@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/services/operator-profiles.js

@@ -0,0 +1,236 @@
+import fs from "node:fs";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest, validateHybridContract } from "./hybrid-contracts.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { readBoundedReleaseFile } from "./release-source.js";
+export function operatorSettingsPath(home) { return path.join(home, "profile-settings.json"); }
+function profileError(code, message, exitCode = 2) {
+    return new AppError(code, `${message}; use dd-flow profiles --help`, exitCode, { phase: "profiles", effect: "no_effect", recoverable: true });
+}
+function completeSettings(input) {
+    const value = { ...input, profiles: input.profiles.map(entry => ({ ...entry, revision: hybridDigest(entry.profile) })) };
+    return { ...value, revision: hybridDigest(value) };
+}
+function admittedSettings(input) {
+    const issues = validateHybridContract("profile-settings", input);
+    if (issues.length)
+        throw profileError("profile_settings_invalid", "Profile settings violate the schema or aliases/revision contract");
+    const settings = input;
+    for (const { profile } of settings.profiles) {
+        if ([profile.provider, profile.model, profile.reasoning, profile.mode].some(value => !value.trim())) {
+            throw profileError("profile_settings_invalid", "Profile execution values must not be blank");
+        }
+    }
+    return settings;
+}
+function readRegularJson(file) {
+    try {
+        return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBoundedReleaseFile(file, 4 * 1024 * 1024)));
+    }
+    catch {
+        // Parser errors can contain submitted secrets. Never retain input text or cause.
+        throw profileError("profile_settings_invalid", "Profile input is unreadable or malformed JSON");
+    }
+}
+/** First successful write imports valid legacy IDs; thereafter the settings file is the sole owner. */
+export function readOperatorProfiles(home) {
+    const file = operatorSettingsPath(home);
+    if (fs.existsSync(file))
+        return admittedSettings(readRegularJson(file));
+    const profiles = [];
+    const legacy = path.join(home, "agent-profiles");
+    if (fs.existsSync(legacy)) {
+        for (const entry of fs.readdirSync(legacy).sort()) {
+            if (!entry.endsWith(".json"))
+                continue;
+            const profile = readRegularJson(path.join(legacy, entry));
+            const id = entry.slice(0, -5);
+            profiles.push({ id, revision: hybridDigest(profile), profile });
+        }
+    }
+    return admittedSettings(completeSettings({ schema_id: "dd-flow/profile-settings@1", profiles,
+        aliases: {}, default_profile: null }));
+}
+export function resolveOperatorProfile(settings, id) {
+    const selected = id ?? settings.default_profile;
+    if (!selected)
+        throw profileError("agent_profile_missing", "Select an explicit profile or configure a default", 1);
+    const target = Object.hasOwn(settings.aliases, selected) ? settings.aliases[selected] : selected;
+    const entry = settings.profiles.find(item => item.id === target);
+    if (!entry)
+        throw profileError("agent_profile_missing", "Selected profile is unavailable", 1);
+    return structuredClone(entry.profile);
+}
+/** Used by explicit files and onboarding alike; extra credential fields fail before any write. */
+export function prepareOperatorProfile(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        throw profileError("profile_settings_invalid", "Profile must be an object");
+    const sample = input;
+    const value = completeSettings({ schema_id: "dd-flow/profile-settings@1", profiles: [
+            { id: sample?.id, revision: hybridDigest(input), profile: sample }
+        ], aliases: {}, default_profile: null });
+    return admittedSettings(value).profiles[0].profile;
+}
+export function readOperatorProfileInput(file) {
+    return prepareOperatorProfile(readRegularJson(file));
+}
+function changedSettings(current, mutation) {
+    const next = structuredClone(current);
+    if (mutation.action === "create" || mutation.action === "edit") {
+        if (mutation.action === "create" && mutation.setDefault !== undefined && typeof mutation.setDefault !== "boolean") {
+            throw profileError("profile_settings_invalid", "Default selection must be an explicit boolean");
+        }
+        const profile = prepareOperatorProfile(mutation.profile);
+        const index = next.profiles.findIndex(entry => entry.id === profile.id);
+        if (mutation.action === "create" && index >= 0)
+            throw profileError("profile_conflict", "Profile ID already exists", 1);
+        if (mutation.action === "edit" && index < 0)
+            throw profileError("agent_profile_missing", "Cannot edit a missing profile", 1);
+        const entry = { id: profile.id, revision: hybridDigest(profile), profile };
+        if (index >= 0)
+            next.profiles[index] = entry;
+        else
+            next.profiles.push(entry);
+        if (mutation.action === "create" && mutation.setDefault === true)
+            next.default_profile = profile.id;
+    }
+    else if (mutation.action === "remove") {
+        if (!next.profiles.some(entry => entry.id === mutation.id))
+            throw profileError("agent_profile_missing", "Cannot remove a missing profile", 1);
+        if (Object.values(next.aliases).includes(mutation.id) || next.default_profile === mutation.id
+            || next.default_profile !== null && next.aliases[next.default_profile] === mutation.id) {
+            throw profileError("profile_in_use", "Remove aliases and change the default before removing this profile", 1);
+        }
+        next.profiles = next.profiles.filter(entry => entry.id !== mutation.id);
+    }
+    else if (mutation.action === "alias") {
+        if (mutation.target === null) {
+            if (!Object.hasOwn(next.aliases, mutation.alias))
+                throw profileError("profile_alias_missing", "Alias is unavailable", 1);
+            if (next.default_profile === mutation.alias)
+                throw profileError("profile_in_use", "Change the default before removing its alias", 1);
+            delete next.aliases[mutation.alias];
+        }
+        else
+            Object.defineProperty(next.aliases, mutation.alias, { value: mutation.target, enumerable: true, writable: true, configurable: true });
+    }
+    else if (mutation.action === "set-default")
+        next.default_profile = mutation.id;
+    else
+        throw profileError("profile_settings_invalid", "Unknown profile mutation");
+    const { revision: _revision, ...content } = next;
+    void _revision;
+    return admittedSettings(completeSettings(content));
+}
+/** Pure preflight suitable for freezing into an installation request before any effects. */
+export function prepareProfileCreation(settings, profile, setDefault) {
+    if (typeof setDefault !== "boolean")
+        throw profileError("profile_settings_invalid", "Default selection requires explicit consent");
+    const before = admittedSettings(structuredClone(settings)), admitted = prepareOperatorProfile(profile);
+    const after = changedSettings(before, { action: "create", profile: admitted, setDefault });
+    return { schema_id: "dd-flow/profile-creation-intent@1", before, after, profile: structuredClone(admitted), set_default: setDefault };
+}
+/** Exact frozen intent reconciliation: an already-applied write is not applied a second time.
+ * A later edit/default change is a conflict, never a reason to restore old settings.
+ */
+export function validateProfileCreationIntent(input) {
+    if (!input || typeof input !== "object" || Array.isArray(input)
+        || Object.keys(input).some(key => !["schema_id", "before", "after", "profile", "set_default"].includes(key))
+        || ["schema_id", "before", "after", "profile", "set_default"].some(key => !Object.hasOwn(input, key))
+        || input.schema_id !== "dd-flow/profile-creation-intent@1")
+        throw profileError("profile_settings_invalid", "Invalid profile creation intent");
+    const expected = prepareProfileCreation(input.before, input.profile, input.set_default);
+    admittedSettings(input.after);
+    if (hybridDigest(expected) !== hybridDigest(input))
+        throw profileError("profile_settings_invalid", "Profile creation intent changed");
+}
+export function readProfileCreationIntent(file) {
+    try {
+        const input = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(readBoundedReleaseFile(file, 4 * 1024 * 1024)));
+        validateProfileCreationIntent(input);
+        return input;
+    }
+    catch {
+        throw profileError("profile_settings_invalid", "Profile creation intent must be a bounded valid regular JSON file");
+    }
+}
+export function commitProfileCreation(home, input) {
+    validateProfileCreationIntent(input);
+    const current = readOperatorProfiles(home);
+    if (current.revision === input.after.revision)
+        return { replayed: true, settings: current };
+    return { replayed: false, settings: mutateOperatorProfiles(home, input.before.revision, { action: "create", profile: input.profile, setDefault: input.set_default }) };
+}
+/** Compare-and-swap under an exclusive owned lock; no dual writer for legacy profile files. */
+export function mutateOperatorProfiles(home, expectedRevision, mutation) {
+    const before = readOperatorProfiles(home);
+    if (before.revision !== expectedRevision)
+        throw profileError("profile_revision_conflict", "Profile settings changed; reread before retrying", 1);
+    const prepared = changedSettings(before, mutation); // Fully validate before creating the home/lock.
+    const serialized = JSON.stringify(prepared, null, 2) + "\n";
+    if (Buffer.byteLength(serialized) > 4 * 1024 * 1024)
+        throw profileError("profile_settings_invalid", "Profile settings exceed the bounded reader limit");
+    fs.mkdirSync(home, { recursive: true, mode: 0o700 });
+    const lock = path.join(home, "profile-settings.lock");
+    // Profiles use storage-owner identity, not a setup request ledger. A dead
+    // writer may be recovered by a later CAS mutation, including after commit.
+    let lease;
+    try {
+        lease = acquireInstallationLock(lock, hybridDigest({ resource: "profile-settings", home: path.resolve(home) }));
+    }
+    catch {
+        throw profileError("profile_write_conflict", "Another profile writer or unreconciled lock exists", 1);
+    }
+    const temporary = path.join(home, `.profile-settings-${randomUUID()}.tmp`);
+    let ownsTemporary = false;
+    let renameAttempted = false;
+    let failure;
+    let result;
+    try {
+        if (readOperatorProfiles(home).revision !== expectedRevision)
+            throw profileError("profile_revision_conflict", "Profile settings changed while acquiring the lock", 1);
+        const fd = fs.openSync(temporary, "wx", 0o600);
+        ownsTemporary = true;
+        try {
+            fs.writeFileSync(fd, serialized);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        renameAttempted = true;
+        fs.renameSync(temporary, operatorSettingsPath(home));
+        result = readOperatorProfiles(home);
+    }
+    catch (error) {
+        failure = error instanceof AppError && !renameAttempted ? error : new AppError("profile_write_interrupted", "Profile write requires reconciliation; reread settings before retrying", 1, { phase: "profiles", effect: "unknown", recoverable: true,
+            next_action: "dd-flow profiles list --json" });
+    }
+    finally {
+        let cleanupFailed = false;
+        try {
+            if (ownsTemporary && fs.existsSync(temporary))
+                fs.unlinkSync(temporary);
+        }
+        catch {
+            cleanupFailed = true;
+        }
+        try {
+            lease.release();
+        }
+        catch {
+            cleanupFailed = true;
+        }
+        if (cleanupFailed) {
+            if (failure)
+                failure.details.cleanup = "not_confirmed";
+            else
+                failure = new AppError("profile_cleanup_failed", "Profile writer cleanup requires reconciliation", 1, { phase: "profiles", effect: "unknown", cleanup: "not_confirmed", next_action: "dd-flow profiles list --json" });
+        }
+    }
+    if (failure)
+        throw failure;
+    return result;
+}

package/dist/services/projects.js

@@ -11,9 +11,24 @@ import { loadProjectFlowContract } from "../domain/flow-contract.js";
 import { buildStaticFlowGuidance } from "./flow-guidance.js";
 import { normalizeProtocolLifecycle } from "./protocol-lifecycle.js";
 import { buildProjectSummary, projectRegistrySummary, readPublishedProjectSummary } from "./project-summary.js";
+/** Resolve filesystem identity before entering a composite SQL writer. */
+export class PreparedProjectRegistration {
+    #root;
+    constructor(root) { this.#root = root; Object.freeze(this); }
+    static prepare(input) {
+        return new PreparedProjectRegistration(resolveProjectRoot(input.root));
+    }
+    root() { return this.#root; }
+}
 export function registerProject(context, input) {
-    const root = resolveProjectRoot(input.root);
-    const existing = findProjectByRoot(context, root);
+    return registerPreparedProject(context, PreparedProjectRegistration.prepare(input));
+}
+/** Metadata-only registration; the composite caller owns its SQL transaction. */
+export function registerPreparedProject(context, prepared) {
+    if (!(prepared instanceof PreparedProjectRegistration))
+        throw new AppError("validation", "Project registration must be prepared", 2);
+    const root = prepared.root();
+    const existing = context.db.get("SELECT * FROM projects WHERE root = ?", [root]);
     const now = context.now();
     const project = existing ?? newProjectRecord(context, root, now);
     if (existing) {