@gendigital/sage-openclaw 0.9.0 → 0.11.0

package/dist/model-download-worker.cjs

@@ -2961,7 +2961,7 @@ var init_index_min = __esm({
 });
 
 // ../core/src/model-download-worker.ts
-var import_promises5 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 
 // ../core/src/config.ts
 var import_node_path = require("node:path");
@@ -7043,23 +7043,21 @@ var ArtifactSchema = external_exports.object({
   value: external_exports.string(),
   context: external_exports.string().optional()
 });
-var SeveritySchema = external_exports.enum(["critical", "high", "medium", "low"]);
-var ActionSchema = external_exports.enum(["block", "require_approval", "log"]);
+var VerdictSeveritySchema = external_exports.enum(["info", "warning", "critical"]);
 var ThreatSchema = external_exports.object({
   id: external_exports.string(),
   version: external_exports.number().int().optional(),
   category: external_exports.string(),
-  severity: SeveritySchema,
+  severity: VerdictSeveritySchema,
   confidence: external_exports.number(),
-  action: ActionSchema,
   pattern: external_exports.string(),
   match_on: external_exports.union([external_exports.string(), external_exports.array(external_exports.string())]),
   title: external_exports.string(),
   expires_at: external_exports.string().nullable().optional(),
-  revoked: external_exports.boolean().optional().default(false)
+  revoked: external_exports.boolean().optional().default(false),
+  flags: external_exports.array(external_exports.string()).optional().default([])
 });
 var DecisionSchema = external_exports.enum(["allow", "deny", "ask"]);
-var VerdictSeveritySchema = external_exports.enum(["info", "warning", "critical"]);
 var SensitivitySchema = external_exports.enum(["paranoid", "balanced", "relaxed"]);
 var UrlCheckConfigSchema = external_exports.object({
   endpoint: external_exports.string().optional(),
@@ -7072,9 +7070,6 @@ var CacheConfigSchema = external_exports.object({
   ttl_clean_seconds: external_exports.number().default(86400),
   path: external_exports.string().default("~/.sage/cache.json")
 });
-var AllowlistConfigSchema = external_exports.object({
-  path: external_exports.string().default("~/.sage/allowlist.json")
-});
 var LoggingConfigSchema = external_exports.object({
   enabled: external_exports.boolean().default(true),
   log_clean: external_exports.boolean().default(false),
@@ -7082,6 +7077,14 @@ var LoggingConfigSchema = external_exports.object({
   max_bytes: external_exports.number().int().min(0).default(5 * 1024 * 1024),
   max_files: external_exports.number().int().min(0).default(3)
 });
+var OperationalLogLevelSchema = external_exports.enum(["debug", "info", "warn", "error"]);
+var OperationalLoggingConfigSchema = external_exports.object({
+  enabled: external_exports.boolean().default(true),
+  level: OperationalLogLevelSchema.default("info"),
+  path: external_exports.string().default("~/.sage/operational.jsonl"),
+  max_bytes: external_exports.number().int().min(0).default(5 * 1024 * 1024),
+  max_files: external_exports.number().int().min(0).default(3)
+});
 var FileCheckConfigSchema = external_exports.object({
   endpoint: external_exports.string().optional(),
   timeout_seconds: external_exports.number().default(5),
@@ -7128,9 +7131,9 @@ var ConfigSchema = external_exports.object({
   pi_check: PiCheckConfigSchema.default({}),
   heuristics_enabled: external_exports.boolean().default(true),
   cache: CacheConfigSchema.default({}),
-  allowlist: AllowlistConfigSchema.default({}),
   exceptions: ExceptionsConfigSchema.default({}),
   logging: LoggingConfigSchema.default({}),
+  operational_logging: OperationalLoggingConfigSchema.default({}),
   sensitivity: SensitivitySchema.default("balanced"),
   disabled_threats: external_exports.array(external_exports.string()).default([]),
   brand_key: external_exports.string().min(1).max(32).regex(/^[a-z0-9_-]+$/u).optional(),
@@ -7146,6 +7149,25 @@ var HookTypeSchema = external_exports.enum([
 ]);
 
 // ../core/src/config.ts
+var SAGE_DIR = "~/.sage";
+function resolvedSageDir() {
+  return resolvePath(SAGE_DIR);
+}
+function defaultConfigPath() {
+  return (0, import_node_path.join)(resolvedSageDir(), "config.json");
+}
+function defaultCachePath() {
+  return (0, import_node_path.join)(resolvedSageDir(), "cache.json");
+}
+function defaultExceptionsPath() {
+  return (0, import_node_path.join)(resolvedSageDir(), "exceptions.json");
+}
+function defaultAuditPath() {
+  return (0, import_node_path.join)(resolvedSageDir(), "audit.jsonl");
+}
+function defaultOperationalLogPath() {
+  return (0, import_node_path.join)(resolvedSageDir(), "operational.jsonl");
+}
 function resolvePath(pathStr) {
   if (pathStr.startsWith("~/") || pathStr === "~") {
     const home = getHomeDir();
@@ -7153,6 +7175,112 @@ function resolvePath(pathStr) {
   }
   return pathStr;
 }
+function isWithinDirectory(baseDir, targetPath) {
+  const rel = (0, import_node_path.relative)(baseDir, targetPath);
+  if (rel === "") return true;
+  if ((0, import_node_path.isAbsolute)(rel)) return false;
+  return rel !== ".." && !rel.startsWith(`..${import_node_path.sep}`);
+}
+function normalizeStateFilePath(configuredPath, fallbackPath, field, logger) {
+  const sageDir = resolvedSageDir();
+  const trimmed = configuredPath.trim();
+  if (trimmed === "") {
+    logger.warn(`Config ${field}.path is empty; using default`, {
+      configuredPath,
+      defaultPath: fallbackPath
+    });
+    return fallbackPath;
+  }
+  const expanded = resolvePath(trimmed);
+  const resolved = (0, import_node_path.isAbsolute)(expanded) ? (0, import_node_path.resolve)(expanded) : (0, import_node_path.resolve)(sageDir, expanded);
+  if (isWithinDirectory(sageDir, resolved)) {
+    if (resolved === sageDir) {
+      logger.warn(`Config ${field}.path must point to a file; using default`, {
+        configuredPath,
+        defaultPath: fallbackPath
+      });
+      return fallbackPath;
+    }
+    return resolved;
+  }
+  logger.warn(`Config ${field}.path escapes ${sageDir}; using default`, {
+    configuredPath,
+    defaultPath: fallbackPath
+  });
+  return fallbackPath;
+}
+var BRAND_KEY_RE = /^[a-z0-9_-]+$/u;
+function sanitizeBrandKey(data, logger) {
+  const brandKey = data.brand_key;
+  if (brandKey === void 0) return data;
+  if (typeof brandKey === "string" && brandKey.length >= 1 && brandKey.length <= 32 && BRAND_KEY_RE.test(brandKey)) {
+    return data;
+  }
+  logger.warn(`Invalid brand_key in config \u2014 ignoring`, { brand_key: brandKey });
+  const { brand_key: _2, ...rest } = data;
+  return rest;
+}
+function sanitizeConfigPaths(config, logger) {
+  const cachePath = defaultCachePath();
+  const exceptionsPath = defaultExceptionsPath();
+  const auditPath = defaultAuditPath();
+  const operationalLogPath = defaultOperationalLogPath();
+  return {
+    ...config,
+    cache: {
+      ...config.cache,
+      path: normalizeStateFilePath(config.cache.path, cachePath, "cache", logger)
+    },
+    exceptions: {
+      ...config.exceptions,
+      path: normalizeStateFilePath(config.exceptions.path, exceptionsPath, "exceptions", logger)
+    },
+    logging: {
+      ...config.logging,
+      path: normalizeStateFilePath(config.logging.path, auditPath, "logging", logger)
+    },
+    operational_logging: {
+      ...config.operational_logging,
+      path: normalizeStateFilePath(
+        config.operational_logging.path,
+        operationalLogPath,
+        "operational_logging",
+        logger
+      )
+    }
+  };
+}
+function defaultConfig(logger) {
+  return sanitizeConfigPaths(ConfigSchema.parse({}), logger);
+}
+function parseConfig(raw, path, logger) {
+  let data;
+  try {
+    data = JSON.parse(raw);
+  } catch (e) {
+    logger.warn(`Failed to parse config from ${path}`, { error: String(e) });
+    return defaultConfig(logger);
+  }
+  if (typeof data !== "object" || data === null || Array.isArray(data)) {
+    logger.warn(`Config file ${path} does not contain a JSON object`);
+    return defaultConfig(logger);
+  }
+  const sanitized = sanitizeBrandKey(data, logger);
+  try {
+    return sanitizeConfigPaths(ConfigSchema.parse(sanitized), logger);
+  } catch (e) {
+    logger.warn(`Config validation failed, using defaults`, { error: String(e) });
+    return defaultConfig(logger);
+  }
+}
+async function loadConfig(configPath, logger = nullLogger) {
+  const path = configPath ? resolvePath(configPath) : defaultConfigPath();
+  try {
+    return parseConfig(await getFileContent(path), path, logger);
+  } catch {
+    return defaultConfig(logger);
+  }
+}
 
 // ../core/src/installation-id.ts
 var import_node_crypto = require("node:crypto");
@@ -7440,7 +7568,7 @@ var import_node_path14 = require("node:path");
 var import_node_url = require("node:url");
 var import_meta = {};
 function resolveVersion() {
-  if (true) return "0.9.0";
+  if (true) return "0.11.0";
   try {
     const pkgPath = (0, import_node_path14.join)((0, import_node_path14.dirname)((0, import_node_url.fileURLToPath)(import_meta.url)), "..", "package.json");
     const pkg = JSON.parse(getFileContentSync(pkgPath));
@@ -7545,7 +7673,19 @@ async function ensureModelsAvailable(args) {
   const required = REQUIRED_MODELS_BY_SCHEMA[schema] ?? [];
   if (required.length === 0) return [];
   const missing = missingRequiredModels(schema, sageDir);
-  if (missing.length === 0) return [...required];
+  logger.debug("Model availability check started", {
+    schema,
+    requiredModels: required,
+    missingModels: missing
+  });
+  if (missing.length === 0) {
+    logger.debug("Model availability check completed", {
+      schema,
+      result: "already_available",
+      installedModels: required
+    });
+    return [...required];
+  }
   const manifest = await fetchModelManifest({
     iid: args.iid,
     schema,
@@ -7555,8 +7695,15 @@ async function ensureModelsAvailable(args) {
     logger
   });
   if (!manifest) {
-    logger.debug("model manifest unavailable; skipping background download");
-    return required.filter((name) => !missing.includes(name));
+    const installed2 = required.filter((name) => !missing.includes(name));
+    logger.debug("Model availability check completed", {
+      schema,
+      result: "skipped",
+      skippedReason: "manifest_unavailable",
+      installedModels: installed2,
+      missingModels: missing
+    });
+    return installed2;
   }
   const installed = new Set(required.filter((name) => !missing.includes(name)));
   for (const name of missing) {
@@ -7578,7 +7725,212 @@ async function ensureModelsAvailable(args) {
       logger.warn(`download of model '${name}' threw: ${err}`);
     }
   }
-  return [...installed];
+  const installedModels = [...installed];
+  logger.debug("Model availability check completed", {
+    schema,
+    result: "checked",
+    installedModels,
+    missingModels: required.filter((name) => !installed.has(name))
+  });
+  return installedModels;
+}
+
+// ../core/src/jsonl-log-writer.ts
+var import_promises5 = require("node:fs/promises");
+var import_node_path15 = require("node:path");
+var import_promises6 = require("node:timers/promises");
+var writeQueues = /* @__PURE__ */ new Map();
+var ROTATE_LOCK_TIMEOUT_MS = 250;
+var ROTATE_LOCK_STALE_MS = 3e4;
+var ROTATE_LOCK_POLL_MS = 50;
+async function shouldRotate(filePath, maxBytes, maxFiles) {
+  if (maxBytes <= 0 || maxFiles <= 0) return false;
+  try {
+    const s3 = await (0, import_promises5.stat)(filePath);
+    return s3.size >= maxBytes;
+  } catch {
+    return false;
+  }
+}
+async function removeStaleRotateLock(lockPath) {
+  try {
+    const s3 = await (0, import_promises5.stat)(lockPath);
+    if (Date.now() - s3.mtimeMs < ROTATE_LOCK_STALE_MS) return;
+    await (0, import_promises5.rmdir)(lockPath);
+  } catch {
+  }
+}
+async function acquireRotateLock(filePath) {
+  const lockPath = `${filePath}.lock`;
+  const deadline = Date.now() + ROTATE_LOCK_TIMEOUT_MS;
+  while (true) {
+    try {
+      await (0, import_promises5.mkdir)(lockPath);
+      return async () => {
+        try {
+          await (0, import_promises5.rmdir)(lockPath);
+        } catch {
+        }
+      };
+    } catch {
+      await removeStaleRotateLock(lockPath);
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) return void 0;
+      await (0, import_promises6.setTimeout)(Math.min(ROTATE_LOCK_POLL_MS, remainingMs));
+    }
+  }
+}
+async function rotateIfNeeded(filePath, maxBytes, maxFiles) {
+  if (!await shouldRotate(filePath, maxBytes, maxFiles)) return;
+  const releaseLock = await acquireRotateLock(filePath);
+  if (!releaseLock) return;
+  try {
+    if (!await shouldRotate(filePath, maxBytes, maxFiles)) return;
+    try {
+      await (0, import_promises5.unlink)(`${filePath}.${maxFiles}`);
+    } catch {
+    }
+    for (let i = maxFiles - 1; i >= 1; i--) {
+      try {
+        await (0, import_promises5.rename)(`${filePath}.${i}`, `${filePath}.${i + 1}`);
+      } catch {
+      }
+    }
+    try {
+      await (0, import_promises5.rename)(filePath, `${filePath}.1`);
+    } catch {
+    }
+  } finally {
+    await releaseLock();
+  }
+}
+async function appendJsonlEntryNow(path, config, entry) {
+  await (0, import_promises5.mkdir)((0, import_node_path15.dirname)(path), { recursive: true });
+  await rotateIfNeeded(path, config.max_bytes, config.max_files);
+  await (0, import_promises5.appendFile)(path, `${JSON.stringify(entry)}
+`);
+}
+async function appendJsonlEntry(config, entry) {
+  const path = resolvePath(config.path);
+  const previousWrite = writeQueues.get(path) ?? Promise.resolve();
+  const nextWrite = previousWrite.catch(() => {
+  }).then(() => appendJsonlEntryNow(path, config, entry));
+  writeQueues.set(path, nextWrite);
+  try {
+    await nextWrite;
+  } finally {
+    if (writeQueues.get(path) === nextWrite) writeQueues.delete(path);
+  }
+}
+
+// ../core/src/operational-log.ts
+var LEVEL_PRIORITY = {
+  debug: 10,
+  info: 20,
+  warn: 30,
+  error: 40
+};
+var FLUSH_TIMEOUT_MS = 250;
+function shouldLog(config, level) {
+  return config.enabled && LEVEL_PRIORITY[level] >= LEVEL_PRIORITY[config.level];
+}
+function normalizeData(data) {
+  if (!data) return void 0;
+  const seen = /* @__PURE__ */ new WeakSet();
+  try {
+    return JSON.parse(
+      JSON.stringify(data, (_key, value) => {
+        if (typeof value === "bigint") return value.toString();
+        if (value instanceof Error) {
+          return { name: value.name, message: value.message, stack: value.stack };
+        }
+        if (value && typeof value === "object") {
+          if (seen.has(value)) return "[Circular]";
+          seen.add(value);
+        }
+        return value;
+      })
+    );
+  } catch {
+    return { serialization_error: "Failed to serialize log data" };
+  }
+}
+async function writeOperationalLogEntry(config, entry) {
+  if (!shouldLog(config, entry.level)) return;
+  try {
+    await appendJsonlEntry(config, entry);
+  } catch {
+  }
+}
+function createOperationalLogger(config, runtime) {
+  const pendingWrites = /* @__PURE__ */ new Set();
+  function log(component, level, message, data) {
+    if (!shouldLog(config, level)) return;
+    const entry = {
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      level,
+      runtime,
+      component,
+      message,
+      ...data ? { data: normalizeData(data) } : {}
+    };
+    const write = writeOperationalLogEntry(config, entry);
+    pendingWrites.add(write);
+    void write.finally(() => pendingWrites.delete(write));
+  }
+  async function flush() {
+    const deadline = Date.now() + FLUSH_TIMEOUT_MS;
+    while (pendingWrites.size > 0) {
+      const remainingMs = deadline - Date.now();
+      if (remainingMs <= 0) return;
+      let timeout;
+      try {
+        const result = await Promise.race([
+          Promise.allSettled([...pendingWrites]).then(() => "drained"),
+          new Promise((resolve4) => {
+            timeout = setTimeout(() => resolve4("timeout"), remainingMs);
+            timeout.unref?.();
+          })
+        ]);
+        if (result === "timeout") return;
+      } finally {
+        if (timeout) clearTimeout(timeout);
+      }
+    }
+  }
+  function forComponent(component) {
+    return {
+      debug(msg, data) {
+        log(component, "debug", msg, data);
+      },
+      info(msg, data) {
+        log(component, "info", msg, data);
+      },
+      warn(msg, data) {
+        log(component, "warn", msg, data);
+      },
+      error(msg, data) {
+        log(component, "error", msg, data);
+      },
+      flush
+    };
+  }
+  return {
+    debug(component, msg, data) {
+      log(component, "debug", msg, data);
+    },
+    info(component, msg, data) {
+      log(component, "info", msg, data);
+    },
+    warn(component, msg, data) {
+      log(component, "warn", msg, data);
+    },
+    error(component, msg, data) {
+      log(component, "error", msg, data);
+    },
+    forComponent,
+    flush
+  };
 }
 
 // ../core/src/model-download-worker.ts
@@ -7591,22 +7943,63 @@ async function readWorkerArgs() {
   const schema = env.SAGE_MODEL_SCHEMA || MODEL_SCHEMA_VERSION;
   return { sageDir, agentRuntime, agentRuntimeVersion, versionApp, schema };
 }
+async function createWorkerLogger(agentRuntime) {
+  try {
+    const config = await loadConfig();
+    return createOperationalLogger(
+      config.operational_logging,
+      agentRuntime
+    ).forComponent("model-download-worker");
+  } catch {
+    return nullLogger;
+  }
+}
 async function workerMain() {
   const args = await readWorkerArgs();
   if (!args) return;
-  await (0, import_promises5.mkdir)(getModelStorageRoot(args.sageDir), { recursive: true }).catch(() => {
-  });
-  const iid = await getInstallationId(args.sageDir).catch(() => void 0);
-  if (!iid) return;
-  await ensureModelsAvailable({
-    sageDir: args.sageDir,
-    iid,
-    agentRuntime: args.agentRuntime,
-    agentRuntimeVersion: args.agentRuntimeVersion,
-    versionApp: args.versionApp,
-    schema: args.schema,
-    logger: nullLogger
-  });
+  const logger = await createWorkerLogger(args.agentRuntime);
+  try {
+    logger.debug("Model download worker started", {
+      schema: args.schema,
+      agentRuntime: args.agentRuntime,
+      agentRuntimeVersion: args.agentRuntimeVersion,
+      versionApp: args.versionApp
+    });
+    await (0, import_promises7.mkdir)(getModelStorageRoot(args.sageDir), { recursive: true }).catch(() => {
+    });
+    const iid = await getInstallationId(args.sageDir).catch(() => void 0);
+    if (!iid) {
+      logger.debug("Model download worker completed", {
+        result: "skipped",
+        skippedReason: "missing_installation_id"
+      });
+      await logger.flush?.();
+      return;
+    }
+    const installedModels = await ensureModelsAvailable({
+      sageDir: args.sageDir,
+      iid,
+      agentRuntime: args.agentRuntime,
+      agentRuntimeVersion: args.agentRuntimeVersion,
+      versionApp: args.versionApp,
+      schema: args.schema,
+      logger
+    });
+    logger.debug("Model download worker completed", {
+      result: "completed",
+      installedModels
+    });
+    await logger.flush?.();
+  } catch (error) {
+    logger.error("Model download worker failed open", {
+      error: String(error),
+      schema: args.schema,
+      agentRuntime: args.agentRuntime,
+      agentRuntimeVersion: args.agentRuntimeVersion,
+      versionApp: args.versionApp
+    });
+    await logger.flush?.();
+  }
 }
 var isWorkerEntry = (() => {
   try {