@kafca/agentdock 0.1.61 → 0.1.63

package/dist-electron/services/local-ai-core/src/acp/store/automation-script-store.js

@@ -0,0 +1,415 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalAutomationScriptStore = void 0;
+exports.parseAutomationScriptVersionRow = parseAutomationScriptVersionRow;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const script_package_js_1 = require("../../automation/scripts/script-package.js");
+const SCRIPT_COLUMNS = 'id, workspace_id, title, description, created_at, updated_at';
+const VERSION_COLUMNS = `
+  id, script_id, status, package_sha256, package_path, shebang, interpreter_path, interpreter_version,
+  created_at, updated_at, version_json
+`;
+class LocalAutomationScriptStore {
+    db;
+    userDataPath;
+    constructor(db, userDataPath) {
+        this.db = db;
+        this.userDataPath = userDataPath;
+    }
+    createScript(input) {
+        const now = new Date().toISOString();
+        const script = {
+            id: `script:${(0, node_crypto_1.randomUUID)()}`,
+            workspaceId: requiredString(input.workspaceId, 'Automation script workspaceId'),
+            title: requiredString(input.title, 'Automation script title'),
+            ...(input.description === undefined ? {} : { description: optionalDescription(input.description) }),
+            createdAt: now,
+            updatedAt: now,
+        };
+        this.db.prepare(`
+      INSERT INTO automation_scripts (id, workspace_id, title, description, created_at, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(script.id, script.workspaceId, script.title, script.description ?? null, script.createdAt, script.updatedAt);
+        return this.getScript(script.id);
+    }
+    updateScript(scriptId, input) {
+        const existing = this.requireScript(scriptId);
+        const updated = {
+            ...existing,
+            ...(input.title === undefined ? {} : { title: requiredString(input.title, 'Automation script title') }),
+            ...(input.description === undefined ? {} : { description: optionalDescription(input.description) }),
+            updatedAt: new Date().toISOString(),
+        };
+        this.db.prepare(`
+      UPDATE automation_scripts
+      SET title = ?, description = ?, updated_at = ?
+      WHERE id = ?
+    `).run(updated.title, updated.description ?? null, updated.updatedAt, scriptId);
+        return this.getScript(scriptId);
+    }
+    listScripts(workspaceId) {
+        const rows = this.db.prepare(`
+      SELECT ${SCRIPT_COLUMNS}
+      FROM automation_scripts
+      ${workspaceId ? 'WHERE workspace_id = ?' : ''}
+      ORDER BY updated_at DESC, id DESC
+    `).all(...(workspaceId ? [workspaceId] : []));
+        return rows.map((row) => this.toScript(row));
+    }
+    getScript(scriptId) {
+        const row = this.db.prepare(`SELECT ${SCRIPT_COLUMNS} FROM automation_scripts WHERE id = ?`)
+            .get(scriptId);
+        return row ? this.toScript(row) : undefined;
+    }
+    createVersionFromPackage(input) {
+        this.requireScript(input.scriptId);
+        const staged = (0, script_package_js_1.stageImmutableScriptPackage)({
+            userDataPath: this.userDataPath,
+            scriptId: input.scriptId,
+            sourceDir: input.sourceDir,
+        });
+        return this.createVersionFromStaged(input.scriptId, staged, input.interpreterPath, input.interpreterVersion);
+    }
+    /**
+     * Stages an API-uploaded source bundle through a server-owned temporary path.
+     * The public route deliberately never receives a filesystem path or interpreter.
+     */
+    stageSource(input) {
+        this.requireScript(input.scriptId);
+        const stagingRoot = (0, node_path_1.join)((0, node_path_1.resolve)(this.userDataPath), 'automations', 'staging');
+        (0, node_fs_1.mkdirSync)(stagingRoot, { recursive: true });
+        const sourceDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)(stagingRoot, 'upload-'));
+        try {
+            writeUploadedSource(sourceDir, input.files);
+            return (0, script_package_js_1.stageImmutableScriptPackage)({ userDataPath: this.userDataPath, scriptId: input.scriptId, sourceDir });
+        }
+        finally {
+            (0, node_fs_1.rmSync)(sourceDir, { recursive: true, force: true });
+        }
+    }
+    createVersionFromStaged(scriptId, staged, interpreterPath, interpreterVersion) {
+        const now = new Date().toISOString();
+        const version = toVersion({
+            id: `script-version:${(0, node_crypto_1.randomUUID)()}`,
+            scriptId,
+            status: 'draft',
+            staged,
+            interpreterPath: requiredString(interpreterPath, 'Automation script interpreterPath'),
+            interpreterVersion: requiredString(interpreterVersion, 'Automation script interpreterVersion'),
+            createdAt: now,
+            updatedAt: now,
+        });
+        this.db.prepare(`
+      INSERT INTO automation_script_versions (
+        id, script_id, status, package_sha256, package_path, shebang, interpreter_path, interpreter_version,
+        created_at, updated_at, version_json
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).run(version.id, version.scriptId, version.status, version.packageSha256, version.packagePath, version.shebang, version.interpreterPath, version.interpreterVersion, version.createdAt, version.updatedAt, JSON.stringify(version));
+        return this.getVersion(version.id);
+    }
+    discardUnreferencedPackage(scriptId, staged) {
+        this.requireScript(scriptId);
+        const referenced = this.db.prepare(`
+      SELECT 1 FROM automation_script_versions WHERE script_id = ? AND package_sha256 = ? LIMIT 1
+    `).get(scriptId, staged.packageSha256);
+        if (referenced)
+            return;
+        const expectedRoot = (0, node_path_1.join)((0, node_path_1.resolve)(this.userDataPath), 'automations', 'scripts', scriptId);
+        const expectedPath = (0, node_path_1.join)(expectedRoot, staged.packageSha256);
+        if (staged.packagePath !== expectedPath)
+            throw new Error('Refusing to discard an unexpected automation script package path.');
+        makeWritableForDiscard(staged.packagePath);
+        (0, node_fs_1.rmSync)(staged.packagePath, { recursive: true, force: true, maxRetries: 2 });
+    }
+    listVersions(scriptId) {
+        this.requireScript(scriptId);
+        const rows = this.db.prepare(`
+      SELECT ${VERSION_COLUMNS}
+      FROM automation_script_versions
+      WHERE script_id = ?
+      ORDER BY created_at DESC, id DESC
+    `).all(scriptId);
+        return rows.map((row) => this.toVersion(row));
+    }
+    getVersion(versionId) {
+        const row = this.db.prepare(`SELECT ${VERSION_COLUMNS} FROM automation_script_versions WHERE id = ?`)
+            .get(versionId);
+        return row ? this.toVersion(row) : undefined;
+    }
+    requireScript(scriptId) {
+        const script = this.getScript(scriptId);
+        if (!script)
+            throw new Error(`Automation script not found: ${scriptId}`);
+        return script;
+    }
+    toScript(row) {
+        return {
+            id: row.id,
+            workspaceId: row.workspace_id,
+            title: row.title,
+            ...(row.description === null ? {} : { description: row.description }),
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
+    toVersion(row) {
+        return parseAutomationScriptVersionRow(row);
+    }
+}
+exports.LocalAutomationScriptStore = LocalAutomationScriptStore;
+const MAX_UPLOAD_FILES = 64;
+const MAX_UPLOAD_BYTES = 1024 * 1024;
+function writeUploadedSource(sourceDir, files) {
+    if (!Array.isArray(files) || files.length === 0 || files.length > MAX_UPLOAD_FILES) {
+        throw new Error(`Automation script source must contain between 1 and ${MAX_UPLOAD_FILES} files.`);
+    }
+    const seen = new Set();
+    let totalBytes = 0;
+    for (const file of files) {
+        const path = normalizeUploadPath(file.path);
+        if (seen.has(path))
+            throw new Error(`Automation script source has duplicate file path: ${path}`);
+        seen.add(path);
+        if (typeof file.content !== 'string')
+            throw new Error(`Automation script source file ${path} must be text.`);
+        const content = Buffer.from(file.content, 'utf8');
+        totalBytes += content.byteLength;
+        if (totalBytes > MAX_UPLOAD_BYTES)
+            throw new Error(`Automation script source exceeds ${MAX_UPLOAD_BYTES} bytes.`);
+        const target = (0, node_path_1.join)(sourceDir, ...path.split('/'));
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(target), { recursive: true });
+        (0, node_fs_1.writeFileSync)(target, content, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    }
+}
+function normalizeUploadPath(value) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error('Automation script source file path is required.');
+    const path = value.trim();
+    if (path.includes('\\') || path.startsWith('/') || node_path_1.posix.isAbsolute(path) || node_path_1.win32.isAbsolute(path)) {
+        throw new Error('Automation script source file path must be relative POSIX path.');
+    }
+    const normalized = node_path_1.posix.normalize(path);
+    if (normalized !== path || path.split('/').some((part) => !part || part === '.' || part === '..')) {
+        throw new Error('Automation script source file path must not contain traversal.');
+    }
+    return path;
+}
+function makeWritableForDiscard(path) {
+    const stat = (0, node_fs_1.lstatSync)(path);
+    if (stat.isSymbolicLink())
+        throw new Error('Refusing to discard a symlinked automation script package.');
+    if (stat.isDirectory()) {
+        for (const child of (0, node_fs_1.readdirSync)(path))
+            makeWritableForDiscard((0, node_path_1.join)(path, child));
+        (0, node_fs_1.chmodSync)(path, 0o700);
+        return;
+    }
+    if (!stat.isFile())
+        throw new Error('Refusing to discard a non-regular automation script package entry.');
+    (0, node_fs_1.chmodSync)(path, 0o600);
+}
+function parseAutomationScriptVersionRow(row) {
+    try {
+        const version = parseVersion(row.version_json);
+        assertDuplicatedField('id', row.id, version.id);
+        assertDuplicatedField('scriptId', row.script_id, version.scriptId);
+        assertDuplicatedField('status', row.status, version.status);
+        assertDuplicatedField('packageSha256', row.package_sha256, version.packageSha256);
+        assertDuplicatedField('packagePath', row.package_path, version.packagePath);
+        assertDuplicatedField('shebang', row.shebang, version.shebang);
+        assertDuplicatedField('interpreterPath', row.interpreter_path, version.interpreterPath);
+        assertDuplicatedField('interpreterVersion', row.interpreter_version, version.interpreterVersion);
+        assertDuplicatedField('createdAt', row.created_at, version.createdAt);
+        assertDuplicatedField('updatedAt', row.updated_at, version.updatedAt);
+        return version;
+    }
+    catch (error) {
+        throw new Error(`Automation script version ${row.id} contains invalid persisted data: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function toVersion(input) {
+    const manifest = input.staged.manifest;
+    return {
+        id: input.id,
+        scriptId: input.scriptId,
+        status: input.status,
+        packageSha256: input.staged.packageSha256,
+        packagePath: input.staged.packagePath,
+        shebang: input.staged.shebang,
+        interpreterPath: input.interpreterPath,
+        interpreterVersion: input.interpreterVersion,
+        capabilities: asRecord(manifest.capabilities ?? {}, 'Automation script capabilities'),
+        config: asRecord(manifest.config, 'Automation script config'),
+        configSchema: asRecord(manifest.configSchema, 'Automation script configSchema'),
+        networkMode: manifest.capabilities.network,
+        internalAccess: manifest.capabilities.internalAccess,
+        allowedReadDirs: stringArray(manifest.capabilities.allowedReadDirs, 'Automation script allowedReadDirs'),
+        secretRefs: stringArray(manifest.secretRefs, 'Automation script secretRefs'),
+        env: stringArray(manifest.env, 'Automation script env'),
+        limits: parseLimits(manifest.limits, 'Automation script limits'),
+        staticCheck: {
+            packageSha256: input.staged.packageSha256,
+            entries: input.staged.entries,
+        },
+        testPlan: asRecord(manifest.testPlan ?? {}, 'Automation script testPlan'),
+        createdAt: input.createdAt,
+        updatedAt: input.updatedAt,
+    };
+}
+function parseVersion(value) {
+    const parsed = JSON.parse(value);
+    return {
+        id: requiredString(parsed.id, 'Automation script version id'),
+        scriptId: requiredString(parsed.scriptId, 'Automation script version scriptId'),
+        status: parseStatus(parsed.status),
+        packageSha256: requiredString(parsed.packageSha256, 'Automation script version packageSha256'),
+        packagePath: requiredString(parsed.packagePath, 'Automation script version packagePath'),
+        shebang: requiredString(parsed.shebang, 'Automation script version shebang'),
+        interpreterPath: requiredString(parsed.interpreterPath, 'Automation script version interpreterPath'),
+        interpreterVersion: requiredString(parsed.interpreterVersion, 'Automation script version interpreterVersion'),
+        capabilities: asRecord(parsed.capabilities, 'Automation script version capabilities'),
+        config: asRecord(parsed.config, 'Automation script version config'),
+        configSchema: asRecord(parsed.configSchema, 'Automation script version configSchema'),
+        networkMode: parseNetworkMode(parsed.networkMode, 'Automation script version networkMode'),
+        internalAccess: booleanValue(parsed.internalAccess, 'Automation script version internalAccess'),
+        allowedReadDirs: stringArray(parsed.allowedReadDirs, 'Automation script version allowedReadDirs'),
+        secretRefs: stringArray(parsed.secretRefs, 'Automation script version secretRefs'),
+        env: stringArray(parsed.env, 'Automation script version env'),
+        limits: parseLimits(parsed.limits, 'Automation script version limits'),
+        staticCheck: parseStaticCheck(parsed.staticCheck, 'Automation script version staticCheck'),
+        testPlan: asRecord(parsed.testPlan, 'Automation script version testPlan'),
+        ...(parsed.testReport === undefined ? {} : { testReport: asRecord(parsed.testReport, 'Automation script version testReport') }),
+        ...(parsed.pendingTestApprovalId === undefined ? {} : { pendingTestApprovalId: optionalString(parsed.pendingTestApprovalId, 'Automation script version pendingTestApprovalId') }),
+        ...(parsed.pendingApprovalId === undefined ? {} : { pendingApprovalId: optionalString(parsed.pendingApprovalId, 'Automation script version pendingApprovalId') }),
+        ...(parsed.testAuthorization === undefined ? {} : { testAuthorization: parseAuditActor(parsed.testAuthorization, 'Automation script version testAuthorization') }),
+        ...(parsed.approval === undefined ? {} : { approval: parseAuditActor(parsed.approval, 'Automation script version approval') }),
+        ...(parsed.rejection === undefined ? {} : { rejection: parseAuditActor(parsed.rejection, 'Automation script version rejection') }),
+        ...(parsed.revocation === undefined ? {} : { revocation: parseAuditActor(parsed.revocation, 'Automation script version revocation') }),
+        createdAt: requiredString(parsed.createdAt, 'Automation script version createdAt'),
+        updatedAt: requiredString(parsed.updatedAt, 'Automation script version updatedAt'),
+    };
+}
+function parseStatus(value) {
+    if (value === 'draft' ||
+        value === 'pending_test_approval' ||
+        value === 'test_authorized' ||
+        value === 'testing' ||
+        value === 'tested' ||
+        value === 'pending_approval' ||
+        value === 'approved' ||
+        value === 'rejected' ||
+        value === 'revoked') {
+        return value;
+    }
+    throw new Error('Automation script version status is invalid.');
+}
+function requiredString(value, label) {
+    if (typeof value !== 'string' || !value.trim())
+        throw new Error(`${label} is required.`);
+    return value.trim();
+}
+function optionalString(value, label) {
+    if (value === undefined)
+        return undefined;
+    return requiredString(value, label);
+}
+function optionalDescription(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string')
+        throw new Error('Automation script description must be a string.');
+    const normalized = value.trim();
+    return normalized || undefined;
+}
+function asRecord(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new Error(`${label} must be an object.`);
+    return value;
+}
+function stringArray(value, label) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== 'string' || !item.trim())) {
+        throw new Error(`${label} must be an array of strings.`);
+    }
+    return value.map((item) => item.trim());
+}
+function booleanValue(value, label) {
+    if (typeof value !== 'boolean')
+        throw new Error(`${label} must be a boolean.`);
+    return value;
+}
+function parseNetworkMode(value, label) {
+    if (value === 'none' || value === 'public')
+        return value;
+    throw new Error(`${label} must be none or public.`);
+}
+function parseLimits(value, label) {
+    const limits = asRecord(value, label);
+    return {
+        timeoutMs: positiveSafeInteger(limits.timeoutMs, `${label}.timeoutMs`),
+        stdoutBytes: positiveSafeInteger(limits.stdoutBytes, `${label}.stdoutBytes`),
+        stderrBytes: positiveSafeInteger(limits.stderrBytes, `${label}.stderrBytes`),
+        payloadBytes: positiveSafeInteger(limits.payloadBytes, `${label}.payloadBytes`),
+        stateBytes: positiveSafeInteger(limits.stateBytes, `${label}.stateBytes`),
+    };
+}
+function positiveSafeInteger(value, label) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${label} must be a positive integer.`);
+    }
+    return value;
+}
+function parseStaticCheck(value, label) {
+    const staticCheck = asRecord(value, label);
+    requiredString(staticCheck.packageSha256, `${label}.packageSha256`);
+    if (!Array.isArray(staticCheck.entries))
+        throw new Error(`${label}.entries must be an array.`);
+    for (const [index, entry] of staticCheck.entries.entries()) {
+        const entryRecord = asRecord(entry, `${label}.entries[${index}]`);
+        requiredString(entryRecord.path, `${label}.entries[${index}].path`);
+        requiredString(entryRecord.sha256, `${label}.entries[${index}].sha256`);
+        nonNegativeSafeInteger(entryRecord.size, `${label}.entries[${index}].size`);
+    }
+    return staticCheck;
+}
+function nonNegativeSafeInteger(value, label) {
+    if (typeof value !== 'number' || !Number.isSafeInteger(value) || value < 0) {
+        throw new Error(`${label} must be a non-negative integer.`);
+    }
+    return value;
+}
+function parseAuditActor(value, label) {
+    const actor = asRecord(value, label);
+    return {
+        actor: requiredString(actor.actor, `${label}.actor`),
+        at: isoTimestamp(actor.at, `${label}.at`),
+        ...(actor.approvalId === undefined ? {} : { approvalId: optionalString(actor.approvalId, `${label}.approvalId`) }),
+    };
+}
+function isoTimestamp(value, label) {
+    const normalized = requiredString(value, label);
+    const match = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/.exec(normalized);
+    if (!match || Number.isNaN(Date.parse(normalized))) {
+        throw new Error(`${label} must be a valid ISO timestamp.`);
+    }
+    const [, yearText, monthText, dayText, hourText, minuteText, secondText] = match;
+    const year = Number(yearText);
+    const month = Number(monthText);
+    const day = Number(dayText);
+    const calendarDate = new Date(Date.UTC(year, month - 1, day));
+    if (calendarDate.getUTCFullYear() !== year ||
+        calendarDate.getUTCMonth() !== month - 1 ||
+        calendarDate.getUTCDate() !== day ||
+        Number(hourText) > 23 ||
+        Number(minuteText) > 59 ||
+        Number(secondText) > 59) {
+        throw new Error(`${label} must be a valid ISO timestamp.`);
+    }
+    return normalized;
+}
+function assertDuplicatedField(field, stored, json) {
+    if (stored !== json) {
+        throw new Error(`${field} mismatch between duplicated columns and JSON body.`);
+    }
+}