@adhdev/daemon-core 0.9.82-rc.142 → 0.9.82-rc.144

package/dist/boot/process-hardening.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Process-level hardening — boot-time mitigations against provider scripts.
+ *
+ * Provider scripts run in-process (see providers/sdk/v1/sandbox/README-design.ts).
+ * The require() whitelist (sandbox/require-whitelist.ts) blocks the obvious
+ * attack surfaces (no `child_process.exec`, no `fs.writeFile`, no `net`, etc.)
+ * but a malicious or buggy script can still:
+ *
+ *   1. Pollute Object.prototype to influence the daemon's downstream consumers
+ *      (e.g. `Object.prototype.toString = () => '...'` makes every untagged
+ *      object stringify to that value across the whole process).
+ *   2. Mutate Array/Function/String prototypes for similar effect.
+ *   3. Call `process.exit()` / `process.kill()` to kill the daemon.
+ *
+ * Sandbox isolation (isolated-vm) is the proper fix but has a real perf cost
+ * and a real marshalling-complexity cost. As a cheaper layer we just freeze
+ * the built-in prototypes at boot, which is irreversible and catches every
+ * prototype-pollution variant for the lifetime of the process.
+ *
+ * `applyProcessHardening()` is idempotent — calling it twice is a no-op the
+ * second time. The function intentionally swallows any "cannot redefine
+ * property" errors that would arise if some upstream code already froze
+ * the same prototype: the post-condition (prototype is frozen) is satisfied
+ * either way.
+ *
+ * Trade-offs:
+ *   - Read-only access to prototype methods (`Object.prototype.hasOwnProperty.call`,
+ *     `Array.prototype.slice.call`, etc.) is unaffected — only writes throw.
+ *   - Some older npm libraries patch Array.prototype or Function.prototype at
+ *     import time. If a daemon-core dep does this, the import will throw. The
+ *     daemon-core vitest suite is the canonical regression check for this.
+ *   - We deliberately do NOT freeze RegExp.prototype, Error.prototype, Map/Set
+ *     prototypes, or Date.prototype because at least one of those tends to be
+ *     mutated by mainstream test/runtime libs and the value of freezing them
+ *     is low (no useful prototype-pollution attack surface).
+ */
+/**
+ * Freeze the canonical built-in prototypes so provider scripts (and anything
+ * else running in this process) cannot mutate them. Idempotent.
+ *
+ * Returns the list of prototype names that were newly frozen — primarily for
+ * tests / observability. Already-frozen prototypes are not re-reported.
+ */
+export declare function applyProcessHardening(): string[];
+/** For tests only — clears the internal "already hardened" flag. The
+ *  prototypes themselves cannot be un-frozen, so this is mostly useful for
+ *  testing the idempotency guard. */
+export declare function _resetProcessHardeningForTest(): void;
+/** For tests only — peek at the hardened state. */
+export declare function _isProcessHardened(): boolean;

package/dist/cli-adapters/cli-script-runner.d.ts

@@ -10,13 +10,76 @@
  * remain a pure transport layer without embedding parsing logic.
  */
 import { type CliApprovalInput, type CliScripts, type CliScriptInput, type CliScreenSnapshot, type CliStatusInput, type ParsedSession } from './provider-cli-shared.js';
+/**
+ * One entry per script invocation, kept in a ring buffer so debug
+ * tooling can answer "what did the script see, and what did it return?"
+ * without having to re-run the daemon with custom logs. This is the
+ * trace that would have answered the codex-cli #102 regression in one
+ * pass instead of a dozen guesses.
+ *
+ * Body fields are bounded: input is reduced to a small summary (sizes
+ * + a salted hash + the first few normalized chars of screenText), and
+ * result is JSON-serialized then capped. Full PTY frames are NOT
+ * captured here — they live in CliBufferSnapshot and are exposed by
+ * the chat debug bundle separately.
+ */
+export interface CliScriptInvocationTrace {
+    at: number;
+    scriptName: string;
+    arity: number;
+    inputSummary: {
+        screenTextLen: number;
+        rawBufferLen: number;
+        tailLen: number;
+        isWaitingForResponse?: boolean;
+        screenTextHead?: string;
+    };
+    ok: boolean;
+    elapsedUs: number;
+    resultSummary?: string;
+    error?: string;
+    /**
+     * True when the invocation's elapsed time exceeded the runner's
+     * `scriptCallBudgetMs`. The script is NOT aborted (Node CJS can't
+     * interrupt sync code without a worker thread) — this flag plus the
+     * trace ring lets an operator identify which provider is hanging the
+     * settle loop. A throttled WARN is emitted alongside.
+     */
+    timedOut?: boolean;
+}
 export declare class CliScriptRunner {
     private scripts;
     private scriptState;
     private _parseErrorMessage;
     private readonly cliType;
+    private sdk;
+    private invocationTrace;
+    /** Per-invocation wall-clock budget (ms). Configurable via setScriptCallBudget. */
+    private scriptCallBudgetMs;
+    /** Last WARN emit time per scriptName, used to throttle repeated budget violations. */
+    private lastBudgetWarnAt;
     constructor(cliType: string);
-    setScripts(scripts: CliScripts): void;
+    /** Returns the most-recent script invocation traces (oldest → newest). */
+    getInvocationTrace(): CliScriptInvocationTrace[];
+    /** Clear the trace ring — used by tests and after PTY reset. */
+    clearInvocationTrace(): void;
+    /**
+     * Configure the wall-clock budget (ms) applied to every script invocation.
+     *
+     * Out-of-range or non-finite values are clamped to [1, 5000] and the
+     * default (50ms) is used as a fallback. The budget is enforced per-call,
+     * not aggregated — it does not abort a runaway script (Node CJS cannot
+     * interrupt synchronous code without a worker thread). Instead, an
+     * exceeded budget flags the trace entry with `timedOut: true` and emits
+     * a throttled WARN naming the script and elapsed time so an operator
+     * can identify which provider is hanging the settle loop.
+     */
+    setScriptCallBudget(ms: number): void;
+    /** Test/debug accessor — current effective budget in ms. */
+    getScriptCallBudgetMs(): number;
+    private recordTrace;
+    setScripts(scripts: CliScripts, providerTui?: Record<string, unknown> | undefined): void;
+    private buildSdk;
     /** Reset per-session state — called when the PTY process exits. */
     resetSessionState(): void;
     /** Returns the live scripts object. Direct property assignment on this object
@@ -42,4 +105,13 @@ export declare class CliScriptRunner {
      */
     invokeByName(name: string, input: any): any;
     private invoke;
+    /**
+     * Returns true when `elapsedUs` exceeded the configured budget. On the
+     * first violation per script (or after the throttle window expires) we
+     * emit a single WARN so the operator learns which provider is slow.
+     *
+     * We deliberately throttle per-scriptName so a chronically-slow
+     * detectStatus doesn't spam the log on every PTY frame settle.
+     */
+    private checkBudget;
 }

package/dist/cli-adapters/provider-cli-adapter.d.ts

@@ -65,6 +65,23 @@ export declare class ProviderCliAdapter implements CliAdapter {
     private readonly runner;
     /** @deprecated use runner.cliScripts for direct script access */
     get cliScripts(): CliScripts;
+    /**
+     * Recent script invocations (oldest → newest). Exposed via the
+     * `get_chat_debug_bundle` daemon command so anyone debugging a
+     * stuck-status regression can read what each detectStatus /
+     * parseSession call actually saw and returned, instead of having
+     * to instrument the daemon.
+     */
+    getScriptInvocationTrace(): import("./cli-script-runner.js").CliScriptInvocationTrace[];
+    /**
+     * Returns the full raw PTY byte stream captured since adapter start.
+     * Used by the `record_provider_pty` IPC command to produce fixtures.
+     * Bounded by MAX_ACCUMULATED_BUFFER; older bytes may have been dropped.
+     */
+    getAccumulatedRawBuffer(): {
+        text: string;
+        droppedChars: number;
+    };
     set cliScripts(scripts: CliScripts);
     private runtimeSettings;
     /** Full accumulated rendered PTY transcript for parser/readback use */

package/dist/cli-adapters/provider-cli-shared.d.ts

@@ -175,6 +175,10 @@ export interface CliProviderModule {
     binary: string;
     approvalKeys?: Record<number, string>;
     sendDelayMs?: number;
+    /** Wall-clock budget (ms) for a single provider script invocation. Default 50. Range 1..5000.
+     *  Exceeding the budget records `timedOut: true` on the invocation trace and emits a
+     *  throttled WARN — it does NOT abort the script (Node CJS can't interrupt sync code). */
+    scriptCallBudgetMs?: number;
     sendKey?: string;
     submitStrategy?: 'wait_for_echo' | 'immediate';
     /** Require the typed prompt to be visible on the PTY screen before sending Enter. */
@@ -189,6 +193,8 @@ export interface CliProviderModule {
     transcriptAuthority?: 'provider' | 'daemon';
     /** Full context lets provider-owned parsers canonicalize retained history instead of daemon prefix stitching. */
     transcriptContext?: 'full' | 'tail';
+    /** v1 declarative tui block — used by CliScriptRunner to synthesize SDK helpers (declarativeDetectStatus, declarativeParseApproval). */
+    tui?: Record<string, unknown>;
     scripts?: CliScripts;
     spawn: {
         command: string;

package/dist/commands/handler.d.ts

@@ -104,7 +104,73 @@ export declare class DaemonCommandHandler implements CommandHelpers {
     setAgentStreamManager(manager: DaemonAgentStreamManager): void;
     handle(cmd: string, args: any): Promise<CommandResult>;
     private dispatch;
+    /**
+     * Reload providers from disk. Does NOT pull from the registry — the user
+     * controls installs explicitly via install_provider_manifest. To upgrade
+     * an installed provider, call install_provider_manifest again with the
+     * desired version (or with no version to pick up the latest from
+     * registry), or use check_provider_updates to see what is out of date.
+     */
     private handleRefreshScripts;
+    /**
+     * Return per-provider availability so a Marketplace UI can show
+     * "Installed" badges. Reuses the existing detection state from
+     * ProviderLoader.getMachineProviderStatus() — no probing is triggered.
+     */
+    private handleListProviderAvailability;
+    /**
+     * Compute the *Marketplace install root*. This is always
+     * `~/.adhdev/marketplace/` regardless of how ProviderLoader resolved its
+     * userDir (which can point to a sibling adhdev-providers git checkout in
+     * dev). Marketplace-installed manifests must never overwrite files in a
+     * developer checkout, and they should be isolated from upstream/registry
+     * sync so they survive `refresh_scripts`.
+     */
+    private getMarketplaceInstallRoot;
+    /**
+     * Download a single provider manifest from the registry and write it to
+     * ~/.adhdev/marketplace/{category}/{type}/provider.json.
+     *
+     * Used by the Marketplace UI's Install button. Verifies SHA-256 checksum
+     * against the registry meta before persisting. Refuses to write outside
+     * the marketplace root.
+     *
+     * Args: { type: string, category?: string, version?: string }
+     * If category/version are omitted, looks up the latest from the registry.
+     */
+    private handleInstallProviderManifest;
+    /**
+     * If `manifest.source = { type:'github', repo, ref, subdir? }` is set,
+     * walk each script directory the manifest references and download every
+     * file from the public GitHub raw endpoint. Returns a small summary so
+     * the caller can report what was fetched.
+     *
+     * Best-effort: failures don't reject the install — the manifest itself is
+     * usable for declarative-only providers, and the user still gets a clear
+     * error string back if a needed script is missing.
+     */
+    private fetchProviderSources;
+    /**
+     * Remove a provider manifest from the marketplace install root
+     * (~/.adhdev/marketplace/{category}/{type}/). Refuses to touch anything
+     * outside that root.
+     */
+    private handleUninstallProviderManifest;
+    /**
+     * Return everything currently installed in ~/.adhdev/marketplace/ with its
+     * version. This is the "what does this daemon have" answer used both by
+     * the UI and by the update checker.
+     */
+    private handleListInstalledProviders;
+    /**
+     * For each installed provider, ask the registry for its current latest
+     * version and report whether an update is available. The user can then
+     * call install_provider_manifest to upgrade (it overwrites the file).
+     *
+     * Returns { providers: [{ type, category, installedVersion, latestVersion,
+     *   updateAvailable, error? }] }
+     */
+    private handleCheckProviderUpdates;
     private proxyDevServerPost;
     private proxyDevServerGet;
     private proxyDevServerScaffold;

package/dist/index.d.ts

@@ -134,3 +134,5 @@ export { getAIExtensions, installExtensions, launchIDE, isExtensionInstalled } f
 export type { ExtensionInfo as InstallerExtensionInfo } from './installer.js';
 export { initDaemonComponents, startDaemonDevSupport, shutdownDaemonComponents } from './boot/daemon-lifecycle.js';
 export type { DaemonInitConfig, DaemonComponents, DaemonDevSupportOptions } from './boot/daemon-lifecycle.js';
+export { startLocalIpcServer, buildIpcStatusHttpResponse, type LocalIpcServerOptions, type LocalIpcServerHandle, type IpcCommandContext, type IpcCommandResult, type IpcStatusPayload, } from './ipc/local-ipc-server.js';
+export { validateCliProviderManifest, formatManifestValidationIssues, type ManifestValidationIssue, type ManifestValidationResult, V1_CONTRACT_VERSION, V1_PRIMITIVE_CATALOG, V1_ALL_PRIMITIVES, } from './providers/sdk/v1/index.js';