@zeroroot-ai/zerocool 0.7.0 → 0.8.0

package/dist/dispatch.d.ts

@@ -262,7 +262,8 @@ export declare function runSourceAnalysisDispatch(ctx: DispatchContext, deps?: D
  *   `gitlab.url`           instance base url; defaults to gitlab.com
  *   `gitlab.ref`           branch to watch; defaults to `main`
  *   `gitlab.credential`    tenant secret holding the project access token
- *   `repository.url`       clone url handed to each Scan mission
+ *   `repository.url`       clone url the Scan mission checks out (required)
+ *   `image.ref`            the image the pipeline published, by digest (required)
  *   `target.id`            the registered target each Scan mission binds to
  *   `watch.interval_ms`    poll cadence; defaults to 30s
  */

package/dist/dispatch.js

@@ -342,7 +342,8 @@ export async function runSourceAnalysisDispatch(ctx, deps = {}) {
  *   `gitlab.url`           instance base url; defaults to gitlab.com
  *   `gitlab.ref`           branch to watch; defaults to `main`
  *   `gitlab.credential`    tenant secret holding the project access token
- *   `repository.url`       clone url handed to each Scan mission
+ *   `repository.url`       clone url the Scan mission checks out (required)
+ *   `image.ref`            the image the pipeline published, by digest (required)
  *   `target.id`            the registered target each Scan mission binds to
  *   `watch.interval_ms`    poll cadence; defaults to 30s
  */
@@ -353,6 +354,8 @@ export async function runWatchDispatch(ctx, deps = {}) {
     const ref = ctx.taskContext["gitlab.ref"] || DEFAULT_REF;
     const targetId = ctx.taskContext["target.id"] || "";
     const credentialName = ctx.taskContext["gitlab.credential"] || "gitlab-token";
+    const repositoryUrl = ctx.taskContext["repository.url"] || "";
+    const imageRef = ctx.taskContext["image.ref"] || "";
     if (!application) {
         throw new Error("watch: the mission node set no `application` in the task context. The watch keys its " +
             "checkpoints and its Scan missions by Application; without one it cannot tell its own " +
@@ -362,6 +365,23 @@ export async function runWatchDispatch(ctx, deps = {}) {
         throw new Error("watch: the mission node set no `gitlab.project` in the task context, so there is no " +
             "project to poll.");
     }
+    // Checked here, not at the first trigger. The checked-in Scan mission requires
+    // all seven of its parameters — CUE refuses an incomplete render rather than
+    // substituting an empty string — so a watch missing one is already broken. It
+    // would otherwise poll cleanly for hours and fail on the first pipeline, at
+    // which point the failure looks like the pipeline's fault rather than the
+    // watch's configuration.
+    if (!w.scans) {
+        const missing = [
+            ...(repositoryUrl ? [] : ["repository.url"]),
+            ...(imageRef ? [] : ["image.ref"]),
+        ];
+        if (missing.length > 0) {
+            throw new Error(`watch: the mission node set no ${missing.join(" and no ")} in the task context. The ` +
+                "checked-in Scan mission requires every one of its seven parameters, so a Scan " +
+                "originated without these would be refused rather than run.");
+        }
+    }
     // A harness is opened unless every seam that would use one was injected.
     const needsHarness = !w.gitlab || !w.checkpoints || !w.scans || !w.credential;
     const opened = needsHarness && !deps.harness;
@@ -380,11 +400,7 @@ export async function runWatchDispatch(ctx, deps = {}) {
         const scans = w.scans ??
             harnessScanLauncher(harness, {
                 targetId,
-                inputs: {
-                    application,
-                    repositoryUrl: ctx.taskContext["repository.url"] || "",
-                    ...(ctx.taskContext["image.ref"] ? { imageRef: ctx.taskContext["image.ref"] } : {}),
-                },
+                inputs: { application, repositoryUrl, imageRef },
             });
         const intervalMs = Number(ctx.taskContext["watch.interval_ms"] || Number.NaN);
         const summary = await runWatchLoop({

package/dist/watch.d.ts

@@ -156,48 +156,40 @@ export declare function parseCheckpoint(text: string): {
 export declare function worldCheckpoints(harness: TaskHarness, application: string): WatchCheckpoints;
 /** The recall text for an application's checkpoints. Exported so a test names it once. */
 export declare function checkpointQueryText(application: string): string;
+/**
+ * The name of the checked-in Scan mission in gibson's mission catalog.
+ *
+ * One file in `internal/platform/missioncatalog/missions/` is one mission,
+ * named for its file: `scan.cue` is `"scan"`.
+ */
+export declare const SCAN_CATALOG_MISSION = "scan";
 /** What a Scan mission needs to know about the pipeline that triggered it. */
 export interface ScanMissionInputs {
     application: string;
     pipeline: Pipeline;
     /** The project's clone url, so the Scan mission knows what to check out. */
     repositoryUrl: string;
-    /** The image the pipeline built, when the watch was told how to name it. */
-    imageRef?: string;
-    /** The registered target the runtime scans are allowed to reach. */
-    targetId?: string;
+    /** The image the pipeline published, by digest. */
+    imageRef: string;
 }
 /**
- * The Scan mission definition, as canonical proto JSON.
- *
- * STILL BUILT HERE, AND IT SHOULD NOT BE. gibson#1685 landed the Scan mission
- * as a checked-in definition in gibson's `missioncatalog`, and ADR-0018 makes
- * that copy authoritative: this function is meant to become a mission name plus
- * seven parameters, not a second description of the same graph.
- *
- * It cannot yet. `missioncatalog.Render` has no production caller, and
- * `CreateMission` carries only `mission_definition_json` — there is no field
- * naming a checked-in mission and none carrying its parameters, so an agent has
- * no way to ask for the catalog's copy. That is gibson#1688. Until it lands the
- * only way to originate a Scan is to send a graph, so this one stays, with the
- * shape the catalog definition expects: everything the fan-out needs is carried
- * in the node's task context, and the swap is this function's body alone.
- *
- * The definition is built as protojson by hand rather than through the
- * generated schema because the SDK's package exports only its index, and the
- * mission schema is not re-exported from it.
+ * The seven parameters the checked-in Scan mission is rendered with.
+ *
+ * These names are the catalog's, not ours: `missioncatalog.Params.fields()` is
+ * the one declaration of them, and the daemon REFUSES an unrecognised key
+ * rather than ignoring it. That refusal is the smuggling defence — `Params` has
+ * no target or host field, so the runtime target binds from the mission's
+ * `target_id` alone and a caller cannot point a scan at a host the tenant never
+ * registered. A key renamed here without renaming it there fails loudly at the
+ * next launch, which is the intended outcome.
+ *
+ * Every one is required. CUE refuses an incomplete render rather than
+ * substituting an empty string, so a missing commit fails instead of scanning
+ * HEAD and a missing image fails instead of scanning nothing.
  */
-export declare function scanMissionDefinition(inputs: ScanMissionInputs): unknown;
+export declare function scanCatalogParams(inputs: ScanMissionInputs): Record<string, string>;
 /** The child mission's name, which is also how a person finds it in the dashboard. */
 export declare function scanMissionName(inputs: ScanMissionInputs): string;
-/**
- * Render a string map as `map<string, gibson.common.v1.TypedValue>` in
- * protojson. Every value the loop passes is a string, so every entry is a
- * `stringValue`.
- */
-export declare function typedContext(ctx: Record<string, string>): Record<string, {
-    stringValue: string;
-}>;
 export interface HarnessScanLauncherOptions {
     /** Everything but the pipeline, which the launcher fills in per trigger. */
     inputs: Omit<ScanMissionInputs, "pipeline">;
@@ -205,8 +197,6 @@ export interface HarnessScanLauncherOptions {
     targetId: string;
     /** Ceiling on one Scan. Defaults to {@link DEFAULT_SCAN_TIMEOUT_MS}. */
     scanTimeoutMs?: number;
-    /** Override the definition, so gibson#1660 can supply the real one. */
-    definition?: (inputs: ScanMissionInputs) => unknown;
 }
 /**
  * A {@link ScanLauncher} over the harness callbacks, on the dispatch grant.
@@ -215,5 +205,29 @@ export interface HarnessScanLauncherOptions {
  * daemon resolves the parent from this harness, so the Scan mission is a child
  * of the watch mission and inherits its tenant. Nothing in the request names a
  * parent, a tenant or an originator, so nothing here can widen them.
+ *
+ * THE MISSION IS NAMED, NOT BUILT (ADR-0018, gibson#1688). The Scan mission is
+ * checked into gibson's `missioncatalog` and that copy is authoritative; this
+ * launcher sends its name and seven parameters. It used to build its own graph,
+ * because `CreateMission` had no way to ask for the catalog's copy — two
+ * descriptions of one mission, which is the parallel definition ADR-0027
+ * forbids. There is no fallback to the old path: a definition that only one of
+ * the two knew about is the drift the single copy exists to prevent.
+ *
+ * The request goes through the SDK's `buildCreateMissionRequest` rather than
+ * being assembled here, because that builder normalises the one trap in this
+ * call. `JSON.stringify(undefined)` encodes to zero bytes but
+ * `JSON.stringify(null)` encodes to the four-byte string `"null"`, so a graph
+ * field filled in unconditionally puts a non-empty body on the wire beside the
+ * catalog name; the daemon refuses the pair, and the failure reads as "the
+ * catalog path does not work" rather than "you passed a null definition".
+ *
+ * The response is then sent by hand rather than through `createTaskMission`,
+ * for one reason: `CreateMissionResponse` carries an in-band `error`, and the
+ * daemon puts its most useful refusals there — an unknown parameter key naming
+ * the key and listing the known set, or every missing parameter reported at
+ * once. `createTaskMission` reads only `mission`, so those would surface as
+ * "returned no mission" and the operator would lose the sentence that says what
+ * to fix.
  */
 export declare function harnessScanLauncher(harness: TaskHarness, opts: HarnessScanLauncherOptions): ScanLauncher;

package/dist/watch.js

@@ -1,4 +1,4 @@
-import { remember, taskKnowledge } from "@zeroroot-ai/sdk";
+import { buildCreateMissionRequest, remember, taskKnowledge } from "@zeroroot-ai/sdk";
 import { TRIGGER_STATUS } from "./gitlab.js";
 /**
  * The always-on watch loop (zerocool-plugins#88).
@@ -222,81 +222,47 @@ export function worldCheckpoints(harness, application) {
 export function checkpointQueryText(application) {
     return `${CHECKPOINT_KIND} application=${application}`;
 }
+// ---------------------------------------------------------------------------
+// The Scan mission
+// ---------------------------------------------------------------------------
 /**
- * The Scan mission definition, as canonical proto JSON.
+ * The name of the checked-in Scan mission in gibson's mission catalog.
  *
- * STILL BUILT HERE, AND IT SHOULD NOT BE. gibson#1685 landed the Scan mission
- * as a checked-in definition in gibson's `missioncatalog`, and ADR-0018 makes
- * that copy authoritative: this function is meant to become a mission name plus
- * seven parameters, not a second description of the same graph.
+ * One file in `internal/platform/missioncatalog/missions/` is one mission,
+ * named for its file: `scan.cue` is `"scan"`.
+ */
+export const SCAN_CATALOG_MISSION = "scan";
+/**
+ * The seven parameters the checked-in Scan mission is rendered with.
  *
- * It cannot yet. `missioncatalog.Render` has no production caller, and
- * `CreateMission` carries only `mission_definition_json` — there is no field
- * naming a checked-in mission and none carrying its parameters, so an agent has
- * no way to ask for the catalog's copy. That is gibson#1688. Until it lands the
- * only way to originate a Scan is to send a graph, so this one stays, with the
- * shape the catalog definition expects: everything the fan-out needs is carried
- * in the node's task context, and the swap is this function's body alone.
+ * These names are the catalog's, not ours: `missioncatalog.Params.fields()` is
+ * the one declaration of them, and the daemon REFUSES an unrecognised key
+ * rather than ignoring it. That refusal is the smuggling defence — `Params` has
+ * no target or host field, so the runtime target binds from the mission's
+ * `target_id` alone and a caller cannot point a scan at a host the tenant never
+ * registered. A key renamed here without renaming it there fails loudly at the
+ * next launch, which is the intended outcome.
  *
- * The definition is built as protojson by hand rather than through the
- * generated schema because the SDK's package exports only its index, and the
- * mission schema is not re-exported from it.
+ * Every one is required. CUE refuses an incomplete render rather than
+ * substituting an empty string, so a missing commit fails instead of scanning
+ * HEAD and a missing image fails instead of scanning nothing.
  */
-export function scanMissionDefinition(inputs) {
-    const { application, pipeline } = inputs;
-    const context = {
-        "zerocool.task": "source-analysis",
-        application,
-        "pipeline.id": String(pipeline.id),
-        "pipeline.url": pipeline.webUrl,
-        "repository.url": inputs.repositoryUrl,
-        "repository.ref": pipeline.ref,
-        "repository.commit": pipeline.sha,
-        ...(inputs.imageRef ? { "image.ref": inputs.imageRef } : {}),
-        ...(inputs.targetId ? { "target.id": inputs.targetId } : {}),
-    };
+export function scanCatalogParams(inputs) {
+    const { pipeline } = inputs;
     return {
-        name: scanMissionName(inputs),
-        description: `Scan ${application} at ${pipeline.sha.slice(0, 12)}, originated by the always-on agent ` +
-            `for pipeline ${pipeline.id}.`,
-        version: "1.0.0",
-        nodes: {
-            scan: {
-                id: "scan",
-                type: "NODE_TYPE_AGENT",
-                name: "scan",
-                description: "Source analysis of the commit the pipeline built.",
-                agentConfig: {
-                    agentName: "zerocool",
-                    task: {
-                        id: "scan",
-                        goal: `Scan the ${application} repository at commit ${pipeline.sha} and submit a Finding for ` +
-                            "every real weakness you can support with evidence.",
-                        context: typedContext(context),
-                    },
-                },
-            },
-        },
-        entryPoints: ["scan"],
+        application: inputs.application,
+        repositoryUrl: inputs.repositoryUrl,
+        ref: pipeline.ref,
+        commit: pipeline.sha,
+        pipelineId: String(pipeline.id),
+        pipelineUrl: pipeline.webUrl,
+        imageRef: inputs.imageRef,
     };
 }
 /** The child mission's name, which is also how a person finds it in the dashboard. */
 export function scanMissionName(inputs) {
     return `scan ${inputs.application} pipeline ${inputs.pipeline.id}`;
 }
-/**
- * Render a string map as `map<string, gibson.common.v1.TypedValue>` in
- * protojson. Every value the loop passes is a string, so every entry is a
- * `stringValue`.
- */
-export function typedContext(ctx) {
-    const out = {};
-    for (const [k, v] of Object.entries(ctx)) {
-        if (v !== "")
-            out[k] = { stringValue: v };
-    }
-    return out;
-}
 /**
  * A {@link ScanLauncher} over the harness callbacks, on the dispatch grant.
  *
@@ -304,19 +270,43 @@ export function typedContext(ctx) {
  * daemon resolves the parent from this harness, so the Scan mission is a child
  * of the watch mission and inherits its tenant. Nothing in the request names a
  * parent, a tenant or an originator, so nothing here can widen them.
+ *
+ * THE MISSION IS NAMED, NOT BUILT (ADR-0018, gibson#1688). The Scan mission is
+ * checked into gibson's `missioncatalog` and that copy is authoritative; this
+ * launcher sends its name and seven parameters. It used to build its own graph,
+ * because `CreateMission` had no way to ask for the catalog's copy — two
+ * descriptions of one mission, which is the parallel definition ADR-0027
+ * forbids. There is no fallback to the old path: a definition that only one of
+ * the two knew about is the drift the single copy exists to prevent.
+ *
+ * The request goes through the SDK's `buildCreateMissionRequest` rather than
+ * being assembled here, because that builder normalises the one trap in this
+ * call. `JSON.stringify(undefined)` encodes to zero bytes but
+ * `JSON.stringify(null)` encodes to the four-byte string `"null"`, so a graph
+ * field filled in unconditionally puts a non-empty body on the wire beside the
+ * catalog name; the daemon refuses the pair, and the failure reads as "the
+ * catalog path does not work" rather than "you passed a null definition".
+ *
+ * The response is then sent by hand rather than through `createTaskMission`,
+ * for one reason: `CreateMissionResponse` carries an in-band `error`, and the
+ * daemon puts its most useful refusals there — an unknown parameter key naming
+ * the key and listing the known set, or every missing parameter reported at
+ * once. `createTaskMission` reads only `mission`, so those would surface as
+ * "returned no mission" and the operator would lose the sentence that says what
+ * to fix.
  */
 export function harnessScanLauncher(harness, opts) {
-    const build = opts.definition ?? scanMissionDefinition;
     const timeoutMs = BigInt(opts.scanTimeoutMs ?? DEFAULT_SCAN_TIMEOUT_MS);
     return {
         async launch(pipeline) {
-            const inputs = { ...opts.inputs, pipeline, targetId: opts.targetId };
-            const created = await harness.client.createMission({
-                context: harness.context,
-                missionDefinitionJson: new TextEncoder().encode(JSON.stringify(build(inputs))),
+            const inputs = { ...opts.inputs, pipeline };
+            const wire = buildCreateMissionRequest({
+                catalogMission: SCAN_CATALOG_MISSION,
+                catalogParams: scanCatalogParams(inputs),
                 targetId: opts.targetId,
                 name: scanMissionName(inputs),
             });
+            const created = await harness.client.createMission({ context: harness.context, ...wire });
             if (created.error) {
                 throw new Error(`CreateMission refused: ${created.error.message}`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeroroot-ai/zerocool",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "opencode plugin: Gibson platform integration (zerocool). Zero-config LLM, tools, findings, knowledge, delegate/missions.",
   "license": "MIT",
   "repository": {
@@ -23,7 +23,7 @@
     "test": "tsc -p tsconfig.test.json && node --test \"dist-test/**/*.test.js\""
   },
   "dependencies": {
-    "@zeroroot-ai/sdk": "^0.10.0"
+    "@zeroroot-ai/sdk": "^0.11.0"
   },
   "peerDependencies": {
     "@opencode-ai/plugin": "*"