@stigmer/runner 3.15.1 → 3.15.2-dev.20260913223433

package/src/activities/execute-deep-agent/command-provenance.ts

@@ -1,102 +0,0 @@
-/**
- * Approved-command turn provenance (DD-28) — the DEEP-AGENT (native) harness
- * adapter over the shared qualification rule ({@link qualifyTurnCommandProvenance}).
- *
- * The deep-agent's consent model differs from Cursor's in exactly two ways, and
- * this adapter is precisely those two differences:
- *
- * 1. IDENTITY turn scoping (not positional). Cursor scopes a turn by the message
- *    index its stream started at. The deep-agent cannot: an approved command
- *    executes IN PLACE at its seeded transcript position (it was proposed in a
- *    prior segment, seeded into this segment, and updated to COMPLETED by
- *    `StatusBuilder.findResumableSeededToolCall`). So "this turn's calls" are
- *    those whose id is absent from a pre-stream {@link collectSettledToolCallIds}
- *    snapshot, and "executed" is a COMPLETED status.
- *
- * 2. SAME-ROW direct consent (not a grant token). A gated deep-agent tool pauses
- *    on a LangGraph interrupt; SubmitApproval writes `approval_action` onto that
- *    same row, and the row keeps its id + `approval_action` when it executes on
- *    resume. So the executed command IS its own consent row — cite its own id.
- *    (The server's PreserveApprovalFields keeps that `approval_action` on the row
- *    across the status write regardless of its new status, so the backend's
- *    verification finds it.)
- *
- * A turn that delegated ANY sub-agent fails closed (DD-28 D1: "delegated zero
- * sub-agents"). A sub-agent's writes fold into the parent turn's change set
- * (DD-19) but are not attributable to a consented top-level command. The
- * top-level `task` call (a SUBAGENT kind) already trips the shared rule's
- * `!== SHELL` fail-closed; the explicit sub-agent-novelty guard below also covers
- * the (currently-impossible under the replace-per-turn model) case of a sub-agent
- * that mutates across a turn boundary without a fresh top-level `task` row.
- *
- * (Trust boundary + fail-closed contract: see the shared module.)
- */
-
-import {
-  ApprovalAction,
-  ToolCallStatus,
-} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
-import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
-import type { TurnCommandProvenance } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/filereview_pb";
-import { qualifyTurnCommandProvenance } from "../../shared/filereview/command-provenance.js";
-import { collectSubAgentToolCallIds } from "../../shared/tool-row.js";
-
-export interface DeepAgentCommandProvenanceInputs {
-  /** The status at capture time — top-level messages + sub-agent executions. */
-  readonly status: AgentExecutionStatus;
-  /**
-   * The top-level tool-call ids that had already SETTLED before this turn's
-   * stream (from {@link collectSettledToolCallIds}). A top-level call whose id is
-   * absent is this-turn's; the shared rule then keeps only the COMPLETED ones.
-   */
-  readonly priorSettledToolCallIds: ReadonlySet<string>;
-  /**
-   * The sub-agent tool-call ids that existed before this turn's stream (from
-   * {@link collectSubAgentToolCallIds}). Any growth means a sub-agent acted this
-   * turn → fail closed.
-   */
-  readonly priorSubAgentToolCallIds: ReadonlySet<string>;
-  /** True when the pre-armed spec.auto_approve_all bypassed the gate. */
-  readonly globalBypass: boolean;
-}
-
-/**
- * Derive the {@link TurnCommandProvenance} for a deep-agent turn, or undefined
- * when it does not qualify. Scopes this turn's top-level calls by id-novelty,
- * resolves consent from the row's own server-authored `approval_action`, fails
- * closed on any sub-agent activity, and delegates the DD-28 rule to
- * {@link qualifyTurnCommandProvenance}.
- */
-export function deriveTurnCommandProvenance(
-  inputs: DeepAgentCommandProvenanceInputs,
-): TurnCommandProvenance | undefined {
-  const { status, priorSettledToolCallIds, priorSubAgentToolCallIds, globalBypass } = inputs;
-
-  // DD-28 D1 cond 2: any sub-agent activity this turn disqualifies. A sub-agent
-  // that ran this turn contributes at least one tool-call id absent from the
-  // pre-stream snapshot.
-  for (const id of collectSubAgentToolCallIds(status.subAgentExecutions)) {
-    if (!priorSubAgentToolCallIds.has(id)) return undefined;
-  }
-
-  const messages = status.messages;
-  // This turn's top-level calls: those not already settled before the stream.
-  const turnToolCalls = messages
-    .flatMap((m) => m.toolCalls)
-    .filter((tc) => !priorSettledToolCallIds.has(tc.id));
-
-  return qualifyTurnCommandProvenance({
-    turnToolCalls,
-    messages,
-    // A deep-agent command executed iff its row reached COMPLETED this turn.
-    isExecutedCommand: (tc) => tc.status === ToolCallStatus.TOOL_CALL_COMPLETED,
-    // The gated command carries its own server-authored approval_action, written
-    // in place by SubmitApproval and preserved when the row executes on resume.
-    resolveDirectConsent: (tc) =>
-      tc.approvalAction === ApprovalAction.APPROVE ||
-      tc.approvalAction === ApprovalAction.APPROVE_ALL
-        ? tc.id
-        : undefined,
-    globalBypass,
-  });
-}

package/src/activities/execute-deep-agent/environment.ts

@@ -1,76 +0,0 @@
-/**
- * Environment variable resolution for deep agent execution.
- *
- * Resolves the merged environment from ExecutionContext — the single
- * source of truth for execution-scoped variables. The workflow injects
- * all resolved variables into ExecutionContext before the activity starts.
- *
- * The returned result separates plaintext keys from secret keys so that
- * downstream consumers (e.g., StatusBuilder in Phase 3b) can redact
- * secret values in user-facing displays.
- */
-
-import type { StigmerClient } from "../../client/stigmer-client.js";
-
-export interface EnvironmentResult {
-  readonly mergedEnvVars: Record<string, string>;
-  readonly secretKeys: ReadonlySet<string>;
-}
-
-/**
- * Fetch the ExecutionContext for the given execution and extract the
- * merged environment variables.
- *
- * If no ExecutionContext exists (e.g., the agent has no environment or
- * secrets configured), returns an empty result so execution can proceed.
- */
-export async function resolveEnvironment(
-  client: StigmerClient,
-  executionId: string,
-): Promise<EnvironmentResult> {
-  // A desktop runner exchanges its bootstrap credential for a token scoped to
-  // this execution's session, so cloud's decrypt gate binds the read (#156).
-  // No-op for cloud sandbox and OSS runners. A failed exchange throws and
-  // fails the activity: the bootstrap credential no longer decrypts
-  // (stigmer-cloud#218), so proceeding would resolve redacted placeholders.
-  const scopedToken = await client.acquireScopedRunnerToken({
-    agentExecutionId: executionId,
-  });
-
-  let execCtx;
-  try {
-    execCtx = await client.getExecutionContextByExecutionId(executionId, scopedToken);
-  } catch (err: unknown) {
-    // ConnectError uses numeric Code.NotFound (5); match the pattern
-    // from shared/env-resolver.ts.
-    const code = (err as { code?: number | string })?.code;
-    if (code === 5 || code === "not_found" || code === "NOT_FOUND") {
-      console.log(
-        `[env] No ExecutionContext found for execution ${executionId} — ` +
-        `proceeding with empty environment.`,
-      );
-      return { mergedEnvVars: {}, secretKeys: new Set() };
-    }
-    throw err;
-  }
-
-  const mergedEnvVars: Record<string, string> = {};
-  const secretKeys = new Set<string>();
-
-  const data = execCtx.spec?.data;
-  if (data) {
-    for (const [key, execValue] of Object.entries(data)) {
-      mergedEnvVars[key] = execValue.value;
-      if (execValue.isSecret) {
-        secretKeys.add(key);
-      }
-    }
-  }
-
-  console.log(
-    `[env] Resolved environment: env_count=${Object.keys(mergedEnvVars).length}, ` +
-    `secret_count=${secretKeys.size}`,
-  );
-
-  return { mergedEnvVars, secretKeys };
-}

package/src/activities/execute-deep-agent/event-recorder.ts

@@ -1,95 +0,0 @@
-/**
- * V2 event recorder for capturing raw streamEvents v2 data.
- *
- * Activated by the V2_EVENT_RECORD_DIR environment variable. When set,
- * the streaming loop records every raw event and flushes them atomically
- * to a JSON file after the stream completes.
- *
- * This is test/development infrastructure for the v3 streaming migration.
- * The captured events serve as a reference for building the
- * V3ProtocolNormalizer and validating event shape mappings.
- */
-
-import { writeFile, mkdir } from "node:fs/promises";
-import { join } from "node:path";
-import type { StreamEvent } from "./status-builder.js";
-
-interface RecordedEvent {
-  readonly seq: number;
-  readonly timestamp: string;
-  readonly event: string;
-  readonly name: string | undefined;
-  readonly run_id: string;
-  readonly data: Record<string, unknown>;
-  readonly metadata: Record<string, unknown> | undefined;
-}
-
-export interface V2EventRecorder {
-  record(event: StreamEvent, seq: number): void;
-  flush(): Promise<void>;
-}
-
-/**
- * Create a recorder if V2_EVENT_RECORD_DIR is set, otherwise return undefined.
- * The caller does `recorder?.record(event, seq)` — zero overhead when off.
- */
-export function createV2EventRecorder(
-  executionId: string,
-  recordDir: string | undefined,
-): V2EventRecorder | undefined {
-  if (!recordDir) return undefined;
-  return new FileV2EventRecorder(executionId, recordDir);
-}
-
-class FileV2EventRecorder implements V2EventRecorder {
-  private readonly events: RecordedEvent[] = [];
-
-  constructor(
-    private readonly executionId: string,
-    private readonly outputDir: string,
-  ) {}
-
-  record(event: StreamEvent, seq: number): void {
-    this.events.push({
-      seq,
-      timestamp: new Date().toISOString(),
-      event: event.event,
-      name: event.name,
-      run_id: event.run_id,
-      data: safeClone(event.data),
-      metadata: event.metadata ? safeClone(event.metadata) : undefined,
-    });
-  }
-
-  async flush(): Promise<void> {
-    if (this.events.length === 0) return;
-
-    await mkdir(this.outputDir, { recursive: true });
-
-    const filePath = join(
-      this.outputDir,
-      `${this.executionId}.v2-events.json`,
-    );
-
-    const payload = {
-      executionId: this.executionId,
-      recordedAt: new Date().toISOString(),
-      eventCount: this.events.length,
-      events: this.events,
-    };
-
-    await writeFile(filePath, JSON.stringify(payload, bigintReplacer, 2));
-  }
-}
-
-function safeClone(obj: Record<string, unknown>): Record<string, unknown> {
-  try {
-    return JSON.parse(JSON.stringify(obj, bigintReplacer));
-  } catch {
-    return { _serializationError: true, keys: Object.keys(obj) };
-  }
-}
-
-function bigintReplacer(_key: string, value: unknown): unknown {
-  return typeof value === "bigint" ? value.toString() : value;
-}