conductor-remote 1.106.3 → 1.108.0

package/dist-node/src/shared.js

@@ -13,8 +13,6 @@
  * Each of these was a second copy before, and each copy was a way for two screens to
  * disagree about the same workspace.
  */
-/** Stable delimiter around the user-authored part of a server-expanded Workflow prompt. */
-export const WORKFLOW_OBJECTIVE_HEADING = '## Workflow objective';
 /**
  * Parse the duration grammar accepted by `conductor-remote nosleep`: `90m`,
  * `2h`, `30s`, or bare seconds. Kept here so the CLI and phone cannot drift.
@@ -28,6 +26,59 @@ export function parseDurationSeconds(raw) {
     const seconds = amount * (unit === 'h' ? 3600 : unit === 'm' ? 60 : 1);
     return Number.isSafeInteger(seconds) ? seconds : null;
 }
+/** Stable delimiter around the user-authored part of a server-expanded Workflow prompt. */
+export const WORKFLOW_OBJECTIVE_HEADING = '## Workflow objective';
+/**
+ * Private orchestration metadata is deliberately recognizable at every relay read
+ * boundary. The model needs this block in its original Conductor context, while the
+ * phone, search index, transcript attachments, logs, and MCP reads must never repeat
+ * it. Keep one versioned marker rather than teaching each consumer about individual
+ * fields as the state machine grows.
+ */
+export const WORKFLOW_PRIVATE_ENVELOPE_VERSION = 1;
+export const WORKFLOW_PRIVATE_ENVELOPE_OPEN = `<conductor-remote-workflow-private version="${WORKFLOW_PRIVATE_ENVELOPE_VERSION}">`;
+export const WORKFLOW_PRIVATE_ENVELOPE_CLOSE = '</conductor-remote-workflow-private>';
+export const WORKFLOW_PRIVATE_REDACTION = '[Workflow orchestration metadata hidden]';
+/** Prefix on the random 256-bit bearer values issued by the Workflow coordinator. */
+export const WORKFLOW_CAPABILITY_PREFIX = `crwf_v${WORKFLOW_PRIVATE_ENVELOPE_VERSION}_`;
+/**
+ * Add a non-secret version prefix to 32 bytes of base64url entropy. Besides making
+ * accidental disclosure recognizable, the prefix lets a future protocol rotate its
+ * scrub rule without treating arbitrary long identifiers as capabilities.
+ */
+export function workflowCapabilityToken(base64urlEntropy) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(base64urlEntropy)) {
+        throw new Error('Workflow capability entropy must be 32 bytes encoded as base64url.');
+    }
+    return `${WORKFLOW_CAPABILITY_PREFIX}${base64urlEntropy}`;
+}
+/** The opaque, machine-readable block delivered only into the root model's context. */
+export function workflowPrivateEnvelope(value) {
+    return [
+        WORKFLOW_PRIVATE_ENVELOPE_OPEN,
+        JSON.stringify({
+            workflow_id: value.workflowId,
+            phase_capability: value.phaseCapability,
+            cycle: value.cycle,
+            revision: value.revision,
+            allowed_roles: [...value.allowedRoles]
+        }),
+        WORKFLOW_PRIVATE_ENVELOPE_CLOSE
+    ].join('\n');
+}
+/**
+ * Remove Workflow bearer material from anything leaving the relay's private
+ * orchestration boundary. An unterminated opening marker consumes the rest of the
+ * string: losing display text is safer than exposing a capability after a truncated
+ * database row or error. The loose-token pass also covers rendered tool arguments,
+ * where the model necessarily repeats the capability outside its original envelope.
+ */
+export function scrubWorkflowSecrets(text) {
+    return text
+        .replace(/<conductor-remote-workflow-private\b[^>]*>[\s\S]*?<\/conductor-remote-workflow-private>/gi, WORKFLOW_PRIVATE_REDACTION)
+        .replace(/<conductor-remote-workflow-private\b[^>]*>[\s\S]*$/gi, WORKFLOW_PRIVATE_REDACTION)
+        .replace(/(^|[^A-Za-z0-9_-])crwf_v\d+_[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g, '$1[Workflow capability hidden]');
+}
 /**
  * The branch minus its prefix, sentence-cased — Conductor's own fallback title while a
  * workspace is still in progress. Prefix-agnostic (github_username / custom / none): it
@@ -209,6 +260,25 @@ export function modelCatalogIncludes(model, groups) {
     const wanted = modelPickerLabel(model);
     return groups.some(group => group.models.some(candidate => modelPickerLabel(candidate) === wanted));
 }
+/**
+ * Complete picker reads are whole-menu observations, not provider slices. Ignore
+ * groups learned only from a successful single-model selection, then use the
+ * newest complete observation to describe what Conductor can select.
+ */
+export function newestModelSnapshot(groups) {
+    let newest = null;
+    for (const group of groups) {
+        if (!group.models.some(model => modelPickerLabel(model).trim()))
+            continue;
+        if (group.snapshotAt === null)
+            continue;
+        const observedAt = group.snapshotAt ?? group.updatedAt;
+        const newestObservedAt = newest ? (newest.snapshotAt ?? newest.updatedAt) : -1;
+        if (!newest || observedAt >= newestObservedAt)
+            newest = group;
+    }
+    return newest;
+}
 /** Stable, case-insensitive grouping shared by every model selector. */
 export function groupModelPickerLabels(models) {
     const grouped = new Map();
@@ -419,6 +489,13 @@ export function isLockedError(error) {
 export function withoutWindowEvidence(error) {
     return error.replace(/\s*\[window server:.*$/s, '').trim();
 }
+/**
+ * Only diagnostic-bearing wire fields lose the AX/window-server tail. Relay log
+ * entries use `text`, so they retain the evidence the phone's log viewer needs.
+ */
+export function withoutClientWindowEvidence(value, field) {
+    return field === 'error' || field === 'message' || field === 'reason' ? withoutWindowEvidence(value) : value;
+}
 /**
  * Header naming the push device that sent a request, so the relay can tell which chat
  * that device has on screen and skip notifying it about that one chat (src/notify.ts).

package/dist-node/src/transcript.js

@@ -8,9 +8,19 @@
  * tool_result blocks, never the user's own words. Real prompts are the
  * plain-text rows. Never render an SDK user frame as a user bubble.
  */
-import { isToolResult } from "./shared.js";
+import { isToolResult, scrubWorkflowSecrets } from "./shared.js";
 const clip = (s, n) => (s.length > n ? `${s.slice(0, n)}…` : s);
 const str = (v) => (typeof v === 'string' && v.trim() ? v.trim() : undefined);
+/** One exit for every human-readable string parseMessage can expose. */
+function scrubEntry(entry) {
+    const scrubbed = { ...entry };
+    for (const key of ['text', 'detail', 'output', 'subagentLabel', 'tool']) {
+        const value = scrubbed[key];
+        if (typeof value === 'string')
+            scrubbed[key] = scrubWorkflowSecrets(value);
+    }
+    return scrubbed;
+}
 /**
  * Turn Conductor's outbox payload into the same user entry its eventual
  * `session_messages` row will become. Outbox rows have no transcript rowid yet;
@@ -32,7 +42,7 @@ export function parseOutboxMessage(row) {
         id: row.message_id,
         rowid: 0,
         role: 'user',
-        text,
+        text: scrubWorkflowSecrets(text),
         ts: row.created_at,
         queued: true
     };
@@ -198,14 +208,14 @@ export function parseMessage(row, worktree = null) {
     if (!content.startsWith('{')) {
         if (!content.trim())
             return [];
-        return [{ ...base, id: row.id, role: 'user', text: content }];
+        return [scrubEntry({ ...base, id: row.id, role: 'user', text: content })];
     }
     let parsed;
     try {
         parsed = JSON.parse(content);
     }
     catch {
-        return [{ ...base, id: row.id, role: 'system', text: clip(content, 200) }];
+        return [scrubEntry({ ...base, id: row.id, role: 'system', text: clip(content, 200) })];
     }
     const parentToolUseId = str(parsed.parent_tool_use_id);
     const frameBase = { ...base, ...(parentToolUseId ? { parentToolUseId } : {}) };
@@ -221,17 +231,17 @@ export function parseMessage(row, worktree = null) {
     if (parsed.type === 'error') {
         const said = str(parsed.content);
         if (said)
-            return [{ ...frameBase, id: row.id, role: 'system', text: clip(said, 200) }];
+            return [scrubEntry({ ...frameBase, id: row.id, role: 'system', text: clip(said, 200) })];
     }
     const blocks = parsed.message?.content;
     if (!Array.isArray(blocks)) {
         if (parsed.type === 'user' || parsed.type === 'assistant')
             return [];
         // Unknown frame shape — keep a dim raw dump so Conductor drift stays visible.
-        return [{ ...frameBase, id: row.id, role: 'system', text: clip(content, 200) }];
+        return [scrubEntry({ ...frameBase, id: row.id, role: 'system', text: clip(content, 200) })];
     }
     const entries = [];
-    const push = (e) => entries.push({ ...frameBase, ...e, id: `${row.id}:${entries.length}` });
+    const push = (e) => entries.push(scrubEntry({ ...frameBase, ...e, id: `${row.id}:${entries.length}` }));
     // Images are numbered per row, because that is all a reference needs to find one again
     // (`toolImageAt`) and a row may hold several results.
     let imageIndex = 0;
@@ -308,8 +318,8 @@ const HEADINGS = {
 /** One tool row per line, the shape `read_chat` prints: what it did, then what it did it to. */
 function toolLine(e) {
     if (e.error)
-        return `- [error] ${e.text}`;
-    return `- [${e.tool ?? 'tool'}] ${e.text}${e.detail ? ` — \`${e.detail}\`` : ''}`;
+        return `- [error] ${scrubWorkflowSecrets(e.text)}`;
+    return `- [${scrubWorkflowSecrets(e.tool ?? 'tool')}] ${scrubWorkflowSecrets(e.text)}${e.detail ? ` — \`${scrubWorkflowSecrets(e.detail)}\`` : ''}`;
 }
 function plural(n, one) {
     return `${n} ${one}${n === 1 ? '' : 's'}`;
@@ -406,7 +416,7 @@ export function renderTranscript(entries, format) {
             heading = want;
         }
         flushElisions();
-        out.push(e.role === 'tool' ? toolLine(e) : e.text);
+        out.push(e.role === 'tool' ? toolLine(e) : scrubWorkflowSecrets(e.text));
         kept++;
     }
     // Anything dropped after the last kept entry still has to be admitted to.

package/dist-node/src/ui-lease-watchdog.js

@@ -0,0 +1,94 @@
+import { processIdentityAlive, terminateRecordedProcessGroup } from "./relay-processes.js";
+const DEFAULT_SETTLE_MS = 750;
+const DEFAULT_RECOVERY_LEASE_MS = 10_000;
+function probeAlive(probe, identity) {
+    try {
+        return probe(identity);
+    }
+    catch {
+        // A failed inspection cannot prove that a process is gone.
+        return true;
+    }
+}
+function sameRelay(left, right) {
+    return (left.instanceId === right.instanceId &&
+        left.pid === right.pid &&
+        left.processStartedAt === right.processStartedAt &&
+        left.protocolVersion === right.protocolVersion);
+}
+function recordedGroup(identity) {
+    if (identity.processGroup === undefined)
+        return undefined;
+    return { pid: identity.pid, processStartedAt: identity.processStartedAt, processGroup: identity.processGroup };
+}
+/**
+ * Recover one expired process-shared UI lease without ever using time as proof
+ * that its owner or detached helper is dead.
+ *
+ * A live owner is never stolen. This relay may terminate its own overdue helper,
+ * while a successor may terminate a proven helper only after the relay owner is
+ * dead. Reclamation then uses the database CAS path, which creates persistent
+ * quarantine for a lease that crossed mayExecute. The temporary recovery lease
+ * is intentionally interactive: it performs no UI work, and this lets it clear a
+ * stale mutex even when that same crash already created the global quarantine.
+ */
+export async function recoverExpiredUiLease(db, relay, options = {}) {
+    const now = options.now ?? Date.now;
+    const probe = options.processProbe ?? processIdentityAlive;
+    const terminate = options.terminateGroup ?? terminateRecordedProcessGroup;
+    const pause = options.sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms)));
+    const settleMs = Math.max(0, Math.floor(options.settleMs ?? DEFAULT_SETTLE_MS));
+    const recoveryLeaseMs = Math.max(1_000, Math.floor(options.recoveryLeaseMs ?? DEFAULT_RECOVERY_LEASE_MS));
+    const observed = db.getUiLeaseOwner();
+    if (!observed)
+        return { status: 'idle' };
+    if (observed.deadlineAt > now())
+        return { status: 'not_expired' };
+    const ownerAlive = probeAlive(probe, observed);
+    const ownedHere = sameRelay(observed, relay);
+    if (ownerAlive && !ownedHere)
+        return { status: 'owner_alive', owner: observed };
+    let terminatedExternal = false;
+    if (observed.externalProcess && probeAlive(probe, observed.externalProcess)) {
+        const group = recordedGroup(observed.externalProcess);
+        if (!group || !(await terminate(group, options.terminateOptions))) {
+            return { status: 'external_process_alive', owner: observed };
+        }
+        terminatedExternal = true;
+    }
+    // The live owning relay will observe its helper's exit, reconcile the effect,
+    // and release its own nonce. A watchdog must never steal even from itself.
+    if (ownerAlive) {
+        if (terminatedExternal && settleMs > 0)
+            await pause(settleMs);
+        return terminatedExternal
+            ? { status: 'owned_external_terminated', owner: observed }
+            : { status: 'owner_alive', owner: observed };
+    }
+    // An external action can outlive its wrapper by a short interval. Delay the
+    // receipt decision, but retain the old mutex throughout this window.
+    if (observed.mayExecute && settleMs > 0)
+        await pause(settleMs);
+    const acquired = db.acquireUiLease({
+        owner: relay,
+        actionId: `ui-recovery:${observed.nonce}`,
+        deadlineAt: now() + recoveryLeaseMs,
+        priority: 'interactive'
+    });
+    if (acquired.status !== 'acquired') {
+        return { status: 'changed', owner: observed };
+    }
+    try {
+        const quarantine = db.getUiQuarantine();
+        return {
+            status: 'reclaimed',
+            owner: observed,
+            quarantined: quarantine.active &&
+                (quarantine.actionId === observed.actionId ||
+                    (observed.effectId !== undefined && quarantine.effectId === observed.effectId))
+        };
+    }
+    finally {
+        db.releaseUiLease(acquired.lease);
+    }
+}