@agentconnect.md/daemon 1.0.0-rc.62 → 1.0.0-rc.63

package/dist/index.js

@@ -4,7 +4,7 @@ import { EventEmitter } from "node:events";
 import childProcess, { execFile, spawn } from "node:child_process";
 import * as sp from "node:path";
 import path, { delimiter, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
-import fs, { accessSync, chmodSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, stat, unlinkSync, unwatchFile, watch, watchFile, writeFileSync } from "node:fs";
+import fs, { accessSync, chmodSync, constants, existsSync, mkdirSync, mkdtempSync, promises, readFileSync, readdirSync, rmSync, stat, unlinkSync, unwatchFile, watch, watchFile, writeFileSync } from "node:fs";
 import process$1 from "node:process";
 import { stripVTControlCharacters } from "node:util";
 import { fileURLToPath } from "node:url";
@@ -13254,6 +13254,72 @@ const SessionHistoryPage = object({
 	nextCursor: string().optional()
 });
 //#endregion
+//#region ../protocol/dist/frames/workspace.js
+/**
+* Agent workspace file browsing (C→D REQ → REP) — the console's on-demand pulls.
+*
+* The CP stores NO workspace data — directory listings and file bytes are pulled
+* live from the owning daemon and proxied to the console, never persisted
+* (body-locality). Missing paths are DATA (`exists:false`), not errors; only
+* path-containment violations (`BAD_PAYLOAD`) and unexpected fs failures
+* (`INTERNAL`) come back as `error` frames.
+*
+* - `workspace/list`: one cursor-paginated page of a directory's entries.
+* - `workspace/read`: one byte slice of a file. `limit` is only a ceiling — the
+*   daemon returns FEWER bytes when needed to keep the JSON-escaped REP under the
+*   256 KiB frame cap (control bytes escape to `\uXXXX`, a 6× blowup), and always
+*   ends the slice on a UTF-8 character boundary. `nextOffset` is the authoritative
+*   byte offset to request next — callers must NOT recompute it from the decoded
+*   `content` (a split multi-byte char would make the byte count drift).
+*/
+/** One directory entry in a workspace listing (name-only; not a full path). */
+const WorkspaceEntry = object({
+	name: string(),
+	type: _enum([
+		"dir",
+		"file",
+		"symlink",
+		"other"
+	]),
+	size: number().int().nonnegative().optional(),
+	mtime: string().optional()
+});
+/** C→D REQ: list one page of a directory in the agent's workspace. */
+const WorkspaceListReq = object({
+	agentId: string().min(1),
+	path: string().default(""),
+	cursor: string().optional(),
+	limit: number().int().positive().max(500).default(200)
+});
+/** D→C REP (corr = the req id): a page of entries + the cursor for the next page. */
+const WorkspaceListPage = object({
+	agentId: string(),
+	path: string(),
+	exists: boolean(),
+	entries: array(WorkspaceEntry),
+	nextCursor: string().optional()
+});
+/** C→D REQ: read one byte slice of a file in the agent's workspace. */
+const WorkspaceReadReq = object({
+	agentId: string().min(1),
+	path: string().min(1),
+	offset: number().int().nonnegative().default(0),
+	limit: number().int().positive().max(65536).default(65536)
+});
+/** D→C REP (corr = the req id): the file slice (or `exists:false` / binary-detected). */
+const WorkspaceReadContent = object({
+	agentId: string(),
+	path: string(),
+	exists: boolean(),
+	size: number().int().nonnegative().optional(),
+	mtime: string().optional(),
+	encoding: _enum(["utf8", "none"]).optional(),
+	content: string().optional(),
+	offset: number().int().nonnegative().optional(),
+	nextOffset: number().int().nonnegative().optional(),
+	truncated: boolean().optional()
+});
+//#endregion
 //#region ../protocol/dist/frames/telemetry.js
 /**
 * Telemetry & facts (D→C) — protocol §7.
@@ -13373,6 +13439,10 @@ const FRAME_SCHEMAS = {
 	"session/list/page": SessionListPage,
 	"session/history": SessionHistoryReq,
 	"session/history/page": SessionHistoryPage,
+	"workspace/list": WorkspaceListReq,
+	"workspace/list/page": WorkspaceListPage,
+	"workspace/read": WorkspaceReadReq,
+	"workspace/read/content": WorkspaceReadContent,
 	"config/push": object({ keys: record(string(), unknown()) }),
 	"daemon/restart": object({
 		reason: string(),
@@ -13468,6 +13538,10 @@ discriminatedUnion("type", [
 	frame("session/list/page", FRAME_SCHEMAS["session/list/page"]),
 	frame("session/history", FRAME_SCHEMAS["session/history"]),
 	frame("session/history/page", FRAME_SCHEMAS["session/history/page"]),
+	frame("workspace/list", FRAME_SCHEMAS["workspace/list"]),
+	frame("workspace/list/page", FRAME_SCHEMAS["workspace/list/page"]),
+	frame("workspace/read", FRAME_SCHEMAS["workspace/read"]),
+	frame("workspace/read/content", FRAME_SCHEMAS["workspace/read/content"]),
 	frame("config/push", FRAME_SCHEMAS["config/push"]),
 	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
 	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
@@ -81991,6 +82065,237 @@ function makeLogger(level = "info") {
 	};
 }
 //#endregion
+//#region src/cp/workspace-reader.ts
+/**
+* `WorkspaceReader` — the read-only seam answering the CP's `workspace/list` and
+* `workspace/read` REQs from the agent's local workspace directory. File bytes
+* live only on the daemon (§1/§12); this streams single pages/slices to the CP,
+* never whole trees or files.
+*
+* Containment is to `workspace.path` EXACTLY — the parent directory holds
+* `agent.json` and `.env` secrets, so escaping even one level is a secret leak.
+* Every request path is (1) rejected if absolute, (2) lexically resolved against
+* the root and prefix-checked, then (3) canonicalised with `realpath` and
+* re-verified so symlinks (including an intermediate directory component swapped
+* to a symlink after the check) cannot smuggle a target outside the root; all
+* I/O runs on the canonical path. Violations throw `WorkspaceViolationError`,
+* which the dispatcher maps to a `BAD_PAYLOAD` error frame; missing paths are
+* data (`exists:false`), not errors. Never log file contents.
+*
+* Frame-size safety: every REP must serialise under the 256 KiB wire cap. JSON
+* escaping of control bytes is a 6× blowup, so `read` bounds the slice by the
+* *encoded* reply size (not the raw byte `limit`) and `list` stops a page early
+* when the encoded entries would overflow — both leave headroom for the envelope.
+*/
+/** Bytes sniffed from the head of a file for binary (NUL byte) detection. */
+const SNIFF_BYTES = 8192;
+/** Encoded-payload ceiling, leaving headroom under MAX_FRAME_BYTES for the
+*  envelope (id/ts/type/corr + fencing ext, well under 4 KiB). */
+const REPLY_BUDGET = MAX_FRAME_BYTES - 4096;
+/** Path-containment / bad-request violation → `BAD_PAYLOAD` on the wire. */
+var WorkspaceViolationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WorkspaceViolationError";
+	}
+};
+function isErrno(err, code) {
+	return err?.code === code;
+}
+function under(root, p) {
+	return p === root || p.startsWith(root + sp.sep);
+}
+/** Largest index ≤ `len` that lands on a UTF-8 character boundary — i.e. never
+*  cuts a multi-byte sequence. If the slice's trailing char is incomplete, the
+*  boundary is placed before that char (its bytes belong to the next slice). */
+function utf8Boundary(buf, len) {
+	if (len >= buf.length) len = buf.length;
+	if (len <= 0) return 0;
+	let start = len - 1;
+	while (start > 0 && ((buf[start] ?? 0) & 192) === 128) start--;
+	const lead = buf[start] ?? 0;
+	const seqLen = lead < 128 ? 1 : (lead & 224) === 192 ? 2 : (lead & 240) === 224 ? 3 : (lead & 248) === 240 ? 4 : 1;
+	return start + seqLen <= len ? len : start;
+}
+/** The encoded size of the payload the wire will carry (JSON.stringify matches
+*  the codec's `encode`), measured in bytes. */
+function encodedBytes(payload) {
+	return Buffer.byteLength(JSON.stringify(payload));
+}
+function createWorkspaceReader(workspaceRootByAgent) {
+	function rootFor(agentId) {
+		const root = workspaceRootByAgent(agentId);
+		if (!root) throw new WorkspaceViolationError(`unknown agent "${agentId}"`);
+		return root;
+	}
+	/**
+	* Lexical containment. Rejects absolute paths and `..` escapes; returns the
+	* lexically-resolved path plus the canonical (realpath'd) root, or `null` for
+	* `realRoot` when the root does not exist yet (callers report `exists:false`).
+	*/
+	async function resolveContained(root, relPath) {
+		if (sp.isAbsolute(relPath)) throw new WorkspaceViolationError("absolute paths are not allowed");
+		const resolved = sp.resolve(root, relPath);
+		if (!under(root, resolved)) throw new WorkspaceViolationError("path escapes the workspace root");
+		try {
+			return {
+				resolved,
+				realRoot: await promises.realpath(root)
+			};
+		} catch (err) {
+			if (isErrno(err, "ENOENT")) return {
+				resolved,
+				realRoot: null
+			};
+			throw err;
+		}
+	}
+	/** Canonicalise an existing target and re-verify containment on the REAL path,
+	*  closing the check-vs-use gap (a symlinked intermediate component resolves
+	*  out and is rejected here). Returns the canonical path used for I/O. */
+	async function canonicalUnder(realRoot, abs) {
+		const canon = await promises.realpath(abs);
+		if (!under(realRoot, canon)) throw new WorkspaceViolationError("path resolves outside the workspace root");
+		return canon;
+	}
+	return {
+		async list(req) {
+			const { resolved, realRoot } = await resolveContained(rootFor(req.agentId), req.path);
+			const notFound = {
+				agentId: req.agentId,
+				path: req.path,
+				exists: false,
+				entries: []
+			};
+			if (realRoot === null) return notFound;
+			let target;
+			try {
+				target = await canonicalUnder(realRoot, resolved);
+			} catch (err) {
+				if (isErrno(err, "ENOENT")) return notFound;
+				throw err;
+			}
+			let dirents;
+			try {
+				dirents = await promises.readdir(target, { withFileTypes: true });
+			} catch (err) {
+				if (isErrno(err, "ENOENT") || isErrno(err, "ENOTDIR")) return notFound;
+				throw err;
+			}
+			const entries = [];
+			for (const d of dirents) {
+				if (d.name === ".git") continue;
+				const type = d.isDirectory() ? "dir" : d.isFile() ? "file" : d.isSymbolicLink() ? "symlink" : "other";
+				const entry = {
+					name: d.name,
+					type
+				};
+				if (type === "file") try {
+					const st = await promises.lstat(sp.join(target, d.name));
+					entry.size = st.size;
+					entry.mtime = st.mtime.toISOString();
+				} catch {}
+				entries.push(entry);
+			}
+			entries.sort(compareEntries);
+			const start = req.cursor !== void 0 && /^\d+$/.test(req.cursor) ? Number(req.cursor) : 0;
+			const page = [];
+			let acc = 0;
+			for (let i = start; i < entries.length && page.length < req.limit; i++) {
+				const e = entries[i];
+				const enc = encodedBytes(e) + 1;
+				if (page.length > 0 && acc + enc > REPLY_BUDGET) break;
+				page.push(e);
+				acc += enc;
+			}
+			const consumed = start + page.length;
+			return {
+				agentId: req.agentId,
+				path: req.path,
+				exists: true,
+				entries: page,
+				...consumed < entries.length ? { nextCursor: String(consumed) } : {}
+			};
+		},
+		async read(req) {
+			const { resolved, realRoot } = await resolveContained(rootFor(req.agentId), req.path);
+			const notFound = {
+				agentId: req.agentId,
+				path: req.path,
+				exists: false
+			};
+			if (realRoot === null) return notFound;
+			let st;
+			try {
+				st = await promises.lstat(resolved);
+			} catch (err) {
+				if (isErrno(err, "ENOENT")) return notFound;
+				throw err;
+			}
+			if (!st.isFile()) throw new WorkspaceViolationError("not a regular file");
+			const target = await canonicalUnder(realRoot, resolved);
+			const size = st.size;
+			const mtime = st.mtime.toISOString();
+			const fh = await promises.open(target, "r");
+			try {
+				const sniffLen = Math.min(SNIFF_BYTES, size);
+				if (sniffLen > 0) {
+					const sniff = Buffer.alloc(sniffLen);
+					const { bytesRead } = await fh.read(sniff, 0, sniffLen, 0);
+					if (sniff.subarray(0, bytesRead).includes(0)) return {
+						agentId: req.agentId,
+						path: req.path,
+						exists: true,
+						size,
+						mtime,
+						encoding: "none"
+					};
+				}
+				const want = Math.min(req.limit, Math.max(0, size - req.offset));
+				let slice = Buffer.alloc(0);
+				if (want > 0) {
+					const buf = Buffer.alloc(want);
+					const { bytesRead } = await fh.read(buf, 0, want, req.offset);
+					slice = buf.subarray(0, bytesRead);
+				}
+				let end = utf8Boundary(slice, slice.length);
+				let content = slice.toString("utf8", 0, end);
+				while (end > 0 && encodedBytes(content) > REPLY_BUDGET) {
+					const factor = REPLY_BUDGET / encodedBytes(content);
+					const shrunk = Math.max(1, Math.floor(end * factor * .9));
+					end = utf8Boundary(slice, Math.min(shrunk, end - 1));
+					content = slice.toString("utf8", 0, end);
+				}
+				const nextOffset = req.offset + end;
+				return {
+					agentId: req.agentId,
+					path: req.path,
+					exists: true,
+					size,
+					mtime,
+					encoding: "utf8",
+					content,
+					offset: req.offset,
+					nextOffset,
+					truncated: nextOffset < size
+				};
+			} finally {
+				await fh.close();
+			}
+		}
+	};
+}
+/** dirs first, then case-insensitive alphabetical (stable within the page). */
+function compareEntries(a, b) {
+	const aDir = a.type === "dir" ? 0 : 1;
+	const bDir = b.type === "dir" ? 0 : 1;
+	if (aDir !== bDir) return aDir - bDir;
+	const al = a.name.toLowerCase();
+	const bl = b.name.toLowerCase();
+	if (al !== bl) return al < bl ? -1 : 1;
+	return a.name < b.name ? -1 : a.name > b.name ? 1 : 0;
+}
+//#endregion
 //#region src/cp/correlator.ts
 /** Transport-free representation of a typed wire `error` REP. */
 var WireError = class extends Error {
@@ -82356,6 +82661,12 @@ var CpClient = class {
 					this.sendError(frame.id, "INTERNAL", `session/history failed: ${err.message}`, false);
 				}
 				return;
+			case "workspace/list":
+				this.deps.workspaceRead.list(frame.payload).then((page) => this.reply(frame, "workspace/list/page", page)).catch((err) => this.workspaceError(frame.id, "workspace/list", err));
+				return;
+			case "workspace/read":
+				this.deps.workspaceRead.read(frame.payload).then((content) => this.reply(frame, "workspace/read/content", content)).catch((err) => this.workspaceError(frame.id, "workspace/read", err));
+				return;
 			case "agent/prompt":
 				this.sendError(frame.id, "INTERNAL", "agent/prompt not implemented", false);
 				return;
@@ -82364,6 +82675,18 @@ var CpClient = class {
 				return;
 		}
 	}
+	/** Map a workspace read failure onto the wire: containment/bad-request
+	*  violations → BAD_PAYLOAD (their messages are hand-written and path-free);
+	*  anything else → INTERNAL with a GENERIC message — raw fs errors (ELOOP,
+	*  EACCES, …) embed absolute host paths that must not leak to the CP/UI. */
+	workspaceError(corr, op, err) {
+		if (err instanceof WorkspaceViolationError) {
+			this.sendError(corr, "BAD_PAYLOAD", `${op} failed: ${err.message}`, false);
+			return;
+		}
+		this.deps.log.warn(`cp: ${op} failed: ${err?.message}`);
+		this.sendError(corr, "INTERNAL", `${op} failed`, false);
+	}
 	reply(req, type, payload) {
 		this.transport?.send(encode(buildEnvelope(type, payload, { corr: req.id })));
 	}
@@ -83926,6 +84249,7 @@ var Daemon = class Daemon {
 			degradedScopes: () => this.cpDegradedScopes(),
 			configApply: this.cpConfigApply(),
 			sessionRead: createSessionReader(this.store),
+			workspaceRead: createWorkspaceReader((id) => this.agents.get(id)?.workspace.path),
 			clock: systemClock,
 			connect: () => ClientTransport.dial(url),
 			log: this.log