copilot-operator 0.1.2 → 0.1.4

package/README.md

@@ -82,7 +82,11 @@ file run. What `Start-Process` is asked to start is judged like any other progra
 `Invoke-WebRequest`, `Invoke-RestMethod`, `curl`, `wget`, `Start-BitsTransfer`, the .NET web
 clients, `ftp`/`scp`, a package named by URL or git address, `npx` of a tool not installed in the
 project, `docker pull` — is neither refused nor run: it waits on the approval screen, in every
-mode, unattended included, and "run the rest without asking" does not answer it. A check that
+mode, unattended included, and "run the rest without asking" does not answer it. That is the
+default, and the one stop an unattended run still makes; `execution.networkFetch` (Settings →
+Execution) may instead **refuse** it back to the chat with the reason, so the run never waits, or
+**run** it unread on a machine where that is acceptable. The choice applies only to unattended
+runs, and each task's policy manifest records which was in force. A check that
 fetches is refused, since a check runs with nobody asked. Requests to this machine (`localhost`,
 `127.0.0.1`) and the project's own package managers are not held. `npm install` runs with
 `ignore-scripts`: a package's install script is code fetched and executed unread, and it does not
@@ -128,8 +132,14 @@ Six rules decide what a step may do, and each is recorded with the run that it g
 - **Only the declared toolchain runs.** `execution.allowedPrograms` names the programs a command
   may start — the shells, the JavaScript, .NET, Java, Python, Go and Rust tools, `git`, and a few
   Windows utilities. A command that starts anything else is refused and sent back with the reason.
-  An empty list turns the gate off. This is a floor against the unknown binary, not a boundary:
-  allowing `node` allows `node -e`.
+  The programs are read the way PowerShell reads a line (`src/exec/commandHeads.ts`): strings,
+  operators, array values, method arguments and hashtable keys are not programs, and a command in a
+  script block, a subexpression, a string's `$( )` or after an assignment is still found. A line that
+  cannot be read with certainty — an unclosed quote or bracket, a program called through a variable
+  (`& $exe`) — is refused rather than guessed at. `cmd` steps are read by `cmd`'s own rules. A refused
+  step is reported to the chat as refused and never executed, with no exit code, apart from a
+  command that ran and failed. An empty list turns the gate off. This is a floor against the unknown
+  binary, not a boundary: allowing `node` allows `node -e`.
 - **Autonomy is graded.** An unattended run carries strictly more restrictions than a watched one,
   because the thing that makes a watched run safe is a person reading each line. Unattended
   requires a non-empty allowlist, and refuses an allowed program used to evaluate a string

package/dist/src/api/operator.controller.js

@@ -251,7 +251,12 @@ let OperatorController = class OperatorController {
      */
     async exportBundle(res, body) {
         const pairs = (body?.tasks ?? [])
-            .map((x) => ({ sessionId: (x?.sessionId ?? '').trim(), taskId: (x?.taskId ?? '').trim() }))
+            .map((x) => ({
+            sessionId: (x?.sessionId ?? '').trim(),
+            taskId: (x?.taskId ?? '').trim(),
+            // One attempt of the task rather than the task as it is now; see `exportBundle`.
+            ...(Number.isInteger(x?.attempt) ? { attempt: x.attempt } : {}),
+        }))
             .filter((x) => x.sessionId && x.taskId);
         try {
             const { fileName, content } = await this.ops.exportBundle(pairs);

package/dist/src/api/operator.service.js

@@ -23,7 +23,7 @@ import { newId, tidyVcsPlan } from '../session/model.js';
 import { runSession, openBrowser } from '../orchestrator/taskRunner.js';
 import { buildExport } from '../session/exportRecord.js';
 import { buildDebugExport } from '../session/debugExport.js';
-import { buildPlanExport, buildDomainExport, buildBotExport, buildBundleExport, exportFileName } from '../session/exports.js';
+import { buildPlanExport, buildDomainExport, buildBotExport, buildBundleExport, exportFileName, exportMachine, taskAtAttempt, withTask, writeAttemptRecord } from '../session/exports.js';
 import { suggestRunName } from '../session/runName.js';
 import { mirrorAllProjects, removeProjectMirrors, contextRoot } from '../context/desktopMirror.js';
 import { describeMirror } from '../context/projectMirror.js';
@@ -36,7 +36,7 @@ function sameFolder(a, b) {
     return a.trim() !== '' && norm(a) === norm(b);
 }
 import { importPlan, plannedSessionSignature, taskSignature } from '../plan/importPlan.js';
-import { vcsPreflight, restorePreview, restoreToBase, sessionBranches } from '../vcs/taskVcs.js';
+import { commitInterrupted, vcsPreflight, restorePreview, restoreToBase, sessionBranches } from '../vcs/taskVcs.js';
 import { gitAvailable, repoUnusableReason } from '../vcs/git.js';
 import { makeAuthorizer } from '../exec/authorizer.js';
 import { listSelectableDirs, collectFiles, findSelectionConflicts, describeConflicts, DEFAULT_IGNORE_DIRS } from '../context/projectMirror.js';
@@ -81,6 +81,9 @@ let OperatorService = class OperatorService {
                     level: 'warn',
                     message: `"${r.title}" was left unfinished by an earlier run and has been marked aborted`,
                 });
+                // What it had changed goes onto its branch, and its record into its run folder, as a
+                // finished task's would. See `commitInterrupted` and `writeAttemptRecord`.
+                await this.settleRecovered(r.sessionId, r.taskId).catch((e) => console.warn(`[api] could not settle "${r.title}": ${e.message}`));
             }
             if (recovered.length > 0) {
                 console.log(`[api] closed ${recovered.length} task(s) left unfinished by an earlier run`);
@@ -88,6 +91,31 @@ let OperatorService = class OperatorService {
         })();
         return this.ready;
     }
+    /**
+     * Closes the loose ends of one task the previous process left unfinished: commits its work on its
+     * branch, says so on the task, and writes the attempt's plan, work and runner into its run folder.
+     */
+    async settleRecovered(sessionId, taskId) {
+        const session = await this.store.getSession(sessionId);
+        const task = session?.tasks.find((t) => t.id === taskId);
+        if (!session || !task)
+            return;
+        const vcs = await commitInterrupted(session, task, task.reason ?? 'interrupted', this.bus);
+        const settled = vcs?.commit
+            ? await this.store.updateSession(sessionId, (s) => {
+                const t = s.tasks.find((x) => x.id === taskId);
+                if (!t)
+                    return;
+                t.vcs = vcs;
+                t.reason = `${t.reason ?? ''} What it had changed is committed on ${vcs.branch} as ${vcs.commit?.slice(0, 8)}.`.trim();
+            })
+            : session;
+        const ended = settled.tasks.find((t) => t.id === taskId);
+        if (!ended)
+            return;
+        const cfg = await this.settings.load();
+        await writeAttemptRecord(settled, ended, cfg.resolved.runsDir, exportMachine(cfg));
+    }
     /** Runs the startup work now, so it does not wait for the first request. */
     bootstrap() {
         return this.init();
@@ -498,12 +526,7 @@ let OperatorService = class OperatorService {
             ? buildPlanExport(scope)
             : kind === 'domain'
                 ? await buildDomainExport(scope, cfg.resolved.runsDir)
-                : await buildBotExport(scope, cfg.resolved.runsDir, {
-                    node: process.versions.node,
-                    platform: process.platform,
-                    cwd: cfg.resolved.cwd,
-                    limits: { ...cfg.limits, execution: { commandTimeoutSec: cfg.execution.commandTimeoutSec, idleTimeoutSec: cfg.execution.idleTimeoutSec, mode: cfg.execution.mode } },
-                });
+                : await buildBotExport(scope, cfg.resolved.runsDir, exportMachine(cfg));
         return { fileName: exportFileName(kind, scope.label), content: JSON.stringify(document, null, 2) };
     }
     /**
@@ -525,29 +548,39 @@ let OperatorService = class OperatorService {
             set.add(taskId);
             wanted.set(sessionId, set);
         }
+        /*
+         * A pair may name one attempt of its task — the button beside an earlier attempt does. That
+         * task is then exported as it stood for that attempt (`taskAtAttempt`): its text, its outcome,
+         * its run folder, and only the attempts before it.
+         */
         const sessions = [];
         for (const sessionId of wanted.keys()) {
-            const session = await this.store.getSession(sessionId);
-            if (session)
-                sessions.push(session);
+            let session = await this.store.getSession(sessionId);
+            if (!session)
+                continue;
+            for (const pair of pairs.filter((x) => x.sessionId === sessionId && x.attempt !== undefined)) {
+                const task = session.tasks.find((t) => t.id === pair.taskId);
+                const asItWas = task ? taskAtAttempt(task, pair.attempt) : null;
+                if (task && !asItWas)
+                    throw new Error(`"${task.title}" has no attempt ${pair.attempt}.`);
+                if (asItWas)
+                    session = withTask(session, asItWas);
+            }
+            sessions.push(session);
         }
         const found = sessions.flatMap((s) => s.tasks.filter((t) => wanted.get(s.id)?.has(t.id)));
         if (found.length === 0)
             throw new Error('None of the chosen tasks still exists.');
         // Named after what was chosen rather than after a run, because a selection is not a run: it
         // may be one task of one, or a task from each of three.
+        const one = pairs.length === 1 ? pairs[0] : undefined;
         const label = found.length === 1 && sessions.length === 1
-            ? `${sessions[0].name}-${found[0].title}`
+            ? `${sessions[0].name}-${found[0].title}${one?.attempt !== undefined ? `-attempt-${one.attempt}` : ''}`
             : sessions.length === 1
                 ? `${sessions[0].name}-${found.length}-tasks`
                 : `${found.length}-tasks-${sessions.length}-sessions`;
         const cfg = await this.settings.load();
-        const document = await buildBundleExport({ sessions, taskFilter: (s, t) => !!wanted.get(s.id)?.has(t.id), label }, cfg.resolved.runsDir, {
-            node: process.versions.node,
-            platform: process.platform,
-            cwd: cfg.resolved.cwd,
-            limits: { ...cfg.limits, execution: { commandTimeoutSec: cfg.execution.commandTimeoutSec, idleTimeoutSec: cfg.execution.idleTimeoutSec, mode: cfg.execution.mode } },
-        });
+        const document = await buildBundleExport({ sessions, taskFilter: (s, t) => !!wanted.get(s.id)?.has(t.id), label }, cfg.resolved.runsDir, exportMachine(cfg));
         return { fileName: exportFileName('bundle', label), content: JSON.stringify(document, null, 2) };
     }
     // --- running --------------------------------------------------------------------------
@@ -618,6 +651,8 @@ let OperatorService = class OperatorService {
             allowedPrograms: cfg.execution.allowedPrograms,
             isolation: cfg.execution.isolation,
             lockedToConfirm: cfg.policyLock?.maxMode === 'confirm',
+            // Read once per run like the rest of the policy: a change in Settings applies from the next start.
+            networkFetch: cfg.execution.networkFetch,
         };
         /*
          * An unattended run that cannot legally execute anything is stopped here, where the operator
@@ -716,7 +751,7 @@ let OperatorService = class OperatorService {
         r.controller.abort();
         for (const [id, w] of this.waiting) {
             if (w.approval.sessionId === sessionId) {
-                w.resolve({ action: 'abort', reason: 'stopped by the operator' });
+                w.resolve({ action: 'abort', reason: 'stopped by the operator', by: 'operator' });
                 this.waiting.delete(id);
             }
         }
@@ -1273,8 +1308,8 @@ let OperatorService = class OperatorService {
         const decision = action === 'run' || action === 'run-all'
             ? { action: 'run' }
             : action === 'skip'
-                ? { action: 'skip', reason: 'skipped by the operator' }
-                : { action: 'abort', reason: 'aborted by the operator' };
+                ? { action: 'skip', reason: 'skipped by the operator', by: 'operator' }
+                : { action: 'abort', reason: 'aborted by the operator', by: 'operator' };
         w.resolve(decision);
         this.bus.publish({ sessionId: w.approval.sessionId, taskId: w.approval.taskId, type: 'approval-decided', level: 'info',
             message: `step ${w.approval.stepId}: ${action}`, data: { approvalId, action } });
@@ -1357,7 +1392,7 @@ let OperatorService = class OperatorService {
                 ...(held ? { network: held.network } : {}),
             };
             if (signal.aborted) {
-                resolvePromise({ action: 'abort', reason: 'stopped by the operator' });
+                resolvePromise({ action: 'abort', reason: 'stopped by the operator', by: 'operator' });
                 return;
             }
             this.waiting.set(approval.id, { approval, resolve: resolvePromise });

package/dist/src/cli.js

@@ -484,6 +484,7 @@ program
         allowedPrograms: cfg.execution.allowedPrograms,
         isolation: cfg.execution.isolation,
         lockedToConfirm: cfg.policyLock?.maxMode === 'confirm',
+        networkFetch: cfg.execution.networkFetch,
     };
     const authorizer = cfg.execution.mode === 'unattended'
         ? unattendedAuthorizer(policy)

package/dist/src/config/schema.js

@@ -117,7 +117,32 @@ export const RunConfigSchema = z.object({
     task: TextOrFile.optional(),
     execution: z
         .object({
+        /*
+         * For the terminal, the mode `cop run` uses without `--unattended`. For the API it is the
+         * operator's standing choice from Settings: `unattended` means an unattended start is not
+         * questioned again with "are you sure" — they said so once, on the Settings page, and asking
+         * at every press is exactly the interruption they switched off. Every start still names its
+         * own mode; this never turns a step-by-step press into an unattended run.
+         */
         mode: z.enum(['confirm', 'unattended']).default('confirm'),
+        /**
+         * What an unattended run does with a step that fetches from the network. See `network.ts`.
+         *
+         *   ask     it waits on the approval screen for the operator, as it did before this setting
+         *           existed — the one question an unattended run still asks.
+         *   refuse  it is not run, and the chat is told why at once and what to do instead, so the
+         *           run never stops to wait for anybody. The terminal's unattended form has always
+         *           done this, because it has nobody to ask.
+         *   run     it runs like every other step, with nobody having read it.
+         *
+         * `ask` is the default because the hold exists for a reason — a security team found
+         * model-written steps staging and running code on a work laptop — and a run that can fetch
+         * and then execute what arrived, unread, is the thing it was built to prevent. `run` is the
+         * operator's to choose on a machine where that is acceptable, and it is recorded in every
+         * task's policy manifest as exactly that. A step-by-step run is unaffected: every step
+         * there, a fetch included, is put in front of a person anyway.
+         */
+        networkFetch: z.enum(['ask', 'refuse', 'run']).default('ask'),
         /**
          * The shell a step or a check runs in when it names none of its own.
          *

package/dist/src/exec/authorizer.js

@@ -6,11 +6,14 @@ import { stdin, stdout } from 'node:process';
 /**
  * Runs the static rules, then, unless unattended, asks the human through `ask`.
  *
- * A step that fetches from the network is the exception to "unless unattended": it is asked about
- * in every mode, with `held` saying why, because the runs nobody is watching are exactly the ones
- * in which a download followed by a second step that runs it would otherwise go unseen. `cfg` is
- * read on every call, not captured, so a run switched to unattended half-way is judged as one from
- * its next step on.
+ * A step that fetches from the network is the exception to "unless unattended": by default it is
+ * asked about in every mode, with `held` saying why, because the runs nobody is watching are
+ * exactly the ones in which a download followed by a second step that runs it would otherwise go
+ * unseen. The operator may choose otherwise for unattended runs (`cfg.networkFetch`): `refuse`
+ * answers the chat at once instead of waiting for anybody, `run` treats the fetch like any other
+ * step. Only for unattended runs — a watched run shows the fetch like every other step, and the
+ * person reading it is the whole point of watching. `cfg` is read on every call, not captured, so
+ * a run switched to unattended half-way is judged as one from its next step on.
  */
 export function makeAuthorizer(cfg, ask) {
     return {
@@ -20,8 +23,13 @@ export function makeAuthorizer(cfg, ask) {
                 return blocked;
             const cwd = ctx.confinement?.cwd;
             const network = networkFetchReason(step.cmd, cwd) ?? (cwd ? scriptNetworkReason(step.cmd, cwd) : null);
-            if (network)
+            if (network) {
+                if (cfg.mode === 'unattended' && cfg.networkFetch === 'refuse')
+                    return { action: 'skip', reason: networkFetchRefusal(network) };
+                if (cfg.mode === 'unattended' && cfg.networkFetch === 'run')
+                    return { action: 'run' };
                 return await ask(step, ctx, { network });
+            }
             if (cfg.mode === 'unattended')
                 return { action: 'run' };
             return await ask(step, ctx);
@@ -39,9 +47,9 @@ export function terminalAuthorizer(cfg, print) {
         try {
             const answer = (await rl.question('  [Enter] run  [s] skip  [q] abort > ')).trim().toLowerCase();
             if (answer === 'q')
-                return { action: 'abort', reason: 'aborted by the operator' };
+                return { action: 'abort', reason: 'aborted by the operator', by: 'operator' };
             if (answer === 's')
-                return { action: 'skip', reason: 'skipped by the operator' };
+                return { action: 'skip', reason: 'skipped by the operator', by: 'operator' };
             return { action: 'run' };
         }
         finally {
@@ -53,8 +61,10 @@ export function terminalAuthorizer(cfg, print) {
  * Everything runs after the static rules. Only for runs the user explicitly marked so.
  *
  * A step held for a person (a network fetch) is refused here, with the reason, because this form
- * has nobody to ask. The web UI does not use it: its unattended runs keep the approval screen for
- * exactly those steps.
+ * has nobody to ask — `ask` and `refuse` come to the same thing at a terminal nobody is at. Only
+ * `networkFetch: run` lets one through, and that is decided in `makeAuthorizer` before this is
+ * reached. The web UI does not use it: its unattended runs keep the approval screen for exactly
+ * those steps.
  */
 export function unattendedAuthorizer(cfg) {
     return makeAuthorizer({ ...cfg, mode: 'unattended' }, async (_step, _ctx, held) => held ? { action: 'skip', reason: networkFetchRefusal(held.network) } : { action: 'run' });