@gmickel/gno 1.27.1 → 1.29.0

package/src/serve/public/pages/Collections.tsx

@@ -91,6 +91,7 @@ interface CollectionStats {
     "override" | "preset" | "default"
   >;
   pattern?: string;
+  egressPolicy?: CollectionModelDetails["egressPolicy"];
 }
 
 interface StatusResponse {
@@ -411,6 +412,7 @@ export default function Collections({ navigate }: PageProps) {
         models: config?.models,
         modelSources: config?.modelSources,
         pattern: config?.pattern,
+        egressPolicy: config?.egressPolicy,
       };
     });
 
@@ -722,6 +724,7 @@ export default function Collections({ navigate }: PageProps) {
       />
 
       <CollectionModelDialog
+        availableCollections={collections.map(({ name }) => name)}
         collection={modelDialogCollection}
         onOpenChange={(open) => {
           if (!open) {

package/src/serve/resident-request.ts

@@ -18,6 +18,69 @@ function saturatedResponse(): Response {
   );
 }
 
+function policyChangedResponse(): Response {
+  return Response.json(
+    {
+      error: {
+        code: "EGRESS_POLICY_CHANGED",
+        message: "Collection policy changed; retry",
+      },
+    },
+    { status: 409 }
+  );
+}
+
+function wrapResidentStream(
+  response: Response,
+  isCurrent: () => boolean,
+  finish: () => void
+): Response {
+  if (!response.body) {
+    finish();
+    return response;
+  }
+  const reader = response.body.getReader();
+  let finished = false;
+  const finishOnce = (): void => {
+    if (finished) return;
+    finished = true;
+    finish();
+  };
+  const body = new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        if (!isCurrent()) {
+          await reader.cancel("EGRESS_POLICY_CHANGED");
+          controller.close();
+          finishOnce();
+          return;
+        }
+        const result = await reader.read();
+        if (!isCurrent()) {
+          await reader.cancel("EGRESS_POLICY_CHANGED");
+          controller.close();
+          finishOnce();
+          return;
+        }
+        if (result.done) {
+          controller.close();
+          finishOnce();
+          return;
+        }
+        controller.enqueue(result.value);
+      } catch (error) {
+        controller.error(error);
+        finishOnce();
+      }
+    },
+    async cancel(reason) {
+      finishOnce();
+      await reader.cancel(reason);
+    },
+  });
+  return new Response(body, response);
+}
+
 export async function handleResidentRead(
   runtime: ResidentRuntime,
   request: Request | undefined,
@@ -27,13 +90,28 @@ export async function handleResidentRead(
   if (!admitted) return unavailableResponse();
 
   let releaseReader: (() => void) | undefined;
+  let deferredFinish = false;
+  const isAuthorizationEpochCurrent = (): boolean =>
+    admitted.isAuthorizationEpochCurrent?.() ?? true;
+  const finish = (): void => {
+    releaseReader?.();
+    admitted.finish();
+  };
   try {
     releaseReader = await runtime.readerGate.acquire(admitted.signal);
     if (admitted.signal.aborted) return unavailableResponse();
     const response = await runtime.withModelLease(() =>
       Promise.resolve(operation(admitted.signal))
     );
-    return admitted.signal.aborted ? unavailableResponse() : response;
+    if (admitted.signal.aborted) return unavailableResponse();
+    if (!isAuthorizationEpochCurrent()) {
+      return policyChangedResponse();
+    }
+    if (response.headers.get("content-type")?.includes("text/event-stream")) {
+      deferredFinish = true;
+      return wrapResidentStream(response, isAuthorizationEpochCurrent, finish);
+    }
+    return response;
   } catch (error) {
     if (
       admitted.signal.aborted ||
@@ -49,7 +127,6 @@ export async function handleResidentRead(
     }
     throw error;
   } finally {
-    releaseReader?.();
-    admitted.finish();
+    if (!deferredFinish) finish();
   }
 }

package/src/serve/resident-runtime.ts

@@ -32,6 +32,8 @@ import {
   loadConfig,
 } from "../config";
 import { SavedCapsuleReverificationScheduler } from "../core/capsule-reverification-scheduler";
+import { collectionEgressPolicyEpoch } from "../core/collection-egress-policy-service";
+import { authorizeCurrentEgress } from "../core/egress-authorization";
 import { acquireWriteLock } from "../core/file-lock";
 import { JobManager } from "../core/job-manager";
 import { recordContentMutation } from "../core/mutation-generations";
@@ -78,8 +80,10 @@ export interface ResidentGeneration {
 }
 
 export interface ResidentRequestHandle {
+  authorizationEpoch?: string;
   id: string;
   signal: AbortSignal;
+  isAuthorizationEpochCurrent?(): boolean;
   finish(): void;
 }
 
@@ -101,12 +105,14 @@ export interface ResidentRuntime {
   readonly generations: ResidentGeneration;
   readonly activeRequests: number;
   readonly activeSessions: number;
+  readonly authorizationEpoch: string;
   readonly isShuttingDown: boolean;
   getStatus(): ResidentStatus;
   setListenerPort(port: number | null): void;
   setTransportStatusProvider(
     provider: (() => HttpMcpTransportStatus) | null
   ): void;
+  setPolicySessionInvalidator(invalidator: (() => Promise<void>) | null): void;
   admitRequest(signal?: AbortSignal): ResidentRequestHandle | null;
   withModelLease<T>(operation: () => Promise<T>): Promise<T>;
   markContentMutation(): void;
@@ -306,6 +312,8 @@ export async function startResidentRuntime(
     serverInstanceId,
     toolMutex,
   });
+  let authorizationEpoch = collectionEgressPolicyEpoch(initialConfig);
+  jobManager.setAuthorizationEpoch(authorizationEpoch);
   ctxHolder.jobManager = jobManager;
   const admission = new AdmissionController();
   const readerGate = new ReaderGate(
@@ -315,6 +323,7 @@ export async function startResidentRuntime(
   const startedAt = Date.now();
   let listenerPort: number | null = null;
   let transportStatusProvider: (() => HttpMcpTransportStatus) | null = null;
+  let policySessionInvalidator: (() => Promise<void>) | null = null;
   let shutdownState: ResidentStatus["shutdown"]["state"] = "none";
   let admissionState: ResidentStatus["admission"]["state"] = "accepting";
   let disposed = false;
@@ -359,7 +368,32 @@ export async function startResidentRuntime(
     markIndexMutation: () => {
       generations.index += 1;
     },
+    invalidateEgressPolicy: async () =>
+      (await ctxHolder.invalidateEgressPolicy?.()) ?? {
+        policyEpoch: collectionEgressPolicyEpoch(ctxHolder.config),
+        queuedJobsInvalidated: 0,
+        sessionsInvalidated: 0,
+        staleWorkMustRetry: true,
+      },
   });
+  mcpContext.authorizeTraceExport = async (lineage) => {
+    const egress = mcpContext.getEgressContext?.();
+    return authorizeCurrentEgress({
+      store,
+      config: ctxHolder.config,
+      lineage,
+      action: "export",
+      destinationZone:
+        egress?.destinationZone === "loopback"
+          ? "local_process"
+          : (egress?.destinationZone ?? "local_process"),
+      caller: egress?.caller ?? {
+        authenticated: true,
+        operationAuthorized: true,
+      },
+      contentClass: "retrieval_trace",
+    });
+  };
 
   const runtime: ResidentRuntime = {
     mode: options.mode ?? "serve",
@@ -385,10 +419,22 @@ export async function startResidentRuntime(
     get activeSessions() {
       return transportStatusProvider?.().activeSessions ?? 0;
     },
+    get authorizationEpoch() {
+      return authorizationEpoch;
+    },
     get isShuttingDown() {
       return disposed || !admission.accepting;
     },
-    admitRequest: (signal) => admission.admit(signal),
+    admitRequest: (signal) => {
+      const admitted = admission.admit(signal);
+      if (!admitted) return null;
+      const requestEpoch = authorizationEpoch;
+      return {
+        ...admitted,
+        authorizationEpoch: requestEpoch,
+        isAuthorizationEpochCurrent: () => requestEpoch === authorizationEpoch,
+      };
+    },
     async withModelLease<T>(operation: () => Promise<T>): Promise<T> {
       const lease = modelManager.acquireLease();
       try {
@@ -450,6 +496,9 @@ export async function startResidentRuntime(
     setTransportStatusProvider(provider) {
       transportStatusProvider = provider;
     },
+    setPolicySessionInvalidator(invalidator) {
+      policySessionInvalidator = invalidator;
+    },
     async syncAll(syncOptions = {}) {
       const config = ctxHolder.config;
       const syncAllService = deps.syncAllService
@@ -508,6 +557,19 @@ export async function startResidentRuntime(
   };
   ctxHolder.startBackgroundWork = (operation) =>
     runtime.startBackgroundWork(operation);
+  ctxHolder.invalidateEgressPolicy = async () => {
+    const sessionsInvalidated = transportStatusProvider?.().activeSessions ?? 0;
+    const policyEpoch = collectionEgressPolicyEpoch(ctxHolder.config);
+    authorizationEpoch = policyEpoch;
+    const queuedJobsInvalidated = jobManager.setAuthorizationEpoch(policyEpoch);
+    await policySessionInvalidator?.();
+    return {
+      policyEpoch,
+      queuedJobsInvalidated,
+      sessionsInvalidated,
+      staleWorkMustRetry: true,
+    };
+  };
   mcpContext.getResidentStatus = () => runtime.getStatus();
   return { success: true, runtime };
 }