codex-workflow-v2 2.0.0-beta.13.14 → 2.0.0-beta.13.16

package/src/alpha6/npm-check-contract.ts

@@ -0,0 +1,47 @@
+import path from 'node:path';
+
+const NPM_RUN_CHECK = /^npm\s+run(?:-script)?\s+([A-Za-z0-9._:-]+)(?:\s+--\s+(.+))?$/;
+const SAFE_FORWARD_ARG = /^--[A-Za-z0-9._:-]+=[^\s]+$/;
+const NODE_AFFECTED_SCRIPT = /^node\s+([A-Za-z0-9._/-]+\.(?:cjs|js|mjs))\s+affected$/;
+const SELECTOR = /^(?:--base|--head|--files)=.+$/;
+
+export interface ParsedNpmRunCheck {
+  script: string;
+  forwardedArguments: string[];
+}
+
+export interface RequiredSelectorContract {
+  runnerPath: string;
+  selectors: readonly ['--base', '--head', '--files'];
+}
+
+export function parseNpmRunCheck(command: string): ParsedNpmRunCheck | null {
+  const match = NPM_RUN_CHECK.exec(command.trim());
+  if (!match) return null;
+  const forwardedArguments = match[2]?.trim().split(/\s+/).filter(Boolean) ?? [];
+  if (forwardedArguments.some((argument) => !SAFE_FORWARD_ARG.test(argument))) return null;
+  return { script: match[1]!, forwardedArguments };
+}
+
+export function inspectRequiredSelectorContract(
+  scriptCommand: string,
+  readRunner: (runnerPath: string) => string | null,
+): RequiredSelectorContract | null {
+  const match = NODE_AFFECTED_SCRIPT.exec(scriptCommand.trim());
+  if (!match) return null;
+  const runnerPath = match[1]!;
+  if (path.posix.isAbsolute(runnerPath)
+    || runnerPath.split('/').some((segment) => segment === '.' || segment === '..')) return null;
+  const source = readRunner(runnerPath);
+  if (!source
+    || !source.includes('process.argv.slice(3)')
+    || !source.includes('--base')
+    || !source.includes('--head')
+    || !source.includes('--files')
+    || !source.includes('Affected mode requires')) return null;
+  return { runnerPath, selectors: ['--base', '--head', '--files'] };
+}
+
+export function hasRequiredSelector(arguments_: readonly string[]): boolean {
+  return arguments_.some((argument) => SELECTOR.test(argument));
+}

package/src/alpha6/plan-integrity-update.ts

@@ -0,0 +1,20 @@
+import type { PlanIntegrityRecoveryAssessment } from './plan-integrity.js';
+import { validLiteralTestInvocationEvidence } from './component-owner.js';
+
+/** Source eligibility only: callers retain target, version surfaces, lease and transaction guards. */
+export function eligiblePlanIntegrityUpdateSource(
+  source: { train: number; patch: number | null } | null,
+  assessment: PlanIntegrityRecoveryAssessment | null,
+  hasRunningStep: boolean,
+): boolean {
+  if (!source || source.patch === null) return false;
+  // Preserve the original beta12 protocol, including its existing compatibility modes.
+  if (source.train === 12 && source.patch >= 11) return true;
+  // No general beta13 transport: assessment is freshly rederived by Core from the
+  // failed current execution cycle, tracked runner/spec and actual diagnostics.
+  return source.train === 13 && source.patch >= 11 && !hasRunningStep
+    && assessment?.applicable === true && assessment.eligible === true
+    && assessment.blockers.length === 0
+    && assessment.evidence?.kind === 'failed-check-component-owner-outside-allowed-writes'
+    && assessment.evidence.conflicts.some(validLiteralTestInvocationEvidence);
+}

package/src/alpha6/plan-integrity.ts

@@ -0,0 +1,298 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import path from 'node:path';
+import type {
+  PlanIntegrityConflictEvidence,
+  PlanIntegrityConflictEvidenceV2,
+  PlanIntegrityConflictEvidenceV3,
+  PlanIntegrityConflictEvidenceV4,
+  TaskState,
+} from '../contracts.js';
+import { pathAllowed } from '../domain/validation.js';
+import { WorkflowError } from '../errors.js';
+import { hashCanonical } from '../lifecycle/fingerprint.js';
+import { changedFiles, headCommit } from '../repository.js';
+import type { FileStateStore } from '../state/store.js';
+import {
+  hasRequiredSelector,
+  inspectRequiredSelectorContract,
+  parseNpmRunCheck,
+} from './npm-check-contract.js';
+import { inspectCheckSupportAnchors } from './check-support-anchor.js';
+import { inspectFailedCheckComponentOwners, semanticBoundaryHash } from './component-owner.js';
+import {
+  readCorrectiveDecisionEvents,
+  readRemediationEvents,
+  selectPlanIntegrityRemediations,
+} from './remediation.js';
+
+const ROOT_MANIFEST = 'package.json' as const;
+const TASK_ID = /^TASK-[0-9A-HJKMNP-TV-Z]{26}$/;
+
+export interface PlanIntegrityRecoveryAssessment {
+  readonly applicable: boolean;
+  readonly eligible: boolean;
+  readonly taskId: string;
+  readonly taskRevision: number;
+  readonly stepId: string;
+  readonly planHash: string | null;
+  readonly blockers: readonly string[];
+  readonly evidence: PlanIntegrityConflictEvidence | null;
+}
+
+export function defaultPlanIntegrityRecoveryActor(taskId: string): string {
+  if (!TASK_ID.test(taskId)) {
+    throw new WorkflowError('INVALID_ARGUMENT', `Cannot derive a Plan-integrity recovery actor from invalid Task ID ${taskId}.`);
+  }
+  return `agent:plan-integrity-recovery:${taskId.toLowerCase()}`;
+}
+
+export function assessPlanIntegrityRecovery(
+  store: FileStateStore,
+  repositoryRoot: string,
+  task: TaskState,
+  stepId: string,
+): PlanIntegrityRecoveryAssessment {
+  const base = {
+    taskId: task.id,
+    taskRevision: task.revision,
+    stepId,
+    planHash: task.planHash,
+  };
+  const step = task.steps.find((candidate) => candidate.id === stepId) ?? null;
+  if (!step || task.status !== 'needs_fix' || step.status !== 'failed' || !task.planHash) {
+    return { ...base, applicable: false, eligible: false, blockers: [], evidence: null };
+  }
+
+  const allRemediations = readRemediationEvents(store, task).filter((event) => event.stepId === stepId);
+  const decisions = readCorrectiveDecisionEvents(store, task).filter((event) => event.stepId === stepId);
+  const remediations = selectPlanIntegrityRemediations(store, task, allRemediations, decisions);
+  if (!remediations || remediations.some(event => event.failureKind !== 'checks-failed')) {
+    return { ...base, applicable: false, eligible: false, blockers: [], evidence: null };
+  }
+
+  const manifest = inspectRootManifest(repositoryRoot);
+  const runnerBlockers: string[] = [];
+  const conflicts: PlanIntegrityConflictEvidenceV2['conflicts'] = [];
+  for (const command of step.checks) {
+    const invocation = parseNpmRunCheck(command);
+    if (!invocation) continue;
+    const scriptCommand = manifest.scripts.get(invocation.script) ?? null;
+    if (scriptCommand === null) {
+      if (pathAllowed(ROOT_MANIFEST, step.allowedWrites)) continue;
+      conflicts.push({
+        reasonCode: 'MISSING_NPM_SCRIPT' as const,
+        script: invocation.script,
+        command: command.trim(),
+        scriptCommand: null,
+        runnerPath: null,
+        runnerHash: null,
+      });
+      continue;
+    }
+    const runnerInspections = new Map<string, ReturnType<typeof inspectRepositoryFile>>();
+    const selectorContract = inspectRequiredSelectorContract(scriptCommand, (runnerPath) => {
+      const inspection = inspectRepositoryFile(repositoryRoot, runnerPath);
+      runnerInspections.set(runnerPath, inspection);
+      return inspection.content;
+    });
+    if (!selectorContract || hasRequiredSelector(invocation.forwardedArguments)) continue;
+    const runnerInspection = runnerInspections.get(selectorContract.runnerPath) ?? null;
+    if (runnerInspection?.blocker) runnerBlockers.push(runnerInspection.blocker);
+    if (pathAllowed(ROOT_MANIFEST, step.allowedWrites)
+      || pathAllowed(selectorContract.runnerPath, step.allowedWrites)) continue;
+    conflicts.push({
+      reasonCode: 'REQUIRED_SELECTOR_MISSING' as const,
+      script: invocation.script,
+      command: command.trim(),
+      scriptCommand,
+      runnerPath: selectorContract.runnerPath,
+      runnerHash: runnerInspection?.hash ?? null,
+    });
+  }
+  conflicts.sort((left, right) => left.command.localeCompare(right.command) || left.reasonCode.localeCompare(right.reasonCode));
+  const supportConflicts: PlanIntegrityConflictEvidenceV3['conflicts'] = conflicts.length === 0
+    ? inspectCheckSupportAnchors({
+        step,
+        scripts: manifest.scripts,
+        readFile: (relativePath) => {
+          const inspected = inspectRepositoryFile(repositoryRoot, relativePath);
+          return { content: inspected.content, hash: inspected.hash };
+        },
+        pathExists: (relativePath) => gitPathExists(repositoryRoot, headCommit(repositoryRoot), relativePath),
+      }).map((conflict) => ({
+        ...conflict,
+        expectedOutputPaths: [...conflict.expectedOutputPaths],
+        anchoredMigrationNames: [...conflict.anchoredMigrationNames],
+      }))
+    : [];
+  const componentOwnerConflicts: PlanIntegrityConflictEvidenceV4['conflicts'] =
+    conflicts.length === 0 && supportConflicts.length === 0
+      ? inspectFailedCheckComponentOwners({
+          step,
+          scripts: manifest.scripts,
+          isTracked: (relativePath) => gitPathExists(repositoryRoot, headCommit(repositoryRoot), relativePath),
+          readFile: (relativePath) => {
+            const inspected = inspectRepositoryFile(repositoryRoot, relativePath);
+            return { content: inspected.content, hash: inspected.hash };
+          },
+        }).map(({ causeFingerprint: _causeFingerprint, ...conflict }) => conflict)
+      : [];
+  if (conflicts.length === 0 && supportConflicts.length === 0 && componentOwnerConflicts.length === 0) {
+    return { ...base, applicable: false, eligible: false, blockers: [], evidence: null };
+  }
+
+  if (remediations.length !== allRemediations.length && conflicts.length > 0)
+    return { ...base, applicable: false, eligible: false, blockers: [], evidence: null };
+
+  const files = [...changedFiles(repositoryRoot)].sort();
+  const outsideAllowedWrites = files.filter((file) => !pathAllowed(file, step.allowedWrites));
+  const forbiddenChanges = files.filter((file) => pathAllowed(file, step.forbiddenScope));
+  const blockers = [
+    ...(manifest.blocker ? [manifest.blocker] : []),
+    ...runnerBlockers,
+    ...(outsideAllowedWrites.length > 0
+      ? [`Changed files outside ${stepId} allowedWrites: ${outsideAllowedWrites.join(', ')}`]
+      : []),
+    ...(forbiddenChanges.length > 0
+      ? [`Changed files intersect ${stepId} forbiddenScope: ${forbiddenChanges.join(', ')}`]
+      : []),
+    ...supportConflicts.flatMap((conflict) => pathAllowed(conflict.supportPath, step.forbiddenScope)
+      ? [`Check-support authority ${conflict.supportPath} intersects ${stepId} forbiddenScope.`]
+      : []),
+    ...componentOwnerConflicts.flatMap((conflict) => pathAllowed(conflict.ownerPath, step.forbiddenScope)
+      ? [`Component owner ${conflict.ownerPath} intersects ${stepId} forbiddenScope.`]
+      : []),
+  ];
+  const stepDefinitionHash = hashCanonical({
+    id: step.id,
+    title: step.title,
+    objective: step.objective,
+    requirements: step.requirements,
+    dependencies: step.dependencies,
+    expectedOutputs: step.expectedOutputs,
+    allowedWrites: step.allowedWrites,
+    forbiddenScope: step.forbiddenScope,
+    checks: step.checks,
+  });
+  const remediationBindings = remediations.map((event) => ({
+    eventId: event.eventId,
+    eventHash: event.eventHash,
+    attemptOrdinal: event.attemptOrdinal,
+  }));
+  const evidenceBase = supportConflicts.length > 0 ? {
+    kind: 'check-support-anchor-outside-allowed-writes' as const,
+    taskRevision: task.revision,
+    remediationEvents: remediationBindings,
+    manifestPath: ROOT_MANIFEST,
+    manifestHash: manifest.hash,
+    gitHead: headCommit(repositoryRoot),
+    stepDefinitionHash,
+    conflicts: supportConflicts,
+    scopeExtensions: [...new Set(supportConflicts.map((conflict) => conflict.supportPath))].sort(),
+    changedFiles: files,
+  } : componentOwnerConflicts.length > 0 ? {
+    kind: 'failed-check-component-owner-outside-allowed-writes' as const,
+    taskRevision: task.revision,
+    remediationEvents: remediationBindings,
+    gitHead: headCommit(repositoryRoot),
+    stepDefinitionHash,
+    semanticBoundaryHash: semanticBoundaryHash(task),
+    failedCheckCauseFingerprint: step.failurePause!.failedChecks!.find((failure) =>
+      componentOwnerConflicts.some((conflict) => conflict.command === failure.command))!.causeFingerprint,
+    conflicts: componentOwnerConflicts,
+    scopeExtensions: [...new Set(componentOwnerConflicts.map((conflict) => conflict.ownerPath))].sort(),
+    changedFiles: files,
+  } : {
+    kind: 'non-executable-npm-check-outside-allowed-writes' as const,
+    taskRevision: task.revision,
+    remediationEvents: remediationBindings,
+    manifestPath: ROOT_MANIFEST,
+    manifestHash: manifest.hash,
+    gitHead: headCommit(repositoryRoot),
+    stepDefinitionHash,
+    conflicts,
+    changedFiles: files,
+  };
+  const evidence: PlanIntegrityConflictEvidence = {
+    ...evidenceBase,
+    conflictHash: hashCanonical({
+      domain: supportConflicts.length > 0
+        ? 'codex-workflow/plan-integrity-conflict/v3'
+        : componentOwnerConflicts.length > 0
+          ? 'codex-workflow/plan-integrity-conflict/v4'
+          : 'codex-workflow/plan-integrity-conflict/v2',
+      taskId: task.id,
+      planHash: task.planHash,
+      stepId,
+      evidence: evidenceBase,
+    }),
+  };
+  return {
+    ...base,
+    applicable: true,
+    eligible: blockers.length === 0,
+    blockers,
+    evidence,
+  };
+}
+
+function gitPathExists(repositoryRoot: string, commit: string, relativePath: string): boolean {
+  const result = spawnSync('git', ['-C', repositoryRoot, 'cat-file', '-e', `${commit}:${relativePath}`], {
+    encoding: 'utf8',
+  });
+  if (result.status === 0) return true;
+  if (result.status === 128) return false;
+  throw new WorkflowError('COMMAND_FAILED', `Unable to inspect ${relativePath} at ${commit}.`, {
+    stderr: result.stderr.trim(),
+    exitCode: result.status,
+  });
+}
+
+function inspectRootManifest(repositoryRoot: string): {
+  readonly scripts: ReadonlyMap<string, string>;
+  readonly hash: string | null;
+  readonly blocker: string | null;
+} {
+  const file = path.join(repositoryRoot, ROOT_MANIFEST);
+  if (!existsSync(file)) return { scripts: new Map(), hash: null, blocker: null };
+  const stat = lstatSync(file);
+  if (!stat.isFile()) {
+    return { scripts: new Map(), hash: null, blocker: 'Root package.json is not a regular file.' };
+  }
+  const bytes = readFileSync(file);
+  const hash = createHash('sha256').update(bytes).digest('hex');
+  try {
+    const parsed = JSON.parse(bytes.toString('utf8')) as { scripts?: unknown };
+    if (parsed.scripts === undefined) return { scripts: new Map(), hash, blocker: null };
+    if (!parsed.scripts || typeof parsed.scripts !== 'object' || Array.isArray(parsed.scripts)) {
+      return { scripts: new Map(), hash, blocker: 'Root package.json scripts field is malformed.' };
+    }
+    return {
+      scripts: new Map(Object.entries(parsed.scripts)
+        .filter((entry): entry is [string, string] => typeof entry[1] === 'string')),
+      hash,
+      blocker: null,
+    };
+  } catch {
+    return { scripts: new Map(), hash, blocker: 'Root package.json is not valid JSON.' };
+  }
+}
+
+function inspectRepositoryFile(repositoryRoot: string, relativePath: string): {
+  content: string | null;
+  hash: string | null;
+  blocker: string | null;
+} {
+  const file = path.join(repositoryRoot, relativePath);
+  if (!existsSync(file)) return { content: null, hash: null, blocker: `${relativePath} is missing.` };
+  const stat = lstatSync(file);
+  if (!stat.isFile()) return { content: null, hash: null, blocker: `${relativePath} is not a regular file.` };
+  const bytes = readFileSync(file);
+  return {
+    content: bytes.toString('utf8'),
+    hash: createHash('sha256').update(bytes).digest('hex'),
+    blocker: null,
+  };
+}