firedrill-run 3.0.1 → 3.0.2

package/dist/assembly.json

@@ -1,7 +1,7 @@
 {
   "schema": "firedrill.cli-assembly.v1",
   "package": "firedrill-run",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "entry": "cli/src/main.js",
   "helpers": [
     "cli/runtime/source_snapshot.py",

package/dist/cli/src/runner-identity.js

@@ -101,7 +101,11 @@ async function lock(scope, key, signal, work) {
     const directory = join(await privateDirectory(), `runner-lock-${identifier(scope.owner)}-${identifier(scope.workspace)}-${identifier(key)}`);
     return withBootstrapProcessLock(directory, signal, work);
 }
-async function proof(value, payload) {
+/** Read only the original signing material and verify its retained public identity.
+ * A metadata journal can outlive a session-only process's in-memory key.
+ * Reading that journal alone therefore does not make a runner usable.
+ */
+async function privateSigningKey(value) {
     try {
         const encoded = MEMORY_KEYS.get(value.key) ?? (await store(value, value.key)).getPassword();
         if (!encoded || encoded.length > 2048)
@@ -112,6 +116,15 @@ async function proof(value, payload) {
         const publicKey = createPublicKey(key).export({ format: 'jwk' });
         if (!publicKey.x || Buffer.from(publicKey.x, 'base64url').toString('base64') !== value.enrollment.public_key)
             throw new Error();
+        return key;
+    }
+    catch {
+        throw new CliError('runner_key_unavailable', 'This runner key could not be read from the OS credential store. It was not regenerated.');
+    }
+}
+async function proof(value, payload) {
+    try {
+        const key = await privateSigningKey(value);
         return { payload, signature: sign(null, Buffer.from('firedrill.local-runner-proof.v1\n' + canonical(payload)), key).toString('base64') };
     }
     catch {
@@ -513,17 +526,29 @@ export async function withNativeExecutor(scope, key, signal, work) {
  * identity on this machine. Enrollment stays an explicit, consented step.
  */
 export async function nativeExecutorKey(scope, requested, signal) {
+    const usableKey = async (key) => {
+        const retained = await currentLocalRunner(scope, key, signal);
+        // Recheck the local journal against the exact validated server receipt.
+        // No key is generated, persisted, signed or sent while selecting a device.
+        const value = await saved(scope, retained.device_key);
+        matches(value, retained);
+        signal.throwIfAborted();
+        await privateSigningKey(value);
+        signal.throwIfAborted();
+        return retained.device_key;
+    };
+    // Explicit requests never fall back to a different runner or enroll a key.
     if (requested !== undefined)
-        return (await currentLocalRunner(scope, identifier(requested), signal)).device_key;
+        return usableKey(identifier(requested));
     const usable = [];
     for (let page = 1; page <= 5; page++) {
         const { directory, candidates } = await localRunnerSelectionPage(scope, page, signal);
         for (const candidate of candidates) {
             try {
-                usable.push((await currentLocalRunner(scope, candidate.device_key, signal)).device_key);
+                usable.push(await usableKey(candidate.device_key));
             }
             catch (error) {
-                if (!(error instanceof CliError) || !['runner_identity_not_local', 'runner_scope_changed', 'runner_access_removed'].includes(error.code))
+                if (!(error instanceof CliError) || !['runner_identity_not_local', 'runner_scope_changed', 'runner_access_removed', 'runner_key_unavailable'].includes(error.code))
                     throw error;
             }
         }

package/dist/cli/src/simple/native-tools.js

@@ -265,11 +265,17 @@ async function start(args, options, emit) {
     }
     const reviewed = setup;
     let children = items ?? await setupItems(scope, { setup: reviewed, signal });
-    if (setup.state === 'reviewed' && setup.approved_at === null && setup.stop_requested_at === null) {
+    const recoveringAdmission = options.request !== undefined && setup.state === 'needs_attention'
+        && setup.approved_at !== null && setup.stop_requested_at === null;
+    if ((setup.state === 'reviewed' && setup.approved_at === null && setup.stop_requested_at === null) || recoveringAdmission) {
         // Quoting reserves nothing. Root keeps one estimate per session and replays it for its quote key only,
         // so a later run admits exactly the estimate the human saw. An approval holds only for that key.
         const original = setup.quote_request_key;
         const given = options.quote?.toLowerCase();
+        if (recoveringAdmission && (original === null || setup.bundle_digest === null))
+            throw new CliError('tool_start_unconfirmed', 'The original approved estimate could not be confirmed. Inspect this same tool session; do not create a replacement request.', 2);
+        if (recoveringAdmission && (ids.length || options.file !== undefined || options.seconds !== undefined || options.service !== undefined))
+            throw new CliError('arguments_invalid', `Continue this original tool session without changing its selection or duration: ${recovery} --usage-quote ${original} --approve-tool-change.`, 2);
         if (given !== undefined && original !== null && given !== original)
             throw new CliError('idempotency_conflict', 'That quote key is not this setup’s original estimate. Read the original setup before continuing. Nothing was admitted.', 2);
         const quoteKey = original ?? given ?? randomUUID();
@@ -280,24 +286,37 @@ async function start(args, options, emit) {
             notice = `This session's estimate was quoted under ${original}, not the key given, so it needs its own approval. `;
         const quoted = children;
         const quotes = await retryTransient(() => quoteSetup(scope, { setup: reviewed, items: quoted, requestKey: quoteKey, signal }), { signal, attempts: 3 });
-        if (!quotes.quotes.every(live))
+        if (recoveringAdmission && (quotes.quote_key !== original || quotes.bundle_digest !== setup.bundle_digest))
+            throw new CliError('idempotency_conflict', 'The retained approved estimate changed. Nothing was retried. Inspect the original tool session.', 2);
+        // The server replays an existing approval without replacing its quote.
+        // Only a never-approved review must still meet the initial quote deadline.
+        if (!recoveringAdmission && !quotes.quotes.every(live))
             throw expiredReview(setup.id);
-        let approved = options.approve === true && (!quotes.quotes.some(quote => quote.credit_approval_required) || (original !== null && given === original));
+        let approved = options.approve === true && (recoveringAdmission ? given === original
+            : !quotes.quotes.some(quote => quote.credit_approval_required) || (original !== null && given === original));
         const interactive = tty(options);
         if (!approved && interactive)
             process.stderr.write(setupText(setup, children) + '\n');
-        emit('tool_start_quote', quotes, `${notice}${quoteText(quotes, children)}`);
+        emit('tool_start_quote', quotes, `${recoveringAdmission ? 'Continuing the original approved tool session with its retained estimate. Existing tools are not replaced.\n' : notice}${quoteText(quotes, children)}`);
         if (!approved && interactive) {
-            approved = await selectOne(`Start ${children.length} tool${children.length === 1 ? '' : 's'} for ${duration(setup.duration_seconds)} each?`, [
-                { value: false, label: 'Not now', detail: 'Nothing is reserved or started.' },
-                { value: true, label: 'Start tools', detail: 'Reserves up to the estimate above. The tools run in the cloud, not on this machine.' },
+            approved = await selectOne(recoveringAdmission ? 'Continue this original approved tool session?'
+                : `Start ${children.length} tool${children.length === 1 ? '' : 's'} for ${duration(setup.duration_seconds)} each?`, [
+                { value: false, label: 'Not now', detail: recoveringAdmission ? 'The original session and existing allocations stay unchanged.' : 'Nothing is reserved or started.' },
+                { value: true, label: recoveringAdmission ? 'Continue original session' : 'Start tools',
+                    detail: recoveringAdmission ? 'Uses the same approved selection and estimate. Existing tool allocations are retained.'
+                        : 'Reserves up to the estimate above. The tools run in the cloud, not on this machine.' },
             ], signal);
         }
         if (!approved) {
-            throw new CliError('tool_change_consent_required', `${notice}Nothing was reserved or started. Show the human this estimate; after they approve it: `
+            throw new CliError('tool_change_consent_required', (recoveringAdmission
+                ? 'The original approval and any existing allocations were left unchanged. After the human approves continuing this same session: '
+                : `${notice}Nothing was reserved or started. Show the human this estimate; after they approve it: `)
                 + `${recovery} --usage-quote ${quoteKey} --approve-tool-change`, 2);
         }
-        const creditApproval = await approveCredits(quotes.quotes, options, interactive, `${recovery} --usage-quote ${quoteKey} --approve-tool-change`);
+        // Recovery does not invent another credit approval. The backend verifies
+        // and uses its durable original approval_digest and per-child request keys.
+        const creditApproval = recoveringAdmission ? false
+            : await approveCredits(quotes.quotes, options, interactive, `${recovery} --usage-quote ${quoteKey} --approve-tool-change`);
         try {
             setup = await retryTransient(() => admitSetup(scope, { quotes, signal, creditApproval }), { signal, attempts: 3 });
         }
@@ -340,6 +359,20 @@ async function start(args, options, emit) {
     }
     emit('tool_session', { ...setup, items: children }, setupText(setup, children)
         + (settled(setup, children) ? '' : `\nFollow it: firedrill tools session ${setup.id}`));
+    if (options.follow) {
+        // A completed follow is an observation, not proof that admission or every
+        // child succeeded. Preserve its full final receipt before the typed error.
+        // Normal stopped/expired history and user cancellation are not failures.
+        const failed = children.filter(item => item.instance_state === 'failed' || item.instance_state === 'rejected'
+            || item.failure_code !== null && item.admission_state !== 'cancelled'
+                && !['stopped', 'canceled', 'cancelled', 'expired'].includes(item.instance_state ?? ''));
+        if (failed.length)
+            throw new CliError('tool_start_failed', `${failed.length} tool${failed.length === 1 ? '' : 's'} failed in this original session. Inspect its retained result with firedrill tools session ${setup.id}. Nothing was restarted.`, 1);
+        if (setup.stop_requested_at === null && (setup.state === 'needs_attention' || children.some(item => item.admission_state === 'needs_attention')))
+            throw new CliError('tool_start_needs_attention', `This original tool session needs attention. Inspect it with firedrill tools session ${setup.id} before explicitly continuing its original request. Nothing was retried.`, 1);
+        if (!settled(setup, children))
+            throw new CliError('tool_start_pending', `This original tool session is still preparing after the follow window. Read its progress with firedrill tools session ${setup.id}. This is not a startup failure, and nothing was restarted.`, 1);
+    }
 }
 /** `tools runnable [--search <text>] [--page <n>]`: saved versions and the lane each service would start in. */
 async function runnable(options, emit) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firedrill-run",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "Local AI agent simulations with cloud-hosted worlds and tools",
   "type": "module",
   "bin": {