@fungi.computer/truffle 0.0.0-stage → 0.2.0

package/dist/private-local-git-exclude.js

@@ -0,0 +1,33 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { appendFile, mkdir, readFile } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { promisify } from "node:util";
+const execFile = promisify(execFileCallback);
+const excludeEntry = ".fungi/";
+/** Keep generated project state out of Git without changing tracked ignore rules. */
+export async function ensurePrivateLocalGitExclude(projectRoot) {
+    let common;
+    try {
+        const result = await execFile("git", ["rev-parse", "--git-common-dir"], {
+            cwd: projectRoot,
+        });
+        common = resolve(projectRoot, result.stdout.trim());
+    }
+    catch (cause) {
+        // A non-Git project still keeps its local Fungi store.
+        if (cause instanceof Error && "code" in cause && cause.code === 128)
+            return;
+        throw cause;
+    }
+    const info = join(common, "info");
+    await mkdir(info, { recursive: true });
+    const exclude = join(info, "exclude");
+    const current = await readFile(exclude, "utf8").catch((cause) => {
+        if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+            return "";
+        throw cause;
+    });
+    if (current.split(/\r?\n/u).some((line) => line.trim() === excludeEntry))
+        return;
+    await appendFile(exclude, `${current !== "" && !current.endsWith("\n") ? "\n" : ""}${excludeEntry}\n`);
+}

package/dist/private-local-http-dispatch.d.ts

@@ -0,0 +1,5 @@
+export type RequestIdleClock = {
+    timeout: (request: Request, seconds: number) => void;
+};
+/** Bun's socket clock must stay off while a command or quiet SSE is pending. */
+export declare function dispatchPrivateLocalRequest(request: Request, clock: RequestIdleClock, fetch: (request: Request) => Response | Promise<Response>): Promise<Response>;

package/dist/private-local-http-dispatch.js

@@ -0,0 +1,14 @@
+/** Bun's socket clock must stay off while a command or quiet SSE is pending. */
+export async function dispatchPrivateLocalRequest(request, clock, fetch) {
+    clock.timeout(request, 0);
+    try {
+        const response = await fetch(request);
+        if (!response.headers.get("content-type")?.startsWith("text/event-stream"))
+            clock.timeout(request, 10);
+        return response;
+    }
+    catch (cause) {
+        clock.timeout(request, 10);
+        throw cause;
+    }
+}

package/dist/private-local-linux-sandbox.d.ts

@@ -0,0 +1,8 @@
+import { type LocalSandboxPolicy } from "./private-local-sandbox-policy.js";
+import type { LinuxSandboxPayload } from "./private-local-bwrap.js";
+/** Ordinary upstream bwrap argv. There is no approval or bare-command path. */
+export declare function linuxSandboxCommand(policy: LocalSandboxPolicy, payload: LinuxSandboxPayload, cwd: string, argv: readonly [string, ...string[]], host?: NodeJS.ProcessEnv): {
+    args: string[];
+    executable: string;
+    seccompFilter: Uint8Array;
+};

package/dist/private-local-linux-sandbox.js

@@ -0,0 +1,67 @@
+import { existsSync, mkdirSync, realpathSync, statSync, writeFileSync, } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { protectedSandboxPaths, } from "./private-local-sandbox-policy.js";
+/** Ordinary upstream bwrap argv. There is no approval or bare-command path. */
+export function linuxSandboxCommand(policy, payload, cwd, argv, host = process.env) {
+    const root = policy.writableRoot;
+    // Bind sources must exist. Only the trusted host prepares the reserved paths.
+    mkdirSync(join(root, ".fungi"), { recursive: true });
+    for (const git of policy.immovable) {
+        mkdirSync(join(git, "hooks"), { recursive: true });
+        for (const config of ["config", "config.worktree"])
+            if (!existsSync(join(git, config)))
+                writeFileSync(join(git, config), "", { flag: "wx" });
+    }
+    const args = [
+        "--unshare-all",
+        "--die-with-parent",
+        "--new-session",
+        "--seccomp",
+        "3",
+        "--ro-bind",
+        "/",
+        "/",
+        // Private system mounts precede the folder bind so /tmp projects survive.
+        "--tmpfs",
+        "/tmp",
+        "--tmpfs",
+        "/run",
+        "--dev",
+        "/dev",
+        "--proc",
+        "/proc",
+        "--bind",
+        root,
+        root,
+    ];
+    for (const path of policy.immovable)
+        args.push("--bind", path, path);
+    for (const path of protectedSandboxPaths(policy.readOnly))
+        args.push("--ro-bind", path, path);
+    if (existsSync("/var/run") && realpathSync("/var/run") !== "/run")
+        args.push("--tmpfs", realpathSync("/var/run"));
+    const runtime = host.XDG_RUNTIME_DIR;
+    if (runtime && isAbsolute(runtime) && existsSync(runtime))
+        args.push("--tmpfs", realpathSync(runtime));
+    // Stopgap masks, not an inventory of all possible host IPC. /run also
+    // covers the usual /var/run alias. These follow folder/protected binds so
+    // a selected socket inside the project is not exposed again by a later bind.
+    // Keep unusual selected SSH-agent paths
+    // and Docker Desktop sockets out without masking all of the user's HOME.
+    if (host.HOME && isAbsolute(host.HOME)) {
+        for (const path of [
+            join(host.HOME, ".docker", "run"),
+            join(host.HOME, ".docker", "desktop"),
+        ])
+            if (existsSync(path) && statSync(path).isDirectory())
+                args.push("--tmpfs", realpathSync(path));
+    }
+    const agentSocket = host.SSH_AUTH_SOCK;
+    if (agentSocket &&
+        isAbsolute(agentSocket) &&
+        existsSync(agentSocket) &&
+        statSync(agentSocket).isSocket())
+        args.push("--ro-bind", "/dev/null", realpathSync(agentSocket));
+    args.push("--chdir", cwd, "--", ...argv);
+    return { ...payload, args };
+}

package/dist/private-local-mail.d.ts

@@ -0,0 +1,13 @@
+import type { BirdDogMail } from "@fungi.computer/bird-dog";
+import { type BirdDogEffect } from "@fungi.computer/bird-dog/effect";
+import type { PrivateSqliteDatabase } from "./private-sqlite-owner.js";
+import type { Accepted } from "@fungi.computer/shiitake";
+export type PrivateLocalMailOptions = Readonly<{
+    /** Admit one reply at its addressed Agent; a rejection retries later. */
+    deliver: (mail: BirdDogMail) => Promise<Accepted>;
+    scheduleWake?: (at: number) => void;
+    now?: () => number;
+}>;
+/** Whether this Agent's outbox still owes any reply a delivery attempt. */
+export declare function hasPrivateLocalPendingMail(database: PrivateSqliteDatabase): Promise<boolean>;
+export declare function createPrivateLocalMailRoom(database: PrivateSqliteDatabase, options: PrivateLocalMailOptions): BirdDogEffect;

package/dist/private-local-mail.js

@@ -0,0 +1,77 @@
+import { BirdDogError, hasPendingDelivery, make as makeBirdDog, } from "@fungi.computer/bird-dog/effect";
+import * as Effect from "effect/Effect";
+import { messageAuthor } from "@fungi.computer/agar/agents";
+import { z } from "zod";
+const outboxValue = z.object({ value: z.string() });
+const outboxRows = z.array(z.object({ key: z.string(), value: z.string() }).readonly());
+function storeFailure(cause) {
+    return new BirdDogError("local mail store is unavailable", { cause });
+}
+/** The Agent store's BirdDog outbox rows. */
+function localOutbox(database) {
+    return {
+        read: (key) => Effect.try({
+            try: () => {
+                const statement = database.prepare("SELECT value FROM local_birddog_outbox WHERE key = ?");
+                const row = outboxValue.safeParse(statement.get(key));
+                return row.success ? row.data.value : undefined;
+            },
+            catch: storeFailure,
+        }),
+        put: (key, value) => Effect.try({
+            try: () => {
+                database
+                    .prepare("INSERT INTO local_birddog_outbox (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
+                    .run(key, value);
+            },
+            catch: storeFailure,
+        }),
+        list: (limit, afterKey) => Effect.try({
+            try: () => outboxRows.parse(database
+                .prepare("SELECT key, value FROM local_birddog_outbox WHERE (? IS NULL OR key > ?) ORDER BY key LIMIT ?")
+                .all(afterKey ?? null, afterKey ?? null, limit)),
+            catch: storeFailure,
+        }),
+        delete: (key) => Effect.try({
+            try: () => {
+                database
+                    .prepare("DELETE FROM local_birddog_outbox WHERE key = ?")
+                    .run(key);
+            },
+            catch: storeFailure,
+        }),
+    };
+}
+/** Whether this Agent's outbox still owes any reply a delivery attempt. */
+export function hasPrivateLocalPendingMail(database) {
+    return Effect.runPromise(hasPendingDelivery(localOutbox(database)));
+}
+export function createPrivateLocalMailRoom(database, options) {
+    database.exec("CREATE TABLE IF NOT EXISTS local_birddog_outbox (key TEXT PRIMARY KEY NOT NULL, value TEXT NOT NULL)");
+    const room = Effect.runSync(makeBirdDog({
+        outbox: localOutbox(database),
+        post: (mail) => Effect.tryPromise({
+            try: async () => {
+                await options.deliver(mail);
+                return true;
+            },
+            catch: (cause) => new BirdDogError("local recipient rejected mail", { cause }),
+        }).pipe(Effect.catch((cause) => Effect.logError("Local mail recipient rejected delivery", cause).pipe(Effect.as(false)))),
+        scheduleWake: (at) => Effect.sync(() => options.scheduleWake?.(at)),
+        now: options.now ?? (() => Date.now()),
+    }));
+    return {
+        ...room,
+        fanOut: (settlement) => {
+            if (settlement.job.outcome !== "cancelled")
+                return room.fanOut(settlement);
+            const author = messageAuthor(settlement.meta);
+            return room.fanOut({
+                ...settlement,
+                content: author === undefined
+                    ? "Work cancelled."
+                    : `Work cancelled by ${author.name}.`,
+            });
+        },
+    };
+}

package/dist/private-local-mesh-enrollment.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import { type LocalMachineEnrollmentAccount } from "./private-local-mesh-record.js";
+export declare const localMeshJoinSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    origin: z.ZodURL;
+    invocationRoot: z.ZodString;
+    machineLabel: z.ZodString;
+    agents: z.ZodArray<z.ZodString>;
+    kind: z.ZodLiteral<"oauth">;
+    teamId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    origin: z.ZodURL;
+    invocationRoot: z.ZodString;
+    machineLabel: z.ZodString;
+    agents: z.ZodArray<z.ZodString>;
+    kind: z.ZodLiteral<"oyster-key">;
+    key: z.ZodString;
+}, z.core.$strict>], "kind">;
+/**
+ * Persist the device pin before authenticated enrollment I/O. This is enrollment
+ * only: it does not report a socket, command Accepted or connected mesh.
+ */
+export declare function enrollPrivateLocalMesh(raw: z.infer<typeof localMeshJoinSchema>, options: {
+    account: LocalMachineEnrollmentAccount;
+    credentialPath: string;
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
+}): Promise<{
+    state: string;
+    deviceId: string;
+    agents: {
+        selection: number;
+        agentId: string;
+    }[];
+}>;

package/dist/private-local-mesh-enrollment.js

@@ -0,0 +1,188 @@
+import { Buffer } from "node:buffer";
+import { generateKeyPairSync } from "node:crypto";
+import { realpath } from "node:fs/promises";
+import { basename, dirname, relative, isAbsolute, resolve } from "node:path";
+import { defineIdFamily } from "@fungi.computer/cairn/id";
+import { z } from "zod";
+import { readBoundedResponse } from "./private-bounded-response.js";
+import { fungiAccountFetch } from "./private-fungi-account.js";
+import { parseFungiMcpEndpoint } from "./private-fungi-mcp-endpoint.js";
+import { listPrivateLocalAgentStores, readPrivateLocalAgentProfile, } from "./private-local-session-discovery.js";
+import { machineBindingSchema, localMachineEnrollmentSchema, } from "./private-local-mesh-record.js";
+const id = z.string().min(1).max(256);
+const joinCommon = z.strictObject({
+    origin: z.url(),
+    invocationRoot: z.string().min(1).max(4096),
+    machineLabel: z.string().trim().min(1).max(256),
+    agents: z
+        .array(id)
+        .max(256)
+        .refine((agents) => new Set(agents).size === agents.length),
+});
+export const localMeshJoinSchema = z.discriminatedUnion("kind", [
+    joinCommon.extend({ kind: z.literal("oauth"), teamId: id }),
+    joinCommon.extend({
+        kind: z.literal("oyster-key"),
+        key: z.string().startsWith("oyk_").min(5).max(4096),
+    }),
+]);
+const responseSchema = z.strictObject({
+    kind: z.literal("joined"),
+    deviceId: id,
+    agents: z.array(machineBindingSchema).max(256),
+});
+const oysterResponseSchema = responseSchema.extend({ scopeId: id });
+const requests = defineIdFamily({
+    family: "local-machine-enrollment",
+    version: 1,
+    kinds: { join: { prefix: "machine_join" } },
+});
+function deviceKey() {
+    const pair = generateKeyPairSync("ed25519");
+    const jwk = z
+        .object({ x: z.string() })
+        .parse(pair.publicKey.export({ format: "jwk" }));
+    return {
+        publicKey: Buffer.from(jwk.x, "base64url").toString("base64"),
+        privateKey: pair.privateKey
+            .export({ format: "der", type: "pkcs8" })
+            .toString("base64"),
+    };
+}
+/**
+ * Persist the device pin before authenticated enrollment I/O. This is enrollment
+ * only: it does not report a socket, command Accepted or connected mesh.
+ */
+export async function enrollPrivateLocalMesh(raw, options) {
+    const input = localMeshJoinSchema.parse(raw);
+    const endpoint = parseFungiMcpEndpoint(input.origin);
+    if (endpoint.pathname !== "/")
+        throw new Error("Mesh enrollment needs an origin");
+    const origin = endpoint.origin;
+    const authority = {
+        kind: input.kind === "oauth" ? "oauth" : "oyster",
+        origin,
+    };
+    if (input.kind === "oauth") {
+        const saved = await options.account.read();
+        if (!saved.some((record) => record.kind === "oauth" && record.origin === origin))
+            throw new Error("Sign in to this Fungi issuer before joining a machine");
+    }
+    const invocationRoot = await realpath(resolve(input.invocationRoot));
+    const stores = await listPrivateLocalAgentStores(invocationRoot);
+    const selected = input.agents.map((localAgentId) => {
+        const databasePath = stores.find((path) => basename(dirname(path)) === localAgentId);
+        if (databasePath === undefined)
+            throw new Error("The selected Agent is not active in this project");
+        const within = relative(invocationRoot, databasePath);
+        if (isAbsolute(within) || within === ".." || within.startsWith("../"))
+            throw new Error("The selected Agent is outside this project");
+        const profile = readPrivateLocalAgentProfile(databasePath);
+        return { localAgentId, databasePath, name: profile.name ?? localAgentId };
+    });
+    const proposed = {
+        state: "pending",
+        requestId: requests.join.generate(),
+        target: input.kind === "oauth"
+            ? { kind: "oauth", teamId: input.teamId }
+            : { kind: "oyster" },
+        invocationRoot,
+        machineLabel: input.machineLabel,
+        ...deviceKey(),
+        agents: selected,
+    };
+    let chosen;
+    await options.account.update(authority, (current) => {
+        const prior = current.find((record) => JSON.stringify(record.target) === JSON.stringify(proposed.target));
+        if (prior !== undefined) {
+            if (prior.invocationRoot !== invocationRoot ||
+                prior.machineLabel !== input.machineLabel ||
+                JSON.stringify(prior.agents) !== JSON.stringify(selected))
+                throw new Error("This scope already has another machine enrollment intent");
+            chosen = prior;
+            return [...current];
+        }
+        chosen = proposed;
+        return [...current, proposed];
+    });
+    if (chosen === undefined)
+        throw new Error("The credential owner did not persist an enrollment");
+    const record = chosen;
+    if (record.state === "enrolled")
+        return {
+            state: "enrolled",
+            deviceId: record.deviceId,
+            agents: record.bindings,
+        };
+    const url = new URL(input.kind === "oauth"
+        ? `/api/teams/${encodeURIComponent(input.teamId)}/local/mesh/join`
+        : "/local/mesh/join", origin);
+    // Only OAuth owns refresh/retry. An Oyster key is ephemeral enrollment
+    // authority; neither the credential owner nor later Seam dials receive it.
+    const request = input.kind === "oauth"
+        ? fungiAccountFetch(origin, options)
+        : (options.fetch ?? globalThis.fetch);
+    const headers = new Headers({ "content-type": "application/json" });
+    if (input.kind === "oyster-key")
+        headers.set("Authorization", `Bearer ${input.key}`);
+    const init = {
+        method: "POST",
+        headers,
+        redirect: "error",
+        body: JSON.stringify({
+            requestId: record.requestId,
+            machineLabel: record.machineLabel,
+            publicKey: record.publicKey,
+            // Local directory selectors and database paths remain private.
+            agents: record.agents.map(({ name }) => ({ name })),
+        }),
+    };
+    if (options.signal !== undefined)
+        init.signal = options.signal;
+    let response;
+    try {
+        response = await request(url, init);
+    }
+    finally {
+        if (input.kind === "oyster-key") {
+            // Release Local-owned references before decoding/storing the response.
+            // This cannot erase immutable string bytes or caller/fetch-owned copies.
+            headers.delete("Authorization");
+            input.key = "";
+        }
+    }
+    if (!response.ok)
+        throw new Error(`Machine enrollment refused with HTTP ${String(response.status)}`);
+    const payload = JSON.parse(await readBoundedResponse(response, 64 * 1024, "Machine enrollment"));
+    const result = input.kind === "oauth"
+        ? { ...responseSchema.parse(payload), scopeId: input.teamId }
+        : oysterResponseSchema.parse(payload);
+    if (result.agents.length !== record.agents.length ||
+        result.agents.some((binding, index) => binding.selection !== index) ||
+        new Set(result.agents.map((binding) => binding.agentId)).size !==
+            result.agents.length)
+        throw new Error("Machine enrollment does not match the selected Agent set");
+    const enrolled = localMachineEnrollmentSchema.parse({
+        ...record,
+        state: "enrolled",
+        deviceId: result.deviceId,
+        scopeId: result.scopeId,
+        bindings: result.agents,
+    });
+    await options.account.update(authority, (current) => {
+        const matching = current.find((candidate) => candidate.requestId === record.requestId);
+        if (matching === undefined)
+            throw new Error("Machine enrollment was removed before acknowledgment");
+        if (matching.state === "enrolled" &&
+            (matching.deviceId !== result.deviceId ||
+                matching.scopeId !== result.scopeId ||
+                JSON.stringify(matching.bindings) !== JSON.stringify(result.agents)))
+            throw new Error("Home changed an acknowledged machine enrollment");
+        return current.map((candidate) => candidate.requestId === record.requestId ? enrolled : candidate);
+    });
+    return {
+        state: "enrolled",
+        deviceId: result.deviceId,
+        agents: result.agents,
+    };
+}

package/dist/private-local-mesh-links.d.ts

@@ -0,0 +1,21 @@
+import type { PostEnvelope, PostDeliveryResult } from "@fungi.computer/carrier/post";
+import type { LocalMachineEnrollment, MachineEnrollmentAuthority } from "./private-local-mesh-record.js";
+export type EnrolledLocalMachine = Extract<LocalMachineEnrollment, {
+    state: "enrolled";
+}> & {
+    authority: MachineEnrollmentAuthority;
+};
+export declare const localMeshLinkKey: (record: EnrolledLocalMachine) => string;
+/**
+ * Service-owned native I/O only. The account owns pins, Carrier owns retry
+ * custody, and the addressed runtime owns acceptance. No mail is queued here.
+ */
+export declare function createLocalMeshLinks(options: {
+    credentialPath: string;
+    receive: (record: EnrolledLocalMachine, envelope: PostEnvelope) => Promise<PostDeliveryResult>;
+}): {
+    refresh: () => Promise<void>;
+    isCurrent: (record: EnrolledLocalMachine) => Promise<boolean>;
+    deliver: (record: EnrolledLocalMachine, envelope: PostEnvelope) => Promise<PostDeliveryResult>;
+    close: () => Promise<void>;
+};