@gajae-code/coding-agent 0.10.2 → 0.11.0

package/src/sdk/broker/transport.ts

@@ -0,0 +1,125 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import type { ServerWebSocket } from "bun";
+import type { Broker } from "./broker";
+
+const PROTOCOL_VERSION = 3;
+/** Maximum UTF-8 byte length accepted for a single broker JSON frame. */
+const MAX_BROKER_JSON_FRAME_BYTES = 4 * 1024 * 1024;
+
+const BROKER_OPERATIONS = new Set([
+	"session.list",
+	"session.get_endpoint",
+	"session.create",
+	"session.fork",
+	"session.resume",
+	"session.close",
+	"session.delete",
+]);
+type RequestInput = Record<string, unknown>;
+type BrokerRequest = {
+	type: "broker_request";
+	id?: string;
+	operation?: string;
+	input?: RequestInput;
+	idempotencyKey?: string;
+};
+function digest(value: string): Buffer {
+	return createHash("sha256").update(value).digest();
+}
+function tokenMatches(expected: string, actual: string | null): boolean {
+	return actual !== null && timingSafeEqual(digest(expected), digest(actual));
+}
+function isInput(value: unknown): value is RequestInput {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function send(socket: ServerWebSocket<unknown>, frame: Record<string, unknown>): void {
+	socket.send(JSON.stringify(frame));
+}
+function sendError(socket: ServerWebSocket<unknown>, id: string | undefined, code: string, message: string): void {
+	send(socket, { type: "broker_response", ...(id === undefined ? {} : { id }), ok: false, error: { code, message } });
+}
+/** Loopback-only WebSocket transport for the agent-global SDK broker. */
+export class BrokerTransport {
+	readonly #broker: Broker;
+	readonly #token: string;
+	readonly #requestedPort: number;
+	#server: ReturnType<typeof Bun.serve> | null = null;
+	#port = 0;
+	constructor(broker: Broker, token: string, port = 0) {
+		this.#broker = broker;
+		this.#token = token;
+		this.#requestedPort = port;
+	}
+	get port(): number {
+		if (!this.#server) throw new Error("Broker transport is not running");
+		return this.#port;
+	}
+	async start(): Promise<number> {
+		if (this.#server) return this.#port;
+		this.#server = Bun.serve({
+			hostname: "127.0.0.1",
+			port: this.#requestedPort,
+			fetch: request => {
+				const url = new URL(request.url);
+				if (request.headers.get("upgrade")?.toLowerCase() !== "websocket")
+					return new Response("Upgrade Required", { status: 426 });
+				if (!tokenMatches(this.#token, url.searchParams.get("token")))
+					return new Response("Unauthorized", { status: 401 });
+				if (!this.#server?.upgrade(request, { data: undefined }))
+					return new Response("WebSocket upgrade failed", { status: 400 });
+				return undefined;
+			},
+			websocket: {
+				maxPayloadLength: MAX_BROKER_JSON_FRAME_BYTES * 2,
+				open: socket => send(socket, { type: "broker_hello", protocolVersion: PROTOCOL_VERSION }),
+				message: (socket, message) => void this.#handleMessage(socket, message),
+			},
+		});
+		this.#port = this.#server.port ?? 0;
+		return this.#port;
+	}
+	async stop(): Promise<void> {
+		const server = this.#server;
+		this.#server = null;
+		if (server) await server.stop(true);
+	}
+	async #handleMessage(socket: ServerWebSocket<unknown>, raw: string | Buffer): Promise<void> {
+		if (Buffer.byteLength(raw) > MAX_BROKER_JSON_FRAME_BYTES) {
+			sendError(socket, undefined, "payload_too_large", "broker JSON frame exceeds 4 MiB limit");
+			return;
+		}
+		let frame: BrokerRequest;
+		try {
+			frame = JSON.parse(raw.toString()) as BrokerRequest;
+		} catch {
+			sendError(socket, undefined, "invalid_input", "malformed JSON");
+			return;
+		}
+		if (frame?.type !== "broker_request") {
+			sendError(socket, undefined, "invalid_input", "invalid broker frame");
+			return;
+		}
+		if (typeof frame.id !== "string" || !frame.id) {
+			sendError(socket, frame.id, "invalid_input", "request id is required");
+			return;
+		}
+		if (typeof frame.operation !== "string" || !BROKER_OPERATIONS.has(frame.operation)) {
+			sendError(socket, frame.id, "unknown_operation", "unknown broker operation");
+			return;
+		}
+		if (frame.input === undefined || !isInput(frame.input)) {
+			sendError(socket, frame.id, "invalid_input", "request input must be an object");
+			return;
+		}
+		if (frame.idempotencyKey !== undefined && typeof frame.idempotencyKey !== "string") {
+			sendError(socket, frame.id, "invalid_input", "idempotencyKey must be a string");
+			return;
+		}
+		try {
+			const result = await this.#broker.handleRequest(frame.operation, frame.input, frame.idempotencyKey);
+			send(socket, { type: "broker_response", id: frame.id, ...result });
+		} catch {
+			sendError(socket, frame.id, "unavailable", "broker request failed");
+		}
+	}
+}

package/src/sdk/bus/chat-command-policy.ts

@@ -0,0 +1,107 @@
+import { validateAdapterSecretFields } from "../protocol/adapter-validation";
+import { type Adapter, OPERATIONS, type Operation, type OperationKind } from "../protocol/operation-registry";
+
+export type ChatTransport = Extract<Adapter, "telegram" | "discord" | "slack">;
+export type ChatOperationDisposition = "allowed" | "unsupported_on_chat";
+
+export interface ChatCommandError {
+	code: "unsupported_on_chat" | "secret_input_forbidden";
+	message: string;
+}
+
+export type ChatCommandDecision = { ok: true } | { ok: false; error: ChatCommandError };
+
+export interface ChatOperationRequest {
+	kind: OperationKind;
+	operation: string;
+	input?: unknown;
+}
+
+const EXPLICITLY_PROHIBITED_OPERATION_IDS = new Set(["C25", "C39", "C40", "G02"]);
+
+function isAllowedOnChat(transport: ChatTransport, operation: Operation): boolean {
+	return (
+		!EXPLICITLY_PROHIBITED_OPERATION_IDS.has(operation.id) &&
+		(operation.adapterDispositions[transport] === "generic_safe" ||
+			operation.adapterDispositions[transport] === "native_alias")
+	);
+}
+
+function buildChatOperationPolicy(transport: ChatTransport): Readonly<Record<string, ChatOperationDisposition>> {
+	const policy: Record<string, ChatOperationDisposition> = {};
+	for (const operation of OPERATIONS)
+		policy[operation.id] = isAllowedOnChat(transport, operation) ? "allowed" : "unsupported_on_chat";
+	return policy;
+}
+
+/**
+ * Chat authorization follows each transport's canonical registry disposition.
+ * Explicit policy prohibitions remain as defense in depth for shell execution,
+ * callback-provider registration, and endpoint credentials.
+ */
+export const CHAT_OPERATION_POLICY: Readonly<
+	Record<ChatTransport, Readonly<Record<string, ChatOperationDisposition>>>
+> = {
+	telegram: buildChatOperationPolicy("telegram"),
+	discord: buildChatOperationPolicy("discord"),
+	slack: buildChatOperationPolicy("slack"),
+};
+
+function unsupported(): ChatCommandDecision {
+	return { ok: false, error: { code: "unsupported_on_chat", message: "This operation is not supported on chat." } };
+}
+
+/** Reject unsafe or unknown commands before their SDK request can be sent. */
+export function authorizeChatOperation(transport: ChatTransport, request: ChatOperationRequest): ChatCommandDecision {
+	const operation = OPERATIONS.find(
+		candidate => candidate.kind === request.kind && candidate.sdkId === request.operation,
+	);
+	if (!operation) return unsupported();
+	if (validateAdapterSecretFields(operation.sdkId, (request.input ?? {}) as Record<string, unknown>)) {
+		return {
+			ok: false,
+			error: { code: "secret_input_forbidden", message: "Secret configuration input is forbidden on chat." },
+		};
+	}
+	return CHAT_OPERATION_POLICY[transport][operation.id] === "allowed" ? { ok: true } : unsupported();
+}
+
+/** Execute only an authorized command, ensuring rejected payloads produce no SDK send. */
+export async function sendAuthorizedChatOperation<T>(
+	transport: ChatTransport,
+	request: ChatOperationRequest,
+	send: () => Promise<T>,
+): Promise<{ ok: true; result: T } | { ok: false; error: ChatCommandError }> {
+	const decision = authorizeChatOperation(transport, request);
+	if (!decision.ok) return decision;
+	return { ok: true, result: await send() };
+}
+
+const BODY_BEARING_QUERY_OPERATIONS = new Set([
+	"transcript.body",
+	"context.get",
+	"diff.read_hunk",
+	"session.last_assistant",
+	"resource.body",
+	"artifact.read",
+]);
+
+export type ChatCommandOutcome =
+	| { ok: true; result: unknown }
+	| { ok: false; error: { code: string; message: string } };
+
+/**
+ * The chat transport is an untrusted presentation surface, not a general SDK
+ * result renderer. Never serialize SDK result bodies or provider error text.
+ */
+export function projectChatCommandOutcome(
+	request: Pick<ChatOperationRequest, "kind" | "operation">,
+	outcome: ChatCommandOutcome,
+): Record<string, unknown> {
+	if (!outcome.ok)
+		return { ok: false, error: { code: outcome.error.code, message: "Command could not be completed." } };
+	if (request.kind === "query" && BODY_BEARING_QUERY_OPERATIONS.has(request.operation)) {
+		return { ok: true, result: { operation: request.operation, status: "content_withheld" } };
+	}
+	return { ok: true, result: { operation: request.operation, status: "completed" } };
+}

package/src/sdk/bus/chat-daemon-cli.ts

@@ -0,0 +1,214 @@
+import * as crypto from "node:crypto";
+import * as path from "node:path";
+import {
+	acquireChatDaemonOwnership,
+	type ChatDaemonKind,
+	clearChatDaemonControlRequest,
+	readChatDaemonControlRequest,
+	readChatDaemonState,
+	releaseChatDaemonOwnership,
+	renewChatDaemonHeartbeat,
+} from "./chat-daemon-control";
+import { type ChatDaemonRuntimeConfig, ChatDaemonRuntime as DefaultChatDaemonRuntime } from "./chat-daemon-runtime";
+import {
+	isDiscordConfigured,
+	isSlackConfigured,
+	loadNotificationConfigFile,
+	notificationConfigFromFile,
+} from "./config";
+
+export interface ChatDaemonRuntimeHandle {
+	start(): Promise<void>;
+	stop(): Promise<void>;
+	transportHealthy?(): boolean;
+}
+
+export interface RunChatDaemonInternalDeps {
+	processPid?: number;
+	pidAlive?: (pid: number) => boolean;
+	createRuntime?: (input: {
+		kind: ChatDaemonKind;
+		agentDir: string;
+		config: ChatDaemonConfig;
+	}) => Promise<ChatDaemonRuntimeHandle> | ChatDaemonRuntimeHandle;
+	setInterval?: typeof setInterval;
+	clearInterval?: typeof clearInterval;
+}
+
+export type ChatDaemonConfig = ChatDaemonRuntimeConfig;
+
+function argValue(argv: string[], name: string): string | undefined {
+	const index = argv.indexOf(name);
+	return index >= 0 ? argv[index + 1] : undefined;
+}
+
+function defaultPidAlive(pid: number): boolean {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+async function loadConfig(agentDir: string, kind: ChatDaemonKind): Promise<ChatDaemonConfig | undefined> {
+	const loaded = loadNotificationConfigFile(agentDir);
+	if (loaded.status === "not-found") return undefined;
+	if (loaded.status === "error") throw loaded.error;
+	const config = notificationConfigFromFile(loaded.value);
+	if (!config.enabled) return undefined;
+	if (kind === "discord") {
+		if (
+			!isDiscordConfigured({
+				...config,
+				sessionScope: "all",
+				idleTimeoutMs: 60_000,
+				rich: { enabled: true },
+				richDraft: { enabled: false },
+				topics: { nameTemplate: undefined },
+			})
+		) {
+			throw new Error("Discord notifications are enabled but configuration is incomplete");
+		}
+		const discord = config.discord as {
+			botToken: string;
+			applicationId: string;
+			guildId: string;
+			parentChannelId: string;
+		};
+		const { botToken, applicationId, guildId, parentChannelId } = discord;
+		const identity = crypto
+			.createHash("sha256")
+			.update(
+				[botToken, applicationId, guildId, parentChannelId, String(config.redact), config.verbosity].join("\0"),
+			)
+			.digest("hex")
+			.slice(0, 16);
+		return {
+			identity,
+			notifications: { discord: { botToken, applicationId, guildId, parentChannelId } },
+			presentation: { redact: config.redact, verbosity: config.verbosity },
+		};
+	}
+	if (
+		!isSlackConfigured({
+			...config,
+			sessionScope: "all",
+			idleTimeoutMs: 60_000,
+			rich: { enabled: true },
+			richDraft: { enabled: false },
+			topics: { nameTemplate: undefined },
+		})
+	) {
+		throw new Error("Slack notifications are enabled but configuration is incomplete");
+	}
+	const slack = config.slack as {
+		botToken: string;
+		appToken: string;
+		workspaceId: string;
+		channelId: string;
+		authorizedUserId?: string;
+	};
+	const { botToken, appToken, workspaceId, channelId, authorizedUserId } = slack;
+	const identity = crypto
+		.createHash("sha256")
+		.update(
+			[
+				botToken,
+				appToken,
+				workspaceId,
+				channelId,
+				authorizedUserId ?? "",
+				String(config.redact),
+				config.verbosity,
+			].join("\0"),
+		)
+		.digest("hex")
+		.slice(0, 16);
+	return {
+		identity,
+		notifications: { slack: { botToken, appToken, workspaceId, channelId, authorizedUserId } },
+		presentation: { redact: config.redact, verbosity: config.verbosity },
+	};
+}
+
+function ownerPid(ownerId: string): number | undefined {
+	const match = /^(\d+)(?:-|$)/.exec(ownerId);
+	const pid = Number(match?.[1]);
+	return Number.isSafeInteger(pid) && pid > 0 ? pid : undefined;
+}
+
+function defaultRuntime(input: {
+	kind: ChatDaemonKind;
+	agentDir: string;
+	config: ChatDaemonConfig;
+}): ChatDaemonRuntimeHandle {
+	return new DefaultChatDaemonRuntime(input);
+}
+
+/** Hidden worker entrypoint. It owns only lock/state/control lifecycle; transport creation remains injectable. */
+export async function runChatDaemonInternal(
+	kind: ChatDaemonKind,
+	argv: string[],
+	deps: RunChatDaemonInternalDeps = {},
+): Promise<void> {
+	const agentDir =
+		argValue(argv, "--agent-dir") ?? process.env.GJC_CODING_AGENT_DIR ?? path.join(process.cwd(), ".gjc", "agent");
+	const ownerId = argValue(argv, "--owner-id");
+	if (!ownerId) throw new Error("missing --owner-id");
+	const pid = ownerPid(ownerId);
+	if (pid !== undefined && !(deps.pidAlive ?? defaultPidAlive)(pid)) return;
+	const config = await loadConfig(agentDir, kind);
+	if (!config) return;
+	if (
+		!(await acquireChatDaemonOwnership({ agentDir, kind, ownerId, pid: deps.processPid, identity: config.identity }))
+	)
+		return;
+
+	let incarnation: string | undefined;
+	let runtime: ChatDaemonRuntimeHandle | undefined;
+	let interval: ReturnType<typeof setInterval> | undefined;
+	let stopping = false;
+	const stop = (): void => {
+		stopping = true;
+	};
+	try {
+		incarnation = (await readChatDaemonState(agentDir, kind))?.incarnation;
+		if (!incarnation) throw new Error("chat daemon ownership state is missing an incarnation");
+		runtime = await (deps.createRuntime?.({ kind, agentDir, config }) ?? defaultRuntime({ kind, agentDir, config }));
+		const renewHeartbeat = async (): Promise<void> => {
+			await renewChatDaemonHeartbeat({
+				agentDir,
+				kind,
+				ownerId,
+				pid: deps.processPid,
+				incarnation,
+				transportHealthy: runtime?.transportHealthy?.() ?? true,
+			});
+		};
+		process.once("SIGTERM", stop);
+		process.once("SIGINT", stop);
+		interval = (deps.setInterval ?? setInterval)(() => {
+			void renewHeartbeat();
+		}, 5_000);
+		await runtime.start();
+		await renewHeartbeat();
+		while (!stopping) {
+			const request = await readChatDaemonControlRequest(agentDir, kind);
+			if (request?.ownerId === ownerId && request.incarnation === incarnation) {
+				await clearChatDaemonControlRequest(agentDir, kind, request.requestId);
+				break;
+			}
+			await new Promise(resolve => setTimeout(resolve, 100));
+		}
+	} finally {
+		if (interval !== undefined) (deps.clearInterval ?? clearInterval)(interval);
+		process.off("SIGTERM", stop);
+		process.off("SIGINT", stop);
+		try {
+			await runtime?.stop();
+		} finally {
+			await releaseChatDaemonOwnership({ agentDir, kind, ownerId, pid: deps.processPid, incarnation });
+		}
+	}
+}