@alisio/core 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/runtime/store.js

@@ -112,6 +112,81 @@ export class SQLiteStore {
                     this.db.exec("ALTER TABLE workspaces ADD COLUMN archived_at INTEGER");
                 this.db.exec("INSERT OR IGNORE INTO schema_migrations VALUES(5)");
             });
+        if (!has(6))
+            this.db.transaction(() => {
+                // v6 (additive): Python analysis executions, published artifacts, persisted capability
+                // grants (audit included) and tabular datasets (used from the data phase on).
+                this.db.exec(`CREATE TABLE IF NOT EXISTS analysis_executions(
+            id TEXT PRIMARY KEY,
+            session TEXT NOT NULL,
+            root_session TEXT NOT NULL,
+            workspace TEXT NOT NULL,
+            run_id TEXT, call_id TEXT,
+            runtime TEXT NOT NULL CHECK(runtime IN ('managed','oci')),
+            status TEXT NOT NULL CHECK(status IN ('running','completed','failed','cancelled','timed_out')),
+            script_sha256 TEXT NOT NULL,
+            exit_code INTEGER, error TEXT,
+            rel_dir TEXT NOT NULL,
+            rerun_of TEXT,
+            created_at INTEGER NOT NULL, ended_at INTEGER);
+          CREATE INDEX IF NOT EXISTS analysis_executions_session
+            ON analysis_executions(root_session, created_at);
+          CREATE TABLE IF NOT EXISTS artifacts(
+            id TEXT PRIMARY KEY,
+            session TEXT NOT NULL, root_session TEXT NOT NULL, workspace TEXT NOT NULL,
+            run_id TEXT, call_id TEXT,
+            execution_id TEXT REFERENCES analysis_executions(id),
+            source_path TEXT,
+            title TEXT NOT NULL, file_name TEXT NOT NULL,
+            kind TEXT NOT NULL, mime TEXT NOT NULL,
+            bytes INTEGER NOT NULL, file_count INTEGER NOT NULL DEFAULT 1,
+            sha256 TEXT NOT NULL, entry TEXT,
+            rel_dir TEXT NOT NULL,
+            status TEXT NOT NULL CHECK(status IN ('ready','deleted','expired')),
+            provenance TEXT NOT NULL,
+            created_at INTEGER NOT NULL, deleted_at INTEGER,
+            UNIQUE(execution_id, source_path));
+          CREATE INDEX IF NOT EXISTS artifacts_session ON artifacts(root_session, created_at);
+          CREATE TABLE IF NOT EXISTS capability_grants(
+            id TEXT PRIMARY KEY,
+            capability TEXT NOT NULL,
+            session TEXT NOT NULL,
+            workspace TEXT NOT NULL,
+            scope TEXT NOT NULL CHECK(scope IN ('once','session')),
+            decision TEXT NOT NULL CHECK(decision IN ('allow','deny')),
+            source TEXT NOT NULL CHECK(source IN ('tui','web','flag','headless-grant')),
+            call_id TEXT, run_id TEXT, correlation_id TEXT,
+            created_at INTEGER NOT NULL,
+            revoked_at INTEGER, revoked_by TEXT);
+          CREATE INDEX IF NOT EXISTS capability_grants_lookup
+            ON capability_grants(capability, session, scope, decision, revoked_at);
+          CREATE TABLE IF NOT EXISTS datasets(
+            id TEXT PRIMARY KEY,
+            session TEXT NOT NULL, root_session TEXT NOT NULL,
+            name TEXT NOT NULL, format TEXT NOT NULL,
+            sha256 TEXT NOT NULL, bytes INTEGER NOT NULL,
+            blob_hash TEXT,
+            source_path TEXT,
+            db_rel_path TEXT NOT NULL,
+            ingest_version INTEGER NOT NULL,
+            sheets TEXT NOT NULL,
+            created_at INTEGER NOT NULL);
+          INSERT OR IGNORE INTO schema_migrations VALUES(6);`);
+            });
+    }
+    /**
+     * The root of a session (itself for roots), following `parent_id`. Unknown ids are their own
+     * root, so callers never throw on a session another process has not written yet.
+     */
+    rootOf(id) {
+        let current = id;
+        for (let depth = 0; depth < 32; depth++) {
+            const row = this.db.prepare("SELECT parent_id FROM sessions WHERE id=?").get(current);
+            if (!row?.parent_id)
+                return current;
+            current = row.parent_id;
+        }
+        return current;
     }
     create(workspace, provider, model) {
         const id = crypto.randomUUID();

package/dist/runtime/zip.d.ts

@@ -0,0 +1,24 @@
+export type ZipEntry = {
+    name: string;
+    source: string;
+} | {
+    name: string;
+    data: Uint8Array;
+};
+/** CRC-32 (IEEE) of `bytes`, continuing from `crc`. */
+export declare function crc32(bytes: Uint8Array, crc?: number): number;
+/** Something to write the archive to (an HTTP response, a file stream…), honoring backpressure. */
+export interface ZipSink {
+    write(chunk: Buffer): boolean;
+    once(event: "drain", listener: () => void): unknown;
+}
+/**
+ * Writes `entries` as a ZIP archive to `out`, streaming file contents. Entry names use `/` and
+ * must be relative; the caller validates them. Throws when the archive would need ZIP64.
+ */
+export declare function writeZip(entries: ZipEntry[], out: ZipSink, options?: {
+    now?: Date;
+    signal?: AbortSignal;
+}): Promise<{
+    bytes: number;
+}>;

package/dist/runtime/zip.js

@@ -0,0 +1,126 @@
+/**
+ * Streaming ZIP writer on `node:zlib` (no dependency): DEFLATE entries with a data descriptor,
+ * UTF-8 names (general-purpose bit 11) and no ZIP64, so archives and entries must stay below
+ * 4 GiB. Used for multi-file artifact downloads and for folders published as one archive.
+ */
+import { createReadStream } from "node:fs";
+import { createDeflateRaw } from "node:zlib";
+let table;
+/** CRC-32 (IEEE) of `bytes`, continuing from `crc`. */
+export function crc32(bytes, crc = 0) {
+    if (!table) {
+        table = new Uint32Array(256);
+        for (let n = 0; n < 256; n++) {
+            let c = n;
+            for (let k = 0; k < 8; k++)
+                c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
+            table[n] = c >>> 0;
+        }
+    }
+    let value = ~crc >>> 0;
+    for (let i = 0; i < bytes.length; i++)
+        value = table[(value ^ bytes[i]) & 0xff] ^ (value >>> 8);
+    return ~value >>> 0;
+}
+/** MS-DOS date and time of `date` (local time, 2-second resolution, 1980 minimum). */
+function dosTime(date) {
+    const year = Math.max(1980, date.getFullYear());
+    return {
+        time: (date.getHours() << 11) | (date.getMinutes() << 5) | Math.floor(date.getSeconds() / 2),
+        date: ((year - 1980) << 9) | ((date.getMonth() + 1) << 5) | date.getDate(),
+    };
+}
+const LIMIT = 0xffff_ffff;
+/**
+ * Writes `entries` as a ZIP archive to `out`, streaming file contents. Entry names use `/` and
+ * must be relative; the caller validates them. Throws when the archive would need ZIP64.
+ */
+export async function writeZip(entries, out, options = {}) {
+    if (entries.length > 0xffff)
+        throw new Error("ZIP archives hold at most 65535 entries");
+    let offset = 0;
+    const put = async (chunk) => {
+        options.signal?.throwIfAborted();
+        offset += chunk.byteLength;
+        if (offset > LIMIT)
+            throw new Error("ZIP archives larger than 4 GiB are not supported");
+        if (!out.write(chunk))
+            await new Promise((resolve) => out.once("drain", resolve));
+    };
+    const { time, date } = dosTime(options.now ?? new Date());
+    const central = [];
+    for (const entry of entries) {
+        const name = Buffer.from(entry.name.replace(/\\/g, "/"), "utf8");
+        const start = offset;
+        const local = Buffer.alloc(30);
+        local.writeUInt32LE(0x04034b50, 0);
+        local.writeUInt16LE(20, 4); // version needed
+        local.writeUInt16LE(0x0808, 6); // data descriptor + UTF-8 names
+        local.writeUInt16LE(8, 8); // deflate
+        local.writeUInt16LE(time, 10);
+        local.writeUInt16LE(date, 12);
+        local.writeUInt16LE(name.length, 26);
+        await put(local);
+        await put(name);
+        let crc = 0, size = 0, compressed = 0;
+        const deflate = createDeflateRaw();
+        const feed = "data" in entry
+            ? (async () => {
+                crc = crc32(entry.data);
+                size = entry.data.byteLength;
+                deflate.end(Buffer.from(entry.data));
+            })()
+            : new Promise((resolve, reject) => {
+                const input = createReadStream(entry.source);
+                input.on("data", (chunk) => {
+                    const bytes = chunk;
+                    crc = crc32(bytes, crc);
+                    size += bytes.byteLength;
+                });
+                input.once("error", (error) => {
+                    deflate.destroy(error);
+                    reject(error);
+                });
+                input.once("end", resolve);
+                input.pipe(deflate);
+            });
+        for await (const chunk of deflate) {
+            compressed += chunk.byteLength;
+            await put(chunk);
+        }
+        await feed;
+        if (size > LIMIT || compressed > LIMIT)
+            throw new Error("ZIP entries larger than 4 GiB are not supported");
+        const descriptor = Buffer.alloc(16);
+        descriptor.writeUInt32LE(0x08074b50, 0);
+        descriptor.writeUInt32LE(crc, 4);
+        descriptor.writeUInt32LE(compressed, 8);
+        descriptor.writeUInt32LE(size, 12);
+        await put(descriptor);
+        const header = Buffer.alloc(46);
+        header.writeUInt32LE(0x02014b50, 0);
+        header.writeUInt16LE(20, 4); // version made by
+        header.writeUInt16LE(20, 6); // version needed
+        header.writeUInt16LE(0x0808, 8);
+        header.writeUInt16LE(8, 10);
+        header.writeUInt16LE(time, 12);
+        header.writeUInt16LE(date, 14);
+        header.writeUInt32LE(crc, 16);
+        header.writeUInt32LE(compressed, 20);
+        header.writeUInt32LE(size, 24);
+        header.writeUInt16LE(name.length, 28);
+        header.writeUInt32LE(start, 42);
+        central.push(header, name);
+    }
+    const directoryStart = offset;
+    for (const part of central)
+        await put(part);
+    const end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50, 0);
+    end.writeUInt16LE(entries.length, 8);
+    end.writeUInt16LE(entries.length, 10);
+    end.writeUInt32LE(offset - directoryStart, 12);
+    end.writeUInt32LE(directoryStart, 16);
+    await put(end);
+    return { bytes: offset };
+}

package/dist/sessions/children.js

@@ -148,6 +148,10 @@ export class ChildSessions {
                     write: caps.write,
                     process: caps.process,
                     external: root.external && !caps.readOnly,
+                    // --allow-analysis carries to children whose process permission is not narrowed.
+                    ...(root.analysis && !caps.readOnly && (spec.permission?.process ?? "allow") === "allow"
+                        ? { analysis: true }
+                        : {}),
                 },
                 approvals: caps.approvals,
                 label: this.label(id),

package/dist/tools/analysis.d.ts

@@ -0,0 +1,37 @@
+import type { DatasetService } from "../analysis/data/datasets.ts";
+import type { AnalysisJobs } from "../analysis/jobs.ts";
+import type { OciRuntime } from "../analysis/oci.ts";
+import type { AnalysisRerun } from "../analysis/rerun.ts";
+import { type AnalysisRuntimeManager } from "../analysis/runtime-manager.ts";
+import { type ArtifactStore } from "../artifacts/store.ts";
+import type { ToolRegistry } from "../core/registry.ts";
+export declare const NOT_SANDBOXED = "Managed Python is not a sandbox: the script runs with your user permissions and can read your files and use the network.";
+export interface AnalysisLimits {
+    timeoutMs: number;
+    maxLogBytes: number;
+}
+export interface AnalysisToolDeps {
+    store: ArtifactStore;
+    jobs: AnalysisJobs;
+    /** Discovery (`interpreter`) and, for the optional extras, `hasExtras` / `installExtras`. */
+    runtime: Pick<AnalysisRuntimeManager, "interpreter"> & Partial<Pick<AnalysisRuntimeManager, "hasExtras" | "installExtras">>;
+    /** Container mode (`analysis.runtime: "oci"`), read when each call starts. */
+    oci?: {
+        mode(): "managed" | "oci";
+        runtime(): OciRuntime;
+    };
+    /** Rerun of an earlier execution (`rerunOf`). */
+    rerun?: AnalysisRerun;
+    /** Datasets of the session: `inputs: [{ datasetId }]` copies the dataset's SQLite file. */
+    datasets?: DatasetService;
+    rootOf: (sessionId: string) => string;
+    limits: AnalysisLimits;
+    /** Startup facts for the description (stat only; no process was launched). */
+    startup: {
+        candidates: boolean;
+        extras: string[];
+    };
+}
+/** `48 KB`, `1.2 MB`. */
+export declare function formatBytes(bytes: number): string;
+export declare function registerAnalysisTools(registry: ToolRegistry, deps: AnalysisToolDeps): void;