voratiq 0.1.0-beta.2 → 0.1.0-beta.21

package/dist/agents/runtime/failures.js

@@ -0,0 +1,136 @@
+import { readFile } from "node:fs/promises";
+import { CLAUDE_OAUTH_RELOGIN_HINT, CLAUDE_PROVIDER_ID, } from "../../auth/providers/claude/constants.js";
+const GEMINI_PROVIDER_ID = "gemini";
+const CODEX_PROVIDER_ID = "codex";
+const CLAUDE_FAILURE_PATTERNS = [
+    /Please run \/login/i,
+    /OAuth token has expired/i,
+];
+const JSON_MESSAGE_PATTERN = /"message"\s*:\s*"((?:\\.|[^"\\])*)"/;
+const JSON_RESULT_PATTERN = /"result"\s*:\s*"((?:\\.|[^"\\])*)"/;
+export async function detectAgentProcessFailureDetail(input) {
+    if (input.provider !== CLAUDE_PROVIDER_ID &&
+        input.provider !== GEMINI_PROVIDER_ID &&
+        input.provider !== CODEX_PROVIDER_ID) {
+        return undefined;
+    }
+    const combinedLogs = await readCombinedLogs(input.stdoutPath, input.stderrPath);
+    if (!combinedLogs) {
+        return undefined;
+    }
+    if (input.provider === CLAUDE_PROVIDER_ID) {
+        if (CLAUDE_FAILURE_PATTERNS.some((pattern) => pattern.test(combinedLogs))) {
+            return CLAUDE_OAUTH_RELOGIN_HINT;
+        }
+        return (extractFirstJsonResult(combinedLogs) ??
+            extractFirstJsonMessage(combinedLogs) ??
+            extractClaudeFallbackLine(combinedLogs));
+    }
+    if (input.provider === GEMINI_PROVIDER_ID) {
+        return (extractFirstJsonMessage(combinedLogs) ??
+            extractGeminiFallbackLine(combinedLogs));
+    }
+    if (input.provider === CODEX_PROVIDER_ID) {
+        return (extractFirstJsonMessage(combinedLogs) ??
+            findFirstMatchingLine(combinedLogs, [
+                /invalid_request_error/,
+                /unsupported_value/,
+                /thread .* panicked/i,
+            ]));
+    }
+    return undefined;
+}
+function extractFirstJsonMessage(text) {
+    return extractFirstJsonStringField(text, JSON_MESSAGE_PATTERN);
+}
+function extractFirstJsonResult(text) {
+    return extractFirstJsonStringField(text, JSON_RESULT_PATTERN);
+}
+function extractFirstJsonStringField(text, pattern) {
+    const match = pattern.exec(text);
+    if (!match) {
+        return undefined;
+    }
+    const raw = match[1]?.trim();
+    if (!raw) {
+        return undefined;
+    }
+    try {
+        const parsed = JSON.parse(`"${raw}"`);
+        return isMeaningfulMessage(parsed) ? parsed : undefined;
+    }
+    catch {
+        return isMeaningfulMessage(raw) ? raw : undefined;
+    }
+}
+function isMeaningfulMessage(message) {
+    const normalized = message.trim();
+    if (!normalized) {
+        return false;
+    }
+    if (normalized === "[object Object]") {
+        return false;
+    }
+    return true;
+}
+function findFirstMatchingLine(text, matchers) {
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        for (const matcher of matchers) {
+            const match = matcher.exec(trimmed);
+            if (match) {
+                return trimmed.slice(match.index).trim();
+            }
+        }
+    }
+    return undefined;
+}
+function extractGeminiFallbackLine(text) {
+    return findFirstMatchingLine(text, [
+        /TerminalQuotaError:/,
+        /PERMISSION_DENIED/,
+        /RESOURCE_EXHAUSTED/,
+        /No capacity available/i,
+        /You have exhausted your capacity/i,
+        /exhausted your capacity/i,
+    ]);
+}
+function extractClaudeFallbackLine(text) {
+    const matched = findFirstMatchingLine(text, [
+        /.*hit your limit.*/i,
+        /.*usage limit.*/i,
+        /.*quota.*/i,
+        /.*capacity.*/i,
+        /.*rate limit.*/i,
+        /.*resource[_\s-]*exhausted.*/i,
+    ]);
+    if (matched) {
+        return matched;
+    }
+    return findFirstMatchingLine(text, [
+        /hit your limit/i,
+        /usage limit/i,
+        /quota/i,
+        /capacity/i,
+        /rate limit/i,
+        /resource[_\s-]*exhausted/i,
+    ]);
+}
+async function readCombinedLogs(stdoutPath, stderrPath) {
+    const [stdout, stderr] = await Promise.all([
+        safeRead(stdoutPath),
+        safeRead(stderrPath),
+    ]);
+    return `${stdout}\n${stderr}`;
+}
+async function safeRead(path) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch {
+        return "";
+    }
+}

package/dist/agents/runtime/harness.d.ts

@@ -0,0 +1,2 @@
+import type { AgentRuntimeHarnessInput, AgentRuntimeHarnessResult } from "./types.js";
+export declare function runSandboxedAgent(input: AgentRuntimeHarnessInput): Promise<AgentRuntimeHarnessResult>;

package/dist/agents/runtime/harness.js

@@ -0,0 +1,119 @@
+import { mkdir, rm } from "node:fs/promises";
+import { dirname } from "node:path";
+import { loadSandboxProviderConfig } from "../../configs/sandbox/loader.js";
+import { toErrorMessage } from "../../utils/errors.js";
+import { writeStagedPrompt } from "../launch/prompt.js";
+import { stageAgentAuth } from "./auth.js";
+import { captureAgentChatArtifacts } from "./chat.js";
+import { AgentRuntimeError, AgentRuntimeProcessError, AgentRuntimeSandboxError, } from "./errors.js";
+import { configureSandboxSettings, runAgentProcess } from "./launcher.js";
+import { writeAgentManifest } from "./manifest.js";
+import { registerStagedAuthContext, teardownRegisteredAuthContext, } from "./registry.js";
+import { DEFAULT_DENIAL_BACKOFF } from "./sandbox.js";
+export async function runSandboxedAgent(input) {
+    const { root, agent, prompt, environment, paths, sandboxStageId = "run", sessionId, sandboxProviderId, sandboxPolicyOverrides, extraWriteProtectedPaths, extraReadProtectedPaths, captureChat = true, teardownAuthOnExit = true, onWatchdogTrigger, } = input;
+    const providerId = sandboxProviderId ?? agent.provider ?? "";
+    if (!providerId) {
+        throw new AgentRuntimeSandboxError(`Agent \`${agent.id}\` is missing a provider.`);
+    }
+    await mkdir(dirname(paths.runtimeManifestPath), { recursive: true });
+    await mkdir(dirname(paths.sandboxSettingsPath), { recursive: true });
+    await mkdir(dirname(paths.stdoutPath), { recursive: true });
+    await mkdir(dirname(paths.stderrPath), { recursive: true });
+    const promptPath = await writeStagedPrompt({
+        runtimePath: paths.runtimePath,
+        prompt,
+    });
+    let authContext;
+    try {
+        const staged = await stageAgentAuth({
+            agent,
+            agentRoot: paths.agentRoot,
+            root,
+            runId: sessionId,
+        });
+        authContext = staged.context;
+        if (sessionId) {
+            registerStagedAuthContext(sessionId, authContext);
+        }
+        const manifestEnv = await writeAgentManifest({
+            agent,
+            runtimeManifestPath: paths.runtimeManifestPath,
+            promptPath,
+            workspacePath: paths.workspacePath,
+            env: staged.env,
+            environment,
+        });
+        const denialBackoff = resolveDenialBackoff({
+            root,
+            providerId,
+            override: input.denialBackoff,
+        });
+        const { sandboxSettings } = await configureSandboxSettings({
+            sandboxHomePath: paths.sandboxHomePath,
+            workspacePath: paths.workspacePath,
+            providerId,
+            stageId: sandboxStageId,
+            root,
+            sandboxSettingsPath: paths.sandboxSettingsPath,
+            runtimePath: paths.runtimePath,
+            artifactsPath: paths.artifactsPath,
+            policyOverrides: sandboxPolicyOverrides,
+            extraWriteProtectedPaths,
+            extraReadProtectedPaths,
+        });
+        const processResult = await runAgentProcess({
+            runtimeManifestPath: paths.runtimeManifestPath,
+            agentRoot: paths.agentRoot,
+            stdoutPath: paths.stdoutPath,
+            stderrPath: paths.stderrPath,
+            sandboxSettingsPath: paths.sandboxSettingsPath,
+            providerId,
+            denialBackoff,
+            onWatchdogTrigger,
+        });
+        const chat = captureChat
+            ? await captureAgentChatArtifacts({
+                providerId: agent.provider,
+                agentRoot: paths.agentRoot,
+            })
+            : undefined;
+        return {
+            exitCode: processResult.exitCode,
+            errorMessage: processResult.errorMessage,
+            signal: processResult.signal,
+            watchdog: processResult.watchdog,
+            failFast: processResult.failFast,
+            sandboxSettings,
+            manifestEnv,
+            ...(chat ? { chat } : {}),
+        };
+    }
+    catch (error) {
+        if (error instanceof AgentRuntimeError) {
+            throw error;
+        }
+        throw new AgentRuntimeProcessError(error instanceof Error ? error.message : toErrorMessage(error));
+    }
+    finally {
+        await rm(promptPath, { force: true }).catch(() => { });
+        if (teardownAuthOnExit || !sessionId) {
+            await teardownRegisteredAuthContext(sessionId ?? "runtime", authContext).catch(() => { });
+        }
+    }
+}
+function resolveDenialBackoff(options) {
+    if (options.override) {
+        return options.override;
+    }
+    try {
+        const config = loadSandboxProviderConfig({
+            root: options.root,
+            providerId: options.providerId,
+        });
+        return config.denialBackoff;
+    }
+    catch {
+        return DEFAULT_DENIAL_BACKOFF;
+    }
+}

package/dist/{commands/run/agents/sandbox-launcher.d.ts → agents/runtime/launcher.d.ts}

@@ -1,7 +1,8 @@
-import type { DenialBackoffConfig } from "../../../configs/sandbox/types.js";
-import type { WatchdogMetadata } from "../../../records/types.js";
-import type { AgentWorkspacePaths } from "../../../workspace/layout.js";
-import { type SandboxFailFastInfo } from "../sandbox.js";
+import type { DenialBackoffConfig } from "../../configs/sandbox/types.js";
+import type { WatchdogMetadata } from "../../domain/run/model/types.js";
+import type { SandboxStageId } from "./policy.js";
+import { generateSandboxSettings, type SandboxFailFastInfo } from "./sandbox.js";
+import type { SandboxPolicyOverrides } from "./types.js";
 import { type WatchdogTrigger } from "./watchdog.js";
 export interface AgentProcessOptions {
     runtimeManifestPath: string;
@@ -37,11 +38,22 @@ export interface RunInvocation {
 }
 export type RunInvocationResolver = (context: RunInvocationContext) => Promise<RunInvocation> | RunInvocation;
 export interface SandboxSettingsInput {
-    workspacePaths: AgentWorkspacePaths;
+    stageId?: SandboxStageId;
+    sandboxHomePath: string;
+    workspacePath: string;
     providerId: string;
     root: string;
+    repoRootPath?: string;
+    sandboxSettingsPath: string;
+    runtimePath: string;
+    artifactsPath: string;
+    policyOverrides?: SandboxPolicyOverrides;
+    extraWriteProtectedPaths?: readonly string[];
+    extraReadProtectedPaths?: readonly string[];
 }
-export declare function configureSandboxSettings(input: SandboxSettingsInput): Promise<void>;
+export declare function configureSandboxSettings(input: SandboxSettingsInput): Promise<{
+    sandboxSettings: ReturnType<typeof generateSandboxSettings>;
+}>;
 export declare function getRunCommand(): Promise<string>;
 export declare function runAgentProcess(options: AgentProcessOptions): Promise<AgentProcessResult>;
 export declare function stageManifestForSandbox(options: {

package/dist/{commands/run/agents/sandbox-launcher.js → agents/runtime/launcher.js}

@@ -1,31 +1,21 @@
 import { constants as fsConstants, createWriteStream, existsSync, } from "node:fs";
 import { access, readFile, writeFile } from "node:fs/promises";
 import { dirname, isAbsolute, relative as relativePath } from "node:path";
-import { getCliAssetPath, resolveCliAssetRoot, } from "../../../utils/cli-root.js";
-import { resolvePath } from "../../../utils/path.js";
-import { spawnStreamingProcess } from "../../../utils/process.js";
-import { ARTIFACTS_DIRNAME, EVALS_DIRNAME, } from "../../../workspace/structure.js";
-import { AgentProcessError } from "../errors.js";
-import { generateSandboxSettings, resolveSrtBinary, writeSandboxSettings, } from "../sandbox.js";
+import { getCliAssetPath, resolveCliAssetRoot } from "../../utils/cli-root.js";
+import { resolvePath } from "../../utils/path.js";
+import { spawnStreamingProcess, } from "../../utils/process.js";
+import { AgentRuntimeProcessError } from "./errors.js";
+import { generateSandboxSettings, resolveSrtBinary, writeSandboxSettings, } from "./sandbox.js";
 import { createWatchdog, WATCHDOG_DEFAULTS, } from "./watchdog.js";
-const DEFAULT_SRT_ARGUMENTS = ["--debug"];
 const SRT_BINARY_ENV = "VORATIQ_SRT_BINARY";
 let cachedSrtBinaryPath;
 export async function configureSandboxSettings(input) {
-    const { workspacePaths, providerId, root } = input;
-    const artifactsPath = resolvePath(workspacePaths.agentRoot, ARTIFACTS_DIRNAME);
-    const evalsPath = resolvePath(workspacePaths.agentRoot, EVALS_DIRNAME);
     const sandboxSettings = generateSandboxSettings({
-        sandboxHomePath: workspacePaths.sandboxHomePath,
-        workspacePath: workspacePaths.workspacePath,
-        provider: providerId,
-        root,
-        sandboxSettingsPath: workspacePaths.sandboxSettingsPath,
-        runtimePath: workspacePaths.runtimePath,
-        artifactsPath,
-        evalsPath,
+        ...input,
+        repoRootPath: input.repoRootPath ?? input.root,
     });
-    await writeSandboxSettings(workspacePaths.sandboxSettingsPath, sandboxSettings);
+    await writeSandboxSettings(input.sandboxSettingsPath, sandboxSettings);
+    return { sandboxSettings };
 }
 export async function getRunCommand() {
     const { X_OK } = fsConstants;
@@ -34,14 +24,13 @@ export async function getRunCommand() {
         await access(binaryPath, X_OK);
     }
     catch {
-        throw new Error(`Sandbox Runtime binary not found or not executable at ${binaryPath}. Please reinstall dependencies with 'npm install'.`);
+        throw new Error(`Sandbox runtime binary is missing or not executable at \`${binaryPath}\`. Run \`npm install\` to reinstall dependencies.`);
     }
     return binaryPath;
 }
 function getRunArgs(options) {
     const { settingsArg, configArg, shimEntryPath } = options;
     return [
-        ...DEFAULT_SRT_ARGUMENTS,
         "--settings",
         settingsArg,
         "--",
@@ -66,9 +55,7 @@ export async function runAgentProcess(options) {
     const stderrStream = createWriteStream(stderrPath, { flags: "w" });
     const shimEntryPath = resolveShimEntryPath();
     if (!existsSync(shimEntryPath)) {
-        throw new AgentProcessError({
-            detail: `Shim entry point missing at ${shimEntryPath}`,
-        });
+        throw new AgentRuntimeProcessError(`Shim entry point is missing at \`${shimEntryPath}\`.`);
     }
     const manifestArgPath = await stageManifestForSandbox({
         runtimeManifestPath,
@@ -85,9 +72,7 @@ export async function runAgentProcess(options) {
         shimEntryPath,
     });
     let watchdogController;
-    // Track abort signal subscription for cleanup
     let abortSignalHandler;
-    // Shared abort controller - watchdog will fire it, spawnStreamingProcess will listen
     const forceAbortController = new AbortController();
     let exitCode;
     let signal;
@@ -97,9 +82,9 @@ export async function runAgentProcess(options) {
             command,
             args,
             cwd: agentRoot,
+            env: { SRT_DEBUG: process.env.SRT_DEBUG ?? "1" },
             stdout: { writable: stdoutStream },
             stderr: { writable: stderrStream },
-            // Spawn in new process group to enable killing entire process tree
             detached: true,
             onSpawn: (child) => {
                 watchdogController = createWatchdog(child, stderrStream, {
@@ -107,12 +92,11 @@ export async function runAgentProcess(options) {
                     onWatchdogTrigger,
                     denialBackoff,
                 });
-                // Bridge watchdog's abort signal to our shared abort controller
                 abortSignalHandler = () => forceAbortController.abort();
                 watchdogController.abortSignal.addEventListener("abort", abortSignalHandler, { once: true });
             },
-            onData: (chunk) => {
-                watchdogController?.handleOutput(chunk);
+            onData: (chunk, source) => {
+                watchdogController?.handleOutput(chunk, source);
             },
             abortSignal: forceAbortController.signal,
         });
@@ -121,12 +105,10 @@ export async function runAgentProcess(options) {
         aborted = result.aborted ?? false;
     }
     finally {
-        // Clean up abort signal listener
         if (abortSignalHandler && watchdogController) {
             watchdogController.abortSignal.removeEventListener("abort", abortSignalHandler);
         }
         watchdogController?.cleanup();
-        // Ensure streams are fully closed to prevent hanging on exit
         if (!stdoutStream.closed) {
             stdoutStream.end();
         }
@@ -152,7 +134,7 @@ export async function runAgentProcess(options) {
     const watchdog = {
         silenceTimeoutMs: WATCHDOG_DEFAULTS.silenceTimeoutMs,
         wallClockCapMs: WATCHDOG_DEFAULTS.wallClockCapMs,
-        trigger: watchdogTrigger,
+        ...(watchdogTrigger ? { trigger: watchdogTrigger } : {}),
     };
     return { exitCode, errorMessage, signal, watchdog, failFast };
 }
@@ -164,9 +146,7 @@ export async function stageManifestForSandbox(options) {
     }
     catch (error) {
         const detail = error instanceof Error ? error.message : String(error);
-        throw new AgentProcessError({
-            detail: `Failed to read manifest at "${runtimeManifestPath}": ${detail}`,
-        });
+        throw new AgentRuntimeProcessError(`Failed to read manifest at \`${runtimeManifestPath}\`: ${detail}`);
     }
     let manifest;
     try {
@@ -174,9 +154,7 @@ export async function stageManifestForSandbox(options) {
     }
     catch (error) {
         const detail = error instanceof Error ? error.message : String(error);
-        throw new AgentProcessError({
-            detail: `Manifest JSON at "${runtimeManifestPath}" is invalid: ${detail}`,
-        });
+        throw new AgentRuntimeProcessError(`Manifest JSON at \`${runtimeManifestPath}\` is invalid: ${detail}`);
     }
     const manifestDir = dirname(runtimeManifestPath);
     const promptAbsolute = isAbsolute(manifest.promptPath)

package/dist/{commands/run/agents/workspace-prep.d.ts → agents/runtime/manifest.d.ts}

@@ -1,9 +1,10 @@
-import type { AgentDefinition } from "../../../configs/agents/types.js";
-import { type EnvironmentConfig } from "../../../configs/environment/types.js";
-import type { AgentWorkspacePaths } from "../../../workspace/layout.js";
+import type { AgentDefinition } from "../../configs/agents/types.js";
+import type { EnvironmentConfig } from "../../configs/environment/types.js";
 export interface ManifestWriteOptions {
     agent: AgentDefinition;
-    workspacePaths: AgentWorkspacePaths;
+    runtimeManifestPath: string;
+    promptPath: string;
+    workspacePath: string;
     env?: Record<string, string>;
     environment: EnvironmentConfig;
 }
@@ -13,5 +14,4 @@ export declare function composeManifestEnvironment(options: {
     workspacePath: string;
     environment: EnvironmentConfig;
 }): Promise<Record<string, string>>;
-export declare function mergePathEntries(prepends: readonly string[], existing: string): string;
-export declare function normalizeRelative(origin: string, target: string): string;
+export { mergePathEntries, normalizeRelative } from "../launch/environment.js";

package/dist/agents/runtime/manifest.js

@@ -0,0 +1,34 @@
+import { mkdir, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { composeLaunchEnvironment, normalizeRelative as normalizeRelativePath, } from "../launch/environment.js";
+import { AgentRuntimeManifestError } from "./errors.js";
+export async function writeAgentManifest(options) {
+    const { agent, runtimeManifestPath, promptPath, workspacePath, env = {}, environment, } = options;
+    const manifestDir = dirname(runtimeManifestPath);
+    const manifestEnv = await composeManifestEnvironment({
+        baseEnv: env,
+        workspacePath,
+        environment,
+    });
+    const manifest = {
+        binary: agent.binary,
+        argv: [...agent.argv],
+        // Keep relative paths for readability; the launcher will normalize to absolutes.
+        promptPath: normalizeRelativePath(manifestDir, promptPath),
+        workspace: normalizeRelativePath(manifestDir, workspacePath),
+        env: manifestEnv,
+    };
+    try {
+        const manifestJson = `${JSON.stringify(manifest, null, 2)}\n`;
+        await mkdir(dirname(runtimeManifestPath), { recursive: true });
+        await writeFile(runtimeManifestPath, manifestJson, { encoding: "utf8" });
+        return manifestEnv;
+    }
+    catch (error) {
+        throw new AgentRuntimeManifestError(error instanceof Error ? error.message : String(error));
+    }
+}
+export async function composeManifestEnvironment(options) {
+    return await composeLaunchEnvironment(options);
+}
+export { mergePathEntries, normalizeRelative } from "../launch/environment.js";

package/dist/agents/runtime/policy.d.ts

@@ -0,0 +1,32 @@
+import type { SandboxFilesystemConfig, SandboxNetworkConfig } from "../../configs/sandbox/types.js";
+import type { SandboxPolicyOverrides } from "./types.js";
+export type SandboxStageId = "spec" | "run" | "reduce" | "verify" | "message";
+export interface BuildSandboxPolicyInput {
+    stageId: SandboxStageId;
+    root: string;
+    workspacePath: string;
+    sandboxHomePath: string;
+    sandboxSettingsPath: string;
+    runtimePath: string;
+    artifactsPath: string;
+    repoRootPath?: string;
+    providerFilesystem: SandboxFilesystemConfig;
+    providerNetwork: SandboxNetworkConfig;
+    policyOverrides?: SandboxPolicyOverrides;
+    stageDenyWritePaths?: readonly string[];
+    stageDenyReadPaths?: readonly string[];
+}
+export interface NormalizeFilesystemPolicyInput {
+    workspacePath: string;
+    filesystem: SandboxFilesystemConfig;
+}
+export interface NormalizeNetworkPolicyInput {
+    workspacePath: string;
+    network: SandboxNetworkConfig;
+}
+export declare function buildSandboxPolicy(input: BuildSandboxPolicyInput): {
+    filesystem: SandboxFilesystemConfig;
+    network: SandboxNetworkConfig;
+};
+export declare function normalizeFilesystemPolicy(input: NormalizeFilesystemPolicyInput): SandboxFilesystemConfig;
+export declare function normalizeNetworkPolicy(input: NormalizeNetworkPolicyInput): SandboxNetworkConfig;