@fungi.computer/truffle 0.1.1 → 0.2.0

package/dist/seatbelt/safe-base.sbpl

@@ -0,0 +1,79 @@
+; Derived from OpenAI Codex, Apache-2.0, Copyright 2025 OpenAI.
+; codex-rs/sandboxing/src/seatbelt_base_policy.sbpl and seatbelt.rs
+; rust-v0.162.1 (7a078f6bb4).
+; Changed by Botanical: no network fragments, PTY/device write grants, shared
+; memory or power-management grants. Reads and parameterized folder/temp writes
+; are composed by private-local-seatbelt.ts. Protect .fungi and Git hooks/config,
+; not all of .git. Denials carry fungi-safe for diagnostic correlation.
+;
+; inspired by Chrome's sandbox policy:
+; https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
+; https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/renderer.sb;l=64;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd
+(version 1)
+(deny default (with message "fungi-safe"))
+; Automation must not ask an unsandboxed application to act on our behalf.
+(deny appleevent-send (with message "fungi-safe"))
+(allow process-exec)
+(allow process-fork)
+(allow signal (target same-sandbox))
+(allow process-info* (target same-sandbox))
+(allow file-write-data
+  (require-all (path "/dev/null") (vnode-type CHARACTER-DEVICE)))
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.model")
+  (sysctl-name "hw.memsize")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name-prefix "hw.optional.arm.")
+  (sysctl-name-prefix "hw.optional.armv8_")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.pagesize")
+  (sysctl-name "hw.physicalcpu")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.logicalcpu")
+  (sysctl-name "hw.cpufrequency")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "machdep.cpu.brand_string")
+  (sysctl-name "kern.argmax")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.maxproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.sysv.semmns")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name "vm.loadavg")
+  (sysctl-name-prefix "hw.perflevel")
+  (sysctl-name-prefix "kern.proc.pgrp.")
+  (sysctl-name-prefix "kern.proc.pid.")
+  (sysctl-name-prefix "net.routetable."))
+(allow sysctl-write (sysctl-name "kern.grade_cputype"))
+(allow iokit-open (iokit-registry-entry-class "RootDomainUserClient"))
+; The only Mach service allowed: user lookup used by shell/git (Codex base).
+; Do not compose Codex's preferences, TLS trust, network or platform fragments:
+; those grant services which a network-free command does not need.
+; Needed to look up user info, see https://crbug.com/792228
+(allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo"))
+(allow ipc-posix-sem)

package/dist/subscription-activation.d.ts

@@ -0,0 +1,9 @@
+/** Fixed categories only: neither parser diagnostics nor filesystem causes escape. */
+export declare class CredentialActivationError extends Error {
+    readonly category: "invalid-input" | "conflict" | "store-failure" | "identity-unavailable";
+    constructor(category: "invalid-input" | "conflict" | "store-failure" | "identity-unavailable");
+}
+/** The credential owner performs a provider-scoped CAS under its refresh lock. */
+export declare function activateSubscriptionCredential(provider: string, input: AsyncIterable<Uint8Array>, options?: {
+    credentialPath?: string;
+}): Promise<void>;

package/dist/subscription-activation.js

@@ -0,0 +1,62 @@
+import { isDeepStrictEqual } from "node:util";
+import { z } from "zod";
+import { capturePrivateLocalConfigRoot } from "./private-local-config-root.js";
+import { createPrivateCredentialStore, oauthCredentialSchema, } from "./private-file-credential-store.js";
+const maximumInputBytes = 256 * 1024;
+const providerSchema = z.enum(["anthropic", "openai"]);
+const subscriptionSchema = oauthCredentialSchema.refine((value) => value.access.length > 0 && value.refresh.length > 0);
+const activationSchema = z.strictObject({
+    expected: subscriptionSchema.nullable(),
+    credential: subscriptionSchema,
+});
+/** Fixed categories only: neither parser diagnostics nor filesystem causes escape. */
+export class CredentialActivationError extends Error {
+    category;
+    constructor(category) {
+        super(`Credential activation: ${category}`);
+        this.category = category;
+        this.name = "CredentialActivationError";
+    }
+}
+/** The credential owner performs a provider-scoped CAS under its refresh lock. */
+export async function activateSubscriptionCredential(provider, input, options = {}) {
+    const providerId = providerSchema.safeParse(provider);
+    if (!providerId.success)
+        throw new CredentialActivationError("invalid-input");
+    const credentialPath = options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath;
+    const chunks = [];
+    let size = 0;
+    try {
+        for await (const chunk of input) {
+            size += chunk.byteLength;
+            if (size > maximumInputBytes)
+                throw new CredentialActivationError("invalid-input");
+            chunks.push(chunk);
+        }
+    }
+    catch {
+        throw new CredentialActivationError("invalid-input");
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        throw new CredentialActivationError("invalid-input");
+    }
+    const parsed = activationSchema.safeParse(decoded);
+    if (!parsed.success)
+        throw new CredentialActivationError("invalid-input");
+    try {
+        await createPrivateCredentialStore(credentialPath).modify(providerId.data, (current) => {
+            if (!isDeepStrictEqual(current ?? null, parsed.data.expected))
+                throw new CredentialActivationError("conflict");
+            return Promise.resolve(parsed.data.credential);
+        });
+    }
+    catch (error) {
+        if (error instanceof CredentialActivationError)
+            throw error;
+        throw new CredentialActivationError("store-failure");
+    }
+}

package/dist/subscription-identity.d.ts

@@ -0,0 +1,23 @@
+import type { OAuthAuth } from "@earendil-works/pi-ai";
+import type { FetchLike } from "@modelcontextprotocol/client";
+import { type OpenAIIdentityDetail } from "./private-openai-claims.js";
+import { CredentialActivationError } from "./subscription-activation.js";
+/** The sign-in proved no person; carries claim names only, never values. */
+export declare class OpenAIIdentityUnavailable extends CredentialActivationError {
+    readonly detail: OpenAIIdentityDetail;
+    constructor(detail: OpenAIIdentityDetail);
+}
+/**
+ * Pi owns OAuth mechanics. OpenAI identity is only the access token's issuer
+ * and subject. Anthropic retains its prepared profile account across refresh.
+ */
+export declare function retainSubscriptionIdentity(oauth: OAuthAuth, provider: "anthropic" | "openai"): OAuthAuth;
+/**
+ * Explicit import preparation, never an alternate login flow. Anthropic's
+ * opaque token requires its own profile. OpenAI's identity is the access
+ * token's issuer and subject; preparation only confirms them.
+ */
+export declare function prepareSubscriptionIdentity(provider: string, options?: {
+    credentialPath?: string;
+    fetch?: FetchLike;
+}): Promise<void>;

package/dist/subscription-identity.js

@@ -0,0 +1,124 @@
+import { z } from "zod";
+import { createPrivateCredentialStore } from "./private-file-credential-store.js";
+import { capturePrivateLocalConfigRoot } from "./private-local-config-root.js";
+import { readOpenAIPerson, } from "./private-openai-claims.js";
+import { CredentialActivationError } from "./subscription-activation.js";
+/** The sign-in proved no person; carries claim names only, never values. */
+export class OpenAIIdentityUnavailable extends CredentialActivationError {
+    detail;
+    constructor(detail) {
+        super("identity-unavailable");
+        this.detail = detail;
+        this.name = "OpenAIIdentityUnavailable";
+    }
+}
+const identitySchema = z.object({
+    accountId: z
+        .string()
+        .min(1)
+        .max(256)
+        .refine((value) => value.trim().length > 0),
+});
+const profileSchema = z.object({
+    account: z.object({ uuid: z.uuid() }),
+});
+async function readBoundedJson(response, schema) {
+    if (!response.ok || response.body === null) {
+        await response.body?.cancel();
+        throw new CredentialActivationError("identity-unavailable");
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            const value = z.instanceof(Uint8Array).parse(chunk.value);
+            size += value.byteLength;
+            if (size > 64 * 1024)
+                throw new CredentialActivationError("identity-unavailable");
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel();
+        reader.releaseLock();
+    }
+    const parsed = schema.safeParse(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+    return parsed.success ? parsed.data : undefined;
+}
+/**
+ * Pi owns OAuth mechanics. OpenAI identity is only the access token's issuer
+ * and subject. Anthropic retains its prepared profile account across refresh.
+ */
+export function retainSubscriptionIdentity(oauth, provider) {
+    const retained = {
+        ...oauth,
+        async refresh(credential, signal) {
+            const next = await oauth.refresh(credential, signal);
+            const identity = provider === "anthropic"
+                ? identitySchema.safeParse(credential)
+                : undefined;
+            return identity?.success === true
+                ? { ...next, accountId: identity.data.accountId }
+                : next;
+        },
+    };
+    if (provider === "anthropic")
+        return retained;
+    return {
+        ...retained,
+        async login(interaction, loginOptions) {
+            const credential = await oauth.login(interaction, loginOptions);
+            const person = readOpenAIPerson(credential.access);
+            if (person.kind === "unproven")
+                throw new OpenAIIdentityUnavailable(person.detail);
+            return credential;
+        },
+    };
+}
+/**
+ * Explicit import preparation, never an alternate login flow. Anthropic's
+ * opaque token requires its own profile. OpenAI's identity is the access
+ * token's issuer and subject; preparation only confirms them.
+ */
+export async function prepareSubscriptionIdentity(provider, options = {}) {
+    if (provider !== "anthropic" && provider !== "openai")
+        throw new CredentialActivationError("invalid-input");
+    const store = createPrivateCredentialStore(options.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath);
+    try {
+        await store.modify(provider, async (current) => {
+            if (current?.type !== "oauth")
+                throw new CredentialActivationError("invalid-input");
+            if (provider === "openai") {
+                // The access token's issuer and subject are the whole identity.
+                if (readOpenAIPerson(current.access).kind === "unproven")
+                    throw new CredentialActivationError("identity-unavailable");
+                return undefined;
+            }
+            if (identitySchema.safeParse(current).success)
+                return undefined;
+            if (current.expires <= Date.now())
+                throw new CredentialActivationError("invalid-input");
+            const response = await (options.fetch ?? globalThis.fetch)("https://api.anthropic.com/api/oauth/profile", {
+                headers: {
+                    Authorization: `Bearer ${current.access}`,
+                    "anthropic-beta": "oauth-2025-04-20",
+                },
+                redirect: "error",
+                signal: AbortSignal.timeout(10_000),
+            });
+            const profile = await readBoundedJson(response, profileSchema);
+            if (profile === undefined)
+                throw new CredentialActivationError("identity-unavailable");
+            return { ...current, accountId: profile.account.uuid };
+        });
+    }
+    catch (error) {
+        if (error instanceof CredentialActivationError)
+            throw error;
+        throw new CredentialActivationError("identity-unavailable");
+    }
+}

package/dist/subscription-turn.d.ts

@@ -0,0 +1,17 @@
+import { type CredentialStore, type Models } from "@earendil-works/pi-ai";
+export declare function registerSubscriptionTurnOwner(models: Models, store: CredentialStore): void;
+declare class SubscriptionTurnError extends Error {
+    readonly category = "account-switched-during-turn";
+    constructor();
+}
+/** One accepted user turn owns one in-memory credential view, never a new vault. */
+export declare function acquireSubscriptionTurn(models: Models, providerId: string, signal: AbortSignal): Promise<{
+    models: Models;
+    refusal: () => undefined;
+    release: () => Promise<void>;
+} | {
+    models: import("@earendil-works/pi-ai").MutableModels;
+    refusal: () => SubscriptionTurnError | undefined;
+    release: () => Promise<void>;
+}>;
+export {};

package/dist/subscription-turn.js

@@ -0,0 +1,143 @@
+import { isDeepStrictEqual } from "node:util";
+import { createModels, } from "@earendil-works/pi-ai";
+import { z } from "zod";
+import { readOpenAIPerson } from "./private-openai-claims.js";
+// Associate only Local-owned collections with their actual credential owner.
+// Caller-supplied Models retain their own auth contract; never guess a file path.
+const owners = new WeakMap();
+export function registerSubscriptionTurnOwner(models, store) {
+    owners.set(models, store);
+}
+class SubscriptionTurnError extends Error {
+    category = "account-switched-during-turn";
+    constructor() {
+        super("Account switched during this turn: retry.");
+        this.name = "SubscriptionTurnError";
+    }
+}
+const accountSchema = z.object({ accountId: z.string().min(1).max(256) });
+function identity(provider, credential) {
+    if (provider === "anthropic") {
+        const account = accountSchema.safeParse(credential);
+        return account.success ? { person: account.data.accountId } : undefined;
+    }
+    // Only the access token's issuer and subject identify an OpenAI person.
+    try {
+        const claims = readOpenAIPerson(credential.access);
+        return claims.kind === "unproven"
+            ? undefined
+            : {
+                person: JSON.stringify([claims.iss, claims.sub]),
+            };
+    }
+    catch {
+        // Never expose decoder diagnostics or accept an unprovable JWT identity.
+        throw new SubscriptionTurnError();
+    }
+}
+function sameAccount(provider, current, pin) {
+    if (current?.type !== "oauth")
+        return false;
+    const pinned = identity(provider, pin);
+    const now = identity(provider, current);
+    // OpenAI always needs a proven person. Anthropic's opaque grant may not yet
+    // have its profile account; exact credential equality still proves continuity.
+    if (pinned === undefined || now === undefined)
+        return provider !== "openai" && isDeepStrictEqual(current, pin);
+    return pinned.person === now.person;
+}
+/** One accepted user turn owns one in-memory credential view, never a new vault. */
+export async function acquireSubscriptionTurn(models, providerId, signal) {
+    const owner = owners.get(models);
+    if (owner === undefined ||
+        (providerId !== "anthropic" && providerId !== "openai"))
+        return {
+            models,
+            refusal: () => undefined,
+            release: () => Promise.resolve(),
+        };
+    const provider = models.getProvider(providerId);
+    if (provider === undefined)
+        throw new Error("Turn provider is not registered");
+    let pin = await owner.read(providerId, { signal });
+    let released = false;
+    let refusal;
+    const fail = () => {
+        refusal ??= new SubscriptionTurnError();
+        throw refusal;
+    };
+    const assertOpen = () => {
+        if (released)
+            throw new Error("Model turn already released");
+        if (refusal !== undefined)
+            throw refusal;
+    };
+    const adopt = (current) => {
+        assertOpen();
+        if (pin?.type !== "oauth")
+            return pin;
+        if (sameAccount(providerId, current, pin))
+            pin = current;
+        else if (pin.expires <= Date.now())
+            fail();
+        return pin;
+    };
+    const view = {
+        async read(id, options) {
+            assertOpen();
+            if (id !== providerId)
+                throw new Error("Turn provider changed");
+            options?.signal?.throwIfAborted();
+            if (pin?.type !== "oauth")
+                return pin;
+            return adopt(await owner.read(id, options));
+        },
+        list: () => Promise.resolve(pin === undefined ? [] : [{ providerId, type: pin.type }]),
+        async modify(id, callback, options) {
+            let resolved;
+            await owner.modify(id, async (current) => {
+                assertOpen();
+                if (id !== providerId || pin?.type !== "oauth")
+                    throw new Error("Turn OAuth credential unavailable");
+                if (!sameAccount(providerId, current, pin)) {
+                    // Pi may request a proactive refresh while the retired token is still
+                    // valid. Serve it without invoking refresh or modifying the active B.
+                    if (pin.expires <= Date.now())
+                        fail();
+                    resolved = pin;
+                    return undefined;
+                }
+                const next = await callback(current);
+                resolved = next ?? current;
+                return next;
+            }, options);
+            // Validate adoption only after the owner commits: cancellation or an
+            // unprovable/switched refresh must never discard a rotated refresh token.
+            // A released turn must not regain a pin.
+            return released ? resolved : adopt(resolved);
+        },
+        delete: () => Promise.reject(new Error("Turn credentials cannot be deleted")),
+    };
+    const scoped = createModels({ credentials: view });
+    scoped.setProvider(provider);
+    try {
+        // Pin/refresh at acquisition, not at the first tool iteration.
+        if ((await scoped.getAuth(providerId, { signal })) === undefined)
+            throw new Error("Turn provider is not signed in");
+    }
+    catch (error) {
+        pin = undefined;
+        if (refusal !== undefined)
+            throw refusal;
+        throw error;
+    }
+    return {
+        models: scoped,
+        refusal: () => refusal,
+        release: () => {
+            released = true;
+            pin = undefined;
+            return Promise.resolve();
+        },
+    };
+}

package/dist/team-apps.d.ts

@@ -1,6 +1,6 @@
 import { type ShiitakeSession } from "@fungi.computer/shiitake/client";
 import type { FetchLike } from "@modelcontextprotocol/client";
-import { type AppDirectory } from "@fungi.computer/oyster/shell/app-directory";
+import { type AppDirectory } from "@fungi.computer/nacre/app-directory";
 import { type GillRequest, type GillReply } from "@fungi.computer/gills";
 import { type FungiAccountTeam } from "./private-fungi-account.js";
 /** A selected Team's App reads. Credentials and selectors remain Local-owned. */
@@ -18,7 +18,7 @@ export type LocalTeamApps = Readonly<{
     requestGill: (surfaceId: string, selectors: GillRequest, signal?: AbortSignal) => Promise<GillReply>;
 }>;
 /** Pin this view to the saved account and Team; a later switch retires it. */
-export declare function openLocalTeamApps(options?: Readonly<{
+export declare function openLocalTeamApps(input?: Readonly<{
     credentialPath?: string;
     fetch?: FetchLike;
 }>): Promise<LocalTeamApps>;

package/dist/team-apps.js

@@ -1,11 +1,16 @@
 import { decodeGillRefusal } from "@fungi.computer/agar/gills";
 import { EventSource } from "eventsource";
 import { createShiitakeClient, } from "@fungi.computer/shiitake/client";
-import { appDirectoryResponseSchema, } from "@fungi.computer/oyster/shell/app-directory";
+import { capturePrivateLocalConfigRoot } from "./private-local-config-root.js";
+import { appDirectoryResponseSchema, } from "@fungi.computer/nacre/app-directory";
 import { createGillClient, } from "@fungi.computer/gills";
 import { fungiAccountFetch, readFungiAccountStatus, } from "./private-fungi-account.js";
 /** Pin this view to the saved account and Team; a later switch retires it. */
-export async function openLocalTeamApps(options = {}) {
+export async function openLocalTeamApps(input = {}) {
+    const options = {
+        ...input,
+        credentialPath: input.credentialPath ?? capturePrivateLocalConfigRoot().credentialPath,
+    };
     const account = await readFungiAccountStatus(options);
     if (account?.team === undefined)
         throw new Error("Sign in to Fungi and choose a Team to view its Apps");