@geminixiang/mikan 1.0.0-beta.4 → 1.0.0-beta.41

package/dist/config.js

@@ -1,10 +1,10 @@
 import { Type } from "@sinclair/typebox";
-import { existsSync, readFileSync, renameSync, rmSync } from "fs";
-import { homedir } from "os";
-import { basename, dirname, join, resolve } from "path";
-import { readEnv } from "./utils/env.js";
+import { existsSync, lstatSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { effectiveStateDir } from "./cli/arg-grammar.js";
+import { readEnv } from "./env-manifest.js";
 import { ensureDirExists, readJsonSchemaFileIfExists } from "./utils/file-guards.js";
-import { atomicWritePrivateFile } from "./utils/fs-atomic.js";
+import { atomicWritePrivateFile } from "./utils/file-guards.js";
 import * as log from "./log.js";
 export class MissingGlobalSettingsError extends Error {
     constructor(settingsPath) {
@@ -33,8 +33,8 @@ const ONBOARD_SETTINGS = {
             cpus: "2",
             memory: "4g",
         },
-        image: {
-            workspaceMount: "private",
+        workspace: {
+            doorPolicy: "isolated",
         },
         defaultSharedVault: "",
     },
@@ -50,6 +50,7 @@ const SettingsFileSchema = Type.Object({
             Type.Literal("medium"),
             Type.Literal("high"),
             Type.Literal("xhigh"),
+            Type.Literal("max"),
         ])),
         autoReply: Type.Optional(Type.Object({
             provider: Type.Optional(Type.String()),
@@ -72,21 +73,43 @@ const SettingsFileSchema = Type.Object({
         image: Type.Optional(Type.Object({
             workspaceMount: Type.Optional(Type.Union([Type.Literal("private"), Type.Literal("full")])),
         })),
+        workspace: Type.Optional(Type.Object({
+            doorPolicy: Type.Optional(Type.Union([Type.Literal("isolated"), Type.Literal("trusted")])),
+            layout: Type.Optional(Type.Union([
+                Type.Literal("conversation"),
+                Type.Literal("shared-support"),
+                Type.Literal("full"),
+            ])),
+        })),
         defaultSharedVault: Type.Optional(Type.String()),
     })),
     autoReply: Type.Optional(Type.Object({
         enabled: Type.Optional(Type.Boolean()),
         rules: Type.Optional(Type.Array(Type.String())),
     })),
+    /** Package sources for this scope; see `src/packages`. */
+    packages: Type.Optional(Type.Array(Type.String())),
 });
 function loadSettingsFile(settingsPath) {
+    if (existsSync(settingsPath)) {
+        try {
+            const raw = JSON.parse(readFileSync(settingsPath, "utf-8"));
+            if (raw?.sandbox?.gondolin?.remote !== undefined) {
+                throw new Error("sandbox.gondolin.remote is no longer supported; use gondolin:default and remove the remote setting");
+            }
+        }
+        catch (error) {
+            if (error instanceof Error && error.message.startsWith("sandbox.gondolin.remote")) {
+                throw error;
+            }
+        }
+    }
     return readJsonSchemaFileIfExists(settingsPath, SettingsFileSchema, (detail) => detail === "unexpected JSON shape"
         ? `Malformed settings file at ${settingsPath}: expected a JSON object at the top level`
         : `Malformed settings file at ${settingsPath}: ${detail}`);
 }
 function getStateDir() {
-    const raw = readEnv("STATE_DIR");
-    return raw ? resolve(raw) : join(homedir(), ".mikan");
+    return effectiveStateDir();
 }
 function normalizeSettingsConfig(config) {
     return {
@@ -94,21 +117,68 @@ function normalizeSettingsConfig(config) {
         ...(config.llm?.model !== undefined ? { model: config.llm.model } : {}),
         ...(config.llm?.thinkingLevel !== undefined ? { thinkingLevel: config.llm.thinkingLevel } : {}),
         ...(config.sentry?.dsn !== undefined ? { sentryDsn: config.sentry.dsn } : {}),
-        ...(config.sandbox?.cpus !== undefined ? { sandboxCpus: config.sandbox.cpus } : {}),
-        ...(config.sandbox?.memory !== undefined ? { sandboxMemory: config.sandbox.memory } : {}),
-        ...(config.sandbox?.boost?.cpus !== undefined
-            ? { sandboxBoostCpus: config.sandbox.boost.cpus }
-            : {}),
-        ...(config.sandbox?.boost?.memory !== undefined
-            ? { sandboxBoostMemory: config.sandbox.boost.memory }
-            : {}),
-        ...(config.sandbox?.image?.workspaceMount !== undefined
-            ? { sandboxImageWorkspaceMount: config.sandbox.image.workspaceMount }
-            : {}),
-        ...(config.sandbox?.defaultSharedVault?.trim()
-            ? { defaultSharedVault: config.sandbox.defaultSharedVault.trim() }
-            : {}),
+        ...(config.sandbox !== undefined ? { sandbox: normalizeSandboxSettings(config.sandbox) } : {}),
         ...(config.slack !== undefined ? { slack: config.slack } : {}),
+        ...(config.packages !== undefined ? { packages: normalizePackages(config.packages) } : {}),
+    };
+}
+/** Drop blank entries and duplicates while preserving the author's order. */
+function normalizePackages(packages) {
+    const seen = new Set();
+    const normalized = [];
+    for (const entry of packages) {
+        const trimmed = entry.trim();
+        if (!trimmed || seen.has(trimmed))
+            continue;
+        seen.add(trimmed);
+        normalized.push(trimmed);
+    }
+    return normalized;
+}
+/**
+ * File shape → in-memory shape for the sandbox group. An empty or
+ * whitespace-only `defaultSharedVault` means "no default" and is dropped;
+ * non-empty values are trimmed. Everything else passes through as-is.
+ */
+function normalizeSandboxSettings(sandbox) {
+    const defaultSharedVault = sandbox.defaultSharedVault?.trim();
+    const legacyWorkspace = sandbox.image?.workspaceMount === "private"
+        ? { doorPolicy: "trusted", layout: "shared-support" }
+        : sandbox.image?.workspaceMount === "full"
+            ? { doorPolicy: "trusted", layout: "full" }
+            : undefined;
+    const workspace = legacyWorkspace
+        ? { ...legacyWorkspace, ...sandbox.workspace }
+        : sandbox.workspace;
+    return {
+        ...(sandbox.cpus !== undefined ? { cpus: sandbox.cpus } : {}),
+        ...(sandbox.memory !== undefined ? { memory: sandbox.memory } : {}),
+        ...(sandbox.boost !== undefined ? { boost: sandbox.boost } : {}),
+        ...(sandbox.image !== undefined ? { image: sandbox.image } : {}),
+        ...(workspace !== undefined ? { workspace } : {}),
+        ...(defaultSharedVault ? { defaultSharedVault } : {}),
+    };
+}
+/**
+ * Merge two sandbox settings groups. The merge invariant is LEAF-LEVEL:
+ * an override that only sets `sandbox.memory` keeps the base `sandbox.cpus`,
+ * and an override that only sets `boost.memory` keeps the base `boost.cpus`
+ * (same for `image`). This mirrors how the fields merged when they were
+ * flat top-level keys; a group-level spread would silently drop base leaves.
+ */
+function mergeSandboxSettings(base, override) {
+    if (!base)
+        return override;
+    if (!override)
+        return base;
+    return {
+        ...base,
+        ...override,
+        ...(base.boost || override.boost ? { boost: { ...base.boost, ...override.boost } } : {}),
+        ...(base.image || override.image ? { image: { ...base.image, ...override.image } } : {}),
+        ...(base.workspace || override.workspace
+            ? { workspace: { ...base.workspace, ...override.workspace } }
+            : {}),
     };
 }
 function getSettingsPath() {
@@ -135,26 +205,18 @@ function toAgentConfig(fromFile) {
     const provider = requireString(fromFile.provider, "llm.provider");
     const model = requireString(fromFile.model, "llm.model");
     const thinkingLevel = requireThinkingLevel(fromFile.thinkingLevel);
-    const sentryDsn = fromFile.sentryDsn ?? process.env.SENTRY_DSN;
-    const sandboxCpus = fromFile.sandboxCpus;
-    const sandboxMemory = fromFile.sandboxMemory;
-    const sandboxBoostCpus = fromFile.sandboxBoostCpus;
-    const sandboxBoostMemory = fromFile.sandboxBoostMemory;
-    const sandboxImageWorkspaceMount = fromFile.sandboxImageWorkspaceMount;
-    const defaultSharedVault = fromFile.defaultSharedVault;
+    const sentryDsn = sentryDsnFrom(fromFile.sentryDsn);
+    const sandbox = fromFile.sandbox;
     const slack = fromFile.slack;
+    const packages = fromFile.packages;
     return {
         provider,
         model,
         thinkingLevel,
         sentryDsn,
-        sandboxCpus,
-        sandboxMemory,
-        sandboxBoostCpus,
-        sandboxBoostMemory,
-        sandboxImageWorkspaceMount,
-        defaultSharedVault,
+        sandbox,
         slack,
+        packages,
     };
 }
 function loadRawGlobalSettings() {
@@ -165,7 +227,9 @@ export function loadGlobalSettings() {
 }
 /**
  * Host-authoritative location of a conversation's settings file:
- * `<stateDir>/conversations/<conversationId>/settings.json`.
+ * `<office state dir>/settings.json`. The Office value names both the
+ * state-dir key and the legacy pre-host-migration location (its workspace
+ * dir) — the key is never inferred from a directory basename.
  *
  * Conversation settings used to live at `<conversationDir>/settings.json`,
  * but conversation dirs are bind-mounted read-write into sandbox containers
@@ -180,23 +244,23 @@ export function loadGlobalSettings() {
  * migration marker — a legacy file (re)appearing later, e.g. planted from
  * inside the sandbox, is never read again.
  */
-export function conversationSettingsPath(conversationDir) {
-    const conversationId = basename(resolve(conversationDir));
-    const hostPath = join(getStateDir(), "conversations", conversationId, "settings.json");
-    if (existsSync(hostPath))
+export function conversationSettingsPath(office) {
+    const hostPath = join(office.stateDir, "settings.json");
+    if (existsSync(hostPath)) {
+        assertSettingsFile(hostPath, "Host conversation settings");
         return hostPath;
+    }
     ensureDirExists(dirname(hostPath));
-    const legacyPath = join(conversationDir, "settings.json");
+    const legacyPath = join(office.dir, "settings.json");
     let content = "{}\n";
     let migrated = false;
     if (existsSync(legacyPath)) {
-        try {
-            content = readFileSync(legacyPath, "utf-8");
-            migrated = true;
-        }
-        catch (err) {
-            log.logWarning(`Could not read legacy conversation settings: ${legacyPath}`, String(err));
-        }
+        assertSettingsFile(legacyPath, "Legacy conversation settings");
+        content = readFileSync(legacyPath, "utf-8");
+        // Validate before moving the file. A malformed legacy file must fail
+        // closed and remain available for an operator to repair.
+        loadSettingsFile(legacyPath);
+        migrated = true;
     }
     atomicWritePrivateFile(hostPath, content);
     if (migrated) {
@@ -210,10 +274,36 @@ export function conversationSettingsPath(conversationDir) {
     }
     return hostPath;
 }
-export function resolveConversationSettings(conversationDir) {
+function assertSettingsFile(path, label) {
+    let stats;
+    try {
+        stats = lstatSync(path);
+    }
+    catch (err) {
+        throw new Error(`${label} cannot be inspected: ${path}`, { cause: err });
+    }
+    if (stats.isSymbolicLink() || !stats.isFile()) {
+        throw new Error(`${label} must be a regular non-symlink file: ${path}`);
+    }
+}
+export function resolveConversationSettings(office) {
     const globalConfig = loadRawGlobalSettings();
-    const conversationConfig = normalizeSettingsConfig(loadSettingsFile(conversationSettingsPath(conversationDir)) ?? {});
-    return toAgentConfig({ ...globalConfig, ...conversationConfig });
+    const conversationConfig = normalizeSettingsConfig(loadSettingsFile(conversationSettingsPath(office)) ?? {});
+    // The sandbox group merges at the leaf level (see mergeSandboxSettings):
+    // a conversation that only sets sandbox.memory keeps the global sandbox.cpus.
+    const sandbox = mergeSandboxSettings(globalConfig.sandbox, conversationConfig.sandbox);
+    return toAgentConfig({
+        ...globalConfig,
+        ...conversationConfig,
+        ...(sandbox ? { sandbox } : {}),
+        // Packages are additive across scopes, so the spread above would be wrong
+        // twice over: an unset conversation list would read as the global list
+        // (loading every global package a second time under the conversation
+        // scope), and a set one would read as if it had replaced the global list.
+        // Report only this conversation's entries; resolveConversationPackages
+        // combines the scopes.
+        packages: conversationConfig.packages,
+    });
 }
 /**
  * Resolve the model used to judge auto-reply rules. Falls back to the main
@@ -222,11 +312,9 @@ export function resolveConversationSettings(conversationDir) {
  *
  * @deprecated Auto-reply is kept for compatibility while its future is undecided.
  */
-export function loadAutoReplyJudgeModel(conversationDir) {
+export function loadAutoReplyJudgeModel(office) {
     const global = requireGlobalSettings();
-    const local = conversationDir
-        ? (loadSettingsFile(conversationSettingsPath(conversationDir)) ?? {})
-        : {};
+    const local = office ? (loadSettingsFile(conversationSettingsPath(office)) ?? {}) : {};
     const merged = { ...global.llm, ...local.llm };
     const judge = { ...global.llm?.autoReply, ...local.llm?.autoReply };
     const provider = requireString(judge.provider ?? merged?.provider, "llm.autoReply.provider");
@@ -275,39 +363,6 @@ export function saveConversationAutoReplyConfig(conversationDir, config) {
     }
     atomicWritePrivateFile(targetPath, config.rules.join("\n"));
 }
-export function resolveWorkspaceDirFromArgv(args = process.argv.slice(2)) {
-    for (let i = 0; i < args.length; i++) {
-        const arg = args[i];
-        if (arg === "--sandbox" || arg === "--download" || arg === "--state-dir") {
-            i += 1;
-            continue;
-        }
-        if (arg === "--version" || arg === "-v" || arg === "-V" || arg === "--onboard") {
-            continue;
-        }
-        if (arg.startsWith("--sandbox=") ||
-            arg.startsWith("--download=") ||
-            arg.startsWith("--state-dir=")) {
-            continue;
-        }
-        if (!arg.startsWith("-")) {
-            return arg;
-        }
-    }
-    return undefined;
-}
-export function resolveStateDirFromArgv(args = process.argv.slice(2)) {
-    for (let i = 0; i < args.length; i++) {
-        const arg = args[i];
-        if (arg.startsWith("--state-dir=")) {
-            return resolve(arg.slice("--state-dir=".length));
-        }
-        if (arg === "--state-dir") {
-            return resolve(args[++i] || "");
-        }
-    }
-    return join(homedir(), ".mikan");
-}
 /**
  * True when `child` is `parent` or a path inside it. Purely lexical (no
  * symlink resolution) — used for configuration sanity checks, not as the
@@ -338,12 +393,13 @@ export function assertStateDirOutsideWorkspace(stateDir, workingDir, sandboxType
     }
     throw new Error(message);
 }
+/** Settings-file DSN wins over SENTRY_DSN env — the rule lives only here. */
+function sentryDsnFrom(fromFile) {
+    return fromFile || readEnv("SENTRY_DSN");
+}
 export function resolveSentryDsn() {
     const fromFile = normalizeSettingsConfig(loadSettingsFile(getSettingsPath()) ?? {});
-    if (fromFile.sentryDsn) {
-        return fromFile.sentryDsn;
-    }
-    return process.env.SENTRY_DSN;
+    return sentryDsnFrom(fromFile.sentryDsn);
 }
 export function createGlobalSettingsFile(stateDir) {
     const settingsPath = join(stateDir, "settings.json");
@@ -375,6 +431,9 @@ function compactSettingsConfig(config) {
         ...(hasDefinedValue(config.sandbox) ? { sandbox: config.sandbox } : {}),
         ...(hasDefinedValue(config.autoReply) ? { autoReply: config.autoReply } : {}),
         ...(hasDefinedValue(config.slack) ? { slack: config.slack } : {}),
+        // An empty list is meaningful (the admin removed the last package) and
+        // must survive the round trip, so this checks for the key, not for values.
+        ...(config.packages !== undefined ? { packages: config.packages } : {}),
     };
 }
 function patchSettingsConfig(existing, config) {
@@ -390,61 +449,89 @@ function patchSettingsConfig(existing, config) {
             ...existing.sentry,
             ...(config.sentryDsn !== undefined ? { dsn: config.sentryDsn } : {}),
         },
-        sandbox: {
-            ...existing.sandbox,
-            ...(config.sandboxCpus !== undefined ? { cpus: config.sandboxCpus } : {}),
-            ...(config.sandboxMemory !== undefined ? { memory: config.sandboxMemory } : {}),
-            ...(config.sandboxBoostCpus !== undefined || config.sandboxBoostMemory !== undefined
-                ? {
-                    boost: {
-                        ...existing.sandbox?.boost,
-                        ...(config.sandboxBoostCpus !== undefined ? { cpus: config.sandboxBoostCpus } : {}),
-                        ...(config.sandboxBoostMemory !== undefined
-                            ? { memory: config.sandboxBoostMemory }
-                            : {}),
-                    },
-                }
-                : {}),
-            ...(config.sandboxImageWorkspaceMount !== undefined
-                ? {
-                    image: {
-                        ...existing.sandbox?.image,
-                        workspaceMount: config.sandboxImageWorkspaceMount,
-                    },
-                }
-                : {}),
-            ...(config.defaultSharedVault !== undefined
-                ? { defaultSharedVault: config.defaultSharedVault }
-                : {}),
-        },
+        // Leaf-level merge: a patch that only sets sandbox.boost.memory keeps the
+        // existing boost.cpus (and every other existing leaf). compactSettingsConfig
+        // drops the group entirely when it ends up with no defined values.
+        sandbox: mergeSandboxSettings(existing.sandbox, config.sandbox) ?? {},
         slack: {
             ...existing.slack,
             ...config.slack,
         },
+        // The package list is replaced wholesale, not merged: the portal edits it
+        // as a list, and a merge would make removal impossible.
+        ...(config.packages !== undefined ? { packages: normalizePackages(config.packages) } : {}),
     };
     return compactSettingsConfig(patched);
 }
-function updateSettingsFile(settingsPath, patch, defaultSettings) {
-    let existing = defaultSettings;
-    if (existsSync(settingsPath)) {
-        try {
-            existing = loadSettingsFile(settingsPath) ?? {};
-        }
-        catch (err) {
-            const detail = err instanceof Error ? err.message : String(err);
-            const message = detail.startsWith("Malformed settings file")
-                ? detail.replace("Malformed settings file", "Refusing to overwrite malformed settings file")
-                : detail;
-            throw new Error(message, { cause: err });
-        }
+function loadSettingsFileForUpdate(settingsPath, defaultSettings) {
+    if (!existsSync(settingsPath))
+        return defaultSettings;
+    try {
+        return loadSettingsFile(settingsPath) ?? {};
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        const message = detail.startsWith("Malformed settings file")
+            ? detail.replace("Malformed settings file", "Refusing to overwrite malformed settings file")
+            : detail;
+        throw new Error(message, { cause: err });
     }
+}
+function updateSettingsFile(settingsPath, patch, defaultSettings) {
+    const existing = loadSettingsFileForUpdate(settingsPath, defaultSettings);
     ensureDirExists(dirname(settingsPath));
     atomicWritePrivateFile(settingsPath, JSON.stringify(patchSettingsConfig(existing, patch), null, 2));
 }
 export function updateGlobalSettings(patch) {
     updateSettingsFile(join(getStateDir(), "settings.json"), patch, ONBOARD_SETTINGS);
 }
-export function updateConversationSettings(conversationDir, patch) {
-    updateSettingsFile(conversationSettingsPath(conversationDir), patch, {});
+export function updateConversationSettings(office, patch) {
+    updateSettingsFile(conversationSettingsPath(office), patch, {});
+}
+/**
+ * The conversation's own door-policy override (legacy `image.workspaceMount`
+ * included), or null when the office follows the global default.
+ */
+export function loadConversationWorkspaceOverride(office) {
+    const file = loadSettingsFile(conversationSettingsPath(office));
+    const sandbox = file?.sandbox;
+    if (sandbox?.workspace?.doorPolicy === "isolated")
+        return { doorPolicy: "isolated" };
+    if (sandbox?.workspace?.doorPolicy === "trusted") {
+        return {
+            doorPolicy: "trusted",
+            layout: sandbox.workspace.layout === "full" ? "full" : "shared-support",
+        };
+    }
+    if (sandbox?.image?.workspaceMount === "full")
+        return { doorPolicy: "trusted", layout: "full" };
+    if (sandbox?.image?.workspaceMount === "private") {
+        return { doorPolicy: "trusted", layout: "shared-support" };
+    }
+    return null;
+}
+export function setConversationWorkspacePolicy(office, choice) {
+    writeWorkspacePolicy(conversationSettingsPath(office), choice, {});
+}
+export function setGlobalWorkspacePolicy(choice) {
+    writeWorkspacePolicy(join(getStateDir(), "settings.json"), choice, ONBOARD_SETTINGS);
+}
+/**
+ * The generic settings patch merges leaves and cannot remove keys, so the
+ * door-policy writer edits the file shape directly: it always drops the
+ * legacy `image.workspaceMount` (the explicit choice replaces it) and either
+ * sets or removes the `workspace` group.
+ */
+function writeWorkspacePolicy(settingsPath, choice, defaultSettings) {
+    const existing = loadSettingsFileForUpdate(settingsPath, defaultSettings);
+    const { workspaceMount: _legacy, ...image } = existing.sandbox?.image ?? {};
+    const { workspace: _previous, image: _image, ...sandboxRest } = existing.sandbox ?? {};
+    const sandbox = {
+        ...sandboxRest,
+        ...(hasDefinedValue(image) ? { image } : {}),
+        ...(choice ? { workspace: choice } : {}),
+    };
+    ensureDirExists(dirname(settingsPath));
+    atomicWritePrivateFile(settingsPath, JSON.stringify(compactSettingsConfig({ ...existing, sandbox }), null, 2));
 }
 //# sourceMappingURL=config.js.map