create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/lead-model-restore-reconciliation.js

@@ -2,44 +2,47 @@
 
 const path = require('node:path');
 const { sourceModelExecutionRecipeMetadata } = require('./model-execution-recipe-metadata');
+// WP-0: the bounds and the capture rule moved to lib/launch-environment.js (§5 D-1). This file keeps its
+// rule-1 caller contract: 'unknown' for non-object input, and 'captured' (with frozen values) for anything
+// captureLaunchEnvironment accepts -- an empty set still reads as 'captured' with {}.
+const { captureLaunchEnvironment, CREDENTIAL_KEY_RE } = require('./launch-environment');
+// WP-0/WP-1 D-3 (§7): the thread clause is the SAME definition the pre-park planner check runs, so a
+// plan this receipt refuses can never have been parked in the first place.
+const { targetThreadClause } = require('./lead-switch-history-mode');
 
 const ACTIVE_STATES = new Set(['queued', 'preparing', 'compacting', 'verified', 'handing_off', 'awaiting_turn']);
 const RECOVERABLE_TARGET_STATES = new Set([...ACTIVE_STATES, 'failed', 'cancelled']);
 const LEAD_MODEL_TRANSITION_RESTORE = Symbol('lead-model-transition-restore');
 const privateSourceRecoveryEnvironment = new WeakMap();
 const capturedEmptySourceEnvironmentRestores = new WeakSet();
-const MAX_SOURCE_ENV_ENTRIES = 64;
-const MAX_SOURCE_ENV_BYTES = 32 * 1024;
-const MAX_SOURCE_ENV_VALUE_BYTES = 8 * 1024;
 
 function capturePrivateSourceEnvironment(env) {
   if (!env || typeof env !== 'object' || Array.isArray(env)) return Object.freeze({ state: 'unknown', values: null });
-  const entries = Object.entries(env);
-  if (entries.length > MAX_SOURCE_ENV_ENTRIES) return Object.freeze({ state: 'unavailable', values: null });
-  const values = {};
-  let bytes = 0;
-  for (const [key, value] of entries) {
-    if (!/^[A-Za-z_][A-Za-z0-9_]{0,127}$/.test(key) || typeof value !== 'string'
-        || value.includes('\0') || Buffer.byteLength(value, 'utf8') > MAX_SOURCE_ENV_VALUE_BYTES) {
-      return Object.freeze({ state: 'unavailable', values: null });
-    }
-    bytes += Buffer.byteLength(key, 'utf8') + Buffer.byteLength(value, 'utf8');
-    if (bytes > MAX_SOURCE_ENV_BYTES) return Object.freeze({ state: 'unavailable', values: null });
-    values[key] = value;
-  }
-  return Object.freeze({ state: 'captured', values: Object.freeze(values) });
+  const captured = captureLaunchEnvironment(env);
+  if (captured.state === 'unavailable') return Object.freeze({ state: 'unavailable', values: null });
+  return Object.freeze({ state: 'captured', values: captured.values });
 }
 
+// WP-2 S-9 (§5 D-5/D-6): an EMPTY `modelId` is accepted ONLY together with the explicit
+// `modelOrigin: 'cli-default'` a cli-default source recipe carries -- the rollback of such a source
+// deliberately passes no `launchModelOverride`, so its recorded model is legitimately ''. Every other
+// empty model stays invalid here, exactly as before.
+// WP-2b (§5 D-5/D-6): `freshRelaunch` records the ONE structural fact the launch-time guards cannot
+// re-derive -- that this rollback relaunches the ORIGINAL argv with no resume selector and no model
+// override. Only an explicit `true` is stored; every other input (absent, falsy, non-boolean) is
+// `false`, so a record written before this change keeps today's exact resume-shaped rule.
 function attachPrivateSourceRecoveryEnvironment(options, { ctmSessionId, agent, modelId, providerThreadId,
-  routeId = null, environment } = {}) {
-  if (!options || typeof options !== 'object' || !ctmSessionId || !modelId || !providerThreadId
+  routeId = null, environment, modelOrigin = null, freshRelaunch = false } = {}) {
+  const origin = modelOrigin === 'cli-default' ? 'cli-default' : 'observed';
+  if (!options || typeof options !== 'object' || !ctmSessionId || !providerThreadId
+      || (!modelId && origin !== 'cli-default')
       || !['claude', 'codex'].includes(agent) || !environment || environment.state !== 'captured'
       || !environment.values || typeof environment.values !== 'object' || Array.isArray(environment.values)) return false;
   const bounded = capturePrivateSourceEnvironment(environment.values);
   if (bounded.state !== 'captured') return false;
   privateSourceRecoveryEnvironment.set(options, Object.freeze({ ctmSessionId: String(ctmSessionId), agent,
-    modelId: String(modelId), providerThreadId: String(providerThreadId), routeId: routeId || null,
-    environment: bounded.values }));
+    modelId: String(modelId || ''), modelOrigin: origin, freshRelaunch: freshRelaunch === true,
+    providerThreadId: String(providerThreadId), routeId: routeId || null, environment: bounded.values }));
   return true;
 }
 
@@ -60,7 +63,7 @@ function getPrivateSourceRecoveryEnvironment(value) {
   // credential-shaped values into the route; its validated launch env remains final authority.
   if (captured.routeId) {
     for (const key of Object.keys(environment)) {
-      if (/(?:API_KEY|AUTH_TOKEN|_TOKEN|SECRET|PASSWORD|CREDENTIAL)/i.test(key)) delete environment[key];
+      if (CREDENTIAL_KEY_RE.test(key)) delete environment[key];
     }
   }
   return { ...captured, environment };
@@ -144,7 +147,6 @@ function authorizeLiveTargetRestore({ transition, options, launchPlan, stagedTok
       && source.harness === target.harness && (source.routeId || null) === (target.routeId || null)
       && typeof request.effort === 'string' && options?.launchEffortOverride === request.effort
     : targetModelId.length > 0 && String(options?.launchModelOverride || '') === targetModelId;
-  const planThread = String(launchPlan?.resume?.sessionId || '');
   const targetGeneration = Number(transition?.target_generation ?? transition?.targetGeneration);
   const sourceGeneration = Number(transition?.source_generation ?? transition?.sourceGeneration);
   const exactClaim = options?.[LEAD_MODEL_TRANSITION_RESTORE] === true && transition?.state === 'handing_off'
@@ -156,7 +158,7 @@ function authorizeLiveTargetRestore({ transition, options, launchPlan, stagedTok
     && launchPlan === options.preparedLaunchPlan
     && Number(launchPlan?.generation) === targetGeneration
     && modelIntentMatches
-    && targetThread.length > 0 && planThread === targetThread
+    && targetThreadClause({ source, target, launchPlan })
     && target.harness === (launchPlan?.agentType === 'codex' ? 'codex-cli' : 'claude-code')
     && Number(target.processGeneration) === targetGeneration;
   if (!exactClaim) return { authorized: false, reason: 'host_target_receipt_mismatch' };
@@ -197,6 +199,80 @@ function authorizeLiveTargetRestore({ transition, options, launchPlan, stagedTok
   return { authorized: true, ownerKind: 'routed-target' };
 }
 
+// WP-2 (§5 D-3/D-4/D-6): the deferred-restore guard's decision. A journal transition in an ACTIVE
+// state (queued|preparing|compacting|verified|handing_off|awaiting_turn) that this restore cannot
+// prove is its own source, and that no host receipt claims, is a two-phase-commit "presumed abort":
+// the target was never confirmed by a turn and no live process holds it, so the switch is aborted
+// and the SOURCE recipe restored. A restore carrying `expectedProviderThreadId` is a nested source
+// recovery and keeps today's refusal instead (no recursion), and a non-active journal state stays
+// 'unknown' -- the controller owns it.
+function classifyDeferredTransitionRestore({ transition, options, exactSource } = {}) {
+  if (options?.leadModelTransition || String(options?.source || '') === 'lead-model') return 'controller-claim';
+  if (exactSource === true) return 'exact-source';
+  if (options?.expectedProviderThreadId && !exactSource) return 'source-recovery-mismatch';
+  if (ACTIVE_STATES.has(String(transition?.state || ''))) return 'presumed-abort';
+  return 'unknown';
+}
+
+/**
+ * WP-2 (§5 D-4, D-6): run the presumed abort for an unconfirmed target with no live process.
+ * `clearRestoreLatch` runs FIRST: the source recovery issues a nested restore of its own, which
+ * would otherwise read the restore latch as "a restore is already starting" and bail. When the
+ * controller still holds the transition in memory in `awaiting_turn`, its own `fail()` owns the
+ * recovery (one owner, never two). Otherwise the journal is recovered through the same unowned
+ * actors boot adoption uses for an orphan target. A recovery that REFUSES (returns `{ok:false}` --
+ * `recoverSource` reports `source_launch_environment_unavailable` / `source_launch_context_unavailable`
+ * / `source_model_unknown`, and `recoverUnownedTransition` itself `transition_source_recipe_unavailable`)
+ * is reported, but the journal is still terminalized: a presumed abort must never leave the deadlock
+ * in place, and the next plain restore then launches the session's own pinned/default model.
+ * @returns {Promise<{action: 'controller-abandoned'|'recovered'|'terminalized'|'failed', error?: Error, reason?: string,
+ *   relaunch?: boolean}>}
+ */
+async function runPresumedAbort({ sessionId, transition, stagedToken = null, leadModelSwitch,
+  getActiveTransition, sourceLaunchContext, recordDiagnostic, clearRestoreLatch } = {}) {
+  const id = String(sessionId || '');
+  const transitionId = String(transition?.transition_id ?? transition?.transitionId ?? '');
+  const entry = typeof leadModelSwitch?.get === 'function' ? leadModelSwitch.get(id) : null;
+  if (typeof recordDiagnostic === 'function') {
+    recordDiagnostic(id, 'lead-transition-presumed-abort', { transition_id: transitionId.slice(0, 16),
+      state: String(transition?.state || ''), controller: entry?.state === 'awaiting_turn' ? 'entry' : 'none' });
+  }
+  if (typeof clearRestoreLatch === 'function') clearRestoreLatch();
+  try {
+    const abandoned = leadModelSwitch?.abandonUnconfirmedTarget?.(id, 'target_unconfirmed_presumed_abort');
+    if (abandoned?.ok) return { action: 'controller-abandoned' };
+    const recovery = await leadModelSwitch.recoverUnownedTransition({ sessionId: id, transition, actual: null,
+      sourceLaunchContext });
+    const recoveryRefused = recovery?.ok !== true;
+    const reason = String(recovery?.reason || 'unknown').slice(0, 80);
+    if (recoveryRefused && typeof recordDiagnostic === 'function') {
+      recordDiagnostic(id, 'lead-transition-presumed-abort-recovery-refused', { reason });
+    }
+    const fresh = await getActiveTransition?.(id);
+    const freshId = String(fresh?.transition_id ?? fresh?.transitionId ?? '');
+    if (fresh && freshId && freshId === transitionId) {
+      await leadModelSwitch.reconcileUnownedTransition({ sessionId: id, transition: fresh, stagedToken,
+        reason: 'target_unconfirmed_presumed_abort' });
+    }
+    if (!recoveryRefused) return { action: 'recovered' };
+    // Observed live 10-27 (textbook 3ae5a121): after a CTM restart the in-memory source launch context
+    // is gone, so recovery refuses `source_launch_context_unavailable` -- the very case this abort
+    // exists for. No nested restore was issued and the client's bootstrap attempt is already spent, so
+    // "the next plain restore" never came. `relaunch` tells the caller to run that plain restore NOW,
+    // and only when no transition is active any more (so the re-entry can never abort again).
+    const remaining = await getActiveTransition?.(id);
+    return { action: 'terminalized', reason, relaunch: !remaining };
+  } catch (error) {
+    // HANDLE: the caller returns false either way (the restore is refused for this pass); the failure
+    // is reported to the session diagnostic ring, never swallowed.
+    if (typeof recordDiagnostic === 'function') {
+      recordDiagnostic(id, 'lead-transition-presumed-abort-failed',
+        { message: String(error?.message || error).slice(0, 160) });
+    }
+    return { action: 'failed', error };
+  }
+}
+
 function projectDeferredRestoreLaunch({ task, sessionLaunchContext, sessionLaunchOverrides, options } = {}) {
   let projectedTask = task;
   if (options?.expectedProviderThreadId && Array.isArray(options.launchArgsOverride)) {
@@ -219,7 +295,12 @@ function projectDeferredRestoreLaunch({ task, sessionLaunchContext, sessionLaunc
   const sourceRecovery = getPrivateSourceRecoveryEnvironment(options);
   let sourceRecoveryEnvironmentInvalid = false;
   if (privateSourceRecoveryEnvironment.has(options || {})) {
+    // WP-2 S-9 (§5 D-6): the empty model an override-less rollback carries is valid ONLY for a source
+    // whose private record says 'cli-default'; any other empty model — and any record that disagrees
+    // with the launch options or the projected task — stays invalid here.
+    const emptyModelAllowed = sourceRecovery?.modelOrigin === 'cli-default';
     sourceRecoveryEnvironmentInvalid = !sourceRecovery
+      || (sourceRecovery.modelId === '' && !emptyModelAllowed)
       || sourceRecovery.ctmSessionId !== String(projectedTask.session_id || projectedTask.id || '')
       || sourceRecovery.providerThreadId !== String(options?.expectedProviderThreadId || '')
       || sourceRecovery.modelId !== String(options?.launchModelOverride || '')
@@ -248,6 +329,7 @@ function exactRecipeOwner(recipe, actual, generation, transitionId) {
 }
 
 module.exports = { classifyBootTransitionOwner, authorizeLiveTargetRestore, projectDeferredRestoreLaunch,
+  classifyDeferredTransitionRestore, runPresumedAbort,
   forwardControllerRestoreClaim, capturePrivateSourceEnvironment, attachPrivateSourceRecoveryEnvironment,
   carryPrivateSourceRecoveryEnvironment, getPrivateSourceRecoveryEnvironment,
   attachCapturedEmptySourceEnvironmentRestore, hasCapturedEmptySourceEnvironmentRestore };