
+    this.deadlineMs = o.deadlineMs ?? CI_WATCH_DEADLINE_MS;
+    this.pollMs = o.pollMs ?? CI_WATCH_POLL_MS;
+    this.now = o.now ?? Date.now;
+  }
+
+  get size(): number { return this.active.size; }
+
+  /** Starts a watcher for this exact head; false when this head is already watched or already reported. A different head replaces the old watcher. */
+  start(target: { id: number; head: string; repo: string; pr: number }): boolean {
+    const have = this.active.get(target.id);
+    if (have?.watch.head === target.head || this.settled.get(target.id)?.head === target.head) return false;
+    if (have) this.cancel(target.id);
+    const entry: { watch: CiWatch; timer?: ReturnType<typeof setTimeout> } = { watch: { ...target, deadlineAt: this.now() + this.deadlineMs } };
+    this.active.set(target.id, entry);
+    this.schedule(entry);
+    return true;
+  }
+
+  /** The result already reported for this exact head, if any. */
+  outcomeOf(id: number, head: string): CiOutcome | undefined {
+    const done = this.settled.get(id);
+    return done?.head === head ? done.outcome : undefined;
+  }
+
+  /** Ends the task's watcher (a given head only when `head` is named). No notice. */
+  cancel(id: number, head?: string): void {
+    const entry = this.active.get(id);
+    if (!entry || head !== undefined && entry.watch.head !== head) return;
+    clearTimeout(entry.timer);
+    this.active.delete(id);
+  }
+
+  stopAll(): void {
+    for (const entry of this.active.values()) clearTimeout(entry.timer);
+    this.active.clear();
+  }
+
+  private schedule(entry: { watch: CiWatch; timer?: ReturnType<typeof setTimeout> }): void {
+    const delay = Math.max(0, Math.min(this.pollMs, entry.watch.deadlineAt - this.now()));
+    entry.timer = setTimeout(() => { void this.tick(entry); }, delay);
+    entry.timer.unref?.();
+  }
+
+  private end(entry: { watch: CiWatch; timer?: ReturnType<typeof setTimeout> }): boolean {
+    if (this.active.get(entry.watch.id) !== entry) return false;
+    clearTimeout(entry.timer);
+    this.active.delete(entry.watch.id);
+    return true;
+  }
+
+  private report(entry: { watch: CiWatch }, outcome: CiOutcome): void {
+    if (outcome !== "deadline") {
+      this.settled.delete(entry.watch.id);
+      this.settled.set(entry.watch.id, { head: entry.watch.head, outcome });
+      while (this.settled.size > SETTLED_CAP) this.settled.delete(this.settled.keys().next().value as number);
+    }
+    void Promise.resolve().then(() => this.o.finish(entry.watch, outcome)).catch(() => { /* the finisher guards its own notices */ });
+  }
+
+  /** A watcher never throws out of its timer: a `current` or `finish` that fails (a closed board at shutdown) ends it. */
+  private async tick(entry: { watch: CiWatch; timer?: ReturnType<typeof setTimeout> }): Promise<void> {
+    try { await this.step(entry); } catch { this.end(entry); }
+  }
+
+  private async step(entry: { watch: CiWatch; timer?: ReturnType<typeof setTimeout> }): Promise<void> {
+    entry.timer = undefined;
+    if (this.active.get(entry.watch.id) !== entry) return;
+    if (!this.o.current(entry.watch)) { this.end(entry); return; }
+    if (this.now() >= entry.watch.deadlineAt) { if (this.end(entry)) this.report(entry, "deadline"); return; }
+    let result: CiPoll;
+    try { result = await this.o.poll(entry.watch); } catch { result = "pending"; }
+    if (this.active.get(entry.watch.id) !== entry) return; // cancelled or replaced during the read
+    if (!this.o.current(entry.watch) || result === "superseded" || result === "closed") { this.end(entry); return; }
+    if (result === "pending") { this.schedule(entry); return; }
+    if (this.end(entry)) this.report(entry, result);
+  }
+}

package/src/hub/claude-launch-proof.ts

@@ -1,8 +1,12 @@
 import { closeSync, fstatSync, openSync, readSync, constants } from "node:fs";
 import { isAbsolute, join } from "node:path";
 import { claudeStateFile } from "./claude-state.ts";
+import { readFileSync } from "node:fs";
+import { isWsPeer, type WsPeer } from "../adapters/channel-peer.ts";
+import { isFixedBuiltinDefinition, type AdapterDefinition } from "../adapters/registry.ts";
+import type { PeerAdapter } from "./peers.ts";
 
-export interface ClaudeLaunchProof {
+export interface ClaudeLaunchRecordProof {
   launchId: string;
   executionCwd?: string;
   privateRecord: boolean;
@@ -12,7 +16,7 @@ export interface ClaudeLaunchProof {
 }
 
 /** One bounded reader for current managed launch metadata; no native identity or payload escapes. */
-export function readClaudeLaunchProof(stateDir: string, peer: string, instanceId: string): ClaudeLaunchProof | undefined {
+export function readClaudeLaunchProof(stateDir: string, peer: string, instanceId: string): ClaudeLaunchRecordProof | undefined {
   let fd: number | undefined;
   try {
     fd = openSync(join(stateDir, claudeStateFile("claude-launch", peer)), constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -31,3 +35,64 @@ export function readClaudeLaunchProof(stateDir: string, peer: string, instanceId
   } catch { return; }
   finally { if (fd !== undefined) closeSync(fd); }
 }
+
+/** Host-only launch and socket-generation evidence; adapter-reported generations cannot establish it. */
+export interface ClaudeLaunchProof {
+  permissionLaunch(peer: string): { launchId: string; unattended: boolean; hookPurpose?: string } | undefined;
+  helloLaunch(peer: string, launchId: unknown): "admit" | "refuse";
+  expectedLaunch(peer: string): string | undefined;
+  owner(peer: string): WsPeer | undefined;
+  bindGeneration(peer: string, generation: string): void;
+  verified(peer: string): boolean;
+}
+
+export function createClaudeLaunchProof(opts: {
+  stateDir: string;
+  cwd: string;
+  instanceId: string;
+  definitionOf(peer: string): AdapterDefinition | undefined;
+  peer(peer: string): PeerAdapter | undefined;
+}): ClaudeLaunchProof {
+  const generations = new Map<string, string>();
+  function channel(peer: string): boolean {
+    const definition = opts.definitionOf(peer);
+    return isFixedBuiltinDefinition(definition) && definition?.transport === "claude-channel";
+  }
+  function owner(peer: string): WsPeer | undefined {
+    if (!channel(peer)) return;
+    const current = opts.peer(peer);
+    return isWsPeer(current) ? current : undefined;
+  }
+  function permissionLaunch(peer: string): ReturnType<ClaudeLaunchProof["permissionLaunch"]> {
+    if (!channel(peer)) return;
+    const row = readClaudeLaunchProof(opts.stateDir, peer, opts.instanceId);
+    return row?.permissionHook ? row : undefined;
+  }
+  function helloLaunch(peer: string, launchId: unknown): "admit" | "refuse" {
+    if (!channel(peer) || launchId === undefined) return "admit";
+    let currentLaunch: unknown;
+    try {
+      const launch = readClaudeLaunchProof(opts.stateDir, peer, opts.instanceId);
+      if (launch) currentLaunch = launch.launchId;
+    } catch { /* No current launch evidence: retain plain/pre-daemon attachment compatibility. */ }
+    return currentLaunch !== undefined && launchId !== currentLaunch ? "refuse" : "admit";
+  }
+  function expectedLaunch(peer: string): string | undefined {
+    if (!channel(peer)) return;
+    let expectedLaunch: string | undefined;
+    try {
+      const rows = JSON.parse(readFileSync(join(opts.stateDir, "terminal-recovery.json"), "utf8"));
+      expectedLaunch = Array.isArray(rows) ? rows.find(row => row?.peer === peer && opts.definitionOf(row.peer)?.transport === "claude-channel" && row?.projectRoot === opts.cwd && row?.instanceId === opts.instanceId)?.launchId : undefined;
+    } catch { /* an ordinary terminal has no Orca recovery identity */ }
+    try {
+      const launch = readClaudeLaunchProof(opts.stateDir, peer, opts.instanceId);
+      if (launch) expectedLaunch = launch.launchId;
+    } catch { /* older/manual launches do not have a launcher marker */ }
+    return expectedLaunch;
+  }
+  return {
+    permissionLaunch, helloLaunch, expectedLaunch, owner,
+    bindGeneration(peer, generation) { if (owner(peer)) generations.set(peer, generation); },
+    verified(peer) { const current = owner(peer); return !!current && generations.get(peer) === current.sessionGeneration; },
+  };
+}

package/src/hub/config-apply.ts

@@ -175,7 +175,7 @@ const schema: Record<string, Check> = {
   omniroute: block({ urls: strings, api_key_file: text, access_hosts: strings, cf_client_id_file: text, cf_client_secret_file: text }),
   mlx: block({ enabled: bool, provider: words(["legacy", "ollama"]), host: text, runtimeDir: text, modelPath: text, bin: text, port: number(1, 65535, true), model: text, sourceModel: text,
     contextWindow: number(1), maxInputTokens: number(1), maxTokens: number(1), maxConcurrency: number(1, 1024, true) }),
-  approvals: block({ timeout_s: timerSeconds, notify: bool }), tasks: block({ release_after_min: number(0), wip_limits: map(number(0, 32, true)), escalate_after: number(1, 10, true) }),
+  approvals: block({ timeout_s: timerSeconds, notify: bool }), tasks: block({ release_after_min: number(0), wip_limits: map(number(0, 32, true)), escalate_after: number(1, 10, true), auto_pull: bool }),
   task_sweep: (v, k) => { block({ enabled: bool, auto_reassign: bool, no_writes_turns: number(0, Number.MAX_SAFE_INTEGER, true), interval_s: timerSeconds, unaccepted_min: timerMinutes, idle_min: timerMinutes, review_min: timerMinutes, ready_min: timerMinutes, ladder_min: timerMinutes })(v, k); taskSweepConfig(v); },
   checks: (v, k) => { for (const [key, value] of Object.entries(object(v, k))) {
     if (value === undefined) continue;
@@ -230,7 +230,7 @@ const restart: Record<string, string> = {
   profile: "Session tool schemas and profile contracts are bound at startup", profile_overrides: "Session tool schemas and profile contracts are bound at startup",
   text_projection: "Converter and cache ownership are bound at startup", terminal: "Terminal provider is supplied by the daemon lifecycle", bench: "Benchmark execution environment is selected before work starts",
 };
-const live = new Set(["action_policy", "permission", "roster", "roles", "planner", "conductor", "protect_instruction_files", "task_sweep", "capabilities", "research", "snapshots", "tasks.wip_limits", "tasks.escalate_after", "approvals.notify", "pet"]);
+const live = new Set(["action_policy", "permission", "roster", "roles", "planner", "conductor", "protect_instruction_files", "task_sweep", "capabilities", "research", "snapshots", "tasks.wip_limits", "tasks.escalate_after", "tasks.auto_pull", "approvals.notify", "pet"]);
 const nextMemory = new Set(["memory.inject_tokens", "memory.brief_items", "memory.suggest_edges"]);
 /** Closed top-level schema; leaf overrides retain the existing session/runtime boundaries. */
 export function configApply(key: string, scopes: readonly ConfigIdentityScope[] = []): ApplyRule {

package/src/hub/config-trust.ts

@@ -27,6 +27,7 @@ export const MACHINE_LOCAL = [
   "local.bash_network",
   "local.network_allow", // the hosts the egress proxy opens (#65)
   "terminal.open", // the command a hub-made TUI start runs to open a terminal (#269)
+  "tasks.auto_pull", // #785 P1c: lets the hub start work on its own; a committed config may not turn it on for someone else's machine
 ] as const;
 /** Legacy exported field list stays compatible; new policies use the complete list below. */
 export const ALL_MACHINE_LOCAL = [...MACHINE_LOCAL, "action_policy", "protect_instruction_files", "qwen_cmd", "jcode_cmd", "jcode_home", "jcode_provider_profile", "adapters", "adapter_modules", "text_projection", "instances"] as const;