@tea-agent/loop-agent 0.23.1 → 0.24.0

package/dist/worker/console/dag-confirmation.js

@@ -1,6 +1,7 @@
 import { createHash, randomBytes } from "node:crypto";
 import path from "node:path";
 import { readJsonIfExists, sha256Utf8, writeSecureJson, } from "./app-data.js";
+import { confirmationPayloadHash, issueHumanGateToken, verifyHumanGateToken, } from "./human-gate-token.js";
 export const ALL_CONFIRMATION_CHALLENGES = [
     "source",
     "writer-scope",
@@ -88,8 +89,15 @@ function detectBindingDrift(rec, current) {
 }
 export class DagConfirmationStore {
     appData;
-    constructor(appData) {
+    humanGateSecret;
+    constructor(appData, 
+    /**
+     * M0-B: per-process HMAC secret for human-gate tokens
+     * (BootCapabilityToken.confirmationToken). Required for prepare/confirm.
+     */
+    humanGateSecret) {
         this.appData = appData;
+        this.humanGateSecret = humanGateSecret;
     }
     async get(confirmationId) {
         const rec = await readJsonIfExists(confirmationPath(this.appData, confirmationId));
@@ -114,15 +122,28 @@ export class DagConfirmationStore {
         const now = input.now ?? new Date();
         const ttl = input.ttlMs ?? DEFAULT_CONFIRMATION_TTL_MS;
         const confirmationId = newConfirmationId();
+        const dagSha256 = hashDagBytes(input.dagBytes);
+        const expiresAt = new Date(now.getTime() + ttl).toISOString();
+        // M0-B: issue a server-signed human-gate token bound to the confirmation's
+        // payloadHash. The browser must present it at confirm; dispatch verifies
+        // the signature so a model cannot self-confirm.
+        const payloadHash = confirmationPayloadHash({
+            dagSha256,
+            sourceBindingSha256: input.sourceBindingSha256,
+            taskContractBindingCanonical: JSON.stringify(input.taskContractBinding),
+            controllerFingerprint: input.controllerFingerprint,
+            validationResultSha256: input.validationResultSha256,
+        });
+        const humanGateToken = issueHumanGateToken({ confirmationId, payloadHash, expiresAt }, this.humanGateSecret, now);
         const rec = {
             schemaVersion: 1,
             confirmationId,
             state: "prepared",
             preparedAt: now.toISOString(),
-            expiresAt: new Date(now.getTime() + ttl).toISOString(),
+            expiresAt,
             operatorSessionId: input.operatorSessionId,
             dagHandle: input.dagHandle,
-            dagSha256: hashDagBytes(input.dagBytes),
+            dagSha256,
             dagBytesPath: input.dagBytesPath,
             sourceBindingSha256: input.sourceBindingSha256,
             taskContractBinding: input.taskContractBinding,
@@ -130,6 +151,7 @@ export class DagConfirmationStore {
             validationResultSha256: input.validationResultSha256,
             confirmedWriterScopes: input.confirmedWriterScopes ?? [],
             confirmedChallenges: [],
+            humanGateToken,
             reviewPacket: input.reviewPacket,
         };
         await writeSecureJson(confirmationPath(this.appData, confirmationId), rec);
@@ -195,14 +217,25 @@ export class DagConfirmationStore {
                 confirmation: stale,
             };
         }
-        const required = new Set(ALL_CONFIRMATION_CHALLENGES);
-        for (const c of input.challenges)
-            required.delete(c);
-        if (required.size > 0) {
+        // M0-B / roadmap G03: verify the human-gate token's HMAC signature. The
+        // old fixed-string challenge set (`source`/`writer-scope`/...) was a fake
+        // gate — a model could fill those strings directly. Now the browser must
+        // present the server-signed token issued at prepare; the signature binds
+        // (confirmationId + payloadHash + expiresAt) and is verified with the
+        // per-process boot secret. A model-side call has no way to forge it.
+        const payloadHash = confirmationPayloadHash({
+            dagSha256: current.dagSha256,
+            sourceBindingSha256: current.sourceBindingSha256,
+            taskContractBindingCanonical: JSON.stringify(current.taskContractBinding),
+            controllerFingerprint: current.controllerFingerprint,
+            validationResultSha256: current.validationResultSha256,
+        });
+        const tokenCheck = verifyHumanGateToken(input.humanGateToken, { confirmationId: input.confirmationId, payloadHash }, this.humanGateSecret, input.now);
+        if (!tokenCheck.ok) {
             return {
                 ok: false,
                 code: "HUMAN_CONFIRMATION_REQUIRED",
-                message: `missing confirmation challenges: ${[...required].join(", ")}`,
+                message: `human-gate token verification failed: ${tokenCheck.code} — ${tokenCheck.message}`,
                 confirmation: rec,
             };
         }
@@ -212,6 +245,7 @@ export class DagConfirmationStore {
             state: "confirmed",
             confirmedAt: now.toISOString(),
             confirmedChallenges: [...ALL_CONFIRMATION_CHALLENGES],
+            humanGateToken: input.humanGateToken ?? rec.humanGateToken,
         };
         await writeSecureJson(confirmationPath(this.appData, rec.confirmationId), confirmed);
         return { ok: true, confirmation: confirmed };

package/dist/worker/console/human-gate-token.js

@@ -0,0 +1,130 @@
+/**
+ * Operator Chat — Human Gate confirmation token (roadmap M0-B / G03).
+ *
+ * Closes the "fake human gate" gap (roadmap §3.2 risk 1): the old
+ * confirmDagConfirmation only checked that a FIXED set of challenge strings
+ * (`source`/`writer-scope`/`verification`/`human-gates`) was present — a model
+ * could fill those in directly and self-confirm. This module issues a
+ * server-signed token bound to (confirmationId, payloadHash, expiresAt) and
+ * verifies its HMAC signature at dispatch time, so confirmation can only
+ * originate from the browser mutation gate that received the signed token.
+ *
+ * The HMAC key is the per-process boot confirmation secret
+ * (BootCapabilityToken.confirmationToken). This binds the human-gate token to
+ * the same Console boot session that the browser established via the HttpOnly
+ * cookie — a model-side tool call cannot fabricate it.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** Canonical message string covered by the signature. */
+export function canonicalTokenMessage(p) {
+    return [
+        `v1`,
+        `confirmationId=${p.confirmationId}`,
+        `payloadHash=${p.payloadHash}`,
+        `expiresAt=${p.expiresAt}`,
+    ].join("\n");
+}
+function b64url(buf) {
+    return buf.toString("base64url");
+}
+/** Issue a signed token. `secret` = BootCapabilityToken.confirmationToken. */
+export function issueHumanGateToken(payload, secret, now = new Date()) {
+    const sig = createHmac("sha256", secret).update(canonicalTokenMessage(payload)).digest();
+    return {
+        ...payload,
+        signature: b64url(sig),
+        issuedAt: now.toISOString(),
+    };
+}
+/**
+ * Verify a presented token. Checks signature, expiry, and that the token is
+ * bound to the given confirmationId + current payloadHash. Constant-time
+ * signature compare. Returns a typed failure (no thrown secrets).
+ */
+export function verifyHumanGateToken(presented, expected, secret, now = new Date()) {
+    if (!presented || typeof presented !== "object") {
+        return { ok: false, code: "MISSING_TOKEN", message: "no human-gate token presented" };
+    }
+    if (presented.confirmationId !== expected.confirmationId) {
+        return {
+            ok: false,
+            code: "CONFIRMATION_MISMATCH",
+            message: "token is bound to a different confirmationId",
+        };
+    }
+    if (presented.payloadHash !== expected.payloadHash) {
+        return {
+            ok: false,
+            code: "PAYLOAD_MISMATCH",
+            message: "token payloadHash does not match the current confirmation bindings",
+        };
+    }
+    const expectedSig = createHmac("sha256", secret)
+        .update(canonicalTokenMessage(presented))
+        .digest();
+    let presentedSig;
+    try {
+        presentedSig = Buffer.from(presented.signature, "base64url");
+    }
+    catch {
+        return { ok: false, code: "INVALID_SIGNATURE", message: "signature is not valid base64url" };
+    }
+    if (presentedSig.length !== expectedSig.length ||
+        !timingSafeEqual(presentedSig, expectedSig)) {
+        return { ok: false, code: "INVALID_SIGNATURE", message: "signature verification failed" };
+    }
+    if (Date.parse(presented.expiresAt) <= now.getTime()) {
+        return { ok: false, code: "EXPIRED", message: "token has expired" };
+    }
+    return { ok: true, token: presented };
+}
+/**
+ * Compute the payloadHash for a confirmation receipt: SHA-256 over the binding
+ * snapshot (dagSha256 + sourceBindingSha256 + taskContractBinding canonical +
+ * controllerFingerprint + validationResultSha256). Changing any binding
+ * invalidates the token (defense against drift-then-confirm).
+ */
+import { createHash } from "node:crypto";
+import { sha256Utf8 } from "./app-data.js";
+export function confirmationPayloadHash(b) {
+    const canonical = [
+        `dag=${b.dagSha256}`,
+        `source=${b.sourceBindingSha256}`,
+        `contract=${sha256Utf8(b.taskContractBindingCanonical)}`,
+        `controller=${b.controllerFingerprint}`,
+        `validation=${b.validationResultSha256}`,
+    ].join("\n");
+    return createHash("sha256").update(canonical).digest("hex");
+}
+/** Stable contract-apply binding; revision and observed hash prevent drift-then-confirm. */
+export function contractApplyPayloadHash(b) {
+    const canonical = [
+        "v1-contract-apply",
+        `taskId=${b.taskId}`,
+        `revision=${b.revision}`,
+        `canonicalHash=${b.canonicalHash}`,
+        `draftSha256=${b.draftSha256}`,
+        `expectedObservedHash=${b.expectedObservedHash}`,
+    ].join("\n");
+    return createHash("sha256").update(canonical).digest("hex");
+}
+/** Stable mutation-gate binding; params are canonical-JSON with sorted keys. */
+export function mutationGatePayloadHash(b) {
+    const paramsCanonical = stableJson(b.actionParams);
+    const canonical = [
+        "v1-mutation-gate",
+        `action=${b.action}`,
+        `operatorSessionId=${b.operatorSessionId}`,
+        `actionParams=${paramsCanonical}`,
+    ].join("\n");
+    return createHash("sha256").update(canonical).digest("hex");
+}
+function stableJson(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map((entry) => stableJson(entry)).join(",")}]`;
+    const obj = value;
+    const keys = Object.keys(obj).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${stableJson(obj[key])}`).join(",")}}`;
+}

package/dist/worker/console/mutation-gate-receipt-store.js

@@ -0,0 +1,184 @@
+/**
+ * Lightweight Human Gate receipts for mutation actions that are not DAG-bound
+ * (standaloneTaskRerun / workerTaskRetry). Mirrors contract-apply receipt
+ * semantics with an atomic prepared → dispatching → dispatched state machine
+ * so concurrent confirm POSTs cannot create duplicate operations.
+ */
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import path from "node:path";
+export class MutationGateReceiptStore {
+    dir;
+    constructor(appData) {
+        this.dir = path.join(appData.root, "mutation-gate-receipts");
+    }
+    file(id) {
+        return path.join(this.dir, `${id.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
+    }
+    async prepare(input) {
+        const receipt = {
+            schemaVersion: 1,
+            state: "prepared",
+            ...input,
+        };
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        await writeFile(this.file(receipt.receiptId), `${JSON.stringify(receipt, null, 2)}\n`, { mode: 0o600 });
+        return receipt;
+    }
+    async get(id) {
+        try {
+            return JSON.parse(await readFile(this.file(id), "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    /**
+     * Atomically claim a prepared receipt for dispatch.
+     * Concurrent callers: only one gets reserved=true; others see
+     * already-dispatching / already-dispatched with the same receipt.
+     */
+    async tryReserve(id) {
+        const receipt = await this.get(id);
+        if (!receipt) {
+            return {
+                ok: false,
+                code: "NOT_FOUND",
+                message: `mutation gate receipt not found: ${id}`,
+            };
+        }
+        if (Date.parse(receipt.expiresAt) <= Date.now()) {
+            return {
+                ok: false,
+                code: "EXPIRED",
+                message: "mutation gate receipt expired",
+                receipt,
+            };
+        }
+        if (receipt.state === "dispatching") {
+            return {
+                ok: true,
+                receipt,
+                reserved: false,
+                reason: "already-dispatching",
+            };
+        }
+        if (receipt.state === "dispatched") {
+            return {
+                ok: true,
+                receipt,
+                reserved: false,
+                reason: "already-dispatched",
+            };
+        }
+        if (receipt.state !== "prepared") {
+            return {
+                ok: false,
+                code: "INVALID_STATE",
+                message: `mutation gate receipt is ${receipt.state}`,
+                receipt,
+            };
+        }
+        const next = {
+            ...receipt,
+            state: "dispatching",
+            reservedAt: new Date().toISOString(),
+        };
+        const claimed = await this.compareAndSwap(id, "prepared", next);
+        if (!claimed.ok) {
+            const current = claimed.current;
+            if (current?.state === "dispatching") {
+                return {
+                    ok: true,
+                    receipt: current,
+                    reserved: false,
+                    reason: "already-dispatching",
+                };
+            }
+            if (current?.state === "dispatched") {
+                return {
+                    ok: true,
+                    receipt: current,
+                    reserved: false,
+                    reason: "already-dispatched",
+                };
+            }
+            return {
+                ok: false,
+                code: "INVALID_STATE",
+                message: `mutation gate receipt raced into ${current?.state ?? "missing"}`,
+                receipt: current,
+            };
+        }
+        return { ok: true, receipt: next, reserved: true };
+    }
+    async markDispatched(id, operationId) {
+        const receipt = await this.get(id);
+        if (!receipt)
+            throw new Error(`receipt not found: ${id}`);
+        const next = {
+            ...receipt,
+            state: "dispatched",
+            operationId,
+            dispatchedAt: new Date().toISOString(),
+        };
+        await writeFile(this.file(id), `${JSON.stringify(next, null, 2)}\n`, {
+            mode: 0o600,
+        });
+        return next;
+    }
+    /** Best-effort unlock if dispatch failed after reserve. */
+    async releaseToPrepared(id) {
+        const receipt = await this.get(id);
+        if (!receipt || receipt.state !== "dispatching")
+            return receipt;
+        const next = {
+            ...receipt,
+            state: "prepared",
+            reservedAt: undefined,
+        };
+        await writeFile(this.file(id), `${JSON.stringify(next, null, 2)}\n`, {
+            mode: 0o600,
+        });
+        return next;
+    }
+    async compareAndSwap(id, expectedState, next) {
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        const target = this.file(id);
+        const lockPath = `${target}.lock`;
+        try {
+            await writeFile(lockPath, `${process.pid}\n`, { flag: "wx", mode: 0o600 });
+        }
+        catch (error) {
+            if (error.code === "EEXIST") {
+                // Brief spin for the other writer; then re-read.
+                await new Promise((r) => setTimeout(r, 25));
+                return { ok: false, current: await this.get(id) };
+            }
+            throw error;
+        }
+        try {
+            const current = await this.get(id);
+            if (!current || current.state !== expectedState) {
+                return { ok: false, current };
+            }
+            const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
+            await writeFile(tmp, `${JSON.stringify(next, null, 2)}\n`, {
+                mode: 0o600,
+            });
+            await rename(tmp, target);
+            return { ok: true };
+        }
+        finally {
+            try {
+                await writeFile(lockPath, "", { flag: "w" });
+                const { unlink } = await import("node:fs/promises");
+                await unlink(lockPath);
+            }
+            catch {
+                // lock cleanup is best-effort
+            }
+        }
+    }
+}

package/dist/worker/console/operation-runner.js

@@ -155,15 +155,19 @@ function coerceEnvelope(result) {
 /** Fire-and-forget scheduler for accepted operations. */
 export function scheduleOperation(operationId, deps) {
     void runOperation(operationId, deps).catch((error) => {
+        const message = error instanceof Error ? error.message : String(error);
         void deps.store
             .update(operationId, {
             state: "needs-reconcile",
             finishedAt: new Date().toISOString(),
             errorCode: "OPERATION_NEEDS_RECONCILE",
-            errorMessage: error instanceof Error ? error.message : String(error),
+            errorMessage: message,
+        })
+            .then((updated) => {
+            stateEvent(deps.events, updated, "needs-reconcile", message);
         })
             .catch(() => {
-            // ignore secondary failures
+            // A failed canonical store update cannot be represented safely.
         });
     });
 }

package/dist/worker/console/operation-sse.js

@@ -13,6 +13,7 @@ export function createOperationEventStore(options) {
     if (persistenceDir)
         ensureSecureDir(persistenceDir);
     const rings = new Map();
+    const subscribers = new Map();
     function persistedPath(operationId) {
         return persistenceDir
             ? path.join(persistenceDir, `${safeOperationId(operationId)}.json`)
@@ -91,6 +92,17 @@ export function createOperationEventStore(options) {
                 ring.minSeq = ring.events[0].seq;
             }
             persist(operationId, ring);
+            const listeners = subscribers.get(operationId);
+            if (listeners) {
+                for (const listener of listeners) {
+                    try {
+                        listener(event);
+                    }
+                    catch {
+                        // Subscriber failures must never break the canonical append path.
+                    }
+                }
+            }
             return event;
         },
         listFrom(operationId, afterSeq) {
@@ -112,8 +124,22 @@ export function createOperationEventStore(options) {
                 rings.set(operationId, ring);
             return ring?.events.slice() ?? [];
         },
+        subscribe(operationId, listener) {
+            let listeners = subscribers.get(operationId);
+            if (!listeners) {
+                listeners = new Set();
+                subscribers.set(operationId, listeners);
+            }
+            listeners.add(listener);
+            return () => {
+                listeners?.delete(listener);
+                if (listeners?.size === 0)
+                    subscribers.delete(operationId);
+            };
+        },
         clear(operationId) {
             rings.delete(operationId);
+            subscribers.delete(operationId);
             const file = persistedPath(operationId);
             if (file)
                 rmSync(file, { force: true });