vgxness 1.19.5 → 1.19.6

package/dist/runs/resume-after-approval-result.js

@@ -0,0 +1,84 @@
+export function buildResumeAfterApprovalResult(input) {
+    const operationKind = stringFromObject(input.executorOutput, 'operationKind') ?? operationKindFromOperation(input.operation);
+    const command = operationKind === 'allowlisted-command' ? extractAllowlistedCommandMetadata(input.executorOutput) : undefined;
+    return {
+        kind: 'resume-after-approval-result',
+        version: 1,
+        operationKind,
+        runId: input.runId,
+        approvalId: input.approvalId,
+        attemptId: input.attemptId,
+        permissionEventId: input.permissionEventId,
+        pendingExecutionEventId: input.pendingExecutionEventId,
+        operationFingerprint: input.operationFingerprint,
+        executor: input.executorName,
+        status: input.status,
+        ...(command === undefined ? {} : { command }),
+        error: input.error === undefined ? null : { code: input.error.code, message: input.error.message },
+        safety: buildSafety(input.executorOutput),
+    };
+}
+function extractAllowlistedCommandMetadata(output) {
+    if (!isObject(output))
+        return undefined;
+    const command = isObject(output.command) ? output.command : output;
+    const commandId = stringField(command.commandId) ?? stringField(output.commandId);
+    const argv = stringArray(command.argv) ?? stringArray(output.argv);
+    if (commandId === undefined || argv === undefined)
+        return undefined;
+    const result = { commandId, argv };
+    setOptionalNumberOrNull(result, 'exitCode', command.exitCode);
+    setOptionalStringOrNull(result, 'signal', command.signal);
+    setOptionalBoolean(result, 'timedOut', command.timedOut);
+    setOptionalBoolean(result, 'outputTruncated', command.outputTruncated);
+    setOptionalNumber(result, 'stdoutBytes', command.stdoutBytes);
+    setOptionalNumber(result, 'stderrBytes', command.stderrBytes);
+    return result;
+}
+function buildSafety(output) {
+    const source = isObject(output) && isObject(output.command) && isObject(output.command.safety) ? output.command.safety : isObject(output) && isObject(output.safety) ? output.safety : undefined;
+    return {
+        metadataOnly: true,
+        rawStdoutPersisted: false,
+        rawStderrPersisted: false,
+        providerPayloadPersisted: false,
+        executorOutputWhitelisted: true,
+        ...(typeof source?.boundedProcess === 'boolean' ? { boundedProcess: source.boundedProcess } : {}),
+        ...(typeof source?.shellDisabled === 'boolean' ? { shellDisabled: source.shellDisabled } : {}),
+        ...(typeof source?.argvArrayOnly === 'boolean' ? { argvArrayOnly: source.argvArrayOnly } : {}),
+        ...(typeof source?.providerConfigWritesBlocked === 'boolean' ? { providerConfigWritesBlocked: source.providerConfigWritesBlocked } : {}),
+        ...(typeof source?.createsSandbox === 'boolean' ? { createsSandbox: source.createsSandbox } : {}),
+        ...(typeof source?.createsWorktree === 'boolean' ? { createsWorktree: source.createsWorktree } : {}),
+    };
+}
+function operationKindFromOperation(operation) {
+    return isObject(operation.input) && typeof operation.input.operationKind === 'string' ? operation.input.operationKind : 'generic-operation';
+}
+function stringFromObject(value, key) {
+    return isObject(value) ? stringField(value[key]) : undefined;
+}
+function stringField(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function stringArray(value) {
+    return Array.isArray(value) && value.every((item) => typeof item === 'string') ? value : undefined;
+}
+function setOptionalNumber(target, key, value) {
+    if (typeof value === 'number')
+        target[key] = value;
+}
+function setOptionalBoolean(target, key, value) {
+    if (typeof value === 'boolean')
+        target[key] = value;
+}
+function setOptionalNumberOrNull(target, key, value) {
+    if (typeof value === 'number' || value === null)
+        target[key] = value;
+}
+function setOptionalStringOrNull(target, key, value) {
+    if (typeof value === 'string' || value === null)
+        target[key] = value;
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}

package/dist/runs/run-service.js

@@ -7,6 +7,7 @@ import { evaluateOperationRetry as evaluateOperationRetryPolicy } from './operat
 import { AllowlistedApplyProgressCommandExecutor } from '../workflows/command-allowlist-adapter.js';
 import { RunRepository, } from './repositories/runs.js';
 import { buildRunInsights, buildRunOperatorResumePlan } from './run-insights.js';
+import { buildResumeAfterApprovalResult } from './resume-after-approval-result.js';
 const preflightSafety = {
     operationExecuted: false,
     executorInvoked: false,
@@ -459,7 +460,19 @@ export class RunService {
         const executed = input.executor.execute({ runId: approval.value.runId, operation });
         if (!executed.ok) {
             const error = { code: executed.error.code, message: executed.error.message };
-            const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'failed', error });
+            const result = buildResumeAfterApprovalResult({
+                runId: approval.value.runId,
+                approvalId: approval.value.id,
+                attemptId: reserved.value.id,
+                permissionEventId: permissionEvent.id,
+                pendingExecutionEventId: pendingExecutionEvent.id,
+                operationFingerprint: replayGuard.operationFingerprint,
+                executorName: input.executor.name,
+                operation,
+                status: 'failed',
+                error,
+            });
+            const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'failed', output: result, error });
             if (!attempt.ok)
                 return attempt;
             const executionEvent = this.runs.appendEvent({
@@ -478,6 +491,7 @@ export class RunService {
                     operationFingerprint: replayGuard.operationFingerprint,
                     resumedFromApprovalId: approval.value.id,
                     executorInvoked: true,
+                    result,
                     error,
                 }),
                 relatedType: 'approval',
@@ -486,7 +500,7 @@ export class RunService {
             if (!executionEvent.ok)
                 return { ok: false, error: executionEvent.error };
             const linkedAttempt = this.runs.attachAttemptResultEvent(attempt.value.id, executionEvent.value.id);
-            const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, undefined, error);
+            const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, result);
             if (!evidence.ok)
                 return { ok: false, error: evidence.error };
             return {
@@ -498,12 +512,25 @@ export class RunService {
                     attempt: linkedAttempt.ok ? linkedAttempt.value : attempt.value,
                     executionEvent: executionEvent.value,
                     status: 'failed',
+                    output: result,
                     ...(evidence.value === undefined ? {} : evidence.value),
                 },
             };
         }
         const output = executed.value.output;
-        const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'succeeded', ...(output === undefined ? {} : { output }) });
+        const result = buildResumeAfterApprovalResult({
+            runId: approval.value.runId,
+            approvalId: approval.value.id,
+            attemptId: reserved.value.id,
+            permissionEventId: permissionEvent.id,
+            pendingExecutionEventId: pendingExecutionEvent.id,
+            operationFingerprint: replayGuard.operationFingerprint,
+            executorName: input.executor.name,
+            operation,
+            status: 'succeeded',
+            ...(output === undefined ? {} : { executorOutput: output }),
+        });
+        const attempt = this.runs.completeOperationAttempt({ attemptId: reserved.value.id, status: 'succeeded', output: result });
         if (!attempt.ok)
             return attempt;
         const executionEvent = this.runs.appendEvent({
@@ -522,7 +549,7 @@ export class RunService {
                 operationFingerprint: replayGuard.operationFingerprint,
                 resumedFromApprovalId: approval.value.id,
                 executorInvoked: true,
-                output: output ?? null,
+                result,
             }),
             relatedType: 'approval',
             relatedId: approval.value.id,
@@ -530,7 +557,7 @@ export class RunService {
         if (!executionEvent.ok)
             return { ok: false, error: executionEvent.error };
         const linkedAttempt = this.runs.attachAttemptResultEvent(attempt.value.id, executionEvent.value.id);
-        const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, output, undefined);
+        const evidence = appendApplyProgressAllowlistEvidenceIfNeeded(this.runs, approval.value.id, permissionEvent, pendingExecutionEvent, linkedAttempt.ok ? linkedAttempt.value : attempt.value, executionEvent.value, replayGuard.operationFingerprint, input.executor.name, operation, result);
         if (!evidence.ok)
             return { ok: false, error: evidence.error };
         return {
@@ -542,7 +569,7 @@ export class RunService {
                 attempt: linkedAttempt.ok ? linkedAttempt.value : attempt.value,
                 executionEvent: executionEvent.value,
                 status: 'succeeded',
-                ...(output === undefined ? {} : { output }),
+                output: result,
                 ...(evidence.value === undefined ? {} : evidence.value),
             },
         };
@@ -1002,24 +1029,21 @@ function workflowConflictDecision(input, runWorkflow) {
         auditEvidence: [`runWorkflow:${runWorkflow}`, `explicitWorkflow:${input.workflow}`],
     };
 }
-function appendApplyProgressAllowlistEvidenceIfNeeded(runs, approvalId, permissionEvent, pendingExecutionEvent, attempt, executionEvent, operationFingerprint, executorName, operation, output, error) {
+function appendApplyProgressAllowlistEvidenceIfNeeded(runs, approvalId, permissionEvent, pendingExecutionEvent, attempt, executionEvent, operationFingerprint, executorName, operation, result) {
     if (!isApplyProgressAllowlistedCommandOperation(operation))
         return { ok: true, value: undefined };
     const base = {
-        kind: 'apply-progress-operation',
-        operationKind: 'allowlisted-command',
-        runId: attempt.runId,
-        approvalId,
-        attemptId: attempt.id,
-        pendingExecutionEventId: pendingExecutionEvent.id,
-        permissionEventId: permissionEvent.id,
+        ...result,
         executionEventId: executionEvent.id,
-        operationFingerprint,
-        executor: executorName,
-        operation: operationMetadata(operation),
-        status: attempt.status,
-        output: output ?? null,
-        error: error ?? null,
+        audit: {
+            metadataOnly: true,
+            operationFingerprint,
+            executor: executorName,
+            approvalId,
+            pendingExecutionEventId: pendingExecutionEvent.id,
+            permissionEventId: permissionEvent.id,
+            attemptId: attempt.id,
+        },
     };
     const evidence = runs.appendEvent({
         runId: attempt.runId,

package/dist/runs/sandbox-process-execution.js

@@ -162,6 +162,11 @@ function acceptedEvidence(workspaceRoot, cwd, checks) {
         enforceable: true,
         createsSandbox: false,
         createsWorktree: false,
+        filesystemIsolation: false,
+        networkIsolation: false,
+        shellDisabled: true,
+        argvArrayOnly: true,
+        providerConfigWritesBlocked: true,
         workspaceRoot,
         cwd,
         capabilities: {

package/dist/workflows/command-allowlist-adapter.js

@@ -55,16 +55,31 @@ export class CommandAllowlistAdapter {
         const result = this.runner(this.request);
         if (!result.ok)
             throw new Error(`${result.error.code}: ${result.error.message}`);
+        const stdoutBytes = Buffer.byteLength(result.value.stdout);
+        const stderrBytes = Buffer.byteLength(result.value.stderr);
+        const safety = {
+            strategy: result.value.evidence.strategy,
+            boundedProcess: true,
+            createsSandbox: result.value.evidence.createsSandbox,
+            createsWorktree: result.value.evidence.createsWorktree,
+            filesystemIsolation: result.value.evidence.filesystemIsolation,
+            networkIsolation: result.value.evidence.networkIsolation,
+            shellDisabled: result.value.evidence.shellDisabled,
+            argvArrayOnly: result.value.evidence.argvArrayOnly,
+            providerConfigWritesBlocked: result.value.evidence.providerConfigWritesBlocked,
+        };
         const output = {
-            command: this.commandId,
+            commandId: this.commandId,
             executable: this.entry.executable,
-            args: this.entry.args,
+            argv: [this.entry.executable, ...this.entry.args],
+            cwd: this.plan.request.cwd,
             exitCode: result.value.exitCode,
             signal: result.value.signal,
             timedOut: result.value.timedOut,
             outputTruncated: result.value.outputTruncated,
-            stdout: result.value.stdout,
-            stderr: result.value.stderr,
+            stdoutBytes,
+            stderrBytes,
+            safety,
         };
         const failed = result.value.timedOut || result.value.exitCode !== 0;
         return {
@@ -77,6 +92,11 @@ export class CommandAllowlistAdapter {
                 shell: false,
                 argv: [this.entry.executable, ...this.entry.args],
                 cwd: this.plan.request.cwd,
+                stdoutBytes,
+                stderrBytes,
+                outputTruncated: result.value.outputTruncated,
+                timedOut: result.value.timedOut,
+                safety,
             },
             ...(failed
                 ? {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vgxness",
-  "version": "1.19.5",
+  "version": "1.19.6",
   "description": "CLI and MCP control plane for guided AI-agent workflows, SDD, memory, and OpenCode setup.",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {