@cotal-ai/manager 0.124.3 → 0.125.0

package/dist/manager.js

@@ -3,6 +3,7 @@ import { hostname } from "node:os";
 import { credsAuthenticator } from "@nats-io/transport-node";
 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from "node:fs";
 import { isAbsolute, join, dirname, resolve } from "node:path";
+import { parse as parseYaml } from "yaml";
 import Headless from "@xterm/headless";
 import { CotalEndpoint, canonicalJson, MANAGED_HANDOFF_KIND, accountFromCreds, credsClaims, DEFAULT_SERVER, DEV_OWNER, MANAGER_LEASE_RENEW_MS, MANAGER_LEASE_TTL_MS, awaitLeaseExpiry, leaseRemainingMs, STANDING_RENEWABLE_TTL_SEC, assertLifecycleToken, discardLaunchArtifacts, divergentSecretStoreNotice, injectedSecretStoreIdentity, parseDaemonStoreAnswer, parseSecretStoreIdentity, sameSecretStoreIdentity, agentFilePath, clearSpaceHistory, dialerFor, connectorServers, spawnEnvAllow, deprovisionAgent, fenceLifecycleAcl, DeprovisionError, addDeprovisionAccounting, isConcreteChannel, deprovisionTargetPrincipal, firstFreeName, spawnNameError, idFromCreds, identityFromCreds, inspectCredHealth, credsRenewalDelayMs, composeWirePersona, loadAgentFile, listPersonaCatalog, personaCatalogDescription, personaCatalogReadable, loadCotalConfig, modelPolicyRefusal, mintCreds, mintGeneration, mintAcceptedToken, bindIssuedStores, mintLifecycleUid, managedRetirementOpId, mkSecretDir, newIdentity, oneLine, actionContext, parsePrincipalKey, principalKey, probeConnect, provisionAgent, provisionAgentDurables, registry, resolveAuthProvider, resolveReadAcl, runAgentBearer, saveAgentFile, subjectMatches, AUTH_ENDPOINT, EP_CMD_RETIRE_LIFECYCLE, controlServiceSubject, eventChannelPrincipal, resolveService, invokeCommand, digestIdToken, } from "@cotal-ai/core";
 import { loadLaunchPersonaFile, PersonaSourceError } from "@cotal-ai/workspace";
@@ -3306,6 +3307,12 @@ export class Manager {
             cancel: (ctx) => this.serveGated(ctx, () => this.serveTurnCancel(ctx)),
             stopSelf: (ctx) => this.serveGated(ctx, () => unwrap(this.opStopSelf(callerOf(ctx), args(ctx)))),
             definePersona: (ctx) => this.serveGated(ctx, () => unwrap(this.opDefinePersona(args(ctx), callerOf(ctx), false))),
+            removePersona: (ctx) => this.serveGated(ctx, () => {
+                const r = this.opRemovePersona(args(ctx), callerOf(ctx), false);
+                if (!r.ok)
+                    throw new EpEnvelopeError((r.code ?? "failed-precondition"), r.error ?? "the operation failed", r.details, "not-executed");
+                return r.data;
+            }),
             // Reach is the broker's: only operator instruments carry these rows. The serve gate is the
             // maintenance fence, so neither runs while a shutdown or resume holds control.
             chatSessionOpen: (ctx) => this.serveGated(ctx, () => this.openStaticChatSession(args(ctx))),
@@ -4443,10 +4450,14 @@ export class Manager {
             throw new Error(`cannot read connector session state ${path}: ${rejectionText(error)}`);
         }
         const state = parsed;
-        if (state.version !== 1 || typeof state.sessionId !== "string" || !state.sessionId.trim() || state.sessionId.length > 4096 ||
-            (state.status !== "running" && state.status !== "quit"))
-            throw new Error(`connector session state ${path} is malformed`);
-        return { sessionId: state.sessionId, status: state.status };
+        if (state.version === 1 && typeof state.sessionId === "string" && state.sessionId.trim() && state.sessionId.length <= 4096 &&
+            (state.status === "running" || state.status === "quit"))
+            return { sessionId: state.sessionId, status: state.status };
+        if (state.version === 2 && state.status === "prompt" && typeof state.connector === "string" && /^[a-z0-9-]{1,64}$/.test(state.connector) &&
+            typeof state.prompt === "string" && state.prompt.trim() && state.prompt.length <= 1024 &&
+            typeof state.cwd === "string" && state.cwd.trim() && state.cwd.length <= 4096)
+            return { connector: state.connector, status: "prompt", prompt: state.prompt, cwd: state.cwd };
+        throw new Error(`connector session state ${path} is malformed`);
     }
     readManagedSessionState(a) {
         const path = a.restart?.sessionStatePath;
@@ -4463,7 +4474,10 @@ export class Manager {
             return undefined;
         const path = join(this.workspaceRoot, ".cotal", "pi-sessions", `${entry.name}-${entry.identity.lifecycleUid}.json`);
         try {
-            return this.readSessionStatePath(path).sessionId;
+            const state = this.readSessionStatePath(path);
+            if (state.status === "prompt")
+                throw new Error(`${state.connector} is waiting at prompt ${JSON.stringify(state.prompt)} for directory ${JSON.stringify(state.cwd)}`);
+            return state.sessionId;
         }
         catch (error) {
             throw new Error(`retained ${connector.name} agent ${entry.name} has no sessionId in its older inventory and no usable upgrade state at ${path} ` +
@@ -4535,7 +4549,10 @@ export class Manager {
         this.freeSlot(a, true, "carried-fork-refused");
     }
     readManagedSession(a) {
-        return this.readManagedSessionState(a).sessionId;
+        const state = this.readManagedSessionState(a);
+        if (state.status === "prompt")
+            throw new Error(`${state.connector} is waiting at prompt ${JSON.stringify(state.prompt)} for directory ${JSON.stringify(state.cwd)}`);
+        return state.sessionId;
     }
     /** Re-record an exact seat's assignment at a proven session, so crash recovery, a preserved resume
      *  and the next manifest launch never pick different sessions. */
@@ -4558,18 +4575,26 @@ export class Manager {
     async awaitManagedSessionState(a) {
         const deadline = Date.now() + 15_000;
         let last = "session state not written yet";
+        let prompt;
+        const promptFailure = () => prompt
+            ? `${prompt.connector} is waiting at prompt ${JSON.stringify(prompt.prompt)} for directory ${JSON.stringify(prompt.cwd)}`
+            : undefined;
         while (Date.now() < deadline) {
-            if (a.handle.status() === "exited")
-                throw new Error("process exited before writing session state");
             try {
-                return this.readManagedSessionState(a);
+                const state = this.readManagedSessionState(a);
+                if (state.status === "prompt")
+                    prompt = state;
+                else
+                    return state;
             }
             catch (error) {
                 last = rejectionText(error);
             }
+            if (a.handle.status() === "exited")
+                throw new Error(promptFailure() ?? "process exited before writing session state");
             await new Promise((resolve) => setTimeout(resolve, 100));
         }
-        throw new Error(`connector did not write session state (${last})`);
+        throw new Error(promptFailure() ?? `connector did not write session state (${last})`);
     }
     /** Bind a continuation-capable connector only after its process is ready. The file proves the
      *  latest in-process session (including Pi /resume); the authenticated socket proves this process
@@ -10594,6 +10619,62 @@ export class Manager {
         }
         return { ok: true, data: { name, path } };
     }
+    /** Remove one machine-local persona definition without touching any running lifecycle that was
+     *  launched from it. Removal accepts the catalog's safe filename alphabet without applying the
+     *  current spawn-name length or user-mode actor rules, so an obsolete invalid-name entry remains
+     *  repairable. Ownership matches redefine: the recorded owner, or admin for an ownerless file. */
+    opRemovePersona(args, caller, admin) {
+        if (this.execution === "none")
+            throw new EpEnvelopeError("unimplemented", this.executionRefusal());
+        const name = String(args.name ?? "").trim();
+        if (!name)
+            return { ok: false, code: "bad-request", error: "name required" };
+        if (!/^[A-Za-z0-9_-]+$/.test(name))
+            return { ok: false, code: "bad-request", error: `unsafe persona name ${JSON.stringify(name)} (allowed: letters, digits, _ -)` };
+        const path = agentFilePath(this.workspaceRoot, name);
+        if (!existsSync(path))
+            return { ok: false, code: "not-found", error: `no persona "${name}"` };
+        let owner;
+        try {
+            owner = loadAgentFile(path).owner;
+        }
+        catch {
+            // A catalog entry may be invalid for launch solely because an older release admitted a name
+            // above today's identity limit. Read only its frontmatter owner without asking the launch
+            // parser to accept the identity. This does not make the file spawnable or readable.
+            try {
+                const source = readFileSync(path, "utf8").replace(/^\uFEFF/, "").replace(/\r\n/g, "\n");
+                const match = /^---\n([\s\S]*?)\n---(?:\n|$)/.exec(source);
+                if (!match)
+                    throw new Error("missing frontmatter");
+                const frontmatter = parseYaml(match[1]);
+                if (!frontmatter || typeof frontmatter !== "object" || Array.isArray(frontmatter))
+                    throw new Error("frontmatter is not a mapping");
+                const fields = frontmatter;
+                if (String(fields.name ?? "") !== name)
+                    throw new Error("frontmatter name differs from the catalog entry");
+                if (fields.owner !== undefined && typeof fields.owner !== "string")
+                    throw new Error("owner is not a string");
+                owner = fields.owner;
+            }
+            catch {
+                return { ok: false, code: "not-found", error: `no persona "${name}"` };
+            }
+        }
+        if (!admin && owner !== caller) {
+            const heldBy = owner ? `owned by ${owner}` : "operator-owned (legacy file - no agent owner)";
+            return { ok: false, code: "permission-denied", error: `not authorized to remove ${name}: ${heldBy}; only its owner or an operator can` };
+        }
+        try {
+            rmSync(path);
+        }
+        catch (e) {
+            if (!existsSync(path))
+                return { ok: false, code: "not-found", error: `no persona "${name}"` };
+            return { ok: false, error: rejectionText(e) };
+        }
+        return { ok: true, data: { name } };
+    }
     /** The owner a fresh wire-defined persona records. A user-auth caller's principal is stable, and
      *  so is one of this manager's own seats for its life. Any other static caller, such as the CLI's
      *  operator instrument minted for one call, would leave an owner no later call matches, so it