@anhlp/alp 0.0.0-beta.2 → 0.0.1-beta.3

package/packages/cli/dist/backup.js

@@ -7,7 +7,7 @@ import { acquireDaemonLock, alpHome, assertPrivateDirectory, daemonPaths, lockAl
 import { daemonHeld, holdDaemon, releaseHold } from "@anhlp/alp-client/supervise";
 import { start, stop } from "./daemon.js";
 import { UsageError } from "./usage.js";
-var VERSION = true ? "0.0.0-beta.2" : "dev";
+var VERSION = true ? "0.0.1-beta.3" : "dev";
 var BY = `alp ${VERSION}`;
 var size = (bytes) => bytes >= 1024 * 1024 ? `${(bytes / 1024 / 1024).toFixed(1)} MB` : bytes >= 1024 ? `${(bytes / 1024).toFixed(1)} KB` : `${bytes} B`;
 var stamp = () => (/* @__PURE__ */ new Date()).toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");

package/packages/cli/dist/build-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.0.0-beta.2",
+  "version": "0.0.1-beta.3",
   "entries": {
     "packages/cli/dist/alpd.js": {
       "inputs": [

package/packages/cli/dist/cli.js

@@ -15,8 +15,12 @@ import { backupCommand, restoreCommand } from "./backup.js";
 var commands = { setup: (args2) => setup(args2, alpHome()), init: (args2) => project("init", args2), upgrade: (args2) => project("upgrade", args2), update: (args2) => project("upgrade", args2), daemon, doctor, run, ps, top, attach, send, questions, answer, log, board, tasks: tasksCommand, task: taskCommand, formula: formulaCommand, permissions: permissionsCommand, agents: (args2) => libraryCommand("agents", args2), skills: (args2) => libraryCommand("skills", args2), mcp: (args2) => ["add", "rm", "mv", "cp", "test", "show", "edit"].includes(args2[0]) ? editCommand("mcp", args2) : libraryCommand("mcp", args2), hooks: (args2) => libraryCommand("hooks", args2), providers: (args2) => libraryCommand("providers", args2), provider: (args2) => editCommand("providers", args2), teams: teamsCommand, trust: trustCommand, agent: (args2) => editCommand("agents", args2), team: (args2) => editCommand("teams", args2), skill: (args2) => editCommand("skills", args2), hook: (args2) => editCommand("hooks", args2), verify, recall, pause, resume, language, interrupt, acp: acpCommand, web: webCommand, backup: backupCommand, restore: restoreCommand };
 var [command, ...args] = process.argv.slice(2);
 try {
-  if (!Object.hasOwn(commands, command)) throw new UsageError();
-  await commands[command](args);
+  if (command === "--version") {
+    console.log(true ? "0.0.1-beta.3" : JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version);
+  } else {
+    if (!Object.hasOwn(commands, command)) throw new UsageError();
+    await commands[command](args);
+  }
 } catch (error) {
   if (error instanceof UsageError || error?.code === "ERR_PARSE_ARGS_UNKNOWN_OPTION") console.error(USAGE);
   else console.error(`alp: ${scrubText(error?.message ?? error)}`);

package/packages/cli/dist/daemon.js

@@ -3,7 +3,7 @@ import { access } from "node:fs/promises";
 import path from "node:path";
 import { installedProgram, installService, serviceFor, uninstallService } from "@anhlp/alp-client/service";
 import { holdDaemon, startDaemon } from "@anhlp/alp-client/supervise";
-import { alpHome, connect, lockAlive, readLock } from "@anhlp/alp-client/index";
+import { alpHome, connect, lockAlive, readLock, withDaemonLifecycle } from "@anhlp/alp-client/index";
 import { scrubText } from "@anhlp/alp-core/log";
 import { UsageError } from "./usage.js";
 import { DAEMON_ENTRY } from "./paths.js";
@@ -52,8 +52,12 @@ async function daemon([action, ...rest]) {
     const lock = await readLock(alpHome());
     console.log(`alpd ${lock.version} running (pid ${lock.pid}) on ${socket}`);
   } else if (action === "stop") {
-    const stopped = await stop();
     await holdDaemon(alpHome());
+    const stopped = await withDaemonLifecycle(alpHome(), "stop", async () => {
+      const stopped2 = await stop();
+      await holdDaemon(alpHome());
+      return stopped2;
+    });
     console.log(stopped ? `alpd stopped; it stays stopped until alp daemon start, a prompt in Paseo, or ${await installed() ? "the next login" : "Paseo starting again"}` : "alpd is not running");
   } else if (action === "restart") {
     const client = await running().catch(() => void 0);

package/packages/client/dist/index.d.ts

@@ -68,17 +68,32 @@ export function connect(socketPath: string, client?: {
     name: string;
     version: string;
 }, options?: import("./rpc/client.js").AlpRpcClientOptions & import("./ipc.js").SocketTransportOptions): Promise<AlpClient>;
+export function readDaemonLifecycle(home: any): Promise<{
+    token: string;
+    pid: number;
+    bootTime: number;
+    action: string;
+} | undefined>;
+/** Serializes requested starts and stops, including the time before alpd has a lock.
+ * Rename publishes a fully populated directory: an existing nonempty directory cannot
+ * be replaced. Reaping/release unlinks only its unique owner token, then rmdir; even
+ * racing stale reapers cannot remove a successor's nonempty directory.
+ */
+export function withDaemonLifecycle(home: any, action: any, run: any, { joinStart }?: {
+    joinStart?: boolean | undefined;
+}): Promise<any>;
 /**
  * Returns the socket of a ready daemon, starting one when none runs.
  * `entry` is the daemon script; it is started through its own detaching launcher so the
  * daemon outlives the client that started it.
  */
-export function ensureDaemon({ home, entry, env, execPath, timeoutMs }?: {
+export function ensureDaemon({ home, entry, env, execPath, timeoutMs, lifecycleLocked }?: {
     home?: string | undefined;
     entry?: string | undefined;
     env?: NodeJS.ProcessEnv | undefined;
     execPath?: string | undefined;
     timeoutMs?: number | undefined;
+    lifecycleLocked?: boolean | undefined;
 }): Promise<any>;
 export function discoverIntegration(name?: string, options?: {}): Promise<string | undefined>;
 export function startIntegration(nameOrOptions?: string): Promise<any>;

package/packages/client/dist/index.js

@@ -1,7 +1,7 @@
 // packages/client/src/index.js
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
-import { open, readFile, realpath, stat, lstat, mkdir, readlink, unlink } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { open, readFile, writeFile, realpath, stat, lstat, mkdir, readlink, unlink, readdir, rename, rmdir, link } from "node:fs/promises";
 import net from "node:net";
 import os from "node:os";
 import path from "node:path";
@@ -197,10 +197,86 @@ async function tail(file, lines = 30) {
     return "";
   }
 }
+async function lifecycleOwners(home) {
+  const directory = path.join(home, "state", "alpd.starting");
+  const names = await readdir(directory).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
+  return names.map((token) => {
+    const match = /^owner-(\d+)-(\d+)-(start|stop)-[a-f0-9-]+$/.exec(token);
+    if (!match) throw new Error("Invalid alpd startup admission owner");
+    return { token, pid: Number(match[1]), bootTime: Number(match[2]), action: match[3] };
+  });
+}
+async function readDaemonLifecycle(home) {
+  return (await lifecycleOwners(home)).find((owner) => lockAlive(owner));
+}
+async function withDaemonLifecycle(home, action, run, { joinStart = false } = {}) {
+  try {
+    await assertPrivateDirectory(home, { create: true });
+  } catch (cause) {
+    throw Object.assign(new Error(`ALP_HOME_UNUSABLE, alpd failed to start while preparing its home: ${cause.message}`, { cause }), { code: "ALP_HOME_UNUSABLE" });
+  }
+  const state = path.join(home, "state");
+  await assertPrivateDirectory(state, { create: true });
+  const directory = path.join(state, "alpd.starting");
+  const token = `owner-${process.pid}-${bootTime()}-${action}-${randomUUID()}`;
+  const candidate = path.join(state, `alpd.starting-${token}`);
+  await mkdir(candidate, { mode: 448 });
+  await writeFile(path.join(candidate, token), JSON.stringify({ pid: process.pid, bootTime: bootTime(), action }), { mode: 384 });
+  try {
+    let joined = false;
+    if (joinStart) {
+      const owner = await readDaemonLifecycle(home);
+      if (owner?.action === "start") {
+        try {
+          await link(path.join(directory, owner.token), path.join(directory, token));
+          joined = true;
+        } catch (error) {
+          if (error.code !== "ENOENT") throw error;
+        }
+      }
+    }
+    while (!joined) {
+      try {
+        await rename(candidate, directory);
+        break;
+      } catch (error) {
+        if (!["EEXIST", "ENOTEMPTY", "EPERM", "EACCES"].includes(error.code)) throw error;
+        for (const owner of await lifecycleOwners(home)) {
+          if (!lockAlive(owner)) await unlink(path.join(directory, owner.token)).catch((error2) => {
+            if (error2.code !== "ENOENT") throw error2;
+          });
+        }
+        await rmdir(directory).catch((error2) => {
+          if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(error2.code)) throw error2;
+        });
+        await new Promise((resolve) => setTimeout(resolve, 25));
+      }
+    }
+    try {
+      return await run();
+    } finally {
+      await unlink(path.join(directory, token));
+      await rmdir(directory).catch((error) => {
+        if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(error.code)) throw error;
+      });
+    }
+  } finally {
+    await unlink(path.join(candidate, token)).catch((error) => {
+      if (error.code !== "ENOENT") throw error;
+    });
+    await rmdir(candidate).catch((error) => {
+      if (error.code !== "ENOENT") throw error;
+    });
+  }
+}
 async function ensureDaemon({ home = alpHome(), entry = (
   /** @type {string | undefined} */
   void 0
-), env = process.env, execPath = process.execPath, timeoutMs = 15e3 } = {}) {
+), env = process.env, execPath = process.execPath, timeoutMs = 15e3, lifecycleLocked = false } = {}) {
+  if (!lifecycleLocked) return withDaemonLifecycle(home, "start", () => ensureDaemon({ home, entry, env, execPath, timeoutMs, lifecycleLocked: true }));
   const ready = async () => {
     const lock = await readLock(home);
     return lockAlive(lock) && lock.ready ? lock.socket : void 0;
@@ -213,7 +289,7 @@ async function ensureDaemon({ home = alpHome(), entry = (
     entry ??= await findDaemonEntry({ home, env });
     if (!entry) throw new Error("ALP daemon is not running and alpd.js was not found. Install the ALP CLI and run `alp daemon start`, or set ALP_DAEMON_ENTRY to alpd.js");
     await new Promise((resolve, reject) => {
-      const launcher = spawn(execPath, [entry, "--detach"], {
+      const launcher = spawn(execPath, [entry, "--detach", `--startup-timeout=${timeoutMs}`], {
         env: { ...env, ALP_HOME: home, ELECTRON_RUN_AS_NODE: "1" },
         stdio: ["ignore", "ignore", "pipe"],
         windowsHide: true
@@ -415,8 +491,10 @@ export {
   ensureDaemon,
   findDaemonEntry,
   lockAlive,
+  readDaemonLifecycle,
   readLock,
   redactUrl,
   releaseDaemonLock,
-  startIntegration
+  startIntegration,
+  withDaemonLifecycle
 };

package/packages/client/dist/supervise.js

@@ -1,7 +1,7 @@
 // packages/client/src/supervise.js
 import { mkdir, unlink, writeFile, stat } from "node:fs/promises";
 import path from "node:path";
-import { ensureDaemon, lockAlive, readLock } from "./index.js";
+import { ensureDaemon, lockAlive, readLock, withDaemonLifecycle } from "./index.js";
 import { installedProgram, serviceFor, startService } from "./service.js";
 var holdFile = (home) => path.join(home, "state", "alpd.held");
 async function holdDaemon(home, by = "alp daemon stop") {
@@ -24,16 +24,20 @@ async function whenReady(home, timeoutMs) {
   }
   throw new Error(`alpd did not become ready within ${timeoutMs / 1e3} s; see ${path.join(home, "logs")}`);
 }
-async function startDaemon({ home, entry, env = process.env, timeoutMs = 15e3 }) {
-  await releaseHold(home);
-  const lock = await readLock(home);
-  if (lockAlive(lock)) return lock.ready ? lock.socket : whenReady(home, timeoutMs);
-  const service = serviceFor({ home, env });
-  if (service && await installedProgram(service)) {
-    await startService(service);
-    return whenReady(home, timeoutMs);
-  }
-  return ensureDaemon({ home, entry, env, timeoutMs });
+async function startDaemon({ home, entry, env = process.env, timeoutMs = 15e3, automatic = false }) {
+  return withDaemonLifecycle(home, "start", async () => {
+    if (automatic) {
+      if (await daemonHeld(home)) return;
+    } else await releaseHold(home);
+    const lock = await readLock(home);
+    if (lockAlive(lock)) return lock.ready ? lock.socket : whenReady(home, timeoutMs);
+    const service = serviceFor({ home, env });
+    if (service && await installedProgram(service)) {
+      await startService(service);
+      return whenReady(home, timeoutMs);
+    }
+    return ensureDaemon({ home, entry, env, timeoutMs, lifecycleLocked: true });
+  });
 }
 function superviseDaemon({ home, entry, env = process.env, intervalMs = 5e3, misses = 2, log = () => {
 } }) {
@@ -41,7 +45,9 @@ function superviseDaemon({ home, entry, env = process.env, intervalMs = 5e3, mis
   let missed = 0;
   let starting;
   const start = (reason) => {
-    starting ??= startDaemon({ home, entry: typeof entry === "function" ? entry() : entry, env }).then(() => log(`alpd ${reason}`), (error) => log(`could not start alpd: ${error?.message ?? error}`)).finally(() => {
+    starting ??= startDaemon({ home, entry: typeof entry === "function" ? entry() : entry, env, automatic: reason !== "started with Paseo" }).then((socket) => {
+      if (socket) log(`alpd ${reason}`);
+    }, (error) => log(`could not start alpd: ${error?.message ?? error}`)).finally(() => {
       starting = void 0;
       missed = 0;
     });

package/packages/core/dist/library-edit.d.ts

@@ -1,3 +1,6 @@
+/** Strict payload contract for opt-in project-data writes. Instructions carry prompt authority;
+ * executable configuration and references to it have no place in this policy. */
+export function assertProjectDataContent(kind: any, content: any): void;
 /**
  * One entry: the version that applies (the project's, else the library's, else the
  * built-in), or one scope's version with `scope`. `revision` goes back with a save.
@@ -52,7 +55,7 @@ export function usersOf(kind: any, name: any, { root, library, templates }?: {})
  * that scope (null to create); a different current revision refuses the save.
  * @returns {Promise<{ revision: string | null }>}
  */
-export function saveEntry(kind: any, name: any, content: any, { scope, root, library, templates, revision }?: {}): Promise<{
+export function saveEntry(kind: any, name: any, content: any, { scope, root, library, templates, revision, policy }?: {}): Promise<{
     revision: string | null;
 }>;
 /**
@@ -60,16 +63,16 @@ export function saveEntry(kind: any, name: any, content: any, { scope, root, lib
  * entry others refer to stays, and the error lists them.
  * @returns {Promise<{ removed: boolean, now?: 'builtin' | 'library' }>}
  */
-export function deleteEntry(kind: any, name: any, { scope, root, library, templates, revision }?: {}): Promise<{
+export function deleteEntry(kind: any, name: any, { scope, root, library, templates, revision, policy }?: {}): Promise<{
     removed: boolean;
     now?: "builtin" | "library";
 }>;
 /** Copies the entry that applies under `from` to a new entry `to` in a scope; built-ins are copied this way. */
-export function duplicateEntry(kind: any, from: any, to: any, { scope, root, library, templates }?: {}): Promise<{
+export function duplicateEntry(kind: any, from: any, to: any, { scope, root, library, templates, policy }?: {}): Promise<{
     revision: string | null;
 }>;
 /** Renames an entry within a scope; refused while others refer to it by its old name. */
-export function renameEntry(kind: any, from: any, to: any, { scope, root, library, templates }?: {}): Promise<{
+export function renameEntry(kind: any, from: any, to: any, { scope, root, library, templates, policy }?: {}): Promise<{
     revision: string | null;
 }>;
 /**

package/packages/core/dist/library-edit.js

@@ -1,5 +1,5 @@
 // packages/core/src/library-edit.js
-import { mkdir, rename, rm, stat, writeFile } from "node:fs/promises";
+import { lstat, mkdir, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { createHash, randomUUID } from "node:crypto";
 import path from "node:path";
 import { moveFile } from "./atomic.js";
@@ -39,6 +39,42 @@ function base(scope, { root, library }, kind) {
   return fail("INVALID_SCOPE", `Scope must be library or project, not '${scope}'`);
 }
 var revisionOf = (content) => content === void 0 ? null : createHash("sha256").update(JSON.stringify(content)).digest("hex").slice(0, 16);
+function assertProjectDataContent(kind, content) {
+  const deny = () => fail("UNSAFE_LIBRARY_WRITE", "Project-data writes allow only instruction entries and non-executable agent configuration");
+  if (!object(content) || !["agents", "skills"].includes(kind)) deny();
+  const keys = kind === "skills" ? ["body"] : ["instructions", "config"];
+  if (Object.keys(content).some((key) => !keys.includes(key))) deny();
+  const text = kind === "skills" ? content.body : content.instructions;
+  if (typeof text !== "string" || !text.trim()) deny();
+  if (content.config !== void 0) {
+    const config = content.config;
+    if (!object(config)) deny();
+    const allowed = ["description", "model", "thinking", "context", "autocompact"];
+    if (Object.keys(config).some((key) => !allowed.includes(key))) deny();
+    for (const key of ["description", "thinking"]) if (config[key] !== void 0 && typeof config[key] !== "string") deny();
+    if (config.model !== void 0 && (typeof config.model !== "string" || !/^(codex|claude):[^\s/\\:]{1,240}$/.test(config.model))) deny();
+    for (const key of ["context", "autocompact"]) if (config[key] !== void 0 && !(typeof config[key] === "string" || typeof config[key] === "number" && Number.isFinite(config[key]))) deny();
+  }
+}
+async function projectDataEntry(kind, name, { scope, root, library, templates }) {
+  if (scope !== "project" || !root || !["agents", "skills"].includes(kind)) fail("UNSAFE_LIBRARY_WRITE", "Project-data writes require project scope and agents or skills");
+  nameOf(name);
+  const directory = base(scope, { root, library }, kind);
+  await safeEntryPaths(directory, kind, name);
+  const found = await layers(kind, name, { root, library, templates });
+  if (found.library !== void 0 || found.builtin !== void 0) fail("UNSAFE_LIBRARY_WRITE", "Project-data writes cannot shadow or reveal a library or built-in entry");
+  if (found.project !== void 0) assertProjectDataContent(kind, found.project);
+  const owned = path.join(directory, kind, name);
+  const files = await readdir(owned).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
+  const allowed = new Set(FILES[kind](name).map(([file]) => path.basename(file)));
+  for (const file of files) {
+    const info = await lstat(path.join(owned, file));
+    if (!allowed.has(file) || !info.isFile() || info.isSymbolicLink() || info.nlink !== 1) fail("UNSAFE_LIBRARY_WRITE", "Project-data entries cannot contain sidecars, links or executable assets");
+  }
+}
 async function safeEntryPaths(directory, kind, name) {
   for (const [file] of FILES[kind](name)) {
     await assertNoSymlinks(directory, path.join(kind, file));
@@ -236,9 +272,13 @@ async function writeAtomic(file, text) {
   await moveFile(temporary, file);
 }
 var exists = (target) => stat(target).then(() => true, () => false);
-async function saveEntry(kind, name, content, { scope, root, library, templates, revision } = {}) {
+async function saveEntry(kind, name, content, { scope, root, library, templates, revision, policy } = {}) {
   kindOf(kind);
   nameOf(name);
+  if (policy === "project-data") {
+    assertProjectDataContent(kind, content);
+    await projectDataEntry(kind, name, { scope, root, library, templates });
+  }
   const directory = base(scope, { root, library }, kind);
   await safeEntryPaths(directory, kind, name);
   await check(kind, name, content, { scope, root, library, templates });
@@ -260,9 +300,10 @@ async function saveEntry(kind, name, content, { scope, root, library, templates,
   }
   return { revision: revisionOf(await readLayer(kind, name, directory)) };
 }
-async function deleteEntry(kind, name, { scope, root, library, templates, revision } = {}) {
+async function deleteEntry(kind, name, { scope, root, library, templates, revision, policy } = {}) {
   kindOf(kind);
   nameOf(name);
+  if (policy === "project-data") await projectDataEntry(kind, name, { scope, root, library, templates });
   const directory = base(scope, { root, library }, kind);
   const current = await readLayer(kind, name, directory);
   if (current === void 0) fail("NOT_FOUND", `No ${kind} entry '${name}' in the ${scope}`);
@@ -278,14 +319,25 @@ async function deleteEntry(kind, name, { scope, root, library, templates, revisi
   const now = scope === "project" && found.library !== void 0 ? "library" : "builtin";
   return { removed: true, ...fallback !== void 0 ? { now } : {} };
 }
-async function duplicateEntry(kind, from, to, { scope, root, library, templates } = {}) {
+async function duplicateEntry(kind, from, to, { scope, root, library, templates, policy } = {}) {
+  kindOf(kind);
+  nameOf(from);
+  nameOf(to);
+  if (policy === "project-data") {
+    await projectDataEntry(kind, from, { scope, root, library, templates });
+    await projectDataEntry(kind, to, { scope, root, library, templates });
+  }
   const { content } = await getEntry(kind, from, { root, library, templates });
-  return saveEntry(kind, to, structuredClone(content), { scope, root, library, templates, revision: null });
+  return saveEntry(kind, to, structuredClone(content), { scope, root, library, templates, revision: null, policy });
 }
-async function renameEntry(kind, from, to, { scope, root, library, templates } = {}) {
+async function renameEntry(kind, from, to, { scope, root, library, templates, policy } = {}) {
   kindOf(kind);
   nameOf(from);
   nameOf(to);
+  if (policy === "project-data") {
+    await projectDataEntry(kind, from, { scope, root, library, templates });
+    await projectDataEntry(kind, to, { scope, root, library, templates });
+  }
   const directory = base(scope, { root, library }, kind);
   const content = await readLayer(kind, from, directory);
   if (content === void 0) fail("NOT_FOUND", `No ${kind} entry '${from}' in the ${scope}`);
@@ -303,6 +355,7 @@ async function renameEntry(kind, from, to, { scope, root, library, templates } =
 }
 export {
   EDIT_KINDS,
+  assertProjectDataContent,
   deleteEntry,
   duplicateEntry,
   getEntry,