@topolo/cli 0.13.19 → 0.13.21

package/agent-packs/src/topolo_agent_pack/execution.py

@@ -7,6 +7,8 @@ reviewed role. Changing that intent requires rebuilding the selected policy.
 import copy
 import hashlib
 import json
+import os
+import datetime
 import pathlib
 import sqlite3
 import subprocess
@@ -16,6 +18,26 @@ from contextlib import closing
 from . import policy, permissions
 from .storage import PackError, atomic_json, component_key, read_json
 
+# Native desktop transport/tool configuration is independent of role execution
+# policy. Keep this list explicit; unknown overrides still fail closed.
+DESKTOP_TRANSPORT_CONFIG_KEYS = frozenset('''
+apps.connector_openai_pages.tools
+features.apps_mcp_path_override features.async_compaction
+features.code_mode_interrupt features.code_mode_tool_description_first
+features.code_mode_tool_search features.collaboration_modes
+features.compaction_image_budget features.concurrent_reasoning_summaries
+features.deferred_tool_world_state features.enable_mcp_apps
+features.guardian_approval features.guardian_reuse_parent_compaction
+features.guardianv2 features.guardianv2_decisions_comparison
+features.image_detail_original features.image_generation features.image_resize_notice
+features.incremental_tools features.instant_interrupt features.item_ids
+features.mcp_oauth_refresh_coordination features.realtime_conversation
+features.recommended_plugins features.request_rule features.unified_image_budget
+features.workspace_dependencies mcp_servers.artifact_session
+mcp_servers.cua_repl mcp_servers.node_repl
+plugins.codex-app-tools@openai-bundled.mcp_servers.codex_app.enabled_tools
+'''.split())
+
 
 def prepare_runtime(lib, components, runtime):
     """Validate existing role intent without installing a policy or changing history."""
@@ -30,7 +52,15 @@ def prepare_runtime(lib, components, runtime):
                 component['key'] in keys or component['threadId'] in identities):
             raise PackError('Execution policy has no unique owned role: ' + component['key'])
         keys.add(component['key']); identities.add(component['threadId'])
-        consent = permissions.load(lib, matches[0]['pack'], manifest['agents']) if hasattr(lib, 'root') else None
+        # Checkpoints contain only the active selection. Installation consent is
+        # owned by the original complete pack, not that history snapshot.
+        consent = None
+        if hasattr(lib, 'root'):
+            policy_manifest, _ = lib.load(matches[0]['pack'])
+            original = [a for a in policy_manifest['agents'] if component_key(a) == component['key']]
+            if len(original) != 1:
+                raise PackError('Checkpoint role has no unique original policy identity')
+            consent = permissions.load(lib, matches[0]['pack'], policy_manifest['agents'])
         rows.append({'key': component['key'], 'threadId': component['threadId'],
                      'sourceRevision': revision, 'cwd': cwds[component['threadId']],
                      'intakeKey': consent['intakeRoutes'][component['key']] if consent else None,
@@ -54,7 +84,7 @@ class ExecutionGate:
     def __init__(self, document):
         if document.get('format') != 'topolo-codex-runtime-execution' or document.get('schemaVersion') != 1:
             raise PackError('Unqualified runtime execution policy')
-        self.roles = {}; self.pending = {}; self.verified = set(); self.catalog = {}
+        self.roles = {}; self.pending = {}; self.verified = set(); self.catalog = {}; self.desktop_home = None
         for role in document['roles']:
             tid = role['threadId']; spec = role['settings']
             if tid in self.roles or not pathlib.Path(role['cwd']).is_absolute():
@@ -142,6 +172,26 @@ class ExecutionGate:
         return {'type': 'workspaceWrite', 'networkAccess': False, 'writableRoots': [role['cwd']],
                 'excludeSlashTmp': True, 'excludeTmpdirEnvVar': True}
 
+    def qualify_roots(self, role, roots):
+        if not isinstance(roots, list) or len(roots)>2 or any(not isinstance(p,str) for p in roots) or len(set(roots))!=len(roots):
+            raise PackError('Frontend workspace roots have an unsupported shape')
+        if not roots:return
+        if roots[0]!=role['cwd']:
+            raise PackError('Frontend workspace roots differ from the reviewed role')
+        if len(roots)==1:return
+        if self.desktop_home is None:
+            raise PackError('Owned desktop visualization root is unavailable')
+        path=pathlib.Path(roots[1]);base=pathlib.Path(self.desktop_home)/'visualizations'
+        try:
+            relative=path.relative_to(base)
+            year,month,day,tid=relative.parts
+            if tid!=role['threadId'] or len(year)!=4 or len(month)!=2 or len(day)!=2:
+                raise ValueError()
+            datetime.date(int(year),int(month),int(day))
+            if not path.is_absolute() or path.resolve()!=path or not path.is_dir() or path.stat().st_uid!=os.getuid():
+                raise ValueError()
+        except (ValueError,OSError):raise PackError('Frontend visualization root is not the owned thread directory')
+
     def prepare(self, message):
         value = copy.deepcopy(message); method = value.get('method'); params = value.get('params') or {}
         tid = params.get('threadId'); role = self.roles.get(tid)
@@ -158,11 +208,47 @@ class ExecutionGate:
             raise PackError('Dynamic lane needs actual loaded role context before task execution')
         if spec['model_reasoning_effort'] not in self.catalog.get(spec['model'], set()):
             raise PackError('Role model/effort is absent from the native account catalog; no fallback selected')
-        if any(params.get(key) is not None for key in ['permissions', 'path', 'history', 'collaborationMode', 'environments', 'runtimeWorkspaceRoots']):
-            raise PackError('Frontend supplied unreviewed permission, identity or execution overrides')
+        collaboration = params.get('collaborationMode')
+        if collaboration is not None:
+            settings = collaboration.get('settings') if isinstance(collaboration, dict) else None
+            if (method != 'turn/start' or not isinstance(collaboration, dict) or
+                set(collaboration) != {'mode', 'settings'} or collaboration['mode'] != 'default' or
+                not isinstance(settings, dict) or set(settings) - {'model', 'reasoning_effort', 'developer_instructions'} or
+                settings.get('model') != spec['model'] or
+                settings.get('reasoning_effort') not in (None, spec['model_reasoning_effort']) or
+                (settings.get('developer_instructions') is not None and
+                 (not isinstance(settings['developer_instructions'], str) or
+                  len(settings['developer_instructions'].encode()) > 64000))):
+                raise PackError('Frontend collaboration mode conflicts with the reviewed role policy')
+            # Native collaboration settings take precedence over top-level model
+            # and effort. Bind them to the same reviewed tuple before forwarding.
+            collaboration['settings']['reasoning_effort'] = spec['model_reasoning_effort']
+            # Desktop supplies its generic Default-mode prompt here. It is not
+            # reviewed role context: discard it rather than accepting any extra
+            # frontend developer authority. This is independent of app builds.
+            collaboration['settings']['developer_instructions'] = None
+        # An empty environment selection explicitly disables environment access;
+        # the desktop sends it on ordinary local turns. Nonempty selections
+        # still require independently reviewed environment identity and roots.
+        environments = params.get('environments')
+        if environments not in (None, []):
+            if not isinstance(environments,list) or len(environments)!=1 or not isinstance(environments[0],dict):
+                raise PackError('Frontend environment selection has an unsupported shape')
+            environment=environments[0]
+            if (set(environment)-{'environmentId','cwd','runtimeWorkspaceRoots'} or
+                environment.get('environmentId')!='local' or environment.get('cwd')!=role['cwd']):
+                raise PackError('Frontend environment selection differs from the reviewed local role')
+            if environment.get('runtimeWorkspaceRoots') is not None:self.qualify_roots(role,environment['runtimeWorkspaceRoots'])
+        roots = params.get('runtimeWorkspaceRoots')
+        if roots is not None:self.qualify_roots(role,roots)
+        if environments and roots is not None and environments[0].get('runtimeWorkspaceRoots') not in (None,roots):
+            raise PackError('Frontend top-level and local environment roots conflict')
+        forbidden = [key for key in ['permissions', 'path', 'history'] if params.get(key) is not None]
+        if forbidden:
+            raise PackError('Frontend supplied unreviewed permission, identity or execution overrides: ' + ','.join(forbidden))
         wanted = {'cwd': role['cwd'], 'model': spec['model'], 'approvalPolicy': spec['approval_policy'],
                   'approvalsReviewer': spec['approvals_reviewer']}
-        if role.get('dynamicLaneId') and method=='thread/resume':wanted['allowProviderModelFallback']=False
+        if (role.get('dynamicLaneId') or role.get('taskWorkerId')) and method=='thread/resume':wanted['allowProviderModelFallback']=False
         if method == 'thread/resume':
             wanted['sandbox'] = spec['sandbox_mode']
             wanted['config'] = {'model_reasoning_effort': spec['model_reasoning_effort'],
@@ -173,6 +259,13 @@ class ExecutionGate:
                 raise PackError('Role needs a verified native resume before starting a turn')
             wanted.update(effort=spec['model_reasoning_effort'], sandboxPolicy=self.sandbox(role))
         for key, expected in wanted.items():
+            if key=='config' and isinstance(params.get(key),dict):
+                supplied=params[key]
+                if (set(supplied)-set(expected)-DESKTOP_TRANSPORT_CONFIG_KEYS or
+                    any(supplied[k]!=expected[k] for k in set(supplied)&set(expected))):
+                    raise PackError('Frontend config conflicts with the reviewed role policy')
+                params[key]={**copy.deepcopy(supplied),**copy.deepcopy(expected)}
+                continue
             if params.get(key) is not None and params[key] != expected:
                 raise PackError('Frontend ' + key + ' conflicts with the reviewed role policy')
             params[key] = copy.deepcopy(expected)
@@ -207,7 +300,11 @@ class ExecutionGate:
 
 def load_gate(runtime):
     path = pathlib.Path(runtime) / 'execution-policy.json'
-    return ExecutionGate(read_json(path)) if path.exists() else None
+    if not path.exists():return None
+    gate=ExecutionGate(read_json(path))
+    runtime=pathlib.Path(runtime).resolve()
+    if runtime.parent.name=='runtimes':gate.desktop_home=runtime.parent.parent/'desktop-home'
+    return gate
 
 
 def qualify_protocol(binary, run=subprocess.run, *, lane_creation=False):

package/agent-packs/src/topolo_agent_pack/frontdoor.py

@@ -0,0 +1,23 @@
+"""Legacy explicit native-message request helpers.
+
+Conversational coordinators use coordinator_context instead: a human status or
+follow-up must never call this conversion or replace native input with a receipt.
+These helpers retain the original deterministic identity for explicit callers.
+"""
+import copy,uuid
+from .work import require
+
+def request(value,channel):
+    params=value['params'];identity=params.get('clientUserMessageId')
+    require(isinstance(identity,str) and 1<=len(identity)<=200,'Native human message identity is missing; use the work GUI so retries cannot duplicate a task')
+    inputs=params.get('input')
+    require(isinstance(inputs,list) and inputs and all(isinstance(x,dict) and x.get('type')=='text' and isinstance(x.get('text'),str) for x in inputs),'This front door currently requires text; submit attachment-backed work through its bound task packet')
+    objective='\n'.join(x['text'] for x in inputs)
+    require(objective.strip(),'Empty task request')
+    task_id=str(uuid.uuid5(uuid.NAMESPACE_URL,'topolo-frontdoor:'+params['threadId']+':'+identity))
+    return {'requestId':task_id,'objective':objective,'channel':channel,'canonicalClaimId':None}
+
+def acknowledgement(value,task):
+    result=copy.deepcopy(value)
+    result['params']['input']=[{'type':'text','text':'Topolo front-door queue receipt. The human request has already been durably recorded as task '+task['id']+'. Its current state is '+task['state']+'. A separate temporary specialist owns routing and execution. This turn is acknowledgement only. Do not read files, use tools, run commands, contact anyone, inspect servers or carry out any previous assignment. Reply briefly that the request is recorded and progress is in the work GUI: http://127.0.0.1:8769/ . Do not claim the work is complete.'}]
+    return result

package/agent-packs/src/topolo_agent_pack/linked_task_context.py

@@ -0,0 +1,80 @@
+"""Explicit same-authority task citations, not portfolio or recursive history."""
+import asyncio,copy,hashlib,json,pathlib,re
+from .storage import atomic_json,canonical,PackError
+from .work import require
+
+UUID=re.compile(r'(?<![A-Za-z0-9])[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?![A-Za-z0-9])',re.I)
+MAX_TASKS=4
+MAX_EVIDENCE=8
+MAX_FILE=512*1024
+MAX_BYTES=2*1024*1024
+
+def references(task):
+    text=task['objective']+'\n'+'\n'.join(r['note'] for r in task.get('humanResponses',[]))
+    require(len(text)<=100000,'Linked-task citation input exceeds the bounded reader')
+    ids=list(dict.fromkeys(x.lower() for x in UUID.findall(text) if x.lower()!=task['id']))
+    require(len(ids)<=MAX_TASKS,'Too many explicit linked task citations; select at most four')
+    return ids
+
+def legacy_reference(ref):
+    return isinstance(ref,dict) and set(ref)=={'path','sha256'} and isinstance(ref['path'],str) and 1<=len(ref['path'])<=4096 and pathlib.PurePosixPath(ref['path']).is_absolute() and isinstance(ref['sha256'],str) and re.fullmatch('[0-9a-f]{64}',ref['sha256']) is not None
+
+def portable(store,linked,target,budget):
+    """Use only immutable references read from the selected canonical task."""
+    from .work_context import materialize
+    from .work_artifacts import read_checkpoint
+    from .topolo import read_artifact
+    context=linked.get('contextRef')
+    if context:
+        require(isinstance(context,dict),'Selected linked context reference must be an object')
+        if 'artifact' in context:require(isinstance(context['artifact'],dict) and type(context['artifact'].get('size')) is int and 0<context['artifact']['size']<=200000,'Selected linked context artifact exceeds the bounded reader')
+        materialize(store.root,linked,target,lambda:store.client)
+        continuity=target/'context/continuity.md';require(continuity.is_file() and continuity.stat().st_size<=128000,'Selected linked task context exceeds the model context bound')
+    checkpoints=[];unavailable=[]
+    result=linked.get('result') or {};review=linked.get('verification') or {}
+    for label,proof,worker in [('execution',result.get('checkpoint'),result.get('workerId')),('review',review.get('nativeCheckpoint'),None)]:
+        if not proof:continue
+        if legacy_reference(proof):
+            unavailable.append({'kind':label+'-checkpoint','originReference':copy.deepcopy(proof),'reason':'Legacy local-only reference; bytes are not portable or read here. Canonical cloud summary remains recorded evidence, not a reverified checkpoint.'});continue
+        payload=read_checkpoint(store.root,proof,linked['id'],worker,store.client)
+        expected={k:result[k] for k in ['summary','artifacts','references']} if label=='execution' else {k:review[k] for k in ['verdict','summary','evidence']}
+        require(payload['phase']==('execute' if label=='execution' else 'review') and payload['outputError'] is None and json.loads(payload['output'])==expected,'Linked task result differs from its immutable checkpoint')
+        path=target/(label+'-checkpoint.json');atomic_json(path,payload)
+        checkpoints.append({'phase':label,'path':str(path),'proof':proof,'sha256':hashlib.sha256(path.read_bytes()).hexdigest()})
+    evidence=[]
+    declared=result.get('artifacts',[])+review.get('evidence',[])
+    require(len(declared)<=32,'Too many selected linked task evidence references')
+    for row in declared:
+        if legacy_reference(row):
+            unavailable.append({'kind':'declared-evidence','originReference':copy.deepcopy(row),'reason':'Legacy local-only evidence; do not read the origin path or claim its bytes verified.'});continue
+        require(isinstance(row,dict) and isinstance(row.get('artifact'),dict),'Linked task evidence must use a portable cloud artifact reference')
+        ref=row['artifact'];require(type(ref.get('size')) is int and 0<ref['size']<=MAX_FILE,'Linked task evidence exceeds the bounded file reader')
+        require(budget['files']<MAX_EVIDENCE and budget['bytes']+ref['size']<=MAX_BYTES,'Linked task evidence exceeds the selected context budget')
+        path=target/('evidence-'+str(len(evidence)))
+        read_artifact(store.client,{'input':{'bytesScope':ref['scope'],'bytesWorkspaceId':ref['workspaceId']}},ref['key'],ref,path)
+        data=path.read_bytes();require(len(data)==ref['size'] and hashlib.sha256(data).hexdigest()==ref['sha256'],'Linked task evidence digest differs')
+        budget['files']+=1;budget['bytes']+=len(data);evidence.append({'title':row.get('title','Selected task evidence'),'path':str(path),'artifact':copy.deepcopy(ref)})
+    return {'contextMaterialized':bool(context),'checkpoints':checkpoints,'evidence':evidence,'unavailableEvidence':unavailable,'recordedEvidenceOnly':bool(unavailable)}
+
+async def materialize(store,task,cwd,get_task):
+    ids=references(task)
+    if not ids:return None
+    require(getattr(store,'cloud',False) is True,'Linked tasks require the current cloud task authority')
+    cwd=pathlib.Path(cwd);require(cwd.resolve()==cwd and cwd.is_dir(),'Owned linked-task workspace required')
+    base=cwd/'context';require(not base.is_symlink(),'Linked-task context cannot be a symlink');base.mkdir(exist_ok=True,mode=0o700)
+    target=base/'linked-tasks';require(not target.exists() and not target.is_symlink(),'Linked task context already exists; do not overwrite another dispatch')
+    target.mkdir(mode=0o700);rows=[];missing=[];budget={'files':0,'bytes':0}
+    for tid in ids:
+        try:linked=await get_task(tid)
+        except PackError as error:
+            if str(error)!='Unknown task':raise
+            missing.append(tid);continue
+        require(linked.get('id')==tid,'Linked cloud task identity differs')
+        selected={k:copy.deepcopy(linked[k]) for k in ['id','revision','state','phase','attempt','channel','objective','summary','ownerInstallationId','route','contextRef','result','verification','checkpoints'] if k in linked}
+        require(len(canonical(selected))<=128000,'Linked task selected record exceeds the context bound')
+        folder=target/tid;folder.mkdir(mode=0o700);atomic_json(folder/'task.json',selected)
+        proof=await asyncio.to_thread(portable,store,linked,folder,budget)
+        rows.append({'taskId':tid,'revision':linked['revision'],'state':linked['state'],'recordPath':str(folder/'task.json'),**proof})
+    index={'format':'topolo-selected-linked-tasks-v1','taskId':task['id'],'authority':{k:store.binding[k] for k in ['organizationId','workspaceId','documentId','datasetId']},'selection':'Explicit UUID citations in the current objective and human responses only; no recursive history','tasks':rows,'unavailableTaskIds':missing,'evidenceBoundary':'Canonical cloud summaries/verification are recorded evidence. Only listed portable checkpoint/artifact files have verified bytes; unavailableEvidence preserves legacy references without reading origin paths or implying byte verification. Compare recorded findings honestly and disclose omitted legacy proof. Preserve owners, holds and UNKNOWN; this grants no adoption or replay authority. Do not substitute an unrelated first retained page for the cited findings.'}
+    atomic_json(base/'linked-tasks.json',index)
+    return index