@anhlp/alp-paseo 0.0.0-beta.2 → 0.0.1-beta.3

package/server/dist/library.js

@@ -8680,7 +8680,7 @@ function launchCommand(command, args = [], env = process.env) {
 }
 
 // packages/core/src/library-edit.js
-import { mkdir as mkdir2, rename as rename3, rm as rm3, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
+import { lstat as lstat3, mkdir as mkdir2, readdir as readdir4, rename as rename3, rm as rm3, stat as stat2, writeFile as writeFile3 } from "node:fs/promises";
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
 import path8 from "node:path";
 
@@ -8736,6 +8736,42 @@ function base(scope, { root, library }, kind) {
   return fail3("INVALID_SCOPE", `Scope must be library or project, not '${scope}'`);
 }
 var revisionOf = (content) => content === void 0 ? null : createHash2("sha256").update(JSON.stringify(content)).digest("hex").slice(0, 16);
+function assertProjectDataContent(kind, content) {
+  const deny = () => fail3("UNSAFE_LIBRARY_WRITE", "Project-data writes allow only instruction entries and non-executable agent configuration");
+  if (!object6(content) || !["agents", "skills"].includes(kind)) deny();
+  const keys2 = kind === "skills" ? ["body"] : ["instructions", "config"];
+  if (Object.keys(content).some((key) => !keys2.includes(key))) deny();
+  const text = kind === "skills" ? content.body : content.instructions;
+  if (typeof text !== "string" || !text.trim()) deny();
+  if (content.config !== void 0) {
+    const config2 = content.config;
+    if (!object6(config2)) deny();
+    const allowed = ["description", "model", "thinking", "context", "autocompact"];
+    if (Object.keys(config2).some((key) => !allowed.includes(key))) deny();
+    for (const key of ["description", "thinking"]) if (config2[key] !== void 0 && typeof config2[key] !== "string") deny();
+    if (config2.model !== void 0 && (typeof config2.model !== "string" || !/^(codex|claude):[^\s/\\:]{1,240}$/.test(config2.model))) deny();
+    for (const key of ["context", "autocompact"]) if (config2[key] !== void 0 && !(typeof config2[key] === "string" || typeof config2[key] === "number" && Number.isFinite(config2[key]))) deny();
+  }
+}
+async function projectDataEntry(kind, name, { scope, root, library, templates: templates2 }) {
+  if (scope !== "project" || !root || !["agents", "skills"].includes(kind)) fail3("UNSAFE_LIBRARY_WRITE", "Project-data writes require project scope and agents or skills");
+  nameOf(name);
+  const directory = base(scope, { root, library }, kind);
+  await safeEntryPaths(directory, kind, name);
+  const found = await layers(kind, name, { root, library, templates: templates2 });
+  if (found.library !== void 0 || found.builtin !== void 0) fail3("UNSAFE_LIBRARY_WRITE", "Project-data writes cannot shadow or reveal a library or built-in entry");
+  if (found.project !== void 0) assertProjectDataContent(kind, found.project);
+  const owned = path8.join(directory, kind, name);
+  const files = await readdir4(owned).catch((error51) => {
+    if (error51.code === "ENOENT") return [];
+    throw error51;
+  });
+  const allowed = new Set(FILES[kind](name).map(([file2]) => path8.basename(file2)));
+  for (const file2 of files) {
+    const info = await lstat3(path8.join(owned, file2));
+    if (!allowed.has(file2) || !info.isFile() || info.isSymbolicLink() || info.nlink !== 1) fail3("UNSAFE_LIBRARY_WRITE", "Project-data entries cannot contain sidecars, links or executable assets");
+  }
+}
 async function safeEntryPaths(directory, kind, name) {
   for (const [file2] of FILES[kind](name)) {
     await assertNoSymlinks(directory, path8.join(kind, file2));
@@ -8933,9 +8969,13 @@ async function writeAtomic(file2, text) {
   await moveFile(temporary, file2);
 }
 var exists = (target) => stat2(target).then(() => true, () => false);
-async function saveEntry(kind, name, content, { scope, root, library, templates: templates2, revision } = {}) {
+async function saveEntry(kind, name, content, { scope, root, library, templates: templates2, revision, policy } = {}) {
   kindOf(kind);
   nameOf(name);
+  if (policy === "project-data") {
+    assertProjectDataContent(kind, content);
+    await projectDataEntry(kind, name, { scope, root, library, templates: templates2 });
+  }
   const directory = base(scope, { root, library }, kind);
   await safeEntryPaths(directory, kind, name);
   await check(kind, name, content, { scope, root, library, templates: templates2 });
@@ -8957,9 +8997,10 @@ async function saveEntry(kind, name, content, { scope, root, library, templates:
   }
   return { revision: revisionOf(await readLayer(kind, name, directory)) };
 }
-async function deleteEntry(kind, name, { scope, root, library, templates: templates2, revision } = {}) {
+async function deleteEntry(kind, name, { scope, root, library, templates: templates2, revision, policy } = {}) {
   kindOf(kind);
   nameOf(name);
+  if (policy === "project-data") await projectDataEntry(kind, name, { scope, root, library, templates: templates2 });
   const directory = base(scope, { root, library }, kind);
   const current = await readLayer(kind, name, directory);
   if (current === void 0) fail3("NOT_FOUND", `No ${kind} entry '${name}' in the ${scope}`);
@@ -8975,14 +9016,25 @@ async function deleteEntry(kind, name, { scope, root, library, templates: templa
   const now = scope === "project" && found.library !== void 0 ? "library" : "builtin";
   return { removed: true, ...fallback !== void 0 ? { now } : {} };
 }
-async function duplicateEntry(kind, from, to, { scope, root, library, templates: templates2 } = {}) {
+async function duplicateEntry(kind, from, to, { scope, root, library, templates: templates2, policy } = {}) {
+  kindOf(kind);
+  nameOf(from);
+  nameOf(to);
+  if (policy === "project-data") {
+    await projectDataEntry(kind, from, { scope, root, library, templates: templates2 });
+    await projectDataEntry(kind, to, { scope, root, library, templates: templates2 });
+  }
   const { content } = await getEntry(kind, from, { root, library, templates: templates2 });
-  return saveEntry(kind, to, structuredClone(content), { scope, root, library, templates: templates2, revision: null });
+  return saveEntry(kind, to, structuredClone(content), { scope, root, library, templates: templates2, revision: null, policy });
 }
-async function renameEntry(kind, from, to, { scope, root, library, templates: templates2 } = {}) {
+async function renameEntry(kind, from, to, { scope, root, library, templates: templates2, policy } = {}) {
   kindOf(kind);
   nameOf(from);
   nameOf(to);
+  if (policy === "project-data") {
+    await projectDataEntry(kind, from, { scope, root, library, templates: templates2 });
+    await projectDataEntry(kind, to, { scope, root, library, templates: templates2 });
+  }
   const directory = base(scope, { root, library }, kind);
   const content = await readLayer(kind, from, directory);
   if (content === void 0) fail3("NOT_FOUND", `No ${kind} entry '${from}' in the ${scope}`);
@@ -9477,7 +9529,7 @@ var TAIL_BYTES = 256 * 1024;
 var MAX_FRAME = 16 * 1024 * 1024;
 var ERROR = Object.freeze({ failed: 1e3, notFound: 1001, forbidden: 1003, conflict: 1004, unavailable: 1005, protocol: 1006 });
 var RPC_ERROR = Object.freeze({ parseError: -32700, invalidRequest: -32600, methodNotFound: -32601, invalidParams: -32602 });
-var CAPABILITY = Object.freeze({ attachAfter: "attach.after", promptReceipts: "prompt.receipts", extensionMethods: "extension.methods", team: "team", task: "task", library: "library", settingsLanguage: "settings.language", sessionListPage: "session.list.page", questionWatch: "question.watch", questionWatchTurns: "question.watch.turns", workspaceFiles: "workspace.files", workspaceFilesRead: "workspace.files.read", promptImages: "prompt.images" });
+var CAPABILITY = Object.freeze({ attachAfter: "attach.after", promptReceipts: "prompt.receipts", extensionMethods: "extension.methods", team: "team", task: "task", library: "library", libraryProjectWrite: "library.project.write", settingsLanguage: "settings.language", sessionListPage: "session.list.page", questionWatch: "question.watch", questionWatchTurns: "question.watch.turns", workspaceFiles: "workspace.files", workspaceFilesRead: "workspace.files.read", promptImages: "prompt.images" });
 var PROMPT_IMAGES = Object.freeze({ mimeTypes: Object.freeze(["image/png", "image/jpeg", "image/gif", "image/webp"]), maxCount: 8, maxBytes: 5 * 1024 * 1024, maxTotalBytes: 11 * 1024 * 1024 });
 var RPC_METHODS = Object.freeze(["assignment.recall", "board.list", "catalog.get", "daemon.hello", "daemon.pause", "daemon.pauses", "daemon.resume", "daemon.shutdown", "daemon.status", "daemon.usage", "extension.register", "extension.unregister", "library.delete", "library.duplicate", "library.get", "library.list", "library.models", "library.rename", "library.save", "library.skills.set", "question.answer", "question.list", "question.watch", "session.archive", "session.attach", "session.close", "session.configure", "session.create", "session.get", "session.interrupt", "session.list", "session.log", "session.message", "session.preview", "session.prompt", "session.release", "session.rename", "session.status", "settings.language.get", "settings.language.set", "task.create", "task.gate.resolve", "task.list", "task.update", "team.list", "workspace.files.list", "workspace.files.read", "workspace.files.search"]);
 var WORKSPACE_FILES = Object.freeze({ maxReadBytes: 1024 * 1024, maxListEntries: 1e3, maxPathLength: 4096 });
@@ -24132,12 +24184,14 @@ var toolShapes = {
     body: external_exports.string().min(1).max(2e4),
     roles: external_exports.array(external_exports.string().min(1)).min(1).max(10),
     lessons: external_exports.array(external_exports.string().min(1).max(600)).max(50).optional(),
-    replace: external_exports.boolean().optional()
+    replace: external_exports.boolean().optional(),
+    requestId: external_exports.string().min(1).max(100).optional()
   },
   alp_issue: {
     action: external_exports.enum(["search", "create", "comment"]),
     target: external_exports.enum(["project", "alp"]),
     query: external_exports.string().min(1).max(200).optional(),
+    requestId: external_exports.string().min(1).max(100).optional(),
     title: external_exports.string().min(1).max(200).optional(),
     body: external_exports.string().min(1).max(2e4).optional(),
     issue: external_exports.number().int().positive().optional(),
@@ -26275,7 +26329,9 @@ var libraryGet = defineRpc2({
     revision: external_exports.string().nullable(),
     usedBy: external_exports.array(external_exports.string()),
     /** Agents: the skills the library gives it by name (role-skills.json). */
-    librarySkills: external_exports.array(external_exports.string()).optional()
+    librarySkills: external_exports.array(external_exports.string()).optional(),
+    /** ALP remote mode: JSON Pointers of the values `content` holds as a secret marker, not as the value. */
+    secrets: external_exports.array(external_exports.string()).optional()
   })
 });
 var librarySkills2 = defineRpc2({