chainlesschain 0.163.6 → 0.163.7

package/src/lib/cowork-cron.js

@@ -60,6 +60,7 @@ export const _deps = {
 
 export const COWORK_SCHEDULER_UNKNOWN_LEASE_EXPIRES_AT =
   "9999-12-31T23:59:59.999Z";
+export const COWORK_SCHEDULER_MIGRATION_SCHEMA_VERSION = 1;
 
 function coworkSchedulerError(
   code,
@@ -85,6 +86,81 @@ function normalizedDate(value, label) {
   return date;
 }
 
+function stableJsonValue(value) {
+  if (Array.isArray(value)) return value.map(stableJsonValue);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value)
+        .sort()
+        .map((key) => [key, stableJsonValue(value[key])]),
+    );
+  }
+  return value;
+}
+
+export function coworkCronMigrationSourceSnapshot(schedule) {
+  const source = { ...schedule };
+  delete source.activeDelivery;
+  delete source.deliveryFence;
+  delete source.schedulerExecution;
+  delete source.schedulerMigration;
+  delete source.lastDeliveryId;
+  delete source.lastRunAt;
+  delete source.lastStatus;
+  delete source.nextAt;
+  delete source.missedRunPolicy;
+  return stableJsonValue(source);
+}
+
+export function coworkCronMigrationSourceDigest(schedule) {
+  return crypto
+    .createHash("sha256")
+    .update(
+      "chainlesschain.cowork-cron.scheduler-migration-source.v1\0",
+      "utf8",
+    )
+    .update(JSON.stringify(coworkCronMigrationSourceSnapshot(schedule)), "utf8")
+    .digest("hex");
+}
+
+function migrationField(value, field) {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw coworkSchedulerError(
+      "COWORK_SCHEDULER_MIGRATION_INVALID",
+      `Cowork scheduler migration ${field} is required`,
+    );
+  }
+  return value.trim();
+}
+
+function coworkMigrationFence(schedule, nowMs) {
+  const migration = schedule.schedulerMigration;
+  const expiresAt = Date.parse(schedule.activeDelivery?.leaseExpiresAt || "");
+  return (
+    migration?.schemaVersion === COWORK_SCHEDULER_MIGRATION_SCHEMA_VERSION &&
+    typeof migration.retirementToken === "string" &&
+    schedule.activeDelivery?.ownerId ===
+      `scheduler-migration:${migration.retirementToken}` &&
+    Number.isFinite(expiresAt) &&
+    expiresAt > nowMs
+  );
+}
+
+function applyCoworkMigrationFence(schedule, now) {
+  const token = schedule.schedulerMigration?.retirementToken;
+  if (typeof token !== "string" || token.length === 0) return false;
+  const fence = Math.max(Number(schedule.deliveryFence) || 0, 0) + 1;
+  schedule.deliveryFence = fence;
+  schedule.activeDelivery = {
+    deliveryId: `scheduler-migration:${token}`,
+    ownerId: `scheduler-migration:${token}`,
+    fence,
+    claimedAt: now.toISOString(),
+    leaseExpiresAt: COWORK_SCHEDULER_UNKNOWN_LEASE_EXPIRES_AT,
+  };
+  return true;
+}
+
 // ─── Cron parser ─────────────────────────────────────────────────────────────
 
 const FIELD_RANGES = [
@@ -687,6 +763,205 @@ export function getSchedule(cwd, id) {
   );
 }
 
+export function prepareCoworkSchedulerMigration(
+  cwd,
+  id,
+  { migrationId, sourceDigest, targetJobId } = {},
+) {
+  const migration = migrationField(migrationId, "migrationId");
+  const digest = migrationField(sourceDigest, "sourceDigest");
+  const target = migrationField(targetJobId, "targetJobId");
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
+    const schedule = schedules.find((entry) => entry.id === id);
+    if (!schedule) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_SCHEDULE_NOT_FOUND",
+        `Cowork schedule does not exist: ${id}`,
+      );
+    }
+    if (schedule.enabled !== true) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_SCHEDULE_DISABLED",
+        `Cowork schedule is disabled: ${id}`,
+      );
+    }
+    if (coworkCronMigrationSourceDigest(schedule) !== digest) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_MIGRATION_SOURCE_CHANGED",
+        `Cowork schedule changed before migration: ${id}`,
+      );
+    }
+    const prior = schedule.schedulerMigration;
+    if (prior) {
+      if (
+        prior.schemaVersion !== COWORK_SCHEDULER_MIGRATION_SCHEMA_VERSION ||
+        prior.migrationId !== migration ||
+        prior.sourceDigest !== digest ||
+        prior.targetJobId !== target ||
+        prior.state !== "prepared"
+      ) {
+        throw coworkSchedulerError(
+          "COWORK_SCHEDULER_MIGRATION_CONFLICT",
+          `Cowork schedule already belongs to another migration: ${id}`,
+        );
+      }
+      return schedule;
+    }
+    schedule.schedulerMigration = {
+      schemaVersion: COWORK_SCHEDULER_MIGRATION_SCHEMA_VERSION,
+      state: "prepared",
+      migrationId: migration,
+      sourceDigest: digest,
+      targetJobId: target,
+      preparedAt: _deps.now().toISOString(),
+    };
+    _saveSchedulesUnlocked(cwd, schedules);
+    return schedule;
+  });
+}
+
+export function retireCoworkSchedulerMigration(
+  cwd,
+  id,
+  {
+    migrationId,
+    sourceDigest,
+    targetJobId,
+    retirementToken,
+    at = _deps.now(),
+  } = {},
+) {
+  const migration = migrationField(migrationId, "migrationId");
+  const digest = migrationField(sourceDigest, "sourceDigest");
+  const target = migrationField(targetJobId, "targetJobId");
+  const token = migrationField(retirementToken, "retirementToken");
+  const now = normalizedDate(at, "cowork scheduler migration retirement");
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
+    const schedule = schedules.find((entry) => entry.id === id);
+    if (!schedule) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_SCHEDULE_NOT_FOUND",
+        `Cowork schedule does not exist: ${id}`,
+      );
+    }
+    const prior = schedule.schedulerMigration;
+    if (
+      prior?.schemaVersion !== COWORK_SCHEDULER_MIGRATION_SCHEMA_VERSION ||
+      prior.migrationId !== migration ||
+      prior.sourceDigest !== digest ||
+      prior.targetJobId !== target ||
+      !["prepared", "retired"].includes(prior.state)
+    ) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_MIGRATION_CONFLICT",
+        `Cowork migration preparation changed before retirement: ${id}`,
+      );
+    }
+    if (prior.state === "retired") {
+      if (
+        prior.retirementToken !== token ||
+        !coworkMigrationFence(schedule, now.getTime())
+      ) {
+        throw coworkSchedulerError(
+          "COWORK_SCHEDULER_MIGRATION_CONFLICT",
+          `Cowork migration retirement fence changed: ${id}`,
+        );
+      }
+      return schedule;
+    }
+    if (coworkCronMigrationSourceDigest(schedule) !== digest) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_MIGRATION_SOURCE_CHANGED",
+        `Cowork schedule changed before retirement: ${id}`,
+      );
+    }
+    const activeExpiresAt = Date.parse(
+      schedule.activeDelivery?.leaseExpiresAt || "",
+    );
+    if (
+      schedule.activeDelivery &&
+      Number.isFinite(activeExpiresAt) &&
+      activeExpiresAt > now.getTime()
+    ) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_LEGACY_CLAIM_ACTIVE",
+        `Cowork schedule is already claimed: ${id}`,
+        { retryable: true, retryAt: activeExpiresAt },
+      );
+    }
+    schedule.schedulerMigration = {
+      ...prior,
+      state: "retired",
+      retirementToken: token,
+      retiredAt: now.toISOString(),
+    };
+    applyCoworkMigrationFence(schedule, now);
+    _saveSchedulesUnlocked(cwd, schedules);
+    return schedule;
+  });
+}
+
+export function restoreCoworkSchedulerMigration(
+  cwd,
+  id,
+  { migrationId, sourceDigest, targetJobId, retirementToken } = {},
+) {
+  const migration = migrationField(migrationId, "migrationId");
+  const expectedDigest = migrationField(sourceDigest, "sourceDigest");
+  const target = migrationField(targetJobId, "targetJobId");
+  const token =
+    retirementToken === null || retirementToken === undefined
+      ? null
+      : migrationField(retirementToken, "retirementToken");
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
+    const schedule = schedules.find((entry) => entry.id === id);
+    if (!schedule) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_SCHEDULE_NOT_FOUND",
+        `Cowork schedule does not exist: ${id}`,
+      );
+    }
+    const current = schedule.schedulerMigration;
+    if (!current) {
+      if (
+        coworkCronMigrationSourceDigest(schedule) !== expectedDigest ||
+        String(schedule.activeDelivery?.ownerId || "").startsWith(
+          "scheduler-migration:",
+        )
+      ) {
+        throw coworkSchedulerError(
+          "COWORK_SCHEDULER_MIGRATION_CONFLICT",
+          `Cowork source changed after rollback restoration: ${id}`,
+        );
+      }
+      return schedule;
+    }
+    if (
+      current?.schemaVersion !== COWORK_SCHEDULER_MIGRATION_SCHEMA_VERSION ||
+      current.migrationId !== migration ||
+      current.sourceDigest !== expectedDigest ||
+      current.targetJobId !== target ||
+      !["prepared", "retired"].includes(current.state) ||
+      coworkCronMigrationSourceDigest(schedule) !== expectedDigest ||
+      (current.state === "retired" &&
+        (current.retirementToken !== token ||
+          schedule.activeDelivery?.ownerId !== `scheduler-migration:${token}`))
+    ) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_MIGRATION_CONFLICT",
+        `Cowork migration fence changed before rollback: ${id}`,
+      );
+    }
+    delete schedule.schedulerMigration;
+    if (current.state === "retired") schedule.activeDelivery = null;
+    _saveSchedulesUnlocked(cwd, schedules);
+    return schedule;
+  });
+}
+
 /**
  * Bind a scheduler-kernel occurrence before starting the Cowork task.
  * The same JSONL lock used by the legacy driver closes both old-first and
@@ -745,7 +1020,13 @@ export function bindSchedulerScheduleFire(
 
     const active = schedule.activeDelivery;
     const activeExpiresAt = Date.parse(active?.leaseExpiresAt || "");
-    if (active && Number.isFinite(activeExpiresAt) && activeExpiresAt > nowMs) {
+    const migrationFence = coworkMigrationFence(schedule, nowMs);
+    if (
+      active &&
+      Number.isFinite(activeExpiresAt) &&
+      activeExpiresAt > nowMs &&
+      !migrationFence
+    ) {
       throw coworkSchedulerError(
         "COWORK_SCHEDULER_LEGACY_CLAIM_ACTIVE",
         `Cowork schedule is already claimed: ${id}`,
@@ -857,6 +1138,81 @@ export function completeSchedulerScheduleFire(
     } else {
       schedule.activeDelivery = null;
     }
+    if (schedule.enabled === true) applyCoworkMigrationFence(schedule, now);
+    _saveSchedulesUnlocked(cwd, schedules);
+    return schedule;
+  });
+}
+
+export function adjudicateSchedulerScheduleFire(
+  cwd,
+  id,
+  {
+    deliveryId,
+    occurrenceId,
+    snapshotDigest,
+    attempt,
+    decision,
+    requestId,
+    at = _deps.now(),
+  } = {},
+) {
+  if (!["confirmed_applied", "confirmed_not_applied"].includes(decision)) {
+    throw coworkSchedulerError(
+      "COWORK_SCHEDULER_ADJUDICATION_INVALID",
+      "Cowork scheduler adjudication decision is invalid",
+    );
+  }
+  const now = normalizedDate(at, "cowork scheduler adjudication time");
+  return _withScheduleLock(cwd, () => {
+    const schedules = loadSchedules(cwd, { failOnMalformed: true });
+    const schedule = schedules.find((entry) => entry.id === id);
+    if (!schedule) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_SCHEDULE_NOT_FOUND",
+        `Cowork schedule does not exist: ${id}`,
+      );
+    }
+    const evidence = schedule.schedulerExecution;
+    const targetStatus =
+      decision === "confirmed_applied"
+        ? "adjudicated_applied"
+        : "adjudicated_not_applied";
+    if (
+      evidence?.status === targetStatus &&
+      evidence.adjudication?.requestId === requestId &&
+      evidence.adjudication.decision === decision
+    ) {
+      return schedule;
+    }
+    if (
+      !evidence ||
+      evidence.deliveryId !== deliveryId ||
+      evidence.occurrenceId !== occurrenceId ||
+      evidence.snapshotDigest !== snapshotDigest ||
+      !Number.isSafeInteger(evidence.attempt) ||
+      evidence.attempt < 1 ||
+      evidence.attempt > attempt ||
+      evidence.status !== "running"
+    ) {
+      throw coworkSchedulerError(
+        "COWORK_SCHEDULER_ADJUDICATION_EVIDENCE_MISMATCH",
+        `Cowork scheduler adjudication evidence does not match: ${id}`,
+      );
+    }
+    schedule.schedulerExecution = {
+      ...evidence,
+      status: targetStatus,
+      endedAt: now.toISOString(),
+      adjudication: { requestId, decision },
+    };
+    if (decision === "confirmed_applied") {
+      schedule.lastDeliveryId = deliveryId;
+      schedule.lastRunAt = now.toISOString();
+      schedule.lastStatus = "adjudicated-applied";
+    }
+    schedule.activeDelivery = null;
+    if (schedule.enabled === true) applyCoworkMigrationFence(schedule, now);
     _saveSchedulesUnlocked(cwd, schedules);
     return schedule;
   });

package/src/lib/cowork-task-runner.js

@@ -36,6 +36,7 @@ import {
   isUnsafeSessionId,
   readVerifiedEvents as readVerifiedSessionEvents,
   readVerifiedProjection as readVerifiedSessionProjection,
+  sessionHasPersistedEvidence,
 } from "../harness/jsonl-session-store.js";
 
 // ─── Dependencies (overridable for testing) ──────────────────────────────────
@@ -49,6 +50,7 @@ export const _deps = {
   appendSessionEventIfHead,
   readVerifiedSessionEvents,
   readVerifiedSessionProjection,
+  sessionHasPersistedEvidence,
   randomUUID,
 };
 
@@ -56,6 +58,91 @@ export const _deps = {
 
 const DEFAULT_MAX_ITERATIONS = 50;
 const DEFAULT_TOKEN_BUDGET = 100_000;
+const COWORK_MCP_CALL_LEDGER_UNSUPPORTED =
+  "CC_COWORK_MCP_CALL_LEDGER_UNSUPPORTED";
+const COWORK_MCP_SESSION_UNVERIFIED = "CC_COWORK_MCP_SESSION_UNVERIFIED";
+const PROTECTED_USAGE_FIELDS = Object.freeze([
+  "observabilityScope",
+  "usageTelemetryProtocol",
+  "usageTelemetryVersion",
+]);
+
+function coworkMcpAdmissionError(code, message, sessionId, cause = null) {
+  const error = new Error(message, cause ? { cause } : undefined);
+  error.code = code;
+  error.sessionId = sessionId;
+  return error;
+}
+
+function assertCoworkMcpEventUsageAdmission(event, sessionId) {
+  if (event?.type !== "session_start") return;
+  const data =
+    event.data && typeof event.data === "object" && !Array.isArray(event.data)
+      ? event.data
+      : {};
+  if (!PROTECTED_USAGE_FIELDS.some((field) => Object.hasOwn(data, field))) {
+    return;
+  }
+  throw coworkMcpAdmissionError(
+    COWORK_MCP_CALL_LEDGER_UNSUPPORTED,
+    "Scoped call-ledger sessions are not supported by Cowork MCP tasks; use agent mode or an IDE host with usage-ledger support",
+    sessionId,
+  );
+}
+
+function readCoworkMcpUsageAdmission(sessionId) {
+  return _deps.readVerifiedSessionProjection(sessionId, () => ({
+    accept(event) {
+      assertCoworkMcpEventUsageAdmission(event, sessionId);
+    },
+    finish() {
+      return true;
+    },
+  }));
+}
+
+/**
+ * An explicitly supplied MCP session can name an existing canonical JSONL
+ * authority. Verify it before mounting servers or starting a child model, and
+ * refuse protected usage transcripts until Cowork persists the call ledger.
+ */
+export function assertCoworkMcpSessionUsageAdmission(sessionId) {
+  if (sessionId == null) return;
+  if (typeof sessionId !== "string" || isUnsafeSessionId(sessionId)) {
+    throw coworkMcpAdmissionError(
+      "CC_COWORK_MCP_SESSION_INVALID",
+      "Cowork MCP session id is invalid",
+      sessionId,
+    );
+  }
+
+  let hasEvidence;
+  try {
+    hasEvidence = _deps.sessionHasPersistedEvidence(sessionId);
+  } catch (cause) {
+    throw coworkMcpAdmissionError(
+      COWORK_MCP_SESSION_UNVERIFIED,
+      "Cowork MCP session authority could not be inspected; refusing to start a model or tool",
+      sessionId,
+      cause,
+    );
+  }
+  if (!hasEvidence) return;
+
+  try {
+    if (readCoworkMcpUsageAdmission(sessionId) !== true) {
+      throw new Error("verified usage-admission projection was bypassed");
+    }
+  } catch (cause) {
+    if (cause?.code === COWORK_MCP_CALL_LEDGER_UNSUPPORTED) throw cause;
+    throw coworkMcpAdmissionError(
+      COWORK_MCP_SESSION_UNVERIFIED,
+      "Cowork MCP session authority could not be verified; refusing to start a model or tool",
+      sessionId,
+      cause,
+    );
+  }
+}
 
 function resolveCoworkMcpSessionId(requested) {
   if (requested != null) {
@@ -152,6 +239,7 @@ function createCoworkMcpRecoveryProjection(sessionId, templateId, onFinish) {
         throw error;
       }
       acceptedCount += 1;
+      assertCoworkMcpEventUsageAdmission(event, sessionId);
       assertCoworkMcpSessionBindingEvent(event, templateId);
       ledger.accept(event);
     },
@@ -343,24 +431,13 @@ export function prepareCoworkMcpRuntime(mcp, options = {}) {
       });
     }
   } catch (error) {
-    recoveryNotice =
-      "MCP recovery notice — the durable Cowork MCP ledger could not be read. " +
-      "Do not execute or retry MCP tools until the session transcript has " +
-      `been inspected (${error?.code || "CC_MCP_LEDGER_EVENT_READ_FAILED"}).`;
-    recoveryState = publicMcpRecoveryState(
-      null,
-      "all",
-      error?.code || "CC_MCP_LEDGER_EVENT_READ_FAILED",
+    if (error?.code === COWORK_MCP_CALL_LEDGER_UNSUPPORTED) throw error;
+    throw coworkMcpAdmissionError(
+      COWORK_MCP_SESSION_UNVERIFIED,
+      "Cowork MCP session authority could not be verified; refusing to start a model or tool",
+      sessionId,
+      error,
     );
-    if (typeof options.onProgress === "function") {
-      options.onProgress({
-        type: "mcp-recovery",
-        sessionId,
-        unsettled: 0,
-        incidents: 1,
-        recovery: recoveryState,
-      });
-    }
   }
 
   const sink = createSessionMcpLedgerSink(
@@ -423,6 +500,10 @@ export async function runCoworkTask(options = {}) {
     throw new Error("userMessage is required");
   }
 
+  // An explicit canonical authority must be admitted before mounting local MCP
+  // servers, constructing a child context, or making any provider call.
+  assertCoworkMcpSessionUsageAdmission(mcpSessionId);
+
   // Validate file paths before starting
   if (files.length > 0) {
     const missing = files.filter((f) => !_deps.existsSync(f));
@@ -586,6 +667,7 @@ export async function runCoworkTask(options = {}) {
  * @param {object} options - Same as runCoworkTask, plus:
  * @param {number} [options.agents] - Number of parallel agents (default 3, max 10)
  * @param {string} [options.strategy] - Routing strategy (default "round-robin")
+ * @param {string} [options.mcpSessionId] - Canonical session authority to admit
  * @param {function} [options.onProgress] - Progress callback
  * @param {AbortSignal} [options.signal] - Cancellation signal
  * @returns {Promise<{ taskId: string, status: string, result: object }>}
@@ -600,12 +682,18 @@ export async function runCoworkTaskParallel(options = {}) {
     strategy,
     onProgress = null,
     signal = null,
+    mcpSessionId = null,
   } = options;
 
   if (!userMessage || typeof userMessage !== "string") {
     throw new Error("userMessage is required");
   }
 
+  // Parallel orchestration can make provider calls while decomposing and
+  // dispatching work. Apply the same canonical authority gate as sequential
+  // Cowork before constructing the orchestrator or starting any provider.
+  assertCoworkMcpSessionUsageAdmission(mcpSessionId);
+
   if (files.length > 0) {
     const missing = files.filter((f) => !_deps.existsSync(f));
     if (missing.length > 0) {
@@ -742,6 +830,7 @@ export async function runCoworkTaskParallel(options = {}) {
  * @param {string[]} [options.perspectives] - Override template perspectives
  * @param {string} [options.cwd] - Working directory for history
  * @param {object} [options.llmOptions] - LLM provider/model/key
+ * @param {string} [options.mcpSessionId] - Canonical session authority to admit
  * @param {function} [options.onProgress] - Progress callback
  * @returns {Promise<{ taskId, status, result }>}
  */
@@ -754,12 +843,18 @@ export async function runCoworkDebate(options = {}) {
     cwd = process.cwd(),
     llmOptions = {},
     onProgress = null,
+    mcpSessionId = null,
   } = options;
 
   if (!userMessage || typeof userMessage !== "string") {
     throw new Error("userMessage is required");
   }
 
+  // Debate performs multiple reviewer calls plus moderator synthesis. Refuse a
+  // protected or unverifiable authority before emitting progress or invoking
+  // the first reviewer, matching sequential and parallel Cowork admission.
+  assertCoworkMcpSessionUsageAdmission(mcpSessionId);
+
   if (files.length > 0) {
     const missing = files.filter((f) => !_deps.existsSync(f));
     if (missing.length > 0) {