@askexenow/exe-os 0.9.357 → 0.9.359

package/dist/{chunk-IT4TFJTK.js → chunk-GSVQBBE5.js}

@@ -1,15 +1,15 @@
 import {
   PLATFORM_PROCEDURE_TITLES
-} from "./chunk-2TL5RKMC.js";
+} from "./chunk-3BAGFZFN.js";
 import {
   isGhostBehaviorRow
-} from "./chunk-FWJFKWYA.js";
+} from "./chunk-6LY3QSJA.js";
 import {
   getClient,
   getIdentity,
   listIdentities,
   updateIdentity
-} from "./chunk-M5DPPJLS.js";
+} from "./chunk-EA5FVACM.js";
 import {
   atomicWriteJsonSync
 } from "./chunk-HSGBZSCA.js";

package/dist/{chunk-LVZZ7YS3.js → chunk-HK7SQDKJ.js}

@@ -1,16 +1,16 @@
+import {
+  resolveType
+} from "./chunk-GUMRIUI5.js";
 import {
   chunkSourceFile,
   languageForFile
 } from "./chunk-Z6BZQHP5.js";
-import {
-  resolveType
-} from "./chunk-GUMRIUI5.js";
 import {
   WORK_STATE_HEARTBEAT_TOOL
-} from "./chunk-IHKRHGKT.js";
+} from "./chunk-ZMYXQU4L.js";
 import {
   hashMemoryContent
-} from "./chunk-VML2UQK7.js";
+} from "./chunk-FVWI2AR4.js";
 
 // src/lib/graph-rag.ts
 import crypto from "crypto";

package/dist/chunk-HKK7LLS5.js

@@ -0,0 +1,408 @@
+import {
+  grantsRegistryStatus,
+  listGrants,
+  resolveExeDataDir,
+  revokeGrant
+} from "./chunk-VXL7PJ56.js";
+
+// src/lib/org-membership.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync, rmSync as rmSync2 } from "fs";
+import path2 from "path";
+
+// src/lib/org-mode-anchor.ts
+import { execFileSync } from "child_process";
+import { existsSync, readFileSync, writeFileSync, rmSync, statSync, chmodSync } from "fs";
+import os from "os";
+import path from "path";
+var SERVICE = "exe-os";
+var ANCHOR_ACCOUNT = "org-mode-anchor";
+var ANCHOR_VALUE = "org-mode";
+var ORG_MODE_ANCHOR_FILENAME = ".exe-os-install-state";
+var _anchorSeen = false;
+var _keychainChecked = false;
+var _keychainResult = false;
+var _macDefaultKeychainProbe = null;
+function macDefaultKeychainExists() {
+  if (_macDefaultKeychainProbe !== null) return _macDefaultKeychainProbe;
+  try {
+    const out = execFileSync("security", ["default-keychain"], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "ignore"]
+    }).trim();
+    _macDefaultKeychainProbe = out.length > 0;
+  } catch {
+    _macDefaultKeychainProbe = false;
+  }
+  return _macDefaultKeychainProbe;
+}
+function nativeKeychainAllowed() {
+  if (process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN === "1") return false;
+  if (process.env.EXE_IS_DAEMON === "1") return false;
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return false;
+  if (process.platform === "darwin" && !macDefaultKeychainExists()) return false;
+  return true;
+}
+function anchorFilePath() {
+  return path.join(os.homedir(), ORG_MODE_ANCHOR_FILENAME);
+}
+function repairAnchorPermissions(p) {
+  try {
+    const mode = statSync(p).mode & 511;
+    if (mode !== 384) chmodSync(p, 384);
+  } catch {
+  }
+}
+function keychainHasAnchor() {
+  if (_keychainChecked) return _keychainResult;
+  _keychainResult = keychainGet() === ANCHOR_VALUE;
+  _keychainChecked = true;
+  return _keychainResult;
+}
+var _probeCount = 0;
+function keychainGet() {
+  _probeCount++;
+  if (!nativeKeychainAllowed()) return null;
+  try {
+    if (process.platform === "darwin") {
+      return execFileSync(
+        "security",
+        ["find-generic-password", "-s", SERVICE, "-a", ANCHOR_ACCOUNT, "-w"],
+        { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "ignore"] }
+      ).trim();
+    }
+    if (process.platform === "linux") {
+      return execFileSync(
+        "secret-tool",
+        ["lookup", "service", SERVICE, "account", ANCHOR_ACCOUNT],
+        { encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "ignore"] }
+      ).trim();
+    }
+  } catch {
+  }
+  return null;
+}
+function keychainSet() {
+  if (!nativeKeychainAllowed()) return false;
+  try {
+    if (process.platform === "darwin") {
+      execFileSync(
+        "security",
+        ["add-generic-password", "-U", "-s", SERVICE, "-a", ANCHOR_ACCOUNT, "-w", ANCHOR_VALUE],
+        { timeout: 5e3, stdio: ["pipe", "ignore", "ignore"] }
+      );
+      return true;
+    }
+    if (process.platform === "linux") {
+      execFileSync(
+        "secret-tool",
+        ["store", "--label", "exe-os org mode", "service", SERVICE, "account", ANCHOR_ACCOUNT],
+        { input: ANCHOR_VALUE, timeout: 5e3, stdio: ["pipe", "ignore", "ignore"] }
+      );
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+function keychainClear() {
+  if (!nativeKeychainAllowed()) return;
+  try {
+    if (process.platform === "darwin") {
+      execFileSync("security", ["delete-generic-password", "-s", SERVICE, "-a", ANCHOR_ACCOUNT], {
+        timeout: 5e3,
+        stdio: ["pipe", "ignore", "ignore"]
+      });
+    } else if (process.platform === "linux") {
+      execFileSync("secret-tool", ["clear", "service", SERVICE, "account", ANCHOR_ACCOUNT], {
+        timeout: 5e3,
+        stdio: ["pipe", "ignore", "ignore"]
+      });
+    }
+  } catch {
+  }
+}
+function orgModeAnchorPresent() {
+  if (_anchorSeen) return true;
+  const fp = anchorFilePath();
+  if (existsSync(fp)) {
+    repairAnchorPermissions(fp);
+    _anchorSeen = true;
+    return true;
+  }
+  if (keychainHasAnchor()) {
+    _anchorSeen = true;
+    return true;
+  }
+  return false;
+}
+function writeOrgModeAnchor() {
+  _anchorSeen = true;
+  const keychainOk = keychainSet();
+  _keychainChecked = keychainOk;
+  _keychainResult = keychainOk;
+  try {
+    writeFileSync(
+      anchorFilePath(),
+      JSON.stringify({ version: 1, anchored_at: (/* @__PURE__ */ new Date()).toISOString() }, null, 2),
+      { mode: 384 }
+    );
+  } catch (err) {
+    if (!keychainOk) {
+      process.stderr.write(
+        `[exe-os] \u26A0 could not persist the org-mode anchor outside the data dir (${err instanceof Error ? err.message : String(err)}). Org mode still holds for this process and via the in-data-dir latch; re-run once the home directory is writable.
+`
+      );
+    }
+  }
+}
+function clearOrgModeAnchor() {
+  keychainClear();
+  rmSync(anchorFilePath(), { force: true });
+  _anchorSeen = false;
+  _keychainChecked = true;
+  _keychainResult = false;
+}
+
+// src/lib/org-membership.ts
+var ORG_MEMBERSHIPS_FILENAME = "org-memberships.json";
+var ORG_MODE_MARKER_FILENAME = "org-mode.marker";
+var CONFIG_FILENAME = "config.json";
+var ORG_MODE_CLEAR_CONFIRMATION = "I am leaving all orgs and accept founder-mode monitoring";
+var _latchedOrgMode = false;
+var _quarantinePending = false;
+function dataDir() {
+  return resolveExeDataDir();
+}
+function orgMembershipsPath() {
+  return path2.join(dataDir(), ORG_MEMBERSHIPS_FILENAME);
+}
+function markerPath() {
+  return path2.join(dataDir(), ORG_MODE_MARKER_FILENAME);
+}
+function configPath() {
+  return path2.join(dataDir(), CONFIG_FILENAME);
+}
+function readActiveOrgMemberships() {
+  const p = orgMembershipsPath();
+  if (!existsSync2(p)) return [];
+  const parsed = JSON.parse(readFileSync2(p, "utf8"));
+  if (typeof parsed !== "object" || parsed === null || !Array.isArray(parsed.memberships)) {
+    throw new Error(`Malformed org-memberships file: ${p}`);
+  }
+  const out = [];
+  for (const m of parsed.memberships) {
+    if (typeof m !== "object" || m === null) throw new Error(`Malformed membership entry in ${p}`);
+    const rec = m;
+    if (typeof rec.org_id !== "string" || rec.org_id.length === 0) {
+      throw new Error(`Membership entry missing org_id in ${p}`);
+    }
+    if (rec.status !== "invited" && rec.status !== "active" && rec.status !== "revoked") {
+      throw new Error(`Membership entry has invalid status in ${p}`);
+    }
+    if (rec.status !== "revoked") out.push(rec);
+  }
+  return out;
+}
+function establishOrgMode(orgIds = []) {
+  _latchedOrgMode = true;
+  writeOrgModeAnchor();
+  const dir = dataDir();
+  try {
+    mkdirSync(dir, { recursive: true });
+    const prev = readMarker();
+    const known = Array.isArray(prev.org_ids) ? prev.org_ids.filter((x) => typeof x === "string") : [];
+    const merged = Array.from(/* @__PURE__ */ new Set([...known, ...orgIds]));
+    writeFileSync2(
+      markerPath(),
+      JSON.stringify(
+        {
+          ...prev,
+          version: 1,
+          established_at: typeof prev.established_at === "string" ? prev.established_at : (/* @__PURE__ */ new Date()).toISOString(),
+          org_ids: merged
+        },
+        null,
+        2
+      )
+    );
+    const cp = configPath();
+    let cfg = {};
+    if (existsSync2(cp)) {
+      try {
+        const parsed = JSON.parse(readFileSync2(cp, "utf8"));
+        if (typeof parsed === "object" && parsed !== null) cfg = parsed;
+      } catch {
+      }
+    }
+    if (cfg.org_mode_established !== true) {
+      cfg.org_mode_established = true;
+      writeFileSync2(cp, JSON.stringify(cfg, null, 2));
+    }
+  } catch (err) {
+    process.stderr.write(
+      `[exe-os] \u26A0 could not persist the org-mode latch (${err instanceof Error ? err.message : String(err)}) \u2014 org mode remains active for this process
+`
+    );
+  }
+  ensureGrantsQuarantined();
+}
+var QUARANTINE_DONE_KEY = "grants_quarantined_at";
+function readMarker() {
+  const mp = markerPath();
+  if (!existsSync2(mp)) return {};
+  try {
+    const parsed = JSON.parse(readFileSync2(mp, "utf8"));
+    return typeof parsed === "object" && parsed !== null ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+function recordQuarantineDone() {
+  try {
+    const marker = readMarker();
+    marker[QUARANTINE_DONE_KEY] = (/* @__PURE__ */ new Date()).toISOString();
+    writeFileSync2(markerPath(), JSON.stringify(marker, null, 2));
+  } catch {
+  }
+}
+function ensureGrantsQuarantined() {
+  if (typeof readMarker()[QUARANTINE_DONE_KEY] === "string") {
+    _quarantinePending = false;
+    return;
+  }
+  const status = grantsRegistryStatus();
+  if (status === "absent") {
+    _quarantinePending = false;
+    recordQuarantineDone();
+    return;
+  }
+  if (status === "unverifiable") {
+    _quarantinePending = true;
+    warnQuarantineDeferredOnce(
+      "[exe-os] \u26A0 org mode: monitoring grants cannot be integrity-verified yet (encryption key not primed) \u2014 quarantine deferred and will retry. Grants are inert meanwhile (the monitoring writer refuses to run in org mode).\n"
+    );
+    return;
+  }
+  try {
+    _quarantinePending = true;
+    const active = listGrants().filter((g) => g.revoked_at === null);
+    let revoked = 0;
+    for (const g of active) revoked += revokeGrant(g.grant_id);
+    const remaining = listGrants().filter((g) => g.revoked_at === null).length;
+    if (remaining > 0) {
+      process.stderr.write(
+        `[exe-os] \u26A0 org mode: ${remaining} monitoring grant(s) could not be quarantined \u2014 will retry.
+`
+      );
+      return;
+    }
+    if (revoked > 0) {
+      process.stderr.write(
+        `[exe-os] \u26A0 org mode established \u2014 quarantined ${revoked} active monitoring grant(s). External monitoring recipients are not permitted on an org install; future sync blobs are encrypted to your key only.
+`
+      );
+    }
+    _quarantinePending = false;
+    recordQuarantineDone();
+  } catch (err) {
+    process.stderr.write(
+      `[exe-os] \u26A0 org mode: monitoring-grant quarantine failed (${err instanceof Error ? err.message : String(err)}) \u2014 will retry. Review with: exe-os grant list
+`
+    );
+  }
+}
+function stickyLatchPresent() {
+  if (existsSync2(markerPath())) return true;
+  const cp = configPath();
+  if (!existsSync2(cp)) return false;
+  try {
+    const cfg = JSON.parse(readFileSync2(cp, "utf8"));
+    return cfg.org_mode_established === true;
+  } catch {
+    return true;
+  }
+}
+function orgModeActive() {
+  if (_latchedOrgMode) {
+    if (_quarantinePending) ensureGrantsQuarantined();
+    return true;
+  }
+  if (orgModeAnchorPresent()) {
+    _latchedOrgMode = true;
+    ensureGrantsQuarantined();
+    return true;
+  }
+  if (stickyLatchPresent()) {
+    _latchedOrgMode = true;
+    writeOrgModeAnchor();
+    ensureGrantsQuarantined();
+    return true;
+  }
+  if (!existsSync2(orgMembershipsPath())) return false;
+  try {
+    const active = readActiveOrgMemberships();
+    if (active.length === 0) {
+      process.stderr.write(
+        "[exe-os] \u26A0 org-memberships file present but lists no active membership \u2014 treating install as org-mode (fail closed: an empty roster is ambiguous, not proof of a founder install)\n"
+      );
+    }
+    establishOrgMode(active.map((m) => m.org_id));
+    return true;
+  } catch (err) {
+    process.stderr.write(
+      `[exe-os] \u26A0 org-memberships file unreadable (${err instanceof Error ? err.message : String(err)}) \u2014 treating install as org-mode (fail closed: founder-monitor writer stays unusable)
+`
+    );
+    establishOrgMode();
+    return true;
+  }
+}
+function orgMembershipPresent() {
+  return orgModeActive();
+}
+function clearOrgModeSticky(confirmation) {
+  if (confirmation !== ORG_MODE_CLEAR_CONFIRMATION) {
+    throw new Error(
+      `Refusing to clear the org-mode latch without the exact confirmation phrase ("${ORG_MODE_CLEAR_CONFIRMATION}")`
+    );
+  }
+  rmSync2(markerPath(), { force: true });
+  const cp = configPath();
+  if (existsSync2(cp)) {
+    try {
+      const cfg = JSON.parse(readFileSync2(cp, "utf8"));
+      delete cfg.org_mode_established;
+      writeFileSync2(cp, JSON.stringify(cfg, null, 2));
+    } catch {
+    }
+  }
+  clearOrgModeAnchor();
+  _latchedOrgMode = false;
+}
+var _warnedQuarantineDeferred = false;
+function warnQuarantineDeferredOnce(msg) {
+  if (_warnedQuarantineDeferred) return;
+  _warnedQuarantineDeferred = true;
+  process.stderr.write(msg);
+}
+function _resetOrgModeLatchForTest() {
+  _quarantinePending = false;
+  _warnedQuarantineDeferred = false;
+  _latchedOrgMode = false;
+}
+
+export {
+  ORG_MEMBERSHIPS_FILENAME,
+  ORG_MODE_MARKER_FILENAME,
+  CONFIG_FILENAME,
+  ORG_MODE_CLEAR_CONFIRMATION,
+  orgMembershipsPath,
+  readActiveOrgMemberships,
+  establishOrgMode,
+  ensureGrantsQuarantined,
+  orgModeActive,
+  orgMembershipPresent,
+  clearOrgModeSticky,
+  _resetOrgModeLatchForTest
+};