@goodea/olimpyx 0.1.1 → 0.3.0

package/src/resident/resident-store.mjs

@@ -0,0 +1,157 @@
+import { constants } from 'node:fs';
+import { chmod, lstat, mkdir, open, readFile, rename, rmdir, unlink } from 'node:fs/promises';
+import { hostname } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const noFollow = constants.O_NOFOLLOW;
+const missing = (error) => error.code === 'ENOENT';
+
+/** Private permanent storage. Filenames are fixed, never selected by model input.
+ * Callers serialize read/modify/write operations with withLock().
+ */
+export class ResidentStore {
+  constructor(home, { now = Date.now } = {}) {
+    this.root = join(home, 'resident');
+    this.now = now;
+  }
+
+  async prepare() {
+    await mkdir(this.root, { recursive: true, mode: 0o700 });
+    if (!(await lstat(this.root)).isDirectory()) throw new Error('Resident storage must be a real directory');
+    await chmod(this.root, 0o700);
+  }
+
+  async syncDirectory() {
+    const directory = await open(this.root, constants.O_RDONLY | noFollow);
+    try { await directory.sync(); } finally { await directory.close(); }
+  }
+
+  async read() {
+    let file;
+    try {
+      file = await open(join(this.root, 'state.json'), constants.O_RDONLY | noFollow);
+      return JSON.parse(await file.readFile('utf8'));
+    } catch (error) {
+      if (missing(error)) return null;
+      throw error;
+    } finally { await file?.close(); }
+  }
+
+  async save(state) {
+    const content = JSON.stringify(state);
+    if (content === undefined) throw new Error('State must be JSON serializable');
+    await this.prepare();
+    const temporary = join(this.root, `.state-${randomUUID()}.tmp`);
+    let file;
+    try {
+      file = await open(temporary, 'wx', 0o600);
+      await file.writeFile(`${content}\n`);
+      await file.sync();
+      await file.close();
+      file = null;
+      await rename(temporary, join(this.root, 'state.json'));
+      await this.syncDirectory();
+    } finally {
+      await file?.close();
+      await unlink(temporary).catch((error) => { if (!missing(error)) throw error; });
+    }
+  }
+
+  async append(record) {
+    const content = JSON.stringify(record);
+    if (content === undefined) throw new Error('Journal record must be JSON serializable');
+    await this.prepare();
+    const file = await open(join(this.root, 'memory.jsonl'), constants.O_CREAT | constants.O_RDWR | noFollow, 0o600);
+    try {
+      await file.chmod(0o600);
+      let end = (await file.stat()).size;
+      // A newline commits a record. Remove only a torn final record before appending.
+      const buffer = Buffer.alloc(8192);
+      let position = end;
+      while (position > 0) {
+        const start = Math.max(0, position - buffer.length);
+        const { bytesRead } = await file.read(buffer, 0, position - start, start);
+        const newline = buffer.subarray(0, bytesRead).lastIndexOf(10);
+        if (newline >= 0) { end = start + newline + 1; break; }
+        position = start;
+        end = start;
+      }
+      await file.truncate(end);
+      const bytes = Buffer.from(`${content}\n`);
+      let written = 0;
+      while (written < bytes.length) {
+        const result = await file.write(bytes, written, bytes.length - written, end + written);
+        if (!result.bytesWritten) throw new Error('Journal write made no progress');
+        written += result.bytesWritten;
+      }
+      await file.sync();
+    } finally { await file.close(); }
+    await this.syncDirectory();
+  }
+
+  async readRecent(limit = 5, maxChars = 6000) {
+    if (!Number.isSafeInteger(limit) || limit < 0 || !Number.isSafeInteger(maxChars) || maxChars < 0 || maxChars > 1_000_000) {
+      throw new Error('Invalid recent-memory bounds');
+    }
+    if (!limit || !maxChars) return [];
+    let file;
+    try {
+      file = await open(join(this.root, 'memory.jsonl'), constants.O_RDONLY | noFollow);
+      const size = (await file.stat()).size;
+      const start = Math.max(0, size - (maxChars * 4 + 8));
+      const buffer = Buffer.alloc(size - start);
+      const { bytesRead } = await file.read(buffer, 0, buffer.length, start);
+      let text = buffer.subarray(0, bytesRead).toString('utf8');
+      if (start) text = text.slice(text.indexOf('\n') + 1);
+      const lines = text.split('\n');
+      lines.pop(); // Ignore an incomplete final record, including a partial JSON token.
+      const records = [];
+      let used = 0;
+      for (let index = lines.length - 1; index >= 0 && records.length < limit; index -= 1) {
+        const line = lines[index];
+        if (used + line.length + 1 > maxChars) break;
+        records.unshift(JSON.parse(line));
+        used += line.length + 1;
+      }
+      return records;
+    } catch (error) {
+      if (missing(error)) return [];
+      throw error;
+    } finally { await file?.close(); }
+  }
+
+  async withLock(callback) {
+    await this.prepare();
+    const guard = join(this.root, '.lock-acquisition');
+    const path = join(this.root, 'lock.json');
+    const owner = { token: randomUUID(), pid: process.pid, hostname: hostname(), createdAt: this.now() };
+    try { await mkdir(guard, { mode: 0o700 }); } catch (error) {
+      if (error.code === 'EEXIST') throw new Error('Resident lock acquisition is busy; stale acquisition guards require manual inspection');
+      throw error;
+    }
+    try {
+      let existing;
+      try { existing = JSON.parse(await readFile(path, 'utf8')); } catch (error) { if (!missing(error)) throw error; }
+      if (existing) {
+        if (existing.hostname !== hostname() || !Number.isSafeInteger(existing.pid) || existing.pid <= 0 || typeof existing.token !== 'string') {
+          throw new Error('Resident lock owner cannot be safely verified');
+        }
+        let dead = false;
+        try { process.kill(existing.pid, 0); } catch (error) { dead = error.code === 'ESRCH'; }
+        if (!dead) throw new Error('Resident operation is already active');
+        await unlink(path);
+      }
+      const lock = await open(path, 'wx', 0o600);
+      try { await lock.writeFile(JSON.stringify(owner)); await lock.sync(); } finally { await lock.close(); }
+      await this.syncDirectory();
+    } finally { await rmdir(guard); }
+    try { return await callback(); } finally {
+      const current = JSON.parse(await readFile(path, 'utf8'));
+      if (current.token === owner.token) {
+        await unlink(path);
+        await this.syncDirectory();
+      }
+    }
+  }
+}

package/src/state.js

@@ -13,12 +13,32 @@ async function atomicJson(path, value, mode = 0o600) {
   await rename(temp, path);
 }
 
+// Sanitise caller-id for use as a directory segment. A caller-id is generated
+// by the participant as e.g. `caller-helios-<pid>-<unix>`, so it normally
+// contains only [a-z0-9-]. We still strip anything else defensively so a
+// hostile caller-id cannot escape the per-caller state directory.
+function safeCallerId(callerId) {
+  if (typeof callerId !== 'string' || !callerId.trim()) return null;
+  if (!/^[A-Za-z0-9._-]{1,128}$/.test(callerId)) return null;
+  return callerId;
+}
+
 export class LocalState {
   constructor(root) { this.root = root; }
   async init() {
     await mkdir(this.root, { recursive: true, mode: 0o700 });
     await mkdir(join(this.root, 'persona-revisions'), { recursive: true, mode: 0o700 });
   }
+  // Per-caller session directory (F-04): when several participants share one
+  // OLIMPYX_HOME, each caller's session.json / session-credential / pending
+  // mutations live under their own subdir so they no longer clobber each other.
+  async callerDir(callerId) {
+    const id = safeCallerId(callerId);
+    if (!id) return this.root;
+    const dir = join(this.root, 'calls', id);
+    await mkdir(dir, { recursive: true, mode: 0o700 });
+    return dir;
+  }
   async loadConfig() { return readJson(join(this.root, 'config.json'), {}); }
   async saveConfig(config) { await this.init(); await atomicJson(join(this.root, 'config.json'), config); return config; }
   async loadCredential() { return (await readFile(join(this.root, 'credential'), 'utf8')).trim(); }
@@ -34,46 +54,52 @@ export class LocalState {
     await this.init(); const path = join(this.root, 'owner-credential');
     await writeFile(path, token, { mode: 0o600 }); await chmod(path, 0o600);
   }
-  async loadSession() {
-    const metadata = await readJson(join(this.root, 'session.json'), null);
+  async loadSession(callerId) {
+    const dir = await this.callerDir(callerId);
+    const metadata = await readJson(join(dir, 'session.json'), null);
     if (!metadata) return null;
-    return { ...metadata, token: (await readFile(join(this.root, 'session-credential'), 'utf8')).trim() };
+    return { ...metadata, token: (await readFile(join(dir, 'session-credential'), 'utf8')).trim() };
   }
   async saveSession(session, callerId, callerLeaseMs = 75_000) {
     if (!session?.session_id || !session?.session_token || !callerId) throw new Error('Complete session and callerId are required');
-    await this.init();
-    const credentialPath = join(this.root, 'session-credential');
+    const dir = await this.callerDir(callerId);
+    const credentialPath = join(dir, 'session-credential');
     await writeFile(credentialPath, session.session_token, { mode: 0o600 }); await chmod(credentialPath, 0o600);
     const metadata = { session_id: session.session_id, expires_at: session.expires_at, caller_id: callerId, caller_deadline: new Date(Date.now() + Math.min(callerLeaseMs, 85_000)).toISOString(), inbox_cursor: session.inbox_cursor ?? null };
-    await atomicJson(join(this.root, 'session.json'), metadata); return metadata;
+    await atomicJson(join(dir, 'session.json'), metadata); return metadata;
   }
   async renewSession(callerId, updates = {}, callerLeaseMs = 75_000) {
-    const session = await this.loadSession();
+    const session = await this.loadSession(callerId);
     if (!session) throw new Error('No local session. Run session begin first.');
     if (session.caller_id !== callerId) throw new Error('callerId does not own this participant session');
     if (Date.parse(session.caller_deadline) <= Date.now()) throw new Error('Local caller lease expired; begin a new session');
     const { token: _token, ...metadata } = session;
     const next = { ...metadata, ...updates, caller_deadline: new Date(Date.now() + Math.min(callerLeaseMs, 85_000)).toISOString() };
-    await atomicJson(join(this.root, 'session.json'), next); return next;
+    const dir = await this.callerDir(callerId);
+    await atomicJson(join(dir, 'session.json'), next); return next;
+  }
+  async clearSession(callerId) {
+    const dir = await this.callerDir(callerId);
+    await Promise.all([rm(join(dir, 'session.json'), { force: true }), rm(join(dir, 'session-credential'), { force: true })]);
   }
-  async clearSession() { await Promise.all([rm(join(this.root, 'session.json'), { force: true }), rm(join(this.root, 'session-credential'), { force: true })]); }
-  async beginMutation(method, path, body, explicitKey) {
+  async beginMutation(method, path, body, explicitKey, callerId) {
     if (explicitKey !== undefined) {
       if (typeof explicitKey !== 'string' || !explicitKey.trim()) throw new Error('--idempotency-key must be a non-empty value');
       return { fingerprint: null, key: explicitKey };
     }
-    await this.init();
+    const dir = await this.callerDir(callerId);
     const fingerprint = createHash('sha256').update(JSON.stringify({ method: method.toUpperCase(), path, body: body ?? null })).digest('hex');
-    const pending = await readJson(join(this.root, 'pending-mutations.json'), {});
+    const pending = await readJson(join(dir, 'pending-mutations.json'), {});
     if (!pending[fingerprint]) {
       pending[fingerprint] = { key: randomUUID(), method: method.toUpperCase(), path, created_at: new Date().toISOString() };
-      await atomicJson(join(this.root, 'pending-mutations.json'), pending);
+      await atomicJson(join(dir, 'pending-mutations.json'), pending);
     }
     return { fingerprint, key: pending[fingerprint].key };
   }
-  async completeMutation(fingerprint) {
+  async completeMutation(fingerprint, callerId) {
     if (!fingerprint) return;
-    const path = join(this.root, 'pending-mutations.json');
+    const dir = await this.callerDir(callerId);
+    const path = join(dir, 'pending-mutations.json');
     const pending = await readJson(path, {});
     delete pending[fingerprint];
     if (Object.keys(pending).length === 0) await rm(path, { force: true });