viber-channel 0.8.19 → 0.8.21

package/lib/runner_exec.ts

@@ -13,13 +13,16 @@
  * injectable so the flow is unit-testable without shelling or a live server.
  */
 
-import { execFile } from "node:child_process";
+import { execFile } from "./hidden_proc.js";
 import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { cfAccessHeaders } from "./cfAccess.js";
 import { gatewayNothingToDo, gatewaySpawnOk, parseGatewayResult } from "./gateway_result.js";
 import { messageForReason, parseSpawnResult, rosterNames, type SpawnReason } from "./spawn_reason.js";
+import { identityBaseUrl } from "./base_urls.js";
+import { recordSpawn, registryPath, type SpawnForRegistry, updateRegistry } from "./runner_registry.js";
+import { relaunchInstance } from "./runner_relaunch.js";
 
 /** A validated role from the server snapshot (allowlisted shape). */
 export interface SnapshotRole {
@@ -39,12 +42,79 @@ export interface ClaimedCommand {
   prefix: string;
   team_name: string | null;
   env: string | null;
+  /** From the LIST entry (the claim response does not carry it). #632: the app
+   *  mode maps it to a local folder; the source runner ignores it. */
+  project_id?: number;
+  /** #627: `relaunch` brings back ONE agent from the runner's registry; absent = team. */
+  kind?: "team" | "relaunch";
+  relaunch_instance_id?: string | null;
 }
 
 export interface RunnerAuthLite {
   base_url: string;
   runner_id: string;
   runner_token: string;
+  /** #627: the web host the machine enrolled on. Absent in a runner.json written
+   *  before #627 — `runnerIdentity` then falls back to `VIBER_BASE_URL`. */
+  identity_base_url?: string;
+}
+
+/**
+ * #627 — the backend identity of each launch env, i.e. the `VIBER_BASE_URL`
+ * vibe-master gives an agent launched with `--env <name>`.
+ *
+ * ⚠ A COPY of `VIBER_ENVS[*].baseUrl` in `vibe-master/lib/env.ts` — viber-channel is
+ * published on its own and cannot import vibe-master. `test/runner_identity.test.ts`
+ * pins the two together, so a changed host breaks the build instead of silently
+ * sending an agent's presence record into a directory its runner never reads.
+ */
+export const ENV_IDENTITY: Readonly<Record<string, string>> = {
+  dev: "https://viber-dev.dgypx.dev",
+  staging: "https://viber.dgypx.dev",
+  qa: "https://viber-qa.dgypx.dev",
+};
+
+/** The backend this runner serves, verbatim (never normalized, #480). */
+export function runnerIdentity(auth: Pick<RunnerAuthLite, "identity_base_url">, env: NodeJS.ProcessEnv = process.env): string {
+  if (auth.identity_base_url !== undefined) return auth.identity_base_url;
+  if (!legacyIdentityAnnounced) {
+    // A runner.json from before #627: the enrolled host was not recorded, so this is a
+    // GUESS (VIBER_BASE_URL, else the default). Wrong for an app runner enrolled on dev.
+    legacyIdentityAnnounced = true;
+    process.stderr.write(
+      `[runner] runner.json has no identity_base_url (enrolled before #627): assuming ${identityBaseUrl(env)} — re-enroll to record it
+`,
+    );
+  }
+  return identityBaseUrl(env);
+}
+let legacyIdentityAnnounced = false;
+
+/**
+ * The env a team must be launched with so its agents land on THIS runner's backend,
+ * or a refusal. An explicit env pointing elsewhere is refused: the agents would write
+ * their presence records under another backend, the runner would never see them, and
+ * they would stay paused forever (#627 step-06). No env → the runner's own, when the
+ * identity is a known one; else unchanged (a custom backend, as before #627).
+ */
+export function launchEnvFor(
+  cmdEnv: string | null,
+  identity: string,
+): { ok: true; env: string | null } | { ok: false; error: string } {
+  if (cmdEnv !== null) {
+    const target = ENV_IDENTITY[cmdEnv];
+    if (target === identity) return { ok: true, env: cmdEnv };
+    return {
+      ok: false,
+      error:
+        `env "${cmdEnv}" runs agents on ${target ?? "an unknown backend"}, but this runner serves ${identity}` +
+        (target !== undefined && target.replace(/\/+$/, "") === identity.replace(/\/+$/, "")
+          ? " — the enrolled host differs only by a trailing slash: re-enroll this machine"
+          : ""),
+    };
+  }
+  const own = Object.keys(ENV_IDENTITY).find((name) => ENV_IDENTITY[name] === identity);
+  return { ok: true, env: own ?? null };
 }
 
 /**
@@ -374,6 +444,8 @@ export function buildGatewayTeamArgs(cmd: {
   teamName?: string;
   specPath: string;
   cwd: string;
+  /** #627: the project, for the runner registry the gateway writes. */
+  projectId?: number;
   registryDir: string;
   permission: string;
   env?: string;
@@ -423,6 +495,8 @@ export function buildGatewayTeamArgs(cmd: {
     cmd.nonce,
   ];
   if (cmd.env) args.push("--env", cmd.env);
+  // #627: the gateway writes the team into the runner registry, keyed by project.
+  if (cmd.projectId !== undefined) args.push("--project", String(cmd.projectId));
   // ▶ Only when set: an empty `--vibe-master-cmd` would make the gateway resolve an
   // empty command, which is worse than not passing the flag at all.
   if (cmd.vibeMasterCmd && cmd.vibeMasterCmd.trim().length > 0) {
@@ -452,8 +526,12 @@ export function buildGatewayTeamArgs(cmd: {
  * "we could not read the verdict" must not collapse into "it worked"
  * (`gatewaySpawnOk`).
  */
-export const execFileGatewayTeamSpawn: TeamSpawnRunner = (args, nonce) => {
-  const base = viberGatewayBaseCmd();
+export const execFileGatewayTeamSpawn: TeamSpawnRunner = (args, nonce) =>
+  gatewayTeamSpawnWith(viberGatewayBaseCmd())(args, nonce);
+
+/** #632: the same launcher with an explicit base command — the app mode passes its
+ *  own absolute `process.execPath`, never a bare name resolved through PATH. */
+export const gatewayTeamSpawnWith = (base: string[]): TeamSpawnRunner => (args, nonce) => {
   const bin = base[0] as string;
   return new Promise((resolve) => {
     execFile(
@@ -540,6 +618,38 @@ export interface ExecDeps {
   writeLog?: (commandId: string, recap: string) => string;
   /** Injectable daemon-stderr writer (tests). Defaults to process.stderr. */
   writeDaemonLine?: (line: string) => void;
+  /**
+   * #632: the folder the AGENTS work in, per project. Absent = the runner's own
+   * cwd (source runner, unchanged). `null` = no folder for this project (the user
+   * cancelled the picker): the command is REFUSED, never launched in a default.
+   */
+  resolveWorkspace?: (projectId: number | undefined) => Promise<string | null>;
+  /** #632: `vibe-master` for the launched team, when the env var is not the source. */
+  vibeMasterCmd?: string;
+  /** #627: remember a launched team on this machine (default: the registry on disk). */
+  recordLaunch?: (spawn: SpawnForRegistry) => void;
+  /** #627: runs `vibe-master <args>` for a relaunch (default: execFile, like a team). */
+  runSingleSpawn?: (args: string[]) => Promise<{ ok: boolean; recap: string }>;
+  /** #627: relaunch seams (tests). */
+  relaunchLockDir?: string;
+  relaunchEnumerate?: () => Promise<Map<number, number | undefined> | undefined>;
+}
+
+/**
+ * #627 — the default `recordLaunch`: write the team into this backend's registry.
+ * The backend is `runnerIdentity(auth)` — the enrolled web host, which `launchEnvFor`
+ * guarantees is also the agents' `VIBER_BASE_URL`, so the registry sits in the
+ * directory their presence records are written to. `auth.base_url` would be wrong
+ * here: it may be the announced API host (#480), not the identity.
+ */
+export function recordLaunchOnDisk(
+  identity: string,
+  spawn: SpawnForRegistry,
+  log: (line: string) => void = (l) => process.stderr.write(`${l}\n`),
+  now: () => number = Date.now,
+): void {
+  const result = updateRegistry(registryPath(identity), (r) => recordSpawn(r, spawn, now()));
+  if (!result.ok) log(`[runner] registry NOT updated for command=${spawn.command_id}: ${result.error}`);
 }
 
 /** Where the log lives, as shown to whoever reads the WEB (#506): RELATIVE, so
@@ -648,6 +758,7 @@ export async function executeClaim(
   // talks to `vibe-master` directly, and its witnesses keep measuring that contract.
   const runTeamSpawn = deps.runTeamSpawn ?? execFileGatewayTeamSpawn;
   const fetchImpl = deps.apiFetch ?? fetch;
+  if (cmd.kind === "relaunch") return executeRelaunchClaim(auth, cmd, deps, fetchImpl);
   const inflight = deps.inflight ?? fsInflightStore();
 
   // P1-4: a PRESENT-but-invalid local policy REFUSES execution (never the
@@ -666,6 +777,19 @@ export async function executeClaim(
     return "failed";
   }
 
+  // #632: the agents' folder. Resolved BEFORE any report, so a cancelled picker
+  // refuses the command without a side effect.
+  const workspace = deps.resolveWorkspace ? await deps.resolveWorkspace(cmd.project_id) : process.cwd();
+  if (workspace === null) {
+    await report(
+      auth,
+      cmd.id,
+      refusalBody(cmd, "launch_refused", `no local folder chosen for project ${cmd.project_id ?? "?"}`),
+      fetchImpl,
+    );
+    return "failed";
+  }
+
   const refusal = validateAgainstPolicy(cmd, policy);
   if (refusal) {
     await report(
@@ -677,6 +801,14 @@ export async function executeClaim(
     return "failed";
   }
 
+  // #627: the agents must land on this runner's backend, or it can never vouch for them.
+  const identity = runnerIdentity(auth);
+  const launchEnv = launchEnvFor(cmd.env, identity);
+  if (!launchEnv.ok) {
+    await report(auth, cmd.id, refusalBody(cmd, "launch_refused", launchEnv.error), fetchImpl);
+    return "failed";
+  }
+
   // Local idempotence (C4): a marker for this command_id means a PRIOR run
   // already started it here (crashed mid-spawn, now re-claimed). Do NOT relaunch.
   // Keep the marker unless the failed report is ACCEPTED (2xx) — else a later
@@ -746,7 +878,8 @@ export async function executeClaim(
       prefix: cmd.prefix,
       ...(cmd.team_name ? { teamName: cmd.team_name } : {}),
       specPath,
-      cwd: process.cwd(),
+      cwd: workspace,
+      ...(cmd.project_id !== undefined ? { projectId: cmd.project_id } : {}),
       // Beside `runner-specs`/`runner-logs`/`runner-inflight`, never the bare cwd - see
       // `buildGatewayTeamArgs`, where the measurement that forced this is recorded.
       registryDir: ensureGatewayRegistryDir(),
@@ -757,13 +890,17 @@ export async function executeClaim(
       // permission from the ARGV and never from the spec, so a mixed roster used to
       // launch a `read-only` member `read-write` with nothing going red.
       permission: cmd.template_spec.roles[0]?.permission ?? "read-only",
-      ...(cmd.env ? { env: cmd.env } : {}),
+      ...(launchEnv.env ? { env: launchEnv.env } : {}),
       nonce,
       // ⚠ See (3) on `buildGatewayTeamArgs`: the runner no longer launches
       // `vibe-master`, so this must TRAVEL or dev silently uses the installed
       // binary. Read from the env here, where the variable is already the
       // convention, rather than re-invented as a second knob.
-      ...(process.env.VIBE_MASTER_CMD ? { vibeMasterCmd: process.env.VIBE_MASTER_CMD } : {}),
+      ...(process.env.VIBE_MASTER_CMD
+        ? { vibeMasterCmd: process.env.VIBE_MASTER_CMD }
+        : deps.vibeMasterCmd
+          ? { vibeMasterCmd: deps.vibeMasterCmd }
+          : {}),
     });
 
     inflight.mark(cmd.id); // durable "started here" BEFORE launch (C4)
@@ -797,6 +934,22 @@ export async function executeClaim(
     // reassuring word promoted on no proof — and it would do so while LOOKING like belt-and-braces.
     const nothingToDo = launcherSaysNothingToDo ?? false;
 
+    // #627: a launched team is remembered on this machine, so the web can offer to
+    // relaunch its members with these settings after a crash or a reboot. Only on a
+    // real launch — "already running" launched nothing and must not reset entries.
+    if (ok) {
+      (deps.recordLaunch ?? ((s: SpawnForRegistry) => recordLaunchOnDisk(identity, s)))({
+        command_id: cmd.id,
+        template_name: cmd.template_name,
+        prefix: cmd.prefix,
+        team_name: cmd.team_name,
+        env: launchEnv.env,
+        project_id: cmd.project_id ?? null,
+        workspace,
+        roles: cmd.template_spec.roles,
+      });
+    }
+
     // #496: the failure now travels as a REASON plus a sentence built from it —
     // whoever clicked Spawn in a browser can act on what they read. The full
     // recap still goes ONLY to the 0600 local log (no secret leak); what changed
@@ -878,7 +1031,7 @@ export async function reconcileOnce(auth: RunnerAuthLite, deps: ExecDeps = {}):
     headers: { Authorization: `Bearer ${auth.runner_token}`, ...cfAccessHeaders() },
   });
   if (!listResp.ok) return 0;
-  const { commands } = (await listResp.json()) as { commands: { id: string }[] };
+  const { commands } = (await listResp.json()) as { commands: { id: string; project_id?: number }[] };
   if (!commands.length) return 0;
 
   const first = commands[0];
@@ -888,6 +1041,75 @@ export async function reconcileOnce(auth: RunnerAuthLite, deps: ExecDeps = {}):
   );
   if (claimResp.status !== 200) return 0; // lost the claim — another pass will retry
   const claimed = (await claimResp.json()) as ClaimedCommand;
+  if (claimed.project_id === undefined && first.project_id !== undefined) claimed.project_id = first.project_id;
   await executeClaim(auth, claimed, deps);
   return 1;
 }
+
+/**
+ * #627 step-07 — a RELAUNCH command: one agent, from this runner's registry. The
+ * decision (refuse / re-attach / launch) is `relaunchInstance`'s; this reports it with
+ * the same fencing-guarded reports as a team spawn. No automatic retry on failure.
+ */
+async function executeRelaunchClaim(
+  auth: RunnerAuthLite,
+  cmd: ClaimedCommand,
+  deps: ExecDeps,
+  fetchImpl: typeof fetch,
+): Promise<"succeeded" | "failed" | "aborted"> {
+  const instanceId = cmd.relaunch_instance_id ?? "";
+  if (!/^[0-9a-f]{32}$/.test(instanceId)) {
+    await report(auth, cmd.id, refusalBody(cmd, "launch_refused", "relaunch command without a valid instance id"), fetchImpl);
+    return "failed";
+  }
+  // Same local idempotence as a team (C4): a marker means a PRIOR run already started
+  // this relaunch here — never launch a second agent for one command.
+  const inflight = deps.inflight ?? fsInflightStore();
+  if (inflight.has(cmd.id)) {
+    const r = await report(auth, cmd.id, refusalBody(cmd, "launch_refused", "this relaunch already ran on this machine"), fetchImpl);
+    if (r >= 200 && r < 300) inflight.clear(cmd.id);
+    return "failed";
+  }
+  // Only a 2xx means the claim is still ours — anything else, never launch (Codex).
+  const starting = await report(auth, cmd.id, { fencing_token: cmd.fencing_token, status: "starting" }, fetchImpl);
+  if (starting < 200 || starting >= 300) return "aborted";
+  inflight.mark(cmd.id);
+  // The saved settings meet TODAY's local policy, like a team does (Codex): an operator
+  // who restricted the machine since the first launch is obeyed.
+  let policy: RunnerPolicy;
+  try {
+    policy = deps.policy ?? loadRunnerPolicy();
+  } catch (err) {
+    const cause = err instanceof RunnerPolicyInvalidError ? err.message : "invalid local policy";
+    await report(auth, cmd.id, refusalBody(cmd, "policy_invalid", `local policy invalid: ${cause}`), fetchImpl);
+    inflight.clear(cmd.id);
+    return "failed";
+  }
+  const outcome = await relaunchInstance(instanceId, {
+    identity: runnerIdentity(auth),
+    ...(deps.relaunchLockDir !== undefined ? { lockDir: deps.relaunchLockDir } : {}),
+    ...(deps.relaunchEnumerate !== undefined ? { enumerate: deps.relaunchEnumerate } : {}),
+    runSpawn: deps.runSingleSpawn ?? ((args) => execFileTeamSpawn(args, randomBytes(8).toString("hex"))),
+    checkPolicy: (entry) =>
+      validateAgainstPolicy(
+        { ...cmd, env: entry.env, template_spec: { roles: [{ ...entry.role }] } },
+        policy,
+      ),
+  });
+  // #627 (live validation): the web says "see the runner log" — so the log must carry it.
+  // vibe-master's own output goes to the 0600 LOCAL log only, like a team's recap (#496:
+  // it may hold secrets) — stderr can be captured elsewhere (Opus). The console line
+  // carries only the runner-authored sentence and where the detail is.
+  if (outcome.kind === "refused") {
+    const logPath = outcome.recap ? (deps.writeLog ? deps.writeLog(cmd.id, outcome.recap) : writeRunnerLog(cmd.id, outcome.recap)) : undefined;
+    console.error(`[runner] relaunch ${instanceId.slice(0, 8)} refused: ${outcome.error}${logPath ? ` (log: ${logPath})` : ""}`);
+  }
+  const body =
+    outcome.kind === "refused"
+      ? refusalBody(cmd, outcome.policy ? "policy_refused" : "launch_refused", outcome.error)
+      : { fencing_token: cmd.fencing_token, status: "succeeded", result: { message: outcome.message } };
+  const final = await report(auth, cmd.id, body, fetchImpl);
+  if (final < 200 || final >= 300) return "aborted"; // marker kept for reconcile
+  inflight.clear(cmd.id);
+  return outcome.kind === "refused" ? "failed" : "succeeded";
+}