@flyingrobots/graft 0.6.1 → 0.7.1

package/src/mcp/control-plane/types.ts

@@ -1,144 +0,0 @@
-import type { DaemonSchedulerCounts } from "../daemon-job-scheduler.js";
-import type { DaemonWorkerCounts } from "../daemon-worker-pool.js";
-import type { RuntimeCausalContext } from "../runtime-causal-context.js";
-import type {
-  WorkspaceBindRequest,
-  WorkspaceCapabilityProfile,
-  WorkspaceStatus,
-} from "../workspace-router.js";
-
-// ---------------------------------------------------------------------------
-// Internal: session tracking
-// ---------------------------------------------------------------------------
-
-export interface RegisteredTransport {
-  readonly sessionId: string;
-  readonly startedAt: string;
-  readonly getWorkspaceStatus: () => WorkspaceStatus;
-  readonly getRuntimeCausalContext: () => RuntimeCausalContext | null;
-  lastActivityAt: string;
-}
-
-// ---------------------------------------------------------------------------
-// Authorization types
-// ---------------------------------------------------------------------------
-
-export interface AuthorizedWorkspaceRecord {
-  readonly repoId: string;
-  readonly worktreeId: string;
-  readonly worktreeRoot: string;
-  readonly gitCommonDir: string;
-  readonly capabilityProfile: WorkspaceCapabilityProfile;
-  readonly authorizedAt: string;
-  readonly lastBoundAt: string | null;
-}
-
-export interface AuthorizedWorkspaceView extends AuthorizedWorkspaceRecord {
-  readonly activeSessions: number;
-}
-
-export interface WorkspaceAuthorizeRequest extends WorkspaceBindRequest {
-  readonly runCapture?: boolean | undefined;
-}
-
-export interface WorkspaceAuthorizeResult {
-  readonly ok: boolean;
-  readonly changed: boolean;
-  readonly authorization?: AuthorizedWorkspaceView;
-  readonly errorCode?: string;
-  readonly error?: string;
-}
-
-export interface WorkspaceRevokeResult {
-  readonly ok: boolean;
-  readonly revoked: boolean;
-  readonly repoId?: string | null;
-  readonly worktreeId?: string | null;
-  readonly worktreeRoot?: string | null;
-  readonly activeSessions?: number;
-  readonly errorCode?: string;
-  readonly error?: string;
-}
-
-// ---------------------------------------------------------------------------
-// Session view
-// ---------------------------------------------------------------------------
-
-export interface DaemonSessionView {
-  readonly sessionId: string;
-  readonly sessionMode: "daemon";
-  readonly bindState: WorkspaceStatus["bindState"];
-  readonly repoId: string | null;
-  readonly worktreeId: string | null;
-  readonly worktreeRoot: string | null;
-  readonly causalSessionId: string | null;
-  readonly checkoutEpochId: string | null;
-  readonly capabilityProfile: WorkspaceCapabilityProfile | null;
-  readonly startedAt: string;
-  readonly lastActivityAt: string;
-}
-
-// ---------------------------------------------------------------------------
-// Daemon runtime & status projection
-// ---------------------------------------------------------------------------
-
-export interface DaemonRuntimeDescriptor {
-  readonly transport: "unix_socket" | "named_pipe";
-  readonly sameUserOnly: true;
-  readonly socketPath: string;
-  readonly mcpPath: string;
-  readonly healthPath: string;
-  readonly activeWarpRepos: number;
-  readonly startedAt: string;
-}
-
-export interface SharedAttachSource {
-  readonly sourceSessionId: string;
-  readonly causalSessionId: string;
-  readonly strandId: string;
-}
-
-export interface DaemonMonitorCounts {
-  readonly totalMonitors: number;
-  readonly runningMonitors: number;
-  readonly pausedMonitors: number;
-  readonly stoppedMonitors: number;
-  readonly failingMonitors: number;
-  readonly backlogMonitors: number;
-}
-
-export interface DaemonStatusView extends DaemonRuntimeDescriptor {
-  readonly ok: true;
-  readonly sessionMode: "daemon";
-  readonly activeSessions: number;
-  readonly boundSessions: number;
-  readonly unboundSessions: number;
-  readonly authorizedWorkspaces: number;
-  readonly authorizedRepos: number;
-  readonly workspaceBindRequiresAuthorization: true;
-  readonly defaultCapabilityProfile: WorkspaceCapabilityProfile;
-  readonly totalMonitors: number;
-  readonly runningMonitors: number;
-  readonly pausedMonitors: number;
-  readonly stoppedMonitors: number;
-  readonly failingMonitors: number;
-  readonly backlogMonitors: number;
-  readonly scheduler: DaemonSchedulerCounts;
-  readonly workers: DaemonWorkerCounts;
-}
-
-// ---------------------------------------------------------------------------
-// Control plane constructor options
-// ---------------------------------------------------------------------------
-
-export interface DaemonControlPlaneOptions {
-  readonly fs: FileSystem;
-  readonly codec: JsonCodec;
-  readonly git: GitClient;
-  readonly graftDir: string;
-}
-
-// Re-import port types so consumers don't need to reach into ports/
-import type { FileSystem } from "../../ports/filesystem.js";
-import type { JsonCodec } from "../../ports/codec.js";
-import type { GitClient } from "../../ports/git.js";

package/src/mcp/daemon-bootstrap.ts

@@ -1,100 +0,0 @@
-import * as crypto from "node:crypto";
-import * as fs from "node:fs/promises";
-import * as http from "node:http";
-import * as net from "node:net";
-import * as os from "node:os";
-import * as path from "node:path";
-
-const DIRECTORY_MODE = 0o700;
-const SOCKET_MODE = 0o600;
-
-export function isNamedPipePath(socketPath: string): boolean {
-  return process.platform === "win32" && socketPath.startsWith("\\\\.\\pipe\\");
-}
-
-export function defaultDaemonRoot(): string {
-  return path.join(os.homedir(), ".graft", "daemon");
-}
-
-function defaultSocketPath(graftDir: string): string {
-  if (process.platform === "win32") {
-    const digest = crypto.createHash("sha256").update(os.homedir()).digest("hex").slice(0, 12);
-    return `\\\\.\\pipe\\graft-daemon-${digest}`;
-  }
-  return path.join(graftDir, "mcp.sock");
-}
-
-export function resolveSocketPath(socketPath: string | undefined, graftDir: string): string {
-  if (socketPath === undefined) return defaultSocketPath(graftDir);
-  if (isNamedPipePath(socketPath)) return socketPath;
-  return path.resolve(socketPath);
-}
-
-export async function ensurePrivateDirectory(dirPath: string): Promise<void> {
-  await fs.mkdir(dirPath, { recursive: true, mode: DIRECTORY_MODE });
-  if (process.platform !== "win32") {
-    await fs.chmod(dirPath, DIRECTORY_MODE).catch(() => {
-      return undefined;
-    });
-  }
-}
-
-async function socketHasActiveListener(socketPath: string): Promise<boolean> {
-  return new Promise<boolean>((resolve) => {
-    const socket = net.createConnection({ path: socketPath });
-    let settled = false;
-
-    const finish = (result: boolean): void => {
-      if (settled) return;
-      settled = true;
-      socket.destroy();
-      resolve(result);
-    };
-
-    socket.once("connect", () => {
-      finish(true);
-    });
-    socket.once("error", () => {
-      finish(false);
-    });
-    socket.setTimeout(200, () => {
-      finish(false);
-    });
-  });
-}
-
-export async function prepareSocketPath(socketPath: string): Promise<void> {
-  if (isNamedPipePath(socketPath)) return;
-  await ensurePrivateDirectory(path.dirname(socketPath));
-  const existing = await fs.lstat(socketPath).catch((error: unknown) => {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") return null;
-    throw error;
-  });
-  if (existing === null) return;
-  if (!existing.isSocket()) {
-    throw new Error(`Refusing to overwrite non-socket path: ${socketPath}`);
-  }
-  if (await socketHasActiveListener(socketPath)) {
-    throw new Error(`A graft daemon is already listening on ${socketPath}`);
-  }
-  await fs.unlink(socketPath);
-}
-
-export async function tightenSocketPermissions(socketPath: string): Promise<void> {
-  if (process.platform === "win32" || isNamedPipePath(socketPath)) return;
-  await fs.chmod(socketPath, SOCKET_MODE).catch(() => {
-    return undefined;
-  });
-}
-
-export async function closeHttpServer(server: http.Server): Promise<void> {
-  await new Promise<void>((resolve, reject) => {
-    server.close((error) => {
-      if (error) {
-        reject(error);
-        return;
-      }
-      resolve();
-    });
-  });
-}

package/src/mcp/daemon-control-plane.ts

@@ -1,310 +0,0 @@
-import type { DaemonSchedulerCounts } from "./daemon-job-scheduler.js";
-import { ZERO_SCHEDULER_COUNTS } from "./daemon-job-scheduler.js";
-import type { DaemonWorkerCounts } from "./daemon-worker-pool.js";
-import type { RuntimeCausalContext } from "./runtime-causal-context.js";
-import {
-  DEFAULT_DAEMON_CAPABILITY_PROFILE,
-  resolveWorkspaceRequest,
-  type ResolvedWorkspace,
-  type WorkspaceBindRequest,
-  type WorkspaceCapabilityProfile,
-  type WorkspaceStatus,
-} from "./workspace-router.js";
-
-import {
-  buildStatePath,
-  capabilityProfilesEqual,
-  cloneAuthorizedWorkspaceRecord,
-  cloneCapabilityProfile,
-  loadPersistedState,
-  persistState,
-  resolveCapabilityProfile,
-  sortByWorktreeRoot,
-} from "./control-plane/authz-storage.js";
-
-import {
-  readRuntimeCausalContext,
-  readWorkspaceStatus,
-  resolveSharedAttachSource,
-  toDaemonSessionView,
-} from "./control-plane/session-registry.js";
-
-import {
-  buildStatusView,
-  toAuthorizedWorkspaceView,
-  ZERO_MONITOR_COUNTS,
-} from "./control-plane/status-projection.js";
-
-// ---------------------------------------------------------------------------
-// Barrel re-exports — keep every public type available from this path
-// ---------------------------------------------------------------------------
-
-export type {
-  AuthorizedWorkspaceRecord,
-  AuthorizedWorkspaceView,
-  DaemonControlPlaneOptions,
-  DaemonMonitorCounts,
-  DaemonRuntimeDescriptor,
-  DaemonSessionView,
-  DaemonStatusView,
-  SharedAttachSource,
-  WorkspaceAuthorizeRequest,
-  WorkspaceAuthorizeResult,
-  WorkspaceRevokeResult,
-} from "./control-plane/types.js";
-
-import type {
-  AuthorizedWorkspaceRecord,
-  AuthorizedWorkspaceView,
-  DaemonControlPlaneOptions,
-  DaemonMonitorCounts,
-  DaemonRuntimeDescriptor,
-  DaemonSessionView,
-  DaemonStatusView,
-  RegisteredTransport,
-  SharedAttachSource,
-  WorkspaceAuthorizeRequest,
-  WorkspaceAuthorizeResult,
-  WorkspaceRevokeResult,
-} from "./control-plane/types.js";
-
-// ---------------------------------------------------------------------------
-// DaemonControlPlane
-// ---------------------------------------------------------------------------
-
-export class DaemonControlPlane {
-  private readonly statePath: string;
-  private readonly authorizedWorkspaces = new Map<string, AuthorizedWorkspaceRecord>();
-  private readonly transports = new Map<string, RegisteredTransport>();
-  private loadPromise: Promise<void> | null = null;
-
-  constructor(private readonly options: DaemonControlPlaneOptions) {
-    this.statePath = buildStatePath(options.graftDir);
-  }
-
-  initialize(): Promise<void> {
-    return this.ensureLoaded();
-  }
-
-  registerTransport(
-    sessionId: string,
-    getWorkspaceStatus: () => WorkspaceStatus,
-    getRuntimeCausalContext: () => RuntimeCausalContext | null,
-  ): void {
-    const now = new Date().toISOString();
-    this.transports.set(sessionId, {
-      sessionId,
-      startedAt: now,
-      lastActivityAt: now,
-      getWorkspaceStatus,
-      getRuntimeCausalContext,
-    });
-  }
-
-  touchTransport(sessionId: string): void {
-    const session = this.transports.get(sessionId);
-    if (session === undefined) return;
-    session.lastActivityAt = new Date().toISOString();
-  }
-
-  unregisterTransport(sessionId: string): void {
-    this.transports.delete(sessionId);
-  }
-
-  resolveSharedAttachSource(input: {
-    readonly sessionId: string;
-    readonly repoId: string;
-    readonly worktreeId: string;
-  }): SharedAttachSource | null {
-    return resolveSharedAttachSource(this.transports, input);
-  }
-
-  async authorizeWorkspace(request: WorkspaceAuthorizeRequest): Promise<WorkspaceAuthorizeResult> {
-    const resolved = await resolveWorkspaceRequest(this.options.git, request);
-    if ("code" in resolved) {
-      return {
-        ok: false,
-        changed: false,
-        errorCode: resolved.code,
-        error: resolved.message,
-      };
-    }
-
-    await this.ensureLoaded();
-    const current = this.authorizedWorkspaces.get(resolved.worktreeId);
-    const nextCapabilityProfile = resolveCapabilityProfile(
-      current?.capabilityProfile,
-      DEFAULT_DAEMON_CAPABILITY_PROFILE,
-      request.runCapture,
-    );
-    const next: AuthorizedWorkspaceRecord = {
-      ...resolved,
-      capabilityProfile: nextCapabilityProfile,
-      authorizedAt: current?.authorizedAt ?? new Date().toISOString(),
-      lastBoundAt: current?.lastBoundAt ?? null,
-    };
-    const changed = current === undefined
-      ? true
-      : current.repoId !== next.repoId
-        || current.worktreeRoot !== next.worktreeRoot
-        || current.gitCommonDir !== next.gitCommonDir
-        || !capabilityProfilesEqual(current.capabilityProfile, next.capabilityProfile);
-
-    this.authorizedWorkspaces.set(next.worktreeId, next);
-    await this.persist();
-    return {
-      ok: true,
-      changed,
-      authorization: toAuthorizedWorkspaceView(next, this.activeTransportsFor(next.worktreeId)),
-    };
-  }
-
-  async revokeWorkspace(request: WorkspaceBindRequest): Promise<WorkspaceRevokeResult> {
-    const resolved = await resolveWorkspaceRequest(this.options.git, request);
-    if ("code" in resolved) {
-      return {
-        ok: false,
-        revoked: false,
-        errorCode: resolved.code,
-        error: resolved.message,
-      };
-    }
-
-    await this.ensureLoaded();
-    const current = this.authorizedWorkspaces.get(resolved.worktreeId);
-    if (current === undefined) {
-      return {
-        ok: false,
-        revoked: false,
-        repoId: resolved.repoId,
-        worktreeId: resolved.worktreeId,
-        worktreeRoot: resolved.worktreeRoot,
-        activeSessions: this.activeTransportsFor(resolved.worktreeId),
-        errorCode: "WORKSPACE_NOT_AUTHORIZED",
-        error: `Workspace ${resolved.worktreeRoot} is not authorized.`,
-      };
-    }
-
-    this.authorizedWorkspaces.delete(resolved.worktreeId);
-    await this.persist();
-    return {
-      ok: true,
-      revoked: true,
-      repoId: current.repoId,
-      worktreeId: current.worktreeId,
-      worktreeRoot: current.worktreeRoot,
-      activeSessions: this.activeTransportsFor(current.worktreeId),
-    };
-  }
-
-  async getCapabilityProfile(resolved: ResolvedWorkspace): Promise<WorkspaceCapabilityProfile | null> {
-    await this.ensureLoaded();
-    const record = this.authorizedWorkspaces.get(resolved.worktreeId);
-    return record === undefined ? null : cloneCapabilityProfile(record.capabilityProfile);
-  }
-
-  async noteBound(resolved: ResolvedWorkspace): Promise<void> {
-    await this.ensureLoaded();
-    const current = this.authorizedWorkspaces.get(resolved.worktreeId);
-    if (current === undefined) return;
-    this.authorizedWorkspaces.set(resolved.worktreeId, {
-      ...current,
-      lastBoundAt: new Date().toISOString(),
-    });
-    await this.persist();
-  }
-
-  async listAuthorizedWorkspaces(): Promise<readonly AuthorizedWorkspaceView[]> {
-    await this.ensureLoaded();
-    return sortByWorktreeRoot([...this.authorizedWorkspaces.values()]).map((record) => {
-      return toAuthorizedWorkspaceView(record, this.activeTransportsFor(record.worktreeId));
-    });
-  }
-
-  async listAuthorizedWorkspaceRecords(): Promise<readonly AuthorizedWorkspaceRecord[]> {
-    await this.ensureLoaded();
-    return sortByWorktreeRoot([...this.authorizedWorkspaces.values()]).map(cloneAuthorizedWorkspaceRecord);
-  }
-
-  async getAuthorizedWorkspace(request: WorkspaceBindRequest): Promise<AuthorizedWorkspaceRecord | null> {
-    const resolved = await resolveWorkspaceRequest(this.options.git, request);
-    if ("code" in resolved) return null;
-    await this.ensureLoaded();
-    const record = this.authorizedWorkspaces.get(resolved.worktreeId);
-    return record === undefined ? null : cloneAuthorizedWorkspaceRecord(record);
-  }
-
-  async getAuthorizedWorkspaceForRepo(
-    repoId: string,
-    preferredWorktreeRoot?: string,
-  ): Promise<AuthorizedWorkspaceRecord | null> {
-    await this.ensureLoaded();
-    const matches = [...this.authorizedWorkspaces.values()].filter((record) => record.repoId === repoId);
-    if (matches.length === 0) return null;
-    if (preferredWorktreeRoot !== undefined) {
-      const preferred = matches.find((record) => record.worktreeRoot === preferredWorktreeRoot);
-      if (preferred !== undefined) {
-        return cloneAuthorizedWorkspaceRecord(preferred);
-      }
-    }
-    const [first] = sortByWorktreeRoot(matches);
-    if (first === undefined) return null;
-    return cloneAuthorizedWorkspaceRecord(first);
-  }
-
-  listTransports(): readonly DaemonSessionView[] {
-    return [...this.transports.values()]
-      .map((session) => toDaemonSessionView(session, readWorkspaceStatus, readRuntimeCausalContext))
-      .sort((left, right) => left.startedAt.localeCompare(right.startedAt));
-  }
-
-  getStatus(
-    runtime: DaemonRuntimeDescriptor,
-    monitorCounts: DaemonMonitorCounts = ZERO_MONITOR_COUNTS,
-    schedulerCounts: DaemonSchedulerCounts = ZERO_SCHEDULER_COUNTS,
-    workerCounts: DaemonWorkerCounts,
-  ): DaemonStatusView {
-    return buildStatusView(
-      runtime,
-      this.listTransports(),
-      this.authorizedWorkspaces,
-      DEFAULT_DAEMON_CAPABILITY_PROFILE,
-      monitorCounts,
-      schedulerCounts,
-      workerCounts,
-    );
-  }
-
-  private async ensureLoaded(): Promise<void> {
-    if (this.loadPromise !== null) {
-      await this.loadPromise;
-      return;
-    }
-
-    this.loadPromise = (async () => {
-      const decoded = await loadPersistedState(this.statePath, this.options.fs, this.options.codec);
-      if (decoded === null) return;
-      for (const record of decoded.workspaces) {
-        this.authorizedWorkspaces.set(record.worktreeId, {
-          repoId: record.repoId,
-          worktreeId: record.worktreeId,
-          worktreeRoot: record.worktreeRoot,
-          gitCommonDir: record.gitCommonDir,
-          capabilityProfile: cloneCapabilityProfile(record.capabilityProfile),
-          authorizedAt: record.authorizedAt,
-          lastBoundAt: record.lastBoundAt,
-        });
-      }
-    })();
-
-    await this.loadPromise;
-  }
-
-  private async persist(): Promise<void> {
-    await persistState(this.statePath, this.options.fs, this.options.codec, this.authorizedWorkspaces);
-  }
-
-  private activeTransportsFor(worktreeId: string): number {
-    return this.listTransports().filter((session) => session.worktreeId === worktreeId).length;
-  }
-}