codex-workflow-v2 2.0.0-beta.12.13 → 2.0.0-beta.12.15

package/dist/src/workflow.js

@@ -2,7 +2,7 @@ import { appendFileSync, existsSync, lstatSync, readFileSync, readdirSync } from
 import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { PROTOCOL_VERSION, STATE_SCHEMA_VERSION, } from './contracts.js';
-import { inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
+import { inspectBoundedWorkflowDependencyCommit, inspectDependencyKnowledgeRefresh, inspectDependencyProvenanceRecovery, } from './dependency-provenance.js';
 import { inspectHistoricalStepProvenanceRecovery, omittedStepEvidenceCommits, } from './historical-step-provenance.js';
 import { renderBrief, renderPlan, renderResult } from './artifacts.js';
 import { assertDelegationCanAuthorize, hashDelegationPolicy, prepareDelegationGrantGate, } from './delegation.js';
@@ -3833,36 +3833,43 @@ export class WorkflowService {
             });
         }
         const now = this.now();
+        const recoveredRecords = preflight.dependencyCommits.map((dependencyCommit, index) => {
+            const isTerminalCommit = index === preflight.dependencyCommits.length - 1;
+            return {
+                commitSha: dependencyCommit.commitSha,
+                parentCommitSha: dependencyCommit.parentCommitSha,
+                packageName: PACKAGE_NAME,
+                packageVersion: dependencyCommit.packageVersion,
+                files: ['package-lock.json', 'package.json'],
+                actor: normalizedActor,
+                reason: normalizedReason,
+                recordedAt: now.toISOString(),
+                retainedHistoricalCommits: isTerminalCommit ? preflight.retainedHistoricalCommits : [],
+                ...(isTerminalCommit && preflight.activeDownstreamProof
+                    ? { activeDownstreamProof: preflight.activeDownstreamProof }
+                    : {}),
+                ...(isTerminalCommit && preflight.downstreamProofReplan
+                    ? { downstreamProofReplan: preflight.downstreamProofReplan }
+                    : {}),
+                ...(isTerminalCommit && preflight.historicalStepProvenance
+                    ? { historicalStepProvenance: preflight.historicalStepProvenance }
+                    : {}),
+                ...(isTerminalCommit && preflight.planIntegrity
+                    ? { planIntegrity: preflight.planIntegrity }
+                    : {}),
+            };
+        });
         const nextTask = {
             ...task,
             revision: task.revision + 1,
             updatedAt: now.toISOString(),
-            systemCommits: [...task.systemCommits, preflight.commitSha],
+            systemCommits: [
+                ...task.systemCommits,
+                ...preflight.dependencyCommits.map((dependencyCommit) => dependencyCommit.commitSha),
+            ],
             dependencyProvenanceRecoveries: [
                 ...(task.dependencyProvenanceRecoveries ?? []),
-                {
-                    commitSha: preflight.commitSha,
-                    parentCommitSha: preflight.parentCommitSha,
-                    packageName: PACKAGE_NAME,
-                    packageVersion: PACKAGE_VERSION,
-                    files: ['package-lock.json', 'package.json'],
-                    actor: normalizedActor,
-                    reason: normalizedReason,
-                    recordedAt: now.toISOString(),
-                    retainedHistoricalCommits: preflight.retainedHistoricalCommits,
-                    ...(preflight.activeDownstreamProof
-                        ? { activeDownstreamProof: preflight.activeDownstreamProof }
-                        : {}),
-                    ...(preflight.downstreamProofReplan
-                        ? { downstreamProofReplan: preflight.downstreamProofReplan }
-                        : {}),
-                    ...(preflight.historicalStepProvenance
-                        ? { historicalStepProvenance: preflight.historicalStepProvenance }
-                        : {}),
-                    ...(preflight.planIntegrity
-                        ? { planIntegrity: preflight.planIntegrity }
-                        : {}),
-                },
+                ...recoveredRecords,
             ],
         };
         if (recoveryMode !== 'plan-integrity' || !preflight.planIntegrity) {
@@ -6027,18 +6034,22 @@ export class WorkflowService {
         };
     }
     carriedPlanIntegrityUpdateCompatibility(snapshot, task) {
-        let parentCommit;
-        try {
-            parentCommit = runGit(snapshot.identity.repositoryRoot, ['rev-parse', 'HEAD^']);
+        let boundaryCommit = headCommit(snapshot.identity.repositoryRoot);
+        let dependencyCommitCount = 0;
+        while (!task.systemCommits.includes(boundaryCommit)) {
+            const dependencyCommit = inspectBoundedWorkflowDependencyCommit(snapshot.identity.repositoryRoot, boundaryCommit);
+            if (!dependencyCommit)
+                return null;
+            boundaryCommit = dependencyCommit.parentCommitSha;
+            dependencyCommitCount += 1;
         }
-        catch {
+        if (dependencyCommitCount === 0)
             return null;
-        }
         const dirtyFiles = changedFiles(snapshot.identity.repositoryRoot).sort();
         const candidates = (task.dependencyProvenanceRecoveries ?? []).filter((record) => {
             const compatibility = record.planIntegrity;
             if (!compatibility
-                || record.commitSha !== parentCommit
+                || record.commitSha !== boundaryCommit
                 || !task.systemCommits.includes(record.commitSha)
                 || compatibility.planHash !== task.planHash
                 || canonicalJsonStringify([...compatibility.dirtyFiles].sort()) !== canonicalJsonStringify(dirtyFiles)