@flyingrobots/graft 0.4.0 → 0.6.0

package/src/mcp/control-plane/types.ts

@@ -0,0 +1,144 @@
+import type { DaemonSchedulerCounts } from "../daemon-job-scheduler.js";
+import type { DaemonWorkerCounts } from "../daemon-worker-pool.js";
+import type { RuntimeCausalContext } from "../runtime-causal-context.js";
+import type {
+  WorkspaceBindRequest,
+  WorkspaceCapabilityProfile,
+  WorkspaceStatus,
+} from "../workspace-router.js";
+
+// ---------------------------------------------------------------------------
+// Internal: session tracking
+// ---------------------------------------------------------------------------
+
+export interface RegisteredTransport {
+  readonly sessionId: string;
+  readonly startedAt: string;
+  readonly getWorkspaceStatus: () => WorkspaceStatus;
+  readonly getRuntimeCausalContext: () => RuntimeCausalContext | null;
+  lastActivityAt: string;
+}
+
+// ---------------------------------------------------------------------------
+// Authorization types
+// ---------------------------------------------------------------------------
+
+export interface AuthorizedWorkspaceRecord {
+  readonly repoId: string;
+  readonly worktreeId: string;
+  readonly worktreeRoot: string;
+  readonly gitCommonDir: string;
+  readonly capabilityProfile: WorkspaceCapabilityProfile;
+  readonly authorizedAt: string;
+  readonly lastBoundAt: string | null;
+}
+
+export interface AuthorizedWorkspaceView extends AuthorizedWorkspaceRecord {
+  readonly activeSessions: number;
+}
+
+export interface WorkspaceAuthorizeRequest extends WorkspaceBindRequest {
+  readonly runCapture?: boolean | undefined;
+}
+
+export interface WorkspaceAuthorizeResult {
+  readonly ok: boolean;
+  readonly changed: boolean;
+  readonly authorization?: AuthorizedWorkspaceView;
+  readonly errorCode?: string;
+  readonly error?: string;
+}
+
+export interface WorkspaceRevokeResult {
+  readonly ok: boolean;
+  readonly revoked: boolean;
+  readonly repoId?: string | null;
+  readonly worktreeId?: string | null;
+  readonly worktreeRoot?: string | null;
+  readonly activeSessions?: number;
+  readonly errorCode?: string;
+  readonly error?: string;
+}
+
+// ---------------------------------------------------------------------------
+// Session view
+// ---------------------------------------------------------------------------
+
+export interface DaemonSessionView {
+  readonly sessionId: string;
+  readonly sessionMode: "daemon";
+  readonly bindState: WorkspaceStatus["bindState"];
+  readonly repoId: string | null;
+  readonly worktreeId: string | null;
+  readonly worktreeRoot: string | null;
+  readonly causalSessionId: string | null;
+  readonly checkoutEpochId: string | null;
+  readonly capabilityProfile: WorkspaceCapabilityProfile | null;
+  readonly startedAt: string;
+  readonly lastActivityAt: string;
+}
+
+// ---------------------------------------------------------------------------
+// Daemon runtime & status projection
+// ---------------------------------------------------------------------------
+
+export interface DaemonRuntimeDescriptor {
+  readonly transport: "unix_socket" | "named_pipe";
+  readonly sameUserOnly: true;
+  readonly socketPath: string;
+  readonly mcpPath: string;
+  readonly healthPath: string;
+  readonly activeWarpRepos: number;
+  readonly startedAt: string;
+}
+
+export interface SharedAttachSource {
+  readonly sourceSessionId: string;
+  readonly causalSessionId: string;
+  readonly strandId: string;
+}
+
+export interface DaemonMonitorCounts {
+  readonly totalMonitors: number;
+  readonly runningMonitors: number;
+  readonly pausedMonitors: number;
+  readonly stoppedMonitors: number;
+  readonly failingMonitors: number;
+  readonly backlogMonitors: number;
+}
+
+export interface DaemonStatusView extends DaemonRuntimeDescriptor {
+  readonly ok: true;
+  readonly sessionMode: "daemon";
+  readonly activeSessions: number;
+  readonly boundSessions: number;
+  readonly unboundSessions: number;
+  readonly authorizedWorkspaces: number;
+  readonly authorizedRepos: number;
+  readonly workspaceBindRequiresAuthorization: true;
+  readonly defaultCapabilityProfile: WorkspaceCapabilityProfile;
+  readonly totalMonitors: number;
+  readonly runningMonitors: number;
+  readonly pausedMonitors: number;
+  readonly stoppedMonitors: number;
+  readonly failingMonitors: number;
+  readonly backlogMonitors: number;
+  readonly scheduler: DaemonSchedulerCounts;
+  readonly workers: DaemonWorkerCounts;
+}
+
+// ---------------------------------------------------------------------------
+// Control plane constructor options
+// ---------------------------------------------------------------------------
+
+export interface DaemonControlPlaneOptions {
+  readonly fs: FileSystem;
+  readonly codec: JsonCodec;
+  readonly git: GitClient;
+  readonly graftDir: string;
+}
+
+// Re-import port types so consumers don't need to reach into ports/
+import type { FileSystem } from "../../ports/filesystem.js";
+import type { JsonCodec } from "../../ports/codec.js";
+import type { GitClient } from "../../ports/git.js";

package/src/mcp/daemon-bootstrap.ts

@@ -0,0 +1,100 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as http from "node:http";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+
+const DIRECTORY_MODE = 0o700;
+const SOCKET_MODE = 0o600;
+
+export function isNamedPipePath(socketPath: string): boolean {
+  return process.platform === "win32" && socketPath.startsWith("\\\\.\\pipe\\");
+}
+
+export function defaultDaemonRoot(): string {
+  return path.join(os.homedir(), ".graft", "daemon");
+}
+
+function defaultSocketPath(graftDir: string): string {
+  if (process.platform === "win32") {
+    const digest = crypto.createHash("sha256").update(os.homedir()).digest("hex").slice(0, 12);
+    return `\\\\.\\pipe\\graft-daemon-${digest}`;
+  }
+  return path.join(graftDir, "mcp.sock");
+}
+
+export function resolveSocketPath(socketPath: string | undefined, graftDir: string): string {
+  if (socketPath === undefined) return defaultSocketPath(graftDir);
+  if (isNamedPipePath(socketPath)) return socketPath;
+  return path.resolve(socketPath);
+}
+
+export async function ensurePrivateDirectory(dirPath: string): Promise<void> {
+  await fs.mkdir(dirPath, { recursive: true, mode: DIRECTORY_MODE });
+  if (process.platform !== "win32") {
+    await fs.chmod(dirPath, DIRECTORY_MODE).catch(() => {
+      return undefined;
+    });
+  }
+}
+
+async function socketHasActiveListener(socketPath: string): Promise<boolean> {
+  return new Promise<boolean>((resolve) => {
+    const socket = net.createConnection({ path: socketPath });
+    let settled = false;
+
+    const finish = (result: boolean): void => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(result);
+    };
+
+    socket.once("connect", () => {
+      finish(true);
+    });
+    socket.once("error", () => {
+      finish(false);
+    });
+    socket.setTimeout(200, () => {
+      finish(false);
+    });
+  });
+}
+
+export async function prepareSocketPath(socketPath: string): Promise<void> {
+  if (isNamedPipePath(socketPath)) return;
+  await ensurePrivateDirectory(path.dirname(socketPath));
+  const existing = await fs.lstat(socketPath).catch((error: unknown) => {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (existing === null) return;
+  if (!existing.isSocket()) {
+    throw new Error(`Refusing to overwrite non-socket path: ${socketPath}`);
+  }
+  if (await socketHasActiveListener(socketPath)) {
+    throw new Error(`A graft daemon is already listening on ${socketPath}`);
+  }
+  await fs.unlink(socketPath);
+}
+
+export async function tightenSocketPermissions(socketPath: string): Promise<void> {
+  if (process.platform === "win32" || isNamedPipePath(socketPath)) return;
+  await fs.chmod(socketPath, SOCKET_MODE).catch(() => {
+    return undefined;
+  });
+}
+
+export async function closeHttpServer(server: http.Server): Promise<void> {
+  await new Promise<void>((resolve, reject) => {
+    server.close((error) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve();
+    });
+  });
+}

package/src/mcp/daemon-control-plane.ts

@@ -0,0 +1,310 @@
+import type { DaemonSchedulerCounts } from "./daemon-job-scheduler.js";
+import { ZERO_SCHEDULER_COUNTS } from "./daemon-job-scheduler.js";
+import type { DaemonWorkerCounts } from "./daemon-worker-pool.js";
+import type { RuntimeCausalContext } from "./runtime-causal-context.js";
+import {
+  DEFAULT_DAEMON_CAPABILITY_PROFILE,
+  resolveWorkspaceRequest,
+  type ResolvedWorkspace,
+  type WorkspaceBindRequest,
+  type WorkspaceCapabilityProfile,
+  type WorkspaceStatus,
+} from "./workspace-router.js";
+
+import {
+  buildStatePath,
+  capabilityProfilesEqual,
+  cloneAuthorizedWorkspaceRecord,
+  cloneCapabilityProfile,
+  loadPersistedState,
+  persistState,
+  resolveCapabilityProfile,
+  sortByWorktreeRoot,
+} from "./control-plane/authz-storage.js";
+
+import {
+  readRuntimeCausalContext,
+  readWorkspaceStatus,
+  resolveSharedAttachSource,
+  toDaemonSessionView,
+} from "./control-plane/session-registry.js";
+
+import {
+  buildStatusView,
+  toAuthorizedWorkspaceView,
+  ZERO_MONITOR_COUNTS,
+} from "./control-plane/status-projection.js";
+
+// ---------------------------------------------------------------------------
+// Barrel re-exports — keep every public type available from this path
+// ---------------------------------------------------------------------------
+
+export type {
+  AuthorizedWorkspaceRecord,
+  AuthorizedWorkspaceView,
+  DaemonControlPlaneOptions,
+  DaemonMonitorCounts,
+  DaemonRuntimeDescriptor,
+  DaemonSessionView,
+  DaemonStatusView,
+  SharedAttachSource,
+  WorkspaceAuthorizeRequest,
+  WorkspaceAuthorizeResult,
+  WorkspaceRevokeResult,
+} from "./control-plane/types.js";
+
+import type {
+  AuthorizedWorkspaceRecord,
+  AuthorizedWorkspaceView,
+  DaemonControlPlaneOptions,
+  DaemonMonitorCounts,
+  DaemonRuntimeDescriptor,
+  DaemonSessionView,
+  DaemonStatusView,
+  RegisteredTransport,
+  SharedAttachSource,
+  WorkspaceAuthorizeRequest,
+  WorkspaceAuthorizeResult,
+  WorkspaceRevokeResult,
+} from "./control-plane/types.js";
+
+// ---------------------------------------------------------------------------
+// DaemonControlPlane
+// ---------------------------------------------------------------------------
+
+export class DaemonControlPlane {
+  private readonly statePath: string;
+  private readonly authorizedWorkspaces = new Map<string, AuthorizedWorkspaceRecord>();
+  private readonly transports = new Map<string, RegisteredTransport>();
+  private loadPromise: Promise<void> | null = null;
+
+  constructor(private readonly options: DaemonControlPlaneOptions) {
+    this.statePath = buildStatePath(options.graftDir);
+  }
+
+  initialize(): Promise<void> {
+    return this.ensureLoaded();
+  }
+
+  registerTransport(
+    sessionId: string,
+    getWorkspaceStatus: () => WorkspaceStatus,
+    getRuntimeCausalContext: () => RuntimeCausalContext | null,
+  ): void {
+    const now = new Date().toISOString();
+    this.transports.set(sessionId, {
+      sessionId,
+      startedAt: now,
+      lastActivityAt: now,
+      getWorkspaceStatus,
+      getRuntimeCausalContext,
+    });
+  }
+
+  touchTransport(sessionId: string): void {
+    const session = this.transports.get(sessionId);
+    if (session === undefined) return;
+    session.lastActivityAt = new Date().toISOString();
+  }
+
+  unregisterTransport(sessionId: string): void {
+    this.transports.delete(sessionId);
+  }
+
+  resolveSharedAttachSource(input: {
+    readonly sessionId: string;
+    readonly repoId: string;
+    readonly worktreeId: string;
+  }): SharedAttachSource | null {
+    return resolveSharedAttachSource(this.transports, input);
+  }
+
+  async authorizeWorkspace(request: WorkspaceAuthorizeRequest): Promise<WorkspaceAuthorizeResult> {
+    const resolved = await resolveWorkspaceRequest(this.options.git, request);
+    if ("code" in resolved) {
+      return {
+        ok: false,
+        changed: false,
+        errorCode: resolved.code,
+        error: resolved.message,
+      };
+    }
+
+    await this.ensureLoaded();
+    const current = this.authorizedWorkspaces.get(resolved.worktreeId);
+    const nextCapabilityProfile = resolveCapabilityProfile(
+      current?.capabilityProfile,
+      DEFAULT_DAEMON_CAPABILITY_PROFILE,
+      request.runCapture,
+    );
+    const next: AuthorizedWorkspaceRecord = {
+      ...resolved,
+      capabilityProfile: nextCapabilityProfile,
+      authorizedAt: current?.authorizedAt ?? new Date().toISOString(),
+      lastBoundAt: current?.lastBoundAt ?? null,
+    };
+    const changed = current === undefined
+      ? true
+      : current.repoId !== next.repoId
+        || current.worktreeRoot !== next.worktreeRoot
+        || current.gitCommonDir !== next.gitCommonDir
+        || !capabilityProfilesEqual(current.capabilityProfile, next.capabilityProfile);
+
+    this.authorizedWorkspaces.set(next.worktreeId, next);
+    await this.persist();
+    return {
+      ok: true,
+      changed,
+      authorization: toAuthorizedWorkspaceView(next, this.activeTransportsFor(next.worktreeId)),
+    };
+  }
+
+  async revokeWorkspace(request: WorkspaceBindRequest): Promise<WorkspaceRevokeResult> {
+    const resolved = await resolveWorkspaceRequest(this.options.git, request);
+    if ("code" in resolved) {
+      return {
+        ok: false,
+        revoked: false,
+        errorCode: resolved.code,
+        error: resolved.message,
+      };
+    }
+
+    await this.ensureLoaded();
+    const current = this.authorizedWorkspaces.get(resolved.worktreeId);
+    if (current === undefined) {
+      return {
+        ok: false,
+        revoked: false,
+        repoId: resolved.repoId,
+        worktreeId: resolved.worktreeId,
+        worktreeRoot: resolved.worktreeRoot,
+        activeSessions: this.activeTransportsFor(resolved.worktreeId),
+        errorCode: "WORKSPACE_NOT_AUTHORIZED",
+        error: `Workspace ${resolved.worktreeRoot} is not authorized.`,
+      };
+    }
+
+    this.authorizedWorkspaces.delete(resolved.worktreeId);
+    await this.persist();
+    return {
+      ok: true,
+      revoked: true,
+      repoId: current.repoId,
+      worktreeId: current.worktreeId,
+      worktreeRoot: current.worktreeRoot,
+      activeSessions: this.activeTransportsFor(current.worktreeId),
+    };
+  }
+
+  async getCapabilityProfile(resolved: ResolvedWorkspace): Promise<WorkspaceCapabilityProfile | null> {
+    await this.ensureLoaded();
+    const record = this.authorizedWorkspaces.get(resolved.worktreeId);
+    return record === undefined ? null : cloneCapabilityProfile(record.capabilityProfile);
+  }
+
+  async noteBound(resolved: ResolvedWorkspace): Promise<void> {
+    await this.ensureLoaded();
+    const current = this.authorizedWorkspaces.get(resolved.worktreeId);
+    if (current === undefined) return;
+    this.authorizedWorkspaces.set(resolved.worktreeId, {
+      ...current,
+      lastBoundAt: new Date().toISOString(),
+    });
+    await this.persist();
+  }
+
+  async listAuthorizedWorkspaces(): Promise<readonly AuthorizedWorkspaceView[]> {
+    await this.ensureLoaded();
+    return sortByWorktreeRoot([...this.authorizedWorkspaces.values()]).map((record) => {
+      return toAuthorizedWorkspaceView(record, this.activeTransportsFor(record.worktreeId));
+    });
+  }
+
+  async listAuthorizedWorkspaceRecords(): Promise<readonly AuthorizedWorkspaceRecord[]> {
+    await this.ensureLoaded();
+    return sortByWorktreeRoot([...this.authorizedWorkspaces.values()]).map(cloneAuthorizedWorkspaceRecord);
+  }
+
+  async getAuthorizedWorkspace(request: WorkspaceBindRequest): Promise<AuthorizedWorkspaceRecord | null> {
+    const resolved = await resolveWorkspaceRequest(this.options.git, request);
+    if ("code" in resolved) return null;
+    await this.ensureLoaded();
+    const record = this.authorizedWorkspaces.get(resolved.worktreeId);
+    return record === undefined ? null : cloneAuthorizedWorkspaceRecord(record);
+  }
+
+  async getAuthorizedWorkspaceForRepo(
+    repoId: string,
+    preferredWorktreeRoot?: string,
+  ): Promise<AuthorizedWorkspaceRecord | null> {
+    await this.ensureLoaded();
+    const matches = [...this.authorizedWorkspaces.values()].filter((record) => record.repoId === repoId);
+    if (matches.length === 0) return null;
+    if (preferredWorktreeRoot !== undefined) {
+      const preferred = matches.find((record) => record.worktreeRoot === preferredWorktreeRoot);
+      if (preferred !== undefined) {
+        return cloneAuthorizedWorkspaceRecord(preferred);
+      }
+    }
+    const [first] = sortByWorktreeRoot(matches);
+    if (first === undefined) return null;
+    return cloneAuthorizedWorkspaceRecord(first);
+  }
+
+  listTransports(): readonly DaemonSessionView[] {
+    return [...this.transports.values()]
+      .map((session) => toDaemonSessionView(session, readWorkspaceStatus, readRuntimeCausalContext))
+      .sort((left, right) => left.startedAt.localeCompare(right.startedAt));
+  }
+
+  getStatus(
+    runtime: DaemonRuntimeDescriptor,
+    monitorCounts: DaemonMonitorCounts = ZERO_MONITOR_COUNTS,
+    schedulerCounts: DaemonSchedulerCounts = ZERO_SCHEDULER_COUNTS,
+    workerCounts: DaemonWorkerCounts,
+  ): DaemonStatusView {
+    return buildStatusView(
+      runtime,
+      this.listTransports(),
+      this.authorizedWorkspaces,
+      DEFAULT_DAEMON_CAPABILITY_PROFILE,
+      monitorCounts,
+      schedulerCounts,
+      workerCounts,
+    );
+  }
+
+  private async ensureLoaded(): Promise<void> {
+    if (this.loadPromise !== null) {
+      await this.loadPromise;
+      return;
+    }
+
+    this.loadPromise = (async () => {
+      const decoded = await loadPersistedState(this.statePath, this.options.fs, this.options.codec);
+      if (decoded === null) return;
+      for (const record of decoded.workspaces) {
+        this.authorizedWorkspaces.set(record.worktreeId, {
+          repoId: record.repoId,
+          worktreeId: record.worktreeId,
+          worktreeRoot: record.worktreeRoot,
+          gitCommonDir: record.gitCommonDir,
+          capabilityProfile: cloneCapabilityProfile(record.capabilityProfile),
+          authorizedAt: record.authorizedAt,
+          lastBoundAt: record.lastBoundAt,
+        });
+      }
+    })();
+
+    await this.loadPromise;
+  }
+
+  private async persist(): Promise<void> {
+    await persistState(this.statePath, this.options.fs, this.options.codec, this.authorizedWorkspaces);
+  }
+
+  private activeTransportsFor(worktreeId: string): number {
+    return this.listTransports().filter((session) => session.worktreeId === worktreeId).length;
+  }
+}