@fitchmultz/pi-subagents 0.49.1 → 0.51.0

package/dist/pi-intercom/bridge-catalog.js

@@ -1,372 +0,0 @@
-import { nativePeerId } from "./session-targets.js";
-import { closeSync, constants, lstatSync, opendirSync, openSync, readSync } from "node:fs";
-import { join, relative, sep } from "node:path";
-import { setImmediate as yieldTurn } from "node:timers/promises";
-import { JournalFrames } from "../shared/journal-reader.js";
-import { loadNativeSession } from "../shared/native-session-loader.js";
-import { Fault, cancelled } from "./bridge-protocol.js";
-import { resolveIntercomPresenceName } from "./identity.js";
-import { within } from "./bridge-launch-policy.js";
-/** Reject links at every journal path component; ordinary owned 0644 journals are valid. */
-export function trustedJournal(policy, file) {
-    const root = [policy.sessionDir, ...policy.resumeDirs].find((dir) => within(dir, file));
-    if (root === undefined) {
-        throw new Fault(403, "journal_forbidden", "Session journal is outside trusted resumeDirs.");
-    }
-    let path = root;
-    for (const part of ["", ...relative(root, file).split(sep).filter(Boolean)]) {
-        path = join(path, part);
-        const stat = lstatSync(path);
-        if (stat.isSymbolicLink() ||
-            stat.uid !== process.getuid?.() ||
-            (!stat.isDirectory() && path !== file)) {
-            throw new Fault(403, "journal_forbidden", "Session journal must have an owned, link-free path.");
-        }
-    }
-    if (!lstatSync(file).isFile()) {
-        throw new Fault(403, "journal_forbidden", "Session journal must be an owned regular file.");
-    }
-}
-// Reads and projection input are consumed synchronously; prefix/UTF-8 carry never retains this view.
-const METADATA_BYTES = Buffer.allocUnsafe(1024 * 1024);
-const METADATA_FIELDS = new Set(["type", "id", "version", "timestamp", "cwd", "name", "parentId"]);
-// ponytail: fast-skip native type-first envelopes only; other key ordering
-// uses the bounded parser. Extend the fast path if native serialization changes.
-const BODY_ENTRY = /^\{"type":"(?:message|model_change|thinking_level_change|compaction|branch_summary|custom|custom_message|label|usage|context_edit)",/;
-class MetadataFrames {
-    prefix = Buffer.alloc(0);
-    skip;
-    frames;
-    nativeHeader;
-    constructor(frames, nativeHeader) {
-        this.frames = frames;
-        this.nativeHeader = nativeHeader;
-    }
-    part(bytes, complete) {
-        let remainder = bytes;
-        if (this.skip === undefined) {
-            const count = Math.min(64 - this.prefix.length, bytes.length);
-            this.prefix = Buffer.concat([this.prefix, bytes.subarray(0, count)]);
-            remainder = bytes.subarray(count);
-            if (this.prefix.length < 64 && !complete) {
-                return;
-            }
-            this.skip = this.nativeHeader() && BODY_ENTRY.test(this.prefix.toString("ascii"));
-            if (!this.skip) {
-                this.frames.write(this.prefix);
-            }
-            this.prefix = Buffer.alloc(0);
-        }
-        if (!this.skip) {
-            this.frames.write(remainder);
-        }
-    }
-    write(bytes) {
-        for (let from = 0; from < bytes.length;) {
-            const newline = bytes.indexOf(10, from);
-            const end = newline < 0 ? bytes.length : newline + 1;
-            this.part(bytes.subarray(from, end), newline >= 0);
-            if (newline >= 0) {
-                this.skip = undefined;
-            }
-            from = end;
-        }
-    }
-    finish() {
-        if (this.prefix.length > 0) {
-            this.part(Buffer.alloc(0), true);
-        }
-        this.frames.finish();
-    }
-}
-async function readMetadata(file, sdk, signal, mode) {
-    const headerOnly = mode === "header";
-    const fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        const metadata = [];
-        let first = true;
-        const frames = new JournalFrames((path) => path.length === 0 || (path.length === 1 && METADATA_FIELDS.has(String(path[0]))), ({ value }) => {
-            if (first &&
-                (value.type !== "session" ||
-                    typeof value.id !== "string" ||
-                    typeof value.cwd !== "string")) {
-                throw new Error("Not a native session journal");
-            }
-            first = false;
-            if (value.type === "session" && metadata.length === 0) {
-                metadata.push(value);
-            }
-            else if (value.type === "session_info") {
-                metadata[1] = value;
-            }
-        }, { policy: "inspect", requireNewline: mode !== "resume" });
-        const bytes = headerOnly ? METADATA_BYTES.subarray(0, 64 * 1024) : METADATA_BYTES;
-        const reader = new MetadataFrames(frames, () => !first);
-        for (;;) {
-            cancelled(signal);
-            // One shared file position/buffer: reads must be serial, and yield to cancellation.
-            // oxlint-disable-next-line no-await-in-loop
-            await yieldTurn(undefined, { signal });
-            const bytesRead = readSync(fd, bytes, 0, bytes.length, null);
-            if (bytesRead === 0) {
-                break;
-            }
-            reader.write(bytes.subarray(0, bytesRead));
-            if (headerOnly && metadata.length > 0) {
-                break;
-            }
-        }
-        reader.finish();
-        const header = metadata.at(0);
-        if (header?.type !== "session" ||
-            typeof header.id !== "string" ||
-            typeof header.cwd !== "string") {
-            throw new Error("Not a native session journal");
-        }
-        // Native naming and ID semantics, without opening/migrating a live journal or hydrating bodies.
-        const entries = sdk.parseSessionEntries(metadata.map((entry) => JSON.stringify(entry)).join("\n"));
-        const manager = sdk.SessionManager.inMemory(header.cwd, undefined, entries);
-        return {
-            sessionId: manager.getSessionId(),
-            peerId: nativePeerId(manager.getSessionId()),
-            name: manager.getSessionName(),
-            cwd: manager.getCwd(),
-            sessionFile: file,
-        };
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-/** Native open repairs EOF framing; inspect its identity before allowing that write. */
-export function inspectResumeIdentity(file, sdk, signal) {
-    return readMetadata(file, sdk, signal, "resume");
-}
-export function savedView(row, peer) {
-    return {
-        id: row.sessionId,
-        sessionId: row.sessionId,
-        peerId: peer?.id,
-        name: row.name,
-        cwd: row.cwd,
-        status: peer?.status ?? "saved",
-        lastSeen: peer?.lastSeen ?? row.lastSeen,
-        saved: true,
-        owned: false,
-    };
-}
-export function exactPeer(row, peers) {
-    const expectedName = resolveIntercomPresenceName(row.name, row.sessionId);
-    const peer = peers.find((candidate) => candidate.id === row.peerId);
-    if (peer && (peer.cwd !== row.cwd || peer.name !== expectedName)) {
-        throw new Fault(409, "active_session", "Native session has a live peer with changed identity; do not reopen its journal.");
-    }
-    if (!peer &&
-        peers.some((candidate) => !candidate.id.startsWith("pi-") &&
-            candidate.name === expectedName &&
-            candidate.cwd === row.cwd)) {
-        throw new Fault(409, "active_session", "A matching live peer has unproven native identity; refusing to reopen its possible journal.");
-    }
-    return peer;
-}
-function liveView(peer, state) {
-    return {
-        id: peer.id,
-        peerId: peer.id,
-        name: peer.name,
-        cwd: peer.cwd,
-        status: state ?? peer.status,
-        lastSeen: peer.lastSeen,
-        saved: false,
-        owned: state !== undefined,
-    };
-}
-export async function browseSessions(catalog, query, context) {
-    const peers = query.live ? await context.peers(context.signal) : [];
-    const { policy } = context;
-    if (query.saved && !policy) {
-        throw new Fault(403, "launch_disabled", "Saved sessions require local launch/resume policy.");
-    }
-    const page = policy && query.saved
-        ? await catalog.page(policy, query, context.signal)
-        : { sessions: [], nextOffset: undefined };
-    const rows = page.sessions.map((row) => {
-        const state = context.activeState(row.sessionId);
-        const peer = exactPeer(row, peers);
-        return {
-            ...savedView(row, peer),
-            status: state ?? peer?.status ?? "saved",
-            owned: state !== undefined,
-        };
-    });
-    const included = new Set(page.sessions.map((row) => row.peerId));
-    const live = peers.filter((peer) => !included.has(peer.id) &&
-        (query.q === undefined ||
-            `${peer.id} ${peer.name ?? ""} ${peer.cwd}`.toLowerCase().includes(query.q.toLowerCase())));
-    if (!query.saved) {
-        const end = query.offset + query.limit;
-        return {
-            sessions: live
-                .slice(query.offset, end)
-                .map((peer) => liveView(peer, context.activeState(peer.id))),
-            nextOffset: end < live.length ? end : undefined,
-        };
-    }
-    return {
-        sessions: [
-            ...rows,
-            ...live
-                .slice(0, query.limit - rows.length)
-                .map((peer) => liveView(peer, context.activeState(peer.id))),
-        ],
-        liveTruncated: rows.length + live.length > query.limit ? true : undefined,
-        nextOffset: page.nextOffset,
-    };
-}
-function uniqueSavedSession(matches) {
-    if (matches.length > 1) {
-        throw new Fault(409, "ambiguous_session", "Multiple saved sessions match; choose an exact unique native ID.");
-    }
-    const session = matches.at(0);
-    if (!session) {
-        throw new Fault(404, "unknown_session", "No saved native session matches within trusted resumeDirs.");
-    }
-    return session;
-}
-export class SessionCatalog {
-    cache = new Map();
-    headers = new Map();
-    async *walk(dir, signal) {
-        await yieldTurn(undefined, { signal });
-        const stat = lstatSync(dir);
-        if (!stat.isDirectory() || stat.uid !== process.getuid?.()) {
-            return;
-        }
-        const directory = opendirSync(dir);
-        let visited = 0;
-        try {
-            for (let row = directory.readSync(); row !== null; row = directory.readSync()) {
-                // Yield during offset skips and empty-directory traversal too.
-                if (visited++ % 32 === 0) {
-                    // Directory entries must be processed without retaining a corpus-sized array.
-                    // oxlint-disable-next-line no-await-in-loop
-                    await yieldTurn(undefined, { signal });
-                }
-                cancelled(signal);
-                const file = join(dir, row.name);
-                if (row.isDirectory()) {
-                    yield* this.walk(file, signal);
-                }
-                else if (row.isFile() && row.name.endsWith(".jsonl")) {
-                    yield file;
-                }
-            }
-        }
-        finally {
-            directory.closeSync();
-        }
-    }
-    async *files(policy, signal) {
-        const unique = [...new Set([policy.sessionDir, ...policy.resumeDirs])];
-        const roots = unique.filter((root) => !unique.some((other) => other !== root && within(other, root)));
-        for (const root of roots) {
-            yield* this.walk(root, signal);
-        }
-    }
-    async read(policy, file, signal, headerOnly = false) {
-        cancelled(signal);
-        try {
-            trustedJournal(policy, file);
-            const stat = lstatSync(file);
-            const stamp = `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
-            const cache = headerOnly ? this.headers : this.cache;
-            const cached = this.cache.get(file) ?? cache.get(file);
-            if (cached?.stamp === stamp) {
-                return cached.session;
-            }
-            const sdk = await loadNativeSession(policy.packageRoot);
-            cancelled(signal);
-            const session = {
-                ...(await readMetadata(file, sdk, signal, headerOnly ? "header" : "published")),
-                lastSeen: stat.mtimeMs,
-            };
-            if (cache.size >= 100000) {
-                cache.clear();
-            }
-            cache.set(file, { stamp, session });
-            return session;
-        }
-        catch (error) {
-            cancelled(signal);
-            if (error instanceof Fault) {
-                throw error;
-            }
-            return undefined;
-        }
-    }
-    async resolve(policy, selector, signal) {
-        if (selector.target !== undefined) {
-            return this.resolveTarget(policy, selector.target, signal);
-        }
-        const matches = [];
-        for await (const file of this.files(policy, signal)) {
-            // Inspect native metadata, not a filename/prefix guess. Yield so request cancellation can run.
-            await yieldTurn(undefined, { signal });
-            const row = await this.read(policy, file, signal, selector.sessionId !== undefined);
-            if (row &&
-                (selector.sessionId === undefined
-                    ? row.name === selector.name
-                    : row.sessionId === selector.sessionId || row.peerId === selector.sessionId)) {
-                matches.push(row);
-            }
-            if (matches.length > 1) {
-                throw new Fault(409, "ambiguous_session", "Multiple saved sessions match; choose an exact unique native ID.");
-            }
-        }
-        const session = uniqueSavedSession(matches);
-        return (await this.read(policy, session.sessionFile, signal)) ?? session;
-    }
-    async resolveTarget(policy, target, signal) {
-        const ids = [];
-        const names = [];
-        for await (const file of this.files(policy, signal)) {
-            // Once an exact native ID is proven, only headers can affect its uniqueness.
-            const row = await this.read(policy, file, signal, ids.length > 0);
-            if (!row) {
-                continue;
-            }
-            if ((row.sessionId === target || row.peerId === target) && ids.length < 2) {
-                ids.push(row);
-            }
-            if (row.name === target && names.length < 2) {
-                names.push(row);
-            }
-        }
-        // Preserve exact-ID priority without paying for two complete archive scans.
-        const session = uniqueSavedSession(ids.length > 0 ? ids : names);
-        return (await this.read(policy, session.sessionFile, signal)) ?? session;
-    }
-    async page(policy, query, signal) {
-        const sessions = [];
-        let offset = 0;
-        let scanned = 0;
-        for await (const file of this.files(policy, signal)) {
-            if (offset++ < query.offset) {
-                continue;
-            }
-            if (scanned++ >= 1000 || sessions.length >= query.limit) {
-                return { sessions, nextOffset: offset - 1 };
-            }
-            // Each bounded metadata read yields to cancellation; no whole-corpus pathname array.
-            const row = await this.read(policy, file, signal);
-            if (row &&
-                (query.q === undefined ||
-                    `${row.sessionId} ${row.name ?? ""} ${row.cwd}`
-                        .toLowerCase()
-                        .includes(query.q.toLowerCase()))) {
-                sessions.push(row);
-            }
-        }
-        return { sessions };
-    }
-}

package/dist/pi-intercom/bridge-control.js

@@ -1,104 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { Fault, wait } from "./bridge-protocol.js";
-import { CONTROL_FALLBACK, CONTROL_SCHEMA, isControlResult, } from "./native-control-protocol.js";
-/** One bounded request owner; exact socket-derived peer, replyTo, version and verb correlation. */
-export class ControlReplies {
-    pending = new Map();
-    open(peer, verb, timeoutMs) {
-        if (this.pending.size >= 8) {
-            throw new Fault(429, "too_many_controls", "At most eight native controls may be in flight.");
-        }
-        const id = randomUUID();
-        const { promise: reply, resolve, reject } = Promise.withResolvers();
-        // A disconnect may reject while send is awaiting its broker receipt.
-        void reply.catch(() => {
-            /* Request owner observes rejection after its send receipt. */
-        });
-        const timer = setTimeout(() => reject(new Fault(504, "control_unconfirmed", "No correlated native response. Owner may be old/unavailable; execution is unknown. Do not automatically retry.", { id, deliveryUnknown: true })), timeoutMs);
-        const pending = { peer, verb, reply, resolve, reject, timer, disconnected: false };
-        this.pending.set(id, pending);
-        return {
-            id,
-            reply,
-            clear: () => this.clear(id),
-            get observedDisconnected() {
-                return pending.disconnected;
-            },
-        };
-    }
-    async request(client, operation, context) {
-        context.onPeer(operation.peer);
-        const waiting = this.open(operation.peer, operation.verb, operation.timeoutMs);
-        try {
-            context.guard();
-            const receipt = await wait(client.send(operation.peer, {
-                text: CONTROL_FALLBACK,
-                messageId: waiting.id,
-                delivery: "passive",
-                control: {
-                    schema: CONTROL_SCHEMA,
-                    kind: "request",
-                    verb: operation.verb,
-                    certificate: operation.certificate,
-                    options: operation.options,
-                },
-            }), context.signal).catch((error) => {
-                context.guard();
-                if (error instanceof Fault) {
-                    throw error;
-                }
-                throw new Fault(504, "control_unconfirmed", "Broker receipt was not received; native execution is unknown. Do not automatically retry.", { id: waiting.id, deliveryUnknown: true });
-            });
-            context.guard();
-            if (!receipt.accepted) {
-                throw new Fault(409, "delivery_failed", receipt.reason ?? "Broker rejected native control.", { id: receipt.id });
-            }
-            const result = await wait(waiting.reply, context.signal);
-            context.guard();
-            return {
-                ...receipt,
-                peer: operation.peer,
-                status: result.status,
-                native: result,
-                observedDisconnected: waiting.observedDisconnected,
-                processExited: false,
-            };
-        }
-        finally {
-            waiting.clear();
-        }
-    }
-    receive(peer, message) {
-        if (!Object.hasOwn(message, "control")) {
-            return false;
-        }
-        const pending = message.replyTo === undefined ? undefined : this.pending.get(message.replyTo);
-        if (pending &&
-            pending.peer === peer &&
-            message.delivery === "passive" &&
-            isControlResult(message.control) &&
-            message.control.verb === pending.verb) {
-            pending.resolve(message.control);
-        }
-        // Unsolicited/spoofed/malformed control results do not enter the remote mailbox.
-        return true;
-    }
-    peerLeft(peer) {
-        for (const [id, pending] of this.pending) {
-            if (pending.peer === peer) {
-                pending.disconnected = true;
-                pending.reject(new Fault(409, "peer_disconnected", "Native peer disconnected; this does not establish process exit.", { id, observedDisconnected: true, processExited: false, deliveryUnknown: true }));
-            }
-        }
-    }
-    close(error) {
-        for (const [id, pending] of this.pending) {
-            pending.reject(error);
-            this.clear(id);
-        }
-    }
-    clear(id) {
-        clearTimeout(this.pending.get(id)?.timer);
-        this.pending.delete(id);
-    }
-}

package/dist/pi-intercom/bridge-groups.js

@@ -1,135 +0,0 @@
-import { lstatSync, mkdirSync } from "node:fs";
-import { join, matchesGlob } from "node:path";
-import { readBridgeFile, writeBridgeJson } from "./bridge-files.js";
-import { isUnknownArray, hasErrorCode } from "../shared/unknown.js";
-import { Fault, label, object } from "./bridge-protocol.js";
-import { resolveSessionTarget, nativePeerId } from "./session-targets.js";
-const GROUP_LIMIT = 64;
-function normalizedGroup(value) {
-    const input = object(value, ["name", "members", "namePattern", "cwdPattern", "match"]);
-    if (input.match === undefined) {
-        return input;
-    }
-    if ([input.members, input.namePattern, input.cwdPattern].some((field) => field !== undefined)) {
-        throw new Fault(400, "invalid_input", "Use match or canonical selectors, not both.");
-    }
-    const match = typeof input.match === "string"
-        ? { nameglob: input.match }
-        : object(input.match, ["id", "nameglob", "cwd"]);
-    return {
-        name: input.name,
-        members: typeof match.id === "string" ? [match.id] : match.id,
-        namePattern: match.nameglob,
-        cwdPattern: match.cwd,
-    };
-}
-export function groupDefinition(value) {
-    const input = normalizedGroup(value);
-    const name = label(input.name, "group name", 64).trim();
-    if (input.members !== undefined &&
-        (!isUnknownArray(input.members) || input.members.length > 256)) {
-        throw new Fault(400, "invalid_input", "members must contain at most 256 peer IDs/names.");
-    }
-    const members = isUnknownArray(input.members)
-        ? [...new Set(input.members.map((member) => label(member, "member", 512).trim()))]
-        : undefined;
-    const namePattern = input.namePattern === undefined ? undefined : label(input.namePattern, "name pattern", 128);
-    const cwdPattern = input.cwdPattern === undefined ? undefined : label(input.cwdPattern, "cwd pattern", 512);
-    if (members === undefined && namePattern === undefined && cwdPattern === undefined) {
-        throw new Fault(400, "invalid_input", "Define explicit members or at least one glob pattern.");
-    }
-    return { name, members, namePattern, cwdPattern };
-}
-function privateDirectory(path) {
-    mkdirSync(path, { recursive: true, mode: 0o700 });
-    const stat = lstatSync(path);
-    if (!stat.isDirectory() ||
-        stat.isSymbolicLink() ||
-        stat.uid !== process.getuid?.() ||
-        (stat.mode & 0o777) !== 0o700) {
-        throw new Fault(503, "state_unavailable", "Group stateDir must be owned by the current user with mode 0700.");
-    }
-}
-export function nativePeers(peers, source) {
-    return peers.filter((peer) => /^pi-[a-f0-9]{32}$/.test(peer.id) && peer.id !== source);
-}
-export class Groups {
-    stateDir;
-    constructor(stateDir) {
-        this.stateDir = stateDir;
-        privateDirectory(stateDir);
-    }
-    file(fingerprint) {
-        if (!/^[a-fA-F0-9]{64}$/.test(fingerprint)) {
-            throw new Fault(403, "unauthorized", "Invalid identity.");
-        }
-        return join(this.stateDir, `groups-${fingerprint.toLowerCase()}.json`);
-    }
-    list(fingerprint) {
-        let raw;
-        try {
-            raw = JSON.parse(readBridgeFile(this.file(fingerprint), true, 1024 * 1024).toString("utf8"));
-        }
-        catch (error) {
-            if (hasErrorCode(error, "ENOENT")) {
-                return [];
-            }
-            throw error;
-        }
-        if (!isUnknownArray(raw) || raw.length > GROUP_LIMIT) {
-            throw new Fault(503, "state_unavailable", "Invalid group state.");
-        }
-        return raw.map(groupDefinition);
-    }
-    upsert(fingerprint, group) {
-        privateDirectory(this.stateDir);
-        const groups = this.list(fingerprint).filter((entry) => entry.name !== group.name);
-        if (groups.length >= GROUP_LIMIT) {
-            throw new Fault(409, "group_limit", "At most 64 groups are allowed per identity.");
-        }
-        groups.push(groupDefinition(group));
-        const file = this.file(fingerprint);
-        const serialized = JSON.stringify(groups);
-        if (Buffer.byteLength(serialized) > 1024 * 1024) {
-            throw new Fault(413, "state_too_large", "Group definitions exceed the 1 MiB identity budget.");
-        }
-        writeBridgeJson(file, groups);
-        return groups;
-    }
-    targets(fingerprint, name, peers) {
-        if (name === undefined) {
-            return { peers: nativePeers(peers), errors: [] };
-        }
-        const group = this.list(fingerprint).find((entry) => entry.name === name);
-        if (!group) {
-            throw new Fault(404, "unknown_group", "Define this group before sending to it.");
-        }
-        return selectTargets(group, nativePeers(peers));
-    }
-}
-function selectTargets(group, peers) {
-    const selected = new Map();
-    const errors = [];
-    for (const member of group.members ?? []) {
-        const result = resolveSessionTarget(peers, member);
-        const target = result.target ?? peers.find((peer) => peer.id === nativePeerId(member));
-        if (target) {
-            selected.set(target.id, target);
-        }
-        else {
-            errors.push({ member, code: result.status === "none" ? "peer_offline" : "ambiguous_target" });
-        }
-    }
-    if (group.namePattern !== undefined || group.cwdPattern !== undefined) {
-        for (const peer of peers) {
-            if (matchesSelectors(group, peer)) {
-                selected.set(peer.id, peer);
-            }
-        }
-    }
-    return { peers: [...selected.values()], errors };
-}
-function matchesSelectors(group, peer) {
-    return ((group.namePattern === undefined || matchesGlob(peer.name ?? "", group.namePattern)) &&
-        (group.cwdPattern === undefined || matchesGlob(peer.cwd, group.cwdPattern)));
-}