@fungi.computer/truffle 0.0.0-stage → 0.1.1

package/dist/log-event.js

@@ -0,0 +1,9 @@
+import * as Redacted from "effect/Redacted";
+/** Retain the original Local failure without printing exception or input text. */
+export function logEvent(operation, cause) {
+    globalThis.console.error(JSON.stringify({
+        source: "local-runtime",
+        operation,
+        failureKind: cause instanceof Error ? "Error" : "NonErrorThrown",
+    }), Redacted.make(cause));
+}

package/dist/private-bun-shiitake-host.d.ts

@@ -0,0 +1,11 @@
+import { type RpcTarget } from "@fungi.computer/capnweb";
+import type { PrivateLocalShiitakeServer } from "./private-local-shiitake-host.js";
+import { type PrivateLocalShiitakeWorkerBatch, type PrivateLocalShiitakeWorkerInput } from "./private-local-shiitake-host.js";
+/** Retained native Bun listener, now owned beside the persistent Local service. */
+export declare function openPrivateLocalBunServer(fetch: (request: Request) => Response | Promise<Response>, listenAddress?: string, auth?: Readonly<{
+    path: string;
+    admit: (request: Request) => boolean;
+    createTarget: () => RpcTarget;
+}>): PrivateLocalShiitakeServer;
+/** Retained static worker server; persistent service callers use the manager. */
+export declare function openPrivateLocalBunShiitakeWorkerBatch(inputs: readonly PrivateLocalShiitakeWorkerInput[], listenAddress: string): Promise<PrivateLocalShiitakeWorkerBatch>;

package/dist/private-bun-shiitake-host.js

@@ -0,0 +1,66 @@
+/// <reference types="bun-types" />
+import { serve } from "bun";
+import { dispatchPrivateLocalRequest } from "./private-local-http-dispatch.js";
+import { newBunWebSocketRpcHandler, } from "@fungi.computer/capnweb";
+import { openPrivateLocalShiitakeWorkerBatch, } from "./private-local-shiitake-host.js";
+function parsePrivateLoopbackListener(value) {
+    const url = new URL(value);
+    const loopback = url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+    const port = Number(url.port);
+    if (url.protocol !== "http:" ||
+        !loopback ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.pathname !== "/" ||
+        url.search !== "" ||
+        url.hash !== "" ||
+        !Number.isInteger(port) ||
+        port < 1 ||
+        port > 65_535)
+        throw new Error("Private local Shiitake listener requires loopback HTTP with an explicit port");
+    return {
+        hostname: url.hostname === "127.0.0.1" ? "127.0.0.1" : "::1",
+        port,
+    };
+}
+/** Retained native Bun listener, now owned beside the persistent Local service. */
+export function openPrivateLocalBunServer(fetch, listenAddress, auth) {
+    const listener = listenAddress === undefined
+        ? { hostname: "127.0.0.1", port: 0 }
+        : parsePrivateLoopbackListener(listenAddress);
+    // A model retry can leave SSE quiet, and command admission/cancellation can
+    // await owner cleanup. Bun's socket-idle clock must not sever either while
+    // the handler is pending. Restore its ordinary idle limit for finite replies.
+    const dispatch = async (request, server) => {
+        return dispatchPrivateLocalRequest(request, server, fetch);
+    };
+    const server = auth === undefined
+        ? serve({ ...listener, fetch: dispatch })
+        : serve({
+            ...listener,
+            websocket: newBunWebSocketRpcHandler(auth.createTarget),
+            fetch(request, server) {
+                if (new URL(request.url).pathname === auth.path) {
+                    if (!auth.admit(request))
+                        return new Response(null, { status: 403 });
+                    if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+                        return new Response(null, { status: 426 });
+                    if (server.upgrade(request, { data: undefined }))
+                        return;
+                    return new Response(null, { status: 400 });
+                }
+                return dispatch(request, server);
+            },
+        });
+    return Object.freeze({
+        baseUrl: server.url.origin,
+        close: () => server.stop(true),
+    });
+}
+/** Retained static worker server; persistent service callers use the manager. */
+export async function openPrivateLocalBunShiitakeWorkerBatch(inputs, listenAddress) {
+    // Validate the native listener before any Local owner opens its store.
+    parsePrivateLoopbackListener(listenAddress);
+    return openPrivateLocalShiitakeWorkerBatch(inputs, (fetch) => openPrivateLocalBunServer(fetch, listenAddress));
+}
+/// <reference types="bun-types" />

package/dist/private-file-credential-store.d.ts

@@ -0,0 +1,33 @@
+import type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
+export declare const maximumCredentialStringLength: number;
+export type AtomicWrite = (path: string, content: string, options: Readonly<{
+    encoding: BufferEncoding;
+    fsync: boolean;
+    mode: number;
+}>) => Promise<void>;
+/** A host-private Pi credential store selected by one absolute filesystem path. */
+export type PrivateCredentialStore = CredentialStore & {
+    /** Stable host identity supplied to Pi's ChatGPT sign-in, never a credential. */
+    getDeviceId(): Promise<string>;
+    /** Revoke or validate current custody under the same lock, then delete it atomically. */
+    remove<T>(providerId: string, beforeRemove: (credential: Credential) => Promise<T>, options?: AuthOperationOptions): Promise<T | undefined>;
+};
+/** Resolve the host-owned default path without consulting project or Agent Home state. */
+export declare function resolveDefaultCredentialPath(home?: string): string;
+/**
+ * Internal constructor permits one focused write-failure test while the public
+ * package surface remains the Pi CredentialStore factory below.
+ */
+export declare class FileCredentialStore implements CredentialStore {
+    #private;
+    constructor(path: string, writeAtomic?: AtomicWrite);
+    /** Keep the installation UUID beside credentials, across logout and restart. */
+    getDeviceId(): Promise<string>;
+    read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
+    modify(providerId: string, callback: (current: Credential | undefined) => Promise<Credential | undefined>, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    delete(providerId: string, options?: AuthOperationOptions): Promise<void>;
+    remove<T>(providerId: string, beforeRemove: (credential: Credential) => Promise<T>, options?: AuthOperationOptions): Promise<T | undefined>;
+}
+/** Create the one private Pi CredentialStore selected by the local host. */
+export declare function createPrivateCredentialStore(path?: string): PrivateCredentialStore;

package/dist/private-file-credential-store.js

@@ -0,0 +1,283 @@
+import { correlationKey } from "@fungi.computer/cairn";
+import { chmod, mkdir, open } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, resolve } from "node:path";
+import lockfile from "proper-lockfile";
+import writeFileAtomic from "write-file-atomic";
+import { z } from "zod";
+const maximumCredentialFileBytes = 256 * 1_024;
+const maximumCredentialEntries = 128;
+const maximumProviderIdLength = 256;
+export const maximumCredentialStringLength = 64 * 1_024;
+const maximumEnvironmentEntries = 64;
+const maximumExtensionEntries = 64;
+const privateDirectoryMode = 0o700;
+const privateFileMode = 0o600;
+const lockOptions = {
+    realpath: false,
+    stale: 30_000,
+    update: 10_000,
+    retries: { retries: 20, factor: 1.2, minTimeout: 25, maxTimeout: 100 },
+};
+const providerIdSchema = z.string().min(1).max(maximumProviderIdLength);
+const credentialStringSchema = z.string().max(maximumCredentialStringLength);
+const environmentSchema = z
+    .record(z.string().min(1).max(maximumProviderIdLength), credentialStringSchema)
+    .superRefine((environment, context) => {
+    if (Object.keys(environment).length > maximumEnvironmentEntries) {
+        context.addIssue({
+            code: "custom",
+            message: "Credential environment contains too many entries",
+        });
+    }
+});
+const apiKeyCredentialSchema = z
+    .strictObject({
+    type: z.literal("api_key"),
+    key: credentialStringSchema.optional(),
+    env: environmentSchema.optional(),
+})
+    .transform((input) => {
+    const credential = { type: "api_key" };
+    if (input.key !== undefined)
+        credential.key = input.key;
+    if (input.env !== undefined)
+        credential.env = input.env;
+    return credential;
+});
+const oauthCredentialSchema = z
+    .object({
+    type: z.literal("oauth"),
+    refresh: credentialStringSchema,
+    access: credentialStringSchema,
+    expires: z.number(),
+})
+    .catchall(z.json())
+    .superRefine((credential, context) => {
+    if (Object.keys(credential).length > maximumExtensionEntries + 4) {
+        context.addIssue({
+            code: "custom",
+            message: "OAuth credential contains too many entries",
+        });
+    }
+    for (const key of Object.keys(credential)) {
+        if (key.length > maximumProviderIdLength) {
+            context.addIssue({
+                code: "custom",
+                message: "OAuth credential contains an oversized key",
+            });
+        }
+    }
+});
+const credentialSchema = z.discriminatedUnion("type", [
+    apiKeyCredentialSchema,
+    oauthCredentialSchema,
+]);
+const credentialMapSchema = z
+    .record(providerIdSchema, credentialSchema)
+    .superRefine((credentials, context) => {
+    if (Object.keys(credentials).length > maximumCredentialEntries) {
+        context.addIssue({
+            code: "custom",
+            message: "Credential store contains too many providers",
+        });
+    }
+});
+const missingFileErrorSchema = z.object({ code: z.literal("ENOENT") });
+/** Resolve the host-owned default path without consulting project or Agent Home state. */
+export function resolveDefaultCredentialPath(home = homedir()) {
+    if (!isAbsolute(home)) {
+        throw new Error("Default credential home must be absolute");
+    }
+    return resolve(home, ".config", "fungi", "credentials.json");
+}
+function credentialStoreError(message) {
+    return new Error(message);
+}
+function ownCredential(credentials, providerId) {
+    if (credentials === undefined || !Object.hasOwn(credentials, providerId)) {
+        return undefined;
+    }
+    return credentials[providerId];
+}
+function parseCredentials(serialized) {
+    let parsed;
+    try {
+        parsed = JSON.parse(serialized);
+    }
+    catch {
+        throw credentialStoreError("Credential store contains malformed JSON");
+    }
+    const result = credentialMapSchema.safeParse(parsed);
+    if (!result.success) {
+        throw credentialStoreError("Credential store contains invalid credential data");
+    }
+    return result.data;
+}
+/**
+ * Internal constructor permits one focused write-failure test while the public
+ * package surface remains the Pi CredentialStore factory below.
+ */
+export class FileCredentialStore {
+    #path;
+    #writeAtomic;
+    constructor(path, writeAtomic = writeFileAtomic) {
+        if (!isAbsolute(path)) {
+            throw new Error("Private credential path must be absolute");
+        }
+        this.#path = path;
+        this.#writeAtomic = writeAtomic;
+    }
+    /** Keep the installation UUID beside credentials, across logout and restart. */
+    async getDeviceId() {
+        return this.#withLock(async () => {
+            const path = `${this.#path}.device-id`;
+            let handle;
+            try {
+                handle = await open(path, "r");
+            }
+            catch (error) {
+                if (!missingFileErrorSchema.safeParse(error).success)
+                    throw error;
+                const id = correlationKey();
+                await this.#writeAtomic(path, id, {
+                    encoding: "utf8",
+                    fsync: true,
+                    mode: privateFileMode,
+                });
+                return id;
+            }
+            try {
+                // A UUID has exactly 36 bytes; the extra byte detects oversized input.
+                const bytes = Buffer.alloc(37);
+                const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+                const parsed = z
+                    .uuid()
+                    .safeParse(bytes.subarray(0, bytesRead).toString("utf8"));
+                if (!parsed.success)
+                    throw credentialStoreError("Local model device ID is invalid");
+                return parsed.data;
+            }
+            finally {
+                await handle.close();
+            }
+        });
+    }
+    async read(providerId, options) {
+        options?.signal?.throwIfAborted();
+        return ownCredential(await this.#readCredentials(), providerId);
+    }
+    async list(options) {
+        options?.signal?.throwIfAborted();
+        const credentials = await this.#readCredentials();
+        if (credentials === undefined)
+            return [];
+        return Object.entries(credentials).map(([providerId, credential]) => ({
+            providerId,
+            type: credential.type,
+        }));
+    }
+    async modify(providerId, callback, options) {
+        options?.signal?.throwIfAborted();
+        return await this.#withLock(async () => {
+            options?.signal?.throwIfAborted();
+            const credentials = (await this.#readCredentials()) ?? {};
+            const current = ownCredential(credentials, providerId);
+            const next = await callback(current);
+            options?.signal?.throwIfAborted();
+            if (next === undefined)
+                return current;
+            const validated = this.#validateCredentials({
+                ...credentials,
+                [providerId]: next,
+            });
+            await this.#replace(validated);
+            const persisted = ownCredential(validated, providerId);
+            if (persisted === undefined) {
+                throw credentialStoreError("Credential store failed to retain its update");
+            }
+            return persisted;
+        });
+    }
+    async delete(providerId, options) {
+        await this.remove(providerId, () => Promise.resolve(), options);
+    }
+    async remove(providerId, beforeRemove, options) {
+        options?.signal?.throwIfAborted();
+        return this.#withLock(async () => {
+            options?.signal?.throwIfAborted();
+            const credentials = await this.#readCredentials();
+            const current = ownCredential(credentials, providerId);
+            if (credentials === undefined || current === undefined)
+                return undefined;
+            const result = await beforeRemove(current);
+            const next = Object.fromEntries(Object.entries(credentials).filter(([id]) => id !== providerId));
+            options?.signal?.throwIfAborted();
+            await this.#replace(this.#validateCredentials(next));
+            return result;
+        });
+    }
+    #validateCredentials(credentials) {
+        const result = credentialMapSchema.safeParse(credentials);
+        if (!result.success) {
+            throw credentialStoreError("Credential update contains invalid credential data");
+        }
+        return result.data;
+    }
+    async #readCredentials() {
+        let handle;
+        try {
+            handle = await open(this.#path, "r");
+        }
+        catch (error) {
+            if (missingFileErrorSchema.safeParse(error).success)
+                return undefined;
+            throw error;
+        }
+        try {
+            const bytes = Buffer.alloc(maximumCredentialFileBytes + 1);
+            let totalBytesRead = 0;
+            while (totalBytesRead < bytes.length) {
+                const { bytesRead } = await handle.read(bytes, totalBytesRead, bytes.length - totalBytesRead, totalBytesRead);
+                if (bytesRead === 0)
+                    break;
+                totalBytesRead += bytesRead;
+            }
+            if (totalBytesRead > maximumCredentialFileBytes) {
+                throw credentialStoreError("Credential store exceeds its private file bound");
+            }
+            return parseCredentials(bytes.subarray(0, totalBytesRead).toString("utf8"));
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async #replace(credentials) {
+        await this.#writeAtomic(this.#path, JSON.stringify(credentials), {
+            encoding: "utf8",
+            fsync: true,
+            mode: privateFileMode,
+        });
+    }
+    /**
+     * proper-lockfile bounds acquisition through retries but cannot cancel it
+     * while queued. Callers check their signal before acquisition and
+     * immediately after it succeeds.
+     */
+    async #withLock(callback) {
+        const directory = dirname(this.#path);
+        await mkdir(directory, { recursive: true, mode: privateDirectoryMode });
+        await chmod(directory, privateDirectoryMode);
+        const release = await lockfile.lock(this.#path, lockOptions);
+        try {
+            return await callback();
+        }
+        finally {
+            await release();
+        }
+    }
+}
+/** Create the one private Pi CredentialStore selected by the local host. */
+export function createPrivateCredentialStore(path = resolveDefaultCredentialPath()) {
+    return new FileCredentialStore(path);
+}

package/dist/private-files-patch.d.ts

@@ -0,0 +1,3 @@
+import type { FilesPatch, FilesPort } from "@fungi.computer/knapsack";
+/** Advertise only a packaged native engine; never install tools during a model call. */
+export declare function createPrivateFilesPatch(root: string, read: FilesPort["read"]): Promise<FilesPatch | undefined>;

package/dist/private-files-patch.js

@@ -0,0 +1,86 @@
+import { access, constants } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import process from "node:process";
+import * as ChildProcess from "effect/process/ChildProcess";
+import { parsePatch } from "diff";
+import * as Stream from "effect/Stream";
+import { runPrivateInvocationProcess } from "./private-invocation-computer.js";
+function patchExecutable() {
+    if (process.env.FUNGI_BUNDLED_CLI) {
+        const name = `@fungi.computer/spore-native-${process.platform}-${process.arch}`;
+        try {
+            return createRequire(process.env.FUNGI_BUNDLED_CLI).resolve(`${name}/bin/fungi-apply-patch`);
+        }
+        catch (cause) {
+            throw new Error(`Missing ${name}; reinstall Fungi with npm optional dependencies enabled`, { cause });
+        }
+    }
+    return fileURLToPath(new URL("../native/bin/fungi-apply-patch", import.meta.url));
+}
+const maximumPatchBytes = 128 * 1024;
+const mismatchExitCode = 23;
+const formatExitCode = 24;
+/** Read-only recovery guidance for rejected standard unified-diff input. */
+async function unifiedDiffContext(patch, read, context) {
+    try {
+        const unified = patch
+            .replace(/^\*\*\* Begin Patch\r?\n/u, "")
+            .replace(/\r?\n\*\*\* End Patch\s*$/u, "");
+        const file = parsePatch(unified)[0];
+        const hunk = file?.hunks[0];
+        const path = file?.oldFileName.replace(/^a\//u, "");
+        if (path === undefined || hunk === undefined || path === "/dev/null")
+            return "\nInclude *** Update File: path/to/file before @@ to identify the target.\n";
+        const current = await read({ path, offset: 0, limit: maximumPatchBytes }, context);
+        const lines = current.content.split(/\r?\n/u);
+        const from = Math.min(Math.max(0, hunk.oldStart - 3), Math.max(0, lines.length - 7));
+        const nearby = lines
+            .slice(from, from + 7)
+            .map((line, index) => `  ${String(from + index + 1)}: ${line.length > 160 ? line.slice(0, 160) + "…" : line}`);
+        return `\nCurrent lines in ${path.slice(0, 160)}:\n${nearby.join("\n")}\n${current.truncated ? "File preview is truncated at 128 KiB.\n" : ""}`;
+    }
+    catch (cause) {
+        context.signal.throwIfAborted();
+        return `\nCurrent file preview unavailable: ${cause instanceof Error ? cause.message.slice(0, 512) : "unified diff could not be decoded"}\n`;
+    }
+}
+/** Advertise only a packaged native engine; never install tools during a model call. */
+export async function createPrivateFilesPatch(root, read) {
+    const executable = patchExecutable();
+    try {
+        await access(executable, constants.X_OK);
+    }
+    catch (cause) {
+        if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+            return undefined;
+        throw cause;
+    }
+    return async ({ patch }, context) => {
+        context.signal.throwIfAborted();
+        const bytes = new TextEncoder().encode(patch);
+        if (bytes.byteLength > maximumPatchBytes)
+            throw new Error("Patch exceeds the 128 KiB input bound");
+        const command = ChildProcess.make(executable, {
+            cwd: root,
+            stdin: Stream.make(bytes),
+        });
+        const result = await runPrivateInvocationProcess(command, context.signal, 30_000);
+        if (result.status === "deadline_exceeded")
+            return {
+                status: "failed",
+                exitCode: result.exitCode,
+                stdout: result.stdout,
+                stderr: `${result.stderr}\n${result.message} Earlier patch writes may remain.`,
+                truncated: result.truncated,
+            };
+        if (result.status === "failed" && result.exitCode === formatExitCode)
+            return {
+                ...result,
+                stderr: result.stderr + (await unifiedDiffContext(patch, read, context)),
+            };
+        return result.status === "failed" && result.exitCode === mismatchExitCode
+            ? { ...result, error: { kind: "mismatch" } }
+            : result;
+    };
+}