oysterun 1.6.0-beta.2 → 1.6.0-beta.21

package/host-service/lifecycle-continuity-runner.mjs

@@ -0,0 +1,192 @@
+import {
+  CONTINUITY_STATES, advanceContinuity, continuityDigest, continuityFailure, readContinuity, qualifyContinuityHost,
+  qualifyContinuityRestoreResult, qualifyContinuitySessions, qualifyContinuityTunnel,
+  recordContinuityRosterPending,
+} from "./lifecycle-continuity.mjs";
+import { fetchContinuityObservation } from "./lifecycle-continuity-probe.mjs";
+import { lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+export function resolveContinuityQualificationOrigin({
+  connectionMode,
+  managedEndpoint,
+  directHostUrl,
+  loopbackOrigin,
+}) {
+  // Old receipts did not retain connection_mode. Keep their Managed-first
+  // interpretation so a later Direct login cannot rewrite their authority.
+  // New receipts bind the selected runtime route explicitly: a dormant
+  // Managed endpoint remains identity metadata while Direct mode is active.
+  const retainedRoute = connectionMode === "direct"
+    ? directHostUrl
+    : managedEndpoint || directHostUrl;
+  const retainedOrigin = retainedRoute ? new URL(retainedRoute).origin : null;
+  if (!retainedOrigin) return loopbackOrigin;
+  const retainedUrl = new URL(retainedOrigin);
+  return retainedUrl.protocol === "https:" ||
+    ["127.0.0.1", "localhost", "[::1]"].includes(retainedUrl.hostname)
+    ? retainedOrigin
+    : loopbackOrigin;
+}
+
+// beta.9 did not store the room or adapter declaration in its outer-v1
+// baseline. Its committed anchor must still resolve in the retained binding,
+// or an empty Session must retain its exact deterministic Host-to-room binding,
+// before the target may attach the room to this read-only legacy observation.
+function qualifyLegacyObservation(rows, peer, configDir) {
+  if (rows.every((row) => row.matrix_room_id && row.adapter_resume_identity_kind)) return rows;
+  const bindingPath = join(configDir, "routec-matrix-bindings.json");
+  let bindings;
+  try {
+    const stat = lstatSync(bindingPath);
+    if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 8 * 1024 * 1024) return rows;
+    bindings = JSON.parse(readFileSync(bindingPath, "utf8"));
+    if (!bindings || typeof bindings !== "object" || Array.isArray(bindings)) return rows;
+  } catch { return rows; }
+  return rows.map((row) => {
+    if (row.matrix_room_id && row.adapter_resume_identity_kind) return row;
+    const after = peer.find((candidate) => candidate.session_id === row.session_id);
+    const binding = bindings[row.session_id];
+    const anchors = row.history_anchors;
+    const anchored = Array.isArray(anchors) && anchors.length > 0 &&
+      anchors.every((anchor) => after?.history_anchors?.some((candidate) =>
+        candidate.event_id === anchor.event_id && candidate.sha256 === anchor.sha256));
+    const emptyDeterministic = Array.isArray(anchors) && anchors.length === 0 &&
+      Array.isArray(after?.history_anchors) && after.history_anchors.length === 0 &&
+      binding?.binding_source === "host_session_id_deterministic_room" &&
+      binding.matrix_room_id === `!oysterun-routec-${row.session_id}:oysterun.local`;
+    if (!after || !binding || binding.host_session_id !== row.session_id ||
+      !["codex", "claude", "xai"].includes(row.provider) ||
+      row.provider !== after.provider || !(anchored || emptyDeterministic)) return row;
+    return { ...row, matrix_binding_host_session_id: binding.host_session_id,
+      matrix_room_id: binding.matrix_room_id, adapter_resume_identity_kind: "provider_metadata",
+      adapter_registered: true };
+  });
+}
+
+/** Shared qualification used by the existing runner and the one-time adapter.
+ * Observations are live authenticated reads; the retained baseline is never
+ * replaced by a new observation after a restart or a failed qualification.
+ */
+export async function qualifyLifecycleContinuity({
+  path, operationId, configDir, healthUrl, version, definitionDigest,
+  rollback = false, requireRestore = true, restartId = null,
+  timeoutMs = 180_000, onStage = () => {}, observe = fetchContinuityObservation,
+}) {
+  const receipt = readContinuity(path, operationId);
+  const baseline = receipt.baseline;
+  const loopbackOrigin = new URL(healthUrl).origin;
+  // Fixed/local task stacks legitimately have no public route configured.
+  // Their retained user route is the exact loopback health origin selected by
+  // the canonical lifecycle command; it still receives the same authenticated
+  // user-path, Host, Session and history qualification below.
+  // The lifecycle grant is a privileged one-operation credential. Never send
+  // it to a configured plaintext Direct URL: qualify the same Host through
+  // the retained loopback listener instead. HTTPS Managed/Direct routes keep
+  // their normal authenticated user-path qualification.
+  const expectedOrigin = resolveContinuityQualificationOrigin({
+    connectionMode: baseline.host.connection_mode,
+    managedEndpoint: baseline.host.managed_endpoint,
+    directHostUrl: baseline.host.direct_host_url,
+    loopbackOrigin,
+  });
+  const result = {};
+  const advance = (stage, proof) => {
+    if (rollback) return;
+    const current = readContinuity(path, operationId);
+    if (CONTINUITY_STATES.indexOf(current.state) < CONTINUITY_STATES.indexOf(stage)) {
+      advanceContinuity(path, operationId, stage, proof);
+    }
+  };
+  const waitFor = async (stage, callback) => {
+    await onStage(stage);
+    const deadline = Date.now() + timeoutMs;
+    let failure;
+    do {
+      try { return await callback(); } catch (error) {
+        failure = error;
+        // Identity, lost history, explicit failed/skipped restores and changed
+        // resume IDs cannot be repaired by waiting. Provider boot and route
+        // readiness may be transient.
+        const transient = error.transient === true || new Set([
+          "p233_runtime_not_ready", "p233_http_status", "p233_authenticated_path",
+          "p233_restart_not_consumed", "p233_user_path_pending",
+        ]).has(error.code) || ["TypeError", "TimeoutError", "AbortError"].includes(error.name);
+        if (!transient) throw error;
+        if (Date.now() < deadline) await new Promise((resolve) => setTimeout(resolve, Math.min(1000, deadline - Date.now())));
+      }
+    } while (Date.now() < deadline);
+    throw failure;
+  };
+  const local = () => observe({ configDir, operationId, origin: loopbackOrigin });
+  const checkHost = (observation) => {
+    const proof = qualifyContinuityHost(baseline.host, observation.host, {
+      version, runtimeIdentityDigest: receipt.source.runtime_identity_digest,
+      expectNewPid: requireRestore, definitionDigest,
+    });
+    if (result.host && proof.pid !== result.host.pid) throw continuityFailure("host_qualification", "qualification_pid_changed", "Host PID changed during qualification; retain recovery assets.");
+    return proof;
+  };
+  const checkSessions = (observation) => {
+    if (requireRestore && (observation.restart_state !== "consumed" || observation.restart_id !== restartId)) {
+      throw continuityFailure("session_qualification", "restart_not_consumed", "Waiting for the exact fresh Session restore receipt.");
+    }
+    const source = qualifyLegacyObservation(baseline.sessions, observation.sessions, configDir);
+    const target = qualifyLegacyObservation(observation.sessions, source, configDir);
+    if (requireRestore && source.length > target.length) {
+      const expectedIds = new Set(source.map((row) => row.session_id));
+      const observedIds = target.map((row) => row.session_id);
+      const observedIsExpectedSubset = new Set(observedIds).size === observedIds.length &&
+        observedIds.every((sessionId) => expectedIds.has(sessionId));
+      if (observedIsExpectedSubset) {
+        const restoreResult = observation.restore_result?.session_restore;
+        // Failed/skipped or unproved restores are terminal even while another
+        // provider runtime is still becoming observable.
+        qualifyContinuityRestoreResult(source, restoreResult);
+        recordContinuityRosterPending(source, target, { path, operationId });
+        // Validate every already-observable Session before waiting for the
+        // absent runtime. Identity, room, history or observation errors fail
+        // immediately instead of being hidden by the partial roster.
+        const presentSource = target.map((row) => source.find((candidate) =>
+          candidate.session_id === row.session_id));
+        qualifyContinuitySessions(presentSource, target, restoreResult,
+          { requireRestore, path, operationId });
+        const waiting = continuityFailure("session_qualification", "roster_changed",
+          "Waiting for every receipt-restored Session to become observable and ready.");
+        waiting.transient = true;
+        throw waiting;
+      }
+    }
+    return qualifyContinuitySessions(source, target,
+      observation.restore_result?.session_restore, { requireRestore, path, operationId });
+  };
+  result.host = await waitFor("HOST_QUALIFIED", async () => checkHost(await local()));
+  advance("HOST_QUALIFIED", result.host);
+  result.sessions = await waitFor("SESSIONS_QUALIFIED", async () => {
+    const observation = await local();
+    checkHost(observation);
+    return checkSessions(observation);
+  });
+  advance("SESSIONS_QUALIFIED", result.sessions);
+  result.tunnel = await waitFor("TUNNEL_QUALIFIED", async () => {
+    const observation = await observe({ configDir, operationId, origin: expectedOrigin });
+    // A provider can exit during transport qualification. Commit only a fresh
+    // observation that still proves the same Host and complete live Sessions.
+    const freshHost = checkHost(observation);
+    const freshSessions = checkSessions(observation);
+    // The scoped route probe proves transport and Host identity; a real
+    // dashboard-authenticated request on that origin proves the normal user
+    // path separately. Waiting for a person is not part of mutation completion.
+    return {
+      ...qualifyContinuityTunnel({ origin: expectedOrigin, device_id: baseline.host.device_id, operation_id: operationId }, observation.route),
+      requalified_at: new Date().toISOString(), host: freshHost, sessions: freshSessions,
+      history_anchors_digest: continuityDigest(observation.sessions.map(row => ({
+        session_id: row.session_id, history_anchors: row.history_anchors,
+      }))),
+      authenticated_user_path: observation.authenticated_user_path?.pid === freshHost.pid
+        ? observation.authenticated_user_path : null,
+    };
+  });
+  advance("TUNNEL_QUALIFIED", result.tunnel);
+  return result;
+}