witnora 0.20.3 → 0.20.5

package/dist/gateway.js

@@ -56,7 +56,7 @@ export async function initializeCustomerGateway(options) {
         projectId: authorization.projectId,
         server: authorization.server,
         connectionName: authorization.connectionName,
-        collectorId: `${slug}-collector`,
+        collectorId: collectorIdForRepository(repository, options.projectId),
         host: process.env.WITNORA_GATEWAY_HOST?.trim() || "127.0.0.1",
         port: gatewayPort(process.env.WITNORA_GATEWAY_PORT, 8787),
         storageDirectory: "data",
@@ -223,8 +223,18 @@ export async function ensureCustomerGatewayPortAvailable(options) {
     const httpActionRaw = await readFile(httpActionPath, "utf8").catch((error) => error.code === "ENOENT" ? undefined : Promise.reject(error));
     const httpAction = httpActionRaw ? parseCustomerHttpActionConfig(httpActionRaw) : undefined;
     const httpActionGuideRaw = httpAction ? await readFile(httpActionGuidePath, "utf8") : undefined;
-    const health = await localCollector(current.host, current.port, options.fetch ?? fetch);
-    if (health === current.collectorId || (!health && await canListen(current.host, current.port))) {
+    const requestFetch = options.fetch ?? fetch;
+    let health = await localCollector(current.host, current.port, requestFetch);
+    if (!health && await canListen(current.host, current.port)) {
+        // A supervised Gateway can leave a short window between process exit and
+        // recovery. Recheck before claiming the port so another repository's
+        // supervisor cannot reclaim it between this probe and service startup.
+        await (options.sleep ?? wait)(600);
+        health = await localCollector(current.host, current.port, requestFetch);
+        if (!health && await canListen(current.host, current.port))
+            return { changed: false, port: current.port };
+    }
+    if (health === current.collectorId) {
         return { changed: false, port: current.port };
     }
     if (clientRaw !== gatewayClient(current) || readmeRaw !== gatewayReadme(current)
@@ -566,6 +576,10 @@ export async function runCustomerGateway(options) {
                 FileActionCheckpointStore: (await durableWorker).FileActionCheckpointStore,
             })
             : undefined;
+        const probeCredentialReady = createBoundedRuntimeProbeReadiness({
+            check: () => runtimeProbeCredentialReady(config, options.configHome),
+            initialReady: true,
+        });
         const assuranceController = await createContinuousAssuranceController({
             repository: resolve(directory, "..", ".."), directory, projectId: config.projectId, server: config.server,
             apiKey: connection.apiKey, config, sourceSigner: () => keyRing.activeSigner(),
@@ -588,7 +602,7 @@ export async function runCustomerGateway(options) {
                     track: (input) => isConfiguredRuntimeProposal(input.proposal, config.runtimeWorker) ? actionWorker.track(input) : Promise.resolve(undefined),
                     status: async () => {
                         const status = await actionWorker.status();
-                        const probeReady = await runtimeProbeCredentialReady(config, options.configHome);
+                        const probeReady = await probeCredentialReady();
                         return {
                             ...status,
                             ready: status.ready === true && probeReady,
@@ -649,6 +663,11 @@ async function configManagedWorkflowHarnessImport() {
 function configBusinessTaskEvaluatorImport() {
     return import(new URL("./vendor/onegent-runtime/business-task-evaluator.js", import.meta.url).href);
 }
+export function workflowHarnessTickDidWork(result) {
+    return (result.evaluationsCompleted ?? 0) > 0
+        || (result.evaluationsFailed ?? 0) > 0
+        || (result.runtimeWatchObservationsUploaded ?? 0) > 0;
+}
 export async function createConfiguredWorkflowHarness(input) {
     const requestFetch = input.fetch ?? fetch;
     let managedEvaluator;
@@ -717,6 +736,8 @@ export async function createConfiguredWorkflowHarness(input) {
         && input.config.realPathActivations[0].actionPathIds.length === 1
         ? input.config.realPathActivations[0]
         : undefined;
+    const basePollIntervalMs = input.config.pollIntervalMs ?? 5_000;
+    const maxIdlePollIntervalMs = Math.max(basePollIntervalMs, 15 * 60_000);
     const runtimeWatch = runtimeWatchConfiguration
         && input.managed.ManagedFailureRuntimeWatch
         && input.managed.FileFailureRuntimeWatchCheckpointStore
@@ -730,7 +751,7 @@ export async function createConfiguredWorkflowHarness(input) {
                 fetch: requestFetch,
             }),
             checkpoints: new input.managed.FileFailureRuntimeWatchCheckpointStore(join(input.directory, "data", "failure-runtime-watch")),
-            intervalMs: input.config.pollIntervalMs ?? 5_000,
+            intervalMs: maxIdlePollIntervalMs,
             ...(activation ? { bindings: [{ taskContractId: activation.taskContractId, actionPathId: activation.actionPathIds[0], environment: "sandbox" }] } : {}),
             readOutcome: async ({ resourceId, actions, receipts }) => input.managed.readLocalSandboxRuntimeWatchOutcome({
                 path: join(input.directory, "data", "runtime-sandbox", "fixture", "audit.jsonl"),
@@ -744,6 +765,7 @@ export async function createConfiguredWorkflowHarness(input) {
         : undefined;
     let timer;
     let closing = false;
+    let idleTicks = 0;
     let lastTickAt;
     let lastError;
     let lastProviderHealthAt = 0;
@@ -778,14 +800,33 @@ export async function createConfiguredWorkflowHarness(input) {
         start() {
             if (timer || closing)
                 return;
-            void tick().catch((error) => process.stderr.write(`Managed Workflow Harness tick failed: ${error instanceof Error ? error.message : "unknown error"}\n`));
-            timer = setInterval(() => void tick().catch((error) => process.stderr.write(`Managed Workflow Harness tick failed: ${error instanceof Error ? error.message : "unknown error"}\n`)), input.config.pollIntervalMs ?? 5_000);
-            timer.unref?.();
+            const schedule = (delayMs) => {
+                if (closing)
+                    return;
+                timer = setTimeout(() => void run(), delayMs);
+                timer.unref?.();
+            };
+            const run = async () => {
+                let didWork = false;
+                try {
+                    const result = await tick();
+                    didWork = workflowHarnessTickDidWork(result);
+                }
+                catch (error) {
+                    process.stderr.write(`Managed Workflow Harness tick failed: ${error instanceof Error ? error.message : "unknown error"}\n`);
+                }
+                if (closing)
+                    return;
+                idleTicks = didWork ? 0 : idleTicks + 1;
+                const multiplier = 2 ** Math.max(0, idleTicks - 1);
+                schedule(Math.min(maxIdlePollIntervalMs, basePollIntervalMs * multiplier));
+            };
+            schedule(0);
         },
         async close() {
             closing = true;
             if (timer)
-                clearInterval(timer);
+                clearTimeout(timer);
             timer = undefined;
             await managedEvaluator?.close();
         },
@@ -1317,12 +1358,15 @@ export async function statusManagedCustomerGateway(options = {}) {
         pid: runtime?.pid,
         logPath: runtime?.logPath,
     };
-    if (health && health.collectorId !== config.collectorId) {
-        return { ...base, state: "CONFLICT", healthy: false, managed: false, detail: `Port ${config.port} is occupied by collector ${health.collectorId}, not ${config.collectorId}.` };
-    }
     if (runtime && !runtimeMatches(runtime, config)) {
+        if (!pidRunning(runtime.pid)) {
+            return { ...base, state: "STALE", healthy: false, managed: false, detail: "Managed Gateway runtime metadata belongs to an older generated identity and its recorded process is no longer running." };
+        }
         return { ...base, state: "CONFLICT", healthy: false, managed: false, detail: "Managed Gateway runtime metadata belongs to a different project or collector." };
     }
+    if (health && health.collectorId !== config.collectorId) {
+        return { ...base, state: "CONFLICT", healthy: false, managed: false, detail: `Port ${config.port} is occupied by collector ${health.collectorId}, not ${config.collectorId}.` };
+    }
     if (health) {
         const managed = Boolean(runtime && pidRunning(runtime.pid));
         return {
@@ -2181,6 +2225,39 @@ function wait(milliseconds) {
 function safeSlug(value) {
     return (value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "agent-repository").slice(0, 48);
 }
+export function createBoundedRuntimeProbeReadiness(input) {
+    const now = input.now ?? Date.now;
+    const successTtlMs = input.successTtlMs ?? 300_000;
+    const failureTtlMs = input.failureTtlMs ?? 15_000;
+    let ready = input.initialReady ?? false;
+    let checkedAt = input.initialReady === undefined ? Number.NEGATIVE_INFINITY : now();
+    let pending;
+    return async () => {
+        const ttl = ready ? successTtlMs : failureTtlMs;
+        if (now() - checkedAt < ttl)
+            return ready;
+        if (pending)
+            return pending;
+        pending = input.check()
+            .then((nextReady) => {
+            ready = nextReady;
+            checkedAt = now();
+            return ready;
+        })
+            .catch(() => {
+            ready = false;
+            checkedAt = now();
+            return false;
+        })
+            .finally(() => { pending = undefined; });
+        return pending;
+    };
+}
+function collectorIdForRepository(repository, projectId) {
+    const readable = safeSlug(basename(repository)).slice(0, 36);
+    const identity = createHash("sha256").update(`${resolve(repository)}\n${projectId}`).digest("hex").slice(0, 10);
+    return `${readable}-${identity}-collector`;
+}
 function message(error) {
     return error instanceof Error ? error.message : String(error);
 }

package/dist/onboard.js

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { access, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { DEFAULT_WITNORA_SERVER, saveConnection } from "./credentials.js";
+import { credentialsPath, DEFAULT_WITNORA_SERVER, loadConnection, saveConnection } from "./credentials.js";
 import { authorizeProjectConnection } from "./device-authorization.js";
 import { verifyControlPlaneConnection } from "./control-plane.js";
 import { inferPrivateCapabilities, runPrivateCapabilityDiscovery } from "./private-discovery.js";
@@ -26,7 +26,15 @@ export async function runOnboard(options) {
         framework: frameworkForTemplate(repository.template),
     };
     const connectionName = options.name ?? repository.slug;
-    const token = await authorizeProjectConnection({
+    const reusableConnection = await loadMatchingOnboardConnection({
+        repository: repositoryPath,
+        projectId: options.projectId,
+        server,
+        connectionName,
+        configHome: options.configHome,
+        fetch: requestFetch,
+    });
+    const token = reusableConnection ?? await authorizeProjectConnection({
         projectId: options.projectId,
         connectionName,
         credentialProfile: "autopilot",
@@ -38,6 +46,8 @@ export async function runOnboard(options) {
         output,
         configHome: options.configHome,
     });
+    if (reusableConnection)
+        output("Reusing the previously approved project-scoped setup connection; no new browser approval is required.\n");
     const credentialsPath = token.credentialsPath;
     await verifyControlPlaneConnection({ baseUrl: server, projectId: token.projectId, apiKey: token.apiKey, fetch: requestFetch });
     const planSnapshot = await jsonRequest(requestFetch, `${server}/v1/projects/${encodeURIComponent(token.projectId)}/setup-plans`, {
@@ -211,7 +221,7 @@ export async function runOnboard(options) {
                         if (!(error instanceof RuntimeSetupNotReadyError))
                             throw error;
                         runtimeLimitation = `Local sandbox Runtime references were found but did not establish readiness: ${error.message}`;
-                        output("\nExisting customer-owned Gateway remains RECORDED_ONLY because its Runtime references did not pass readiness checks.\n");
+                        output(`\nExisting customer-owned Gateway remains RECORDED_ONLY because its Runtime references did not pass readiness checks: ${error.message}\n`);
                     }
                 }
                 else {
@@ -336,7 +346,7 @@ export async function runOnboard(options) {
             output(`Action transport: ${actionTransportTest.transport.toUpperCase()} is waiting for one exact sandbox Task/action path. ${actionTransportTest.limitation}\n`);
         }
         output(actionTransportTest?.state === "WAITING_FOR_ACTION_PATH"
-            ? `Base Gateway connected, but ${actionTransportTest.transport.toUpperCase()} Action is not verified yet. Go to Overview, run the Agent once, confirm one exact sandbox Business Task/action path, then rerun this same command.\n`
+            ? `Base Gateway connected, but ${actionTransportTest.transport.toUpperCase()} Action is not verified yet. Run the Agent's normal sandbox workflow from this repository; there is no Run button in Overview. Once Overview receives the activity, confirm one sandbox Business Task and choose its exact discovered Agent action, then rerun this same command.\n`
             : "Connected. Nora is monitoring this Agent. Run it normally whenever it is ready; the first source-signed activity will appear automatically without blocking setup.\n");
         return { projectId: token.projectId, connectionName: token.connectionName, credentialsPath, template: repository.template,
             repositoryKind: repository.kind, generatedFiles, receiptPath, discovery, setupPlanId: setupPlan.id,
@@ -368,6 +378,35 @@ export async function runOnboard(options) {
         throw new Error(`Witnora Setup Autopilot rolled back this install attempt: ${diagnosis}`);
     }
 }
+const AUTOPILOT_CONNECTION_SCOPES = [
+    "runs:read", "runs:write", "events:write", "evidence:write", "collector:manage",
+    "actions:read", "actions:propose", "actions:execute",
+];
+async function loadMatchingOnboardConnection(options) {
+    const gateway = await inspectCustomerGatewayFiles({ repository: options.repository });
+    try {
+        let candidateName = options.connectionName;
+        if (gateway.status === "complete") {
+            const config = JSON.parse(await readFile(join(gateway.directory, "gateway.json"), "utf8"));
+            if (config.projectId !== options.projectId || config.server !== options.server || typeof config.connectionName !== "string")
+                return undefined;
+            candidateName = config.connectionName;
+        }
+        const stored = await loadConnection(candidateName, { configHome: options.configHome });
+        if (!stored || stored.projectId !== options.projectId || stored.server !== options.server)
+            return undefined;
+        await verifyControlPlaneConnection({ baseUrl: stored.server, projectId: stored.projectId, apiKey: stored.apiKey, fetch: options.fetch });
+        return {
+            ...stored,
+            connectionName: candidateName,
+            credentialsPath: credentialsPath({ configHome: options.configHome }),
+            scopes: [...AUTOPILOT_CONNECTION_SCOPES],
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
 async function runActionTransportTest(options) {
     if (!options.httpActionReady)
         return {

package/dist/vendor/onegent-runtime/failure-runtime-watch.js

@@ -87,8 +87,8 @@ export class ManagedFailureRuntimeWatch {
         this.#now = options.now ?? (() => new Date());
         this.#readOutcome = options.readOutcome;
         this.#bindings = options.bindings ? new Set(options.bindings.map(bindingKey)) : undefined;
-        if (!Number.isSafeInteger(this.#intervalMs) || this.#intervalMs < 1_000 || this.#intervalMs > 60_000) {
-            throw new Error("Failure Runtime Watch intervalMs must be between 1000 and 60000.");
+        if (!Number.isSafeInteger(this.#intervalMs) || this.#intervalMs < 1_000 || this.#intervalMs > 15 * 60_000) {
+            throw new Error("Failure Runtime Watch intervalMs must be between 1000 and 900000.");
         }
     }
     tick() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.20.3",
+  "version": "0.20.5",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",