codex-workflow-v2 2.0.0-beta.13.8 → 2.0.0-beta.14

package/src/checks/runner.ts

@@ -0,0 +1,245 @@
+import { spawnSync, type SpawnSyncOptions } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { mkdtempSync, writeFileSync, readFileSync, existsSync, lstatSync, rmSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { performance } from 'node:perf_hooks';
+export interface CheckExecutionOptions {
+  timeoutMs?: number;
+  totalTimeoutMs?: number;
+  cancellationFile?: string;
+  maxOutputBytes?: number;
+  graceMs?: number;
+}
+export interface CheckCommandResult {
+  command: string;
+  outcome: 'passed' | 'failed' | 'infra';
+  exitCode: number | null;
+  signal: string | null;
+  error: string | null;
+  errorCode: string | null;
+  errorMessage: string | null;
+  output: string;
+  stdoutTail: string;
+  stderrTail: string;
+  outputTruncated: boolean;
+  outputBytes: number;
+  durationMs: number;
+  cleanupComplete: boolean;
+  cleanupScope: 'owned-process-group';
+  cleanupEvidencePath: string | null;
+}
+const message = (error: unknown) => error instanceof Error ? error.message.slice(0, 1024) : 'Unknown runner error';
+const sleep = (ms: number) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+const positive = (n: number | undefined, fallback: number, max: number) => {
+  const value = n ?? fallback;
+  if (!Number.isSafeInteger(value) || value <= 0 || value > max) {
+    throw new Error('Invalid check runner limit');
+  }
+  return value;
+};
+function alive(pid: number): boolean {
+  try {
+    process.kill(-pid, 0);
+    return true;
+  } catch (e) {
+    return (e as NodeJS.ErrnoException).code !== 'ESRCH';
+  }
+}
+function kill(pid: number, signal: NodeJS.Signals) {
+  try {
+    process.kill(-pid, signal);
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code !== 'ESRCH') {
+      throw e;
+    }
+  }
+}
+export function runCheckCommands(repositoryRoot: string, commands: string[], options: CheckExecutionOptions = {}): CheckCommandResult[] {
+  const timeout = positive(options.timeoutMs, 120_000, 600_000);
+  const total = positive(options.totalTimeoutMs, 600_000, 600_000);
+  const grace = positive(options.graceMs, 500, 5_000);
+  const cap = positive(options.maxOutputBytes, 12_000, 12_000);
+  if (options.cancellationFile !== undefined && (typeof options.cancellationFile !== 'string' || !options.cancellationFile.trim())) {
+    throw new Error('Invalid cancellation file');
+  }
+  const cancellationFile = options.cancellationFile === undefined ? null : path.resolve(options.cancellationFile);
+  const deadline = process.hrtime.bigint() + BigInt(total) * 1_000_000n;
+  const results: CheckCommandResult[] = [];
+  for (const command of commands) {
+    const start = performance.now();
+    let error: string | null = null, exitCode: number | null = null, signal: string | null = null, cleanup = true;
+    let output = '', stdoutTail = '', stderrTail = '', outputTruncated = false, outputBytes = 0;
+    const now = process.hrtime.bigint();
+    const perCommandDeadline = now + BigInt(timeout) * 1_000_000n;
+    const commandDeadline = perCommandDeadline < deadline ? perCommandDeadline : deadline;
+    const budget = Number((commandDeadline - now) / 1_000_000n);
+    if (process.platform === 'win32' || budget <= 0 || cancellationFile && existsSync(cancellationFile)) {
+      results.push({
+        command,
+        outcome: 'infra',
+        exitCode: null,
+        signal: null,
+        errorCode: process.platform === 'win32' ? 'PROCESS_PLATFORM_UNSUPPORTED' : budget <= 0 ? 'CHECK_TOTAL_TIMEOUT' : 'CHECK_CANCELLED',
+        error: process.platform === 'win32' ? 'platform-unsupported' : budget <= 0 ? 'total-timeout' : 'cancelled',
+        output,
+        stdoutTail,
+        stderrTail,
+        outputTruncated,
+        outputBytes,
+        errorMessage: null,
+        durationMs: 0,
+        cleanupComplete: true,
+        cleanupScope: 'owned-process-group',
+        cleanupEvidencePath: null
+      });
+      break;
+    }
+    const directory = mkdtempSync(path.join(os.tmpdir(), 'workflow-check-')), nonce = randomUUID(), request = path.join(directory, 'request.json'), resultFile = path.join(directory, 'result.json');
+    let pid: number | undefined;
+    let errorCode: string | null = null;
+    let errorMessage: string | null = null;
+    try {
+      writeFileSync(request, JSON.stringify({
+        nonce,
+        command,
+        cwd: repositoryRoot,
+        deadlineNs: commandDeadline.toString(),
+        graceMs: grace,
+        cap,
+        parentPid: process.pid,
+        cancellationFile,
+        resultFile,
+        journalFile: path.join(directory, 'owner.json')
+      }), {
+        mode: 0o600
+      });
+      const child = spawnSync(process.execPath, [fileURLToPath(new URL('./worker.js', import.meta.url)), request], {
+        cwd: repositoryRoot,
+        env: process.env,
+        stdio: 'ignore',
+        detached: true,
+        timeout: budget + 2 * grace + 250,
+        killSignal: 'SIGKILL'
+      } as SpawnSyncOptions & {
+        detached: boolean;
+      });
+      pid = child.pid;
+      signal = child.signal;
+      errorMessage = child.error ? message(child.error) : null;
+      errorCode = (child.error as NodeJS.ErrnoException | undefined)?.code ?? null;
+      error = child.error ? ((child.error as NodeJS.ErrnoException).code === 'ETIMEDOUT' ? 'outer-timeout' : 'helper-launch-failed') : null;
+      if (existsSync(resultFile)) {
+        const stat = lstatSync(resultFile);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 18 * cap + 8192) {
+          throw new Error('Invalid helper protocol size');
+        }
+        const r = JSON.parse(readFileSync(resultFile, 'utf8'));
+        const journalFile = path.join(directory, 'owner.json'), journalStat = lstatSync(journalFile);
+        if (!journalStat.isFile() || journalStat.isSymbolicLink() || journalStat.size > 1024) {
+          throw new Error('Invalid helper ownership');
+        }
+        const owner = JSON.parse(readFileSync(journalFile, 'utf8'));
+        if (owner.nonce !== nonce || owner.pid !== pid || owner.parentPid !== process.pid || owner.groupLeader !== true) {
+          throw new Error('Invalid helper ownership');
+        }
+        if (Object.keys(r).sort().join(',') !== 'errorCode,errorMessage,exitCode,finishedAtNs,nonce,output,outputBytes,outputTruncated,pid,protocol,reason,signal,stderrTail,stdoutTail' || r.pid !== pid || r.nonce !== nonce || r.protocol !== 1 || !['exit', 'timeout', 'cancelled', 'parent-exit', 'launch-failed'].includes(r.reason)
+          || !(r.exitCode === null || Number.isInteger(r.exitCode) && r.exitCode >= 0 && r.exitCode <= 255) || !(r.signal === null || typeof r.signal === 'string' && /^SIG[A-Z0-9]+$/.test(r.signal))
+          || !['output', 'stdoutTail', 'stderrTail'].every(k => typeof r[k] === 'string' && Buffer.byteLength(r[k]) <= cap + 3)
+          || !(r.errorCode === null || typeof r.errorCode === 'string' && /^[A-Z0-9_]{1,80}$/.test(r.errorCode))
+          || !(r.errorMessage === null || typeof r.errorMessage === 'string' && r.errorMessage.length <= 1024)
+          || (r.reason === 'exit' && r.exitCode === null && r.signal === null)
+          || typeof r.finishedAtNs !== 'string' || !/^[0-9]{1,30}$/.test(r.finishedAtNs)
+          || typeof r.outputTruncated !== 'boolean' || !Number.isSafeInteger(r.outputBytes) || r.outputBytes < 0) {
+          throw new Error('Invalid helper protocol');
+        }
+        ({
+          output,
+          stdoutTail,
+          stderrTail,
+          outputTruncated,
+          outputBytes,
+          exitCode
+        } = r);
+        signal = r.signal;
+        errorCode ??= r.errorCode;
+        errorMessage ??= r.errorMessage;
+        error ??= r.reason === 'exit' ? null : r.reason;
+        if (r.reason === 'exit' && BigInt(r.finishedAtNs) > commandDeadline) {
+          error ??= 'timeout';
+        }
+        if (r.reason === 'exit' && child.status !== 0) {
+          error ??= 'helper-failed';
+        }
+        if (r.reason === 'exit' && r.signal !== null) {
+          error ??= 'command-signalled';
+        }
+        if (r.reason === 'exit' && [126, 127].includes(r.exitCode)) {
+          error ??= 'shell-command-unavailable';
+        }
+      }
+      else {
+        error ??= 'helper-result-missing';
+      }
+    } catch (e) {
+      errorMessage ??= message(e);
+      error ??= 'helper-protocol-invalid';
+      errorCode ??= (e as NodeJS.ErrnoException).code ?? 'CHECK_HELPER_PROTOCOL_INVALID';
+    }
+    finally {
+      if (pid && pid > 0 && alive(pid)) {
+        error ??= 'descendants-remain';
+        try {
+          kill(pid, 'SIGTERM');
+          const end = performance.now() + grace;
+          while (alive(pid) && performance.now() < end) {
+            sleep(10);
+          }
+          if (alive(pid)) {
+            kill(pid, 'SIGKILL');
+          }
+          const killed = performance.now() + grace;
+          while (alive(pid) && performance.now() < killed) {
+            sleep(10);
+          }
+          cleanup = !alive(pid);
+        } catch (e) {
+          cleanup = false;
+          errorMessage ??= message(e);
+        }
+      }
+      if (!cleanup) {
+        error = 'cleanup-failed';
+      }
+      if (cleanup) {
+        rmSync(directory, {
+          recursive: true,
+          force: true
+        });
+      }
+    }
+    results.push({
+      command,
+      outcome: error ? 'infra' : exitCode === 0 ? 'passed' : 'failed',
+      exitCode,
+      signal,
+      error,
+      errorCode,
+      errorMessage,
+      output,
+      stdoutTail,
+      stderrTail,
+      outputTruncated,
+      outputBytes,
+      durationMs: Math.round(performance.now() - start),
+      cleanupComplete: cleanup,
+      cleanupScope: 'owned-process-group',
+      cleanupEvidencePath: cleanup ? null : directory
+    });
+    if (error) {
+      break;
+    }
+  }
+  return results;
+}

package/src/checks/task-sync.ts

@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto';
+import type { TaskState } from '../contracts.js';
+import { WorkflowError } from '../errors.js';
+import { changedFiles, currentBranch, headCommit } from '../repository.js';
+
+export function taskSyncChecks(task: TaskState): string[] {
+  return [...new Set(task.steps.flatMap(step => step.checks))];
+}
+export function taskSyncChecksHash(task: TaskState): string {
+  return createHash('sha256').update(JSON.stringify(taskSyncChecks(task))).digest('hex');
+}
+export function assertNoPendingBaseSyncValidation(task: TaskState): void {
+  if (task.pendingBaseSyncValidation !== undefined) {
+    throw new WorkflowError('TRANSITION_BLOCKED', 'Resume task sync-base validation before changing this Task.', { taskId: task.id });
+  }
+}
+/** This checkpoint grants no authority: only the exact merged snapshot may be checked again. */
+export function assessPendingBaseSyncValidation(task: TaskState): { dirtyFiles: string[]; reason: string | null } {
+  const pending = task.pendingBaseSyncValidation;
+  if (!pending || typeof pending !== 'object' || Array.isArray(pending)
+    || Object.keys(pending).sort().join(',') !== 'baseCommit,checksHash,headCommit,syncCommit'
+    || ![pending.baseCommit, pending.headCommit, pending.syncCommit].every(value => typeof value === 'string' && /^[a-f0-9]{40}$/.test(value))
+    || typeof pending.checksHash !== 'string' || !/^[a-f0-9]{64}$/.test(pending.checksHash)
+    || task.status !== 'validating' || task.workspaceOwner !== 'local' || !task.taskBranch
+    || task.baseCommit !== pending.baseCommit || pending.syncCommit !== pending.headCommit
+    || !task.systemCommits.includes(pending.syncCommit)
+    || task.evidenceHash !== null || task.resultHash !== null || task.review.status !== 'pending'
+    || task.authorizations.some(item => item.kind === 'final_acceptance' && item.decision === 'approved')) {
+    throw new WorkflowError('STATE_CORRUPT', 'Invalid pending base-sync validation checkpoint.', { taskId: task.id });
+  }
+  const dirtyFiles = changedFiles(task.repositoryRoot).sort();
+  const reason = taskSyncChecksHash(task) !== pending.checksHash ? 'The approved checks changed.'
+    : currentBranch(task.repositoryRoot) !== task.taskBranch ? 'Restore the exact Task branch.'
+      : headCommit(task.repositoryRoot) !== pending.headCommit ? 'The Task HEAD changed after synchronization.'
+        : dirtyFiles.length > 0 ? 'Validation left uncommitted files; preserve and resolve these changes before retrying.' : null;
+  return { dirtyFiles, reason };
+}
+export function assertPendingBaseSyncValidationReady(task: TaskState): void {
+  const assessment = assessPendingBaseSyncValidation(task);
+  if (assessment.reason) throw new WorkflowError('TRANSITION_BLOCKED', assessment.reason, { taskId: task.id, ...assessment });
+}

package/src/checks/worker.ts

@@ -0,0 +1,149 @@
+import { spawn } from 'node:child_process';
+import { readFileSync, writeFileSync, renameSync, existsSync } from 'node:fs';
+const request = JSON.parse(readFileSync(process.argv[2]!, 'utf8'));
+const { nonce, command, cwd, deadlineNs, graceMs, cap, parentPid, resultFile, journalFile, cancellationFile } = request;
+// Refuse to launch work unless this process really owns its dedicated POSIX group.
+try {
+  process.kill(-process.pid, 0);
+} catch {
+  process.exit(70);
+}
+writeFileSync(journalFile, JSON.stringify({
+  protocol: 1,
+  pid: process.pid,
+  parentPid,
+  nonce,
+  groupLeader: true
+}), {
+  mode: 0o600
+});
+let out = Buffer.alloc(0);
+let err = Buffer.alloc(0);
+let combined = Buffer.alloc(0);
+let bytes = 0;
+let truncated = false;
+let stopping = false;
+let finished = false;
+let errorCode: string | null = null, errorMessage: string | null = null;
+let exitCode: number | null = null, signal: NodeJS.Signals | null = null;
+const append = (data: Buffer, stderr: boolean) => {
+  bytes = Math.min(Number.MAX_SAFE_INTEGER, bytes + data.length);
+  const retain = (old: Buffer) => {
+    const joined = Buffer.concat([old, data]);
+    if (joined.length > cap) {
+      truncated = true;
+    }
+    return joined.subarray(Math.max(0, joined.length - cap));
+  };
+  combined = retain(combined);
+  if (stderr) {
+    err = retain(err);
+  }
+  else {
+    out = retain(out);
+  }
+};
+const text = (b: Buffer) => {
+  const decoded = Buffer.from(b.toString('utf8'));
+  return decoded.subarray(Math.max(0, decoded.length - cap)).toString('utf8');
+};
+function record(reason: string) {
+  const tmp = resultFile + '.tmp';
+  writeFileSync(tmp, JSON.stringify({
+    protocol: 1,
+    nonce,
+    pid: process.pid,
+    reason,
+    errorCode,
+    errorMessage,
+    exitCode,
+    finishedAtNs: process.hrtime.bigint().toString(),
+    signal,
+    output: text(combined),
+    stdoutTail: text(out),
+    stderrTail: text(err),
+    outputBytes: bytes,
+    outputTruncated: truncated
+  }), {
+    mode: 0o600
+  });
+  renameSync(tmp, resultFile);
+}
+function stop(reason: string) {
+  if (stopping || finished) {
+    return;
+  }
+  stopping = true;
+  try {
+    record(reason);
+  } catch {
+  }
+  try {
+    process.kill(-process.pid, 'SIGTERM');
+  } catch {
+  }
+  setTimeout(() => {
+    try {
+      record(reason);
+    } catch {
+    }
+    process.kill(-process.pid, 'SIGKILL');
+  }, graceMs);
+}
+process.on('SIGTERM', () => stop('cancelled'));
+process.on('SIGINT', () => stop('cancelled'));
+if (process.ppid !== parentPid) {
+  record('parent-exit');
+  process.exit(1);
+}
+const deadline = BigInt(deadlineNs);
+if (cancellationFile && existsSync(cancellationFile)) {
+  record('cancelled');
+  process.exit(1);
+}
+if (process.hrtime.bigint() >= deadline) {
+  record('timeout');
+  process.exit(1);
+}
+const child = spawn('/bin/sh', ['-lc', command], {
+  cwd,
+  env: process.env,
+  stdio: ['ignore', 'pipe', 'pipe']
+});
+child.stdout.on('data', (b: Buffer) => append(b, false));
+child.stderr.on('data', (b: Buffer) => append(b, true));
+const timer = setTimeout(() => stop('timeout'), Math.max(0, Number((deadline - process.hrtime.bigint()) / 1_000_000n)));
+const monitor = setInterval(() => {
+  if (process.ppid !== parentPid) {
+    stop('parent-exit');
+  }
+  else if (cancellationFile && existsSync(cancellationFile)) {
+    stop('cancelled');
+  }
+}, 25);
+child.on('exit', (code, s) => {
+  exitCode = code;
+  signal = s;
+});
+child.on('error', (error: NodeJS.ErrnoException) => {
+  errorCode = error.code ?? 'CHECK_SPAWN_FAILED';
+  errorMessage = error.message.slice(0, 1024);
+  if (stopping || finished) {
+    return;
+  }
+  finished = true;
+  clearTimeout(timer);
+  clearInterval(monitor);
+  record('launch-failed');
+});
+child.on('close', (code, s) => {
+  exitCode = code;
+  signal = s;
+  if (stopping || finished) {
+    return;
+  }
+  finished = true;
+  clearTimeout(timer);
+  clearInterval(monitor);
+  record('exit');
+});

package/src/cli-actions.ts

@@ -0,0 +1,107 @@
+/**
+ * Commands accepted by the packaged CLI. Keeping this registry outside the
+ * executable entry point lets read-only navigation metadata bind an
+ * advertised action to the real CLI surface without importing `cli.ts` and
+ * executing it.
+ */
+const CLI_ACTIONS_LITERAL = {
+  gateway: ['handshake'],
+  change: ['explain'],
+  update: [
+    'preflight',
+    'navigation-source-preflight',
+    'navigation-transport-preflight',
+    'navigation-recover',
+    'dependency-provenance-preflight',
+    'dependency-provenance-recover',
+    'historical-step-dependency-preflight',
+    'historical-step-dependency-recover',
+    'downstream-proof-dependency-preflight',
+    'downstream-proof-dependency-recover',
+  ],
+  delegation: ['prepare', 'grant', 'list', 'show', 'revoke'],
+  'project-memory': ['scan', 'show', 'status', 'approve', 'reconcile'],
+  state: ['migrate', 'adoption-prepare', 'adoption-apply'],
+  graph: ['prepare', 'status', 'refresh-request', 'bind', 'fallback'],
+  discovery: ['start', 'update', 'show', 'materialize'],
+  task: [
+    'show',
+    'replacement-materialize',
+    'preexecution-replan',
+    'plan-set',
+    'knowledge-rebind',
+    'context-refresh',
+    'authorize',
+    'plan-risk-audit',
+    'start',
+    'run',
+    'step-complete',
+    'submit',
+    'review-record',
+    'review-launch',
+    'review-packet',
+    'review-sealed-record',
+    'step-review',
+    'step-review-packet',
+    'step-review-record',
+    'corrective-decision-recover',
+    'plan-integrity-recover',
+    'downstream-proof-recover',
+    'corrective-decision',
+    'corrective-yield',
+    'corrective-yield-recover',
+    'corrective-replan-prepare',
+    'corrective-replan-confirm',
+    'corrective-replan-execute',
+    'corrective-replan-recover',
+    'historical-step-provenance-preflight',
+    'historical-step-provenance-recover',
+    'handoff',
+    'handoff-prepare',
+    'handoff-replace',
+    'handoff-show',
+    'claim',
+    'writer-credential-replace',
+    'handback',
+    'handback-create',
+    'result-set',
+    'accept',
+    'sync-base',
+    'merge',
+    'merge-confirm',
+  ],
+  milestone: [
+    'recover',
+    'show',
+    'progress',
+    'plan-set',
+    'remediation-materialize',
+    'scope-change-prepare',
+    'scope-change-apply',
+    'autonomy-prepare',
+    'autonomy-grant',
+    'autonomy-evolve',
+    'authorize',
+    'validate',
+    'accept',
+    'cancel',
+  ],
+  locks: ['inspect', 'repair'],
+} as const;
+
+export const CLI_ACTIONS: Readonly<Record<string, readonly string[]>> = CLI_ACTIONS_LITERAL;
+
+export type CliNoun = keyof typeof CLI_ACTIONS_LITERAL;
+export type CliCommand = {
+  [Noun in CliNoun]: `${Noun} ${typeof CLI_ACTIONS_LITERAL[Noun][number]}`;
+}[CliNoun] | 'doctor' | 'status' | 'next';
+
+export function isCliCommand(command: string): command is CliCommand {
+  if (command === 'doctor' || command === 'status' || command === 'next') return true;
+  const separator = command.indexOf(' ');
+  if (separator < 1) return false;
+  const noun = command.slice(0, separator) as CliNoun;
+  const action = command.slice(separator + 1);
+  const supported = CLI_ACTIONS[noun] as readonly string[] | undefined;
+  return supported?.includes(action) ?? false;
+}