@fitchmultz/pi-subagents 0.47.0 → 0.49.0

package/dist/pi-intercom/bridge-storage.js

@@ -0,0 +1,73 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, realpathSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { isRecord } from "../shared/unknown.js";
+import { label } from "./bridge-protocol.js";
+export function stateDirectory(value) {
+    if (value === undefined) {
+        return;
+    }
+    const path = label(value, "stateDir", 4096);
+    const stat = lstatSync(path);
+    if (!isAbsolute(path) ||
+        !stat.isDirectory() ||
+        stat.uid !== process.getuid?.() ||
+        (stat.mode & 0o777) !== 0o700) {
+        throw new Error("stateDir must be an absolute owned directory with mode 0700, not a symlink.");
+    }
+    return realpathSync(path);
+}
+export function privateFile(path) {
+    const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() ||
+            stat.uid !== process.getuid?.() ||
+            (stat.mode & 0o777) !== 0o600 ||
+            stat.nlink !== 1) {
+            throw new Error("Storage files must be owned regular files with mode 0600 and one link.");
+        }
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Native SQLite FULL commits own durability; never replace an unreadable existing database. */
+export function privateDatabase(stateDir, name) {
+    stateDirectory(stateDir);
+    const path = join(stateDir, name);
+    let created = false;
+    try {
+        const fd = openSync(path, constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        closeSync(fd);
+        created = true;
+    }
+    catch (error) {
+        if (!isRecord(error) || error.code !== "EEXIST") {
+            throw error;
+        }
+    }
+    privateFile(path);
+    for (const suffix of ["-journal", "-wal", "-shm"]) {
+        try {
+            lstatSync(`${path}${suffix}`);
+        }
+        catch (error) {
+            if (isRecord(error) && error.code === "ENOENT") {
+                continue;
+            }
+            throw error;
+        }
+        privateFile(`${path}${suffix}`);
+    }
+    const db = new DatabaseSync(path, { enableDoubleQuotedStringLiterals: false });
+    try {
+        db.exec(`PRAGMA journal_mode=DELETE; PRAGMA synchronous=FULL; PRAGMA secure_delete=ON;
+      PRAGMA cache_size=-1024; PRAGMA busy_timeout=1000;`);
+        return { db, created };
+    }
+    catch (error) {
+        db.close();
+        throw error;
+    }
+}

package/dist/pi-intercom/bridge-target.js

@@ -0,0 +1,22 @@
+import { resolveSessionTarget, formatSessionTarget, nativePeerId } from "./session-targets.js";
+import { Fault } from "./bridge-protocol.js";
+export function bridgeSessionList(peers) {
+    return peers.map(({ topics: _topics, subscriptions: _subscriptions, ...entry }) => ({
+        ...entry,
+        target: formatSessionTarget(entry, peers),
+    }));
+}
+export function resolveBridgeTarget(peers, to, self) {
+    const exactNative = peers.find((peer) => peer.id === nativePeerId(to));
+    const resolution = resolveSessionTarget(peers, exactNative?.id ?? to);
+    if (resolution.status === "none") {
+        throw new Fault(404, "peer_offline", "Peer is not connected.");
+    }
+    if (resolution.status !== "found" || !resolution.target) {
+        throw new Fault(409, "ambiguous_target", "Use an unambiguous peer name or session ID (prefixes need at least 8 characters).");
+    }
+    if (resolution.target.id === self) {
+        throw new Fault(400, "self_target", "Choose another peer.");
+    }
+    return resolution.target;
+}

package/dist/pi-intercom/bridge-wake-owner.js

@@ -0,0 +1,57 @@
+import { randomUUID } from "node:crypto";
+import { rmSync } from "node:fs";
+import { join } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { privateDatabase, privateFile } from "./bridge-storage.js";
+import { isRecord } from "../shared/unknown.js";
+export const WAKE_OWNER_FILE = /^wake-owner-[0-9a-f-]{36}\.lock$/;
+/** SQLite's OS lock survives pauses and is released on exit, without PID reuse or stale leases. */
+export class WakeOwner {
+    name = `wake-owner-${randomUUID()}.lock`;
+    db;
+    path;
+    constructor(stateDir) {
+        this.path = join(stateDir, this.name);
+        this.db = privateDatabase(stateDir, this.name).db;
+        try {
+            this.db.exec("BEGIN EXCLUSIVE");
+        }
+        catch (error) {
+            this.db.close();
+            throw error;
+        }
+    }
+    close() {
+        this.db.close();
+        rmSync(this.path, { force: true });
+    }
+}
+export function stoppedWakeOwner(stateDir, name) {
+    if (!WAKE_OWNER_FILE.test(name)) {
+        throw new Error("Invalid wake owner.");
+    }
+    const path = join(stateDir, name);
+    try {
+        privateFile(path);
+    }
+    catch (error) {
+        if (isRecord(error) && error.code === "ENOENT") {
+            return true;
+        }
+        throw error;
+    }
+    const db = new DatabaseSync(path);
+    try {
+        db.exec("PRAGMA busy_timeout=0; BEGIN EXCLUSIVE");
+        return true;
+    }
+    catch (error) {
+        if (isRecord(error) && error.errcode === 5) {
+            return false;
+        }
+        throw error;
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/pi-intercom/bridge-wake-state.js

@@ -0,0 +1,293 @@
+import { lstatSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { privateDatabase, privateFile, stateDirectory } from "./bridge-storage.js";
+import { readBridgeFile } from "./bridge-files.js";
+import { isRecord, isUnknownArray } from "../shared/unknown.js";
+import { object } from "./bridge-protocol.js";
+import { WakeOwner, WAKE_OWNER_FILE, stoppedWakeOwner } from "./bridge-wake-owner.js";
+const HOUR_MS = 3600000;
+const LIMIT = 20;
+const RETRY_MS = 30000;
+const MAX_BACKOFF_MS = 300000;
+const FILE = "wake-quota.sqlite";
+const ATTEMPTS = `CREATE TABLE wake_attempts(
+  sequence INTEGER PRIMARY KEY, attemptedAt INTEGER NOT NULL,
+  settledAt INTEGER, owner TEXT,
+  CHECK(settledAt IS NOT NULL OR owner IS NOT NULL))`;
+function integer(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
+        throw new Error("Invalid durable wake state.");
+    }
+    return value;
+}
+/** One helper ledger, independent of identity, certificate, URL and credential rotation. */
+export class WakeState {
+    db;
+    path;
+    stateDir;
+    inode;
+    device;
+    owner;
+    finishing = false;
+    constructor(stateDir) {
+        this.stateDir = stateDir;
+        this.path = join(stateDir, FILE);
+        const { db, created } = privateDatabase(stateDir, FILE);
+        this.db = db;
+        const stat = lstatSync(this.path);
+        this.inode = stat.ino;
+        this.device = stat.dev;
+        try {
+            if (created) {
+                this.initialize();
+            }
+            this.verify();
+            this.migrate();
+            this.owner = this.createOwner();
+        }
+        catch (error) {
+            db.close();
+            throw error;
+        }
+    }
+    verify() {
+        const db = this.db;
+        if (db.prepare("PRAGMA quick_check").get()?.quick_check !== "ok") {
+            throw new Error("Wake ledger is corrupt.");
+        }
+        const meta = db.prepare("SELECT version, clock FROM wake_meta WHERE singleton=1").get();
+        if (!meta || (meta.version !== 1 && meta.version !== 2)) {
+            throw new Error("Unsupported wake ledger.");
+        }
+        integer(meta.clock);
+        this.verifyAttempts(meta.version);
+        for (const row of db.prepare("SELECT due, backoff FROM wake_batches").all()) {
+            integer(row.due);
+            const backoff = integer(row.backoff);
+            if ((backoff !== 0 && backoff < RETRY_MS) || backoff > MAX_BACKOFF_MS) {
+                throw new Error("Invalid wake retry state.");
+            }
+        }
+    }
+    createOwner() {
+        let owner;
+        try {
+            // Recovery holds this same ledger lock: it cannot reap a file before its owner locks it.
+            return this.transaction(() => {
+                owner = new WakeOwner(this.stateDir);
+                return owner;
+            });
+        }
+        catch (error) {
+            owner?.close();
+            throw error;
+        }
+    }
+    verifyAttempts(version) {
+        for (const row of this.db.prepare("SELECT attemptedAt FROM wake_attempts").all()) {
+            integer(row.attemptedAt);
+        }
+        if (version !== 2) {
+            return;
+        }
+        for (const row of this.db
+            .prepare("SELECT attemptedAt, settledAt, owner FROM wake_attempts")
+            .all()) {
+            if (row.settledAt !== null) {
+                if (integer(row.settledAt) < integer(row.attemptedAt)) {
+                    throw new Error("Invalid wake completion time.");
+                }
+            }
+            else if (typeof row.owner !== "string" || !WAKE_OWNER_FILE.test(row.owner)) {
+                throw new Error("Invalid open wake attempt.");
+            }
+        }
+    }
+    initialize() {
+        // Timestamped legacy outcomes omit crash-before-log attempts. Verified preflight may provide
+        // complete history plus a bounded unknown reservation; absent proof reserves the full hour.
+        const legacy = readdirSync(this.stateDir).some((name) => name !== FILE && (name.endsWith(".sqlite") || name.startsWith("presence-")));
+        const now = Date.now();
+        const attempts = this.history(now) ?? (legacy ? Array(LIMIT).fill(now) : []);
+        this.db.exec(`BEGIN IMMEDIATE;
+      CREATE TABLE wake_meta(singleton INTEGER PRIMARY KEY CHECK(singleton=1), version INTEGER NOT NULL, clock INTEGER NOT NULL);
+      ${ATTEMPTS};
+      CREATE TABLE wake_batches(bucket TEXT PRIMARY KEY, due INTEGER NOT NULL, backoff INTEGER NOT NULL);`);
+        this.db.prepare("INSERT INTO wake_meta VALUES(1,2,?)").run(now);
+        const insert = this.db.prepare("INSERT INTO wake_attempts(attemptedAt,settledAt) VALUES(?,?)");
+        for (const timestamp of attempts) {
+            insert.run(timestamp, timestamp);
+        }
+        this.db.exec("COMMIT");
+    }
+    migrate() {
+        this.transaction(() => {
+            if (this.db.prepare("SELECT version FROM wake_meta").get()?.version !== 1) {
+                return;
+            }
+            // V1 timestamps precede COMMIT/connect/TLS, so none prove when a POST finished.
+            // Stop all old writers before upgrading; the new CHECK also denies their old INSERT shape.
+            const now = Math.max(Date.now(), integer(this.db.prepare("SELECT clock FROM wake_meta").get()?.clock));
+            this.db.exec(`ALTER TABLE wake_attempts RENAME TO wake_attempts_v1; ${ATTEMPTS};`);
+            this.db
+                .prepare(`INSERT INTO wake_attempts(sequence,attemptedAt,settledAt)
+        SELECT sequence,attemptedAt,MAX(attemptedAt,?) FROM wake_attempts_v1`)
+                .run(now);
+            this.db.exec("DROP TABLE wake_attempts_v1");
+            this.db.prepare("UPDATE wake_meta SET version=2,clock=?").run(now);
+        });
+    }
+    history(now) {
+        const path = join(this.stateDir, "wake-history.json");
+        let input;
+        try {
+            privateFile(path);
+            input = JSON.parse(readBridgeFile(path, true, 1024 * 1024).toString("utf8"));
+        }
+        catch (error) {
+            if (isRecord(error) && error.code === "ENOENT") {
+                return;
+            }
+            throw error;
+        }
+        const raw = object(input, ["coveredSince", "stoppedAt", "attempts", "unknownAttempts"]);
+        const coveredSince = integer(raw.coveredSince);
+        const stoppedAt = integer(raw.stoppedAt);
+        const unknownAttempts = integer(raw.unknownAttempts);
+        if (coveredSince > stoppedAt - HOUR_MS ||
+            stoppedAt > now ||
+            unknownAttempts > LIMIT ||
+            !isUnknownArray(raw.attempts) ||
+            raw.attempts.length > 10000) {
+            throw new Error("Invalid legacy wake history; never reset prior usage.");
+        }
+        const attempts = raw.attempts.map(integer);
+        if (attempts.some((timestamp) => timestamp < coveredSince || timestamp > stoppedAt)) {
+            throw new Error("Attempt outside attested history coverage.");
+        }
+        return attempts
+            .filter((timestamp) => timestamp > now - HOUR_MS)
+            .concat(Array(unknownAttempts).fill(now));
+    }
+    validate() {
+        stateDirectory(this.stateDir);
+        privateFile(this.path);
+        const stat = lstatSync(this.path);
+        if (stat.ino !== this.inode || stat.dev !== this.device) {
+            throw new Error("Wake ledger was replaced.");
+        }
+    }
+    deadline(bucket) {
+        this.validate();
+        const existing = this.db.prepare("SELECT due FROM wake_batches WHERE bucket=?").get(bucket);
+        if (existing) {
+            return integer(existing.due);
+        }
+        // First observation occurs only after mailbox FULL commit, never at the pre-write receivedAt.
+        // Keep this grace durable too: new arrivals/reload/restart cannot restart an existing deadline.
+        this.db
+            .prepare("INSERT OR IGNORE INTO wake_batches VALUES(?,?,0)")
+            .run(bucket, Date.now() + 2000);
+        return integer(this.db.prepare("SELECT due FROM wake_batches WHERE bucket=?").get(bucket)?.due);
+    }
+    retire(bucket) {
+        this.validate();
+        this.db.prepare("DELETE FROM wake_batches WHERE bucket=?").run(bucket);
+    }
+    /** Persist quota and uncertainty BEFORE dispatch. Returning a deadline means no attempt admitted. */
+    reserve(bucket) {
+        this.retrySettlement();
+        return this.transaction(() => this.reservation(bucket));
+    }
+    retrySettlement() {
+        if (this.finishing) {
+            this.settle();
+        }
+    }
+    transaction(action) {
+        this.validate();
+        this.db.exec("BEGIN IMMEDIATE");
+        try {
+            const result = action();
+            this.db.exec("COMMIT");
+            return result;
+        }
+        catch (error) {
+            this.db.exec("ROLLBACK");
+            throw error;
+        }
+    }
+    /** A failed settlement stays open and must be retried before this owner can dispatch again. */
+    settle() {
+        this.finishing = true;
+        this.transaction(() => this.finishOwner(this.owner.name));
+        this.finishing = false;
+    }
+    finishOwner(owner) {
+        const now = Math.max(Date.now(), integer(this.db.prepare("SELECT clock FROM wake_meta").get()?.clock));
+        this.db
+            .prepare(`UPDATE wake_attempts SET settledAt=MAX(attemptedAt,?)
+      WHERE owner=? AND settledAt IS NULL`)
+            .run(now, owner);
+        this.db.prepare("UPDATE wake_meta SET clock=?").run(now);
+    }
+    recover() {
+        const names = new Set(readdirSync(this.stateDir).filter((name) => WAKE_OWNER_FILE.test(name)));
+        for (const row of this.db
+            .prepare("SELECT DISTINCT owner FROM wake_attempts WHERE settledAt IS NULL")
+            .all()) {
+            if (typeof row.owner !== "string") {
+                throw new Error("Invalid open wake owner.");
+            }
+            names.add(row.owner);
+        }
+        for (const name of names) {
+            if (name !== this.owner.name && stoppedWakeOwner(this.stateDir, name)) {
+                // The owner cannot send again. Unknown outcomes retain a full hour from this observation.
+                this.finishOwner(name);
+                rmSync(join(this.stateDir, name), { force: true });
+            }
+        }
+    }
+    reservation(bucket) {
+        this.recover();
+        const clock = integer(this.db.prepare("SELECT clock FROM wake_meta WHERE singleton=1").get()?.clock);
+        const now = Date.now();
+        if (now < clock) {
+            return clock;
+        }
+        const row = this.db.prepare("SELECT due, backoff FROM wake_batches WHERE bucket=?").get(bucket);
+        if (row && integer(row.due) > now) {
+            return integer(row.due);
+        }
+        this.db.prepare("DELETE FROM wake_attempts WHERE settledAt<=?").run(now - HOUR_MS);
+        const attempts = this.db
+            .prepare("SELECT settledAt FROM wake_attempts ORDER BY settledAt")
+            .all();
+        if (attempts.length >= LIMIT) {
+            const oldest = attempts.find((attempt) => attempt.settledAt !== null);
+            // Only open/unknown attempts have no expiry yet; revisit on the existing recovery backoff.
+            return oldest ? integer(oldest.settledAt) + HOUR_MS : now + RETRY_MS;
+        }
+        const backoff = row
+            ? Math.max(RETRY_MS, Math.min(integer(row.backoff) * 2, MAX_BACKOFF_MS))
+            : RETRY_MS;
+        this.db
+            .prepare("INSERT INTO wake_attempts(attemptedAt,owner) VALUES(?,?)")
+            .run(now, this.owner.name);
+        this.db.prepare("UPDATE wake_meta SET clock=? WHERE singleton=1").run(now);
+        this.db
+            .prepare("INSERT OR REPLACE INTO wake_batches VALUES(?,?,?)")
+            .run(bucket, now + backoff, backoff);
+        return;
+    }
+    close() {
+        try {
+            this.settle();
+        }
+        finally {
+            this.db.close();
+            this.owner.close();
+        }
+    }
+}