copilot-operator 0.1.3 → 0.1.5

package/dist/src/exec/policy.js

@@ -92,7 +92,7 @@ confinement) {
     // The allowlist after the known-bad floor and the operator's deny list, so their precise
     // messages win, and this catches the long tail neither of them was ever going to enumerate: a
     // program that is simply not part of this project's toolchain. See `programs.ts`.
-    const offlist = programRefusal(command, allowedPrograms);
+    const offlist = programRefusal(command, allowedPrograms, shell);
     if (offlist)
         return offlist;
     const trap = findShellExecuteTrap(command, shell, env);

package/dist/src/exec/programs.js

@@ -29,6 +29,7 @@
  * before this existed starts failing on an upgrade.
  */
 import { extname } from 'node:path';
+import { scanCommandHeads } from './commandHeads.js';
 /**
  * Windows executable extensions. A token carrying one of these names a program by file, whatever
  * the stem, so it is always checked; a token with any other extension (`config.json`, `app.ts`)
@@ -55,6 +56,7 @@ const SHELL_WORDS = new Set([
     'gi', 'gp', 'sp', 'si', 'gm', 'gu', 'gv', 'sv', 'select', 'where', 'foreach-object', 'where-object',
     'sort', 'group', 'measure', 'ft', 'fl', 'fw', 'fh', 'oh', 'out-host', 'tee',
     'sls', 'gcm', 'gmo', 'ipmo', 'man', 'help', 'more', 'h', 'history', 'r',
+    '%', '?', // ForEach-Object and Where-Object, as `ls | % { $_.Name }` writes them
     'gsv', 'gps', 'ps', 'kill', 'sleep', 'start', 'saps', 'spps', 'sasv', 'spsv',
     'iwr', 'irm', 'wget', 'curl', // PowerShell aliases for Invoke-WebRequest/Invoke-RestMethod; the raw .exe forms are allowlisted by name if wanted, and iwr|iex is caught by dangerous.ts
     // cmd built-ins
@@ -62,87 +64,13 @@ const SHELL_WORDS = new Set([
     'pushd', 'popd', 'ver', 'vol', 'date', 'time', 'exist', 'not', 'defined', 'errorlevel',
 ]);
 /**
- * The heads of every statement in a command line: the first token after the start and after each
- * separator that begins a new command (`|`, `;`, `&`, `&&`, `||`, a newline, a `(` sub-expression
- * or a `{` script block). Quote- and depth-aware so a separator inside `'...'`, `"..."` or an
- * argument list does not split a statement, and a back-tick before a newline continues it.
- *
- * Best effort by design. The point is to find the programs a line would obviously start, not to
- * be a PowerShell parser; a construction it cannot read yields no head for that fragment, and the
- * fragment then rests on `dangerous.ts` and the human, which is where the honest limit was always
- * going to be anyway.
+ * The name at the head of every command a line invokes. Read by `commandHeads.ts`, which follows
+ * PowerShell's command and expression modes (or `cmd`'s rules for a `cmd` step), so strings,
+ * operators, array values, method arguments and hashtable keys are not mistaken for programs, and
+ * a command nested in a script block, a subexpression or after an assignment is not missed.
  */
-export function commandHeads(command) {
-    const heads = [];
-    const boundaries = new Set(['|', ';', '&', '\n', '(', '{']);
-    let expectStart = true;
-    let quote = null;
-    let i = 0;
-    const readToken = (from) => {
-        let j = from;
-        let text = '';
-        let q = null;
-        while (j < command.length) {
-            const ch = command[j];
-            if (q) {
-                if (ch === q)
-                    q = null;
-                else
-                    text += ch;
-                j += 1;
-                continue;
-            }
-            if (ch === "'" || ch === '"') {
-                q = ch;
-                j += 1;
-                continue;
-            }
-            if (/\s/.test(ch) || boundaries.has(ch) || ch === ')' || ch === '}')
-                break;
-            text += ch;
-            j += 1;
-        }
-        return { text, end: j };
-    };
-    while (i < command.length) {
-        const ch = command[i];
-        if (quote) {
-            if (ch === quote)
-                quote = null;
-            i += 1;
-            continue;
-        }
-        if (ch === "'" || ch === '"') {
-            quote = ch;
-            i += 1;
-            continue;
-        }
-        if (expectStart && !/\s/.test(ch) && !boundaries.has(ch) && ch !== ')' && ch !== '}') {
-            const { text, end } = readToken(i);
-            i = end;
-            // A dot-source — `. .\script.ps1` — runs the file that follows in the current scope. The
-            // dot is not what runs; the next token is, and it is the one the allowlist has to see.
-            // (`& .\script.ps1` already works this way because `&` is a boundary.)
-            if (text === '.')
-                continue;
-            if (text)
-                heads.push(text);
-            expectStart = false;
-            continue;
-        }
-        if (boundaries.has(ch)) {
-            // A back-tick immediately before a newline is a line continuation, not a new statement.
-            if (ch === '\n' && command[i - 1] === '`') {
-                i += 1;
-                continue;
-            }
-            expectStart = true;
-            i += 1;
-            continue;
-        }
-        i += 1;
-    }
-    return heads;
+export function commandHeads(command, shell) {
+    return scanCommandHeads(command, shell).heads;
 }
 /**
  * The external-program name a statement head invokes, normalised for the allowlist, or null when
@@ -273,12 +201,24 @@ export function inlineCodeRefusal(command) {
  * is a legitimate tool this project happens to need, and the fix is one line of config — not a
  * reason to weaken the gate for everyone.
  */
-export function programRefusal(command, allowedPrograms) {
+export function programRefusal(command, allowedPrograms, shell = 'pwsh') {
     if (!allowedPrograms || allowedPrograms.length === 0)
         return null;
     const allowed = new Set(allowedPrograms.map((p) => p.trim().toLowerCase().replace(/\.(exe|com|bat|cmd|ps1|msi)$/i, '')).filter(Boolean));
+    /*
+     * Fail-closed: a line that cannot be read with certainty is a line whose programs are not known,
+     * and an allowlist that cannot name the programs has nothing to check them against. What makes
+     * a line uncertain — an unclosed string or bracket, a program chosen through a variable — is
+     * never needed by honest work, so refusing it costs a rewrite and guessing could cost the gate.
+     */
+    const scan = scanCommandHeads(command, shell);
+    if (scan.uncertain) {
+        return (`refused: the runner could not tell which programs this line starts (${scan.uncertain}). ` +
+            'Write it so every program is named literally — close each quote and bracket, and call a program by its ' +
+            'name or a literal path rather than through a variable or an expression.');
+    }
     // What `Start-Process` is asked to start is a program this line starts, as much as a head is.
-    for (const head of [...commandHeads(command), ...startProcessTargets(command)]) {
+    for (const head of [...scan.heads, ...startProcessTargets(command)]) {
         const program = externalProgram(head);
         if (program && !allowed.has(program)) {
             return (`refused: "${program}" is not in execution.allowedPrograms. This machine runs only the project's ` +

package/dist/src/exec/reportFile.js

@@ -42,8 +42,11 @@ export function clip(text, maxChars) {
     return `${text.slice(0, half)}\n\n[... ${dropped} characters omitted ...]\n\n${text.slice(-half)}`;
 }
 function sectionFor(r, maxOutputChars) {
-    const head = `--- step ${r.id} (${r.shell}, ${r.outcome}, exit ${r.exitCode}, ` +
-        `${(r.durationMs / 1000).toFixed(1)}s)\n$ ${r.command}\n`;
+    // A refused step never ran, so it is not given an exit code or a duration that could be read as
+    // a command that ran and failed; the header says what happened instead.
+    const head = r.outcome === 'refused'
+        ? `--- step ${r.id} (${r.shell}, REFUSED by the runner, never executed, no exit code)\n$ ${r.command}\n`
+        : `--- step ${r.id} (${r.shell}, ${r.outcome}, exit ${r.exitCode}, ` + `${(r.durationMs / 1000).toFixed(1)}s)\n$ ${r.command}\n`;
     const out = clip(r.stdout, maxOutputChars);
     const err = r.stderr.trim().length > 0 ? `[stderr]\n${clip(r.stderr, maxOutputChars)}\n` : '';
     const note = r.truncated ? `[note] output was truncated; the full stream is in ${r.logPath}\n` : '';

package/dist/src/orchestrator/review.js

@@ -426,7 +426,7 @@ ${machineNote}` : contract);
                     confinement: { roots: deps.roots, cwd: deps.cwd },
                 });
                 if (decision.action !== 'run') {
-                    results.push(refused(step.id, decision.reason, step.cmd, step.shell));
+                    results.push(refused(step.id, decision.reason, step.cmd, step.shell, decision.by === 'operator' ? 'operator' : 'runner'));
                     if (decision.action === 'abort')
                         break;
                     continue;
@@ -525,7 +525,7 @@ export function refusedChecksMessage(refused) {
     ].join('\n');
 }
 /** A step the review did not run, in the shape the reporter expects. */
-function refused(id, reason, command = '(not run)', requested) {
+function refused(id, reason, command = '(not run)', requested, by = 'runner') {
     return {
         id,
         // The shell it would have run in, rather than the one this file used to name: a report line
@@ -537,7 +537,8 @@ function refused(id, reason, command = '(not run)', requested) {
         requestedShell: requested ?? null,
         command,
         exitCode: -4,
-        outcome: 'aborted',
+        // Who declined it, as in `refusedResult` in the task runner: a rule, or a person.
+        outcome: by === 'operator' ? 'aborted' : 'refused',
         durationMs: 0,
         stdout: '',
         stderr: `[policy] step not executed: ${reason}\n`,

package/dist/src/orchestrator/taskRunner.js

@@ -41,6 +41,7 @@ import { composeOpening, READ_ONLY_NOTE } from '../session/compose.js';
 import { mirrorProject, describeMirror } from '../context/projectMirror.js';
 import { projectNameFor, projectTargetDir, removeLegacyFlatMirror } from '../context/desktopMirror.js';
 import { prepareForTask, commitTaskResult, repoDirOf } from '../vcs/taskVcs.js';
+import { exportMachine, writeAttemptRecord } from '../session/exports.js';
 /** Why a task that was reported as done is being closed as failed. */
 function checksFailedReason(outcomes) {
     const failed = outcomes.filter((o) => !o.passed);
@@ -110,14 +111,18 @@ function blockedReason(tried, needed) {
         .filter(Boolean)
         .join(' — ');
 }
-/** A step that was refused never reaches the shell, but Copilot still has to hear about it. */
-function refusedResult(step, reason) {
+/**
+ * A step that was not run never reaches the shell, but Copilot still has to hear about it — and
+ * hear who declined it: the runner (`refused`: a rule, so rewrite the step) or the operator
+ * (`aborted`: a person stopped or skipped it).
+ */
+function refusedResult(step, reason, by = 'runner') {
     return {
         id: step.id,
         shell: effectiveShell(step.shell),
         command: describeStep(step),
         exitCode: -4,
-        outcome: 'aborted',
+        outcome: by === 'operator' ? 'aborted' : 'refused',
         durationMs: 0,
         stdout: '',
         stderr: `[policy] step not executed: ${reason}\n`,
@@ -445,6 +450,26 @@ export async function runTask(transport, session, task, deps) {
         });
         sink.event('task-finished', { status, reason, iterations }, `task "${task.title}" ${status}${reason ? `: ${reason}` : ''}`);
         await log.close();
+        /*
+         * An attempt that did not end done leaves its plan, work and runner views in its own folder,
+         * written after the transcript is closed so they carry all of it. See `writeAttemptRecord`.
+         * A failure to write them is reported and changes nothing about the outcome.
+         */
+        if (status !== 'done') {
+            const now = await store.getSession(session.id);
+            const ended = now?.tasks.find((x) => x.id === task.id);
+            if (now && ended) {
+                await writeAttemptRecord(now, ended, cfg.resolved.runsDir, exportMachine(cfg))
+                    .then((dir) => {
+                    if (dir) {
+                        bus.publish({ sessionId: session.id, taskId: task.id, type: 'attempt-record', level: 'info',
+                            message: `plan, work and runner of this attempt saved in ${dir}`, data: { dir } });
+                    }
+                })
+                    .catch((e) => bus.publish({ sessionId: session.id, taskId: task.id, type: 'attempt-record', level: 'warn',
+                    message: `could not save the plan, work and runner of this attempt: ${e.message}` }));
+            }
+        }
         return { status, iterations, summary, reason };
     };
     await setTask((t) => {
@@ -542,7 +567,7 @@ export async function runTask(transport, session, task, deps) {
         // --- version control: a branch of this task's own, before anything is touched -------
         const prepared = await prepareForTask(session, task, bus, async (mutate) => {
             await store.updateSession(session.id, mutate);
-        });
+        }, () => store.listSessions());
         if (prepared.vcs.branch || prepared.vcs.problem) {
             await setTask((t) => {
                 t.vcs = prepared.vcs;
@@ -1181,7 +1206,7 @@ export async function runTask(transport, session, task, deps) {
             let shellRefused = 0;
             for (const step of reply.steps) {
                 if (signal?.aborted) {
-                    results.push(refusedResult(step, 'stopped by the operator'));
+                    results.push(refusedResult(step, 'stopped by the operator', 'operator'));
                     aborted = true;
                     break;
                 }
@@ -1233,13 +1258,13 @@ export async function runTask(transport, session, task, deps) {
                     t.status = 'running';
                 });
                 if (decision.action === 'abort') {
-                    results.push(refusedResult(step, decision.reason));
+                    results.push(refusedResult(step, decision.reason, decision.by === 'operator' ? 'operator' : 'runner'));
                     aborted = true;
                     break;
                 }
                 if (decision.action === 'skip') {
-                    sink.event('step-skipped', { id: step.id, reason: decision.reason }, `step ${step.id} skipped: ${decision.reason}`, 'warn');
-                    results.push(refusedResult(step, decision.reason));
+                    sink.event('step-skipped', { id: step.id, reason: decision.reason, by: decision.by ?? 'runner' }, `step ${step.id} skipped: ${decision.reason}`, 'warn');
+                    results.push(refusedResult(step, decision.reason, decision.by === 'operator' ? 'operator' : 'runner'));
                     continue;
                 }
                 const long = step.expect === 'long';