@dharma-ai-labs/agent-fabric 0.2.210 → 0.2.211

package/dist/index.js

@@ -21,11 +21,13 @@ import { runDeviceSigningMaintenanceController } from './deviceSigningMaintenanc
 import { withLegacySigningMaintenanceBoundary } from './legacySigningMaintenanceBoundary.js';
 import { superviseRelay } from './relaySupervisor.js';
 import { currentRepositoryRelayFailure, repositoryRelayObservationReady, runRegisteredRepositoryRelays, selectRepositoryRelayRegistrations, serializeRelayWork, waitForRelayRefresh, withRepositoryRelayStage } from './repositoryRelaySupervisor.js';
-import { assertRelayStartupOwnership, disableRelayAutostart, enableRelayAutostart, inspectOwnedRelayAutostart, relayAutostartStatus, startRelayAutostart, stopRelayAutostart } from './relayAutostart.js';
+import { assertRelayStartupOwnership, assertRelayAutostartPaused, disableRelayAutostart, enableRelayAutostart, inspectOwnedRelayAutostart, relayAutostartStatus, startRelayAutostart, stopRelayAutostart } from './relayAutostart.js';
 import { runOwnedContainerEntrypoint, readContainerProcessIdentity } from './containerRelayLifecycle.js';
 import { readWorkspaceRegistry } from './workspaceRegistry.js';
 import { appendRecoveredWorkspace, applyRegistryRecoveryFile, inspectRegistryRecoveryFile, resolveRegistryRecoveryProjection } from './workspaceRegistryRecovery.js';
 import { relayRuntimeObservationReady, upgradeRelayRuntime } from './relayRuntimeUpgrade.js';
+import { reconcileStoppedNamedSessionLock } from './namedSessionStoppedLock.js';
+import { upgradeRelayForSigningMaintenance } from './relaySigningMaintenanceUpgrade.js';
 import { activateMaintenanceRestart, maintainNamedSession, recoverStoppedNamedSession } from './namedSessionMaintenance.js';
 import { assertNamedSessionStartupRegistration } from './namedSessionAdmission.js';
 import { recoverableContainerJournal } from './containerRelayRecovery.js';
@@ -112,7 +114,7 @@ import { parseLocalCodexSetupReadiness } from '@dharma-ai-labs/agent-fabric-loca
 import { writeBootstrapHostJson, writeBootstrapHostText } from './bootstrapHostFiles.js';
 export { openCooperativeInboxSession } from './cooperativeInboxSession.js';
 import { inspectNamedCodexRecoveryToolDeclaration } from './codexSigningRecoveryTool.js';
-const VERSION = '0.2.210';
+const VERSION = '0.2.211';
 const USAGE = CLI_USAGE;
 const execFileAsync = promisify(execFile);
 const LOCAL_PROVIDER_IDS = ['codex', 'claude', 'agy', 'hermes'];
@@ -177,6 +179,18 @@ export function formatCommandOutput(value) {
 }
 export function commandExitCode(argv, value) {
     const { positional, flags } = parseCliOptions(argv);
+    if (positional[0] === 'relay' && positional[1] === 'upgrade'
+        && (flags.has('stage-signing-maintenance') || flags.has('finish-signing-maintenance'))) {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return 2;
+        const receipt = value;
+        if (receipt.schema !== 'dharma.local-signing-maintenance-upgrade/v1' || receipt.ready !== false
+            || receipt.nativeContinuationAuthorized !== false)
+            return 2;
+        return flags.get('apply') !== true ? receipt.state === 'planned' ? 0 : 2
+            : flags.has('finish-signing-maintenance') ? receipt.state === 'completed' && receipt.upgradeComplete === true ? 0 : 2
+                : receipt.state === 'staged' && receipt.upgradeComplete === false ? 0 : 2;
+    }
     if (positional[0] === 'signing-recovery') {
         if (!value || typeof value !== 'object' || Array.isArray(value))
             return 2;
@@ -2014,6 +2028,15 @@ async function installStableRepositoryLauncher(workspace) {
     return { shell: '.dharma/bin/dharma', windows: '.dharma/bin/dharma.cmd' };
 }
 async function relayUpgrade(flags) {
+    const stageMaintenance = flags.has('stage-signing-maintenance'), finishMaintenance = flags.has('finish-signing-maintenance');
+    const maintenance = stageMaintenance || finishMaintenance;
+    if (maintenance && process.platform !== 'linux')
+        throw new Error('relay_signing_maintenance_linux_required');
+    if (stageMaintenance && finishMaintenance || maintenance && flags.has('rollback')
+        || ['stage-signing-maintenance', 'finish-signing-maintenance'].some(key => flags.has(key) && flags.get(key) !== true)
+        || maintenance && ['apply', 'dry-run'].some(key => flags.has(key) && flags.get(key) !== true)
+        || flags.has('previous-upgrade-sha256') && !stageMaintenance)
+        throw new Error('relay_signing_maintenance_options_invalid');
     const config = await readDeviceConfig();
     if (!config)
         throw new Error('relay_upgrade_enrollment_required');
@@ -2057,10 +2080,46 @@ async function relayUpgrade(flags) {
         const npmCliPath = process.platform === 'linux' && !flags.has('rollback') ? await resolveRepositoryNpmCli() : undefined;
         const codexDirectory = !flags.has('rollback')
             ? await resolveRepositoryCodexDirectory({ searchPath: providerProcessEnvironment(process.env).PATH }) : undefined;
-        const receipt = await upgradeRelayRuntime({ home, workspace, version: VERSION,
+        const upgrade = maintenance ? upgradeRelayForSigningMaintenance : upgradeRelayRuntime;
+        const receipt = await upgrade({ home, workspace, version: VERSION,
             organizationId: config.organizationId, deviceId: config.deviceId, workspaceId: selected.workspaceId,
-            dryRun: !flags.has('apply'), rollback: flags.has('rollback') }, {
+            dryRun: !flags.has('apply'), rollback: flags.has('rollback'),
+            trustGeneration: config.serverSigningKeyset?.generation ?? 0, finish: finishMaintenance,
+            ...(flags.has('previous-upgrade-sha256') ? { previousUpgradeSha256: String(flags.get('previous-upgrade-sha256')) } : {}) }, {
             assertStopped,
+            assertStartupPaused: () => assertRelayAutostartPaused(startupOptions),
+            stageStartup: (version, restore) => enableRelayAutostart({ ...startupOptions, workspace,
+                launcher: startup.launcher, policy: startup.policy, version, restoreCodexHome: restore.codexHome, pauseForSigningMaintenance: true }),
+            assertNamedDisabled: async () => {
+                const entries = await readdir(resolve(home, 'sessions'), { withFileTypes: true });
+                const names = entries.filter(entry => entry.isDirectory() && /^[a-z][a-z0-9-]{0,47}$/.test(entry.name));
+                if (names.length !== 1)
+                    throw Error('relay_signing_maintenance_session_scope_unavailable');
+                const registration = await readNamedSession(home, names[0].name);
+                if (!registration || registration.enabled || registration.identity.organizationId !== config.organizationId
+                    || registration.identity.deviceId !== config.deviceId || registration.identity.workspaceId !== selected.workspaceId)
+                    throw Error('relay_signing_maintenance_session_scope_unavailable');
+                try {
+                    await lstat(resolve(home, 'sessions', names[0].name, 'service.lock'));
+                    throw Error('relay_signing_maintenance_session_lock_requires_reconciliation');
+                }
+                catch (error) {
+                    if (error.code !== 'ENOENT')
+                        throw error;
+                }
+            },
+            assertRecoveredTrust: async (previousGeneration) => {
+                const current = await readDeviceConfig(), keyset = current?.serverSigningKeyset;
+                if (!current || current.organizationId !== config.organizationId || current.deviceId !== config.deviceId
+                    || current.hqUrl !== config.hqUrl || current.relayUrl !== config.relayUrl || current.enrolledAt !== config.enrolledAt
+                    || current.connectionMode !== config.connectionMode
+                    || current.installationId !== config.installationId || current.publicKeyEd25519 !== config.publicKeyEd25519
+                    || current.setupClaimReference !== config.setupClaimReference || current.setupClaimRepositoryFingerprint !== config.setupClaimRepositoryFingerprint
+                    || !keyset || keyset.generation <= previousGeneration || !validateTrustedServerSigningKeysetContract(keyset).ok
+                    || !verifyInitialServerSigningKeyset(keyset, createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: current.serverPublicKeyEd25519 }, format: 'jwk' }), current.organizationId).ok)
+                    throw Error('relay_signing_maintenance_trust_not_recovered');
+                await loadDeviceEnrollmentAnchor({ config: current, readOnly: true });
+            },
             recoverableJournal: startup.backend === 'container-entrypoint' ? recoverableContainerJournal : undefined,
             inspectStartup: async () => {
                 const current = await inspectOwnedRelayAutostart(startupOptions);
@@ -2120,7 +2179,8 @@ async function relayUpgrade(flags) {
                 throw new Error('relay_upgrade_receiver_unconfirmed');
             },
         });
-        const validation = await validateContract(resolve(fileURLToPath(new URL('.', import.meta.url)), 'schemas'), 'https://schemas.dharma-ai.io/local-relay-upgrade/v1', receipt);
+        const validation = await validateContract(resolve(fileURLToPath(new URL('.', import.meta.url)), 'schemas'), maintenance ? 'https://schemas.dharma-ai.io/local-signing-maintenance-upgrade/v1'
+            : 'https://schemas.dharma-ai.io/local-relay-upgrade/v1', receipt);
         if (!validation.ok)
             throw new Error('relay_upgrade_receipt_invalid');
         return receipt;
@@ -5316,6 +5376,11 @@ async function namedSessionCommand(action, flags) {
     const hostScope = currentBootstrapHostScope();
     const setupSessionScope = currentAcceptedSetupSessionScope();
     const supervisorOwner = currentNamedSessionChildOwner();
+    if (action === 'reconcile-stopped-lock' && (hostScope || setupSessionScope || supervisorOwner
+        || [...flags.keys()].some(k => !['name', 'workspace-id', 'registration-sha256', 'lock-sha256', 'apply', 'dry-run', 'json'].includes(k))
+        || ['apply', 'dry-run', 'json'].some(k => flags.has(k) && flags.get(k) !== true)
+        || flags.has('apply') && flags.has('dry-run')))
+        throw Error('named_session_stopped_lock_options_invalid');
     if (hostScope && (supervisorOwner || setupSessionScope))
         throw new Error('named_session_child_owner_conflict');
     if (setupSessionScope && !['start', 'status', 'readiness'].includes(action))
@@ -5338,7 +5403,7 @@ async function namedSessionCommand(action, flags) {
         await release?.();
     };
     try {
-        if (['start', 'serve'].includes(action) && flags.has('apply')) {
+        if (['start', 'serve'].includes(action) && flags.has('apply') || action === 'reconcile-stopped-lock') {
             startupAdmission = await step(() => acquireNamedSessionStartupAdmission());
         }
         let childMessage;
@@ -5373,6 +5438,36 @@ async function namedSessionCommand(action, flags) {
                     bindingId: existing?.bindingId ?? null };
             }
         }
+        if (action === 'reconcile-stopped-lock') {
+            if (!existing)
+                throw Error('named_session_stopped_lock_unconfirmed');
+            return await reconcileStoppedNamedSessionLock({ home: dharmaHome(), name, registration: existing,
+                registrationSha256: required(flags, 'registration-sha256'), lockSha256: required(flags, 'lock-sha256'), apply: flags.has('apply') }, {
+                assertTopology: async () => {
+                    await assertRelayAutostartPaused({ home: dharmaHome() });
+                    if (await relayProcessState(dharmaHome()) !== 'stopped' || await relaySupervisorProcessState(dharmaHome()) !== 'stopped')
+                        throw Error('named_session_stopped_lock_unconfirmed');
+                    try {
+                        await namedSessionRequest(dharmaHome(), name, { action: 'status' }, { diagnostic: true });
+                        throw Error('named_session_stopped_lock_unconfirmed');
+                    }
+                    catch (error) {
+                        if (!(error instanceof NamedSessionTransportFailure) || error.diagnostic.phase !== 'connect'
+                            || !['ENOENT', 'ECONNREFUSED'].includes(String(error.diagnostic.osCode)))
+                            throw Error('named_session_stopped_lock_unconfirmed');
+                    }
+                },
+                processState: async (pid) => {
+                    try {
+                        process.kill(pid, 0);
+                        return 'running';
+                    }
+                    catch (error) {
+                        return error.code === 'ESRCH' ? 'stopped' : 'unknown';
+                    }
+                },
+            });
+        }
         if (action === 'readiness') {
             if (!existing?.enabled)
                 throw new Error('named_session_readiness_unavailable');
@@ -9649,9 +9744,24 @@ export async function run(argv) {
     if (command === 'relay' && subcommand === 'autostart') {
         if (positional[2] === 'status')
             return relayAutostartStatus({ home: dharmaHome() });
+        if (positional[2] === 'pause') {
+            if ([...flags.keys()].some(k => !['apply', 'dry-run', 'json'].includes(k))
+                || [...flags.values()].some(v => v !== true) || flags.has('apply') && flags.has('dry-run'))
+                throw Error('relay_pause_options_invalid');
+            return withRelayStartupMutation(async () => {
+                const registration = await inspectOwnedRelayAutostart({ home: dharmaHome() });
+                if (registration.backend !== 'container-entrypoint')
+                    throw Error('relay_pause_container_required');
+                if (!flags.has('apply'))
+                    return { ok: true, planned: true, state: 'pause_planned', backend: registration.backend };
+                await stopRelayAutostart({ home: dharmaHome() });
+                await assertRelayAutostartPaused({ home: dharmaHome() });
+                return { ok: true, planned: false, state: 'paused', backend: registration.backend, registrationPreserved: true };
+            });
+        }
         if (positional[2] === 'disable')
             return withRelayStartupMutation(() => disableRelayAutostart({ home: dharmaHome() }));
-        throw new Error('Use dharma relay autostart status or dharma relay autostart disable.');
+        throw new Error('Use dharma relay autostart status, pause or disable.');
     }
     if (command === 'relay' && subcommand === 'supervise')
         return relaySupervise(flags);