chainlesschain 0.166.7 → 0.166.9

package/src/lib/graph-kernel/runtime.js

@@ -4,6 +4,7 @@ import {
   compileGraphDefinition,
   executionAttemptId,
   graphDigest,
+  validateGraphDefinitionMigrationEvidence,
   writeScopesOverlap,
 } from "./compiler.js";
 import { GraphEventStore } from "./event-store.js";
@@ -356,6 +357,7 @@ function stateSnapshot(run) {
     version: 1,
     id: run.id,
     definition: run.compiled.definition,
+    definitionMigration: clone(run.definitionMigration),
     subgraphDefinitions: run.compiled.subgraphDefinitions,
     phase: run.phase,
     status: run.status,
@@ -404,6 +406,11 @@ function restoreState(run, snapshot, compiled = null) {
       subgraphs: persistedSubgraphRegistry(snapshot.subgraphDefinitions),
       allowUnresolvedSubgraphs: snapshot.subgraphDefinitions == null,
     });
+  run.definitionMigration = snapshot.definitionMigration
+    ? clone(
+        validateGraphDefinitionMigrationEvidence(snapshot.definitionMigration),
+      )
+    : clone(run.compiled.definitionMigration || null);
   run.phase = snapshot.phase;
   run.status = snapshot.status;
   run.graphRevision = snapshot.graphRevision;
@@ -475,12 +482,35 @@ function attemptProjection(attempt) {
   return Object.freeze(clone(attempt));
 }
 
+function humanTaskProjection(task) {
+  const projected = clone(task);
+  if (
+    projected.claimExpiresAt == null &&
+    Number.isFinite(projected.claimExpiresAtMs)
+  ) {
+    projected.claimExpiresAt = nowIso(() => projected.claimExpiresAtMs);
+  }
+  delete projected.claimExpiresAtMs;
+  delete projected.expiresAtMs;
+  return Object.freeze(projected);
+}
+
 function runProjection(run) {
   return Object.freeze({
     id: run.id,
     definitionId: run.compiled.definitionId,
     revision: run.compiled.revision,
     revisionDigest: run.revisionDigest,
+    definitionMigration: run.definitionMigration
+      ? Object.freeze({
+          schema: run.definitionMigration.schema,
+          fromVersion: run.definitionMigration.fromVersion,
+          toVersion: run.definitionMigration.toVersion,
+          revisionDigest: run.definitionMigration.revisionDigest,
+          rollbackDigest: run.definitionMigration.rollbackDigest,
+          backupAvailable: true,
+        })
+      : null,
     occurrenceRef: clone(run.occurrenceRef),
     phase: run.phase,
     status: run.status,
@@ -591,6 +621,7 @@ function buildRun(compiled, options, now, writerIdentity, writerLeaseTtlMs) {
   const run = {
     id,
     compiled,
+    definitionMigration: clone(compiled.definitionMigration || null),
     phase: "open",
     status: "running",
     graphRevision: compiled.revision,
@@ -963,6 +994,7 @@ function sweepExpirations(run, now) {
       task.status = "open";
       task.claimActorId = null;
       task.claimLeaseId = null;
+      task.claimExpiresAt = null;
       task.claimExpiresAtMs = null;
       task.updatedAt = nowIso(() => now);
       changed = true;
@@ -1170,6 +1202,13 @@ function classifyQuiescence(run, now) {
   ) {
     return "running";
   }
+  if (
+    [...run.humanTasks.values()].some((task) =>
+      ["open", "claimed"].includes(task.status),
+    )
+  ) {
+    return "waiting_human";
+  }
   if (
     [...run.attempts.values()].some((attempt) =>
       ACTIVE_ATTEMPT.has(attempt.status),
@@ -1191,13 +1230,6 @@ function classifyQuiescence(run, now) {
   ) {
     return "reconciliation_required";
   }
-  if (
-    [...run.humanTasks.values()].some((task) =>
-      ["open", "claimed"].includes(task.status),
-    )
-  ) {
-    return "waiting_human";
-  }
   if (
     [...run.messages.values()].some((message) =>
       ["admitted", "delivered", "read"].includes(message.status),
@@ -1582,6 +1614,19 @@ export class GraphKernel {
     );
   }
 
+  humanTasks(runId) {
+    const run = this._run(runId);
+    return Object.freeze(
+      [...run.humanTasks.values()]
+        .sort(
+          (left, right) =>
+            left.createdAt.localeCompare(right.createdAt) ||
+            left.id.localeCompare(right.id),
+        )
+        .map(humanTaskProjection),
+    );
+  }
+
   registerAgent(runId, { agentId, capacity = 1, resident = true } = {}) {
     const run = this._run(runId);
     const id = safeIdentifier(agentId, "agentId");
@@ -4146,11 +4191,12 @@ export class GraphKernel {
           authorityDigest: run.authorityDigest,
           status: "open",
           nonce: safeIdentifier(nonce, "nonce"),
-          quorum: Math.max(1, Number(quorum) || 1),
+          quorum: Math.min(64, Math.max(1, Math.trunc(Number(quorum)) || 1)),
           separationOfDuties: separationOfDuties === true,
           decisions: [],
           claimActorId: null,
           claimLeaseId: null,
+          claimExpiresAt: null,
           claimExpiresAtMs: null,
           createdAt: nowIso(() => now),
           updatedAt: nowIso(() => now),
@@ -4160,7 +4206,7 @@ export class GraphKernel {
         };
         run.humanTasks.set(id, task);
         run.status = "waiting_human";
-        return Object.freeze(clone(task));
+        return humanTaskProjection(task);
       },
       { idempotencyKey: `human-task:${id}` },
     );
@@ -4206,8 +4252,9 @@ export class GraphKernel {
         task.claimActorId = actor;
         task.claimLeaseId = safeIdentifier(claimLeaseId, "claimLeaseId");
         task.claimExpiresAtMs = now + finitePositive(ttlMs, 300_000);
+        task.claimExpiresAt = nowIso(() => task.claimExpiresAtMs);
         task.updatedAt = nowIso(() => now);
-        return Object.freeze(clone(task));
+        return humanTaskProjection(task);
       },
     );
   }
@@ -4312,11 +4359,15 @@ export class GraphKernel {
           task.status = "open";
           task.claimActorId = null;
           task.claimLeaseId = null;
+          task.claimExpiresAt = null;
           task.claimExpiresAtMs = null;
         }
         task.updatedAt = nowIso(() => now);
         run.status = classifyQuiescence(run, now);
-        return Object.freeze(clone(task));
+        if (TERMINAL_RUN.has(run.status)) {
+          run.completedAt = nowIso(() => now);
+        }
+        return humanTaskProjection(task);
       },
     );
   }
@@ -4336,14 +4387,25 @@ export class GraphKernel {
             "human task is already terminal",
           );
         }
+        const now = this.now();
         task.status = "cancelled";
         task.reason = String(reason).slice(0, 1024);
-        task.updatedAt = nowIso(this.now);
+        task.updatedAt = nowIso(() => now);
+        const attempt = run.attempts.get(task.attemptId);
+        if (attempt && attempt.status === "waiting_human") {
+          attempt.status = "cancelled";
+          attempt.participationStatus = "human_cancelled";
+          attempt.updatedAt = nowIso(() => now);
+        }
         const state = run.nodeStates.get(task.nodeId);
         state.status = "cancelled";
         state.blockedRoot = task.id;
-        state.updatedAt = nowIso(this.now);
-        return Object.freeze(clone(task));
+        state.updatedAt = nowIso(() => now);
+        run.status = classifyQuiescence(run, now);
+        if (TERMINAL_RUN.has(run.status)) {
+          run.completedAt = nowIso(() => now);
+        }
+        return humanTaskProjection(task);
       },
     );
   }

package/src/lib/interaction-adapter.js

@@ -205,6 +205,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         // null (the default for plain questions) → no binding check, unchanged.
         binding: options.binding || null,
         bindingType: options.bindingType || null,
+        requireBinding: options.requireBinding === true,
       });
 
       if (approvalRequest) {
@@ -253,6 +254,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         // Approval binding pass-through: a permission-gate producer supplies
         // it; plain questions never carry one (message stays byte-identical).
         ...(options.binding ? { binding: options.binding } : {}),
+        ...(options.requireBinding === true ? { requireBinding: true } : {}),
       },
     );
   }
@@ -290,6 +292,45 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     return answer === "true" || answer === "yes" || answer === "y";
   }
 
+  /**
+   * Structured approval variant used by Desktop/WebSocket hosts. Unlike the
+   * legacy boolean askConfirm path, this preserves the canonical decision
+   * lifetime and requires the trusted host to echo the exact request binding.
+   */
+  async askApproval(question, options = {}) {
+    const {
+      binding = null,
+      default: dflt = false,
+      approval = {},
+      ...extra
+    } = options || {};
+    const answer = await this._ask(
+      "confirm",
+      question,
+      { default: dflt, approval, ...extra },
+      binding ? { binding, requireBinding: true } : {},
+    );
+    const candidate =
+      answer?.decision && typeof answer.decision === "object"
+        ? answer.decision
+        : answer;
+    if (
+      candidate &&
+      typeof candidate === "object" &&
+      [
+        "acceptOnce",
+        "acceptForTurn",
+        "acceptForSession",
+        "decline",
+        "cancel",
+      ].includes(candidate.kind)
+    ) {
+      return candidate;
+    }
+    if (answer === true) return { kind: "acceptOnce" };
+    return { kind: "decline" };
+  }
+
   /**
    * Agent-core AskUserQuestion transport for Desktop/WebSocket consumers.
    * It uses the same pending map and `session-answer` resolver as MCP
@@ -369,7 +410,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
    * Resolves the corresponding pending promise.
    */
   resolveAnswer(requestId, answer, binding = null) {
-    this._resolvePending(requestId, answer, "question", binding);
+    return this._resolvePending(requestId, answer, "question", binding);
   }
 
   /**
@@ -441,7 +482,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
   }
 
   resolveHostTool(requestId, payload) {
-    this._resolvePending(requestId, payload, "host-tool");
+    return this._resolvePending(requestId, payload, "host-tool");
   }
 
   rejectAllPending(reason = createAbortError("Interaction interrupted")) {
@@ -549,7 +590,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
   ) {
     const pending = this._pending.get(requestId);
     if (!pending) {
-      return;
+      return Object.freeze({ settled: false, reason: "not_pending" });
     }
     // Kind guard: a question-answer must not settle a host-tool request (or
     // vice versa). On a mismatch, IGNORE the message — leave the request pending
@@ -559,7 +600,7 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
     // value). Backward-compatible: callers passing no expectedKind, and
     // pre-kind pending entries, behave exactly as before.
     if (expectedKind && pending.kind && pending.kind !== expectedKind) {
-      return;
+      return Object.freeze({ settled: false, reason: "kind_mismatch" });
     }
 
     // Approval-binding guard (authority §"权限来源"): if this request was raised
@@ -572,17 +613,18 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
       pending.bindingType === "interaction" &&
       !sameInteractionBinding(pending.binding, incomingBinding)
     ) {
-      return;
+      return Object.freeze({ settled: false, reason: "binding_mismatch" });
     }
 
     let effective = payload;
     if (
       pending.bindingType !== "interaction" &&
       pending.binding &&
-      incomingBinding &&
-      !verifyApprovalBinding(pending.binding, incomingBinding)
+      ((pending.requireBinding && !incomingBinding) ||
+        (incomingBinding &&
+          !verifyApprovalBinding(pending.binding, incomingBinding)))
     ) {
-      effective = false;
+      effective = pending.requireBinding ? { kind: "decline" } : false;
     }
 
     this._pending.delete(requestId);
@@ -594,13 +636,23 @@ export class WebSocketInteractionAdapter extends InteractionAdapter {
         effective === true ||
         effective === "true" ||
         effective === "yes" ||
-        effective === "y";
+        effective === "y" ||
+        ["acceptOnce", "acceptForTurn", "acceptForSession"].includes(
+          effective?.kind || effective?.decision?.kind,
+        );
       this._notifyPendingApproval("approval.settled", {
         requestId,
         reason: normalizedApproval ? "approved" : "denied",
       });
     }
     pending.resolve(effective);
+    return Object.freeze({
+      settled: true,
+      reason:
+        effective !== payload && pending.requireBinding
+          ? "binding_mismatch_denied"
+          : "resolved",
+    });
   }
 }
 

package/src/lib/policy-decision-event.js

@@ -0,0 +1,149 @@
+import { createHash } from "node:crypto";
+import { redactSecrets } from "./secret-scan.js";
+
+export const POLICY_DECISION_EVENT_VERSION = 1;
+
+const MAX_CHAIN = 8;
+
+function boundedText(value, max) {
+  if (value == null) return null;
+  let text;
+  if (typeof value === "string") {
+    text = value;
+  } else {
+    try {
+      text = JSON.stringify(value);
+    } catch {
+      text = String(value);
+    }
+  }
+  const redacted = redactSecrets(String(text));
+  return redacted.length > max
+    ? `${redacted.slice(0, Math.max(0, max - 1))}…`
+    : redacted;
+}
+
+function stableValue(value) {
+  if (Array.isArray(value)) return value.map(stableValue);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.keys(value)
+      .filter((key) => value[key] !== undefined)
+      .sort()
+      .map((key) => [key, stableValue(value[key])]),
+  );
+}
+
+function digest(value) {
+  return `sha256:${createHash("sha256")
+    .update(JSON.stringify(stableValue(value)))
+    .digest("hex")}`;
+}
+
+function canonicalDecision(
+  value,
+  { blocked = false, requiresApproval = false } = {},
+) {
+  const normalized = String(value || "")
+    .trim()
+    .toLowerCase();
+  if (
+    blocked ||
+    ["block", "blocked", "deny", "denied", "decline", "cancel"].includes(
+      normalized,
+    )
+  ) {
+    return "deny";
+  }
+  if (
+    requiresApproval ||
+    ["ask", "confirm", "approval_required", "require_confirmation"].includes(
+      normalized,
+    )
+  ) {
+    return "ask";
+  }
+  return "allow";
+}
+
+function normalizeChain(value) {
+  if (!Array.isArray(value)) return [];
+  return value.slice(0, MAX_CHAIN).map((candidate) => {
+    const row =
+      candidate && typeof candidate === "object" && !Array.isArray(candidate)
+        ? candidate
+        : {};
+    return {
+      layer: boundedText(row.layer, 80),
+      outcome: boundedText(row.outcome, 80),
+      via: boundedText(row.via || row.source, 120),
+      rule: boundedText(row.rule, 256),
+      reason: boundedText(row.reason, 512),
+    };
+  });
+}
+
+function finalizePolicyDecision(value) {
+  const projection = Object.fromEntries(
+    Object.entries(value).filter(([, entry]) => entry !== undefined),
+  );
+  const policyDigest = digest(projection);
+  return Object.freeze({
+    type: "policy_decision",
+    schema_version: POLICY_DECISION_EVENT_VERSION,
+    decision_id:
+      boundedText(projection.decision_id, 160) ||
+      `policy:${policyDigest.slice("sha256:".length, "sha256:".length + 48)}`,
+    ...projection,
+    policy_digest: policyDigest,
+  });
+}
+
+export function projectHookPolicyDecision(event = {}) {
+  if (event?.type !== "hook_response") return null;
+  return finalizePolicyDecision({
+    source: "hook",
+    decision: canonicalDecision(event.decision, {
+      blocked: event.blocked === true || Boolean(event.error),
+      requiresApproval: event.requires_approval === true,
+    }),
+    session_id: boundedText(event.session_id, 160) || undefined,
+    turn_id: boundedText(event.turn_id, 160) || undefined,
+    tool_use_id: boundedText(event.tool_use_id, 160) || undefined,
+    tool: boundedText(event.tool || event.tool_name, 256) || undefined,
+    hook_event: boundedText(event.hook_event, 96) || undefined,
+    via: boundedText(
+      event.via || (event.hook_event ? `hook:${event.hook_event}` : "hook"),
+      120,
+    ),
+    reason: event.error ? "hook_runtime_error" : undefined,
+  });
+}
+
+export function projectToolPolicyDecision(event = {}, context = {}) {
+  const permission =
+    event?.permission_decision &&
+    typeof event.permission_decision === "object" &&
+    !Array.isArray(event.permission_decision)
+      ? event.permission_decision
+      : null;
+  if (!permission) return null;
+  return finalizePolicyDecision({
+    decision_id:
+      boundedText(permission.id || event.permission_decision_id, 160) ||
+      undefined,
+    source: "tool",
+    decision: canonicalDecision(permission.decision),
+    session_id:
+      boundedText(context.sessionId || event.session_id, 160) || undefined,
+    turn_id: boundedText(context.turnId || event.turn_id, 160) || undefined,
+    tool_use_id:
+      boundedText(context.toolUseId || event.tool_use_id || event.id, 160) ||
+      undefined,
+    tool: boundedText(event.tool || permission.tool, 256) || undefined,
+    via: boundedText(permission.via, 120) || undefined,
+    rule: boundedText(permission.rule, 256) || undefined,
+    reason: boundedText(permission.reason, 512) || undefined,
+    chain: normalizeChain(permission.chain),
+  });
+}

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -2208,7 +2208,7 @@ function cleanupWindowsTemporaryPath(
       }
       if (
         !expectedIdentity ||
-        !sameWindowsFileIdentity(inspected.identity, expectedIdentity)
+        !sameWindowsFileObjectIdentity(inspected.identity, expectedIdentity)
       ) {
         return false;
       }
@@ -2719,6 +2719,20 @@ function sameWindowsFileIdentity(left, right) {
   );
 }
 
+// Cleanup is authorized by the stable file-object identity, not by metadata
+// that Windows may settle after the helper closes its last write handle.  The
+// strict identity above remains authoritative while content is read or
+// attested; this cleanup-only comparison still rejects a same-path replacement
+// because that changes the inode/birth identity.
+function sameWindowsFileObjectIdentity(left, right) {
+  return (
+    left.dev === right.dev &&
+    left.ino === right.ino &&
+    left.mode === right.mode &&
+    left.birthtimeNs === right.birthtimeNs
+  );
+}
+
 function inspectWindowsAdapterAssembly(runtime, assemblyPath) {
   const boundBefore = inspectWindowsAdapterBoundPath(
     runtime,

package/src/lib/record-replay/index.js

@@ -1 +1,2 @@
 export * from "./skill-recorder.js";
+export * from "./playwright-ui-driver.js";