firedrill-run 3.0.1 → 3.0.3

package/dist/assembly.json

@@ -1,7 +1,7 @@
 {
   "schema": "firedrill.cli-assembly.v1",
   "package": "firedrill-run",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "entry": "cli/src/main.js",
   "helpers": [
     "cli/runtime/source_snapshot.py",

package/dist/cli/src/request-input.js

@@ -2,13 +2,88 @@ import { constants } from 'node:fs';
 import { lstat, open } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { CliError } from './http.js';
+/** Consume a pipe once without leaving an abort waiting for another byte. */
+async function stdinInput(signal, maximumBytes) {
+    signal.throwIfAborted();
+    const input = process.stdin;
+    if (input.isTTY || input.readableEncoding !== null) {
+        throw new CliError('request_stdin_invalid', 'Pipe one UTF-8 JSON object into --file -. Nothing was submitted.', 2);
+    }
+    const chunks = await new Promise((accept, reject) => {
+        const collected = [];
+        let size = 0;
+        let settled = false;
+        const invalid = () => new CliError('request_stdin_invalid', 'Standard input must contain one JSON object within transport capacity. Nothing was submitted.', 2);
+        const finish = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            input.pause();
+            input.removeListener('data', data);
+            input.removeListener('end', end);
+            input.removeListener('error', failed);
+            input.removeListener('close', closed);
+            signal.removeEventListener('abort', aborted);
+            if (error !== undefined)
+                reject(error);
+            else
+                accept(collected);
+        };
+        const data = (chunk) => {
+            if (!Buffer.isBuffer(chunk)) {
+                finish(invalid());
+                return;
+            }
+            size += chunk.length;
+            if (size > maximumBytes) {
+                finish(invalid());
+                return;
+            }
+            collected.push(Buffer.from(chunk));
+        };
+        const end = () => finish();
+        const failed = () => finish(invalid());
+        const closed = () => { if (!input.readableEnded)
+            finish(invalid()); };
+        const aborted = () => finish(signal.reason ?? new DOMException('The operation was aborted.', 'AbortError'));
+        input.on('data', data);
+        input.once('end', end);
+        input.once('error', failed);
+        input.once('close', closed);
+        signal.addEventListener('abort', aborted, { once: true });
+        // EOF or cancellation can precede listener installation. Never wait for an
+        // event that has already happened, including an idle pipe on cancellation.
+        if (signal.aborted)
+            aborted();
+        else if (input.readableEnded)
+            end();
+        else if (input.destroyed)
+            failed();
+        else
+            input.resume();
+    });
+    signal.throwIfAborted();
+    try {
+        const raw = new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
+        const value = JSON.parse(raw);
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        return raw;
+    }
+    catch {
+        throw new CliError('request_stdin_invalid', 'Standard input is not a UTF-8 JSON object. Nothing was submitted.', 2);
+    }
+}
 /** Read one bounded, unchanged JSON object without rewriting number literals. */
 export async function requestInput(path, signal, maximumBytes = 8 * 1024 * 1024) {
+    signal.throwIfAborted();
     if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 2 || maximumBytes > 8 * 1024 * 1024) {
         throw new CliError('request_capacity_invalid', 'Choose a supported request capacity.', 2);
     }
     if (!path)
         return '{}';
+    if (path === '-')
+        return stdinInput(signal, maximumBytes);
     const before = await lstat(resolve(path));
     if (!before.isFile() || before.isSymbolicLink() || before.size > maximumBytes) {
         throw new CliError('request_file_invalid', 'Choose a regular JSON file within transport capacity.', 2);

package/dist/cli/src/runner-identity.js

@@ -101,7 +101,11 @@ async function lock(scope, key, signal, work) {
     const directory = join(await privateDirectory(), `runner-lock-${identifier(scope.owner)}-${identifier(scope.workspace)}-${identifier(key)}`);
     return withBootstrapProcessLock(directory, signal, work);
 }
-async function proof(value, payload) {
+/** Read only the original signing material and verify its retained public identity.
+ * A metadata journal can outlive a session-only process's in-memory key.
+ * Reading that journal alone therefore does not make a runner usable.
+ */
+async function privateSigningKey(value) {
     try {
         const encoded = MEMORY_KEYS.get(value.key) ?? (await store(value, value.key)).getPassword();
         if (!encoded || encoded.length > 2048)
@@ -112,6 +116,15 @@ async function proof(value, payload) {
         const publicKey = createPublicKey(key).export({ format: 'jwk' });
         if (!publicKey.x || Buffer.from(publicKey.x, 'base64url').toString('base64') !== value.enrollment.public_key)
             throw new Error();
+        return key;
+    }
+    catch {
+        throw new CliError('runner_key_unavailable', 'This runner key could not be read from the OS credential store. It was not regenerated.');
+    }
+}
+async function proof(value, payload) {
+    try {
+        const key = await privateSigningKey(value);
         return { payload, signature: sign(null, Buffer.from('firedrill.local-runner-proof.v1\n' + canonical(payload)), key).toString('base64') };
     }
     catch {
@@ -513,17 +526,29 @@ export async function withNativeExecutor(scope, key, signal, work) {
  * identity on this machine. Enrollment stays an explicit, consented step.
  */
 export async function nativeExecutorKey(scope, requested, signal) {
+    const usableKey = async (key) => {
+        const retained = await currentLocalRunner(scope, key, signal);
+        // Recheck the local journal against the exact validated server receipt.
+        // No key is generated, persisted, signed or sent while selecting a device.
+        const value = await saved(scope, retained.device_key);
+        matches(value, retained);
+        signal.throwIfAborted();
+        await privateSigningKey(value);
+        signal.throwIfAborted();
+        return retained.device_key;
+    };
+    // Explicit requests never fall back to a different runner or enroll a key.
     if (requested !== undefined)
-        return (await currentLocalRunner(scope, identifier(requested), signal)).device_key;
+        return usableKey(identifier(requested));
     const usable = [];
     for (let page = 1; page <= 5; page++) {
         const { directory, candidates } = await localRunnerSelectionPage(scope, page, signal);
         for (const candidate of candidates) {
             try {
-                usable.push((await currentLocalRunner(scope, candidate.device_key, signal)).device_key);
+                usable.push(await usableKey(candidate.device_key));
             }
             catch (error) {
-                if (!(error instanceof CliError) || !['runner_identity_not_local', 'runner_scope_changed', 'runner_access_removed'].includes(error.code))
+                if (!(error instanceof CliError) || !['runner_identity_not_local', 'runner_scope_changed', 'runner_access_removed', 'runner_key_unavailable'].includes(error.code))
                     throw error;
             }
         }

package/dist/cli/src/simple/native-tools.js

@@ -265,11 +265,17 @@ async function start(args, options, emit) {
     }
     const reviewed = setup;
     let children = items ?? await setupItems(scope, { setup: reviewed, signal });
-    if (setup.state === 'reviewed' && setup.approved_at === null && setup.stop_requested_at === null) {
+    const recoveringAdmission = options.request !== undefined && setup.state === 'needs_attention'
+        && setup.approved_at !== null && setup.stop_requested_at === null;
+    if ((setup.state === 'reviewed' && setup.approved_at === null && setup.stop_requested_at === null) || recoveringAdmission) {
         // Quoting reserves nothing. Root keeps one estimate per session and replays it for its quote key only,
         // so a later run admits exactly the estimate the human saw. An approval holds only for that key.
         const original = setup.quote_request_key;
         const given = options.quote?.toLowerCase();
+        if (recoveringAdmission && (original === null || setup.bundle_digest === null))
+            throw new CliError('tool_start_unconfirmed', 'The original approved estimate could not be confirmed. Inspect this same tool session; do not create a replacement request.', 2);
+        if (recoveringAdmission && (ids.length || options.file !== undefined || options.seconds !== undefined || options.service !== undefined))
+            throw new CliError('arguments_invalid', `Continue this original tool session without changing its selection or duration: ${recovery} --usage-quote ${original} --approve-tool-change.`, 2);
         if (given !== undefined && original !== null && given !== original)
             throw new CliError('idempotency_conflict', 'That quote key is not this setup’s original estimate. Read the original setup before continuing. Nothing was admitted.', 2);
         const quoteKey = original ?? given ?? randomUUID();
@@ -280,24 +286,37 @@ async function start(args, options, emit) {
             notice = `This session's estimate was quoted under ${original}, not the key given, so it needs its own approval. `;
         const quoted = children;
         const quotes = await retryTransient(() => quoteSetup(scope, { setup: reviewed, items: quoted, requestKey: quoteKey, signal }), { signal, attempts: 3 });
-        if (!quotes.quotes.every(live))
+        if (recoveringAdmission && (quotes.quote_key !== original || quotes.bundle_digest !== setup.bundle_digest))
+            throw new CliError('idempotency_conflict', 'The retained approved estimate changed. Nothing was retried. Inspect the original tool session.', 2);
+        // The server replays an existing approval without replacing its quote.
+        // Only a never-approved review must still meet the initial quote deadline.
+        if (!recoveringAdmission && !quotes.quotes.every(live))
             throw expiredReview(setup.id);
-        let approved = options.approve === true && (!quotes.quotes.some(quote => quote.credit_approval_required) || (original !== null && given === original));
+        let approved = options.approve === true && (recoveringAdmission ? given === original
+            : !quotes.quotes.some(quote => quote.credit_approval_required) || (original !== null && given === original));
         const interactive = tty(options);
         if (!approved && interactive)
             process.stderr.write(setupText(setup, children) + '\n');
-        emit('tool_start_quote', quotes, `${notice}${quoteText(quotes, children)}`);
+        emit('tool_start_quote', quotes, `${recoveringAdmission ? 'Continuing the original approved tool session with its retained estimate. Existing tools are not replaced.\n' : notice}${quoteText(quotes, children)}`);
         if (!approved && interactive) {
-            approved = await selectOne(`Start ${children.length} tool${children.length === 1 ? '' : 's'} for ${duration(setup.duration_seconds)} each?`, [
-                { value: false, label: 'Not now', detail: 'Nothing is reserved or started.' },
-                { value: true, label: 'Start tools', detail: 'Reserves up to the estimate above. The tools run in the cloud, not on this machine.' },
+            approved = await selectOne(recoveringAdmission ? 'Continue this original approved tool session?'
+                : `Start ${children.length} tool${children.length === 1 ? '' : 's'} for ${duration(setup.duration_seconds)} each?`, [
+                { value: false, label: 'Not now', detail: recoveringAdmission ? 'The original session and existing allocations stay unchanged.' : 'Nothing is reserved or started.' },
+                { value: true, label: recoveringAdmission ? 'Continue original session' : 'Start tools',
+                    detail: recoveringAdmission ? 'Uses the same approved selection and estimate. Existing tool allocations are retained.'
+                        : 'Reserves up to the estimate above. The tools run in the cloud, not on this machine.' },
             ], signal);
         }
         if (!approved) {
-            throw new CliError('tool_change_consent_required', `${notice}Nothing was reserved or started. Show the human this estimate; after they approve it: `
+            throw new CliError('tool_change_consent_required', (recoveringAdmission
+                ? 'The original approval and any existing allocations were left unchanged. After the human approves continuing this same session: '
+                : `${notice}Nothing was reserved or started. Show the human this estimate; after they approve it: `)
                 + `${recovery} --usage-quote ${quoteKey} --approve-tool-change`, 2);
         }
-        const creditApproval = await approveCredits(quotes.quotes, options, interactive, `${recovery} --usage-quote ${quoteKey} --approve-tool-change`);
+        // Recovery does not invent another credit approval. The backend verifies
+        // and uses its durable original approval_digest and per-child request keys.
+        const creditApproval = recoveringAdmission ? false
+            : await approveCredits(quotes.quotes, options, interactive, `${recovery} --usage-quote ${quoteKey} --approve-tool-change`);
         try {
             setup = await retryTransient(() => admitSetup(scope, { quotes, signal, creditApproval }), { signal, attempts: 3 });
         }
@@ -340,6 +359,20 @@ async function start(args, options, emit) {
     }
     emit('tool_session', { ...setup, items: children }, setupText(setup, children)
         + (settled(setup, children) ? '' : `\nFollow it: firedrill tools session ${setup.id}`));
+    if (options.follow) {
+        // A completed follow is an observation, not proof that admission or every
+        // child succeeded. Preserve its full final receipt before the typed error.
+        // Normal stopped/expired history and user cancellation are not failures.
+        const failed = children.filter(item => item.instance_state === 'failed' || item.instance_state === 'rejected'
+            || item.failure_code !== null && item.admission_state !== 'cancelled'
+                && !['stopped', 'canceled', 'cancelled', 'expired'].includes(item.instance_state ?? ''));
+        if (failed.length)
+            throw new CliError('tool_start_failed', `${failed.length} tool${failed.length === 1 ? '' : 's'} failed in this original session. Inspect its retained result with firedrill tools session ${setup.id}. Nothing was restarted.`, 1);
+        if (setup.stop_requested_at === null && (setup.state === 'needs_attention' || children.some(item => item.admission_state === 'needs_attention')))
+            throw new CliError('tool_start_needs_attention', `This original tool session needs attention. Inspect it with firedrill tools session ${setup.id} before explicitly continuing its original request. Nothing was retried.`, 1);
+        if (!settled(setup, children))
+            throw new CliError('tool_start_pending', `This original tool session is still preparing after the follow window. Read its progress with firedrill tools session ${setup.id}. This is not a startup failure, and nothing was restarted.`, 1);
+    }
 }
 /** `tools runnable [--search <text>] [--page <n>]`: saved versions and the lane each service would start in. */
 async function runnable(options, emit) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firedrill-run",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "Local AI agent simulations with cloud-hosted worlds and tools",
   "type": "module",
   "bin": {