@tea-agent/loop-agent 0.33.6 → 0.33.7-beta.0

package/dist/worker/console/dag-execution-receipt.js

@@ -1,380 +0,0 @@
-/**
- * DAG execution receipt — session-bound, TTL, single-use autonomous DAG
- * execution (2026-08-11 design §5 / §8.3).
- *
- * `prepareDagExecution` issues an execution receipt ONLY when the server-side
- * G2 autonomous-execution assessment passes (bounded writeSet ⊆ allowedPaths,
- * no forbidden overlap, no broad/destructive risk, structured verification
- * present, valid bindings). The receipt carries no human-gate token — the
- * browser Human Gate is not part of this flow.
- *
- * `runDag` consumes the receipt exactly once. Consumption re-reads the staged
- * DAG bytes/hash and re-validates every binding (dag hash, source binding,
- * task contract binding, controller fingerprint, validation result); any
- * expiry, cross-session use, replay, or drift fails closed. Error codes reuse
- * the existing confirmation lifecycle codes (CONFIRMATION_* /
- * HUMAN_CONFIRMATION_REQUIRED / NOT_FOUND) because registry error codes are
- * immutable in this task.
- */
-import { randomBytes } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import path from "node:path";
-import { pathMatchesPattern } from "../../shared/git-progress.js";
-import { readJsonIfExists, sha256Utf8, writeSecureJson, } from "./app-data.js";
-import { hashDagBytes, } from "./dag-confirmation.js";
-export const DEFAULT_EXECUTION_RECEIPT_TTL_MS = 30 * 60 * 1000;
-function normalizePathEntry(entry) {
-    return entry.trim().replace(/\\/g, "/").replace(/^\.\//, "");
-}
-function isBroadWriteSetEntry(entry) {
-    const normalized = normalizePathEntry(entry);
-    if (!normalized || normalized === "." || normalized === "./")
-        return true;
-    if (normalized === "**")
-        return true;
-    // Placeholder marker (`REPLACE/WITH`) means the writeSet is not concrete yet.
-    return normalized.includes("REPLACE/WITH");
-}
-function isContainedInAllowed(candidate, allowedPaths) {
-    const normalized = normalizePathEntry(candidate);
-    if (!normalized)
-        return false;
-    return allowedPaths.some((allowed) => {
-        const pattern = normalizePathEntry(allowed);
-        if (!pattern || pattern === "." || pattern === "./")
-            return false;
-        return pathMatchesPattern(normalized, pattern);
-    });
-}
-function overlapsForbidden(candidate, forbiddenPaths) {
-    const normalized = normalizePathEntry(candidate);
-    if (!normalized)
-        return true;
-    return forbiddenPaths.some((forbidden) => {
-        const pattern = normalizePathEntry(forbidden);
-        if (!pattern)
-            return false;
-        return (pathMatchesPattern(normalized, pattern) ||
-            pathMatchesPattern(pattern, normalized));
-    });
-}
-/**
- * G2 deterministic autonomous-execution assessment (design §5.2). Pure and
- * exported so the dispatcher and unit tests share the exact same code path.
- * Every condition must pass — any missing fact fails closed.
- */
-export function assessAutonomousExecutionEligibility(input) {
-    const dangerous = input.dangerousMarkers ?? {};
-    if (dangerous.credentials || dangerous.destructive || dangerous.irreversible) {
-        return {
-            ok: false,
-            reason: "DAG involves credentials, destructive operations, or irreversible migration; human authorization required",
-        };
-    }
-    if (!input.hasStructuredVerification) {
-        return {
-            ok: false,
-            reason: "DAG has no structured shell verification; autonomous execution not permitted",
-        };
-    }
-    if (input.broadWriteSetRisk) {
-        return {
-            ok: false,
-            reason: "writeSet contains broad/placeholder entries; autonomous execution not permitted",
-        };
-    }
-    if (input.forbiddenOverlapRisk) {
-        return {
-            ok: false,
-            reason: "writeSet overlaps forbidden paths; autonomous execution not permitted",
-        };
-    }
-    if (!Array.isArray(input.allowedPaths) || !Array.isArray(input.forbiddenPaths)) {
-        return {
-            ok: false,
-            reason: "task boundary (allowedPaths/forbiddenPaths) unavailable; autonomous execution not permitted",
-        };
-    }
-    for (const writer of input.writersWriteSets ?? []) {
-        if (!Array.isArray(writer.writeSet))
-            continue;
-        for (const entry of writer.writeSet) {
-            if (!isContainedInAllowed(entry, input.allowedPaths)) {
-                return {
-                    ok: false,
-                    reason: `writer ${writer.nodeId} writeSet entry "${entry}" is outside allowedPaths`,
-                };
-            }
-            if (overlapsForbidden(entry, input.forbiddenPaths)) {
-                return {
-                    ok: false,
-                    reason: `writer ${writer.nodeId} writeSet entry "${entry}" overlaps forbiddenPaths`,
-                };
-            }
-        }
-    }
-    return { ok: true };
-}
-/**
- * Extract the deterministic G2 facts from a generated DAG spec (staged bytes).
- * Mirrors the CLI review-packet semantics (generate-task-dag.ts) so the
- * console never trusts client-supplied claims. Missing facts fail closed.
- */
-export function deriveEligibilityFactsFromDagSpec(input) {
-    const spec = (input.dagSpec ?? {});
-    const tasks = Array.isArray(spec.tasks) ? spec.tasks : [];
-    const defaultWritePolicy = spec.defaults?.writePolicy;
-    const resolvePolicy = (task) => task.writePolicy ?? defaultWritePolicy ?? "none";
-    const stringList = (value) => Array.isArray(value)
-        ? value.filter((v) => typeof v === "string")
-        : [];
-    const writers = tasks
-        .filter((task) => resolvePolicy(task) === "exclusive" &&
-        stringList(task.writeSet).length > 0)
-        .map((task) => ({
-        nodeId: task.id ?? "unknown",
-        writeSet: stringList(task.writeSet),
-    }));
-    const allWriteSetEntries = writers.flatMap((writer) => writer.writeSet);
-    const broadWriteSetRisk = allWriteSetEntries.some(isBroadWriteSetEntry);
-    const forbiddenOverlapRisk = tasks.some((task) => stringList(task.writeSet).some((entry) => [...stringList(task.forbiddenPaths), ...input.forbiddenPaths].some((forbidden) => pathMatchesPattern(entry, forbidden) ||
-        pathMatchesPattern(forbidden, entry))));
-    const hasStructuredVerification = tasks.some((task) => {
-        if (task.executor !== "shell" || !task.shell)
-            return false;
-        if (/verify|verification/i.test(task.id ?? ""))
-            return true;
-        const commands = stringList(task.shell.commands);
-        return commands.some((command) => /(vitest|npm run (lint|typecheck|test)|check-repo\.sh|loop-agent-standard-verify)/.test(command));
-    });
-    return {
-        writersWriteSets: writers,
-        allowedPaths: input.allowedPaths,
-        forbiddenPaths: input.forbiddenPaths,
-        broadWriteSetRisk,
-        forbiddenOverlapRisk,
-        hasStructuredVerification,
-    };
-}
-function receiptPath(appData, executionId) {
-    const dir = appData.dagReceipts ??
-        path.join(path.dirname(appData.confirmations), "dag-receipts");
-    return path.join(dir, `${executionId}.json`);
-}
-export function newExecutionId() {
-    return `exec_${randomBytes(12).toString("hex")}`;
-}
-export class DagExecutionReceiptStore {
-    appData;
-    constructor(appData) {
-        this.appData = appData;
-    }
-    async get(executionId) {
-        const rec = await readJsonIfExists(receiptPath(this.appData, executionId));
-        if (!rec)
-            return undefined;
-        return this.materializeExpiry(rec);
-    }
-    async materializeExpiry(rec, now = Date.now()) {
-        if (rec.state === "prepared" && Date.parse(rec.expiresAt) <= now) {
-            const expired = {
-                ...rec,
-                state: "expired",
-                staleReason: rec.staleReason ?? "ttl exceeded (30min default)",
-            };
-            await writeSecureJson(receiptPath(this.appData, rec.executionId), expired);
-            return expired;
-        }
-        return rec;
-    }
-    /**
-     * Issue a single-use execution receipt. G2 eligibility is re-checked here
-     * (fail closed) in addition to the dispatcher's pre-check.
-     */
-    async prepare(input) {
-        const assessment = assessAutonomousExecutionEligibility(input.eligibility);
-        if (!assessment.ok) {
-            return {
-                ok: false,
-                code: "HUMAN_CONFIRMATION_REQUIRED",
-                reason: assessment.reason,
-            };
-        }
-        if (!input.dagBytes ||
-            !input.dagBytesPath ||
-            !input.sourceBindingSha256 ||
-            !input.controllerFingerprint ||
-            !input.validationResultSha256 ||
-            !input.taskContractBinding?.taskId) {
-            return {
-                ok: false,
-                code: "INVALID_INPUT",
-                reason: "missing server-derived DAG/binding facts for execution receipt",
-            };
-        }
-        const now = input.now ?? new Date();
-        const ttl = input.ttlMs ?? DEFAULT_EXECUTION_RECEIPT_TTL_MS;
-        const executionId = newExecutionId();
-        const rec = {
-            schemaVersion: 1,
-            executionId,
-            state: "prepared",
-            preparedAt: now.toISOString(),
-            expiresAt: new Date(now.getTime() + ttl).toISOString(),
-            operatorSessionId: input.operatorSessionId,
-            taskId: input.taskId,
-            dagHandle: input.dagHandle,
-            dagSha256: hashDagBytes(input.dagBytes),
-            dagBytesPath: input.dagBytesPath,
-            sourceBindingSha256: input.sourceBindingSha256,
-            taskContractBinding: input.taskContractBinding,
-            controllerFingerprint: input.controllerFingerprint,
-            validationResultSha256: input.validationResultSha256,
-            reviewPacket: input.reviewPacket,
-        };
-        await writeSecureJson(receiptPath(this.appData, executionId), rec);
-        return { ok: true, receipt: rec };
-    }
-    /**
-     * Atomic single-use consume for runDag. Re-reads the staged DAG bytes and
-     * re-validates every binding; any drift/expiry/session/replay fails closed.
-     */
-    async consume(input) {
-        const rec = await this.get(input.executionId);
-        if (!rec) {
-            return {
-                ok: false,
-                code: "NOT_FOUND",
-                message: `execution receipt not found: ${input.executionId}`,
-            };
-        }
-        if (rec.state === "expired") {
-            return {
-                ok: false,
-                code: "CONFIRMATION_EXPIRED",
-                message: "execution receipt expired",
-                receipt: rec,
-            };
-        }
-        if (rec.state === "consumed") {
-            return {
-                ok: false,
-                code: "CONFIRMATION_CONSUMED",
-                message: "execution receipt already consumed (single-use)",
-                receipt: rec,
-            };
-        }
-        if (rec.state === "stale") {
-            return {
-                ok: false,
-                code: "CONFIRMATION_STALE",
-                message: rec.staleReason ?? "execution receipt is stale",
-                receipt: rec,
-            };
-        }
-        if (rec.state !== "prepared") {
-            return {
-                ok: false,
-                code: "HUMAN_CONFIRMATION_REQUIRED",
-                message: `execution receipt is ${rec.state}; re-prepare required`,
-                receipt: rec,
-            };
-        }
-        if (rec.operatorSessionId !== input.operatorSessionId) {
-            return {
-                ok: false,
-                code: "HUMAN_CONFIRMATION_REQUIRED",
-                message: "session mismatch; execution receipt cannot be consumed across operator sessions",
-                receipt: rec,
-            };
-        }
-        // Re-read staged DAG bytes and re-hash (fail closed on any drift).
-        let dagBytes;
-        try {
-            dagBytes = await readFile(rec.dagBytesPath, "utf8");
-        }
-        catch (error) {
-            const stale = await this.markStale(rec.executionId, `cannot re-read staged DAG bytes: ${error instanceof Error ? error.message : String(error)}`);
-            return {
-                ok: false,
-                code: "CONFIRMATION_STALE",
-                message: "cannot re-read staged DAG bytes",
-                receipt: stale,
-            };
-        }
-        const dagSha256 = hashDagBytes(dagBytes);
-        if (dagSha256 !== rec.dagSha256) {
-            const stale = await this.markStale(rec.executionId, "staged DAG bytes drift (hash mismatch on consume)");
-            return {
-                ok: false,
-                code: "CONFIRMATION_STALE",
-                message: "staged DAG bytes drift (hash mismatch on consume)",
-                receipt: stale,
-            };
-        }
-        const drift = detectReceiptBindingDrift(rec, {
-            sourceBindingSha256: input.sourceBindingSha256,
-            taskContractBinding: input.taskContractBinding,
-            controllerFingerprint: input.controllerFingerprint,
-            validationResultSha256: input.validationResultSha256,
-        });
-        if (drift) {
-            const stale = await this.markStale(rec.executionId, drift);
-            return {
-                ok: false,
-                code: "CONFIRMATION_STALE",
-                message: drift,
-                receipt: stale,
-            };
-        }
-        const now = input.now ?? new Date();
-        const consumed = {
-            ...rec,
-            state: "consumed",
-            consumedAt: now.toISOString(),
-        };
-        await writeSecureJson(receiptPath(this.appData, rec.executionId), consumed);
-        return { ok: true, receipt: consumed };
-    }
-    /** Record the operation id that consumed this receipt (post-accept). */
-    async markDispatched(executionId, operationId) {
-        const rec = await this.get(executionId);
-        if (!rec || rec.state !== "consumed")
-            return rec;
-        const dispatched = {
-            ...rec,
-            consumedOperationId: operationId,
-        };
-        await writeSecureJson(receiptPath(this.appData, executionId), dispatched);
-        return dispatched;
-    }
-    async markStale(executionId, reason) {
-        const rec = await this.get(executionId);
-        if (!rec) {
-            throw new Error(`execution receipt not found: ${executionId}`);
-        }
-        const stale = {
-            ...rec,
-            state: "stale",
-            staleReason: reason,
-        };
-        await writeSecureJson(receiptPath(this.appData, executionId), stale);
-        return stale;
-    }
-}
-function detectReceiptBindingDrift(rec, current) {
-    if (current.sourceBindingSha256 !== rec.sourceBindingSha256) {
-        return "sourceBindingSha256 binding drift";
-    }
-    if (current.controllerFingerprint !== rec.controllerFingerprint) {
-        return "controllerFingerprint binding drift";
-    }
-    if (current.validationResultSha256 !== rec.validationResultSha256) {
-        return "validationResultSha256 binding drift";
-    }
-    const a = sha256Utf8(JSON.stringify(rec.taskContractBinding));
-    const b = sha256Utf8(JSON.stringify(current.taskContractBinding));
-    if (a !== b)
-        return "taskContractBinding drift";
-    return undefined;
-}