Skip to content

fix(work-item-pipeline): finalize acts under claim-holder identity (item #137) #534

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
getappz wants to merge 1 commit into from
Closed

fix(work-item-pipeline): finalize acts under claim-holder identity (item #137) #534

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/dashboard/server.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -765,6 +765,7 @@ pub async fn run(host: &str, port: u16, open: bool, yes_expose: bool) {
std::time::Duration::from_secs(crate::cli::work::DEFAULT_TIMEOUT_SECS),
std::time::Duration::from_secs(crate::cli::work::DEFAULT_IDLE_TIMEOUT_SECS),
Vec::new(),
None,
);
if let Err(e) = crate::work_item_pipeline::engine().register_workflow(dummy_definition) {
crate::ui::error(&format!(
Expand Down
64 changes: 52 additions & 12 deletions src/work_item_pipeline.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,6 +409,22 @@ pub(crate) fn build_sdd_loop_step(
))
}

/// Runs `f` under the claim-holder identity so the MCP claim guard (which
/// resolves `claims::owner_id()` per call) sees the owner that actually holds
/// this item's claim. The workflow's own process/thread identity is not the
/// dispatch agent's — each `sdd_loop` role ran in its own subprocess, and
/// `finalize` runs on the engine's runtime thread — so without this override
/// `finalize`'s `item_done`/`item_release` is refused as "someone else's live
/// claim". `None`/empty falls through to the ambient identity (the pre-fix
/// behavior), which is correct when there's no known claim holder (e.g. the
/// boot-time dummy definition in `src/dashboard/server.rs`).
fn run_as_claim_holder<T>(owner: Option<&str>, f: impl FnOnce() -> T) -> T {
match owner.filter(|o| !o.trim().is_empty()) {
Some(o) => crate::claims::with_owner_override(o, f),
None => f(),
}
}

/// Wraps `execute_work`'s existing hold/`item_done`/comment/notify tail
/// (`src/cli/work.rs`'s `HeadlessOutcome::Ok` arm) as the pipeline's last
/// step. Three outcomes, checked in order:
Expand All @@ -435,18 +451,22 @@ pub(crate) fn build_finalize_step(
mcp: std::sync::Arc<AgentflareMcp>,
item_id: String,
notify_recipient: Option<String>,
owner: Option<String>,
) -> StepDefinition<WorkItemData> {
let executor = std::sync::Arc::new(FunctionStep::new(
move |ctx: &mut WorkflowContext<WorkItemData>| {
let mcp = mcp.clone();
let item_id = item_id.clone();
let notify_recipient = notify_recipient.clone();
let owner = owner.clone();
Box::pin(async move {
if let Some(reason) = ctx.data.hold_reason.clone() {
let _ = mcp.item_release(ItemRequest {
action: "release".into(),
id: Some(item_id.clone()),
..Default::default()
let _ = run_as_claim_holder(owner.as_deref(), || {
mcp.item_release(ItemRequest {
action: "release".into(),
id: Some(item_id.clone()),
..Default::default()
})
});
let body = format!("## agentflare work — on hold\n\n{reason}");
let _ = mcp.comment_impl(CommentRequest {
Expand Down Expand Up @@ -476,17 +496,18 @@ pub(crate) fn build_finalize_step(
return Ok(StepResult::Success);
}

let done_resp = mcp
.item_done(ItemRequest {
let done_resp = run_as_claim_holder(owner.as_deref(), || {
mcp.item_done(ItemRequest {
action: "done".into(),
id: Some(item_id.clone()),
summary: Some(ctx.data.reply_text.clone()),
..Default::default()
})
.map_err(|e| WorkflowError::StepFailed {
step_id: StepId::new("finalize"),
message: e.message.to_string(),
})?;
})
.map_err(|e| WorkflowError::StepFailed {
step_id: StepId::new("finalize"),
message: e.message.to_string(),
})?;
let done_val: serde_json::Value =
serde_json::from_str(&done_resp).unwrap_or(serde_json::Value::Null);
ctx.data.pr_url = done_val["pr_url"].as_str().map(str::to_string);
Expand Down Expand Up @@ -537,6 +558,7 @@ pub(crate) fn build_work_item_pipeline(
timeout: std::time::Duration,
idle_timeout: std::time::Duration,
extra_args: Vec<String>,
owner: Option<String>,
) -> flare_workflow::WorkflowDefinition<WorkItemData> {
build_work_item_pipeline_with_sender(
agent,
Expand All @@ -546,6 +568,7 @@ pub(crate) fn build_work_item_pipeline(
item_id,
notify_recipient,
real_agent_send_hook(timeout, idle_timeout, extra_args),
owner,
)
}

Expand Down Expand Up @@ -605,10 +628,11 @@ fn build_work_item_pipeline_with_sender(
item_id: String,
notify_recipient: Option<String>,
send: flare_workflow::json::SendMessage,
owner: Option<String>,
) -> flare_workflow::WorkflowDefinition<WorkItemData> {
let agent_name = agent.as_str().to_string();
let sdd_loop = build_sdd_loop_step(agent_name.clone(), agent_name, send);
let finalize = build_finalize_step(mcp, item_id, notify_recipient).depends_on(&["sdd_loop"]);
let finalize = build_finalize_step(mcp, item_id, notify_recipient, owner).depends_on(&["sdd_loop"]);

flare_workflow::WorkflowDefinition::new(WORKFLOW_ID, "sdd work item")
.add_step(sdd_loop)
Expand Down Expand Up @@ -716,6 +740,7 @@ pub(crate) fn run_or_resume_with_sender(
item.id.clone(),
notify_recipient,
send,
item.assignee_agent.clone(),
);
eng.register_workflow(definition)
.map_err(|e| e.to_string())?;
Expand Down Expand Up @@ -1031,7 +1056,7 @@ mod tests {
reply_text: "implemented the thing".into(),
..Default::default()
};
let step = build_finalize_step(mcp.clone(), item_id.clone(), None);
let step = build_finalize_step(mcp.clone(), item_id.clone(), None, None);
let wf = WorkflowDefinition::new(WORKFLOW_ID, "work item").add_step(step);
let engine = WorkflowEngine::<WorkItemData, InMemoryStore<WorkItemData>>::new();
engine.register_workflow(wf).unwrap();
Expand Down Expand Up @@ -1210,13 +1235,28 @@ mod pipeline_assembly_tests {
"item-1".to_string(),
None,
send,
None,
);
assert_eq!(pipeline.steps.len(), 2);
assert_eq!(pipeline.steps[0].id.to_string(), "sdd_loop");
assert_eq!(pipeline.steps[1].id.to_string(), "finalize");
assert_eq!(pipeline.steps[1].depends_on, vec![StepId::new("sdd_loop")]);
}

/// The finalize step must present the *claim-holder's* identity to the
/// MCP claim guard, not the engine thread's ambient one — otherwise
/// `item_done`/`item_release` are refused as "someone else's live claim".
#[test]
fn run_as_claim_holder_uses_override_when_present_and_ambient_when_absent() {
assert_eq!(
run_as_claim_holder(Some("opencode:job-42"), crate::claims::owner_id),
"opencode:job-42"
);
let ambient = crate::claims::owner_id();
assert_eq!(run_as_claim_holder(None, crate::claims::owner_id), ambient);
assert_eq!(run_as_claim_holder(Some(" "), crate::claims::owner_id), ambient);
}

/// Regression test: `sdd_loop`'s per-iteration engine timeout must not
/// fall back to `flare_workflow::WorkflowDefinition::new`'s 300s
/// library default -- a real implementer/reviewer/judge dispatch
Expand Down