@fitlab-ai/agent-infra 0.12.1 → 0.12.2

package/dist/lib/agent-clients/adapters/codex-lifecycle/binding.js

@@ -1,114 +0,0 @@
-import { managedDelegationRole } from '../../../task/delegation-receipts.js';
-const MARKER_PREFIX = '__agent_infra_binding_';
-const BASE32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
-const TASK_ID_PATTERN = /^TASK-[0-9]{8}-[0-9]{6}$/u;
-const SAFE_LABEL_PATTERN = /^[a-z0-9_]{1,80}$/u;
-const SAFE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/u;
-function assertSafeTaskName(taskName) {
-    if (Buffer.byteLength(taskName, 'utf8') > 255 || !/^[a-z0-9_]+$/u.test(taskName)) {
-        throw new Error('Codex task_name must use lowercase letters, digits, and underscores within 255 bytes');
-    }
-}
-function encodeTaskNamePayload(value) {
-    let buffer = 0;
-    let bits = 0;
-    let encoded = '';
-    for (const byte of Buffer.from(value, 'utf8')) {
-        buffer = (buffer << 8) | byte;
-        bits += 8;
-        while (bits >= 5) {
-            encoded += BASE32_ALPHABET[(buffer >>> (bits - 5)) & 31];
-            bits -= 5;
-        }
-    }
-    if (bits)
-        encoded += BASE32_ALPHABET[(buffer << (5 - bits)) & 31];
-    return encoded;
-}
-function decodeTaskNamePayload(encoded) {
-    let buffer = 0;
-    let bits = 0;
-    const bytes = [];
-    for (const character of encoded) {
-        const value = BASE32_ALPHABET.indexOf(character);
-        if (value < 0)
-            return null;
-        buffer = (buffer << 5) | value;
-        bits += 5;
-        if (bits >= 8) {
-            bytes.push((buffer >>> (bits - 8)) & 255);
-            bits -= 8;
-        }
-    }
-    if (bits && (buffer & ((1 << bits) - 1)) !== 0)
-        return null;
-    const decoded = Buffer.from(bytes).toString('utf8');
-    return encodeTaskNamePayload(decoded) === encoded ? decoded : null;
-}
-function encodeCodexLifecycleBinding(binding) {
-    if (!TASK_ID_PATTERN.test(binding.taskId)
-        || !SAFE_ID_PATTERN.test(binding.runId)
-        || !SAFE_ID_PATTERN.test(binding.receiptId)) {
-        throw new Error('Codex lifecycle task binding is invalid');
-    }
-    return `${MARKER_PREFIX}${encodeTaskNamePayload(JSON.stringify(binding))}`;
-}
-function appendCodexLifecycleBinding(label, binding) {
-    if (!SAFE_LABEL_PATTERN.test(label))
-        throw new Error('Codex task_name label is invalid');
-    const taskName = `${label}${encodeCodexLifecycleBinding(binding)}`;
-    assertSafeTaskName(taskName);
-    return taskName;
-}
-function parseCodexLifecycleBinding(taskName) {
-    assertSafeTaskName(taskName);
-    const markerIndex = taskName.lastIndexOf(MARKER_PREFIX);
-    if (markerIndex < 1)
-        return null;
-    const label = taskName.slice(0, markerIndex);
-    const encoded = taskName.slice(markerIndex + MARKER_PREFIX.length);
-    if (!SAFE_LABEL_PATTERN.test(label) || !/^[a-z2-7]+$/u.test(encoded))
-        return null;
-    try {
-        const decoded = decodeTaskNamePayload(encoded);
-        if (!decoded)
-            return null;
-        const value = JSON.parse(decoded);
-        if (Object.keys(value).sort().join(',') !== 'receiptId,runId,taskId'
-            || typeof value.taskId !== 'string' || !TASK_ID_PATTERN.test(value.taskId)
-            || typeof value.runId !== 'string' || !SAFE_ID_PATTERN.test(value.runId)
-            || typeof value.receiptId !== 'string' || !SAFE_ID_PATTERN.test(value.receiptId))
-            return null;
-        return Object.freeze({
-            taskName,
-            label,
-            binding: Object.freeze({ taskId: value.taskId, runId: value.runId, receiptId: value.receiptId })
-        });
-    }
-    catch {
-        return null;
-    }
-}
-function verifyCodexLifecycleTaskBinding(binding, run, nativeAgent, expected = {}) {
-    if (!codexReceiptMatchesBinding(binding, run, nativeAgent, expected)) {
-        throw new Error('Codex lifecycle task binding does not match the current pending receipt');
-    }
-}
-function codexReceiptMatchesBinding(binding, run, nativeAgent, expected) {
-    const receipt = run.pendingDelegation;
-    return Boolean(receipt)
-        && run.status === 'running'
-        && run.runId === binding.runId
-        && receipt.runId === binding.runId
-        && receipt.id === binding.receiptId
-        && receipt.client === 'codex'
-        && receipt.status === 'prepared'
-        && managedDelegationRole(nativeAgent) === receipt.role
-        && requestedBindingMatches(receipt, expected);
-}
-function requestedBindingMatches(receipt, expected) {
-    return (!expected.requestedModel || receipt.requestedModel === expected.requestedModel)
-        && (!expected.requestedReasoningEffort || receipt.requestedReasoningEffort === expected.requestedReasoningEffort);
-}
-export { appendCodexLifecycleBinding, encodeCodexLifecycleBinding, parseCodexLifecycleBinding, verifyCodexLifecycleTaskBinding };
-//# sourceMappingURL=binding.js.map

package/dist/lib/agent-clients/adapters/codex-lifecycle/build-identity.js

@@ -1,237 +0,0 @@
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import semver from 'semver';
-const LIFECYCLE_PROTOCOL_VERSION = 3;
-function exactText(value) {
-    return typeof value === 'string' && value.trim() === value && value.length > 0;
-}
-function isCanonicalLifecyclePackageVersion(value) {
-    return typeof value === 'string' && semver.valid(value) === value;
-}
-function isLifecycleProtocolVersion(value) {
-    return value === LIFECYCLE_PROTOCOL_VERSION;
-}
-function normalizeRelativePath(value) {
-    return value.replaceAll('\\', '/');
-}
-function isSafeLifecyclePath(value) {
-    return exactText(value)
-        && value === normalizeRelativePath(value)
-        && !path.isAbsolute(value)
-        && !/^[A-Za-z]:[\\/]/u.test(value)
-        && !value.split('/').includes('..');
-}
-function isLifecycleLauncherLine(value) {
-    return typeof value === 'string'
-        && value.length > 1
-        && value.slice(0, -1).trim() === value.slice(0, -1)
-        && value.startsWith('#!')
-        && value.endsWith('\n')
-        && value.indexOf('\n') === value.length - 1
-        && !value.includes('\r');
-}
-function readLifecycleLauncherShebang(value, executableFiles) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)) {
-        throw new Error('Lifecycle manifest launcher shebang policy is invalid');
-    }
-    const policy = value;
-    if (!isSafeLifecyclePath(policy.sourceFile)
-        || !isSafeLifecyclePath(policy.compiledFile)
-        || !isLifecycleLauncherLine(policy.canonicalLine)
-        || !Array.isArray(policy.acceptedLines)
-        || !policy.acceptedLines.every(isLifecycleLauncherLine)
-        || new Set(policy.acceptedLines).size !== policy.acceptedLines.length
-        || !policy.acceptedLines.includes(policy.canonicalLine)
-        || !executableFiles.includes(policy.sourceFile)
-        || policy.compiledFile !== normalizeRelativePath(path.join('dist', policy.sourceFile.endsWith('.ts')
-            ? policy.sourceFile.replace(/\.ts$/u, '.js')
-            : policy.sourceFile))) {
-        throw new Error('Lifecycle manifest launcher shebang policy is invalid');
-    }
-    return Object.freeze({
-        sourceFile: policy.sourceFile,
-        compiledFile: policy.compiledFile,
-        canonicalLine: policy.canonicalLine,
-        acceptedLines: Object.freeze([...policy.acceptedLines])
-    });
-}
-function readLifecycleManifestFiles(packageRoot) {
-    const file = path.join(packageRoot, 'lib', 'agent-clients', 'adapters', 'codex-lifecycle', 'manifest-files.json');
-    const value = JSON.parse(fs.readFileSync(file, 'utf8'));
-    if (!Array.isArray(value.executableFiles)
-        || !Array.isArray(value.contractFiles)
-        || !value.executableFiles.every(isSafeLifecyclePath)
-        || !value.contractFiles.every(isSafeLifecyclePath)
-        || new Set(value.executableFiles).size !== value.executableFiles.length
-        || new Set(value.contractFiles).size !== value.contractFiles.length) {
-        throw new Error('Lifecycle manifest file list is invalid');
-    }
-    const executableFiles = Object.freeze([...value.executableFiles]);
-    return Object.freeze({
-        executableFiles,
-        contractFiles: Object.freeze([...value.contractFiles]),
-        launcherShebang: readLifecycleLauncherShebang(value.launcherShebang, executableFiles)
-    });
-}
-function executablePackageRoot() {
-    let current = path.dirname(fileURLToPath(import.meta.url));
-    while (true) {
-        const candidate = path.join(current, 'package.json');
-        if (fs.existsSync(candidate)) {
-            const value = JSON.parse(fs.readFileSync(candidate, 'utf8'));
-            if (value.name === '@fitlab-ai/agent-infra')
-                return current;
-        }
-        const parent = path.dirname(current);
-        if (parent === current)
-            throw new Error('Lifecycle executable package root is unavailable');
-        current = parent;
-    }
-}
-function normalizeLifecycleLauncherBytes(relative, content, policy) {
-    const normalized = normalizeRelativePath(relative);
-    if (normalized !== policy.sourceFile && normalized !== policy.compiledFile)
-        return content;
-    const lineEnd = content.indexOf(0x0a);
-    if (lineEnd < 0)
-        return content;
-    const firstLine = content.subarray(0, lineEnd + 1);
-    if (!policy.acceptedLines.some((line) => Buffer.from(line).equals(firstLine)))
-        return content;
-    return Buffer.concat([
-        Buffer.from(policy.canonicalLine),
-        content.subarray(lineEnd + 1)
-    ]);
-}
-function hashFiles(root, files, launcherShebang) {
-    const hash = crypto.createHash('sha256');
-    for (const relative of [...new Set(files.map(normalizeRelativePath))].sort()) {
-        if (path.isAbsolute(relative) || relative.split(/[\\/]/u).includes('..')) {
-            throw new Error(`Lifecycle manifest path '${relative}' is unsafe`);
-        }
-        const file = path.join(root, relative);
-        const stat = fs.lstatSync(file);
-        if (!stat.isFile() || stat.isSymbolicLink()) {
-            throw new Error(`Lifecycle manifest entry '${relative}' must be a regular file`);
-        }
-        hash.update(relative);
-        hash.update('\0');
-        const content = fs.readFileSync(file);
-        hash.update(launcherShebang
-            ? normalizeLifecycleLauncherBytes(relative, content, launcherShebang)
-            : content);
-        hash.update('\0');
-    }
-    return hash.digest('hex');
-}
-function resolveLifecycleExecutableFiles(root, entries) {
-    const pending = [...entries];
-    const resolved = new Set();
-    while (pending.length > 0) {
-        const relative = normalizeRelativePath(pending.pop());
-        if (resolved.has(relative))
-            continue;
-        resolved.add(relative);
-        if (!/\.[cm]?[jt]s$/u.test(relative))
-            continue;
-        const file = path.join(root, relative);
-        const source = fs.readFileSync(file, 'utf8');
-        const imports = source.matchAll(/(?:\bfrom\s*|\bimport\s*(?:\(\s*)?)["'](\.[^"']+)["']/gu);
-        for (const match of imports) {
-            const requested = match[1];
-            const base = path.resolve(path.dirname(file), requested);
-            const candidates = [
-                base,
-                `${base}.ts`, `${base}.js`,
-                path.join(base, 'index.ts'), path.join(base, 'index.js')
-            ];
-            const dependency = candidates.find((candidate) => fs.existsSync(candidate) && fs.lstatSync(candidate).isFile());
-            if (!dependency)
-                throw new Error(`Lifecycle executable dependency '${requested}' from '${relative}' is unavailable`);
-            const dependencyRelative = path.relative(root, dependency);
-            if (dependencyRelative.startsWith('..') || path.isAbsolute(dependencyRelative)) {
-                throw new Error(`Lifecycle executable dependency '${requested}' escapes the package root`);
-            }
-            pending.push(normalizeRelativePath(dependencyRelative));
-        }
-    }
-    return [...resolved].sort();
-}
-function computeLifecycleBuildIdentity(repoRoot, options = {}) {
-    const packageRoot = executablePackageRoot();
-    const executableRoot = options.executableFiles ? repoRoot : packageRoot;
-    const defaults = readLifecycleManifestFiles(packageRoot);
-    const packageJson = JSON.parse(fs.readFileSync(path.join(executableRoot, 'package.json'), 'utf8'));
-    if (!exactText(packageJson.version))
-        throw new Error('Lifecycle package version is invalid');
-    let internalExecutableBuildHash;
-    if (options.executableFiles) {
-        internalExecutableBuildHash = hashFiles(repoRoot, options.executableFiles, defaults.launcherShebang);
-    }
-    else {
-        const manifestFile = path.join(executableRoot, 'dist', 'lifecycle-build-manifest.json');
-        if (fs.existsSync(manifestFile)) {
-            const manifest = JSON.parse(fs.readFileSync(manifestFile, 'utf8'));
-            if (manifest.protocolVersion !== LIFECYCLE_PROTOCOL_VERSION
-                || manifest.packageVersion !== packageJson.version
-                || !exactText(manifest.sourceInputHash)
-                || !exactText(manifest.internalExecutableBuildHash)) {
-                throw new Error('Lifecycle executable build manifest is stale or invalid');
-            }
-            if (fileURLToPath(import.meta.url).split(path.sep).includes('dist')) {
-                const compiledFiles = defaults.executableFiles.map((file) => file.endsWith('.ts') ? path.join('dist', file.replace(/\.ts$/u, '.js')) : file);
-                if (hashFiles(executableRoot, resolveLifecycleExecutableFiles(executableRoot, compiledFiles), defaults.launcherShebang) !== manifest.internalExecutableBuildHash) {
-                    throw new Error('Lifecycle compiled executable build does not match its manifest');
-                }
-            }
-            else if (hashFiles(executableRoot, resolveLifecycleExecutableFiles(executableRoot, defaults.executableFiles), defaults.launcherShebang) !== manifest.sourceInputHash) {
-                throw new Error('Lifecycle executable build manifest is stale or invalid');
-            }
-            internalExecutableBuildHash = manifest.internalExecutableBuildHash;
-        }
-        else
-            internalExecutableBuildHash = hashFiles(executableRoot, resolveLifecycleExecutableFiles(executableRoot, defaults.executableFiles), defaults.launcherShebang);
-    }
-    return Object.freeze({
-        protocolVersion: LIFECYCLE_PROTOCOL_VERSION,
-        packageVersion: packageJson.version,
-        internalExecutableBuildHash,
-        lifecycleContractHash: hashFiles(repoRoot, options.contractFiles ?? defaults.contractFiles)
-    });
-}
-function verifyLifecycleBuildIdentity(expected, actual) {
-    if (actual.protocolVersion !== expected.protocolVersion) {
-        return {
-            ok: false,
-            code: 'CODEX_LIFECYCLE_PROTOCOL_MISMATCH',
-            message: 'Codex lifecycle protocol version does not match',
-            warnings: []
-        };
-    }
-    const warnings = [];
-    if (actual.packageVersion !== expected.packageVersion
-        || actual.internalExecutableBuildHash !== expected.internalExecutableBuildHash) {
-        warnings.push({
-            code: 'CODEX_LIFECYCLE_BUILD_MISMATCH',
-            message: 'Codex lifecycle executable build identity differs; rebuild the sandbox if the runtime is stale',
-            action: 'rebuild-sandbox'
-        });
-    }
-    if (actual.lifecycleContractHash !== expected.lifecycleContractHash) {
-        warnings.push({
-            code: 'CODEX_LIFECYCLE_CONTRACT_MISMATCH',
-            message: 'Codex lifecycle contract identity differs; rebuild the sandbox if the runtime is stale',
-            action: 'rebuild-sandbox'
-        });
-    }
-    return {
-        ok: true,
-        code: null,
-        message: null,
-        warnings: Object.freeze(warnings)
-    };
-}
-export { LIFECYCLE_PROTOCOL_VERSION, computeLifecycleBuildIdentity, isCanonicalLifecyclePackageVersion, isLifecycleProtocolVersion, readLifecycleManifestFiles, resolveLifecycleExecutableFiles, verifyLifecycleBuildIdentity };
-//# sourceMappingURL=build-identity.js.map