@verax-ai/proxy 0.1.2 → 0.1.3

package/dist/in-flight-log.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Called before `inner` runs. A failure here must not block the call.
+ *
+ * The stamp is wall-clock time and not the proxy's injected `now`: a mark is
+ * not a ledger row, and taking a tick from a deterministic clock would shift
+ * every timestamp recorded after it — the golden ledger caught exactly that.
+ */
+export declare function markStarted(stateDir: string, ref: string, subject: string): void;
+/** Called once the effect row is written, on success and on failure alike. */
+export declare function markEnded(stateDir: string, ref: string): void;
+/** True when a run started and no end was recorded: the outcome is unknown. */
+export declare function startedWithoutEnd(stateDir: string, ref: string): boolean;

package/dist/in-flight-log.js

@@ -0,0 +1,65 @@
+/**
+ * Durable in-flight marks: "this ref started running".
+ *
+ * The in-memory registry that stops a second run dies with the process. On the
+ * approved path an `allow` does not mean the tool ran — it means the operator
+ * said yes — so a restarted body cannot tell "approved, never started" from
+ * "approved, started, crashed before the effect". Without that distinction it
+ * has to either run everything twice or run nothing at all.
+ *
+ * A mark is one empty file per ref, created before `inner` and removed after
+ * the effect is written. One file per ref rather than a shared log because two
+ * refs may start and finish at the same moment: file create and unlink need no
+ * lock, a shared append-only log would need a compaction pass and would race.
+ *
+ * A mark left behind by a crash is exactly the signal wanted: it outlives the
+ * process, and the retry that finds it answers `outcome-unknown` instead of
+ * running the tool a second time.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+const KLASOR = "in-flight";
+/** Ref may carry a tenant prefix and any path character; the name never does. */
+function markPath(stateDir, ref) {
+    const ad = createHash("sha256").update(ref, "utf8").digest("hex").slice(0, 32);
+    return join(stateDir, KLASOR, `${ad}.start`);
+}
+/**
+ * Called before `inner` runs. A failure here must not block the call.
+ *
+ * The stamp is wall-clock time and not the proxy's injected `now`: a mark is
+ * not a ledger row, and taking a tick from a deterministic clock would shift
+ * every timestamp recorded after it — the golden ledger caught exactly that.
+ */
+export function markStarted(stateDir, ref, subject) {
+    try {
+        mkdirSync(join(stateDir, KLASOR), { recursive: true, mode: 0o700 });
+        // The body is for a human reading the directory after a crash; nothing parses it.
+        writeFileSync(markPath(stateDir, ref), `${JSON.stringify({ ref, subject, atMs: Date.now() })}\n`, {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+    }
+    catch {
+        // A missing mark degrades to today's behaviour, it does not deny the call.
+    }
+}
+/** Called once the effect row is written, on success and on failure alike. */
+export function markEnded(stateDir, ref) {
+    try {
+        rmSync(markPath(stateDir, ref), { force: true });
+    }
+    catch {
+        // Leaving a stale mark makes the next retry cautious, never wrong.
+    }
+}
+/** True when a run started and no end was recorded: the outcome is unknown. */
+export function startedWithoutEnd(stateDir, ref) {
+    try {
+        return existsSync(markPath(stateDir, ref));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/proxy.js

@@ -4,6 +4,7 @@ import { signDecisionRecord } from "@cedulon/core";
 import { approvePending, approvalsLogFor, createApprovalBudgetGuard, drainApprovalCommands, spentTodayMinorOf, } from "./approvals.js";
 import { SerialQueue } from "./serial-queue.js";
 import { diskProbe } from "./disk.js";
+import { markEnded, markStarted, startedWithoutEnd } from "./in-flight-log.js";
 import { effectDescriptor, sha256Canonical } from "./hash.js";
 import { inputsLogFor } from "./inputs.js";
 import { countedWork, hasPrimaryEffect, lookupDecisionByRef, lookupReauthByHash, lookupResolvedBy, noteResolution, noteTenantRef, } from "./ledger.js";
@@ -294,6 +295,11 @@ export function createProxy(deps) {
         };
     }
     function launchInner(dispatchedCall, principal, allowRef, flightKey) {
+        // Written before the tool runs, removed after the effect is recorded. A
+        // mark that survives the process is what tells a restarted body that this
+        // ref was already started (in-flight-log.ts).
+        if (stateDir !== null)
+            markStarted(stateDir, flightKey, dispatchedCall.name);
         const work = runInner(dispatchedCall, principal, allowRef);
         inFlight.set(flightKey, work);
         return { kind: "run", work, key: flightKey, replayRef: allowRef };
@@ -469,6 +475,27 @@ export function createProxy(deps) {
                                 const flying = inFlight.get(scopedRef);
                                 if (flying)
                                     return { kind: "wait", work: flying, replayRef: allow.ref };
+                                // An approved allow means "the operator said yes", not "it ran",
+                                // so the first retry after an approval is the first run. Only a
+                                // mark left on disk says a run was already started and never
+                                // finished — that one cannot be run again.
+                                if (stateDir !== null && startedWithoutEnd(stateDir, scopedRef)) {
+                                    const unknownRef = deps.nonce();
+                                    await writeRecord({
+                                        decision: "deny",
+                                        reasonCode: "outcome-unknown",
+                                        ref: unknownRef,
+                                        requestHash,
+                                        inputs: {
+                                            ...resolved.inputs,
+                                            approver: { id: "verax-proxy", via: "proxy", resolves: scopedRef },
+                                        },
+                                        effectHash: null,
+                                        subject: call.name,
+                                        timestampMs,
+                                    });
+                                    return { kind: "done", result: denied("outcome-unknown", unknownRef) };
+                                }
                                 return launchInner(dispatched, principal, allow.ref, scopedRef);
                             }
                             return { kind: "done", result: deferred(given) };
@@ -596,6 +623,10 @@ export function createProxy(deps) {
             }
             finally {
                 inFlight.delete(plan.key);
+                // runInner has written its effect row by now — on the throw path too,
+                // as `<name>:threw`. The outcome is on the ledger, so the mark goes.
+                if (stateDir !== null)
+                    markEnded(stateDir, plan.key);
             }
         },
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verax-ai/proxy",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "license": "Apache-2.0",
   "type": "module",
   "engines": {