chainlesschain 0.162.188 → 0.162.193

package/src/lib/agent-core.js

@@ -50,9 +50,11 @@ export {
   _anthropicThinkingParams,
   _normalizeAnthropicResponse,
   _resetFileFreshness,
+  _withPostEditDiagnostics,
   _getSharedCodeIntel,
   disposeSharedCodeIntel,
   emitToolHookLifecycle,
   emitToolBatchHookLifecycle,
+  buildSubAgentHandoffContext,
   _resetSubtreeInstructionLoaders,
 } from "../runtime/agent-core.js";

package/src/lib/agent-sandbox.js

@@ -5,6 +5,11 @@ import { proxyEnv } from "./sandbox-egress-proxy.js";
 import executionBroker from "./process-execution-broker/index.js";
 
 export const DEFAULT_SANDBOX_IMAGE = "node:22-bookworm-slim";
+export const AGENT_SANDBOX_MODES = Object.freeze([
+  "off",
+  "workspace-write",
+  "strict",
+]);
 export const _deps = {
   spawnSync: (...args) => executionBroker.spawnSync(...args),
 };
@@ -82,8 +87,7 @@ function pathIsWithin(candidate, root) {
 }
 
 function normalizeWorkspaceRoots(entries, cwd) {
-  const roots =
-    Array.isArray(entries) && entries.length > 0 ? entries : [cwd];
+  const roots = Array.isArray(entries) && entries.length > 0 ? entries : [cwd];
   return stringList(roots).map((entry) => path.resolve(cwd, entry));
 }
 
@@ -142,9 +146,7 @@ export function resolveSandboxPolicyPath(
       ? normalizedPolicy.allowWrite
       : normalizedPolicy.allowRead;
   const policyDenies =
-    access === "write"
-      ? normalizedPolicy.denyWrite
-      : normalizedPolicy.denyRead;
+    access === "write" ? normalizedPolicy.denyWrite : normalizedPolicy.denyRead;
   const allowedInputs = [
     ...normalizeWorkspaceRoots(workspaceRoots, resolvedCwd),
     ...resolvePolicyPaths(policyAllows, resolvedCwd),
@@ -208,18 +210,112 @@ export function normalizeSandboxPolicy(settings = {}, cwd = process.cwd()) {
 
 export function normalizeAgentSandbox(value, options = {}) {
   const settings = options.settings || {};
-  if (!value && settings.enabled !== true) return null;
-  if (value === false || settings.enabled === false) return null;
+  const policyRequiresSandbox =
+    settings.requireSandbox === true ||
+    settings.allowUnsandboxedCommands === false;
+  if (!value && settings.enabled !== true && !policyRequiresSandbox)
+    return null;
+  if (value === false || settings.enabled === false) {
+    if (policyRequiresSandbox) {
+      const error = new Error(
+        "Sandbox disablement is prohibited by effective sandbox policy",
+      );
+      error.code = "CONFIG_SANDBOX_OFF_PROHIBITED";
+      throw error;
+    }
+    return null;
+  }
+  const effectiveSettings = policyRequiresSandbox
+    ? {
+        ...settings,
+        enabled: true,
+        failIfUnavailable: true,
+        allowUnsandboxedCommands: false,
+      }
+    : settings;
+  const managedNetworkDisabled = options.managedSettings?.network === false;
   const image =
     typeof value === "string" && value.trim() && value !== "true"
       ? value.trim()
       : DEFAULT_SANDBOX_IMAGE;
   return {
-    engine: settings.engine || "docker",
-    image: settings.image || image,
+    engine: effectiveSettings.engine || "docker",
+    image: effectiveSettings.image || image,
     cwd: path.resolve(options.cwd || process.cwd()),
-    network: options.network === true || settings.network === true,
-    policy: normalizeSandboxPolicy(settings, options.cwd || process.cwd()),
+    network: managedNetworkDisabled
+      ? false
+      : options.network === true || effectiveSettings.network === true,
+    policy: normalizeSandboxPolicy(
+      effectiveSettings,
+      options.cwd || process.cwd(),
+    ),
+  };
+}
+
+/**
+ * Resolve the explicit public sandbox posture. Both isolation modes fail
+ * closed when the selected engine is unavailable; `strict` additionally
+ * forbids per-command unsandboxed escape hatches and network access.
+ */
+export function normalizeAgentSandboxMode(mode, value, options = {}) {
+  if (mode == null || mode === "") {
+    return normalizeAgentSandbox(value, options);
+  }
+  if (!AGENT_SANDBOX_MODES.includes(mode)) {
+    const error = new Error(
+      `Invalid sandbox mode "${mode}"; expected off, workspace-write, or strict`,
+    );
+    error.code = "CONFIG_SANDBOX_MODE_INVALID";
+    throw error;
+  }
+  const settings = { ...(options.settings || {}) };
+  if (mode === "off") {
+    const managedSettings = options.managedSettings || {};
+    if (
+      managedSettings.enabled === true ||
+      managedSettings.requireSandbox === true ||
+      managedSettings.allowUnsandboxedCommands === false ||
+      settings.requireSandbox === true ||
+      settings.allowUnsandboxedCommands === false
+    ) {
+      const error = new Error(
+        "Sandbox mode off is prohibited by managed/effective sandbox policy",
+      );
+      error.code = "CONFIG_SANDBOX_OFF_PROHIBITED";
+      throw error;
+    }
+    return null;
+  }
+  settings.enabled = true;
+  settings.failIfUnavailable = true;
+  settings.allowUnsandboxedCommands = false;
+  if (mode === "strict") {
+    settings.network = false;
+  }
+  const sandbox = normalizeAgentSandbox(value || true, {
+    ...options,
+    network: mode === "strict" ? false : options.network,
+    settings,
+  });
+  sandbox.mode = mode;
+  return sandbox;
+}
+
+/**
+ * Clamp an already-enabled sandbox to fail closed for safety-oriented run
+ * modes. This never turns isolation on implicitly; it only prevents a selected
+ * sandbox from degrading to bare host execution when its engine is missing.
+ */
+export function enforceSandboxFailClosed(sandbox, reason = "safe") {
+  if (!sandbox) return null;
+  return {
+    ...sandbox,
+    failClosedReason: reason,
+    policy: {
+      ...(sandbox.policy || {}),
+      allowUnsandboxedCommands: false,
+      failIfUnavailable: true,
+    },
   };
 }
 
@@ -229,21 +325,19 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
   }
   const hostCwd = path.resolve(options.cwd || sandbox.cwd);
   const policy = sandbox.policy || normalizeSandboxPolicy({}, hostCwd);
-  // An egress proxy (see sandbox-egress-proxy.js) ENFORCES the domain allow/deny
-  // policy: the caller starts it and passes `{ env }` here, and the sandboxed
-  // process routes its HTTP(S) traffic through it. Without a proxy, a
-  // domain-restricted network request has no enforcement point, so we refuse
-  // rather than grant unrestricted access.
+  // Proxy environment variables are advisory: a child can clear them or open a
+  // raw socket. Until a backend can enforce egress below the process layer,
+  // domain-restricted networking must fail closed instead of granting the
+  // sandbox an unrestricted network namespace.
   const egress = options.egressProxy || null;
   if (
     (policy.allowedDomains.length || policy.deniedDomains.length) &&
-    sandbox.network &&
-    !egress
+    sandbox.network
   ) {
     return {
       stdout: "",
       stderr:
-        "Domain-restricted sandbox networking requires a configured sandbox proxy; refusing unrestricted network access",
+        "Domain-restricted sandbox networking has no non-bypassable backend enforcement; refusing unrestricted network access",
       exitCode: 1,
       failedToStart: true,
     };
@@ -272,10 +366,8 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
   if (process.platform !== "win32" && process.getuid && process.getgid) {
     args.push("--user", `${process.getuid()}:${process.getgid()}`);
   }
-  // Route egress through the host proxy so the domain policy is enforced. The
-  // container reaches the host proxy via host.docker.internal (mapped to the
-  // gateway on Linux via host-gateway); the caller builds `egress.env` with that
-  // hostname (proxyEnv(port, "host.docker.internal")).
+  // Proxy variables remain useful for unrestricted networking, but are not a
+  // security boundary. Domain-restricted requests have already failed closed.
   if (egress && egress.port && sandbox.network) {
     args.push("--add-host", "host.docker.internal:host-gateway");
     const penv = proxyEnv(egress.port, "host.docker.internal");
@@ -348,8 +440,8 @@ function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
   for (const target of policy.denyWrite) args.push("--ro-bind", target, target);
   for (const target of policy.denyRead) args.push("--tmpfs", target);
   args.push("--", "sh", "-lc", String(command || ""));
-  // bwrap `--share-net` shares the host network namespace, so the egress proxy
-  // is reachable at 127.0.0.1 directly — merge its env into the child's.
+  // bwrap `--share-net` shares the host network namespace. Proxy variables are
+  // convenience only; domain-restricted requests have already failed closed.
   const egress = options.egressProxy || null;
   const bwrapEnv =
     egress && egress.port && sandbox.network
@@ -459,7 +551,7 @@ export function assertSandboxAvailable(sandbox, deps = _deps) {
 
 export function sandboxSummary(sandbox) {
   if (!sandbox) return null;
-  return {
+  const summary = {
     engine: sandbox.engine,
     image: sandbox.image,
     isolationLevel: isolationLevel(sandbox),
@@ -474,4 +566,6 @@ export function sandboxSummary(sandbox) {
       failIfUnavailable: sandbox.policy?.failIfUnavailable === true,
     },
   };
+  if (sandbox.mode) summary.mode = sandbox.mode;
+  return summary;
 }

package/src/lib/agent-session-export.js

@@ -7,6 +7,7 @@
  * Pure function over the event list (see jsonl-session-store.js appendEvent):
  *   { type, timestamp, data }
  *   types: session_start{title,provider,model} · user_message · assistant_message
+ *          · ws_turn{requestId,user,assistant,outcome}
  *          · system · tool_call{tool,args} · tool_result{tool,result}
  *          · compact(stats) · token_usage{...}
  */
@@ -76,6 +77,25 @@ export function renderAgentSessionMarkdown(sessionId, events, opts = {}) {
         L.push(asText(ev.data?.content));
         L.push("");
         break;
+      case "ws_turn":
+        if (
+          ev.data?.schemaVersion === 1 &&
+          ev.data?.outcome === "completed" &&
+          ev.data?.user?.role === "user" &&
+          ev.data?.assistant?.role === "assistant"
+        ) {
+          users += 1;
+          assistants += 1;
+          L.push("## 👤 User");
+          L.push("");
+          L.push(asText(ev.data.user.content));
+          L.push("");
+          L.push("## 🤖 Assistant");
+          L.push("");
+          L.push(asText(ev.data.assistant.content));
+          L.push("");
+        }
+        break;
       case "system":
         L.push("## ⚙ System");
         L.push("");

package/src/lib/agent-team/task-lease.js

@@ -28,6 +28,11 @@ import { randomUUID } from "node:crypto";
 
 export const DEFAULT_LEASE_TTL_MS = 60000;
 export const DEFAULT_MAX_ATTEMPTS = 3;
+export const ADJUDICATION_DECISIONS = Object.freeze({
+  RETRY: "retry",
+  ACCEPT: "accept",
+  CANCEL: "cancel",
+});
 
 export class TaskLeaseRegistry {
   constructor({
@@ -423,7 +428,14 @@ export class TaskLeaseRegistry {
    */
   fail(
     key,
-    { holder, leaseId, error = null, retryable = true, now = this._now() } = {},
+    {
+      holder,
+      leaseId,
+      error = null,
+      retryable = true,
+      adjudication = null,
+      now = this._now(),
+    } = {},
   ) {
     const id = this._byKey.get(key);
     const task = id ? this._tasks.get(id) : null;
@@ -434,6 +446,23 @@ export class TaskLeaseRegistry {
     }
     const attempts = (task.metadata?.attempts || 0) + 1;
     const willRetry = retryable !== false && attempts < this.maxAttempts;
+    const adjudicationRequest =
+      !willRetry && adjudication && typeof adjudication === "object"
+        ? {
+            required: true,
+            code:
+              adjudication.code ||
+              "TEAM_TASK_SIDE_EFFECT_ADJUDICATION_REQUIRED",
+            reason:
+              adjudication.reason ||
+              (error ? String(error) : "task outcome requires adjudication"),
+            evidenceDigest: adjudication.evidenceDigest || null,
+            requestedAt: Number.isFinite(adjudication.requestedAt)
+              ? adjudication.requestedAt
+              : now,
+            decision: null,
+          }
+        : task.metadata?.adjudication || null;
     const ok = this._write(task, {
       status: willRetry ? TASK_STATUS.PENDING : TASK_STATUS.CANCELLED,
       assignee: null,
@@ -442,6 +471,7 @@ export class TaskLeaseRegistry {
         lease: null,
         attempts,
         lastError: error ? String(error) : null,
+        ...(adjudicationRequest ? { adjudication: adjudicationRequest } : {}),
       },
     });
     if (!ok) return { ok: false, reason: "concurrent" };
@@ -529,6 +559,14 @@ export class TaskLeaseRegistry {
       if (!candidate.retry) {
         metadata.attempts = (fresh.metadata?.attempts || 0) + 1;
         metadata.lastError = String(error);
+        metadata.adjudication = {
+          required: true,
+          code: "TEAM_TASK_ABANDONED_ADJUDICATION_REQUIRED",
+          reason: String(error),
+          evidenceDigest: null,
+          requestedAt: this._now(),
+          decision: null,
+        };
       }
       if (
         this._write(fresh, {
@@ -550,6 +588,234 @@ export class TaskLeaseRegistry {
     return { reclaimed, adjudicationRequired };
   }
 
+  /**
+   * Resolve a fail-closed task after a durable human decision has been
+   * authenticated by the adjudication log.
+   *
+   * This is deliberately the only TaskLeaseRegistry operation allowed to move
+   * a CANCELLED task out of a terminal state. The generic SharedTaskList keeps
+   * its terminal-state invariant; this method performs a compare-by-revision
+   * replacement and records the exceptional transition in task history.
+   */
+  resolveAdjudication(
+    key,
+    {
+      decision,
+      decisionId,
+      actor = "human",
+      reason = null,
+      evidenceDigest = null,
+      result = null,
+      now = this._now(),
+    } = {},
+  ) {
+    const allowed = new Set(Object.values(ADJUDICATION_DECISIONS));
+    if (!allowed.has(decision)) {
+      return { ok: false, reason: "invalid_decision" };
+    }
+    if (!decisionId || typeof decisionId !== "string") {
+      return { ok: false, reason: "decision_id_required" };
+    }
+    const id = this._byKey.get(key);
+    const task = id ? this._tasks.get(id) : null;
+    if (!task) return { ok: false, reason: "not_found" };
+    const pending = task.metadata?.adjudication || null;
+    if (pending?.required !== true) {
+      const prior = pending?.decision || null;
+      if (prior?.id === decisionId && prior?.action === decision) {
+        return {
+          ok: true,
+          idempotent: true,
+          decision,
+          status: task.status,
+        };
+      }
+      return { ok: false, reason: "adjudication_not_required" };
+    }
+    if (task.status !== TASK_STATUS.CANCELLED) {
+      return { ok: false, reason: "invalid_task_state" };
+    }
+    if (pending.evidenceDigest && pending.evidenceDigest !== evidenceDigest) {
+      return { ok: false, reason: "evidence_mismatch" };
+    }
+
+    const status =
+      decision === ADJUDICATION_DECISIONS.RETRY
+        ? TASK_STATUS.PENDING
+        : decision === ADJUDICATION_DECISIONS.ACCEPT
+          ? TASK_STATUS.COMPLETED
+          : TASK_STATUS.CANCELLED;
+    const decidedAt = Number.isFinite(now) ? now : this._now();
+    const decisionRecord = {
+      id: decisionId,
+      action: decision,
+      actor: actor ? String(actor) : "human",
+      reason: reason == null ? null : String(reason),
+      evidenceDigest: evidenceDigest || pending.evidenceDigest || null,
+      decidedAt,
+    };
+    const snapshot = this._tasks.snapshot();
+    const stored = snapshot.tasks.find((candidate) => candidate.id === task.id);
+    if (!stored || stored.rev !== task.rev) {
+      return { ok: false, reason: "concurrent" };
+    }
+    stored.status = status;
+    stored.assignee = null;
+    stored.updatedAt = decidedAt;
+    stored.rev += 1;
+    stored.metadata = {
+      ...stored.metadata,
+      lease: null,
+      ...(decision === ADJUDICATION_DECISIONS.ACCEPT
+        ? {
+            result: result ?? {
+              adjudicated: true,
+              decisionId,
+            },
+          }
+        : {}),
+      adjudication: {
+        ...pending,
+        required: false,
+        decision: decisionRecord,
+      },
+    };
+    stored.history = [
+      ...(stored.history || []),
+      {
+        ts: decidedAt,
+        actor: decisionRecord.actor,
+        action: "adjudicated",
+        changes: ["status", "assignee", "metadata"],
+        decision: decisionRecord.action,
+        decisionId,
+      },
+    ];
+    this._tasks = SharedTaskList.restore(snapshot, { now: this._now });
+    this._rebuildIndexes();
+    if (status === TASK_STATUS.PENDING) {
+      this._enqueueIfReady(key, decidedAt);
+    } else if (status === TASK_STATUS.COMPLETED) {
+      for (const dependent of this._dependentsByKey.get(key) || []) {
+        this._enqueueIfReady(dependent, decidedAt);
+      }
+    }
+    return { ok: true, decision, status };
+  }
+
+  /**
+   * Force any recovery-ambiguous task into the fail-closed adjudication state.
+   * This exceptional transition is used only when durable collaboration
+   * evidence contradicts or weakens the registry snapshot.
+   */
+  requireAdjudication(
+    key,
+    {
+      code = "TEAM_TASK_SIDE_EFFECT_ADJUDICATION_REQUIRED",
+      reason = "task outcome requires adjudication",
+      evidenceDigest = null,
+      now = this._now(),
+    } = {},
+  ) {
+    const id = this._byKey.get(key);
+    const task = id ? this._tasks.get(id) : null;
+    if (!task) return { ok: false, reason: "not_found" };
+    if (task.metadata?.adjudication?.required === true) {
+      return { ok: true, idempotent: true };
+    }
+    const snapshot = this._tasks.snapshot();
+    const stored = snapshot.tasks.find((candidate) => candidate.id === task.id);
+    if (!stored || stored.rev !== task.rev) {
+      return { ok: false, reason: "concurrent" };
+    }
+    const requestedAt = Number.isFinite(now) ? now : this._now();
+    const priorStatus = stored.status;
+    stored.status = TASK_STATUS.CANCELLED;
+    stored.assignee = null;
+    stored.updatedAt = requestedAt;
+    stored.rev += 1;
+    stored.metadata = {
+      ...stored.metadata,
+      lease: null,
+      lastError: String(reason),
+      adjudication: {
+        required: true,
+        code: String(code),
+        reason: String(reason),
+        evidenceDigest: evidenceDigest || null,
+        requestedAt,
+        priorStatus,
+        decision: null,
+      },
+    };
+    stored.history = [
+      ...(stored.history || []),
+      {
+        ts: requestedAt,
+        actor: "recovery",
+        action: "adjudication-required",
+        changes: ["status", "assignee", "metadata"],
+      },
+    ];
+    this._tasks = SharedTaskList.restore(snapshot, { now: this._now });
+    this._rebuildIndexes();
+    return { ok: true, priorStatus };
+  }
+
+  /** Bind a pending adjudication to its immutable durable case evidence. */
+  bindAdjudicationCase(key, { caseId, registryDigest, sideEffectDigest } = {}) {
+    const id = this._byKey.get(key);
+    const task = id ? this._tasks.get(id) : null;
+    if (!task) return { ok: false, reason: "not_found" };
+    const adjudication = task.metadata?.adjudication || null;
+    if (adjudication?.required !== true) {
+      return { ok: false, reason: "adjudication_not_required" };
+    }
+    for (const [name, value] of Object.entries({
+      caseId,
+      registryDigest,
+      sideEffectDigest,
+    })) {
+      if (typeof value !== "string" || value.length === 0) {
+        return { ok: false, reason: `${name}_required` };
+      }
+    }
+    const current = adjudication.case || null;
+    if (current) {
+      if (
+        current.caseId === caseId &&
+        current.registryDigest === registryDigest &&
+        current.sideEffectDigest === sideEffectDigest
+      ) {
+        return { ok: true, idempotent: true, case: { ...current } };
+      }
+      return { ok: false, reason: "case_binding_conflict" };
+    }
+    const binding = { caseId, registryDigest, sideEffectDigest };
+    const ok = this._write(task, {
+      metadata: {
+        ...task.metadata,
+        adjudication: {
+          ...adjudication,
+          case: binding,
+        },
+      },
+    });
+    return ok
+      ? { ok: true, case: { ...binding } }
+      : { ok: false, reason: "concurrent" };
+  }
+
+  pendingAdjudications() {
+    return this.list()
+      .filter((task) => task.metadata?.adjudication?.required === true)
+      .map((task) => ({
+        key: task.key,
+        status: task.status,
+        ...task.metadata.adjudication,
+      }));
+  }
+
   stats({ now = this._now() } = {}) {
     const base = this._tasks.stats();
     let leased = 0;
@@ -566,6 +832,7 @@ export class TaskLeaseRegistry {
       leased,
       expiredLeases: expired,
       claimable: this.claimable({ now }).length,
+      adjudicationRequired: this.pendingAdjudications().length,
     };
   }
 
@@ -575,8 +842,9 @@ export class TaskLeaseRegistry {
       .list()
       .every(
         (t) =>
-          t.status === TASK_STATUS.COMPLETED ||
-          t.status === TASK_STATUS.CANCELLED,
+          (t.status === TASK_STATUS.COMPLETED ||
+            t.status === TASK_STATUS.CANCELLED) &&
+          t.metadata?.adjudication?.required !== true,
       );
   }