patchwork-os 1.2.0-beta.2.canary.827 → 1.2.0-beta.2.canary.830

package/dist/recipeRoutes.js

@@ -40,7 +40,7 @@ import { respond500 } from "./httpErrorResponse.js";
 import { loadConfig as loadPatchworkConfig } from "./patchworkConfig.js";
 import { patchworkPath } from "./patchworkHome.js";
 import { summariseBoundaryReceipts } from "./privacy/boundaryReceipts.js";
-import { cancelRun } from "./recipes/runRegistry.js";
+import { cancelRunChecked } from "./recipes/runRegistry.js";
 import { invalidateRecipesCache } from "./recipesHttp.js";
 import { validateSafeUrl } from "./ssrfGuard.js";
 import { AmbiguousActionRefError } from "./workers/actionRef.js";
@@ -544,6 +544,57 @@ function fireOnRecipesChanged(deps) {
  *
  * Must be called AFTER bearer-auth — none of these routes are public.
  */
+/**
+ * The replay response, shared by `/runs/:seq/replay` and
+ * `/runs/by-task/:taskId/replay` so the two cannot drift.
+ */
+function writeReplayResult(res, result) {
+    if (result.error === "run_not_found") {
+        res.writeHead(404, { "Content-Type": "application/json" });
+    }
+    else if (result.error === "ambiguous_seq" ||
+        result.error?.startsWith("replay_refused_unmocked_step")) {
+        // 409 either way — a conflict with the evidence, not a server fault:
+        // `ambiguous_seq` means the seq names more than one run (body carries
+        // `taskIds`; replay by taskId instead); the replay boundary
+        // (src/recipes/replayBoundary.ts) means the original run lacks a usable
+        // capture, so nothing ran (body carries `unmockedSteps`).
+        res.writeHead(409, { "Content-Type": "application/json" });
+    }
+    else if (!result.ok) {
+        res.writeHead(500, { "Content-Type": "application/json" });
+    }
+    else {
+        res.writeHead(200, { "Content-Type": "application/json" });
+    }
+    res.end(JSON.stringify(result));
+}
+/** The dry-run plan for the recipe that produced `run`. Shared by seq/taskId routes. */
+async function writePlanForRun(res, deps, run) {
+    if (!run) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "run_not_found" }));
+        return;
+    }
+    if (!deps.runPlanFn) {
+        res.writeHead(503, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "plan_unavailable" }));
+        return;
+    }
+    // Guard: recipeName may be absent on runs created before the field was
+    // added (audit LOW #36). An unsafe cast + immediate .replace() would
+    // throw TypeError — return 404 instead.
+    if (!run.recipeName) {
+        res.writeHead(404, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "recipe_name_missing" }));
+        return;
+    }
+    // triggerSource appends ":agent" suffix — strip before file lookup
+    const recipeName = run.recipeName.replace(/:agent$/, "");
+    const plan = await deps.runPlanFn(recipeName);
+    res.writeHead(200, { "Content-Type": "application/json" });
+    res.end(JSON.stringify({ plan }));
+}
 export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
     const recipeNameRunMatch = req.method === "POST"
         ? /^\/recipes\/([^/]+)\/run$/.exec(parsedUrl.pathname)
@@ -1175,6 +1226,71 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         })();
         return true;
     }
+    // /runs/by-task/:taskId[/replay|/plan] — the same three operations as the
+    // seq routes below, addressed by the run's real identity. A seq is only
+    // unique per bridge (RecipeRunLog.getAllBySeq); a taskId names one run.
+    // The taskId is URL-encoded by the caller (it contains `:`).
+    const byTaskMatch = /^\/runs\/by-task\/([^/]+)(\/replay|\/plan)?$/.exec(parsedUrl.pathname);
+    if (byTaskMatch?.[1]) {
+        let taskId;
+        try {
+            taskId = decodeURIComponent(byTaskMatch[1]);
+        }
+        catch {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "invalid_task_id" }));
+            return true;
+        }
+        const op = byTaskMatch[2];
+        if (op === undefined && req.method === "GET") {
+            try {
+                const run = deps.runDetailByTaskFn?.(taskId) ?? null;
+                res.writeHead(run ? 200 : 404, { "Content-Type": "application/json" });
+                res.end(JSON.stringify(run ? { run } : { error: "not_found" }));
+            }
+            catch (err) {
+                respond500(res, err);
+            }
+            return true;
+        }
+        if (op === "/replay" && req.method === "POST") {
+            void (async () => {
+                try {
+                    if (!deps.runReplayByTaskFn) {
+                        res.writeHead(503, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "replay_unavailable" }));
+                        return;
+                    }
+                    writeReplayResult(res, await deps.runReplayByTaskFn(taskId));
+                }
+                catch (err) {
+                    respond500(res, err, "runs/by-task replay");
+                }
+            })();
+            return true;
+        }
+        if (op === "/plan" && req.method === "GET") {
+            void (async () => {
+                try {
+                    await writePlanForRun(res, deps, deps.runDetailByTaskFn?.(taskId) ?? null);
+                }
+                catch (err) {
+                    const code = err?.code;
+                    if (code === "ENOENT" || code === "RECIPE_NOT_FOUND") {
+                        res.writeHead(404, { "Content-Type": "application/json" });
+                        res.end(JSON.stringify({ error: "Run not found" }));
+                    }
+                    else {
+                        respond500(res, err, "runs/by-task plan");
+                    }
+                }
+            })();
+            return true;
+        }
+        res.writeHead(405, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ error: "method_not_allowed" }));
+        return true;
+    }
     // GET /runs/:seq — single run detail (includes stepResults if present)
     const runDetailMatch = req.method === "GET" ? /^\/runs\/(\d+)$/.exec(parsedUrl.pathname) : null;
     if (runDetailMatch?.[1]) {
@@ -1186,8 +1302,17 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                 res.end(JSON.stringify({ error: "not_found" }));
             }
             else {
+                // A seq can name several runs; this route shows the first it meets.
+                // Say so, with every candidate, so the page can offer a choice and
+                // link by taskId instead of silently showing a different run.
+                const sameSeq = deps.runsBySeqFn?.(seq) ?? [];
                 res.writeHead(200, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ run }));
+                res.end(JSON.stringify({
+                    run,
+                    ...(sameSeq.length > 1 && {
+                        sameSeqTaskIds: sameSeq.map((r) => r.taskId),
+                    }),
+                }));
             }
         }
         catch (err) {
@@ -1213,24 +1338,7 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
                     res.end(JSON.stringify({ error: "replay_unavailable" }));
                     return;
                 }
-                const result = await deps.runReplayFn(seq);
-                if (result.error === "run_not_found") {
-                    res.writeHead(404, { "Content-Type": "application/json" });
-                }
-                else if (result.error?.startsWith("replay_refused_unmocked_step")) {
-                    // Replay boundary (src/recipes/replayBoundary.ts): the original
-                    // run lacks a usable capture for one or more steps, so the replay
-                    // was refused before anything ran. A conflict with the evidence,
-                    // not a server fault — body carries `unmockedSteps`.
-                    res.writeHead(409, { "Content-Type": "application/json" });
-                }
-                else if (!result.ok) {
-                    res.writeHead(500, { "Content-Type": "application/json" });
-                }
-                else {
-                    res.writeHead(200, { "Content-Type": "application/json" });
-                }
-                res.end(JSON.stringify(result));
+                writeReplayResult(res, await deps.runReplayFn(seq));
             }
             catch (err) {
                 respond500(res, err, "runs/:seq detail");
@@ -1248,12 +1356,39 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         : null;
     if (runCancelMatch?.[1]) {
         const seq = Number.parseInt(runCancelMatch[1], 10);
+        const taskId = parsedUrl.searchParams.get("taskId") ?? undefined;
         try {
-            const cancelled = cancelRun(seq);
-            res.writeHead(cancelled ? 200 : 404, {
+            // `seq` is not unique across the bridges sharing one run log. Without a
+            // `taskId`, a number that names more than one RUNNING run cannot say
+            // which run the caller meant, so refuse rather than abort whichever run
+            // this process registered under it.
+            if (taskId === undefined && deps.runsBySeqFn) {
+                const running = deps
+                    .runsBySeqFn(seq)
+                    .filter((r) => r.status === "running");
+                if (running.length > 1) {
+                    res.writeHead(409, { "Content-Type": "application/json" });
+                    res.end(JSON.stringify({
+                        cancelled: false,
+                        seq,
+                        error: "ambiguous_seq",
+                        taskIds: running.map((r) => r.taskId),
+                    }));
+                    return true;
+                }
+            }
+            const outcome = cancelRunChecked(seq, {
+                ...(taskId !== undefined && { taskId }),
+            });
+            const cancelled = outcome === "cancelled";
+            res.writeHead(cancelled ? 200 : outcome === "task_mismatch" ? 409 : 404, {
                 "Content-Type": "application/json",
             });
-            res.end(JSON.stringify({ cancelled, seq }));
+            res.end(JSON.stringify({
+                cancelled,
+                seq,
+                ...(outcome === "task_mismatch" && { error: "task_mismatch" }),
+            }));
         }
         catch (err) {
             respond500(res, err, "runs/:seq/cancel");
@@ -1268,30 +1403,7 @@ export function tryHandleRecipeRoute(req, res, parsedUrl, deps) {
         const seq = Number.parseInt(runPlanMatch[1], 10);
         void (async () => {
             try {
-                const run = deps.runDetailFn?.(seq) ?? null;
-                if (!run) {
-                    res.writeHead(404, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "run_not_found" }));
-                    return;
-                }
-                if (!deps.runPlanFn) {
-                    res.writeHead(503, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "plan_unavailable" }));
-                    return;
-                }
-                // Guard: recipeName may be absent on runs created before the field was
-                // added (audit LOW #36). An unsafe cast + immediate .replace() would
-                // throw TypeError — return 404 instead.
-                if (!run.recipeName) {
-                    res.writeHead(404, { "Content-Type": "application/json" });
-                    res.end(JSON.stringify({ error: "recipe_name_missing" }));
-                    return;
-                }
-                // triggerSource appends ":agent" suffix — strip before file lookup
-                const recipeName = run.recipeName.replace(/:agent$/, "");
-                const plan = await deps.runPlanFn(recipeName);
-                res.writeHead(200, { "Content-Type": "application/json" });
-                res.end(JSON.stringify({ plan }));
+                await writePlanForRun(res, deps, deps.runDetailFn?.(seq) ?? null);
             }
             catch (err) {
                 // #605: classify by error code, not message substring.