harnery 0.31.6 → 0.32.0

package/src/core/hooks/unsafe-cross-shell.ts

@@ -0,0 +1,160 @@
+import { isWslUncPath } from "./codex-wsl-bridge.ts";
+import type { Adapter } from "./events/schema.ts";
+
+export interface CrossShellInspection {
+  adapter: Adapter;
+  cwd: unknown;
+  toolName: unknown;
+  toolInput: unknown;
+}
+
+const DENY_REASON =
+  "Unsafe Windows-to-WSL shell-string construction blocked. Use the host's argv-preserving " +
+  "WSL bridge for a single executable, or its literal-script mode for compound Bash. Do not " +
+  "invoke wsl.exe with bash -c or bash -lc.";
+
+function shellCommand(toolName: unknown, toolInput: unknown): string | null {
+  if (typeof toolName !== "string") return null;
+  const normalized = toolName.toLowerCase();
+  if (
+    normalized !== "bash" &&
+    normalized !== "shell" &&
+    normalized !== "shell_command" &&
+    normalized !== "functions.shell_command"
+  ) {
+    return null;
+  }
+
+  let input = toolInput;
+  if (typeof input === "string") {
+    try {
+      input = JSON.parse(input) as unknown;
+    } catch {
+      return null;
+    }
+  }
+  if (!input || typeof input !== "object") return null;
+  const command = (input as Record<string, unknown>).command;
+  return typeof command === "string" ? command : null;
+}
+
+function quotedToken(command: string, start: number): { token: string; end: number } {
+  const quote = command[start]!;
+  let token = "";
+  for (let index = start + 1; index < command.length; index += 1) {
+    const char = command[index]!;
+    if (char === "`" && quote === '"' && index + 1 < command.length) {
+      token += command[index + 1]!;
+      index += 1;
+      continue;
+    }
+    if (char === quote) {
+      if (quote === "'" && command[index + 1] === "'") {
+        token += "'";
+        index += 1;
+        continue;
+      }
+      return { token, end: index + 1 };
+    }
+    token += char;
+  }
+  return { token, end: command.length };
+}
+
+/** Find direct PowerShell command invocations of wsl/wsl.exe outside quoted strings. */
+function wslInvocationOffsets(command: string): number[] {
+  const offsets: number[] = [];
+  let expectCommand = true;
+  let callOperator = false;
+
+  for (let index = 0; index < command.length; ) {
+    const char = command[index]!;
+    if (/\s/.test(char)) {
+      if (char === "\n" || char === "\r") {
+        expectCommand = true;
+        callOperator = false;
+      }
+      index += 1;
+      continue;
+    }
+    if (char === "#" && expectCommand) {
+      const newline = command.indexOf("\n", index + 1);
+      index = newline === -1 ? command.length : newline + 1;
+      expectCommand = true;
+      callOperator = false;
+      continue;
+    }
+    if (";|{}=()".includes(char)) {
+      expectCommand = true;
+      callOperator = false;
+      index += 1;
+      continue;
+    }
+    if (char === "&") {
+      expectCommand = true;
+      callOperator = true;
+      index += command[index + 1] === "&" ? 2 : 1;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      const parsed = quotedToken(command, index);
+      if (expectCommand && callOperator && /^wsl(?:\.exe)?$/i.test(parsed.token)) {
+        offsets.push(index);
+      }
+      expectCommand = false;
+      callOperator = false;
+      index = parsed.end;
+      continue;
+    }
+
+    const start = index;
+    while (index < command.length && !/[\s;|{}=()&]/.test(command[index]!)) index += 1;
+    const token = command.slice(start, index);
+    if (expectCommand && /^wsl(?:\.exe)?$/i.test(token)) offsets.push(start);
+    expectCommand = false;
+    callOperator = false;
+  }
+
+  return offsets;
+}
+
+function statementEnd(command: string, start: number): number {
+  let quote: string | null = null;
+  for (let index = start; index < command.length; index += 1) {
+    const char = command[index]!;
+    if (quote) {
+      if (char === "`" && quote === '"') {
+        index += 1;
+      } else if (char === quote) {
+        if (quote === "'" && command[index + 1] === "'") index += 1;
+        else quote = null;
+      }
+      continue;
+    }
+    if (char === "'" || char === '"') quote = char;
+    else if (char === ";" || char === "\n" || char === "\r" || char === "|") return index;
+    else if (char === "&" && command[index + 1] === "&") return index;
+  }
+  return command.length;
+}
+
+function invokesBashCommandString(command: string): boolean {
+  for (const offset of wslInvocationOffsets(command)) {
+    const segment = command.slice(offset, statementEnd(command, offset));
+    if (/(?:^|\s)(?:\/bin\/)?bash(?=\s|$)[\s\S]*?\s-[a-z]*c[a-z]*(?=\s|$)/i.test(segment)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+/**
+ * Deny only the unsafe hybrid shape: Windows-native Codex, WSL UNC workspace,
+ * shell tool, and a direct wsl.exe -> bash -c/-lc command-string invocation.
+ */
+export function unsafeCrossShellReason(input: CrossShellInspection): string | null {
+  if (input.adapter !== "codex" || !isWslUncPath(input.cwd)) return null;
+  const command = shellCommand(input.toolName, input.toolInput);
+  if (!command || !invokesBashCommandString(command)) return null;
+  return DENY_REASON;
+}

package/src/core/work/state.ts

@@ -21,7 +21,7 @@ import { readWorkflowRunManifest, workflowScriptDigest } from "../workflow/run-s
 import { WORKFLOW_TRANSCRIPT_EVENT_BYTES, workflowTranscriptPath } from "../workflow/transcript.ts";
 import { isWorkspaceBoundExecutionEvidence } from "../workflow/workspaces/validate.ts";
 
-export const WORK_INTENT_SCHEMA_VERSION = 1 as const;
+export const WORK_INTENT_SCHEMA_VERSION = 2 as const;
 export const WORK_EVENT_SCHEMA_VERSION = 1 as const;
 
 const WORK_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
@@ -77,12 +77,11 @@ export interface WorkIntent {
   dependencies: string[];
   workflow: { path: string; sha256: string };
   max_attempts: number;
-  /** Ceiling on CONSECUTIVE uncharged attempts (ADR 0046), separate from
+  /** Ceiling on consecutive uncharged attempts (ADR 0046), separate from
    * max_attempts. An upstream outage produces uncharged attempt after uncharged
    * attempt; without a bound it would retry forever. At the bound the item stops
-   * and reports it is blocked on an outside service. Optional for back-compat:
-   * an intent written before ADR 0046 has none and falls back to the default. */
-  max_uncharged_attempts?: number;
+   * and reports it is blocked on an outside service. */
+  max_uncharged_attempts: number;
   source?: { kind: "human" | "workflow" | "external"; ref?: string };
   created_at: string;
 }
@@ -551,7 +550,7 @@ function deriveWorkProjection(
     // Count trailing consecutive uncharged attempts in the current window. The
     // bound is the only brake on an outage that never ends, so at the limit the
     // item stops and names the outside service — distinct from work-blocked.
-    const maxUncharged = intent.max_uncharged_attempts ?? DEFAULT_MAX_UNCHARGED_ATTEMPTS;
+    const maxUncharged = intent.max_uncharged_attempts;
     let trailingUncharged = 0;
     for (let index = currentAttempts.length - 1; index >= 0; index--) {
       if (currentAttempts[index]!.uncharged === undefined) break;
@@ -1041,12 +1040,9 @@ function validateWorkIntent(intent: WorkIntent, workId: string): void {
     !Number.isSafeInteger(intent.max_attempts) ||
     intent.max_attempts < 1 ||
     intent.max_attempts > 100 ||
-    // Optional for back-compat: absent on pre-ADR-0046 intents. When present it
-    // must be a valid bound.
-    (intent.max_uncharged_attempts !== undefined &&
-      (!Number.isSafeInteger(intent.max_uncharged_attempts) ||
-        intent.max_uncharged_attempts < 1 ||
-        intent.max_uncharged_attempts > 100))
+    !Number.isSafeInteger(intent.max_uncharged_attempts) ||
+    intent.max_uncharged_attempts < 1 ||
+    intent.max_uncharged_attempts > 100
   ) {
     throw new Error(`work intent ${workId} has an unsupported or mismatched schema`);
   }

package/src/core/workflow/engine.ts

@@ -87,7 +87,7 @@ import {
 import type {
   WorkspaceAttestation,
   WorkspaceBinding,
-  WorkspaceUnsupportedExecutionEvidence,
+  WorkspaceCompatibilityExecutionEvidence,
 } from "./workspaces/types.ts";
 import { isWorkspaceAttestation } from "./workspaces/validate.ts";
 
@@ -324,7 +324,7 @@ async function executeWorkflow(
   const fallbackMeta = normalizeWorkflowMeta(undefined, fallbackName);
   const workspaceProvider = isolation === "shared" ? undefined : opts.workspace?.provider;
   let workspaceBinding: WorkspaceBinding | undefined;
-  let workspaceFallback: WorkspaceUnsupportedExecutionEvidence | undefined =
+  let workspaceFallback: WorkspaceCompatibilityExecutionEvidence | undefined =
     resumeState?.manifest.execution.workspace_fallback;
   try {
     workspaceBinding = await resolveWorkspaceBinding({

package/src/core/workflow/index.ts

@@ -143,7 +143,6 @@ export type {
   WorkspaceProviderCapabilities,
   WorkspaceProviderRef,
   WorkspaceResourceState,
-  WorkspaceUnsupportedExecutionEvidence,
 } from "./workspaces/index.ts";
 export {
   applyIntegration,

package/src/core/workflow/proof.ts

@@ -40,13 +40,13 @@ import { isCanonicalWorkflowWorkContext } from "./work-context.ts";
 import type {
   WorkspaceAttestation,
   WorkspaceBinding,
+  WorkspaceCompatibilityExecutionEvidence,
   WorkspaceExecutionEvidence,
-  WorkspaceUnsupportedExecutionEvidence,
 } from "./workspaces/index.ts";
 import {
   isWorkspaceBoundExecutionEvidence,
+  isWorkspaceCompatibilityExecutionEvidence,
   isWorkspaceExecutionEvidence,
-  isWorkspaceUnsupportedExecutionEvidence,
   workspaceProofLifecycle,
 } from "./workspaces/validate.ts";
 
@@ -101,7 +101,7 @@ export interface BuildWorkflowProofInput {
   blocked?: { reason: string; decisionId?: string };
   workspaceBinding?: WorkspaceBinding;
   workspaceAttestation?: WorkspaceAttestation;
-  workspaceFallback?: WorkspaceUnsupportedExecutionEvidence;
+  workspaceFallback?: WorkspaceCompatibilityExecutionEvidence;
   result?: unknown;
   error?: string;
 }
@@ -401,7 +401,7 @@ export function readWorkflowProof(coordRoot: string, runId: string): WorkflowPro
       ? isWorkspaceBoundExecutionEvidence(proofExecution, runId) &&
         stableDigest(proofExecution.binding) === stableDigest(manifestBinding)
       : manifestFallback !== undefined
-        ? isWorkspaceUnsupportedExecutionEvidence(proofExecution, runId) &&
+        ? isWorkspaceCompatibilityExecutionEvidence(proofExecution, runId) &&
           stableDigest(proofExecution) === stableDigest(manifestFallback)
         : proofExecution === undefined;
   if (!executionMatches) {

package/src/core/workflow/run-state.ts

@@ -33,12 +33,12 @@ import { isCanonicalWorkflowWorkContext } from "./work-context.ts";
 import type {
   WorkspaceAllocationRequest,
   WorkspaceBinding,
-  WorkspaceUnsupportedExecutionEvidence,
+  WorkspaceCompatibilityExecutionEvidence,
 } from "./workspaces/index.ts";
 import {
   assertWorkspaceManifestAuthority,
   isWorkspaceBinding,
-  isWorkspaceUnsupportedExecutionEvidence,
+  isWorkspaceCompatibilityExecutionEvidence,
 } from "./workspaces/validate.ts";
 
 export const WORKFLOW_RUN_MANIFEST_SCHEMA_VERSION = 1 as const;
@@ -70,7 +70,7 @@ export interface WorkflowRunManifest {
     policy?: NormalizedPolicy;
     specialists?: Record<string, WorkflowSpecialistProfile>;
     workspace_binding?: WorkspaceBinding;
-    workspace_fallback?: WorkspaceUnsupportedExecutionEvidence;
+    workspace_fallback?: WorkspaceCompatibilityExecutionEvidence;
   };
 }
 
@@ -307,9 +307,9 @@ function validWorkspaceBinding(binding: WorkspaceBinding | undefined): boolean {
 }
 
 function validWorkspaceFallback(
-  fallback: WorkspaceUnsupportedExecutionEvidence | undefined,
+  fallback: WorkspaceCompatibilityExecutionEvidence | undefined,
 ): boolean {
-  return fallback === undefined || isWorkspaceUnsupportedExecutionEvidence(fallback);
+  return fallback === undefined || isWorkspaceCompatibilityExecutionEvidence(fallback);
 }
 
 function validSpecialists(

package/src/core/workflow/types.ts

@@ -425,11 +425,11 @@ export type Spawner = (req: SpawnRequest) => Promise<SpawnResult>;
 /** The API surface injected into a workflow script's default export. Explicit
  * injection (no ambient globals): keeps scripts portable and unit-testable. */
 export interface WorkflowContext {
-  /** Frozen durable-work assignment for work-linked runs. Standalone and
-   * legacy-resumed workflows have no work context. */
+  /** Frozen durable-work assignment for work-linked runs. Standalone workflows
+   * have no work context. */
   work?: Readonly<WorkflowWorkContext>;
   /** Frozen attempt identity and, on retry, a bounded synopsis of prior
-   * terminal evidence. Absent for standalone and legacy-resumed workflows. */
+   * terminal evidence. Absent for standalone workflows. */
   attempt?: Readonly<WorkflowAttemptContext>;
   /** Spawn one subagent; resolves to validated JSON (schema) or reply text. */
   agent: (prompt: string, opts?: AgentOpts) => Promise<unknown>;

package/src/core/workflow/workspaces/execution.ts

@@ -14,9 +14,9 @@ import { appendWorkflowTranscriptEvent, stableDigest, writeWorkspaceRequest } fr
 import type {
   WorkspaceAttestation,
   WorkspaceBinding,
+  WorkspaceCompatibilityExecutionEvidence,
   WorkspaceIsolation,
   WorkspaceProvider,
-  WorkspaceUnsupportedExecutionEvidence,
 } from "./types.ts";
 import { isWorkspaceAttestation, isWorkspaceBinding } from "./validate.ts";
 
@@ -36,7 +36,7 @@ export async function resolveWorkspaceBinding(input: {
   workContext: Readonly<WorkflowWorkContext> | undefined;
   attemptContext: Readonly<WorkflowAttemptContext> | undefined;
   policy: NormalizedPolicy | undefined;
-  onUnsupportedFallback?: (evidence: WorkspaceUnsupportedExecutionEvidence) => void;
+  onUnsupportedFallback?: (evidence: WorkspaceCompatibilityExecutionEvidence) => void;
 }): Promise<WorkspaceBinding | undefined> {
   if (input.isolation === "shared") return undefined;
   if (
@@ -47,6 +47,13 @@ export async function resolveWorkspaceBinding(input: {
     throw new Error(`unsupported workflow isolation ${JSON.stringify(input.isolation)}`);
   }
   if (input.resumeState && !input.resumeState.manifest.execution.workspace_binding) {
+    const frozenFallback = input.resumeState.manifest.execution.workspace_fallback;
+    if (!frozenFallback) {
+      throw new Error(
+        `workflow run ${input.runId} requested ${input.isolation} isolation without frozen workspace evidence`,
+      );
+    }
+    input.onUnsupportedFallback?.(frozenFallback);
     return undefined;
   }
   const capability = input.isolation as WorkspaceIsolation;
@@ -55,7 +62,7 @@ export async function resolveWorkspaceBinding(input: {
     if (input.resumeState?.manifest.execution.workspace_binding) {
       throw new Error("isolated workflow resume requires the frozen workspace provider");
     }
-    const fallback: WorkspaceUnsupportedExecutionEvidence = {
+    const fallback: WorkspaceCompatibilityExecutionEvidence = {
       schema_version: 1,
       run_id: input.runId,
       requested_isolation: capability,
@@ -163,7 +170,7 @@ export async function resolveWorkspaceBinding(input: {
                 message: `provider does not support ${capability} isolation`,
               },
             ];
-      const fallback: WorkspaceUnsupportedExecutionEvidence = {
+      const fallback: WorkspaceCompatibilityExecutionEvidence = {
         schema_version: 1,
         run_id: input.runId,
         requested_isolation: capability,

package/src/core/workflow/workspaces/index.ts

@@ -56,7 +56,6 @@ export type {
   RepositoryBinding,
   RepositoryObservation,
   ValidatedFilesystemPath,
-  ValidatedFilesystemRoot,
   WorkspaceAllocationRequest,
   WorkspaceAttestation,
   WorkspaceBinding,
@@ -77,13 +76,11 @@ export type {
   WorkspaceOwner,
   WorkspaceProbeInput,
   WorkspaceProbeResult,
-  WorkspaceProofLifecycleState,
   WorkspaceProofOutcome,
   WorkspaceProvider,
   WorkspaceProviderCapabilities,
   WorkspaceProviderRef,
   WorkspaceResourceState,
-  WorkspaceUnsupportedExecutionEvidence,
 } from "./types.ts";
 export {
   WORKSPACE_BINDING_SCHEMA_VERSION,

package/src/core/workflow/workspaces/local-git.ts

@@ -76,7 +76,6 @@ import { isWorkspaceAttestation } from "./validate.ts";
 const PROVIDER_ID = "local-git-worktree";
 const PROVIDER_VERSION = "1";
 const WORKSPACE_PARENT_SEGMENT = ".harnery-workspaces";
-const LEGACY_WORKSPACE_PARENT_SEGMENT = "harnery-workspaces";
 const LOCK_STALE_MS = 5 * 60 * 1_000;
 const OBJECT_FORMAT = /^[a-f0-9]{40,64}$/;
 const REF_FORMAT = /^refs\/heads\/[A-Za-z0-9][A-Za-z0-9._/-]{0,180}$/;
@@ -308,7 +307,7 @@ async function allocate(
  */
 function claimedParentSegment(claim: WorkspaceClaim): string {
   const segment = basename(dirname(claim.workspace_root));
-  if (segment !== WORKSPACE_PARENT_SEGMENT && segment !== LEGACY_WORKSPACE_PARENT_SEGMENT) {
+  if (segment !== WORKSPACE_PARENT_SEGMENT) {
     throw new Error("claimed workspace path is not under a provider-owned workspace parent");
   }
   return segment;

package/src/core/workflow/workspaces/paths.ts

@@ -9,11 +9,11 @@ import {
   statSync,
 } from "node:fs";
 import { isAbsolute, join, relative, resolve } from "node:path";
-import type { FilesystemIdentity, ValidatedFilesystemRoot } from "./types.ts";
+import type { FilesystemIdentity, ValidatedFilesystemPath } from "./types.ts";
 
 const WINDOWS_AMBIGUOUS = /[<>:"|?*]|[ .]$/;
 
-export type ValidatedRoot = ValidatedFilesystemRoot;
+export type ValidatedRoot = ValidatedFilesystemPath;
 
 export interface OpenContainedDirectory {
   path: string;

package/src/core/workflow/workspaces/types.ts

@@ -21,9 +21,6 @@ export interface ValidatedFilesystemPath {
   identity: FilesystemIdentity;
 }
 
-/** @deprecated Use ValidatedFilesystemPath. */
-export type ValidatedFilesystemRoot = ValidatedFilesystemPath;
-
 export interface WorkspaceProviderRef {
   id: string;
   version: string;
@@ -184,9 +181,6 @@ export type WorkspaceProofOutcome =
   | "blocked"
   | "lost";
 
-/** @deprecated Use WorkspaceProofOutcome. */
-export type WorkspaceProofLifecycleState = WorkspaceProofOutcome;
-
 export type WorkspaceResourceState = "active" | "preserved_dirty" | "released" | "blocked" | "lost";
 
 export type WorkspaceIntegrationState = "none" | "planned" | "applying" | "applied";
@@ -492,9 +486,6 @@ export interface WorkspaceCompatibilityExecutionEvidence {
   receipts: Record<string, never>;
 }
 
-/** @deprecated Use WorkspaceCompatibilityExecutionEvidence. */
-export type WorkspaceUnsupportedExecutionEvidence = WorkspaceCompatibilityExecutionEvidence;
-
 export type WorkspaceExecutionEvidence =
   | WorkspaceBoundExecutionEvidence
   | WorkspaceCompatibilityExecutionEvidence;

package/src/core/workflow/workspaces/validate.ts

@@ -11,7 +11,6 @@ import type {
   WorkspaceCompatibilityExecutionEvidence,
   WorkspaceExecutionEvidence,
   WorkspaceOwner,
-  WorkspaceProofLifecycleState,
   WorkspaceProofOutcome,
 } from "./types.ts";
 
@@ -376,7 +375,7 @@ function workspaceCwdMatchesBinding(
 }
 
 function validWorkspaceProofOutcome(
-  outcome: WorkspaceProofLifecycleState,
+  outcome: WorkspaceProofOutcome,
   attestation: WorkspaceAttestation,
   workflowStatus?: "succeeded" | "failed",
 ): boolean {
@@ -420,9 +419,6 @@ export function isWorkspaceCompatibilityExecutionEvidence(
   );
 }
 
-/** @deprecated Use isWorkspaceCompatibilityExecutionEvidence. */
-export const isWorkspaceUnsupportedExecutionEvidence = isWorkspaceCompatibilityExecutionEvidence;
-
 function sameOwner(left: WorkspaceOwner, right: WorkspaceOwner): boolean {
   return (
     left.kind === right.kind &&