chati-dev 4.5.28 → 4.5.29

package/src/orchestrator/agent-selector.js

@@ -24,6 +24,35 @@ export const AGENT_PIPELINE = [
   { name: 'devops', phase: 'deploy', group: 'deploy', parallel: false },
 ];
 
+const V2_PLANNING_PREDECESSORS = Object.freeze({
+  brief: Object.freeze(['work-understanding']),
+  detail: Object.freeze(['work-understanding', 'brief']),
+  architect: Object.freeze(['work-understanding', 'brief']),
+  ux: Object.freeze(['work-understanding', 'brief']),
+  'qa-planning': Object.freeze(['work-understanding', 'brief', 'detail', 'architect', 'ux']),
+  phases: Object.freeze(['work-understanding', 'brief', 'detail', 'architect', 'ux', 'qa-planning']),
+  tasks: Object.freeze(['work-understanding', 'brief', 'detail', 'architect', 'ux', 'qa-planning', 'phases']),
+});
+
+// Shared by reservation, command consumption and canonical advance. Keep this
+// check pure so the session writer can apply the same contract under its lock.
+export function assertV2PlanningPredecessors(session, agent) {
+  const projectType = session?.project_type || session?.project?.type || 'greenfield';
+  const required = (V2_PLANNING_PREDECESSORS[agent] || []).map((name) =>
+    name === 'work-understanding' ? (projectType === 'brownfield' ? 'brownfield-wu' : 'greenfield-wu') : name
+  );
+  const incomplete = required.filter((name) =>
+    session?.agents?.[name]?.status !== 'completed' || !session?.completed_agents?.includes(name)
+  );
+  if (incomplete.length > 0) {
+    const error = new Error(`Agent ${agent} cannot execute or advance before its canonical predecessors complete: ${incomplete.join(', ')}`);
+    error.code = 'V2_PLANNING_PREDECESSORS_INCOMPLETE';
+    error.incomplete = incomplete;
+    throw error;
+  }
+  return Object.freeze({ valid: true, required: Object.freeze(required) });
+}
+
 /**
  * Get agent definition by name.
  *
@@ -197,9 +226,10 @@ export function selectAgent(context) {
  *
  * @param {string} agentName - Current agent
  * @param {string[]} completedAgents - Already completed
+ * @param {object} [options] - V2-only recovery; legacy workflows retain forward selection
  * @returns {{ next: string|null, isParallel: boolean, group: string[] }}
  */
-export function getNextAgent(agentName, completedAgents = []) {
+export function getNextAgent(agentName, completedAgents = [], { recoverPlanningPeers = false } = {}) {
   const currentDef = getAgentDef(agentName);
   if (!currentDef) {
     return { next: null, isParallel: false, group: [] };
@@ -207,6 +237,14 @@ export function getNextAgent(agentName, completedAgents = []) {
 
   const currentIndex = AGENT_PIPELINE.indexOf(currentDef);
 
+  // Planning peers may finish in any order. The last completed member is not
+  // a watermark for the whole group, including after a legacy downstream cursor.
+  if (recoverPlanningPeers && (currentDef.phase === 'plan' || agentName === 'brief') && completedAgents.includes('brief')) {
+    const peers = getAgentsByGroup('plan-parallel');
+    const unfinished = peers.find(({ name }) => !completedAgents.includes(name));
+    if (unfinished) return { next: unfinished.name, isParallel: true, group: peers.map(({ name }) => name) };
+  }
+
   // Look ahead for next incomplete agent
   for (let i = currentIndex + 1; i < AGENT_PIPELINE.length; i++) {
     const nextDef = AGENT_PIPELINE[i];

package/src/orchestrator/browser-artifact-store.js

@@ -0,0 +1,131 @@
+import { randomUUID } from 'node:crypto';
+import { join, resolve } from 'node:path';
+import { canonicalSerialize, sha256 } from '@chati/core';
+import { installationAuthorityProjectBinding, signHostAuthorityPayload, verifyHostAuthorityPayload } from '../installer-v2/installation-authority.js';
+import { listSafeInstallationStorageFiles, persistImmutableInstallationFile, readSafeInstallationStorageFile, removeSafeInstallationStorageFile } from '../installer-v2/catalog-client.js';
+
+export const LOCAL_BROWSER_ARTIFACT_PREFIX = 'rail-browser-artifact://sha256/';
+const DOMAIN = 'chati.browser-artifact-retention.v1';
+const SEMANTICS = 'logical-ttl-opportunistic-purge-v1';
+const RETENTION = Object.freeze({ 'internal-30d': 30 * 24 * 60 * 60 * 1000 });
+const META_FIELDS = ['schema_version', 'artifact_id', 'run_id', 'project_id', 'project_binding', 'attempt_id',
+  'commit_ref', 'policy_ref', 'browser_session_id', 'kind', 'content_sha256', 'retention_class',
+  'retention_semantics', 'captured_at', 'expires_at'];
+function fail(code, message) { throw Object.assign(new Error(message), { code }); }
+function exact(value, fields) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).length === fields.length && Object.keys(value).every((key) => fields.includes(key));
+}
+function now(clock) {
+  const value = new Date(clock()).getTime();
+  if (!Number.isFinite(value)) fail('BROWSER_RETENTION_TIME_INVALID', 'browser retention clock must be valid');
+  return value;
+}
+function directory(projectDir) { return join(resolve(projectDir), '.chati/v2/rail/browser-artifacts'); }
+function pathFor(projectDir, ref) {
+  if (typeof ref !== 'string' || !/^rail-browser-artifact:\/\/sha256\/[a-f0-9]{64}$/.test(ref)) fail('BROWSER_ARTIFACT_REF_INVALID', 'expected a content-addressed local browser artifact reference');
+  return join(directory(projectDir), `${ref.slice(LOCAL_BROWSER_ARTIFACT_PREFIX.length)}.json`);
+}
+export function browserRetentionPolicy(retentionClass) {
+  if (!Object.hasOwn(RETENTION, retentionClass)) fail('BROWSER_RETENTION_UNSUPPORTED', 'this local store supports internal-30d logical TTL only; physical-deletion guarantees require a different backend');
+  return Object.freeze({ retention_class: retentionClass, semantics: SEMANTICS, duration_ms: RETENTION[retentionClass] });
+}
+
+function assertRedactedContent(content) {
+  if (!exact(content, ['schema_version', 'projection', 'nodes']) || content.schema_version !== 1
+    || content.projection !== 'dom-structure-all-values-redacted' || !Array.isArray(content.nodes)
+    || content.nodes.length === 0 || content.nodes.length > 5000) fail('BROWSER_ARTIFACT_CONTENT_INVALID', 'only the supported all-values-redacted DOM projection can enter this store');
+  const tags = new Set('HTML HEAD BODY TITLE META LINK STYLE SCRIPT DIV SPAN P H1 H2 H3 H4 H5 H6 A BUTTON INPUT FORM LABEL SELECT OPTION TEXTAREA UL OL LI TABLE THEAD TBODY TR TH TD MAIN NAV HEADER FOOTER SECTION ARTICLE ASIDE IMG SVG PATH CANVAS VIDEO AUDIO IFRAME BR HR STRONG EM B I PRE CODE #text #document OTHER'.split(' '));
+  for (const node of content.nodes) {
+    if (!exact(node, ['document', 'index', 'parent', 'type', 'tag', ...(node?.type === 3 ? ['text'] : [])])
+      || !['document', 'index', 'parent', 'type'].every((key) => Number.isInteger(node[key]))
+      || node.document < 0 || node.index < 0 || node.parent < -1 || node.type < 1 || node.type > 12
+      || !tags.has(node.tag) || (node.type === 3 && node.text !== '[REDACTED]')) fail('BROWSER_ARTIFACT_CONTENT_INVALID', 'DOM structure contains unsupported or unredacted fields');
+  }
+}
+
+function authenticatedRecord({ projectDir, projectId, ref, authorityDirectory }) {
+  const path = pathFor(projectDir, ref);
+  const source = readSafeInstallationStorageFile(path, { allowMissing: true, label: 'retained browser artifact', maxBytes: 2 * 1024 * 1024 });
+  if (!source) fail('BROWSER_ARTIFACT_MISSING', 'retained browser artifact is missing');
+  if (source.stat.uid !== BigInt(process.geteuid()) || (source.stat.mode & 0o777n) !== 0o600n) fail('BROWSER_ARTIFACT_STORAGE_UNSAFE', 'retained browser artifact must be private and owned by the current account');
+  let record;
+  try { record = JSON.parse(source.content); } catch { fail('BROWSER_ARTIFACT_INVALID', 'retained browser artifact is not valid JSON'); }
+  const metadata = record?.metadata;
+  if (!exact(record, ['metadata', 'content', 'authority_receipt']) || !exact(metadata, META_FIELDS)
+    || metadata.schema_version !== 1 || metadata.kind !== 'dom' || metadata.project_id !== projectId
+    || metadata.project_binding !== sha256(installationAuthorityProjectBinding(projectDir, projectId))
+    || ref !== `${LOCAL_BROWSER_ARTIFACT_PREFIX}${sha256(metadata)}`
+    || metadata.content_sha256 !== sha256(record.content)
+    || metadata.retention_semantics !== SEMANTICS
+    || !exact(record.authority_receipt, ['authority_id', 'signature'])
+    || !verifyHostAuthorityPayload(metadata, { domain: DOMAIN, authorityDirectory,
+      authorityId: record.authority_receipt.authority_id, signature: record.authority_receipt.signature })) {
+    fail('BROWSER_ARTIFACT_INVALID', 'retained browser artifact metadata, bytes or host authentication changed');
+  }
+  const policy = browserRetentionPolicy(metadata.retention_class);
+  const captured = Date.parse(metadata.captured_at); const expires = Date.parse(metadata.expires_at);
+  if (!Number.isFinite(captured) || !Number.isFinite(expires) || expires - captured !== policy.duration_ms
+    || new Date(captured).toISOString() !== metadata.captured_at || new Date(expires).toISOString() !== metadata.expires_at) fail('BROWSER_ARTIFACT_INVALID', 'retained browser artifact has an invalid fixed lifetime');
+  assertRedactedContent(record.content);
+  return { path, source, record, expires };
+}
+
+/** Fixed lifetime from capture. Reading/retrying never modifies this record. */
+export function readBrowserArtifact({ projectDir, projectId, ref, clock = () => new Date(), authorityDirectory } = {}) {
+  const loaded = authenticatedRecord({ projectDir, projectId, ref, authorityDirectory });
+  if (now(clock) >= loaded.expires) {
+    let purgeError;
+    try { removeSafeInstallationStorageFile(loaded.path, loaded.source); } catch (error) { purgeError = error.code || error.name; }
+    const error = Object.assign(new Error(`browser artifact expired${purgeError ? `; physical purge failed: ${purgeError}` : ''}`), { code: 'BROWSER_ARTIFACT_EXPIRED' });
+    if (purgeError) error.purge_error = purgeError;
+    throw error;
+  }
+  return Object.freeze({ ref, ...loaded.record });
+}
+
+export function persistBrowserArtifact({ projectDir, projectId, run_id, attempt_id, commit_ref, policy_ref,
+  browser_session_id, artifact, retention_class, captured_at, clock = () => new Date(), authorityDirectory } = {}) {
+  const policy = browserRetentionPolicy(retention_class);
+  if (!artifact || artifact.kind !== 'dom' || artifact.redaction_status !== 'redacted') fail('BROWSER_ARTIFACT_CONTENT_INVALID', 'artifact must be an actually redacted DOM observation');
+  assertRedactedContent(artifact.content);
+  const captured = Date.parse(captured_at);
+  if (!Number.isFinite(captured) || new Date(captured).toISOString() !== captured_at || captured > now(clock)
+    || now(clock) >= captured + policy.duration_ms) fail('BROWSER_ARTIFACT_CAPTURE_INVALID', 'artifact capture must be current, never future or already expired');
+  if (![run_id, attempt_id, commit_ref, policy_ref, browser_session_id, projectId].every((value) => typeof value === 'string' && value.trim())) fail('BROWSER_ARTIFACT_BINDING_REQUIRED', 'retained artifact requires canonical project, attempt, result and browser provenance');
+  const metadata = { schema_version: 1, artifact_id: `browser-artifact-${randomUUID()}`, run_id, project_id: projectId,
+    project_binding: sha256(installationAuthorityProjectBinding(projectDir, projectId)), attempt_id, commit_ref,
+    policy_ref, browser_session_id, kind: 'dom', content_sha256: sha256(artifact.content), retention_class,
+    retention_semantics: SEMANTICS, captured_at, expires_at: new Date(captured + policy.duration_ms).toISOString() };
+  const ref = `${LOCAL_BROWSER_ARTIFACT_PREFIX}${sha256(metadata)}`;
+  const record = { metadata, content: artifact.content,
+    authority_receipt: signHostAuthorityPayload(metadata, { domain: DOMAIN, authorityDirectory }) };
+  persistImmutableInstallationFile(pathFor(projectDir, ref), `${canonicalSerialize(record)}\n`, { label: 'retained browser artifact', maxBytes: 2 * 1024 * 1024 });
+  readBrowserArtifact({ projectDir, projectId, ref, clock, authorityDirectory });
+  return Object.freeze({ artifact_id: metadata.artifact_id, kind: 'dom', sanitized_ref: ref,
+    redaction_status: 'redacted', retention_class, content_sha256: metadata.content_sha256 });
+}
+
+export function pruneBrowserArtifacts({ projectDir, projectId, clock = () => new Date(), authorityDirectory } = {}) {
+  const timestamp = now(clock); const removed = []; const failures = [];
+  for (const name of listSafeInstallationStorageFiles(directory(projectDir))) {
+    if (!/^[a-f0-9]{64}\.json$/.test(name)) continue;
+    const ref = `${LOCAL_BROWSER_ARTIFACT_PREFIX}${name.slice(0, -5)}`;
+    try {
+      const loaded = authenticatedRecord({ projectDir, projectId, ref, authorityDirectory });
+      if (timestamp >= loaded.expires && removeSafeInstallationStorageFile(loaded.path, loaded.source)) removed.push(ref);
+    } catch (error) { failures.push({ ref, code: error.code || error.name }); }
+  }
+  return Object.freeze({ ok: failures.length === 0, removed, failures });
+}
+
+export function assertLocalBrowserArtifacts({ projectDir, projectId, artifacts, expected, clock = () => new Date() }) {
+  for (const artifact of artifacts) {
+    if (!artifact.sanitized_ref.startsWith(LOCAL_BROWSER_ARTIFACT_PREFIX)) continue;
+    const { metadata } = readBrowserArtifact({ projectDir, projectId, ref: artifact.sanitized_ref, clock });
+    if (metadata.content_sha256 !== artifact.content_sha256 || metadata.retention_class !== artifact.retention_class
+      || metadata.artifact_id !== artifact.artifact_id || metadata.kind !== artifact.kind
+      || !Object.entries(expected).every(([key, value]) => metadata[key] === value)) fail('BROWSER_ARTIFACT_BINDING_MISMATCH', 'local browser artifact does not match certified execution and policy provenance');
+  }
+  return true;
+}