harnery 0.22.1 → 0.24.0

package/src/core/work/state.ts

@@ -1,4 +1,4 @@
-import { randomBytes, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import {
   appendFileSync,
   chmodSync,
@@ -15,8 +15,10 @@ import {
 import { hostname } from "node:os";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { readWorkflowApproval } from "../workflow/approvals.ts";
+import { stableDigest } from "../workflow/durable-record.ts";
 import { readWorkflowProof } from "../workflow/proof.ts";
 import { readWorkflowRunManifest, workflowScriptDigest } from "../workflow/run-state.ts";
+import { isWorkspaceBoundExecutionEvidence } from "../workflow/workspaces/validate.ts";
 
 export const WORK_INTENT_SCHEMA_VERSION = 1 as const;
 export const WORK_EVENT_SCHEMA_VERSION = 1 as const;
@@ -92,6 +94,10 @@ export interface WorkEvent {
   run_id?: string;
   attempt?: number;
   trigger?: WorkAttemptTrigger;
+  workspace_binding_id?: string;
+  proof_sha256?: string;
+  terminal_attestation_sha256?: string;
+  accepted_unknowns?: string[];
   state?: WorkState;
   next_action?: WorkNextAction;
 }
@@ -264,7 +270,7 @@ export function reconcileAllWorkItems(coordRoot: string, actor?: string): WorkRe
 export function acceptWorkItem(
   coordRoot: string,
   workId: string,
-  input: { actor?: string; reason?: string } = {},
+  input: { actor?: string; reason?: string; acceptedUnknowns?: readonly string[] } = {},
 ): WorkRecord {
   return appendGovernanceEvent(coordRoot, workId, "work.accepted", ["in_review"], input);
 }
@@ -278,7 +284,7 @@ export function cancelWorkItem(
     coordRoot,
     workId,
     "work.cancelled",
-    ["waiting", "ready", "blocked", "in_review"],
+    ["waiting", "ready", "running", "awaiting_approval", "blocked", "in_review"],
     input,
   );
 }
@@ -531,48 +537,109 @@ function appendGovernanceEvent(
   workId: string,
   event: "work.accepted" | "work.cancelled" | "work.reopened",
   allowed: WorkState[],
-  input: { actor?: string; reason?: string },
+  input: { actor?: string; reason?: string; acceptedUnknowns?: readonly string[] },
 ): WorkRecord {
-  const release = acquireWorkLease(coordRoot, workId);
+  const releaseWork = event === "work.cancelled" ? undefined : acquireWorkLease(coordRoot, workId);
+  const releaseEvent = acquireWorkEventLease(coordRoot, workId);
   try {
-    const current = readWorkItemIgnoringLease(coordRoot, workId);
+    const current = releaseWork
+      ? readWorkItemIgnoringLease(coordRoot, workId)
+      : readWorkItem(coordRoot, workId);
     if (!allowed.includes(current.projection.state)) {
       throw new Error(
         `work item ${workId} cannot ${event.replace("work.", "")} from state ${current.projection.state}`,
       );
     }
-    appendWorkEvent(coordRoot, workId, {
+    const acceptance =
+      event === "work.accepted"
+        ? acceptanceAuthority(coordRoot, current, input.acceptedUnknowns ?? [])
+        : undefined;
+    appendWorkEventUnderLease(coordRoot, workId, {
       event,
       actor: boundedActor(input.actor),
       reason: boundedOptional(input.reason, "work reason", MAX_REASON),
+      ...acceptance,
     });
   } finally {
-    release();
+    releaseEvent();
+    releaseWork?.();
   }
   return reconcileWorkItem(coordRoot, workId, input.actor);
 }
 
+function acceptanceAuthority(
+  coordRoot: string,
+  current: WorkRecord,
+  acceptedUnknowns: readonly string[],
+): Pick<
+  WorkEvent,
+  | "run_id"
+  | "attempt"
+  | "proof_sha256"
+  | "workspace_binding_id"
+  | "terminal_attestation_sha256"
+  | "accepted_unknowns"
+> {
+  const latest = current.projection.attempts.at(-1);
+  if (!latest?.proof_path) throw new Error("work acceptance requires terminal workflow proof");
+  const manifest = readWorkflowRunManifest(coordRoot, latest.run_id);
+  const proof = readWorkflowProof(coordRoot, latest.run_id);
+  if (
+    proof.run.work_item_id !== current.intent.id ||
+    proof.run.attempt_context?.number !== latest.number
+  ) {
+    throw new Error("work acceptance proof does not match the durable attempt");
+  }
+  const accepted = [...new Set(acceptedUnknowns)].sort();
+  for (const code of accepted) {
+    boundedString(code, "accepted unknown code", 200);
+  }
+  const execution = proof.execution;
+  return {
+    run_id: latest.run_id,
+    attempt: latest.number,
+    proof_sha256: createHash("sha256").update(readFileSync(latest.proof_path)).digest("hex"),
+    workspace_binding_id: manifest.execution.workspace_binding?.binding_id,
+    terminal_attestation_sha256: isWorkspaceBoundExecutionEvidence(execution)
+      ? stableDigest(execution.terminal_attestation)
+      : undefined,
+    accepted_unknowns: execution ? accepted : undefined,
+  };
+}
+
 /** @internal Runner seam; not a separate persistence contract. */
 export function appendReconcileIfChanged(
   coordRoot: string,
   record: WorkRecord,
   actor: string,
 ): void {
-  const last = [...record.events].reverse().find((event) => event.event === "work.reconciled");
-  if (
-    last?.state === record.projection.state &&
-    last.reason === record.projection.reason &&
-    last.next_action === record.projection.next_action
-  ) {
-    return;
-  }
-  appendWorkEvent(coordRoot, record.intent.id, {
-    event: "work.reconciled",
-    actor,
-    reason: record.projection.reason,
-    state: record.projection.state,
-    next_action: record.projection.next_action,
-  });
+  let release: (() => void) | undefined;
+  try {
+    release = acquireWorkEventLease(coordRoot, record.intent.id);
+  } catch (error) {
+    if (workEventLeaseIsLive(coordRoot, record.intent.id)) return;
+    throw error;
+  }
+  try {
+    const current = readWorkItemIgnoringLease(coordRoot, record.intent.id);
+    const last = [...current.events].reverse().find((event) => event.event === "work.reconciled");
+    if (
+      last?.state === current.projection.state &&
+      last.reason === current.projection.reason &&
+      last.next_action === current.projection.next_action
+    ) {
+      return;
+    }
+    appendWorkEventUnderLease(coordRoot, current.intent.id, {
+      event: "work.reconciled",
+      actor,
+      reason: current.projection.reason,
+      state: current.projection.state,
+      next_action: current.projection.next_action,
+    });
+  } finally {
+    release();
+  }
 }
 
 /** @internal Runner seam; not a separate persistence contract. */
@@ -580,15 +647,28 @@ export function appendWorkEvent(
   coordRoot: string,
   workId: string,
   input: Omit<WorkEvent, "schema_version" | "work_id" | "seq" | "ts">,
+): WorkEvent {
+  const release = acquireWorkEventLease(coordRoot, workId);
+  try {
+    return appendWorkEventUnderLease(coordRoot, workId, input);
+  } finally {
+    release();
+  }
+}
+
+function appendWorkEventUnderLease(
+  coordRoot: string,
+  workId: string,
+  input: Omit<WorkEvent, "schema_version" | "work_id" | "seq" | "ts">,
 ): WorkEvent {
   const events = readWorkEvents(coordRoot, workId);
   if (events.length === 0 && input.event !== "work.created") {
-    appendWorkEvent(coordRoot, workId, {
+    appendWorkEventUnderLease(coordRoot, workId, {
       event: "work.created",
       actor: "recovery",
       reason: "recovered creation receipt from immutable intent",
     });
-    return appendWorkEvent(coordRoot, workId, input);
+    return appendWorkEventUnderLease(coordRoot, workId, input);
   }
   if (events.length >= MAX_EVENTS)
     throw new Error(`work item ${workId} exceeds ${MAX_EVENTS} events`);
@@ -699,7 +779,11 @@ function validateWorkEvent(event: WorkEvent, workId: string, seq: number): void
   }
   boundedActor(event.actor);
   boundedOptional(event.reason, "work reason", MAX_REASON);
-  if (event.event === "attempt.started" || event.event === "attempt.resumed") {
+  if (
+    event.event === "attempt.started" ||
+    event.event === "attempt.resumed" ||
+    (event.event === "work.accepted" && event.run_id !== undefined)
+  ) {
     if (
       !event.run_id ||
       !RUN_ID.test(event.run_id) ||
@@ -709,6 +793,26 @@ function validateWorkEvent(event: WorkEvent, workId: string, seq: number): void
       throw new Error(`work item ${workId} event ${seq} has invalid attempt data`);
     }
   }
+  if (event.event === "work.accepted" && event.run_id !== undefined) {
+    if (event.workspace_binding_id !== undefined) {
+      boundedString(event.workspace_binding_id, "workspace binding id", 200);
+    }
+    if (!/^[a-f0-9]{64}$/.test(event.proof_sha256 ?? "")) {
+      throw new Error(`work item ${workId} event ${seq} has invalid proof digest`);
+    }
+    if (event.workspace_binding_id !== undefined) {
+      if (
+        !/^[a-f0-9]{64}$/.test(event.terminal_attestation_sha256 ?? "") ||
+        !Array.isArray(event.accepted_unknowns) ||
+        event.accepted_unknowns.some(
+          (code) => typeof code !== "string" || code.length === 0 || code.length > 200,
+        ) ||
+        new Set(event.accepted_unknowns).size !== event.accepted_unknowns.length
+      ) {
+        throw new Error(`work item ${workId} event ${seq} has invalid execution review evidence`);
+      }
+    }
+  }
   if (
     event.trigger !== undefined &&
     (event.event !== "attempt.started" ||
@@ -802,8 +906,27 @@ function workDir(coordRoot: string, workId: string): string {
 
 /** @internal Runner seam; not a separate persistence contract. */
 export function acquireWorkLease(coordRoot: string, workId: string): () => void {
+  return acquireWorkFileLease(coordRoot, workId, "lease.json", "is already active");
+}
+
+/** @internal Work journal mutation seam. */
+export function acquireWorkEventLease(coordRoot: string, workId: string): () => void {
+  return acquireWorkFileLease(
+    coordRoot,
+    workId,
+    "events.lease.json",
+    "event journal is already active",
+  );
+}
+
+function acquireWorkFileLease(
+  coordRoot: string,
+  workId: string,
+  filename: string,
+  activeMessage: string,
+): () => void {
   readWorkIntent(coordRoot, workId);
-  const path = join(workDir(coordRoot, workId), "lease.json");
+  const path = join(workDir(coordRoot, workId), filename);
   const owner = {
     pid: process.pid,
     host: hostname(),
@@ -829,7 +952,7 @@ export function acquireWorkLease(coordRoot: string, workId: string): () => void
     const existing = readLease(path);
     if (existing && leaseIsLive(existing)) {
       throw new Error(
-        `work item ${workId} is already active under pid ${existing.pid} on ${existing.host}`,
+        `work item ${workId} ${activeMessage} under pid ${existing.pid} on ${existing.host}`,
       );
     }
     unlinkSync(path);
@@ -850,6 +973,11 @@ function workLeaseIsLive(coordRoot: string, workId: string): boolean {
   return lease ? leaseIsLive(lease) : false;
 }
 
+function workEventLeaseIsLive(coordRoot: string, workId: string): boolean {
+  const lease = readLease(join(workDir(coordRoot, workId), "events.lease.json"));
+  return lease ? leaseIsLive(lease) : false;
+}
+
 function workflowResumeLeaseIsLive(coordRoot: string, runId: string): boolean {
   const lease = readLease(join(coordRoot, ".harnery", "workflows", runId, "resume.lock"));
   return lease ? leaseIsLive(lease) : false;

package/src/core/workflow/child-env.ts

@@ -6,13 +6,17 @@
  *    harness CLI under a live session inherits vars that make it exit 1 with
  *    empty output; an empty-string var still reads as set. Scrub all three
  *    families (CLAUDE*, CODEX*, CURSOR*) regardless of which adapter spawns —
- *    a codex child launched from inside a Claude Code session must not
- *    inherit CLAUDE* either.
- * 2. **The scrub targets SESSION vars, not credentials.** CURSOR_API_KEY
+ *    a codex child launched from inside a Claude Code session must not inherit
+ *    CLAUDE* either. Preserve explicit auth/config locators such as CODEX_HOME:
+ *    changing the home silently changes which subscription account the child
+ *    uses.
+ * 2. **The scrub targets SESSION vars, not credentials or auth locators.** CURSOR_API_KEY
  *    matches the CURSOR* prefix but is an auth credential, so it is carved
- *    out and re-added — a key-only cursor host must keep working. (The other
- *    two key vars, ANTHROPIC_API_KEY and OPENAI_API_KEY, don't collide with
- *    the scrub prefixes.)
+ *    out and re-added — a key-only cursor host must keep working. CODEX_HOME
+ *    is likewise preserved because codex reads its ChatGPT subscription login
+ *    from `$CODEX_HOME/auth.json`. (The other two key vars,
+ *    ANTHROPIC_API_KEY and OPENAI_API_KEY, don't collide with the scrub
+ *    prefixes.)
  * 3. **subscriptionOnly deletes every API-key var** (see billing.ts) so the
  *    child can only authenticate via its stored subscription login — the
  *    guarantee behind `workflow run --subscription-only`.
@@ -26,6 +30,7 @@
 import { API_KEY_VARS } from "./billing.ts";
 
 const SCRUB_PREFIXES = ["CLAUDE", "CODEX", "CURSOR"];
+const PRESERVED_HARNESS_VARS = new Set(["CODEX_HOME"]);
 
 export interface ChildEnvOpts {
   /** Delete all API-key vars so children can only use stored logins. */
@@ -38,7 +43,13 @@ export function buildChildEnv(runId?: string, opts: ChildEnvOpts = {}): Record<s
   for (const [k, v] of Object.entries(process.env)) {
     if (v === undefined) continue;
     if (opts.subscriptionOnly && keyVars.has(k)) continue;
-    if (SCRUB_PREFIXES.some((p) => k.startsWith(p)) && !keyVars.has(k)) continue;
+    if (
+      SCRUB_PREFIXES.some((p) => k.startsWith(p)) &&
+      !keyVars.has(k) &&
+      !PRESERVED_HARNESS_VARS.has(k)
+    ) {
+      continue;
+    }
     env[k] = v;
   }
   env.HARNERY_WORKFLOW_CHILD = "1";

package/src/core/workflow/durable-record.ts

@@ -0,0 +1,94 @@
+import { createHash, randomUUID } from "node:crypto";
+import {
+  chmodSync,
+  closeSync,
+  existsSync,
+  fsyncSync,
+  linkSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  statSync,
+  unlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname } from "node:path";
+
+const JSON_LIMIT = 512 * 1024;
+
+export function stableDigest(value: unknown): string {
+  return createHash("sha256").update(canonicalJson(value)).digest("hex");
+}
+
+export function canonicalJson(value: unknown): string {
+  return JSON.stringify(canonicalize(value));
+}
+
+export function fileSha256(path: string): string {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+export function writeImmutableJson(path: string, value: unknown): boolean {
+  const body = `${JSON.stringify(value, null, 2)}\n`;
+  if (Buffer.byteLength(body) > JSON_LIMIT) {
+    throw new Error(`immutable record exceeds ${JSON_LIMIT} bytes`);
+  }
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+  let fd: number | undefined;
+  try {
+    fd = openSync(temporary, "wx", 0o600);
+    writeFileSync(fd, body, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = undefined;
+    try {
+      linkSync(temporary, path);
+      chmodSync(path, 0o600);
+      fsyncParentDirectory(path);
+      return true;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+      const existing = readFileSync(path, "utf8");
+      if (existing !== body) throw new Error(`immutable record already exists at ${path}`);
+      return false;
+    }
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+    if (existsSync(temporary)) unlinkSync(temporary);
+  }
+}
+
+export function fsyncParentDirectory(path: string): void {
+  const directory = dirname(path);
+  const fd = openSync(directory, "r");
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+}
+
+export function readJsonRecord<T>(path: string, label: string): T {
+  if (!existsSync(path)) throw new Error(`${label} does not exist at ${path}`);
+  const size = statSync(path).size;
+  if (size <= 0 || size > JSON_LIMIT) throw new Error(`${label} has invalid size ${size}`);
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as T;
+  } catch (error) {
+    throw new Error(`cannot parse ${label} at ${path}: ${(error as Error).message}`);
+  }
+}
+
+function canonicalize(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value as Record<string, unknown>)
+        .filter(([, item]) => item !== undefined)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([key, item]) => [key, canonicalize(item)]),
+    );
+  }
+  return value;
+}