@tea-agent/loop-agent 0.28.1 → 0.28.2

package/dist/worker/run-task/execute-prepared-task.js

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import { access, readFile } from "node:fs/promises";
+import path from "node:path";
+import { controllerIdentityExpectationFailure, resolveControllerIdentity, } from "../loop-agent/loop-agent-client.js";
+import { buildWorkerRunId, } from "./run-task.js";
+/**
+ * Consume a frozen night admission: do not materialize/generate DAG.
+ * Verifies workspace + gate token, then runs `task advance --approve-gate`
+ * with cwd = workspaceRoot.
+ */
+export async function executePreparedTaskSpec(options) {
+    const now = options.now ?? new Date();
+    const admission = options.admission;
+    if (!admission.harnessTaskId) {
+        throw new Error("executePreparedTask: admission.harnessTaskId required");
+    }
+    if (!admission.gateApproval?.token || !admission.gateApproval.approvedAt) {
+        throw new Error("executePreparedTask: approved admission gate receipt required");
+    }
+    if (!admission.workspace?.path) {
+        throw new Error("executePreparedTask: admission.workspace required");
+    }
+    const controllerIdentity = resolveControllerIdentity(options.client, options.controllerIdentity ??
+        admission.controllerIdentity);
+    const identityFailure = controllerIdentityExpectationFailure(controllerIdentity, options.controllerExpectation);
+    if (identityFailure) {
+        throw new Error(`${identityFailure.code}: ${identityFailure.message}`);
+    }
+    // Fail closed: never run on control root when workspace differs.
+    const workspaceRoot = path.resolve(options.workspaceRoot);
+    const controlRoot = path.resolve(options.controlRepoRoot);
+    if (workspaceRoot === controlRoot) {
+        throw new Error("executePreparedTask: refusing to run on controlRepoRoot (night isolation required)");
+    }
+    const expectedWorkspaceRoot = path.resolve(controlRoot, admission.workspace.path);
+    if (workspaceRoot !== expectedWorkspaceRoot) {
+        throw new Error(`executePreparedTask: workspace binding mismatch (expected ${expectedWorkspaceRoot}, got ${workspaceRoot})`);
+    }
+    assertWithinRoot(path.resolve(controlRoot, ".worktrees"), workspaceRoot, "night workspace");
+    await access(workspaceRoot);
+    if (options.verifyAdmissionHashes !== false) {
+        if (!admission.dag?.path || !admission.dag.sha256) {
+            throw new Error("executePreparedTask: frozen DAG hash is required");
+        }
+        await verifyFrozenWorkspaceFile(workspaceRoot, admission.dag.path, admission.dag.sha256, "DAG");
+        if (admission.taskSpec) {
+            await verifyFrozenWorkspaceFile(workspaceRoot, admission.taskSpec.path, admission.taskSpec.sha256, "TaskSpec");
+        }
+        if (admission.taskGraph) {
+            await verifyFrozenWorkspaceFile(workspaceRoot, admission.taskGraph.path, admission.taskGraph.sha256, "TaskGraph");
+        }
+    }
+    const workerRunId = options.workerRunId ?? buildWorkerRunId(admission.taskId, now);
+    const gateToken = admission.gateApproval.token;
+    const advance = options.executeGate ??
+        (async (input) => options.client.run([
+            "task",
+            "advance",
+            input.harnessTaskId,
+            "--approve-gate",
+            input.gateToken,
+            "--json",
+        ], {
+            cwd: input.workspaceRoot,
+            artifactName: `night-execute-${input.workerRunId}`,
+            expectJson: true,
+        }));
+    const advanceResult = await advance({
+        workspaceRoot,
+        harnessTaskId: admission.harnessTaskId,
+        gateToken,
+        workerRunId,
+    });
+    const succeeded = isAdvanceSuccess(advanceResult);
+    const status = succeeded ? "succeeded" : "failed";
+    const dagPath = admission.dag?.path
+        ? path.isAbsolute(admission.dag.path)
+            ? admission.dag.path
+            : path.join(workspaceRoot, admission.dag.path)
+        : path.join(workspaceRoot, ".harness", "tasks", admission.harnessTaskId, "dag.json");
+    const runRecordPath = path.join(workspaceRoot, ".harness", "tasks", admission.harnessTaskId, "artifacts", "worker-run-record.json");
+    return {
+        status,
+        workerRunId,
+        businessId: admission.taskId,
+        harnessTaskId: admission.harnessTaskId,
+        runRecordPath,
+        dagPath,
+        reportDecision: {
+            succeeded,
+            reason: succeeded
+                ? "prepared-execute-gate-consumed"
+                : "prepared-execute-failed",
+            ...(advanceResult.exitCode !== null &&
+                advanceResult.exitCode !== undefined
+                ? { runStatus: `exit-${advanceResult.exitCode}` }
+                : {}),
+        },
+        workspaceRoot,
+        admissionScheduleId: admission.scheduleId,
+        gateTokenConsumed: gateToken,
+    };
+}
+async function verifyFrozenWorkspaceFile(workspaceRoot, fileRef, expectedSha256, label) {
+    if (path.isAbsolute(fileRef)) {
+        throw new Error(`executePreparedTask: ${label} path must be workspace-relative`);
+    }
+    const absolutePath = path.resolve(workspaceRoot, fileRef);
+    assertWithinRoot(workspaceRoot, absolutePath, label);
+    try {
+        const bytes = await readFile(absolutePath);
+        const actual = createHash("sha256").update(bytes).digest("hex");
+        const expected = expectedSha256.replace(/^sha256:/, "");
+        if (actual !== expected) {
+            throw new Error(`executePreparedTask: ${label} hash drift (admission ${expectedSha256}, actual sha256:${actual})`);
+        }
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.includes("hash drift")) {
+            throw error;
+        }
+        throw new Error(`executePreparedTask: cannot verify ${label} at ${absolutePath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function assertWithinRoot(root, candidate, label) {
+    const relative = path.relative(path.resolve(root), path.resolve(candidate));
+    if (relative.length === 0 ||
+        relative.startsWith("..") ||
+        path.isAbsolute(relative)) {
+        throw new Error(`executePreparedTask: ${label} escapes its allowed root`);
+    }
+}
+function isAdvanceSuccess(result) {
+    if (result.ok)
+        return true;
+    // Mirror run-task terminal failure semantics loosely: non-zero with
+    // lifecycle terminal payload still counts as completed attempt (failed).
+    const root = result.json;
+    if (!root || typeof root !== "object")
+        return false;
+    const envelope = root;
+    const payload = envelope.result && typeof envelope.result === "object"
+        ? envelope.result
+        : envelope;
+    const lifecycle = typeof payload.lifecycleState === "string"
+        ? payload.lifecycleState
+        : typeof payload.status === "string"
+            ? payload.status
+            : "";
+    if (/success|succeeded|done|completed/i.test(lifecycle))
+        return true;
+    return false;
+}

package/dist/worker/runner/single-task-attempt.js

@@ -0,0 +1,147 @@
+import { deriveFailureRoute, deriveFailureRouteFromError, } from "../pool/failure-routing.js";
+import { recordTaskPoolRun, writeTaskPoolState } from "../pool/run-store.js";
+/**
+ * Shared Worker attempt used by batch run-ready and Night Scheduler.
+ * Owns Task Pool Running/Done/Failed projection + run record; does not select tasks.
+ */
+export async function runSingleTaskAttempt(input) {
+    const now = input.ctx.now ?? new Date();
+    const { ctx } = input;
+    await writeTaskPoolState(ctx.controlRepoRoot, {
+        schemaVersion: 2,
+        featureId: ctx.featureId,
+        taskId: ctx.taskId,
+        status: "Running",
+        updatedAt: now.toISOString(),
+        workerRunId: ctx.workerRunId,
+        ...(ctx.night?.nightScheduleId
+            ? { nightScheduleId: ctx.night.nightScheduleId }
+            : {}),
+        ...(ctx.night?.admissionPath
+            ? { admissionPath: ctx.night.admissionPath }
+            : {}),
+        ...(ctx.night?.nightWorktreePath
+            ? { nightWorktreePath: ctx.night.nightWorktreePath }
+            : {}),
+        ...(ctx.night?.nightBranch ? { nightBranch: ctx.night.nightBranch } : {}),
+    });
+    let result;
+    try {
+        result = await input.execute(ctx);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const failure = deriveFailureRouteFromError(message, ctx.taskId);
+        const run = {
+            schemaVersion: 1,
+            batchRunId: ctx.batchRunId,
+            workerRunId: ctx.workerRunId,
+            taskId: ctx.taskId,
+            featureId: ctx.featureId,
+            status: "run-error",
+            recordedAt: new Date().toISOString(),
+            error: message,
+            failure,
+            ...(ctx.controllerIdentity
+                ? { controllerIdentity: ctx.controllerIdentity }
+                : {}),
+        };
+        await recordTaskPoolRun({
+            repoRoot: ctx.controlRepoRoot,
+            run,
+        });
+        // Restore night fields after recordTaskPoolRun overwrites state from run.
+        await writeTaskPoolState(ctx.controlRepoRoot, {
+            schemaVersion: 2,
+            featureId: ctx.featureId,
+            taskId: ctx.taskId,
+            status: "Failed",
+            updatedAt: new Date().toISOString(),
+            workerRunId: ctx.workerRunId,
+            failure,
+            ...(ctx.night?.nightScheduleId
+                ? { nightScheduleId: ctx.night.nightScheduleId }
+                : {}),
+            ...(ctx.night?.admissionPath
+                ? { admissionPath: ctx.night.admissionPath }
+                : {}),
+            ...(ctx.night?.nightWorktreePath
+                ? { nightWorktreePath: ctx.night.nightWorktreePath }
+                : {}),
+            ...(ctx.night?.nightBranch ? { nightBranch: ctx.night.nightBranch } : {}),
+        });
+        return {
+            status: "run-error",
+            workerRunId: ctx.workerRunId,
+            run,
+            error: message,
+        };
+    }
+    const failure = result.outcomeFailure
+        ? {
+            category: result.outcomeFailure.category,
+            recommendedFollowUpKind: "manual-review",
+            derivedFollowUpTaskId: `${ctx.taskId}-outcome-contract-review`,
+            source: "report-decision",
+        }
+        : deriveFailureRoute(result);
+    const run = {
+        schemaVersion: 1,
+        batchRunId: ctx.batchRunId,
+        workerRunId: result.workerRunId,
+        taskId: result.businessId,
+        featureId: ctx.featureId,
+        status: result.status,
+        harnessTaskId: result.harnessTaskId,
+        runRecordPath: result.runRecordPath,
+        dagPath: result.dagPath,
+        recordedAt: new Date().toISOString(),
+        ...(failure ? { failure } : {}),
+        ...(result.failureArtifacts
+            ? { failureArtifacts: result.failureArtifacts }
+            : {}),
+        ...(ctx.controllerIdentity
+            ? { controllerIdentity: ctx.controllerIdentity }
+            : {}),
+        ...(result.workflow ? { workflow: result.workflow } : {}),
+        ...(result.outcome
+            ? {
+                outcomePath: result.outcome.outcomePath,
+                outcomeSha256: result.outcome.outcomeSha256,
+            }
+            : {}),
+    };
+    await recordTaskPoolRun({
+        repoRoot: ctx.controlRepoRoot,
+        run,
+    });
+    const terminalStatus = result.status === "succeeded" ? "Done" : "Failed";
+    const poolState = {
+        schemaVersion: 2,
+        featureId: ctx.featureId,
+        taskId: ctx.taskId,
+        status: terminalStatus,
+        updatedAt: new Date().toISOString(),
+        workerRunId: result.workerRunId,
+        lastRunRecordPath: result.runRecordPath,
+        ...(failure ? { failure } : {}),
+        ...(ctx.night?.nightScheduleId
+            ? { nightScheduleId: ctx.night.nightScheduleId }
+            : {}),
+        ...(ctx.night?.admissionPath
+            ? { admissionPath: ctx.night.admissionPath }
+            : {}),
+        ...(ctx.night?.nightWorktreePath
+            ? { nightWorktreePath: ctx.night.nightWorktreePath }
+            : {}),
+        ...(ctx.night?.nightBranch ? { nightBranch: ctx.night.nightBranch } : {}),
+    };
+    await writeTaskPoolState(ctx.controlRepoRoot, poolState);
+    return {
+        status: result.status,
+        workerRunId: result.workerRunId,
+        run,
+        result,
+        poolState,
+    };
+}