@gmickel/gno 1.28.0 → 1.29.1

package/src/core/egress-provenance.ts

@@ -0,0 +1,336 @@
+/** Canonical, content-free policy lineage for source and derived artifacts. */
+
+import { z } from "zod";
+
+import type { EgressPolicy, EgressPolicySource } from "../config/types";
+
+import { EgressPolicySchema, EgressPolicySourceSchema } from "../config/types";
+
+export interface EgressLineageSource {
+  collection: string;
+  policy: EgressPolicy;
+  source: EgressPolicySource;
+}
+
+export interface EgressLineage {
+  effectivePolicy: EgressPolicy;
+  digest: string;
+  sources: EgressLineageSource[];
+}
+
+export type EgressLineageInput = Readonly<{
+  collection: string;
+  policy: EgressPolicy;
+  source: EgressPolicySource;
+}>;
+
+const COLLECTION_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const MAX_EGRESS_LINEAGE_SOURCES = 128;
+const POLICY_RESTRICTIVENESS: Readonly<Record<EgressPolicy, number>> = {
+  local_only: 0,
+  lan: 1,
+  remote: 2,
+};
+
+export class EgressProvenanceError extends Error {
+  readonly code: "EMPTY_EGRESS_LINEAGE" | "INVALID_EGRESS_LINEAGE";
+
+  constructor(
+    code: "EMPTY_EGRESS_LINEAGE" | "INVALID_EGRESS_LINEAGE",
+    message: string
+  ) {
+    super(message);
+    this.name = "EgressProvenanceError";
+    this.code = code;
+  }
+}
+
+const compareCodeUnits = (left: string, right: string): number =>
+  left < right ? -1 : left > right ? 1 : 0;
+
+const canonicalize = (value: unknown): unknown => {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (value !== null && typeof value === "object") {
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([left], [right]) => compareCodeUnits(left, right))
+        .map(([key, child]) => [key, canonicalize(child)])
+    );
+  }
+  return value;
+};
+
+const canonicalJson = (value: unknown): string =>
+  JSON.stringify(canonicalize(value));
+const sha256Text = (value: string): string =>
+  new Bun.CryptoHasher("sha256").update(value).digest("hex");
+
+const invalidLineageInput = (): EgressProvenanceError =>
+  new EgressProvenanceError(
+    "INVALID_EGRESS_LINEAGE",
+    `Source policy lineage must be a readable dense array with at most ${MAX_EGRESS_LINEAGE_SOURCES} entries`
+  );
+
+const snapshotInputs = (
+  inputs: readonly EgressLineageInput[]
+): readonly EgressLineageInput[] => {
+  try {
+    if (!Array.isArray(inputs)) throw invalidLineageInput();
+    const { length } = inputs;
+    if (!Number.isSafeInteger(length) || length > MAX_EGRESS_LINEAGE_SOURCES) {
+      throw invalidLineageInput();
+    }
+    if (length === 0) {
+      throw new EgressProvenanceError(
+        "EMPTY_EGRESS_LINEAGE",
+        "Source policy lineage must contain at least one collection"
+      );
+    }
+
+    const snapshots: EgressLineageInput[] = [];
+    for (let index = 0; index < length; index += 1) {
+      if (!(index in inputs)) throw invalidLineageInput();
+      const input: unknown = inputs[index];
+      if (input === null || typeof input !== "object") {
+        throw invalidLineageInput();
+      }
+      const candidate = input as Partial<EgressLineageInput>;
+      snapshots.push({
+        collection: candidate.collection as string,
+        policy: candidate.policy as EgressPolicy,
+        source: candidate.source as EgressPolicySource,
+      });
+    }
+    return snapshots;
+  } catch (error) {
+    if (error instanceof EgressProvenanceError) throw error;
+    throw invalidLineageInput();
+  }
+};
+
+const canonicalSources = (
+  inputs: readonly EgressLineageInput[]
+): readonly EgressLineageSource[] => {
+  const snapshots = snapshotInputs(inputs);
+  const byCollection = new Map<string, EgressLineageSource>();
+  for (const input of snapshots) {
+    const collectionInput = input.collection;
+    const policyInput = input.policy;
+    const sourceInput = input.source;
+    if (
+      typeof collectionInput !== "string" ||
+      typeof policyInput !== "string" ||
+      typeof sourceInput !== "string"
+    ) {
+      throw new EgressProvenanceError(
+        "INVALID_EGRESS_LINEAGE",
+        "Source policy lineage contains an invalid collection or policy"
+      );
+    }
+    const collection = collectionInput.trim().toLowerCase();
+    const policy = EgressPolicySchema.safeParse(policyInput);
+    const source = EgressPolicySourceSchema.safeParse(sourceInput);
+    if (
+      collectionInput !== collection ||
+      !COLLECTION_PATTERN.test(collection) ||
+      !policy.success ||
+      !source.success ||
+      (source.data !== "explicit" && policy.data !== "local_only")
+    ) {
+      throw new EgressProvenanceError(
+        "INVALID_EGRESS_LINEAGE",
+        "Source policy lineage contains an invalid collection or policy"
+      );
+    }
+    const previous = byCollection.get(collection);
+    const current = {
+      collection,
+      policy: policy.data,
+      source: source.data,
+    };
+    if (previous) {
+      throw new EgressProvenanceError(
+        "INVALID_EGRESS_LINEAGE",
+        previous.policy === current.policy && previous.source === current.source
+          ? `Duplicate policy lineage for collection ${collection}`
+          : `Conflicting policy lineage for collection ${collection}`
+      );
+    }
+    byCollection.set(collection, current);
+  }
+  return Object.freeze(
+    [...byCollection.values()]
+      .sort((left, right) =>
+        compareCodeUnits(left.collection, right.collection)
+      )
+      .map((source) => Object.freeze(source))
+  );
+};
+
+/** Build deterministic lineage. Transformations can aggregate but never relax. */
+export const createEgressLineage = (
+  inputs: readonly EgressLineageInput[]
+): EgressLineage => {
+  const sources = canonicalSources(inputs);
+  const effectivePolicy = sources.reduce<EgressPolicy>(
+    (mostRestrictive, source) =>
+      POLICY_RESTRICTIVENESS[source.policy] <
+      POLICY_RESTRICTIVENESS[mostRestrictive]
+        ? source.policy
+        : mostRestrictive,
+    "remote"
+  );
+  const digest = sha256Text(
+    canonicalJson({
+      effectivePolicy,
+      sources: sources.map(({ collection, policy, source }) => ({
+        collection,
+        policy,
+        source,
+      })),
+    })
+  );
+  return Object.freeze({ effectivePolicy, digest, sources }) as EgressLineage;
+};
+
+/**
+ * Canonically merge already-bounded lineage projections. Exact duplicates are
+ * collapsed here, before the strict provenance construction boundary.
+ */
+export const mergeEgressLineages = (
+  lineages: readonly Pick<EgressLineage, "sources">[]
+): EgressLineage => {
+  const byCollection = new Map<string, EgressLineageInput>();
+  for (const lineage of lineages) {
+    for (const input of lineage.sources) {
+      const collection = input.collection;
+      const previous = byCollection.get(collection);
+      if (
+        previous &&
+        (previous.policy !== input.policy || previous.source !== input.source)
+      ) {
+        throw new EgressProvenanceError(
+          "INVALID_EGRESS_LINEAGE",
+          `Conflicting policy lineage for collection ${collection}`
+        );
+      }
+      if (!previous) byCollection.set(collection, input);
+    }
+  }
+  return createEgressLineage([...byCollection.values()]);
+};
+
+/** Resolve an exact requested scope; empty and unknown names fail closed. */
+export const resolveEgressLineage = (
+  inputs: readonly EgressLineageInput[],
+  requestedNames?: readonly string[]
+): EgressLineage => {
+  const canonical = canonicalSources(inputs);
+  if (requestedNames === undefined) return createEgressLineage(canonical);
+  let requested: string[];
+  try {
+    if (!Array.isArray(requestedNames)) throw invalidLineageInput();
+    const { length } = requestedNames;
+    if (!Number.isSafeInteger(length) || length > MAX_EGRESS_LINEAGE_SOURCES) {
+      throw invalidLineageInput();
+    }
+    const names: string[] = [];
+    for (let index = 0; index < length; index += 1) {
+      if (!(index in requestedNames)) throw invalidLineageInput();
+      const name: unknown = requestedNames[index];
+      if (
+        typeof name !== "string" ||
+        name !== name.trim().toLowerCase() ||
+        !COLLECTION_PATTERN.test(name)
+      ) {
+        throw new EgressProvenanceError(
+          "INVALID_EGRESS_LINEAGE",
+          "Requested policy scope contains an invalid collection"
+        );
+      }
+      names.push(name);
+    }
+    requested = [...new Set(names)].sort();
+  } catch (error) {
+    if (error instanceof EgressProvenanceError) throw error;
+    throw new EgressProvenanceError(
+      "INVALID_EGRESS_LINEAGE",
+      "Requested policy scope must be a readable dense bounded array"
+    );
+  }
+  if (requested.length === 0) {
+    throw new EgressProvenanceError(
+      "EMPTY_EGRESS_LINEAGE",
+      "Requested policy scope must contain at least one collection"
+    );
+  }
+  const byCollection = new Map(
+    canonical.map((input) => [input.collection, input])
+  );
+  const missing = requested.filter((name) => !byCollection.has(name));
+  if (missing.length > 0) {
+    throw new EgressProvenanceError(
+      "INVALID_EGRESS_LINEAGE",
+      `Unknown collection policy scope: ${missing.join(", ")}`
+    );
+  }
+  return createEgressLineage(
+    requested.map((name) => byCollection.get(name) as EgressLineageInput)
+  );
+};
+
+/** Conservative lineage for persisted legacy artifacts without provenance. */
+export const legacyLocalOnlyEgressLineage = (
+  collection = "legacy"
+): EgressLineage =>
+  createEgressLineage([
+    { collection, policy: "local_only", source: "legacy_default" },
+  ]);
+
+/** True only for the exact migration projection used by pre-lineage rows. */
+export const isMigratedLegacyEgressLineage = (
+  lineage: EgressLineage
+): boolean => lineage.digest === legacyLocalOnlyEgressLineage().digest;
+
+export const egressLineageByteSize = (lineage: EgressLineage): number =>
+  new TextEncoder().encode(canonicalJson(lineage)).byteLength;
+
+export const egressLineageSourceSchema = z
+  .object({
+    collection: z.string().regex(COLLECTION_PATTERN),
+    policy: EgressPolicySchema,
+    source: EgressPolicySourceSchema,
+  })
+  .strict();
+
+export const egressLineageSchema = z
+  .object({
+    effectivePolicy: EgressPolicySchema,
+    digest: z.string().regex(/^[a-f0-9]{64}$/),
+    sources: z
+      .array(egressLineageSourceSchema)
+      .min(1)
+      .max(MAX_EGRESS_LINEAGE_SOURCES),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    try {
+      const canonical = createEgressLineage(value.sources);
+      if (
+        canonical.effectivePolicy !== value.effectivePolicy ||
+        canonical.digest !== value.digest ||
+        JSON.stringify(canonical.sources) !== JSON.stringify(value.sources)
+      ) {
+        context.addIssue({
+          code: "custom",
+          message: "Egress lineage must be canonical and digest-bound",
+        });
+      }
+    } catch (error) {
+      context.addIssue({
+        code: "custom",
+        message:
+          error instanceof Error ? error.message : "Invalid egress lineage",
+      });
+    }
+  });

package/src/core/job-manager.ts

@@ -76,7 +76,9 @@ export class JobManager {
   #lockTimeoutMs: number;
   #activeJobId: string | null = null;
   #jobs = new Map<string, JobRecord>();
+  #jobAuthorizationEpochs = new Map<string, string>();
   #activeJobs = new Set<Promise<void>>();
+  #authorizationEpoch = "egress-epoch-uninitialized";
 
   constructor(options: JobManagerOptions) {
     this.#lockPath = options.lockPath;
@@ -154,6 +156,25 @@ export class JobManager {
     return this.#jobs.get(this.#activeJobId) ?? null;
   }
 
+  /**
+   * Rotate the authorization snapshot used by queued work. Jobs re-check this
+   * after acquiring the shared tool mutex, immediately before any work runs.
+   */
+  setAuthorizationEpoch(epoch: string): number {
+    if (epoch === this.#authorizationEpoch) return 0;
+    this.#authorizationEpoch = epoch;
+    let invalidated = 0;
+    for (const job of this.#jobs.values()) {
+      if (
+        job.status === "running" &&
+        this.#jobAuthorizationEpochs.get(job.id) !== epoch
+      ) {
+        invalidated += 1;
+      }
+    }
+    return invalidated;
+  }
+
   updateJobProgress(
     jobId: string,
     progress: { current: number; total: number; currentFile?: string }
@@ -164,6 +185,7 @@ export class JobManager {
 
   clear(): void {
     this.#jobs.clear();
+    this.#jobAuthorizationEpochs.clear();
     this.#activeJobId = null;
   }
 
@@ -203,6 +225,7 @@ export class JobManager {
     try {
       const release = await this.#toolMutex.acquire();
       try {
+        this.#assertAuthorizationEpoch(job);
         const result = await fn();
         job.status = "completed";
         job.result = result;
@@ -238,6 +261,7 @@ export class JobManager {
     };
 
     this.#jobs.set(jobId, job);
+    this.#jobAuthorizationEpochs.set(jobId, this.#authorizationEpoch);
     this.#activeJobId = jobId;
 
     const jobPromise = this.#runJob(job, fn, lock);
@@ -261,6 +285,7 @@ export class JobManager {
     };
 
     this.#jobs.set(jobId, job);
+    this.#jobAuthorizationEpochs.set(jobId, this.#authorizationEpoch);
     this.#activeJobId = jobId;
 
     const jobPromise = this.#runTypedJob(job, fn, lock);
@@ -277,6 +302,7 @@ export class JobManager {
     try {
       const release = await this.#toolMutex.acquire();
       try {
+        this.#assertAuthorizationEpoch(job);
         const result = await fn();
         job.status = "completed";
         job.typedResult = result;
@@ -305,6 +331,7 @@ export class JobManager {
       const completedAt = job.completedAt ?? job.startedAt;
       if (now - completedAt > JOB_EXPIRATION_MS) {
         this.#jobs.delete(id);
+        this.#jobAuthorizationEpochs.delete(id);
       }
     }
 
@@ -321,7 +348,17 @@ export class JobManager {
       const job = completed[i];
       if (job) {
         this.#jobs.delete(job.id);
+        this.#jobAuthorizationEpochs.delete(job.id);
       }
     }
   }
+
+  #assertAuthorizationEpoch(job: JobRecord): void {
+    if (this.#jobAuthorizationEpochs.get(job.id) === this.#authorizationEpoch) {
+      return;
+    }
+    throw new Error(
+      "STALE_EGRESS_POLICY: collection policy changed; retry to re-authorize"
+    );
+  }
 }

package/src/core/network-boundary-inventory.ts

@@ -0,0 +1,261 @@
+/** Checked callsite-level inventory of shipped network/process boundaries. */
+
+import type { EgressAction } from "./egress-policy";
+
+export type NetworkBoundaryPrimitive =
+  | "bun_connect"
+  | "bun_dns_lookup"
+  | "bun_serve"
+  | "child_process"
+  | "event_source"
+  | "fetch"
+  | "http_inference"
+  | "web_socket";
+
+export interface NetworkBoundaryInventoryEntry {
+  id: string;
+  key: string;
+  path: string;
+  primitive: NetworkBoundaryPrimitive | "logical";
+  action: EgressAction | null;
+  enforcement:
+    | "collection_policy"
+    | "client_transport"
+    | "disabled"
+    | "local_process_only"
+    | "loopback_only"
+    | "no_collection_data";
+  serverBoundary?: string;
+}
+
+export const NETWORK_BOUNDARY_INVENTORY = [
+  {
+    id: "daemon-listener",
+    key: "src/cli/commands/daemon.ts::bun_serve#1",
+    path: "src/cli/commands/daemon.ts",
+    primitive: "bun_serve",
+    action: "serve",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "semantic-setup-process",
+    key: "src/cli/commands/setup-semantic.ts::child_process#1",
+    path: "src/cli/commands/setup-semantic.ts",
+    primitive: "child_process",
+    action: null,
+    enforcement: "no_collection_data",
+  },
+  {
+    id: "detached-runtime-process",
+    key: "src/cli/detach.ts::child_process#1",
+    path: "src/cli/detach.ts",
+    primitive: "child_process",
+    action: null,
+    enforcement: "no_collection_data",
+  },
+  {
+    id: "detached-runtime-health",
+    key: "src/cli/detach.ts::fetch#1",
+    path: "src/cli/detach.ts",
+    primitive: "fetch",
+    action: null,
+    enforcement: "no_collection_data",
+  },
+  {
+    id: "terminal-pager",
+    key: "src/cli/pager.ts::child_process#1",
+    path: "src/cli/pager.ts",
+    primitive: "child_process",
+    action: null,
+    enforcement: "local_process_only",
+  },
+  {
+    id: "file-lock-process-probe",
+    key: "src/core/file-lock.ts::child_process#1",
+    path: "src/core/file-lock.ts",
+    primitive: "child_process",
+    action: null,
+    enforcement: "no_collection_data",
+  },
+  {
+    id: "local-file-operations",
+    key: "src/core/file-ops.ts::child_process#1",
+    path: "src/core/file-ops.ts",
+    primitive: "child_process",
+    action: null,
+    enforcement: "local_process_only",
+  },
+  {
+    id: "sync-update-command",
+    key: "src/ingestion/sync.ts::child_process#1",
+    path: "src/ingestion/sync.ts",
+    primitive: "child_process",
+    action: "export",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "sync-git-repository-check",
+    key: "src/ingestion/sync.ts::child_process#2",
+    path: "src/ingestion/sync.ts",
+    primitive: "child_process",
+    action: null,
+    enforcement: "local_process_only",
+  },
+  {
+    id: "sync-git-pull",
+    key: "src/ingestion/sync.ts::child_process#3",
+    path: "src/ingestion/sync.ts",
+    primitive: "child_process",
+    action: "export",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "inference-dns-classification",
+    key: "src/llm/http-policy.ts::bun_dns_lookup#1",
+    path: "src/llm/http-policy.ts",
+    primitive: "bun_dns_lookup",
+    action: "remote_inference",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "http-embedding-single",
+    key: "src/llm/httpEmbedding.ts::http_inference#1",
+    path: "src/llm/httpEmbedding.ts",
+    primitive: "http_inference",
+    action: "remote_inference",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "http-embedding-batch",
+    key: "src/llm/httpEmbedding.ts::http_inference#2",
+    path: "src/llm/httpEmbedding.ts",
+    primitive: "http_inference",
+    action: "remote_inference",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "http-generation",
+    key: "src/llm/httpGeneration.ts::http_inference#1",
+    path: "src/llm/httpGeneration.ts",
+    primitive: "http_inference",
+    action: "remote_inference",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "http-rerank",
+    key: "src/llm/httpRerank.ts::http_inference#1",
+    path: "src/llm/httpRerank.ts",
+    primitive: "http_inference",
+    action: "remote_inference",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "pinned-http-fetch",
+    key: "src/llm/pinned-http-connection.ts::fetch#1",
+    path: "src/llm/pinned-http-connection.ts",
+    primitive: "fetch",
+    action: "remote_inference",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "browser-blob-read",
+    key: "src/serve/public/components/ai-elements/prompt-input.tsx::fetch#1",
+    path: "src/serve/public/components/ai-elements/prompt-input.tsx",
+    primitive: "fetch",
+    action: null,
+    enforcement: "local_process_only",
+  },
+  {
+    id: "browser-api-hook",
+    key: "src/serve/public/hooks/use-api.ts::fetch#1",
+    path: "src/serve/public/hooks/use-api.ts",
+    primitive: "fetch",
+    action: "serve",
+    enforcement: "client_transport",
+    serverBoundary: "src/serve/server.ts",
+  },
+  {
+    id: "browser-api-helper",
+    key: "src/serve/public/hooks/use-api.ts::fetch#2",
+    path: "src/serve/public/hooks/use-api.ts",
+    primitive: "fetch",
+    action: "serve",
+    enforcement: "client_transport",
+    serverBoundary: "src/serve/server.ts",
+  },
+  {
+    id: "browser-document-events",
+    key: "src/serve/public/hooks/use-doc-events.ts::event_source#1",
+    path: "src/serve/public/hooks/use-doc-events.ts",
+    primitive: "event_source",
+    action: "serve",
+    enforcement: "client_transport",
+    serverBoundary: "src/serve/server.ts",
+  },
+  {
+    id: "clipper-pair-csrf",
+    key: "src/serve/public/lib/clipper-approval.ts::fetch#1",
+    path: "src/serve/public/lib/clipper-approval.ts",
+    primitive: "fetch",
+    action: "clip_write",
+    enforcement: "client_transport",
+    serverBoundary: "src/serve/routes/clipper.ts",
+  },
+  {
+    id: "clipper-pair-approval",
+    key: "src/serve/public/lib/clipper-approval.ts::fetch#2",
+    path: "src/serve/public/lib/clipper-approval.ts",
+    primitive: "fetch",
+    action: "clip_write",
+    enforcement: "client_transport",
+    serverBoundary: "src/serve/routes/clipper.ts",
+  },
+  {
+    id: "serve-listener",
+    key: "src/serve/server.ts::bun_serve#1",
+    path: "src/serve/server.ts",
+    primitive: "bun_serve",
+    action: "serve",
+    enforcement: "loopback_only",
+  },
+  {
+    id: "http-mcp-tools",
+    key: "logical::http-mcp-tools",
+    path: "src/mcp/http-egress.ts",
+    primitive: "logical",
+    action: "serve",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "http-mcp-resources",
+    key: "logical::http-mcp-resources",
+    path: "src/mcp/http-egress.ts",
+    primitive: "logical",
+    action: "serve",
+    enforcement: "collection_policy",
+  },
+  {
+    id: "local-publish-artifact",
+    key: "logical::local-publish-artifact",
+    path: "src/publish/export-service.ts",
+    primitive: "logical",
+    action: "export",
+    enforcement: "local_process_only",
+  },
+  {
+    id: "remote-publish-upload",
+    key: "logical::remote-publish-upload",
+    path: "src/publish/export-service.ts",
+    primitive: "logical",
+    action: null,
+    enforcement: "disabled",
+  },
+  {
+    id: "private-agent-access",
+    key: "logical::private-agent-access",
+    path: "src/publish/encrypted-export.ts",
+    primitive: "logical",
+    action: null,
+    enforcement: "disabled",
+  },
+] as const satisfies readonly NetworkBoundaryInventoryEntry[];