presubmit 0.1.0

package/dist/apps/server/src/child-sessions.js

@@ -0,0 +1,191 @@
+import { randomUUID } from 'node:crypto';
+import { childCollaborationGuidance } from './child-collaboration-guidance.js';
+import { childSessionLimits, } from '../../../packages/protocol/src/child-sessions.js';
+/** Project-owned durable intents; per-child receipts provide cross-store exactly-once acceptance. */
+export function createChildSessions(options) {
+    const intents = options.store.get('ordinaryChildStarts') ?? [];
+    const pending = new Map();
+    const reports = options.store.get('ordinaryChildReports') ?? [];
+    const saveReports = () => options.store.put('ordinaryChildReports', reports);
+    function enqueueReport(parentId, id, text) {
+        if (reports.some((r) => r.id === id))
+            return;
+        reports.push({ parentId, id, text, delivered: false });
+        saveReports();
+    }
+    const owner = (id) => `child:${options.store.directory}:${id}`;
+    const save = () => options.store.put('ordinaryChildStarts', intents);
+    function lineage(sourceId) {
+        const summaries = options.summaries();
+        let current = summaries.find((s) => s.id === sourceId);
+        let depth = 0;
+        const seen = new Set();
+        while (current) {
+            if (current.assignment)
+                throw new Error('Approved task attempts cannot start ordinary children. Ask the coordinator.');
+            if (seen.has(current.id))
+                throw new Error('Invalid session lineage.');
+            seen.add(current.id);
+            if (!current.parentSessionId)
+                return { rootId: current.id, depth };
+            depth++;
+            current = summaries.find((s) => s.id === current.parentSessionId);
+        }
+        throw new Error('Parent session is unavailable.');
+    }
+    function acquire(id) {
+        const intent = intents.find((i) => i.launch.destinationId === id);
+        if (!intent)
+            return;
+        if (!options.capacity.acquire(owner(id), `${options.store.directory}:${intent.sourceId}`))
+            throw new Error(`Child capacity is full (${options.capacity.limit} active children per parent session). Wait for a child or task to finish, then retry the same requestKey.`);
+    }
+    async function start(sourceId, key, fingerprint, launch, validate) {
+        validate();
+        const { rootId, depth } = lineage(sourceId);
+        let intent = intents.find((i) => i.sourceId === sourceId && i.key === key);
+        if (intent && intent.fingerprint !== fingerprint)
+            throw new Error('requestKey already belongs to different child instructions. Reuse the original request or choose a new key for genuinely new work.');
+        if (intent?.accepted)
+            return intent.launch.destinationId;
+        const pendingKey = `${sourceId}:${key}`;
+        if (pending.has(pendingKey))
+            return pending.get(pendingKey);
+        if (!intent) {
+            if (depth >= childSessionLimits.depth)
+                throw new Error('Child nesting limit reached (maximum depth 2). Complete this work here or ask the direct parent.');
+            if (intents.filter((i) => i.rootId === rootId).length >= childSessionLimits.totalSpawns)
+                throw new Error('Root tree spawn budget exhausted (8 total children, including failed starts). Continue in an existing session.');
+            // Reserve capacity before writing a new durable spawn; limits never consume a spawn.
+            launch.destinationId = randomUUID();
+            if (!options.capacity.acquire(owner(launch.destinationId), `${options.store.directory}:${sourceId}`))
+                throw new Error(`Child capacity is full (${options.capacity.limit} active children per parent session). Wait and retry the same requestKey.`);
+            intent = {
+                sourceId,
+                rootId,
+                key,
+                fingerprint,
+                launch,
+                accepted: false,
+                error: 'Handoff was interrupted before acceptance. Retry the original requestKey.',
+            };
+            intents.push(intent);
+            save();
+        }
+        const saved = intent;
+        const operation = (async () => {
+            acquire(saved.launch.destinationId);
+            try {
+                validate();
+                await options.launch(sourceId, saved.launch, validate);
+                saved.accepted = true;
+                saved.error = undefined;
+                save();
+                return saved.launch.destinationId;
+            }
+            catch (error) {
+                saved.error = error instanceof Error ? error.message : String(error);
+                save();
+                options.capacity.release(owner(saved.launch.destinationId));
+                throw new Error(`Child ${saved.launch.destinationId} handoff incomplete: ${saved.error} Retry the same requestKey, not a new start.`);
+            }
+        })();
+        pending.set(pendingKey, operation);
+        try {
+            return await operation;
+        }
+        finally {
+            pending.delete(pendingKey);
+        }
+    }
+    let ticking = false;
+    async function reconcile() {
+        if (ticking)
+            return;
+        ticking = true;
+        try {
+            for (const intent of intents) {
+                const id = intent.launch.destinationId;
+                if (pending.has(`${intent.sourceId}:${intent.key}`))
+                    continue;
+                const state = options.state(id);
+                if (!state?.runs.some((r) => r.status === 'running') &&
+                    !(state?.queuedMessages?.length && !state.queuePaused))
+                    options.capacity.release(owner(id));
+                // Reviewer progress/findings are collected by Reviews, never injected as coding work.
+                if (intent.launch.reviewer)
+                    continue;
+                for (const run of state?.runs ?? []) {
+                    if (run.status === 'running')
+                        continue;
+                    const text = childReportText(state.events, run.id);
+                    const number = options
+                        .summaries()
+                        .find((session) => session.id === id)?.childSessionNumber;
+                    enqueueReport(intent.sourceId, `child-result:${id}:${run.id}`, `Child session ${id}${number ? ` [T${number}]` : ''} (${run.status}) — ${options.url?.(id) ?? `/s/${id}`}\n${childCollaborationGuidance}\nAttributed child report:\n${text || run.error || 'No final response was produced. Inspect the child session for details.'}`);
+                }
+                if (!state?.runs.length && intent.error)
+                    enqueueReport(intent.sourceId, `child-start-failure:${id}`, `Child session ${id} could not start: ${intent.error}. Retry the original requestKey (${intent.key}) to complete the handoff without duplicating work.`);
+            }
+            for (const report of reports) {
+                if (report.delivered)
+                    continue;
+                try {
+                    await options.report(report.parentId, report.id, report.text);
+                    report.delivered = true;
+                    saveReports();
+                }
+                catch {
+                    /* A full, stopped or unavailable parent retains the durable outbox entry. */
+                }
+            }
+        }
+        finally {
+            ticking = false;
+        }
+    }
+    function list(sourceId) {
+        return options
+            .summaries()
+            .filter((s) => s.parentSessionId === sourceId)
+            .map((s) => ({
+            sessionId: s.id,
+            displayId: s.childSessionNumber ? `T${s.childSessionNumber}` : undefined,
+            parentSessionId: sourceId,
+            title: s.title,
+            status: s.status,
+            url: options.url?.(s.id) ?? `/s/${s.id}`,
+        }));
+    }
+    return {
+        start,
+        acquire,
+        reconcile,
+        list,
+        async close() {
+            await Promise.allSettled(pending.values());
+            for (const i of intents)
+                options.capacity.release(owner(i.launch.destinationId));
+        },
+    };
+}
+/** Text events are streaming deltas; only separate narrative blocks across other events. */
+export function childReportText(events, runId) {
+    let text = '';
+    let separated = false;
+    for (const event of events) {
+        if (event.runId !== runId)
+            continue;
+        if (event.type !== 'text') {
+            separated = true;
+            continue;
+        }
+        if (!event.text)
+            continue;
+        if (separated && text)
+            text += '\n\n';
+        text += event.text;
+        separated = false;
+    }
+    return text.slice(-12000);
+}

package/dist/apps/server/src/cli.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+import { startDiagnostics } from './diagnostics.js';
+import { resolve, join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { existsSync } from 'node:fs';
+import { mkdir, realpath } from 'node:fs/promises';
+import { attachOptions, followAttachment } from './attach.js';
+import { acquireHub, hubAddress } from './hub.js';
+import { tailscaleOrigin } from './browser-access.js';
+import { startServer } from './server.js';
+import { sharedAuthPath } from './shared-auth.js';
+import { discoverWorkspace } from './workspace.js';
+import { WorkspaceAlreadyRunningError } from './workspace-lock.js';
+async function main() {
+    const args = process.argv.slice(2);
+    const dev = process.env.PRESUBMIT_DEV === '1';
+    if (args.includes('--help')) {
+        console.log('Usage: presubmit [repository] [--port 4317] [--data-dir path] [--tailscale https://machine.tailnet.ts.net]\npresubmit attach <session-id|session-url> [--project id] [--json] [--after seq]\nStart Tailscale Serve from Settings → Devices; the device address is discovered and saved automatically. --tailscale optionally overrides the HTTPS origin or port. Re-run with the same URL for a fresh remote access link.\nConnect OpenAI in the browser (ChatGPT sign-in or API key), or set OPENAI_API_KEY on the server. Human review and shared drafts work without a model.');
+        return;
+    }
+    if (args[0] === 'attach') {
+        const options = attachOptions(args.slice(1));
+        const home = await realpath(resolve(process.env.PRESUBMIT_HOME ?? join(homedir(), '.local', 'share', 'presubmit')));
+        const controller = new AbortController();
+        const stop = () => controller.abort();
+        const outputError = (error) => {
+            stop();
+            if (error.code !== 'EPIPE')
+                process.exitCode = 1;
+        };
+        process.once('SIGINT', stop);
+        process.once('SIGTERM', stop);
+        process.stdout.on('error', outputError);
+        try {
+            await followAttachment(hubAddress(home), options, process.stdout, controller.signal, (message) => console.error(message));
+        }
+        finally {
+            process.removeListener('SIGINT', stop);
+            process.removeListener('SIGTERM', stop);
+            process.stdout.removeListener('error', outputError);
+        }
+        return;
+    }
+    let cwd = process.cwd(), port = 4317, tailscale, dataDir = process.env.PRESUBMIT_DATA_DIR;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === '--port')
+            port = Number(args[++i]);
+        else if (args[i] === '--data-dir')
+            dataDir = resolve(args[++i]);
+        else if (args[i] === '--tailscale')
+            tailscale = tailscaleOrigin(args[++i] ?? '');
+        else if (args[i].startsWith('--'))
+            throw new Error('Unknown option ' + args[i]);
+        else
+            cwd = resolve(args[i]);
+    }
+    if (dev && process.env.PRESUBMIT_DEV_PORT)
+        port = Number(process.env.PRESUBMIT_DEV_PORT);
+    if (!Number.isInteger(port) || port < 0 || port > 65535)
+        throw new Error('Invalid port');
+    cwd = await discoverWorkspace(cwd);
+    let presubmitHome = resolve(process.env.PRESUBMIT_HOME ?? join(homedir(), '.local', 'share', 'presubmit'));
+    await mkdir(presubmitHome, { recursive: true, mode: 0o700 });
+    presubmitHome = await realpath(presubmitHome);
+    dataDir ??= join(presubmitHome, createHash('sha256').update(cwd).digest('hex').slice(0, 20));
+    let root = dirname(fileURLToPath(import.meta.url));
+    while (!existsSync(join(root, dev ? 'apps/web/index.html' : 'apps/web/dist/index.html')) &&
+        dirname(root) !== root)
+        root = dirname(root);
+    const webDir = join(root, 'apps/web/dist');
+    if (!dev && !existsSync(join(webDir, 'index.html')))
+        throw new Error('Browser assets missing. Run npm run build first.');
+    const hub = await acquireHub(presubmitHome, cwd, tailscale);
+    if (hub.existingUrl) {
+        console.log(`\nPresubmit is already running for this workspace.\n\nOpen in your browser:\n${hub.existingUrl}\n`);
+        return;
+    }
+    let app;
+    try {
+        const authPath = await sharedAuthPath(presubmitHome, dataDir);
+        try {
+            app = await startServer({
+                cwd,
+                dataDir,
+                webDir,
+                port,
+                authPath,
+                dev,
+                tailscaleOrigin: tailscale,
+            });
+        }
+        catch (error) {
+            if (error.code === 'EADDRINUSE' && port === 4317)
+                app = await startServer({
+                    cwd,
+                    dataDir,
+                    webDir,
+                    port: 0,
+                    authPath,
+                    dev,
+                    tailscaleOrigin: tailscale,
+                });
+            else
+                throw error;
+        }
+        await hub.listen(app.origin, (path, remote) => app.openProject(path, remote), app.readAttachEvents);
+    }
+    catch (error) {
+        await app?.close();
+        await hub.close?.();
+        throw error;
+    }
+    if (!app.getState().configured)
+        console.log('Model setup: Choose Connect OpenAI in the browser.');
+    console.log(`\nPresubmit · ${cwd}\n\nOpen this access link in your browser:\n${app.url}\n\nKeep this process running. Ctrl+C stops the server.\n`);
+    if (tailscale) {
+        const httpsPort = new URL(tailscale).port || '443';
+        console.log(`Tailscale access link (one use, expires in 10 minutes):\n${app.tailscaleUrl()}\n\nStart Serve in Settings → Devices, or run it in another terminal:\ntailscale serve --https=${httpsPort} ${app.origin}\n\nThe link works once Serve is running for ${tailscale}. Settings → Devices also offers automatic startup with Presubmit.\n`);
+    }
+    const stopDiagnostics = startDiagnostics('host');
+    let stopping = false;
+    let restartRequested = false;
+    let check;
+    const stop = async (code) => {
+        if (stopping)
+            return;
+        stopping = true;
+        clearInterval(check);
+        stopDiagnostics();
+        hub.beginShutdown?.();
+        await app.close();
+        await hub.close?.();
+        process.exit(code);
+    };
+    if (dev && process.send) {
+        process.on('message', (message) => {
+            if (message?.type !== 'restart' || restartRequested)
+                return;
+            restartRequested = true;
+            if (app.hasActiveRuns())
+                console.log('Server changes detected. Reloading when active sessions finish.');
+            check = setInterval(() => {
+                if (!app.hasActiveRuns())
+                    void stop(75);
+            }, 200);
+            check.unref();
+        });
+        process.send({ type: 'ready', port: Number(new URL(app.origin).port) });
+    }
+    for (const signal of ['SIGINT', 'SIGTERM'])
+        process.once(signal, () => void stop(0));
+}
+main().catch((e) => {
+    if (e instanceof WorkspaceAlreadyRunningError && e.url) {
+        console.log(`\nPresubmit is already running for this workspace.\n\nOpen in your browser:\n${e.url}\n`);
+        return;
+    }
+    console.error('Presubmit:', e.message);
+    process.exitCode = 1;
+});

package/dist/apps/server/src/conversation-search.js

@@ -0,0 +1,12 @@
+import { searchExcerpt, searchPattern, } from '../../../packages/protocol/src/search.js';
+/** Check in-memory prompts first, then the persistent index of saved reply text. */
+export function searchConversation(store, runs, query) {
+    const pattern = searchPattern(query);
+    for (let i = runs.length - 1; i >= 0; i--) {
+        const run = runs[i];
+        const excerpt = searchExcerpt(run.prompt, pattern);
+        if (excerpt)
+            return { kind: 'prompt', excerpt, runId: run.id };
+    }
+    return store.replySearch.search(new Set(runs.map((run) => run.id)), query, pattern);
+}

package/dist/apps/server/src/coordinator-messages.js

@@ -0,0 +1,72 @@
+import { createHash } from 'node:crypto';
+import { parseCoordinatorRequest, } from '../../../packages/protocol/src/coordinator.js';
+/** Capability-scoped adapter for supported launches and follow-ups; never shell approvals. */
+export async function coordinatorRequest(options) {
+    const { state, bridge, validate } = options;
+    validate();
+    if (!options.requestId.trim() || options.requestId.length > 128)
+        throw new Error('Invalid coordinator request ID.');
+    const request = parseCoordinatorRequest(options.request);
+    // Only uploads already sent in this conversation can be forwarded, not arbitrary project IDs.
+    const attachments = [
+        ...new Map(state.runs.flatMap((run) => run.attachments ?? []).map((a) => [a.id, a])).values(),
+    ].slice(-100);
+    let launch;
+    if (request.action === 'launch_tasks') {
+        launch = (await bridge.command({
+            id: `agent-launch:${createHash('sha256').update(request.requestKey).digest('hex')}`,
+            type: 'delegation_agent_launch',
+            revision: request.revision,
+            version: request.version,
+            taskIds: request.taskIds,
+            requestKey: request.requestKey,
+        }, validate));
+    }
+    let messageId;
+    if (request.action === 'send') {
+        const allowed = new Set(attachments.map((a) => a.id));
+        if (request.attachments?.some((id) => !allowed.has(id)))
+            throw new Error('Only attachments listed by get_child_sessions can be forwarded.');
+        messageId =
+            'coordinator:' +
+                createHash('sha256')
+                    .update(JSON.stringify(request.requestKey
+                    ? ['follow-up', request.requestKey]
+                    : [options.runId, options.requestId]))
+                    .digest('hex');
+        await bridge.command({
+            id: messageId,
+            type: 'delegation_reply',
+            coordinatorFollowUp: true,
+            followUpToken: request.followUpToken,
+            version: request.version,
+            attemptId: request.attemptId,
+            prompt: request.message,
+            attachments: request.attachments ?? [],
+        }, validate);
+    }
+    const view = bridge.view();
+    const latest = new Map(view.attempts.map((attempt) => [attempt.taskId, attempt]));
+    return {
+        version: view.version,
+        ...(launch ? { launch } : {}),
+        children: [...latest.values()].map((a) => ({
+            attemptId: a.id,
+            followUpToken: bridge.followUpToken?.(a.id),
+            sessionId: a.sessionId,
+            taskId: a.taskId,
+            title: a.task.title,
+            status: a.status,
+            question: a.question,
+            blockedReason: a.blockedReason,
+            summary: a.result?.summary.slice(0, 2000),
+            pendingReplies: a.pendingReplies,
+            // Report this attempt's dispatch gate, not the coordinator's older queue.
+            // Running and terminal attempts are described by status, not as paused.
+            paused: a.status === 'queued' &&
+                (!!a.queuePaused || (view.paused && !a.resumeRequested)),
+        })),
+        attachments,
+        ...(messageId ? { messageId } : {}),
+    };
+}

package/dist/apps/server/src/dev-auth.js

@@ -0,0 +1,54 @@
+import { randomBytes } from 'node:crypto';
+/** Sign in without loading anything from Vite's workspace or module graph. */
+export function serveDevSignIn(req, res, url) {
+    const navigation = req.method === 'GET' &&
+        (['/', '/index.html', '/settings'].includes(url.pathname) ||
+            /^\/(?:s|agents)\/(?:main|[a-f0-9-]+)\/?$/i.test(url.pathname));
+    if (!navigation) {
+        res.writeHead(401, {
+            'Content-Type': 'application/json',
+            'Cache-Control': 'no-store',
+            'X-Content-Type-Options': 'nosniff',
+        });
+        res.end(JSON.stringify({ error: 'Open a Presubmit access link to connect this browser.' }));
+        return;
+    }
+    const nonce = randomBytes(24).toString('base64');
+    res.writeHead(200, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Cache-Control': 'no-store',
+        'Referrer-Policy': 'no-referrer',
+        'X-Content-Type-Options': 'nosniff',
+        'Content-Security-Policy': `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'`,
+    });
+    // The token and return location are read in the browser, never interpolated into HTML.
+    res.end(`<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>Connect to Presubmit</title>
+<style nonce="${nonce}">:root { color-scheme: light dark; font-family: system-ui, sans-serif; } body { max-width: 36rem; margin: 15vh auto; padding: 1.5rem; line-height: 1.5; }</style>
+</head><body><h1>Connect to Presubmit</h1>
+<p id="status" role="status">Open the access link from your Presubmit terminal or Settings → Devices to connect this browser.</p>
+<noscript>Enable JavaScript to connect.</noscript>
+<script nonce="${nonce}">
+void (async () => {
+  const url = new URL(location.href);
+  const token = url.searchParams.get('token');
+  if (!token) return;
+  url.searchParams.delete('token');
+  history.replaceState(null, '', url.pathname + url.search + url.hash);
+  const status = document.getElementById('status');
+  status.textContent = 'Connecting…';
+  try {
+    const response = await fetch('/api/auth', {
+      method: 'POST', credentials: 'same-origin', cache: 'no-store',
+      headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ token }),
+    });
+    const result = await response.json();
+    if (!response.ok) throw new Error(result.error || 'This access link could not be used. Open a fresh link.');
+    location.reload();
+  } catch (error) {
+    status.textContent = error instanceof Error ? error.message : 'Could not connect. Open the access link again to retry.';
+  }
+})();
+</script></body></html>`);
+}