cli-aimlock 7.0.35 → 7.0.37

package/README.md

@@ -23,7 +23,7 @@ When active, Aimlock uses Lock for one file through 500 changed lines and Probe
 - 把需求锁成可执行目标，阻止思考漂移、执行漂移、范围膨胀
 - Bypass / Lock / Probe / Swarm 分档：小改绕过；深度修改才进入门禁
 - 改前文件快照，禁止创建 git 分支
-- Lock / Probe / Swarm 分别强制 3 / 10 / 30 个文件与 2 / 8 / 15 分钟读取预算；Probe、Swarm 另有限制 30K / 100K 估算 token
+- Lock / Probe / Swarm 分别强制 3 / 10 / 30 个文件与 2 / 8 / 60 分钟读取预算；Probe、Swarm 另有限制 30K / 100K 估算 token
 - Ed25519 写入凭证绑定 chainId、快照摘要、路径集合和最长 300 秒有效期
 - `probe.targetSymbols` 可从新鲜的 ContextBase 项目地图解析真实目标文件；缺失、歧义或陈旧条目直接阻断
 - 服务端按当前需求实时发现专项技能，只返回命中项；非计算需求不出现 Calctool
@@ -43,7 +43,7 @@ cli-aimlock local gate-issue .
 cli-aimlock local guarded-write .
 ```
 
-每个命令从 stdin 读取 JSON。读取预算使用进程间原子锁，耗尽后只允许执行、输出方案或明确阻塞；追加预算必须携带 Confirm Protocol 的低风险确认回执。无凭证写入仅豁免 `.aimlock/logs/` 与 `.aimlock/tmp/`。
+每个命令从 stdin 读取 JSON。读取预算使用进程间原子锁，耗尽后只允许执行、输出方案或明确阻塞；文件/token 追加预算必须携带 Confirm Protocol 的低风险确认回执。长任务可先用 `budget-auto-renew-request` 生成目标、路径、续期间隔与次数上限，再凭一次真实回执调用 `budget-auto-renew`；同任务后续只自动续时间，累计额度与每次续期保留审计。达到次数/文件/token 上限仍明确阻断。撤销或完成时调用 `budget-auto-renew-stop`；本地执行链成功也会关闭预算。无凭证写入仅豁免 `.aimlock/logs/` 与 `.aimlock/tmp/`。
 
 Swarm 模式下，`chain-plan` 会在 `swarm` 前插入 `coordinator.conflict-scan`。`gate-issue` 必须显式声明 `coordinationRequired`；为 true 时凭证绑定 `.coord/leases/` 中的签名文件锁，`guarded-write` 在同一拦截点同时校验门禁与活动租约。存在活动 `dependency-wait` 的 chain 会被 `budget-read` 拒绝。
 
@@ -65,3 +65,9 @@ Source: https://github.com/88208555/aimlock-clitax.git
 Brain Client 服务端在同一次 runtime 请求的事务中绑定真实响应、生成并持久化权威评分与评语，再返回已提交回执。broker 只验证 `feedbackReceiptId`、`feedbackInvocationId` 和权威摘要，不发起第二次评价写入，也不生成分数或评语。`not-reported`、验证不完整、P0/P1 findings、`blocked` 或 `failed` 都不得生成好评；缺凭证、缺回执、摘要不匹配、响应非法或 HTTP 失败都会显式失败。
 
 本地 CLI 不提供手工评分或评语提交命令，人类不能选择技能分数或填写技能评价。日常聊天不属于评价协议。
+
+## 网络中断与原回执恢复
+
+仅在 TLS 握手前确定尚未发送 HTTP 请求时，broker 才允许最多 3 次连接尝试，并受总超时约束。请求发出后发生断线或响应中断，只用 GET 查询原 requestId 的服务端回执，禁止重发 POST；未取得有效回执时保留不确定状态，不得假定成功或继续依赖步骤。
+
+`npx cli-aimlock@latest recover <operation> <requestId>` 可重新查询原调用，不会重做操作或重复计费。链恢复不会跳过人工确认，也不会自动重跑结果不确定的本地命令。代理连接需 Node.js 22.21+ 或 24.5+；不支持的运行时会明确报错。

package/aimlock-chain-calls.mjs

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto'
 import { resolve } from 'node:path'
 import { executeCoordinatorOperation } from 'cli-swarm/coordinator'
 import { loadOfficialSkillContext } from './installer.mjs'
-import { invokeOfficialSkill } from './broker.mjs'
+import { invokeOfficialSkill, recoverOfficialSkill } from './broker.mjs'
 import { fail, sha256 } from './aimlock-local-fs.mjs'
 import { errorRecord } from './aimlock-chain-model.mjs'
 import { saveExecution } from './aimlock-chain-store.mjs'
@@ -52,10 +52,12 @@ export async function callSkill(session, skillId, operation, input) {
     const invocation = await invokeOfficialSkill(context, operation, input, {
       environment: dependencies.environment, credentialAccess: dependencies.credentialAccess,
       request: async (url, options) => {
-        const request = JSON.parse(options.body).input
-        call.requestId = request.requestId
-        call.status = 'dispatched'
-        await saveExecution(session.file, session.state)
+        if (options.method === 'POST') {
+          const request = JSON.parse(options.body).input
+          call.requestId = request.requestId
+          call.status = 'dispatched'
+          await saveExecution(session.file, session.state)
+        }
         return dependencies.request(url, options)
       },
     })
@@ -103,3 +105,20 @@ export async function callCommand(session, input) {
     throw error
   }
 }
+
+export async function recoverSkillCall(session, skillId) {
+  const call = session.record.calls.at(-1)
+  if (!call || call.kind !== 'skill' || !call.requestId || !['uncertain', 'dispatched', 'recorded'].includes(call.status)) {
+    fail('AIMLOCK_CHAIN_RECOVERY_INVALID', 'Only an uncertain skill request can be recovered by receipt query')
+  }
+  call.status = 'uncertain'
+  await saveExecution(session.file, session.state)
+  const invocation = await recoverOfficialSkill(skillContext(session.state, skillId),
+    call.operation, call.requestId, session.dependencies)
+  call.receipt = invocation
+  call.status = 'recorded'
+  call.error = null
+  call.completedAt = new Date().toISOString()
+  await saveExecution(session.file, session.state)
+  return invocation.response.output
+}

package/aimlock-chain-cli.mjs

@@ -1,6 +1,7 @@
 import { stdin, stdout } from 'node:process'
 import { answerExecution, executionStatus, initializeExecution, resumeExecution } from './aimlock-chain-executor.mjs'
 import { errorRecord } from './aimlock-chain-model.mjs'
+import { createBrokerTransport } from './broker-transport.mjs'
 import { fail } from './aimlock-local-fs.mjs'
 
 const PLAN_MAX_BYTES = 1_048_576
@@ -29,7 +30,7 @@ export async function dispatchChain(args) {
   if (!Object.hasOwn(expected, operation) || args.length !== expected[operation]) {
     fail('AIMLOCK_CHAIN_USAGE_INVALID', CHAIN_USAGE)
   }
-  const dependencies = { environment: process.env, request: fetch }
+  const dependencies = { environment: process.env, request: createBrokerTransport({ environment: process.env }) }
   if (operation === 'init') return initializeExecution(repositoryRoot, await readPlan(stdin))
   if (operation === 'status') return executionStatus(repositoryRoot, chainId)
   if (operation === 'resume') return resumeExecution(repositoryRoot, chainId, dependencies)

package/aimlock-chain-executor.mjs

@@ -4,7 +4,7 @@ import { fail } from './aimlock-local-fs.mjs'
 import { bindInput, errorRecord, validatePlan } from './aimlock-chain-model.mjs'
 import { assertNewExecution, executionStatus, initialState, loadExecution, recoverInterrupted,
   saveExecution, withExecutionLock } from './aimlock-chain-store.mjs'
-import { callCommand, callCoordinator, callSkill, resolveContexts, verifyContexts } from './aimlock-chain-calls.mjs'
+import { callCommand, callCoordinator, callSkill, recoverSkillCall, resolveContexts, verifyContexts } from './aimlock-chain-calls.mjs'
 import { answerPending, prepareHuman } from './aimlock-chain-human.mjs'
 import { skillOutcome } from './aimlock-chain-outcomes.mjs'
 
@@ -149,6 +149,20 @@ async function coordinatorStep(session, step, input) {
   }
 }
 
+function finishSkillStep(session, step, output) {
+    if (step.skillId === 'confirm-protocol' && step.operation === 'interaction-request' && output.status === 'succeeded') {
+      session.record.status = 'waiting'
+      session.record.output = output
+      session.record.pending = { kind: 'human', interaction: output.interaction, waitInput: null,
+        presentation: output.chatFallback, response: output,
+        continueWhen: Object.hasOwn(step, 'continueWhen') ? step.continueWhen : null }
+    } else {
+      const outcome = skillOutcome(step, output)
+      finish(session.record, output, outcome.status)
+      session.record.error = outcome.error
+    }
+}
+
 async function executeStep(session, step) {
   if (!await readyForWork(session, step)) return
   const input = bindInput(step, session.state)
@@ -164,17 +178,7 @@ async function executeStep(session, step) {
   } else if (step.kind === 'coordinator') await coordinatorStep(session, step, input)
   else {
     const output = await callSkill(session, step.skillId, step.operation, input)
-    if (step.skillId === 'confirm-protocol' && step.operation === 'interaction-request' && output.status === 'succeeded') {
-      session.record.status = 'waiting'
-      session.record.output = output
-      session.record.pending = { kind: 'human', interaction: output.interaction, waitInput: null,
-        presentation: output.chatFallback, response: output,
-        continueWhen: Object.hasOwn(step, 'continueWhen') ? step.continueWhen : null }
-    } else {
-      const outcome = skillOutcome(step, output)
-      finish(session.record, output, outcome.status)
-      session.record.error = outcome.error
-    }
+    finishSkillStep(session, step, output)
   }
   await saveExecution(session.file, session.state)
 }
@@ -186,6 +190,18 @@ async function advance(root, file, state, dependencies) {
     if (record.status === 'blocked' && step.kind === 'coordinator' && step.operation === 'lock-acquire'
       && record.output?.status === 'queued' && record.input) saveQueuePending(record, record.output, record.input)
     const session = { root, file, state, record, dependencies }
+    if (record.status === 'uncertain' && step.kind === 'skill'
+      && record.calls.at(-1)?.operation === step.operation) {
+      try {
+        finishSkillStep(session, step, await recoverSkillCall(session, step.skillId))
+        await saveExecution(file, state)
+      } catch (error) {
+        await failedStep(session, error)
+        return state
+      }
+      if (record.status === 'succeeded') continue
+      return state
+    }
     if (['failed', 'uncertain'].includes(record.status)) return state
     if (record.status === 'waiting' && record.pending?.kind === 'human') return state
     if (record.status === 'blocked' && record.pending?.kind !== 'coordination-guard') return state

package/aimlock-chain-model.mjs

@@ -179,7 +179,7 @@ export function chainStatus(state) {
 export function errorRecord(error) {
   if (!(error instanceof Error)) return { name: 'ThrownValue', message: String(error) }
   const value = { name: error.name, message: error.message }
-  for (const key of ['code', 'transportCode', 'operation', 'retryable']) {
+  for (const key of ['code', 'transportCode', 'operation', 'requestId', 'stage', 'transport', 'recovery', 'receiptStatus', 'retryable']) {
     if (Object.hasOwn(error, key)) value[key] = error[key]
   }
   if (error.cause instanceof Error) value.cause = errorRecord(error.cause)

package/aimlock-chain-store.mjs

@@ -4,6 +4,7 @@ import { dirname, resolve } from 'node:path'
 import { setTimeout as delay } from 'node:timers/promises'
 import { atomicJson, ensureManagedDirectory, fail, identifier, repositoryRoot, resolvedProjectPath } from './aimlock-local-fs.mjs'
 import { STATE_SCHEMA, chainStatus, planDigest, validatePlan } from './aimlock-chain-model.mjs'
+import { completeReadBudgetIfExists } from './aimlock-read-budget-renewal.mjs'
 
 const LOCK_WAIT_MS = 2_000
 const LOCK_POLL_MS = 20
@@ -114,6 +115,7 @@ export async function saveExecution(file, state) {
   state.updatedAt = new Date().toISOString()
   state.status = chainStatus(state)
   await atomicJson(file, state)
+  if (state.status === 'succeeded') await completeReadBudgetIfExists(resolve(dirname(file), '../../..'), state.chainId)
 }
 
 export async function loadExecution(file) {

package/aimlock-local-runner.mjs

@@ -3,22 +3,15 @@ import {
   lstat,
   readFile,
   readdir,
-  writeFile,
 } from 'node:fs/promises'
 import { dirname, extname, relative, resolve } from 'node:path'
 import { promisify } from 'node:util'
 import {
   LOCAL_SCHEMA,
   appendAudit,
-  atomicJson,
-  ensureManagedDirectory,
   fail,
-  identifier,
-  managedPath,
   repositoryRoot,
   resolvedProjectPath,
-  safeRelativePath,
-  withFileLock,
 } from './aimlock-local-fs.mjs'
 import {
   PASS_SCHEMA,
@@ -27,24 +20,19 @@ import {
   verifyMutationPassFile,
 } from './aimlock-local-gate.mjs'
 import { resolveContextMapTargets } from './aimlock-context-map.mjs'
-import { assertChainNotSuspended } from './aimlock-coordination.mjs'
+import { BUDGET_SCHEMA, TOKEN_ESTIMATE_ALGORITHM, READ_BUDGETS, initializeReadBudget } from './aimlock-read-budget-state.mjs'
+import { checkCachedReadAccess, extendReadBudget, readBudgetStatus, readFileWithinBudget } from './aimlock-read-budget.mjs'
+import { authorizeReadBudgetRenewal, requestReadBudgetRenewal, stopReadBudgetRenewal } from './aimlock-read-budget-renewal.mjs'
+import { AUTO_RENEW_OPERATION_SCHEMAS } from './aimlock-read-budget-schemas.mjs'
 
 const execFile = promisify(execFileCallback)
-const BUDGET_SCHEMA = 'aimlock.read-budget/1.0'
-const CONFIRMATION_SCHEMA = 'confirm-protocol.skill.response/1.0'
 const MAX_DISCOVERED_FILES = 1_000
 const MAX_SOURCE_BYTES = 1_048_576
-const TOKEN_ESTIMATE_ALGORITHM = 'utf8-bytes-div-4-ceil'
 const SOURCE_EXTENSIONS = new Set(['.cjs', '.js', '.jsx', '.mjs', '.ts', '.tsx'])
 const IGNORED_DIRECTORIES = new Set([
   '.aimlock', '.git', '.runtime', 'coverage', 'dist', 'node_modules',
 ])
 const MODE_ORDER = Object.freeze(['lock', 'probe', 'swarm'])
-const READ_BUDGETS = Object.freeze({
-  lock: Object.freeze({ maxFiles: 3, maxTokenEstimate: null, maxDurationMs: 120_000 }),
-  probe: Object.freeze({ maxFiles: 10, maxTokenEstimate: 30_000, maxDurationMs: 480_000 }),
-  swarm: Object.freeze({ maxFiles: 30, maxTokenEstimate: 100_000, maxDurationMs: 900_000 }),
-})
 const HIGH_RISK_PATTERN = /生产数据|支付|用户隐私|密码|密钥|凭证|线上环境|production/i
 const IMPORT_PATTERN = /(?:import|export)\s+(?:[^'";]+?\s+from\s+)?['"]([^'"]+)['"]|require\(\s*['"]([^'"]+)['"]\s*\)/g
 const schema = (required, properties) => ({ type: 'object', additionalProperties: false,
@@ -67,6 +55,7 @@ const BUDGET_CONFIRMATION_SCHEMA = schema(['schemaVersion', 'requestId', 'status
   }), nextStep: objectValueSchema,
 })
 const LOCAL_OPERATION_SCHEMAS = Object.freeze({
+  ...AUTO_RENEW_OPERATION_SCHEMAS,
   capabilities: schema([], {}),
   probe: schema(['goal', 'targetHints'], { goal: stringSchema, targetHints: stringArraySchema,
     targetSymbols: { type: 'array', items: objectValueSchema } }),
@@ -266,167 +255,11 @@ function reassessMode(input) {
   }
 }
 
-async function readBudget(root, chainId) {
-  const id = identifier(chainId, 'chainId')
-  const path = managedPath(root, 'runs', id, 'read-budget.json')
-  const state = JSON.parse(await readFile(path, 'utf8'))
-  if (state.schemaVersion !== BUDGET_SCHEMA || state.chainId !== id) {
-    fail('AIMLOCK_BUDGET_INVALID', 'read budget authority is invalid')
-  }
-  return { path, state }
-}
-
-function budgetView(state, now = Date.now()) {
-  const elapsedMs = now - Date.parse(state.startedAt)
-  const remainingFiles = Math.max(0, state.maxFiles - state.uniqueFiles.length)
-  const remainingTokenEstimate = state.maxTokenEstimate === null ? null
-    : Math.max(0, state.maxTokenEstimate - state.tokenEstimate)
-  const remainingDurationMs = Math.max(0, state.maxDurationMs - elapsedMs)
-  const decisionRequired = remainingFiles === 0 || remainingDurationMs === 0
-    || remainingTokenEstimate === 0
-  return { ...state, elapsedMs, remainingFiles, remainingTokenEstimate, remainingDurationMs,
-    decisionRequired, nextActions: decisionRequired ? ['execute', 'plan', 'blocked'] : [] }
-}
-
-async function initializeReadBudget(input) {
-  const root = await repositoryRoot(input.repositoryRoot)
-  const chainId = identifier(input.chainId, 'chainId')
-  const limits = READ_BUDGETS[input.mode]
-  if (!limits) fail('AIMLOCK_MODE_INVALID', 'mode must be lock, probe, or swarm')
-  const directory = await ensureManagedDirectory(root, 'runs', chainId)
-  const state = {
-    schemaVersion: BUDGET_SCHEMA,
-    chainId,
-    mode: input.mode,
-    startedAt: new Date().toISOString(),
-    ...limits,
-    uniqueFiles: [],
-    readCalls: 0,
-    tokenEstimate: 0,
-    tokenEstimateAlgorithm: TOKEN_ESTIMATE_ALGORITHM,
-    extensions: [],
-  }
-  await writeFile(resolve(directory, 'read-budget.json'), `${JSON.stringify(state)}\n`, {
-    flag: 'wx', mode: 0o600,
-  })
-  await appendAudit(root, { event: 'read-budget-initialized', chainId, mode: input.mode })
-  return budgetView(state)
-}
-
-async function readFileWithinBudget(input) {
-  const root = await repositoryRoot(input.repositoryRoot)
-  const chainId = identifier(input.chainId, 'chainId')
-  await assertChainNotSuspended({ repositoryRoot: root, chainId })
-  const budgetPath = managedPath(root, 'runs', chainId, 'read-budget.json')
-  return withFileLock(budgetPath, async () => {
-    const authority = await readBudget(root, chainId)
-    const path = safeRelativePath(input.path)
-    const state = authority.state
-    const before = budgetView(state)
-    if (before.remainingDurationMs === 0) fail('AIMLOCK_DECISION_REQUIRED', 'read deadline exhausted')
-    const isNew = !state.uniqueFiles.includes(path)
-    if (isNew && before.remainingFiles === 0) fail('AIMLOCK_DECISION_REQUIRED', 'read file budget exhausted')
-    const projectFile = await resolvedProjectPath(root, path)
-    if (!projectFile.status.isFile()) fail('AIMLOCK_READ_NOT_FILE', `${path} is not a file`)
-    const tokenEstimate = Math.ceil(projectFile.status.size / 4)
-    if (before.remainingTokenEstimate !== null && tokenEstimate > before.remainingTokenEstimate) {
-      fail('AIMLOCK_DECISION_REQUIRED', 'read token estimate budget exhausted')
-    }
-    const content = await readFile(projectFile.target, 'utf8')
-    const updated = {
-      ...state,
-      uniqueFiles: isNew ? [...state.uniqueFiles, path] : state.uniqueFiles,
-      readCalls: state.readCalls + 1,
-      tokenEstimate: state.tokenEstimate + tokenEstimate,
-    }
-    await atomicJson(authority.path, updated)
-    await appendAudit(root, { event: 'read-consumed', chainId, path, tokenEstimate })
-    return { schemaVersion: LOCAL_SCHEMA, path, content, budget: budgetView(updated) }
-  })
-}
-
-async function checkCachedReadAccess(input) {
-  const root = await repositoryRoot(input.repositoryRoot)
-  const chainId = identifier(input.chainId, 'chainId')
-  await assertChainNotSuspended({ repositoryRoot: root, chainId })
-  const budgetPath = managedPath(root, 'runs', chainId, 'read-budget.json')
-  return withFileLock(budgetPath, async () => {
-    const { state } = await readBudget(root, chainId)
-    const path = safeRelativePath(input.path)
-    const budget = budgetView(state)
-    if (budget.remainingDurationMs === 0) fail('AIMLOCK_DECISION_REQUIRED', 'read deadline exhausted')
-    if (budget.remainingTokenEstimate === 0) fail('AIMLOCK_DECISION_REQUIRED', 'read token estimate budget exhausted')
-    if (!state.uniqueFiles.includes(path)) fail('AIMLOCK_CACHE_UNCHARGED', 'cached source was not read by this chain')
-    return { schemaVersion: LOCAL_SCHEMA, path, budget }
-  })
-}
-
-async function readBudgetStatus(input) {
-  const root = await repositoryRoot(input.repositoryRoot)
-  return budgetView((await readBudget(root, input.chainId)).state)
-}
-
-function confirmedBudgetExtension(input) {
-  const confirmation = input.confirmation
-  const audit = confirmation?.auditEntry
-  const callback = confirmation?.callbackRequest
-  const payload = callback?.payload
-  const fields = ['files', 'tokenEstimate', 'durationMs']
-  if (!confirmation || confirmation.schemaVersion !== CONFIRMATION_SCHEMA || confirmation.status !== 'succeeded'
-    || audit?.schemaVersion !== 'confirm.audit-entry/1.0' || audit.risk !== 'low' || audit.answer !== 'approve'
-    || typeof audit.remembered !== 'boolean' || !Number.isFinite(Date.parse(audit.answeredAt))
-    || callback?.operation !== 'budget-extend' || payload?.answer !== 'approve'
-    || payload.chainId !== input.chainId || payload.requestId !== audit.requestId
-    || !payload.additions || fields.some((key) => payload.additions[key] !== input.additions?.[key])) {
-    fail('AIMLOCK_CONFIRMATION_REQUIRED', 'a low-risk Confirm Protocol interaction-answer bound to this chain and exact additions is required')
-  }
-  identifier(audit.actorId, 'actorId')
-  identifier(audit.requestId, 'requestId')
-  return identifier(audit.auditId, 'auditId')
-}
-
-async function extendReadBudget(input) {
-  const root = await repositoryRoot(input.repositoryRoot)
-  const confirmationId = confirmedBudgetExtension(input)
-  const additions = input.additions
-  if (!additions || !Number.isSafeInteger(additions.files) || additions.files < 0
-    || !Number.isSafeInteger(additions.tokenEstimate) || additions.tokenEstimate < 0
-    || !Number.isSafeInteger(additions.durationMs) || additions.durationMs < 0
-    || additions.files + additions.tokenEstimate + additions.durationMs === 0) {
-    fail('AIMLOCK_EXTENSION_INVALID', 'budget additions must contain a positive integer increase')
-  }
-  const chainId = identifier(input.chainId, 'chainId')
-  const budgetPath = managedPath(root, 'runs', chainId, 'read-budget.json')
-  return withFileLock(budgetPath, async () => {
-    const authority = await readBudget(root, chainId)
-    const state = authority.state
-    if (state.extensions.some((item) => item.confirmationId === confirmationId)) {
-      fail('AIMLOCK_CONFIRMATION_REPLAYED', 'this budget confirmation has already been applied')
-    }
-    const updated = {
-      ...state,
-      maxFiles: state.maxFiles + additions.files,
-      maxTokenEstimate: state.maxTokenEstimate === null && additions.tokenEstimate === 0
-        ? null : (state.maxTokenEstimate ?? 0) + additions.tokenEstimate,
-      maxDurationMs: state.maxDurationMs + additions.durationMs,
-      extensions: [...state.extensions, {
-        confirmationId,
-        additions,
-        at: new Date().toISOString(),
-      }],
-    }
-    await atomicJson(authority.path, updated)
-    await appendAudit(root, { event: 'read-budget-extended', chainId,
-      confirmationId, additions })
-    return budgetView(updated)
-  })
-}
-
 const LOCAL_CAPABILITIES = Object.freeze({
   schemaVersion: LOCAL_SCHEMA,
   operations: Object.freeze([
     'capabilities', 'probe', 'reassess', 'budget-init', 'budget-read', 'budget-status',
-    'budget-extend', 'gate-issue', 'gate-verify', 'guarded-write',
+    'budget-extend', 'budget-auto-renew-request', 'budget-auto-renew', 'budget-auto-renew-stop', 'gate-issue', 'gate-verify', 'guarded-write',
   ]),
   operationSchemas: LOCAL_OPERATION_SCHEMAS,
   writeBoundary: 'Only writes routed through guarded-write are physically intercepted. The IDE host must route batch writes through this runner.',
@@ -442,6 +275,9 @@ export {
   LOCAL_SCHEMA,
   PASS_SCHEMA,
   READ_BUDGETS,
+  authorizeReadBudgetRenewal,
+  requestReadBudgetRenewal,
+  stopReadBudgetRenewal,
   checkCachedReadAccess,
   extendReadBudget,
   guardedWriteFile,

package/aimlock-read-budget-renewal.mjs

@@ -0,0 +1,198 @@
+import { readFile } from 'node:fs/promises'
+import { relative } from 'node:path'
+import { appendAudit, atomicJson, fail, identifier, managedPath, repositoryRoot,
+  resolvedProjectPath, safeRelativePath, sha256, withFileLock } from './aimlock-local-fs.mjs'
+import { readBudget, budgetView, requiredRenewalIntervals } from './aimlock-read-budget-state.mjs'
+
+const RENEWAL_SCHEMA = 'aimlock.read-budget-auto-renew/1.0'
+const MIN_INTERVAL_MS = 60_000
+const MAX_INTERVAL_MS = 86_400_000
+const MAX_RENEWALS = 1_000
+const RENEWAL_LIMITS = Object.freeze({ minIntervalMs: MIN_INTERVAL_MS,
+  maxIntervalMs: MAX_INTERVAL_MS, maxRenewals: MAX_RENEWALS })
+const RENEW_OPERATION = 'budget-auto-renew'
+const RENEWAL_REASON = 'authorized-read-deadline-expired'
+
+function renewalTerms(input) {
+  const chainId = identifier(input.chainId, 'chainId')
+  const scope = input.scope
+  const policy = input.policy
+  if (!scope || typeof scope.goal !== 'string' || !scope.goal.trim()
+    || !Array.isArray(scope.allowedPaths) || scope.allowedPaths.length === 0) {
+    fail('AIMLOCK_RENEWAL_SCOPE_INVALID', 'a goal and explicit repository-relative allowedPaths are required')
+  }
+  const paths = scope.allowedPaths.map((path) => {
+    const value = safeRelativePath(path)
+    if (/[*?\[\]{}]/.test(value)) fail('AIMLOCK_RENEWAL_SCOPE_INVALID', 'scope paths must be literal files or directories')
+    return value
+  })
+  if (!policy || !Number.isSafeInteger(policy.intervalMs) || policy.intervalMs < MIN_INTERVAL_MS
+    || policy.intervalMs > MAX_INTERVAL_MS || !Number.isSafeInteger(policy.maxRenewals)
+    || policy.maxRenewals < 1 || policy.maxRenewals > MAX_RENEWALS) {
+    fail('AIMLOCK_RENEWAL_POLICY_INVALID', 'intervalMs must be 60000..86400000; maxRenewals must be 1..1000')
+  }
+  const normalizedScope = { goal: scope.goal.trim(), allowedPaths: [...new Set(paths)].sort() }
+  return { chainId, scope: normalizedScope, scopeDigest: sha256(JSON.stringify(normalizedScope)),
+    policy: { intervalMs: policy.intervalMs, maxRenewals: policy.maxRenewals } }
+}
+
+function renewalQuestion(terms) {
+  return `Allow automatic read-time renewal for chain ${terms.chainId}? Goal: ${terms.scope.goal}. `
+    + `Read scope: ${terms.scope.allowedPaths.join(', ')}. Each renewal: ${terms.policy.intervalMs} ms; `
+    + `maximum: ${terms.policy.maxRenewals}; total additional time: ${terms.policy.intervalMs * terms.policy.maxRenewals} ms. `
+    + 'File, token and write limits remain unchanged. Revocation or task completion stops automatic renewal.'
+}
+
+async function requestReadBudgetRenewal(input) {
+  const terms = renewalTerms(input)
+  const root = await repositoryRoot(input.repositoryRoot)
+  const { state } = await readBudget(root, terms.chainId)
+  await assertReadBudgetActive(root, state)
+  const requestId = identifier(input.requestId, 'requestId')
+  return { schemaVersion: 'confirm.interaction/1.0', requestId, type: 'confirm',
+    question: renewalQuestion(terms), options: [{ id: 'approve', label: 'Approve' }, { id: 'decline', label: 'Decline' }],
+    default: null, timeout: null, timeoutAction: 'wait', risk: 'low', riskDescription: '',
+    rememberable: false, memoryKey: '', callback: { operation: RENEW_OPERATION,
+      payload: { chainId: terms.chainId, scopeDigest: terms.scopeDigest, policy: terms.policy } } }
+}
+
+function renewalReceipt(input, terms) {
+  const response = input.confirmation
+  const audit = response?.auditEntry
+  const callback = response?.callbackRequest
+  const payload = callback?.payload
+  if (response?.schemaVersion !== 'confirm-protocol.skill.response/1.0' || response.status !== 'succeeded'
+    || audit?.schemaVersion !== 'confirm.audit-entry/1.0' || audit.risk !== 'low'
+    || audit.answer !== 'approve' || audit.remembered !== false || !Number.isFinite(Date.parse(audit.answeredAt))
+    || audit.question !== renewalQuestion(terms) || callback?.operation !== RENEW_OPERATION
+    || payload?.answer !== 'approve' || payload.chainId !== terms.chainId || payload.requestId !== audit.requestId
+    || payload.scopeDigest !== terms.scopeDigest || payload.policy?.intervalMs !== terms.policy.intervalMs
+    || payload.policy?.maxRenewals !== terms.policy.maxRenewals) {
+    fail('AIMLOCK_CONFIRMATION_REQUIRED', 'a one-time Confirm Protocol approval bound to the chain, goal, scope and exact renewal policy is required')
+  }
+  identifier(response.requestId, 'confirmation.requestId')
+  return { confirmationId: identifier(audit.auditId, 'auditId'), actorId: identifier(audit.actorId, 'actorId'),
+    requestId: identifier(audit.requestId, 'requestId'), authorizedAt: audit.answeredAt }
+}
+
+async function authorizeReadBudgetRenewal(input) {
+  const terms = renewalTerms(input)
+  const receipt = renewalReceipt(input, terms)
+  const root = await repositoryRoot(input.repositoryRoot)
+  const budgetPath = managedPath(root, 'runs', terms.chainId, 'read-budget.json')
+  return withFileLock(budgetPath, async () => {
+    const { state } = await readBudget(root, terms.chainId)
+    await assertReadBudgetActive(root, state)
+    if (state.autoRenew) {
+      const replayed = state.autoRenew.confirmationId === receipt.confirmationId
+      fail(replayed ? 'AIMLOCK_CONFIRMATION_REPLAYED' : 'AIMLOCK_RENEWAL_ALREADY_AUTHORIZED',
+        'this chain already has an immutable renewal authorization; use the existing policy or an explicit budget extension')
+    }
+    for (const path of terms.scope.allowedPaths) {
+      const target = await resolvedProjectPath(root, path, { allowMissing: true })
+      if (relative(root, target.target).split('\\').join('/') !== path) {
+        fail('AIMLOCK_RENEWAL_SCOPE_INVALID', 'authorized paths must use their canonical repository location')
+      }
+    }
+    const updated = { ...state, autoRenew: { schemaVersion: RENEWAL_SCHEMA,
+      ...terms, ...receipt, status: 'active', renewalCount: 0, totalRenewedMs: 0, renewals: [] } }
+    await atomicJson(budgetPath, updated)
+    await appendAudit(root, { event: 'read-budget-auto-renew-authorized', ...terms, ...receipt })
+    return budgetView(updated)
+  })
+}
+
+async function executionCompleted(root, chainId) {
+  let source
+  try {
+    source = await readFile(managedPath(root, 'executions', chainId, 'state.json'), 'utf8')
+  } catch (error) {
+    if (error.code === 'ENOENT') return false
+    throw error
+  }
+  const execution = JSON.parse(source)
+  if (execution.chainId !== chainId || typeof execution.status !== 'string') {
+    fail('AIMLOCK_CHAIN_STATE_INVALID', 'execution lifecycle does not match the read-budget chain')
+  }
+  return execution.status === 'succeeded'
+}
+
+async function assertReadBudgetActive(root, state) {
+  if (state.completedAt || await executionCompleted(root, state.chainId)) {
+    fail('AIMLOCK_BUDGET_COMPLETED', 'this task is complete; read access and automatic renewal have stopped')
+  }
+}
+
+function assertRenewalScope(state, path, canonicalPath) {
+  if (!state.autoRenew) return
+  const paths = state.autoRenew.scope.allowedPaths
+  const covered = (target) => paths.some((allowed) => target === allowed || target.startsWith(`${allowed}/`))
+  if (!covered(path) || !covered(canonicalPath)) {
+    fail('AIMLOCK_RENEWAL_SCOPE_MISMATCH', 'source path is outside this task\'s approved read scope')
+  }
+}
+
+async function renewReadBudgetTime(root, authority, path) {
+  const state = authority.state
+  const now = Date.now()
+  const budget = budgetView(state, now)
+  if (budget.remainingDurationMs > 0) return state
+  const renewal = state.autoRenew
+  if (!renewal || renewal.status !== 'active') {
+    fail('AIMLOCK_DECISION_REQUIRED', `read deadline exhausted; automatic renewal ${renewal ? 'was stopped' : 'requires explicit approval via budget-auto-renew-request'}`)
+  }
+  if (budget.remainingFiles === 0 || budget.remainingTokenEstimate === 0) {
+    fail('AIMLOCK_DECISION_REQUIRED', 'file or token budget exhausted; time renewal cannot expand these limits')
+  }
+  const count = requiredRenewalIntervals(state, now)
+  if (count > renewal.policy.maxRenewals - renewal.renewalCount) {
+    fail('AIMLOCK_DECISION_REQUIRED', `automatic renewal limit exhausted: ${renewal.renewalCount}/${renewal.policy.maxRenewals} used; ${count} additional intervals required`)
+  }
+  const at = new Date(now).toISOString()
+  const records = Array.from({ length: count }, (_, index) => ({
+    count: renewal.renewalCount + index + 1, reason: RENEWAL_REASON, at, path,
+    durationMs: renewal.policy.intervalMs,
+    maxDurationMs: state.maxDurationMs + (index + 1) * renewal.policy.intervalMs,
+  }))
+  const addedMs = count * renewal.policy.intervalMs
+  const updated = { ...state, maxDurationMs: state.maxDurationMs + addedMs,
+    autoRenew: { ...renewal, renewalCount: renewal.renewalCount + count,
+      totalRenewedMs: renewal.totalRenewedMs + addedMs, renewals: [...renewal.renewals, ...records] } }
+  await atomicJson(authority.path, updated)
+  for (const record of records) await appendAudit(root, { event: 'read-budget-auto-renewed',
+    chainId: state.chainId, confirmationId: renewal.confirmationId, scopeDigest: renewal.scopeDigest, ...record })
+  return updated
+}
+
+async function stopReadBudgetRenewal(input) {
+  const root = await repositoryRoot(input.repositoryRoot)
+  const chainId = identifier(input.chainId, 'chainId')
+  if (!['revoked', 'completed'].includes(input.reason)) {
+    fail('AIMLOCK_RENEWAL_STOP_INVALID', 'reason must be revoked or completed')
+  }
+  return withFileLock(managedPath(root, 'runs', chainId, 'read-budget.json'), async () => {
+    const { state, path } = await readBudget(root, chainId)
+    if (state.completedAt || (input.reason === 'revoked' && state.autoRenew?.status === 'revoked')) return budgetView(state)
+    if (input.reason === 'revoked' && !state.autoRenew) {
+      fail('AIMLOCK_RENEWAL_NOT_AUTHORIZED', 'this task has no automatic renewal authorization to revoke')
+    }
+    const at = new Date().toISOString()
+    const updated = { ...state }
+    if (input.reason === 'completed') updated.completedAt = at
+    if (state.autoRenew) updated.autoRenew = { ...state.autoRenew, status: input.reason, stoppedAt: at }
+    await atomicJson(path, updated)
+    await appendAudit(root, { event: 'read-budget-auto-renew-stopped', chainId, reason: input.reason, at })
+    return budgetView(updated)
+  })
+}
+
+async function completeReadBudgetIfExists(root, chainId) {
+  try { await readBudget(root, chainId) } catch (error) {
+    if (error.code === 'ENOENT') return
+    throw error
+  }
+  await stopReadBudgetRenewal({ repositoryRoot: root, chainId, reason: 'completed' })
+}
+
+export { RENEWAL_LIMITS, authorizeReadBudgetRenewal, requestReadBudgetRenewal, stopReadBudgetRenewal,
+  assertReadBudgetActive, assertRenewalScope, renewReadBudgetTime, completeReadBudgetIfExists }

package/aimlock-read-budget-schemas.mjs

@@ -0,0 +1,31 @@
+import { RENEWAL_LIMITS } from './aimlock-read-budget-renewal.mjs'
+
+const stringSchema = { type: 'string', minLength: 1 }
+const objectSchema = (required, properties) => ({ type: 'object', additionalProperties: false, required, properties })
+const scopeSchema = objectSchema(['goal', 'allowedPaths'], { goal: stringSchema,
+  allowedPaths: { type: 'array', minItems: 1, items: stringSchema } })
+const policySchema = objectSchema(['intervalMs', 'maxRenewals'], {
+  intervalMs: { type: 'integer', minimum: RENEWAL_LIMITS.minIntervalMs, maximum: RENEWAL_LIMITS.maxIntervalMs },
+  maxRenewals: { type: 'integer', minimum: 1, maximum: RENEWAL_LIMITS.maxRenewals },
+})
+const confirmationSchema = objectSchema(['schemaVersion', 'requestId', 'status', 'callbackRequest', 'auditEntry', 'nextStep'], {
+  schemaVersion: { const: 'confirm-protocol.skill.response/1.0' }, requestId: stringSchema,
+  status: { const: 'succeeded' },
+  callbackRequest: objectSchema(['operation', 'payload'], { operation: { const: 'budget-auto-renew' },
+    payload: objectSchema(['chainId', 'scopeDigest', 'policy', 'requestId', 'answer'], {
+      chainId: stringSchema, scopeDigest: stringSchema, policy: policySchema, requestId: stringSchema, answer: { const: 'approve' },
+    }) }),
+  auditEntry: objectSchema(['schemaVersion', 'auditId', 'requestId', 'actorId', 'question', 'answer', 'remembered', 'risk', 'answeredAt'], {
+    schemaVersion: { const: 'confirm.audit-entry/1.0' }, auditId: stringSchema, requestId: stringSchema,
+    actorId: stringSchema, question: stringSchema, answer: { const: 'approve' }, remembered: { const: false },
+    risk: { const: 'low' }, answeredAt: { type: 'string', format: 'date-time' },
+  }), nextStep: { type: 'object' },
+})
+const terms = { chainId: stringSchema, scope: scopeSchema, policy: policySchema }
+const AUTO_RENEW_OPERATION_SCHEMAS = Object.freeze({
+  'budget-auto-renew-request': objectSchema(['chainId', 'scope', 'policy', 'requestId'], { ...terms, requestId: stringSchema }),
+  'budget-auto-renew': objectSchema(['chainId', 'scope', 'policy', 'confirmation'], { ...terms, confirmation: confirmationSchema }),
+  'budget-auto-renew-stop': objectSchema(['chainId', 'reason'], { chainId: stringSchema, reason: { enum: ['revoked', 'completed'] } }),
+})
+
+export { AUTO_RENEW_OPERATION_SCHEMAS }