conductor-remote 1.125.0 → 1.126.0

package/dist-node/src/orchestration/workflow/blocked.js

@@ -0,0 +1,93 @@
+import { scrubWorkflowSecrets, withoutWindowEvidence } from "../../shared.js";
+import { withUiPriority } from "../../writes/ui-lock.js";
+import { errorMessage } from "./helpers.js";
+export function workflowBlockMessage(notice, workspace) {
+    return withoutWindowEvidence(scrubWorkflowSecrets([
+        `Workflow paused in ${workspace} during ${notice.run.blocked?.resumePhase.replaceAll('_', ' ')}: ${notice.action}.`,
+        notice.run.blocked?.message,
+        `On your phone: ${notice.recovery}.`
+    ]
+        .filter(Boolean)
+        .join('\n\n')));
+}
+function blockedAction(context, run) {
+    const actionId = run.blocked?.actionId ?? '';
+    const kind = context.db.getWorkflowEffect(run.id, actionId)?.kind;
+    if (kind)
+        return ({
+            create_workspace: 'create the workspace',
+            configure_root: 'apply the planning settings',
+            send_root: 'send the objective to the planner',
+            open_child: 'open a helper chat',
+            configure_child: 'apply the helper settings',
+            send_task: 'send the helper assignment',
+            return_baton: 'return the helper result',
+            authorize_phase: 'deliver the next phase authorization'
+        }[kind] ?? 'advance the Workflow');
+    if (actionId.startsWith('compatibility:'))
+        return 'check relay compatibility';
+    if (actionId.startsWith('job:'))
+        return 'read the helper result';
+    if (actionId === 'bind-root')
+        return 'identify the planning chat';
+    return 'advance the Workflow';
+}
+/** Notifications are best effort, with a durable claim before each external send. */
+export async function notifyBlockedRun(context, run) {
+    if (run.phase !== 'blocked' || !run.blocked)
+        return;
+    const event = context.db.listWorkflowEvents(run.id).findLast(event => event.type === 'workflow_blocked');
+    if (!event)
+        return;
+    const eventId = event.id;
+    const notice = {
+        run,
+        eventId,
+        action: blockedAction(context, run),
+        recovery: run.blocked.retryClass === 'deterministic'
+            ? 'Retry saved action or Cancel'
+            : run.blocked.retryClass === 'ambiguous'
+                ? 'Review risky replay or Cancel'
+                : 'Cancel this run'
+    };
+    async function attempt(channel, send) {
+        const eventKey = `block-${channel}:${eventId}`;
+        const claimed = context.db.idempotentMutation('workflow_block_notice', `${run.id}:${eventKey}`, { eventId, channel }, () => {
+            context.db.recordWorkflowObservation({
+                runId: run.id,
+                eventKey,
+                type: 'workflow_block_notice_claimed',
+                data: { channel, eventId }
+            });
+            return { runId: run.id };
+        });
+        if (claimed.replayed)
+            return;
+        try {
+            await send();
+        }
+        catch (error) {
+            context.db.recordWorkflowObservation({
+                runId: run.id,
+                eventKey: `${eventKey}:failed`,
+                type: 'workflow_block_notice_failed',
+                data: { channel, message: errorMessage(error) }
+            });
+            console.warn(`[workflow ${run.id}] ${channel} block notice failed: ${errorMessage(error)}`);
+        }
+    }
+    if (context.deps.notifyBlocked)
+        await attempt('push', () => context.deps.notifyBlocked(notice));
+    // A notice would make an unprompted root non-pristine and prevent its retry.
+    const canSendRoot = run.rootSessionId &&
+        !['creating_workspace', 'binding_root', 'pending_root'].includes(run.blocked.resumePhase) &&
+        run.blocked.errorCode !== 'workflow_root_not_pristine' &&
+        run.blocked.errorCode !== 'workflow_not_found';
+    if (!canSendRoot || !context.deps.sendBlockedNotice)
+        return;
+    await attempt('root', async () => {
+        if (context.db.getUiQuarantine().active)
+            return;
+        await withUiPriority('background', () => context.deps.sendBlockedNotice(notice));
+    });
+}

package/dist-node/src/orchestration/workflow/compatibility.js

@@ -0,0 +1,42 @@
+import { randomUUID } from 'node:crypto';
+import { errorMessage } from "./helpers.js";
+import { blockRun } from "./state.js";
+const MAX_COMPATIBILITY_READ_FAILURES = 3;
+function failuresSinceRecovery(context, runId) {
+    let count = 0;
+    for (const event of context.db.listWorkflowEvents(runId)) {
+        if (event.type === 'workflow_compatibility_read_failed')
+            count++;
+        if (event.type === 'workflow_compatibility_read_recovered' || event.type === 'workflow_retry_accepted')
+            count = 0;
+    }
+    return count;
+}
+/** One failed wake spends one persisted attempt. Nothing else runs on that tick. */
+export function compatibilityReadFailed(context, run, error) {
+    const message = errorMessage(error);
+    context.db.recordWorkflowObservation({
+        runId: run.id,
+        eventKey: `compatibility-read:${randomUUID()}`,
+        type: 'workflow_compatibility_read_failed',
+        data: { message }
+    });
+    if (failuresSinceRecovery(context, run.id) >= MAX_COMPATIBILITY_READ_FAILURES) {
+        blockRun(context, run, {
+            actionId: `compatibility:${run.id}`,
+            errorCode: 'workflow_incompatible_relay',
+            message: `The relay process check failed ${MAX_COMPATIBILITY_READ_FAILURES} consecutive times. ${message}`,
+            retryClass: 'deterministic'
+        });
+    }
+}
+/** Clear the streak only after an entire wake succeeds, including checks at the UI gate. */
+export function compatibilityReadRecovered(context, runId) {
+    if (!failuresSinceRecovery(context, runId))
+        return;
+    context.db.recordWorkflowObservation({
+        runId,
+        eventKey: `compatibility-recovered:${randomUUID()}`,
+        type: 'workflow_compatibility_read_recovered'
+    });
+}

package/dist-node/src/orchestration/workflow/effects.js

@@ -3,7 +3,7 @@ import { workflowCapabilityToken } from "../../shared.js";
 import { withUiDispatchHook, withUiPriority } from "../../writes/ui-lock.js";
 import { hashCapabilityToken, WorkflowTransitionError } from "../persistence/db.js";
 import { quarantineAndBlock } from "./effect-recovery.js";
-import { WorkflowCoordinatorError } from "./errors.js";
+import { WorkflowCompatibilityReadError, WorkflowCoordinatorError, WorkflowRoleVerificationError } from "./errors.js";
 import { cleanUnknown, errorCode, errorMessage, preExecutionRetryClass, sameRelay } from "./helpers.js";
 import { isTerminalWorkflowPhase } from "./machine.js";
 import { assertCompatible, blockRun, effectReadCall, requireEffect, requireRun } from "./state.js";
@@ -176,6 +176,51 @@ export async function reconcileClaimedEffect(context, run, effect, job) {
 export async function failEffect(context, run, actionId, attemptNumber, error, job) {
     let effect = requireEffect(context, run.id, actionId);
     const currentRun = requireRun(context, run.id);
+    if (error instanceof WorkflowCompatibilityReadError &&
+        !isTerminalWorkflowPhase(currentRun.phase) &&
+        !effect.mayExecute) {
+        // The read failed before any external command was released. Settle this
+        // attempt, put the exact intent back, and let the wake budget decide when to pause.
+        const failure = {
+            runId: run.id,
+            actionId,
+            owner: context.relay,
+            attemptNumber,
+            errorCode: error.code,
+            errorMessage: error.message
+        };
+        if (effect.state === 'prepared' && sameRelay(effect.owner, context.relay)) {
+            context.db.markWorkflowEffectFailed(failure);
+        }
+        else if (effect.state === 'dispatched') {
+            context.db.markWorkflowEffectFailedBeforeMayExecute(failure);
+        }
+        if (requireEffect(context, run.id, actionId).state === 'failed') {
+            context.db.retryWorkflowEffect(run.id, actionId, `compatibility-retry:${actionId}:${attemptNumber}`);
+        }
+        throw error;
+    }
+    if (error instanceof WorkflowRoleVerificationError &&
+        effect.state === 'dispatched' &&
+        effect.mayExecute &&
+        (effect.kind === 'configure_root' || effect.kind === 'configure_child')) {
+        effect = context.db.markWorkflowConfigurationRejected({
+            runId: run.id,
+            actionId,
+            owner: context.relay,
+            attemptNumber,
+            errorCode: error.code,
+            errorMessage: error.message,
+            evidence: { applied: true, matched: false }
+        });
+        blockRun(context, currentRun, {
+            actionId,
+            errorCode: error.code,
+            message: error.message,
+            retryClass: 'deterministic'
+        });
+        return { effect, changed: true };
+    }
     if (currentRun.phase === 'cancelled' || currentRun.phase === 'completed') {
         if (effect.state === 'dispatched') {
             if (!effect.mayExecute) {

package/dist-node/src/orchestration/workflow/errors.js

@@ -11,3 +11,17 @@ export class WorkflowCoordinatorError extends Error {
         this.retryable = options.retryable ?? false;
     }
 }
+/** Only raised after the role write has finished successfully and a present chat was read back. */
+export class WorkflowRoleVerificationError extends WorkflowCoordinatorError {
+    constructor() {
+        super('workflow_role_verification_failed', 'Conductor no longer matches every frozen role setting; no fallback was selected.', { retryable: true });
+        this.name = 'WorkflowRoleVerificationError';
+    }
+}
+/** The process inventory could not be read. No incompatible relay was observed. */
+export class WorkflowCompatibilityReadError extends WorkflowCoordinatorError {
+    constructor(message) {
+        super('workflow_incompatible_relay', message, { retryable: true });
+        this.name = 'WorkflowCompatibilityReadError';
+    }
+}

package/dist-node/src/orchestration/workflow/helpers.js

@@ -31,6 +31,8 @@ export function sanitizeChildOutcome(outcome) {
         ? {
             kind: 'success',
             baton: scrubWorkflowSecrets(outcome.baton),
+            ...(outcome.text === undefined ? {} : { text: scrubWorkflowSecrets(outcome.text) }),
+            ...(outcome.assistantRowid === undefined ? {} : { assistantRowid: outcome.assistantRowid }),
             ...(outcome.evidence === undefined ? {} : { evidence: cleanUnknown(outcome.evidence) })
         }
         : {

package/dist-node/src/orchestration/workflow/job-results.js

@@ -4,6 +4,7 @@ import { markReceiptLost } from "./effect-recovery.js";
 import { runDurableEffect } from "./effects.js";
 import { assertDeliveryReceipt, effectGrant, guardJobs, isDeliveryReceipt, messageReceipt, privateCorrelationBlock, sanitizeChildOutcome, workflowEffectCorrelationMarker } from "./helpers.js";
 import { phaseAfterDeliveredBaton } from "./machine.js";
+import { workflowReportReturnText } from "./report.js";
 import { blockRun, effectCall, effectReadCall, requireEffect, requireRun } from "./state.js";
 export async function driveJobOutcome(context, run, job) {
     const outcome = await context.deps.readChildOutcome({ run, job });
@@ -109,6 +110,11 @@ export async function driveJobBaton(context, run, job) {
         // durable root message; accepted outbox rows do not satisfy the barrier.
         if (designatedFinal && !grant)
             return false;
+        // Old outcomes and already-prepared returns keep their original bytes. A new
+        // return freezes its public message before any UI attempt or receipt lookup.
+        const returnText = outcome.text === undefined
+            ? outcome.baton
+            : workflowReportReturnText(job, outcome, await context.deps.materializeReport({ run, job, outcome }));
         effect = context.db.prepareWorkflowEffect({
             id: `${run.id}:${actionId}`,
             runId: run.id,
@@ -117,6 +123,7 @@ export async function driveJobBaton(context, run, job) {
             jobId: job.id,
             target: { sessionId: run.rootSessionId },
             inputs: {
+                returnText,
                 ...(grant ? { grant } : {}),
                 correlationMarker: workflowEffectCorrelationMarker(run.id, actionId)
             },
@@ -126,6 +133,7 @@ export async function driveJobBaton(context, run, job) {
         }).effect;
     }
     const grant = effectGrant(effect) ?? undefined;
+    const savedText = effect.inputs?.returnText ?? outcome.baton;
     let current = effect;
     let changed = false;
     if (effect.state !== 'committed') {
@@ -148,7 +156,7 @@ export async function driveJobBaton(context, run, job) {
                     ...effectCall(run, effect, dispatch, job),
                     job,
                     sessionId: run.rootSessionId,
-                    text: [outcome.baton, envelope, privateCorrelationBlock(run.id, effect.actionId)].filter(Boolean).join('\n\n')
+                    text: [savedText, envelope, privateCorrelationBlock(run.id, effect.actionId)].filter(Boolean).join('\n\n')
                 });
             },
             validate: assertDeliveryReceipt

package/dist-node/src/orchestration/workflow/report.js

@@ -0,0 +1,31 @@
+import { scrubWorkflowSecrets } from "../../shared.js";
+import { chatCursor } from "../../transcript/cursor.js";
+/** Completion freezes the source. Returning a report never reads the child's later turns. */
+export function workflowReportBody(run, job, outcome) {
+    if (!job.childSessionId || outcome.text === undefined)
+        throw new Error('Workflow report source is incomplete');
+    return scrubWorkflowSecrets([
+        `# Workflow ${job.role} report`,
+        '',
+        `Workflow: ${run.id}`,
+        `Workflow job: ${job.id} (${job.logicalKey}, attempt ${job.attemptCount})`,
+        `Child chat: ${job.childSessionId}`,
+        ...(outcome.assistantRowid === undefined ? [] : [`Completion cursor: ${chatCursor(outcome.assistantRowid)}`]),
+        '',
+        outcome.text
+    ].join('\n'));
+}
+export function workflowReportReturnText(job, outcome, token) {
+    if (!job.childSessionId)
+        throw new Error('Workflow report has no child chat');
+    const read = {
+        session_id: job.childSessionId,
+        ...(outcome.assistantRowid === undefined ? {} : { near: chatCursor(outcome.assistantRowid), before: 6, after: 0 })
+    };
+    return scrubWorkflowSecrets([
+        outcome.baton,
+        `Workflow ${job.role} task ${job.logicalKey} completed.`,
+        `Report: ${token}`,
+        `For earlier investigation, use read_chat(${JSON.stringify(read)}).`
+    ].join('\n\n'));
+}

package/dist-node/src/orchestration/workflow/wake.js

@@ -1,5 +1,8 @@
 import { WorkflowTransitionError } from "../persistence/db.js";
+import { notifyBlockedRun } from "./blocked.js";
+import { compatibilityReadFailed, compatibilityReadRecovered } from "./compatibility.js";
 import { markReceiptLost, reconcileBlockedEffect } from "./effect-recovery.js";
+import { WorkflowCompatibilityReadError } from "./errors.js";
 import { cleanUnknown, effectSessionId, errorMessage, isDeliveryReceipt, receiptEventSuffix, sanitizeChildOutcome } from "./helpers.js";
 import { driveNextJob } from "./job-dispatch.js";
 import { advanceDeliveredBarrier } from "./job-results.js";
@@ -16,6 +19,8 @@ export function wake(context, runId) {
 }
 export async function wakeInternal(context, runId) {
     heartbeat(context);
+    let compatibilityFailed = false;
+    let compatibilityChecked = false;
     for (let step = 0; step < MAX_WAKE_STEPS; step++) {
         const run = requireRun(context, runId);
         if (run.phase === 'cancelled') {
@@ -25,14 +30,21 @@ export async function wakeInternal(context, runId) {
         if (run.phase === 'completed')
             break;
         if (run.phase === 'blocked') {
+            await notifyBlockedRun(context, run);
             if (await reconcileBlockedEffect(context, run))
                 continue;
             break;
         }
         try {
             await assertCompatible(context);
+            compatibilityChecked = true;
         }
         catch (error) {
+            compatibilityFailed = true;
+            if (error instanceof WorkflowCompatibilityReadError) {
+                compatibilityReadFailed(context, requireRun(context, runId), error);
+                break;
+            }
             blockRun(context, run, {
                 actionId: `compatibility:${run.id}`,
                 errorCode: 'workflow_incompatible_relay',
@@ -46,6 +58,11 @@ export async function wakeInternal(context, runId) {
             changed = await driveOnce(context, run);
         }
         catch (error) {
+            if (error instanceof WorkflowCompatibilityReadError) {
+                compatibilityFailed = true;
+                compatibilityReadFailed(context, requireRun(context, runId), error);
+                break;
+            }
             if (error instanceof WorkflowTransitionError) {
                 const current = requireRun(context, runId);
                 if (current.phase !== run.phase || current.cancellationGeneration !== run.cancellationGeneration)
@@ -56,6 +73,9 @@ export async function wakeInternal(context, runId) {
         if (!changed)
             break;
     }
+    if (compatibilityChecked && !compatibilityFailed)
+        compatibilityReadRecovered(context, runId);
+    await notifyBlockedRun(context, requireRun(context, runId));
     return projection(context, runId);
 }
 export async function observeCancelledRun(context, run) {

package/dist-node/src/prefs.js

@@ -72,7 +72,8 @@ function sanitizeAttachment(raw) {
         token.length > MAX_ATTACHMENT_TOKEN_LENGTH ||
         !Number.isSafeInteger(bytes) ||
         bytes < 0 ||
-        bytes > MAX_ATTACHMENT_BYTES)
+        // Forks reference an already-written transcript, which can exceed the upload limit.
+        (bytes > MAX_ATTACHMENT_BYTES && value.source !== 'fork'))
         return null;
     const match = attachmentPath.match(/^\.context\/attachments\/([A-Za-z0-9]{6})\/([^/]+)$/);
     if (!match || match[2] !== name || attachmentName(name) !== name || token !== attachmentToken(name, attachmentPath))
@@ -80,7 +81,14 @@ function sanitizeAttachment(raw) {
     const stageId = value.stageId;
     if (stageId !== undefined && (typeof stageId !== 'string' || stageId !== match[1]))
         return null;
-    return { name, path: attachmentPath, bytes, token, ...(stageId ? { stageId } : {}) };
+    return {
+        name,
+        path: attachmentPath,
+        bytes,
+        token,
+        ...(value.source === 'fork' ? { source: 'fork' } : {}),
+        ...(stageId ? { stageId } : {})
+    };
 }
 function sanitizeAttachments(raw) {
     if (!Array.isArray(raw))
@@ -151,6 +159,7 @@ function sameDraft(a, b) {
                 attachment.path === other.path &&
                 attachment.bytes === other.bytes &&
                 attachment.token === other.token &&
+                attachment.source === other.source &&
                 attachment.stageId === other.stageId);
         }) &&
         a.agent.model === b.agent.model &&

package/dist-node/src/shared.js

@@ -387,6 +387,10 @@ export function isVoiceSpeed(value) {
     return typeof value === 'number' && Number.isFinite(value) && value >= 0.25 && value <= 1.5;
 }
 const ATTACHMENT_PREFIX = '.context/attachments/';
+/** Conductor's attachment syntax encodes the whole relative path, including slashes. */
+export function attachmentToken(name, relPath) {
+    return `@⟦${name}⟧(${encodeURIComponent(relPath)})`;
+}
 /**
  * Read Conductor attachment tokens from prompt text.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "conductor-remote",
-	"version": "1.125.0",
+	"version": "1.126.0",
 	"type": "module",
 	"packageManager": "yarn@4.15.0",
 	"description": "Phone control panel for local Conductor agents. Reads ride SQLite + git; prompts ride Conductor's own dispatch path.",