pi-subagents 0.69.0 → 0.70.0

package/src/workflows/chat-progress.ts

@@ -1,152 +0,0 @@
-import { spawnSync } from "node:child_process";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import type { Details, WorkflowPreflightLane, WorkflowPreflight } from "../shared/types.ts";
-import { workflowPreflightLaneForRuntimeKey } from "./workflow-preflight.ts";
-
-export const WORKFLOW_CHAT_PROGRESS_MODES = ["auto", "off", "live-card"] as const;
-export type WorkflowChatProgressMode = typeof WORKFLOW_CHAT_PROGRESS_MODES[number];
-export type ResolvedWorkflowChatProgressMode = Exclude<WorkflowChatProgressMode, "auto">;
-
-export interface GitRepositoryIdentity {
-	root: string;
-	commonDir: string;
-}
-
-export interface WorkflowChatProgressProjection {
-	mode: ResolvedWorkflowChatProgressMode;
-	repoRelation: "same" | "other";
-	repoLabel?: string;
-}
-
-interface ResolveWorkflowChatProgressInput {
-	requested: unknown;
-	parentCwd: string;
-	workflowCwd: string;
-	background: boolean;
-}
-
-function git(cwd: string, args: string[]): string | undefined {
-	const result = spawnSync("git", ["-C", cwd, ...args], { encoding: "utf-8", windowsHide: true });
-	if (result.status !== 0) return undefined;
-	const output = result.stdout.trim();
-	return output || undefined;
-}
-
-function realPath(value: string): string {
-	try {
-		return fs.realpathSync.native(value);
-	} catch {
-		return path.resolve(value);
-	}
-}
-
-export function resolveGitRepositoryIdentity(cwd: string): GitRepositoryIdentity | undefined {
-	if (git(cwd, ["rev-parse", "--is-inside-work-tree"]) !== "true") return undefined;
-	const root = git(cwd, ["rev-parse", "--show-toplevel"]);
-	const commonDir = git(cwd, ["rev-parse", "--git-common-dir"]);
-	if (!root || !commonDir) return undefined;
-	const commonDirPath = path.isAbsolute(commonDir)
-		? commonDir
-		: [path.resolve(cwd, commonDir), path.resolve(root, commonDir)].find((candidate) => fs.existsSync(candidate)) ?? path.resolve(root, commonDir);
-	return {
-		root: realPath(root),
-		commonDir: realPath(commonDirPath),
-	};
-}
-
-function isSameGitRepositoryIdentity(left: GitRepositoryIdentity | undefined, right: GitRepositoryIdentity | undefined): boolean {
-	if (!left || !right) return false;
-	return left.commonDir === right.commonDir || left.root === right.root;
-}
-
-export function isSameGitRepository(leftCwd: string, rightCwd: string): boolean {
-	return isSameGitRepositoryIdentity(resolveGitRepositoryIdentity(leftCwd), resolveGitRepositoryIdentity(rightCwd));
-}
-
-function normalizeRequestedMode(value: unknown): { mode?: WorkflowChatProgressMode; error?: string } {
-	if (value === undefined) return { mode: "auto" };
-	if (typeof value !== "string" || !WORKFLOW_CHAT_PROGRESS_MODES.includes(value as WorkflowChatProgressMode)) {
-		return { error: `chatProgress must be one of: ${WORKFLOW_CHAT_PROGRESS_MODES.join(", ")}.` };
-	}
-	return { mode: value as WorkflowChatProgressMode };
-}
-
-export function resolveWorkflowChatProgress(input: ResolveWorkflowChatProgressInput): { projection?: WorkflowChatProgressProjection; error?: string } {
-	const requested = normalizeRequestedMode(input.requested);
-	if (requested.error) return { error: requested.error };
-	const parentIdentity = resolveGitRepositoryIdentity(input.parentCwd);
-	const workflowIdentity = resolveGitRepositoryIdentity(input.workflowCwd);
-	const sameRepo = !!(
-		parentIdentity
-		&& workflowIdentity
-		&& (parentIdentity.commonDir === workflowIdentity.commonDir || parentIdentity.root === workflowIdentity.root)
-	);
-	const repoLabel = workflowIdentity ? path.basename(workflowIdentity.root) : undefined;
-	const repoRelation = sameRepo ? "same" : "other";
-
-	const requestedMode = requested.mode ?? "auto";
-	let mode: ResolvedWorkflowChatProgressMode;
-	if (requestedMode === "auto") mode = sameRepo && !input.background ? "live-card" : "off";
-	else mode = requestedMode;
-
-	if (mode === "live-card" && !sameRepo) return { error: "chatProgress: 'live-card' is only available for workflowScript runs in the same Git repository." };
-	if (mode === "live-card" && input.background) return { error: "chatProgress: 'live-card' is unavailable for async workflowScript. Async workflows have no inline live card; omit chatProgress or use auto/off. Use async:false only when the parent must block." };
-	return { projection: { mode, repoRelation, ...(repoLabel ? { repoLabel } : {}) } };
-}
-
-export interface WorkflowChatProgressRow {
-	key: string;
-	state: "planned" | "running" | "complete" | "failed" | "detached" | "stopped";
-	label?: string;
-	phase?: string;
-	runId?: string;
-	durationMs?: number;
-	error?: string;
-	preflight?: WorkflowPreflightLane;
-}
-
-function cleanLabel(value: unknown): string | undefined {
-	return typeof value === "string" && value.trim() ? value.trim() : undefined;
-}
-
-export function buildWorkflowChatProgressRows(trace: NonNullable<Details["workflow"]>["trace"], preflight?: WorkflowPreflight): WorkflowChatProgressRow[] {
-	const rows = new Map<string, WorkflowChatProgressRow>();
-	for (const entry of trace) {
-		if (entry.operation !== "run") continue;
-		const existing = rows.get(entry.key);
-		if (entry.state === "reused") {
-			if (existing) {
-				const label = cleanLabel(entry.label);
-				const phase = cleanLabel(entry.phase);
-				if (label) existing.label = label;
-				if (phase) existing.phase = phase;
-			}
-			continue;
-		}
-		const lane = workflowPreflightLaneForRuntimeKey(preflight, entry.key, [entry.generatedLaneKey]);
-		const next: WorkflowChatProgressRow = existing ?? { key: entry.key, state: "running" };
-		if (lane && !next.preflight) next.preflight = lane;
-		next.state = entry.state === "completed"
-			? "complete"
-			: entry.state === "failed"
-				? "failed"
-				: entry.state === "detached"
-					? "detached"
-					: entry.state === "stopped"
-						? "stopped"
-						: "running";
-		const label = cleanLabel(entry.label);
-		const phase = cleanLabel(entry.phase);
-		if (label) next.label = label;
-		if (phase) next.phase = phase;
-		if (entry.runId === undefined) delete next.runId;
-		else next.runId = entry.runId;
-		if (entry.durationMs === undefined) delete next.durationMs;
-		else next.durationMs = entry.durationMs;
-		if (entry.error === undefined) delete next.error;
-		else next.error = entry.error;
-		rows.set(entry.key, next);
-	}
-	return [...rows.values()];
-}

package/src/workflows/host-command.ts

@@ -1,235 +0,0 @@
-import { spawn } from "node:child_process";
-import { randomUUID } from "node:crypto";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { quoteExecutableForShell } from "../runs/shared/acceptance.ts";
-import { createOwnedProcessTreeController, type OwnedProcessTreeController } from "../runs/background/owned-process-tree.ts";
-import { resolveSingleOutputClaimPath } from "../runs/shared/single-output.ts";
-import { DEFAULT_FILE_SYSTEM_RETRY_DELAYS_MS, runFileSystemOperationWithRetry } from "../shared/file-system-retry.ts";
-
-const MAX_COMMAND_BYTES = 16 * 1024;
-const MAX_OUTPUT_PATH_BYTES = 240;
-const MAX_CAPTURE_BYTES = 1024 * 1024;
-const MAX_PREVIEW_BYTES = 4 * 1024;
-const MAX_TIMEOUT_MS = 24 * 60 * 60 * 1000;
-
-export interface WorkflowHostCommandParams {
-	kind: "command";
-	command: string;
-	timeoutMs: number;
-	output?: string;
-	role?: "ci" | "gate";
-	provider?: string;
-}
-
-export interface WorkflowHostCommandResult {
-	key: string;
-	kind: "command";
-	ok: boolean;
-	state: "passed" | "failed" | "timed-out" | "stopped";
-	exitCode: number | null;
-	stdout: string;
-	stderr: string;
-	outputPath: string;
-	durationMs: number;
-	error?: string;
-}
-
-type ProcessTreeTerminal = Awaited<ReturnType<OwnedProcessTreeController["terminate"]>>;
-type ProcessTreeCleanup = ProcessTreeTerminal | { state: "unknown"; reason: "missing-process-id" };
-
-function byteLength(value: string): number {
-	return Buffer.byteLength(value, "utf8");
-}
-
-function boundedText(value: string, maxBytes: number): string {
-	if (byteLength(value) <= maxBytes) return value;
-	let end = Math.max(0, maxBytes - 3);
-	while (end > 0 && byteLength(value.slice(0, end)) > maxBytes - 3) end -= 1;
-	return `${value.slice(0, end)}...`;
-}
-
-export function normalizeWorkflowHostCommandParams(value: unknown, label = "runs.host params"): WorkflowHostCommandParams {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object.`);
-	const params = value as Record<string, unknown>;
-	const unknownFields = Object.keys(params).filter((field) => !["kind", "command", "timeoutMs", "output", "role", "provider"].includes(field));
-	if (unknownFields.length) {
-		const cwdHint = unknownFields.includes("cwd")
-			? " The host step does not accept per-step cwd; commands and relative output paths use the workflow cwd. Set cwd on the outer subagent request, or put a trusted directory change in command (for example, 'cd /path/to/worktree && npm test')."
-			: "";
-		throw new Error(`${label} has unsupported fields: ${unknownFields.join(", ")}.${cwdHint}`);
-	}
-	if (params.kind !== "command") throw new Error(`${label}.kind must be 'command'.`);
-	if (typeof params.command !== "string" || !params.command.trim()) throw new Error(`${label}.command must be a non-empty string.`);
-	const command = params.command.trim();
-	if (byteLength(command) > MAX_COMMAND_BYTES || /[\u0000]/.test(command)) throw new Error(`${label}.command exceeds the ${MAX_COMMAND_BYTES}-byte limit or contains NUL.`);
-	if (typeof params.timeoutMs !== "number" || !Number.isInteger(params.timeoutMs) || params.timeoutMs < 1 || params.timeoutMs > MAX_TIMEOUT_MS) throw new Error(`${label}.timeoutMs must be an integer from 1 to ${MAX_TIMEOUT_MS}.`);
-	let output: string | undefined;
-	if (params.output !== undefined) {
-		if (typeof params.output !== "string" || !params.output.trim()) throw new Error(`${label}.output must be a non-empty relative path.`);
-		output = params.output.trim();
-		if (path.isAbsolute(output) || output.split(/[\\/]/).includes("..") || /[\u0000-\u001f\u007f]/.test(output) || byteLength(output) > MAX_OUTPUT_PATH_BYTES) throw new Error(`${label}.output must be a bounded relative path without traversal or control characters.`);
-	}
-	if (params.role !== undefined && params.role !== "ci" && params.role !== "gate") throw new Error(`${label}.role must be 'ci' or 'gate'.`);
-	let provider: string | undefined;
-	if (params.provider !== undefined) {
-		if (typeof params.provider !== "string" || !params.provider.trim() || /[\r\n\u0000]/.test(params.provider) || byteLength(params.provider.trim()) > 64) throw new Error(`${label}.provider must be a non-empty single-line string of at most 64 bytes.`);
-		provider = params.provider.trim();
-	}
-	return {
-		kind: "command",
-		command,
-		timeoutMs: params.timeoutMs,
-		...(output ? { output } : {}),
-		...(params.role ? { role: params.role } : {}),
-		...(provider ? { provider } : {}),
-	};
-}
-
-function appendBounded(current: string, chunk: Buffer, limit: number): string {
-	if (byteLength(current) >= limit) return current;
-	return boundedText(current + chunk.toString("utf8"), limit);
-}
-
-export function resolveWorkflowHostOutputClaimPath(outputPath: string): string {
-	return resolveSingleOutputClaimPath(outputPath);
-}
-
-function assertSafeExplicitOutput(cwd: string, outputPath: string, key: string): string {
-	const root = fs.realpathSync(cwd);
-	const outputParent = path.dirname(outputPath);
-	let existingParent = outputParent;
-	while (!fs.existsSync(existingParent)) existingParent = path.dirname(existingParent);
-	const existingParentReal = fs.realpathSync(existingParent);
-	const existingRelative = path.relative(root, existingParentReal);
-	if (existingRelative === ".." || existingRelative.startsWith(`..${path.sep}`) || path.isAbsolute(existingRelative)) throw new Error(`runs.host('${key}') output resolves outside the workflow cwd.`);
-	fs.mkdirSync(outputParent, { recursive: true });
-	const parent = fs.realpathSync(outputParent);
-	const relative = path.relative(root, parent);
-	if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) throw new Error(`runs.host('${key}') output resolves outside the workflow cwd.`);
-	try {
-		const stat = fs.lstatSync(outputPath);
-		if (!stat.isFile() || stat.nlink > 1) throw new Error(`runs.host('${key}') output must be a regular, non-linked file path.`);
-	} catch (error) {
-		if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
-	}
-	return parent;
-}
-
-function writeExplicitOutput(outputParent: string, outputPath: string, capture: string, key: string): void {
-	const destination = path.join(outputParent, path.basename(outputPath));
-	const temporaryPath = path.join(outputParent, `.pi-host-output-${process.pid}-${randomUUID()}.tmp`);
-	let descriptor: number | undefined;
-	try {
-		descriptor = fs.openSync(temporaryPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 0o600);
-		fs.writeFileSync(descriptor, capture, { encoding: "utf8" });
-		fs.closeSync(descriptor);
-		descriptor = undefined;
-		fs.chmodSync(temporaryPath, 0o600);
-		runFileSystemOperationWithRetry(() => fs.renameSync(temporaryPath, destination), {
-			retryDelaysMs: process.platform === "win32" ? DEFAULT_FILE_SYSTEM_RETRY_DELAYS_MS : [],
-		});
-	} catch (error) {
-		throw new Error(`runs.host('${key}') could not atomically replace its output.`, { cause: error instanceof Error ? error : undefined });
-	} finally {
-		if (descriptor !== undefined) fs.closeSync(descriptor);
-		try {
-			fs.unlinkSync(temporaryPath);
-		} catch (error) {
-			if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
-		}
-	}
-}
-
-function terminateProcessTree(pid: number, controller: OwnedProcessTreeController): Promise<ProcessTreeTerminal> {
-	if (process.platform !== "win32") return controller.terminate();
-	return new Promise<ProcessTreeTerminal>((resolve) => {
-		const cleanup = spawn("taskkill", ["/PID", String(pid), "/T", "/F"], { stdio: "ignore", windowsHide: true });
-		cleanup.once("error", () => { void controller.terminate().then(resolve); });
-		cleanup.once("close", () => { void controller.terminate().then(resolve); });
-	});
-}
-
-export async function executeWorkflowHostCommand(input: {
-	key: string;
-	params: WorkflowHostCommandParams;
-	cwd: string;
-	defaultOutputPath: string;
-	claimedOutputPath?: string;
-	signal: AbortSignal;
-}): Promise<WorkflowHostCommandResult> {
-	const outputPath = input.params.output ? path.resolve(input.cwd, input.params.output) : input.defaultOutputPath;
-	const relative = path.relative(input.cwd, outputPath);
-	if (input.params.output && (relative === "" || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))) throw new Error(`runs.host('${input.key}') output escapes the workflow cwd.`);
-	const explicitOutputParent = input.params.output ? assertSafeExplicitOutput(input.cwd, outputPath, input.key) : undefined;
-	if (!input.params.output) fs.mkdirSync(path.dirname(outputPath), { recursive: true });
-	const startedAt = Date.now();
-	let stdout = "";
-	let stderr = "";
-	let capture = "";
-	let timedOut = false;
-	let stopped = false;
-	let settled = false;
-
-	return new Promise((resolve, reject) => {
-		const child = spawn(quoteExecutableForShell(input.params.command), {
-			cwd: input.cwd,
-			env: process.env,
-			shell: true,
-			stdio: ["ignore", "pipe", "pipe"],
-			windowsHide: true,
-			detached: process.platform !== "win32",
-		});
-		const processTree = typeof child.pid === "number" ? createOwnedProcessTreeController(child.pid, { termGraceMs: 1_000 }) : undefined;
-		let termination: Promise<ProcessTreeCleanup> | undefined;
-		const terminate = (reason: "timeout" | "abort") => {
-			if (settled) return;
-			timedOut = reason === "timeout";
-			stopped = reason === "abort";
-			if (processTree && child.pid !== undefined) termination ??= terminateProcessTree(child.pid, processTree);
-			else {
-				child.kill("SIGTERM");
-				termination ??= Promise.resolve({ state: "unknown", reason: "missing-process-id" });
-			}
-		};
-		const timeout = setTimeout(() => terminate("timeout"), input.params.timeoutMs);
-		timeout.unref?.();
-		const onAbort = () => terminate("abort");
-		if (input.signal.aborted) onAbort();
-		else input.signal.addEventListener("abort", onAbort, { once: true });
-		child.stdout.on("data", (chunk: Buffer) => {
-			stdout = appendBounded(stdout, chunk, MAX_PREVIEW_BYTES);
-			capture = appendBounded(capture, chunk, MAX_CAPTURE_BYTES);
-		});
-		child.stderr.on("data", (chunk: Buffer) => {
-			stderr = appendBounded(stderr, chunk, MAX_PREVIEW_BYTES);
-			capture = appendBounded(capture, chunk, MAX_CAPTURE_BYTES);
-		});
-		const finish = async (exitCode: number | null, spawnError?: unknown) => {
-			if (settled) return;
-			settled = true;
-			clearTimeout(timeout);
-			input.signal.removeEventListener("abort", onAbort);
-			const terminal = termination ? await termination : await processTree?.finishAfterWriterClose();
-			const cleanupError = process.platform !== "win32" && terminal?.state === "unknown" ? terminal.reason : undefined;
-			const state = timedOut ? "timed-out" : stopped ? "stopped" : exitCode === 0 && !spawnError && !cleanupError ? "passed" : "failed";
-			const error = spawnError instanceof Error ? spawnError.message : spawnError ? String(spawnError) : cleanupError ? `Process-tree cleanup failed: ${cleanupError}.` : state === "timed-out" ? `Command timed out after ${input.params.timeoutMs}ms.` : state === "stopped" ? "Command stopped because the workflow was aborted." : state === "failed" ? `Command exited with code ${exitCode ?? "unknown"}.` : undefined;
-			try {
-				if (input.claimedOutputPath && resolveWorkflowHostOutputClaimPath(outputPath) !== input.claimedOutputPath) throw new Error(`output path changed after it was claimed.`);
-				if (explicitOutputParent) {
-					const currentParent = assertSafeExplicitOutput(input.cwd, outputPath, input.key);
-					if (currentParent !== explicitOutputParent) throw new Error(`output parent changed while the command was running.`);
-					writeExplicitOutput(explicitOutputParent, outputPath, capture, input.key);
-				} else {
-					fs.writeFileSync(outputPath, capture, { encoding: "utf8", mode: 0o600 });
-				}
-			} catch (writeError) {
-				reject(new Error(`runs.host('${input.key}') could not save command output: ${writeError instanceof Error ? writeError.message : String(writeError)}`, { cause: writeError instanceof Error ? writeError : undefined }));
-				return;
-			}
-			resolve({ key: input.key, kind: "command", ok: state === "passed", state, exitCode, stdout, stderr, outputPath, durationMs: Date.now() - startedAt, ...(error ? { error } : {}) });
-		};
-		child.on("close", (code) => { void finish(code); });
-		child.on("error", (error) => { void finish(null, error); });
-	});
-}