chainlesschain 0.164.0 → 0.165.2

package/src/commands/cowork.js

@@ -9,6 +9,71 @@ import fs from "fs";
 import path from "path";
 import { logger } from "../lib/logger.js";
 
+const SESSION_EXECUTION_LOCATION_AUTHORITY_SCHEMA =
+  "cc-session-execution-location-authority/v1";
+
+function workflowAuthorityError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  error.executionStarted = false;
+  return error;
+}
+
+function requireWorkflowExecutionAuthoritySession(sessionId) {
+  if (typeof sessionId !== "string" || sessionId.trim() === "") {
+    throw workflowAuthorityError(
+      "CC_DYNAMIC_WORKFLOW_EXECUTION_AUTHORITY_MISSING",
+      "--execution-authority-session <id> is required",
+    );
+  }
+  return sessionId;
+}
+
+function projectWorkflowExecutionAuthority(sessionId, verifiedProof) {
+  requireWorkflowExecutionAuthoritySession(sessionId);
+  let proof;
+  try {
+    proof = structuredClone(verifiedProof);
+  } catch {
+    throw workflowAuthorityError(
+      "CC_DYNAMIC_WORKFLOW_EXECUTION_AUTHORITY_INVALID",
+      "verified execution authority could not be safely snapshotted",
+    );
+  }
+  if (proof?.sessionId !== sessionId) {
+    throw workflowAuthorityError(
+      "CC_DYNAMIC_WORKFLOW_EXECUTION_AUTHORITY_SESSION_MISMATCH",
+      "verified execution authority does not match the requested session",
+    );
+  }
+  return Object.freeze({
+    schema: SESSION_EXECUTION_LOCATION_AUTHORITY_SCHEMA,
+    authority: proof.authority || "verified-session-start",
+    sessionId: proof.sessionId,
+    headHash: proof.headHash,
+    eventCount: proof.eventCount,
+    binding: proof.binding,
+  });
+}
+
+function renderWorkflowPreflight(preflight) {
+  const color = preflight.allowed ? chalk.green : chalk.red;
+  logger.log(color(preflight.allowed ? "READY" : "BLOCKED"));
+  logger.log(`  definition:  ${preflight.definition.definitionDigest}`);
+  logger.log(
+    `  task calls: ${preflight.scale.worstCaseTaskCalls ?? "unknown"}`,
+  );
+  logger.log(
+    `  tokens/USD: ${preflight.cost.projectedTokens ?? "unknown"} / ${preflight.cost.projectedUsd ?? "unknown"}`,
+  );
+  for (const blocker of preflight.blockers) {
+    logger.log(chalk.red(`  blocker: ${blocker}`));
+  }
+  for (const warning of preflight.warnings) {
+    logger.log(chalk.yellow(`  warning: ${warning}`));
+  }
+}
+
 async function loadCoworkWorkflowRecord(cwd, id, definitionDigest) {
   const { getWorkflowRecord, getWorkflowVersion } =
     await import("../lib/cowork-workflow.js");
@@ -17,7 +82,38 @@ async function loadCoworkWorkflowRecord(cwd, id, definitionDigest) {
     : getWorkflowRecord(cwd, id);
 }
 
-export function registerCoworkCommand(program) {
+function verifyWorkflowRunAuthorities(
+  cwd,
+  { workflowId, definitionDigest, executionAuthoritySessionId },
+  deps,
+) {
+  const definitionAuthority = deps.getWorkflowVersion(
+    cwd,
+    workflowId,
+    definitionDigest,
+  );
+  if (
+    !definitionAuthority ||
+    definitionAuthority.definitionDigest !== definitionDigest
+  ) {
+    throw workflowAuthorityError(
+      "CC_DYNAMIC_WORKFLOW_DEFINITION_AUTHORITY_DRIFT",
+      "the exact admitted workflow definition version is no longer available",
+    );
+  }
+  const executionLocationAuthority = projectWorkflowExecutionAuthority(
+    executionAuthoritySessionId,
+    deps.getVerifiedSessionExecutionLocationAuthority(
+      executionAuthoritySessionId,
+    ),
+  );
+  return Object.freeze({
+    definitionAuthority,
+    executionLocationAuthority,
+  });
+}
+
+export function registerCoworkCommand(program, commandDeps = {}) {
   const cowork = program
     .command("cowork")
     .description(
@@ -770,6 +866,256 @@ export function registerCoworkCommand(program) {
     .command("workflow")
     .description("Define and execute multi-step Cowork workflows (DAG)");
 
+  workflow
+    .command("draft <prompt>")
+    .description(
+      "Generate a digest-bound workflow draft for explicit human review",
+    )
+    .option("--provider <name>", "LLM provider to use")
+    .option("--model <name>", "LLM model to use")
+    .action(async (prompt, options) => {
+      try {
+        let chat;
+        let provider;
+        let model;
+        if (Object.hasOwn(commandDeps, "workflowDraftChat")) {
+          const descriptor = Object.getOwnPropertyDescriptor(
+            commandDeps,
+            "workflowDraftChat",
+          );
+          if (
+            !descriptor ||
+            !Object.hasOwn(descriptor, "value") ||
+            typeof descriptor.value !== "function"
+          ) {
+            throw new Error(
+              "Cowork workflow draft chat seam must be a function data property",
+            );
+          }
+          chat = descriptor.value;
+          provider = options.provider || "fixture";
+          model = options.model || "fixture-model";
+        } else {
+          const [{ createChatFn }, { BUILT_IN_PROVIDERS }, { loadConfig }] =
+            await Promise.all([
+              import("../lib/cowork-adapter.js"),
+              import("../lib/llm-providers.js"),
+              import("../lib/config-manager.js"),
+            ]);
+          const config = loadConfig()?.llm || {};
+          provider =
+            options.provider ||
+            process.env.LLM_PROVIDER ||
+            config.provider ||
+            "ollama";
+          const providerDefinition = BUILT_IN_PROVIDERS[provider];
+          if (!providerDefinition) {
+            throw new Error(`Unsupported workflow draft provider: ${provider}`);
+          }
+          model =
+            options.model ||
+            process.env.LLM_MODEL ||
+            (config.provider === provider ? config.model : null) ||
+            providerDefinition.models[0];
+          chat = createChatFn({
+            provider,
+            model,
+            ...(config.provider === provider && config.baseUrl
+              ? { baseUrl: config.baseUrl }
+              : {}),
+            ...(config.provider === provider && config.apiKey
+              ? { apiKey: config.apiKey }
+              : {}),
+          });
+        }
+        const { generateDynamicWorkflowDraft } =
+          await import("../lib/dynamic-workflow-draft.js");
+        const draft = await generateDynamicWorkflowDraft(
+          { prompt, provider, model },
+          { chat },
+        );
+        console.log(JSON.stringify(draft, null, 2));
+      } catch (err) {
+        logger.error(`WORKFLOW_DRAFT_FAILED: ${err.message}`);
+        process.exitCode = 2;
+      }
+    });
+
+  workflow
+    .command("review <file>")
+    .description(
+      "Accept or reject an exact workflow draft; accepted definitions are versioned",
+    )
+    .requiredOption(
+      "--expected-draft-digest <sha256>",
+      "Exact draft digest shown during review",
+    )
+    .requiredOption("--reviewer <identity>", "Human reviewer identity")
+    .option("--accept", "Accept and save the reviewed definition")
+    .option("--reject", "Reject without saving the definition")
+    .option("--reason <text>", "Bounded, secret-free review reason")
+    .option("--json", "Machine-readable JSON output")
+    .action(async (file, options) => {
+      try {
+        if (options.accept === options.reject) {
+          throw new Error("exactly one of --accept or --reject is required");
+        }
+        const [draftModule, workflowModule] = await Promise.all([
+          import("../lib/dynamic-workflow-draft.js"),
+          import("../lib/cowork-workflow.js"),
+        ]);
+        const draft = draftModule.readDynamicWorkflowDraftFile(file);
+        const review = draftModule.reviewDynamicWorkflowDraft({
+          draft,
+          expectedDraftDigest: options.expectedDraftDigest,
+          decision: options.accept ? "accept" : "reject",
+          reviewer: options.reviewer,
+          reason: options.reason,
+        });
+        let persisted = false;
+        if (review.status === "accepted") {
+          workflowModule.saveWorkflow(process.cwd(), review.definition);
+          const record = workflowModule.getWorkflowRecord(
+            process.cwd(),
+            review.definition.id,
+          );
+          if (
+            !record ||
+            record.definitionDigest !== review.acceptedDefinitionDigest
+          ) {
+            throw new Error(
+              "reviewed workflow readback did not match its accepted digest",
+            );
+          }
+          persisted = true;
+        }
+        const result = Object.freeze({ ...review, persisted });
+        if (options.json) {
+          console.log(JSON.stringify(result, null, 2));
+          return;
+        }
+        const label = review.status === "accepted" ? "Accepted" : "Rejected";
+        logger.log(`${label} workflow draft ${review.draftDigest}`);
+        logger.log(`  review:    ${review.reviewDigest}`);
+        logger.log(
+          `  definition: ${review.acceptedDefinitionDigest || "not-saved"}`,
+        );
+      } catch (err) {
+        logger.error(`WORKFLOW_REVIEW_FAILED: ${err.message}`);
+        process.exitCode = 2;
+      }
+    });
+
+  workflow
+    .command("runtime-status <run-id>")
+    .description("Read a durable workflow run without invoking a task provider")
+    .option("--json", "Machine-readable JSON output")
+    .action(async (runId, options) => {
+      try {
+        const runtime = await import("../lib/dynamic-workflow-runtime.js");
+        const statePath = runtime.dynamicWorkflowRunStatePath(
+          process.cwd(),
+          runId,
+        );
+        const projection = runtime.projectDynamicWorkflowRuntime(statePath);
+        if (options.json) {
+          console.log(JSON.stringify(projection, null, 2));
+          return;
+        }
+        logger.log(`${projection.runId}  ${projection.status}`);
+        logger.log(`  revision: ${projection.revision}`);
+        logger.log(`  definition: ${projection.definitionDigest}`);
+        logger.log(
+          `  effects: ${projection.settledEffectCount}/${projection.effectCount} settled`,
+        );
+        for (const effect of projection.pendingEffects) {
+          logger.log(`  pending: ${effect.id} (${effect.key})`);
+        }
+      } catch (err) {
+        logger.error(`WORKFLOW_RUNTIME_STATUS_FAILED: ${err.message}`);
+        process.exitCode = 2;
+      }
+    });
+
+  for (const action of ["pause", "stop", "resume"]) {
+    workflow
+      .command(`runtime-${action} <run-id>`)
+      .description(
+        `${action[0].toUpperCase()}${action.slice(1)} a revision-bound durable workflow run`,
+      )
+      .requiredOption(
+        "--expected-revision <n>",
+        "Exact runtime revision shown by runtime-status",
+      )
+      .option("--json", "Machine-readable JSON output")
+      .action(async (runId, options) => {
+        try {
+          const runtime = await import("../lib/dynamic-workflow-runtime.js");
+          const statePath = runtime.dynamicWorkflowRunStatePath(
+            process.cwd(),
+            runId,
+          );
+          const operation =
+            action === "pause"
+              ? runtime.requestDurableWorkflowPause
+              : action === "stop"
+                ? runtime.requestDurableWorkflowStop
+                : runtime.prepareDurableWorkflowResume;
+          const state = operation(statePath, options.expectedRevision);
+          const projection = runtime.projectDynamicWorkflowRuntime(state);
+          if (options.json) {
+            console.log(JSON.stringify(projection, null, 2));
+          } else {
+            logger.log(
+              `${projection.runId}  ${projection.status}  revision=${projection.revision}`,
+            );
+          }
+        } catch (err) {
+          logger.error(
+            `WORKFLOW_RUNTIME_${action.toUpperCase()}_FAILED: ${err.message}`,
+          );
+          process.exitCode = 2;
+        }
+      });
+  }
+
+  workflow
+    .command("runtime-reconcile <run-id> <effect-id> <result-file>")
+    .description(
+      "Settle one outcome-unknown effect from a bounded provider result file",
+    )
+    .requiredOption(
+      "--expected-revision <n>",
+      "Exact runtime revision shown by runtime-status",
+    )
+    .option("--json", "Machine-readable JSON output")
+    .action(async (runId, effectId, resultFile, options) => {
+      try {
+        const runtime = await import("../lib/dynamic-workflow-runtime.js");
+        const statePath = runtime.dynamicWorkflowRunStatePath(
+          process.cwd(),
+          runId,
+        );
+        const result = runtime.readDynamicWorkflowEffectResultFile(resultFile);
+        const state = runtime.reconcileDurableWorkflowEffect(statePath, {
+          expectedRevision: options.expectedRevision,
+          effectId,
+          result,
+        });
+        const projection = runtime.projectDynamicWorkflowRuntime(state);
+        if (options.json) {
+          console.log(JSON.stringify(projection, null, 2));
+        } else {
+          logger.log(
+            `${projection.runId}  ${projection.status}  revision=${projection.revision}`,
+          );
+        }
+      } catch (err) {
+        logger.error(`WORKFLOW_RUNTIME_RECONCILE_FAILED: ${err.message}`);
+        process.exitCode = 2;
+      }
+    });
+
   workflow
     .command("list")
     .description("List saved workflows")
@@ -896,53 +1242,96 @@ export function registerCoworkCommand(program) {
       "--definition-digest <sha256>",
       "Preflight an immutable saved definition version",
     )
+    .option(
+      "--execution-authority-session <id>",
+      "Verified session whose start event anchors execution authority",
+    )
     .option("--max-parallel <n>", "Requested maximum parallel steps", "4")
     .option("--json", "Machine-readable JSON output")
     .action(async (id, options) => {
       try {
         const [
-          { buildDynamicWorkflowPreflight },
-          { captureAmbientExecutionLocation },
+          { buildDynamicWorkflowRunAdmission },
+          { getWorkflowVersion },
+          { getVerifiedSessionExecutionLocationAuthority },
           record,
         ] = await Promise.all([
           import("../lib/dynamic-workflow-facade.js"),
-          import("../lib/execution-location-runtime.js"),
+          import("../lib/cowork-workflow.js"),
+          import("../harness/jsonl-session-store.js"),
           loadCoworkWorkflowRecord(process.cwd(), id, options.definitionDigest),
         ]);
         if (!record) {
-          logger.error(`Workflow not found: ${id}`);
+          if (options.json) {
+            console.log(
+              JSON.stringify(
+                {
+                  schema: "cc-dynamic-workflow-run-admission-error/v1",
+                  allowed: false,
+                  executionStarted: false,
+                  code: "WORKFLOW_NOT_FOUND",
+                  message: `Workflow not found: ${id}`,
+                },
+                null,
+                2,
+              ),
+            );
+          } else {
+            logger.error(`Workflow not found: ${id}`);
+          }
           process.exitCode = 1;
           return;
         }
-        const preflight = buildDynamicWorkflowPreflight({
-          workflow: record.definition,
-          definitionAuthority: record,
-          executionLocation: captureAmbientExecutionLocation(),
-          maxParallel: options.maxParallel,
-        });
+        const executionAuthoritySessionId =
+          requireWorkflowExecutionAuthoritySession(
+            options.executionAuthoritySession,
+          );
+        const admission = buildDynamicWorkflowRunAdmission(
+          {
+            definitionAuthority: record,
+            executionAuthoritySessionId,
+            maxParallel: options.maxParallel,
+            execution: {
+              cwd: process.cwd(),
+              continueOnError: false,
+              pipeline: record.definition.pipeline === true,
+            },
+          },
+          {
+            verifyAuthorities: (lookup) =>
+              verifyWorkflowRunAuthorities(process.cwd(), lookup, {
+                getWorkflowVersion,
+                getVerifiedSessionExecutionLocationAuthority,
+              }),
+          },
+        );
+        const preflight = admission.preflight;
         if (options.json) {
           console.log(JSON.stringify(preflight, null, 2));
         } else {
-          const color = preflight.allowed ? chalk.green : chalk.red;
-          logger.log(color(preflight.allowed ? "READY" : "BLOCKED"));
-          logger.log(`  definition:  ${preflight.definition.definitionDigest}`);
-          logger.log(
-            `  task calls: ${preflight.scale.worstCaseTaskCalls ?? "unknown"}`,
-          );
-          logger.log(
-            `  tokens/USD: ${preflight.cost.projectedTokens ?? "unknown"} / ${preflight.cost.projectedUsd ?? "unknown"}`,
-          );
-          for (const blocker of preflight.blockers) {
-            logger.log(chalk.red(`  blocker: ${blocker}`));
-          }
-          for (const warning of preflight.warnings) {
-            logger.log(chalk.yellow(`  warning: ${warning}`));
-          }
+          renderWorkflowPreflight(preflight);
         }
-        process.exitCode = preflight.allowed ? 0 : 2;
+        process.exitCode = admission.allowed ? 0 : 2;
       } catch (err) {
-        logger.error(err.message);
-        process.exitCode = 1;
+        const code = err.code || "WORKFLOW_PREFLIGHT_BLOCKED";
+        if (options.json) {
+          console.log(
+            JSON.stringify(
+              {
+                schema: "cc-dynamic-workflow-run-admission-error/v1",
+                allowed: false,
+                executionStarted: false,
+                code,
+                message: err.message,
+              },
+              null,
+              2,
+            ),
+          );
+        } else {
+          logger.error(`${code}: ${err.message}`);
+        }
+        process.exitCode = 2;
       }
     });
 
@@ -983,20 +1372,80 @@ export function registerCoworkCommand(program) {
       "--definition-digest <sha256>",
       "Replay an immutable saved definition version",
     )
+    .option(
+      "--execution-authority-session <id>",
+      "Verified session whose start event anchors execution authority",
+    )
     .option("--continue-on-error", "Keep running after a step fails", false)
-    .option("--max-parallel <n>", "Max parallel steps per batch", "4")
+    .option("--max-parallel <n>", "Max parallel steps per batch")
+    .option(
+      "--durable-run-id <id>",
+      "Use request-before-provider durable runtime with atomic effect batches",
+    )
     .option(
       "--pipeline",
       "No-barrier scheduling: start each step as soon as its own deps finish",
       false,
     )
     .action(async (id, options) => {
-      const [{ executeWorkflow, _deps: wfDeps }, { runCoworkTask }] =
-        await Promise.all([
+      let executionStarted = false;
+      try {
+        let workflowExecutionAuthorityModule;
+        if (Object.hasOwn(commandDeps, "workflowExecutionAuthorityProvider")) {
+          const descriptor = Object.getOwnPropertyDescriptor(
+            commandDeps,
+            "workflowExecutionAuthorityProvider",
+          );
+          if (!descriptor || !Object.hasOwn(descriptor, "value")) {
+            throw new Error(
+              "Cowork workflow authority provider seam must be a data property",
+            );
+          }
+          workflowExecutionAuthorityModule = Promise.resolve({
+            getVerifiedSessionExecutionLocationAuthority: descriptor.value,
+          });
+        } else {
+          workflowExecutionAuthorityModule =
+            import("../harness/jsonl-session-store.js");
+        }
+        let workflowRunTaskModule;
+        if (Object.hasOwn(commandDeps, "workflowRunTask")) {
+          const descriptor = Object.getOwnPropertyDescriptor(
+            commandDeps,
+            "workflowRunTask",
+          );
+          if (!descriptor || !Object.hasOwn(descriptor, "value")) {
+            throw new Error(
+              "Cowork workflow task runner seam must be a data property",
+            );
+          }
+          workflowRunTaskModule = Promise.resolve({
+            runCoworkTask: descriptor.value,
+          });
+        } else {
+          workflowRunTaskModule = import("../lib/cowork-task-runner.js");
+        }
+        const [
+          { executeWorkflow: executeCoworkWorkflow, getWorkflowVersion },
+          { executeDynamicWorkflowWithAdmission },
+          { getVerifiedSessionExecutionLocationAuthority },
+          { runCoworkTask },
+        ] = await Promise.all([
           import("../lib/cowork-workflow.js"),
-          import("../lib/cowork-task-runner.js"),
+          import("../lib/dynamic-workflow-facade.js"),
+          workflowExecutionAuthorityModule,
+          workflowRunTaskModule,
         ]);
-      try {
+        if (typeof runCoworkTask !== "function") {
+          throw new Error("Cowork workflow task runner is unavailable");
+        }
+        if (
+          typeof getVerifiedSessionExecutionLocationAuthority !== "function"
+        ) {
+          throw new Error(
+            "Cowork workflow execution authority provider is unavailable",
+          );
+        }
         const record = await loadCoworkWorkflowRecord(
           process.cwd(),
           id,
@@ -1008,33 +1457,79 @@ export function registerCoworkCommand(program) {
           return;
         }
         const wf = record.definition;
-        wfDeps.runTask = runCoworkTask;
-        logger.log(
-          chalk.bold(
-            `\nExecuting workflow '${wf.name}' (${wf.steps.length} steps, ${record.definitionDigest})...`,
-          ),
-        );
-        const result = await executeWorkflow({
-          workflow: wf,
-          definitionDigest: record.definitionDigest,
-          cwd: process.cwd(),
-          maxParallel: parseInt(options.maxParallel, 10) || 4,
-          continueOnError: !!options.continueOnError,
-          // undefined (not false) when the flag is absent, so a workflow-level
-          // `pipeline: true` in the JSON definition still takes effect.
-          pipeline: options.pipeline ? true : undefined,
-          onStepStart: ({ stepId }) =>
-            logger.log(chalk.gray(`  → step ${stepId} ...`)),
-          onStepComplete: (out) => {
-            const flag =
-              out.status === "completed"
-                ? chalk.green("✓")
-                : out.status === "skipped"
-                  ? chalk.gray("—")
-                  : chalk.red("✗");
-            logger.log(`  ${flag} ${out.id}  (${out.status})`);
+        const requestedMaxParallel =
+          options.maxParallel || (options.durableRunId ? "1" : "4");
+        const executionAuthoritySessionId =
+          requireWorkflowExecutionAuthoritySession(
+            options.executionAuthoritySession,
+          );
+        const outcome = await executeDynamicWorkflowWithAdmission(
+          {
+            definitionAuthority: record,
+            executionAuthoritySessionId,
+            maxParallel: requestedMaxParallel,
+            execution: {
+              cwd: process.cwd(),
+              continueOnError: !!options.continueOnError,
+              // Omit (rather than pass undefined) when absent so a
+              // workflow-level `pipeline: true` remains authoritative.
+              ...(options.pipeline ? { pipeline: true } : {}),
+              onStepStart: ({ stepId }) =>
+                logger.log(chalk.gray(`  → step ${stepId} ...`)),
+              onStepComplete: (out) => {
+                const flag =
+                  out.status === "completed"
+                    ? chalk.green("✓")
+                    : out.status === "skipped"
+                      ? chalk.gray("—")
+                      : chalk.red("✗");
+                logger.log(`  ${flag} ${out.id}  (${out.status})`);
+              },
+            },
+            onAdmitted: () => {
+              executionStarted = true;
+              logger.log(
+                chalk.bold(
+                  `\nExecuting workflow '${wf.name}' (${wf.steps.length} steps, ${record.definitionDigest})...`,
+                ),
+              );
+            },
           },
-        });
+          {
+            verifyAuthorities: (lookup) =>
+              verifyWorkflowRunAuthorities(process.cwd(), lookup, {
+                getWorkflowVersion,
+                getVerifiedSessionExecutionLocationAuthority,
+              }),
+            executeWorkflow: async (execution) => {
+              if (!options.durableRunId) {
+                return executeCoworkWorkflow({
+                  ...execution,
+                  runTask: runCoworkTask,
+                });
+              }
+              const runtime =
+                await import("../lib/dynamic-workflow-runtime.js");
+              return runtime.executeDurableDynamicWorkflow(
+                {
+                  statePath: runtime.dynamicWorkflowRunStatePath(
+                    process.cwd(),
+                    options.durableRunId,
+                  ),
+                  runId: options.durableRunId,
+                  execution,
+                },
+                { runTask: runCoworkTask },
+              );
+            },
+          },
+        );
+        if (!outcome.allowed) {
+          renderWorkflowPreflight(outcome.preflight);
+          process.exitCode = 2;
+          return;
+        }
+        const result = outcome.record;
         const color =
           result.status === "completed"
             ? chalk.green
@@ -1042,9 +1537,11 @@ export function registerCoworkCommand(program) {
               ? chalk.yellow
               : chalk.red;
         logger.log(color(`\nWorkflow ${result.status}.\n`));
+        process.exitCode = result.status === "completed" ? 0 : 1;
       } catch (err) {
-        logger.error(err.message);
-        process.exit(1);
+        logger.error(`${err.code || "WORKFLOW_RUN_FAILED"}: ${err.message}`);
+        process.exitCode =
+          executionStarted || err.executionStarted === true ? 1 : 2;
       }
     });