@tt-a1i/openpi 0.6.0 → 0.7.0

package/extensions/workflows/artifacts.ts

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import {
@@ -22,10 +23,14 @@ import {
 } from "./serialization.ts";
 
 export const JOURNAL_FILE = "journal.json";
+export const WORKFLOW_COMMIT_FILE = ".workflow-commit.json";
 
 const ARTIFACT_TRANSCRIPT_MAX_BYTES = 32 * 1024;
 const ARTIFACT_TRANSCRIPT_ENTRY_MAX_BYTES = 8 * 1024;
 const AGENT_RESULT_ARTIFACT_MAX_BYTES = 2 * 1024 * 1024;
+const WORKFLOW_MANIFEST_MAX_BYTES = 1024 * 1024;
+const WORKFLOW_TRANSCRIPTS_MAX_BYTES = 2 * 1024 * 1024;
+const WORKFLOW_COMMIT_MAX_BYTES = 3 * 1024 * 1024;
 export const WORKFLOW_CHECKPOINT_INTERVAL_MS = 500;
 const ENTRY_TRUNCATION_MARKER = "\n[entry truncated]";
 const TRANSCRIPT_TRUNCATION_MARKER =
@@ -35,10 +40,317 @@ type WorkflowJournalSource =
   | readonly JournalEntry[]
   | WorkflowJournalAccumulator;
 
+interface WorkflowArtifactWrite {
+  name: typeof JOURNAL_FILE | "result.json" | "transcripts.json";
+  content: string;
+}
+
+interface WorkflowCommitArtifact {
+  name: WorkflowArtifactWrite["name"];
+  bytes: number;
+  sha256: string;
+}
+
+interface WorkflowCommitMarker {
+  version: 1;
+  runId: string;
+  manifest: string;
+  predecessorSha256: string;
+  artifacts: WorkflowCommitArtifact[];
+}
+
+export type WorkflowCommitRecovery =
+  | "none"
+  | "recovered"
+  | "already-committed"
+  | "incomplete"
+  | "invalid"
+  | "failed";
+
+const artifactLimits = new Map<WorkflowArtifactWrite["name"], number>([
+  ["transcripts.json", WORKFLOW_TRANSCRIPTS_MAX_BYTES],
+  ["result.json", WORKFLOW_MANIFEST_MAX_BYTES],
+  [JOURNAL_FILE, JOURNAL_MAX_BYTES],
+]);
+
 function textBytes(text: string) {
   return Buffer.byteLength(text, "utf8");
 }
 
+function sha256(content: string | Buffer) {
+  return createHash("sha256").update(content).digest("hex");
+}
+
+function removeWorkflowCommit(runDir: string, strict = false) {
+  try {
+    fs.unlinkSync(path.join(runDir, WORKFLOW_COMMIT_FILE));
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return;
+    if (strict) throw error;
+  }
+}
+
+function workflowCommitMarker(
+  details: WorkflowDetails,
+  manifest: string,
+  artifacts: WorkflowArtifactWrite[],
+  predecessorSha256: string,
+): WorkflowCommitMarker {
+  for (const { name, content } of artifacts) {
+    const bytes = textBytes(content);
+    const limit = artifactLimits.get(name);
+    if (limit === undefined || bytes > limit) {
+      throw new Error(`Workflow artifact ${name} exceeded its commit budget`);
+    }
+  }
+  return {
+    version: 1,
+    runId: details.runId,
+    manifest,
+    predecessorSha256,
+    artifacts: artifacts.map(({ name, content }) => ({
+      name,
+      bytes: textBytes(content),
+      sha256: sha256(content),
+    })),
+  };
+}
+
+function serializeWorkflowCommitMarker(
+  details: WorkflowDetails,
+  manifest: string,
+  artifacts: WorkflowArtifactWrite[],
+  predecessorSha256: string,
+) {
+  const content = JSON.stringify(
+    workflowCommitMarker(details, manifest, artifacts, predecessorSha256),
+  );
+  if (textBytes(content) > WORKFLOW_COMMIT_MAX_BYTES) {
+    throw new Error(
+      "Workflow artifact commit receipt exceeded its byte budget",
+    );
+  }
+  return content;
+}
+
+function parseWorkflowCommitMarker(
+  runDir: string,
+): WorkflowCommitMarker | "none" | "invalid" {
+  const markerPath = path.join(runDir, WORKFLOW_COMMIT_FILE);
+  let stat: fs.Stats;
+  try {
+    stat = fs.lstatSync(markerPath);
+  } catch (error) {
+    return (error as NodeJS.ErrnoException).code === "ENOENT"
+      ? "none"
+      : "invalid";
+  }
+  if (
+    !stat.isFile() ||
+    stat.isSymbolicLink() ||
+    stat.size <= 0 ||
+    stat.size > WORKFLOW_COMMIT_MAX_BYTES
+  ) {
+    return "invalid";
+  }
+
+  let raw: unknown;
+  try {
+    raw = JSON.parse(fs.readFileSync(markerPath, "utf8"));
+  } catch {
+    return "invalid";
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return "invalid";
+  const record = raw as Record<string, unknown>;
+  if (
+    record.version !== 1 ||
+    typeof record.runId !== "string" ||
+    record.runId !== path.basename(runDir) ||
+    typeof record.predecessorSha256 !== "string" ||
+    !/^[0-9a-f]{64}$/u.test(record.predecessorSha256) ||
+    typeof record.manifest !== "string" ||
+    textBytes(record.manifest) > WORKFLOW_MANIFEST_MAX_BYTES ||
+    !Array.isArray(record.artifacts) ||
+    record.artifacts.length < 1 ||
+    record.artifacts.length > artifactLimits.size
+  ) {
+    return "invalid";
+  }
+
+  let manifest: Record<string, unknown>;
+  try {
+    const parsed: unknown = JSON.parse(record.manifest);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return "invalid";
+    }
+    manifest = parsed as Record<string, unknown>;
+  } catch {
+    return "invalid";
+  }
+  if (
+    manifest.runId !== record.runId ||
+    !["completed", "failed", "aborted", "uncertain"].includes(
+      String(manifest.status),
+    ) ||
+    manifest.transcriptArtifact !== "transcripts.json" ||
+    (manifest.resultArtifact !== undefined &&
+      manifest.resultArtifact !== "result.json")
+  ) {
+    return "invalid";
+  }
+
+  const artifacts: WorkflowCommitArtifact[] = [];
+  const names = new Set<string>();
+  for (const value of record.artifacts) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return "invalid";
+    }
+    const artifact = value as Record<string, unknown>;
+    if (
+      typeof artifact.name !== "string" ||
+      !artifactLimits.has(artifact.name as WorkflowArtifactWrite["name"]) ||
+      names.has(artifact.name) ||
+      typeof artifact.bytes !== "number" ||
+      !Number.isInteger(artifact.bytes) ||
+      artifact.bytes < 0 ||
+      artifact.bytes >
+        (artifactLimits.get(artifact.name as WorkflowArtifactWrite["name"]) ??
+          -1) ||
+      typeof artifact.sha256 !== "string" ||
+      !/^[0-9a-f]{64}$/u.test(artifact.sha256)
+    ) {
+      return "invalid";
+    }
+    names.add(artifact.name);
+    artifacts.push({
+      name: artifact.name as WorkflowArtifactWrite["name"],
+      bytes: artifact.bytes,
+      sha256: artifact.sha256,
+    });
+  }
+  if (
+    !names.has("transcripts.json") ||
+    (manifest.resultArtifact === "result.json") !== names.has("result.json")
+  ) {
+    return "invalid";
+  }
+  return {
+    version: 1,
+    runId: record.runId,
+    manifest: record.manifest,
+    predecessorSha256: record.predecessorSha256,
+    artifacts,
+  };
+}
+
+function hasCommittedManifest(
+  manifestPath: string,
+  marker: WorkflowCommitMarker,
+) {
+  try {
+    const stat = fs.lstatSync(manifestPath);
+    if (
+      !stat.isFile() ||
+      stat.isSymbolicLink() ||
+      stat.size > WORKFLOW_MANIFEST_MAX_BYTES
+    )
+      return false;
+    const content = fs.readFileSync(manifestPath);
+    if (content.byteLength > WORKFLOW_MANIFEST_MAX_BYTES) return false;
+    const parsed: unknown = JSON.parse(content.toString("utf8"));
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      return false;
+    }
+    const manifest = parsed as Record<string, unknown>;
+    const markerManifest = JSON.parse(marker.manifest) as Record<
+      string,
+      unknown
+    >;
+    return (
+      manifest.runId === marker.runId &&
+      manifest.status === markerManifest.status &&
+      manifest.transcriptArtifact === markerManifest.transcriptArtifact &&
+      manifest.resultArtifact === markerManifest.resultArtifact
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Complete a terminal artifact commit only when every prepared file matches
+ * the exact bounded receipt written before the side-artifact sequence began.
+ */
+export function recoverPendingWorkflowCommit(
+  runDir: string,
+): WorkflowCommitRecovery {
+  const marker = parseWorkflowCommitMarker(runDir);
+  if (marker === "none" || marker === "invalid") return marker;
+
+  for (const artifact of marker.artifacts) {
+    const artifactPath = path.join(runDir, artifact.name);
+    let stat: fs.Stats;
+    let content: Buffer;
+    try {
+      stat = fs.lstatSync(artifactPath);
+      if (
+        !stat.isFile() ||
+        stat.isSymbolicLink() ||
+        stat.size !== artifact.bytes
+      ) {
+        return "incomplete";
+      }
+      content = fs.readFileSync(artifactPath);
+    } catch {
+      return "incomplete";
+    }
+    if (
+      content.byteLength !== artifact.bytes ||
+      sha256(content) !== artifact.sha256
+    ) {
+      return "incomplete";
+    }
+  }
+
+  const manifestPath = path.join(runDir, "workflow.json");
+  try {
+    if (
+      fs.existsSync(manifestPath) &&
+      hasCommittedManifest(manifestPath, marker)
+    ) {
+      removeWorkflowCommit(runDir);
+      return "already-committed";
+    }
+    // A later terminal/cleanup/delivery publication supersedes this receipt.
+    // Artifact validity alone cannot authorize replacing canonical facts.
+    let predecessor: Buffer;
+    try {
+      const stat = fs.lstatSync(manifestPath);
+      if (
+        !stat.isFile() ||
+        stat.isSymbolicLink() ||
+        stat.size > WORKFLOW_MANIFEST_MAX_BYTES
+      ) {
+        return "invalid";
+      }
+      predecessor = fs.readFileSync(manifestPath);
+    } catch {
+      return "invalid";
+    }
+    if (
+      predecessor.byteLength > WORKFLOW_MANIFEST_MAX_BYTES ||
+      sha256(predecessor) !== marker.predecessorSha256
+    ) {
+      return "invalid";
+    }
+    writeFileAtomic(manifestPath, marker.manifest);
+    removeWorkflowCommit(runDir);
+    return "recovered";
+  } catch {
+    return "failed";
+  }
+}
+
 function boundEntry(entry: TranscriptEntry, maxBytes: number) {
   if (textBytes(entry.text) <= maxBytes) return { ...entry };
   const markerBytes = textBytes(ENTRY_TRUNCATION_MARKER);
@@ -120,11 +432,11 @@ export function persistWorkflowTerminalState(
   delete terminalManifest.result;
   delete terminalManifest.resultArtifact;
   delete terminalManifest.transcriptArtifact;
-  writeRunFile(
-    runDir,
-    "workflow.json",
-    safeStringify(terminalManifest, { maxBytes: 1024 * 1024 }),
-  );
+  const content = safeStringify(terminalManifest, {
+    maxBytes: WORKFLOW_MANIFEST_MAX_BYTES,
+  });
+  writeRunFile(runDir, "workflow.json", content);
+  return sha256(content);
 }
 
 /** Persist one successful child result before any handoff/context projection. */
@@ -177,15 +489,24 @@ export function persistWorkflowJson(
   // later artifact write fails, readers still see an explained terminal run
   // instead of the previous `running` manifest. The final manifest below adds
   // the artifact references once every dependent file has committed.
-  if (details.status !== "running") {
-    persistWorkflowTerminalState(runDir, details);
+  const terminal = details.status !== "running";
+  let predecessorSha256: string | undefined;
+  if (terminal) {
+    // A retry supersedes an older unfinished receipt before it publishes a new
+    // terminal fact. Failing to remove it must stop the new commit rather than
+    // let a concurrent reader promote stale artifact identities.
+    removeWorkflowCommit(runDir, true);
+    predecessorSha256 = persistWorkflowTerminalState(runDir, details);
   }
 
-  writeRunFile(
-    runDir,
-    "transcripts.json",
-    safeStringify(transcripts, { maxBytes: 2 * 1024 * 1024 }),
-  );
+  const artifactWrites: WorkflowArtifactWrite[] = [
+    {
+      name: "transcripts.json",
+      content: safeStringify(transcripts, {
+        maxBytes: WORKFLOW_TRANSCRIPTS_MAX_BYTES,
+      }),
+    },
+  ];
   // Written alongside the rest so it inherits atomic write, 500ms coalescing,
   // and the final flush. Only present once a call has actually succeeded.
   // Accumulators already enforce the cap incrementally and can assemble the
@@ -201,14 +522,15 @@ export function persistWorkflowJson(
       "toJson" in journal
         ? journal.toJson()
         : JSON.stringify(boundedJournal(journal).journal, null, 2);
-    writeRunFile(runDir, JOURNAL_FILE, content);
+    artifactWrites.push({ name: JOURNAL_FILE, content });
   }
   if (details.result !== undefined) {
-    writeRunFile(
-      runDir,
-      "result.json",
-      safeStringify(details.result, { maxBytes: 1024 * 1024 }),
-    );
+    artifactWrites.push({
+      name: "result.json",
+      content: safeStringify(details.result, {
+        maxBytes: WORKFLOW_MANIFEST_MAX_BYTES,
+      }),
+    });
   }
   const compact: WorkflowDetails = {
     ...details,
@@ -218,11 +540,27 @@ export function persistWorkflowJson(
     transcriptArtifact: "transcripts.json",
     agents: details.agents.map((agent) => ({ ...agent, transcript: [] })),
   };
-  writeRunFile(
-    runDir,
-    "workflow.json",
-    safeStringify(compact, { maxBytes: 1024 * 1024 }),
-  );
+  const manifest = safeStringify(compact, {
+    maxBytes: WORKFLOW_MANIFEST_MAX_BYTES,
+  });
+
+  if (predecessorSha256 !== undefined) {
+    writeRunFile(
+      runDir,
+      WORKFLOW_COMMIT_FILE,
+      serializeWorkflowCommitMarker(
+        details,
+        manifest,
+        artifactWrites,
+        predecessorSha256,
+      ),
+    );
+  }
+  for (const artifact of artifactWrites) {
+    writeRunFile(runDir, artifact.name, artifact.content);
+  }
+  writeRunFile(runDir, "workflow.json", manifest);
+  if (terminal) removeWorkflowCommit(runDir);
 }
 
 /**
@@ -235,6 +573,7 @@ export function persistWorkflowDeliveryState(
   runDir: string,
   delivery: WorkflowDelivery,
 ) {
+  recoverPendingWorkflowCommit(runDir);
   const file = path.join(runDir, "workflow.json");
   const raw: unknown = JSON.parse(fs.readFileSync(file, "utf8"));
   if (!raw || typeof raw !== "object" || Array.isArray(raw)) {

package/extensions/workflows/dashboard.ts

@@ -31,6 +31,7 @@ import {
 import { SPINNER_INTERVAL_MS, spinnerFrame } from "../shared/spinner.ts";
 import { sanitizeTerminalText } from "../shared/terminal-text.ts";
 import { isAcceptanceLedger } from "./acceptance.ts";
+import { recoverPendingWorkflowCommit } from "./artifacts.ts";
 import { projectWorkflowGraph } from "./graph-projection.ts";
 import {
   classifyInterruptedInvocation,
@@ -143,18 +144,55 @@ export function readPersistedWorkflowDetails(
   runId: string,
   options: ReadPersistedRunOptions = {},
 ): WorkflowDetails | undefined {
-  let details: WorkflowDetails | undefined;
+  const details = normalizeReadRecord(
+    runId,
+    readPersistedWorkflowRecord(runId),
+  );
+  if (!details) return undefined;
+  if (options.hydrateArtifacts) hydrateRunArtifacts(runId, details);
+  return details;
+}
+
+function normalizeReadRecord(runId: string, raw: unknown) {
+  try {
+    return normalizePersistedWorkflowDetails(runId, raw);
+  } catch {
+    return undefined;
+  }
+}
+
+function readPersistedWorkflowRecord(runId: string) {
+  recoverPendingWorkflowCommit(path.join(runsDir(), runId));
   try {
     const raw: unknown = JSON.parse(
       fs.readFileSync(path.join(runsDir(), runId, "workflow.json"), "utf8"),
     );
-    details = normalizePersistedWorkflowDetails(runId, raw);
+    return raw && typeof raw === "object"
+      ? (raw as Record<string, unknown>)
+      : undefined;
   } catch {
     return undefined;
   }
-  if (!details) return undefined;
-  if (options.hydrateArtifacts) hydrateRunArtifacts(runId, details);
-  return details;
+}
+
+function matchesRunScope(
+  record: { startedAt?: unknown; finishedAt?: unknown; sessionId?: unknown },
+  runId: string,
+  sessionId: string,
+  referencedRunIds: ReadonlySet<string>,
+  startedSince: number,
+  fromRetention = false,
+) {
+  const touchedAt = Math.max(
+    typeof record.startedAt === "number" ? record.startedAt : 0,
+    typeof record.finishedAt === "number" ? record.finishedAt : 0,
+  );
+  return (
+    touchedAt >= startedSince &&
+    (fromRetention ||
+      record.sessionId === sessionId ||
+      referencedRunIds.has(runId))
+  );
 }
 
 function isWorktreeCleanup(
@@ -581,27 +619,41 @@ export function loadRunEntries(
   retained: ReadonlyMap<string, WorkflowDetails> = new Map(),
 ): RunEntry[] {
   const entries: RunEntry[] = [];
-  const runIds = new Set([...listPersistedRunIds(), ...retained.keys()]);
+  const runIds = new Set([
+    ...listPersistedRunIds(),
+    ...retained.keys(),
+    ...active.keys(),
+  ]);
   for (const runId of runIds) {
     const live = active.get(runId);
     if (live) {
       entries.push({ runId, details: live, live: true });
       continue;
     }
-    const persisted = readPersistedWorkflowDetails(runId, {
-      hydrateArtifacts: true,
-    });
+    // Reject unrelated history before normalizing potentially large inline
+    // transcripts. Side artifacts belong to explicit detail navigation.
+    const raw = readPersistedWorkflowRecord(runId);
+    if (
+      raw &&
+      !matchesRunScope(raw, runId, sessionId, referencedRunIds, startedSince)
+    ) {
+      continue;
+    }
+    const persisted = normalizeReadRecord(runId, raw);
     const retainedDetails = retained.get(runId);
     const details = persisted ?? retainedDetails;
     if (!details) continue;
     const fromRetention =
       persisted === undefined && retainedDetails !== undefined;
-    const touchedAt = Math.max(details.startedAt, details.finishedAt ?? 0);
     if (
-      touchedAt < startedSince ||
-      (!fromRetention &&
-        details.sessionId !== sessionId &&
-        !referencedRunIds.has(runId))
+      !matchesRunScope(
+        details,
+        runId,
+        sessionId,
+        referencedRunIds,
+        startedSince,
+        fromRetention,
+      )
     ) {
       continue;
     }
@@ -718,6 +770,9 @@ type DetailFocus = "phases" | "agents";
 export class WorkflowDashboard {
   private view: View = "list";
   private entries: RunEntry[] = [];
+  private historyLoaded = false;
+  private seenRetainedRunIds = new Set<string>();
+  private hydratedRunIds = new Set<string>();
   private listIndex = 0;
   private phaseIndex = 0;
   private agentIndex = 0;
@@ -826,13 +881,68 @@ export class WorkflowDashboard {
 
   private refresh() {
     const selected = this.entries[this.listIndex]?.runId;
-    this.entries = loadRunEntries(
-      this.getActive(),
-      this.sessionId,
-      this.referencedRunIds,
-      this.startedSince,
-      this.getRetained(),
-    );
+    const active = this.getActive();
+    const retained = this.getRetained();
+    if (!this.historyLoaded) {
+      this.entries = loadRunEntries(
+        active,
+        this.sessionId,
+        this.referencedRunIds,
+        this.startedSince,
+        retained,
+      );
+      this.historyLoaded = true;
+    } else {
+      // Animation ticks reuse historical projections. Only a newly settled run
+      // needs one canonical read; stable frames never scan or reread history.
+      const entries = new Map(
+        this.entries.map((entry) => [entry.runId, entry]),
+      );
+      const settledIds = new Set([
+        ...this.entries
+          .filter((entry) => entry.live && !active.has(entry.runId))
+          .map((entry) => entry.runId),
+        ...[...retained.keys()].filter(
+          (runId) =>
+            !this.seenRetainedRunIds.has(runId) &&
+            !entries.has(runId) &&
+            !active.has(runId),
+        ),
+      ]);
+      for (const runId of settledIds) {
+        const persisted = readPersistedWorkflowDetails(runId);
+        const details =
+          persisted ?? retained.get(runId) ?? entries.get(runId)?.details;
+        if (!details) continue;
+        if (
+          !matchesRunScope(
+            details,
+            runId,
+            this.sessionId,
+            this.referencedRunIds,
+            this.startedSince,
+            !persisted,
+          )
+        ) {
+          entries.delete(runId);
+          continue;
+        }
+        // Recovery operates on a projection, never on the former live owner.
+        const recovered = recoverStaleWorkflowDetails({
+          ...details,
+          agents: details.agents.map((agent) => ({ ...agent })),
+        });
+        entries.set(runId, { runId, details: recovered, live: false });
+        this.hydratedRunIds.delete(runId);
+      }
+      for (const [runId, details] of active) {
+        entries.set(runId, { runId, details, live: true });
+      }
+      this.entries = [...entries.values()].sort(
+        (a, b) => b.details.startedAt - a.details.startedAt,
+      );
+    }
+    for (const runId of retained.keys()) this.seenRetainedRunIds.add(runId);
     if (selected) {
       const index = this.entries.findIndex((e) => e.runId === selected);
       if (index >= 0) this.listIndex = index;
@@ -847,6 +957,7 @@ export class WorkflowDashboard {
       );
       if (refreshed) this.current = refreshed;
     }
+    if (this.view === "transcript") this.hydrateCurrent();
     if (this.notice && Date.now() - this.noticeAt > NOTICE_TTL_MS)
       this.notice = undefined;
   }
@@ -882,7 +993,15 @@ export class WorkflowDashboard {
     this.agentIndex = Math.min(this.agentIndex, Math.max(0, agents.length - 1));
   }
 
+  private hydrateCurrent() {
+    const entry = this.current;
+    if (!entry || entry.live || this.hydratedRunIds.has(entry.runId)) return;
+    hydrateRunArtifacts(entry.runId, entry.details);
+    this.hydratedRunIds.add(entry.runId);
+  }
+
   private saveReport() {
+    this.hydrateCurrent();
     const entry = this.current;
     if (!entry) return;
     const target = path.join(runsDir(), entry.runId, "report.md");
@@ -1023,6 +1142,7 @@ export class WorkflowDashboard {
   }
 
   private openTranscriptPage() {
+    this.hydrateCurrent();
     const transcriptAdapter = new WorkflowTranscriptAdapter();
     this.view = "transcript";
     this.transcriptPage = new AgentSessionPage(