harnery 0.45.2 → 0.46.0

package/src/core/hooks/adapter/native-parent.ts

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync } from "node:fs";
+import { discoverCodexSessionTranscript } from "./runtime-telemetry.ts";
+
+export type NativeParentObservation =
+  | { state: "observed"; parent_session_id: string; source_witness: string }
+  | { state: "none"; reason: string; source_witness: string }
+  | { state: "unknown"; reason: string };
+
+export interface NativeParentRequest {
+  adapter: string;
+  native_session_id?: string;
+  transcript_path?: string;
+}
+
+export interface NativeParentReaderOptions {
+  discoverTranscript?: (sessionId: string, transcriptPath?: string) => string | undefined;
+}
+
+const HEADER_LIMIT = 1024 * 1024;
+const NATIVE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const ORDINARY_SOURCES = new Set(["cli", "exec", "vscode", "app-server"]);
+
+function object(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+/** Native relationship evidence only; no prompt bodies, state writes or recipient authority. */
+export function readNativeParentReference(
+  request: NativeParentRequest,
+  options: NativeParentReaderOptions = {},
+): NativeParentObservation {
+  if (request.adapter !== "codex") return unknown("native_parent_adapter_unsupported");
+  const child = request.native_session_id;
+  if (!child || !NATIVE_ID.test(child)) return unknown("native_child_identity_unavailable");
+  let fd: number | undefined;
+  try {
+    const path = (options.discoverTranscript ?? discoverCodexSessionTranscript)(
+      child,
+      request.transcript_path,
+    );
+    if (!path) return unknown("native_parent_transcript_unavailable");
+    const entry = lstatSync(path);
+    if (!entry.isFile() || entry.isSymbolicLink()) return unknown("native_parent_not_regular");
+    fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const before = fstatSync(fd);
+    if (!before.isFile() || before.dev !== entry.dev || before.ino !== entry.ino) {
+      return unknown("native_parent_file_changed");
+    }
+    const header = readHeader(fd);
+    if (!header) return unknown("native_parent_header_incomplete");
+    // Appending later rows is normal. The same header must remain unchanged.
+    const checked = readHeader(fd);
+    const after = lstatSync(path);
+    if (
+      !checked?.equals(header) ||
+      !after.isFile() ||
+      after.isSymbolicLink() ||
+      before.dev !== after.dev ||
+      before.ino !== after.ino
+    ) {
+      return unknown("native_parent_file_changed");
+    }
+    const row = object(JSON.parse(header.toString("utf8")));
+    const payload = object(row?.payload);
+    if (row?.type !== "session_meta" || payload?.id !== child) {
+      return unknown("native_parent_child_mismatch");
+    }
+    const source_witness = createHash("sha256").update(header).digest("hex");
+    if (typeof payload.source === "string" && ORDINARY_SOURCES.has(payload.source)) {
+      return { state: "none", reason: "native_ordinary_session", source_witness };
+    }
+    const source = object(payload.source);
+    const spawn = object(object(source?.subagent)?.thread_spawn);
+    const parent = spawn?.parent_thread_id;
+    if (typeof parent !== "string" || !NATIVE_ID.test(parent)) {
+      return unknown("native_parent_not_reported");
+    }
+    if (parent.toLowerCase() === child.toLowerCase())
+      return unknown("native_parent_self_reference");
+    return { state: "observed", parent_session_id: parent, source_witness };
+  } catch {
+    return unknown("native_parent_metadata_unreadable");
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+function readHeader(fd: number): Buffer | undefined {
+  const chunks: Buffer[] = [];
+  let offset = 0;
+  while (offset < HEADER_LIMIT) {
+    const buffer = Buffer.alloc(Math.min(16 * 1024, HEADER_LIMIT - offset));
+    const bytes = readSync(fd, buffer, 0, buffer.length, offset);
+    if (bytes === 0) return undefined;
+    const data = buffer.subarray(0, bytes);
+    const newline = data.indexOf(10);
+    if (newline >= 0) return Buffer.concat([...chunks, data.subarray(0, newline)]);
+    chunks.push(data);
+    offset += bytes;
+  }
+  return undefined;
+}
+
+function unknown(reason: string): NativeParentObservation {
+  return { state: "unknown", reason };
+}

package/src/core/hooks/cli.ts

@@ -69,6 +69,7 @@ import {
   agentsRequireGitFinalization,
   coordFreshnessSeconds,
   hostPromptContextConfig,
+  readAdmissionConfig,
   resolveBinName,
 } from "../config.ts";
 import {
@@ -92,6 +93,7 @@ import {
 import type { TurnRitualEvidenceV3 } from "../events/v3/producers/hook-base.ts";
 import { captureSpanClockV3 } from "../events/v3/span-state.ts";
 import { ensureRelayDaemon, fetchPresence, publishPresence } from "../presence/index.ts";
+import { importMail, publishMail } from "../presence/mail.ts";
 import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.ts";
 import { stableScopeId } from "../workflow/scope-id.ts";
 import { type AdapterBehavior, adapterBehavior } from "./adapter/behaviors/index.ts";
@@ -142,6 +144,7 @@ import {
 } from "./resolve/transcript.ts";
 import { clearHookRunMarker, writeHookRunMarker } from "./run-markers.ts";
 import { sessionNamePresence } from "./session-name-presence.ts";
+import { shellCommitTreeReason } from "./shell-commit-tree.ts";
 import { shellRmReason } from "./shell-rm.ts";
 import { shellWaiterReason } from "./shell-waiter.ts";
 
@@ -343,8 +346,17 @@ function ensureSessionDisplayName(
   payload: ParsedPayload | null,
 ): void {
   if (coordEnv("WORKFLOW_CHILD") === "1") return;
-  const row =
-    readLiveCoordinationRow(coordRoot, instanceId) ?? readHeartbeat(coordRoot, instanceId);
+  // This runs on every tool call. The heartbeat cache is the surface this
+  // function stamps, so a cache that already carries a name, or marks a
+  // session that never takes one, means there is nothing to do. Only a cache
+  // that cannot answer pays for the authoritative read, which re-validates the
+  // whole active ledger and cost about half a second per call at 22 MB.
+  const cached = readHeartbeat(coordRoot, instanceId);
+  if (cached?.kind === "subagent" || cached?.kind === "transient" || cached?.workflow_run_id) {
+    return;
+  }
+  if (cached?.name?.trim()) return;
+  const row = readLiveCoordinationRow(coordRoot, instanceId) ?? cached;
   if (row?.kind === "subagent" || row?.kind === "transient" || row?.workflow_run_id) return;
   if (row?.name?.trim()) return;
   const assigned = assignSessionNameInProcess(coordRoot, instanceId, payload, adapter);
@@ -1276,8 +1288,23 @@ function recordContextTelemetry(run: HookRun): void {
   }
 }
 
+/** Cross-machine peer messages (ADR 0222) ride the presence fetch: import
+ * whatever mail refs are already local. Reads local refs only, at most once
+ * per import interval; never blocks on the network. */
+async function receiveRemoteMail(coordRoot: string): Promise<void> {
+  const { peerInbox } = await import("../inbox/peer-messages.ts");
+  importMail(coordRoot, peerInbox(coordRoot), { throttle: true });
+}
+
 async function handleSessionStarted(run: HookRun): Promise<void> {
   const { coordRoot, adapter, payload, owner, sessionId, data } = run;
+  // Import mail from refs fetched earlier, so a message sent from another
+  // machine while this task was away is in the inbox this context renders.
+  try {
+    await receiveRemoteMail(coordRoot);
+  } catch (err) {
+    logError(coordRoot, err, { phase: "session-start-mail" });
+  }
   // A configured backup runs out of process and is freshness-gated per host.
   // Startup never waits for restic or a remote provider; the child owns no
   // hook stdio, so the harness is not held open until it finishes. A failed
@@ -1402,6 +1429,7 @@ async function handleTurnStarted(run: HookRun): Promise<void> {
   // interval; the systemMessage below reads whatever is locally known).
   try {
     fetchPresence(coordRoot);
+    await receiveRemoteMail(coordRoot);
   } catch (err) {
     logError(coordRoot, err, { phase: "user-prompt-submit-presence" });
   }
@@ -1472,6 +1500,7 @@ async function handleStop(run: HookRun): Promise<number | undefined> {
   // its daemon intentionally exits when a machine has no live sessions.
   try {
     publishPresence(coordRoot);
+    publishMail(coordRoot);
     ensureRelayDaemon(coordRoot);
   } catch (err) {
     logError(coordRoot, err, { phase: "stop-presence" });
@@ -1609,6 +1638,17 @@ async function handleToolRequested(run: HookRun): Promise<number | undefined> {
     return 0;
   }
 
+  const commitTreeReason = shellCommitTreeReason(
+    payload?.tool_name,
+    payload?.tool_input,
+    resolveBinName(coordRoot),
+  );
+  if (commitTreeReason) {
+    const { emitDeny } = await import("./adapter/output.ts");
+    emitDeny(adapter, commitTreeReason);
+    return 0;
+  }
+
   // G-guard for ALL adapters. Claude Code previously ran this via a
   // pre-tool-use bash adapter (which called `agent-coord verdict --rule=claim`);
   // that adapter is now deleted, so agent-hook owns the deny for every adapter.
@@ -1624,9 +1664,41 @@ async function handleToolRequested(run: HookRun): Promise<number | undefined> {
     logError(coordRoot, err, { phase: "pre-tool-use-guard" });
   }
   if (!guardAllowed) return 0;
+
+  // Heavy shell checks queue for a machine-wide admission slot when the
+  // project configures one. Fails open: any error runs the command as written.
+  try {
+    if (await emitAdmissionRewrite(coordRoot, adapter, payload)) return 0;
+  } catch (err) {
+    logError(coordRoot, err, { phase: "pre-tool-use-admission" });
+  }
   return undefined;
 }
 
+async function emitAdmissionRewrite(
+  coordRoot: string,
+  adapter: Adapter,
+  payload: HookRun["payload"],
+): Promise<boolean> {
+  const resource = readAdmissionConfig(coordRoot)?.guard?.resource;
+  if (!resource) return false;
+  const { admissionHookOutput } = await import("./shell-admission.ts");
+  const output = admissionHookOutput({
+    adapter,
+    resource,
+    bin: resolveBinName(coordRoot),
+    projectRoot: coordRoot,
+    toolName: payload?.tool_name,
+    toolInput: payload?.tool_input,
+    cwd: payload?.cwd,
+    skip: coordEnv("ADMISSION_SKIP") === "1" || Boolean(coordEnv("ADMISSION_HELD")),
+    platform: process.platform,
+  });
+  if (!output) return false;
+  process.stdout.write(`${JSON.stringify(output)}\n`);
+  return true;
+}
+
 async function handlePostToolUse(run: HookRun): Promise<void> {
   const { coordRoot, adapter, eventName, payload, owner } = run;
   // Inject the full instruction only at the successful tool boundary that
@@ -1646,9 +1718,16 @@ async function handlePostToolUse(run: HookRun): Promise<void> {
   // retry response already carries the full instruction and an end-turn
   // status is the wrong place to ask.
   try {
-    const row = readLiveCoordinationRow(coordRoot, owner.instance_id);
     // A workflow child has no user-visible title to set.
-    const name = coordEnv("WORKFLOW_CHILD") === "1" ? undefined : sessionNameDisplayPending(row);
+    if (coordEnv("WORKFLOW_CHILD") === "1") return;
+    // The live row copies every name-display field from a current heartbeat
+    // cache and leaves them unset otherwise, so a raw cache with nothing
+    // pending proves the row has nothing pending either. That skips a full
+    // ledger read on almost every tool call; only a pending title pays for
+    // the authoritative check below.
+    if (!sessionNameDisplayPending(readHeartbeat(coordRoot, owner.instance_id))) return;
+    const row = readLiveCoordinationRow(coordRoot, owner.instance_id);
+    const name = sessionNameDisplayPending(row);
     if (name && toolResponseMintedSessionName(payload?.tool_response, name)) {
       // Record the title before asking for it. The suggestion can still
       // change afterwards (an assigned-name rewrite, a lifecycle re-mint, a

package/src/core/hooks/resolve/owner.ts

@@ -144,29 +144,6 @@ function readPpid(pid: number): number | null {
   return null;
 }
 
-/**
- * Find the parent owner for a subagent invocation. The per-shell marker at
- * `.harnery/shells/<pid>` is set by `sub-agent-start` and removed by
- * `sub-agent-stop`.
- *
- * Phase 2 stub: the marker file isn't written yet, so we return null in most
- * cases. Phase 2 callers can pass through.
- */
-export function readShellMarker(coordRoot: string, pid: number): string | null {
-  const path = join(coordRoot, ".harnery", "shells", String(pid));
-  if (!existsSync(path)) return null;
-  try {
-    return readFileSync(path, "utf8").trim() || null;
-  } catch {
-    return null;
-  }
-}
-
-/** Read the V3-projected `agent_id` for an owner if it exists. */
-export function readAgentIdForOwner(coordRoot: string, instanceId: string): string | null {
-  return readLiveCoordinationRow(coordRoot, instanceId)?.agent_id ?? null;
-}
-
 /** Diagnostic: list of pid-map entries (for debugging). */
 export function listPidmap(coordRoot: string): Array<{ pid: number; owner: string }> {
   const dir = join(coordRoot, ".harnery", "pid-map");