@minionry/minion 0.7.36

package/dist/server/services/model-catalog.js

@@ -0,0 +1,247 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { machinePath } from '../../bin/machine-layout.js';
+import { withFileLock, writeFileAtomic } from '../utils/file-store.js';
+function defaultCacheDir() {
+    return machinePath('cache');
+}
+const CACHE_TTL_MS = 24 * 60 * 60 * 1000;
+const FETCH_BUDGET_MS = 10_000;
+const HERMES_MANIFEST_URL = 'https://hermes-agent.nousresearch.com/docs/api/model-catalog.json';
+const OPENROUTER_MODELS_URL = 'https://openrouter.ai/api/v1/models';
+const defaultFetch = (url, init) => globalThis.fetch(url, init);
+const memoryCache = new Map();
+function getCacheEntry(dir) {
+    let entry = memoryCache.get(dir);
+    if (!entry) {
+        entry = { data: null, loadedFromDisk: false };
+        memoryCache.set(dir, entry);
+    }
+    return entry;
+}
+function cacheFilePath(dir) {
+    return join(dir, 'model-catalog.json');
+}
+function lockFilePath(dir) {
+    return join(dir, 'model-catalog.lock');
+}
+function isValidRowArray(value) {
+    return (Array.isArray(value) &&
+        value.every((row) => row !== null && typeof row === 'object' && typeof row.value === 'string' && typeof row.label === 'string'));
+}
+class InvalidCacheShapeError extends Error {
+}
+function parseHermesSection(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== 'object')
+        throw new InvalidCacheShapeError('hermes');
+    const h = value;
+    if (typeof h.updatedAt !== 'string' || !isValidRowArray(h.nous) || !isValidRowArray(h.openrouter)) {
+        throw new InvalidCacheShapeError('hermes');
+    }
+    return { updatedAt: h.updatedAt, nous: h.nous, openrouter: h.openrouter };
+}
+function parseOpenRouterSection(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value !== 'object')
+        throw new InvalidCacheShapeError('openrouter');
+    const o = value;
+    if (!isValidRowArray(o.models))
+        throw new InvalidCacheShapeError('openrouter');
+    return { models: o.models };
+}
+function normalizeStoredCatalog(parsed) {
+    if (parsed === null || typeof parsed !== 'object')
+        return null;
+    const p = parsed;
+    if (p.version !== 1 || typeof p.fetchedAt !== 'string')
+        return null;
+    const hermes = parseHermesSection(p.hermes);
+    const openrouter = parseOpenRouterSection(p.openrouter);
+    const errors = p.errors !== null && typeof p.errors === 'object'
+        ? p.errors
+        : undefined;
+    return { version: 1, fetchedAt: p.fetchedAt, hermes, openrouter, errors };
+}
+function loadFromDisk(dir) {
+    try {
+        const raw = readFileSync(cacheFilePath(dir), 'utf-8');
+        return normalizeStoredCatalog(JSON.parse(raw));
+    }
+    catch {
+        return null;
+    }
+}
+function persistToDisk(dir, data) {
+    try {
+        withFileLock(lockFilePath(dir), () => {
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true, mode: 0o700 });
+            writeFileAtomic(cacheFilePath(dir), JSON.stringify(data, null, 2), { mode: 0o600 });
+        });
+    }
+    catch (err) {
+        console.warn('[model-catalog] Failed to persist cache:', err);
+    }
+}
+function titleCase(slug) {
+    return slug
+        .split(/[-_\s]+/)
+        .filter(Boolean)
+        .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+        .join(' ');
+}
+function labelFromModelId(id) {
+    const modelPart = id.includes('/') ? id.slice(id.indexOf('/') + 1) : id;
+    return titleCase(modelPart);
+}
+function errorMessage(reason) {
+    return reason instanceof Error ? reason.message : String(reason);
+}
+function normalizeManifestRows(rows) {
+    if (!Array.isArray(rows))
+        return [];
+    const result = [];
+    for (const row of rows) {
+        if (!row || typeof row.id !== 'string')
+            continue;
+        result.push({
+            value: row.id,
+            label: labelFromModelId(row.id),
+            description: typeof row.description === 'string' ? row.description : undefined,
+            isDefault: row.default === true ? true : undefined,
+        });
+    }
+    return result;
+}
+async function fetchHermesManifest(fetchImpl, signal) {
+    const res = await fetchImpl(HERMES_MANIFEST_URL, { signal });
+    if (!res.ok)
+        throw new Error(`Hermes manifest fetch failed: ${res.status}`);
+    const json = (await res.json());
+    return {
+        updatedAt: typeof json.updated_at === 'string' ? json.updated_at : new Date().toISOString(),
+        nous: normalizeManifestRows(json.providers?.nous?.models),
+        openrouter: normalizeManifestRows(json.providers?.openrouter?.models),
+    };
+}
+async function fetchOpenRouterModels(fetchImpl, signal) {
+    const res = await fetchImpl(OPENROUTER_MODELS_URL, { signal });
+    if (!res.ok)
+        throw new Error(`OpenRouter models fetch failed: ${res.status}`);
+    const json = (await res.json());
+    const rows = Array.isArray(json.data) ? json.data : [];
+    const models = [];
+    for (const row of rows) {
+        if (!row || typeof row.id !== 'string')
+            continue;
+        models.push({
+            value: row.id,
+            label: typeof row.name === 'string' && row.name.length > 0 ? row.name : labelFromModelId(row.id),
+            description: typeof row.description === 'string' ? row.description : undefined,
+            contextLength: typeof row.context_length === 'number' ? row.context_length : undefined,
+        });
+    }
+    return { models };
+}
+async function performFetch(fetchImpl, previous) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), FETCH_BUDGET_MS);
+    try {
+        const [hermesResult, openrouterResult] = await Promise.allSettled([
+            fetchHermesManifest(fetchImpl, controller.signal),
+            fetchOpenRouterModels(fetchImpl, controller.signal),
+        ]);
+        const errors = {};
+        const hermes = hermesResult.status === 'fulfilled' ? hermesResult.value : previous?.hermes ?? null;
+        if (hermesResult.status === 'rejected')
+            errors.hermes = errorMessage(hermesResult.reason);
+        const openrouter = openrouterResult.status === 'fulfilled' ? openrouterResult.value : previous?.openrouter ?? null;
+        if (openrouterResult.status === 'rejected')
+            errors.openrouter = errorMessage(openrouterResult.reason);
+        return {
+            version: 1,
+            fetchedAt: new Date().toISOString(),
+            hermes,
+            openrouter,
+            errors: Object.keys(errors).length > 0 ? errors : undefined,
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function startFetch(dir, entry, fetchImpl) {
+    const previous = entry.data;
+    const promise = performFetch(fetchImpl, previous)
+        .then((stored) => {
+        entry.data = stored;
+        persistToDisk(dir, stored);
+        return stored;
+    })
+        .finally(() => {
+        entry.pending = undefined;
+    });
+    entry.pending = promise;
+    return promise;
+}
+function buildPayload(stored, stale, refreshing) {
+    const hasErrors = Boolean(stored.errors && (stored.errors.hermes || stored.errors.openrouter));
+    return {
+        version: 1,
+        fetchedAt: stored.fetchedAt,
+        stale: stale || hasErrors,
+        refreshing,
+        hermes: stored.hermes,
+        openrouter: stored.openrouter,
+        errors: stored.errors,
+    };
+}
+export function peekModelCatalog(deps = {}) {
+    const dir = deps.minionryDir ?? defaultCacheDir();
+    const entry = getCacheEntry(dir);
+    if (!entry.loadedFromDisk) {
+        entry.data = loadFromDisk(dir);
+        entry.loadedFromDisk = true;
+    }
+    const refreshing = Boolean(entry.pending);
+    if (!entry.data) {
+        return {
+            version: 1,
+            fetchedAt: null,
+            stale: true,
+            refreshing,
+            hermes: null,
+            openrouter: null,
+        };
+    }
+    const age = Date.now() - Date.parse(entry.data.fetchedAt);
+    const isStaleByAge = !Number.isFinite(age) || age > CACHE_TTL_MS;
+    return buildPayload(entry.data, isStaleByAge || refreshing, refreshing);
+}
+export async function getModelCatalog(options = {}, deps = {}) {
+    const dir = deps.minionryDir ?? defaultCacheDir();
+    const fetchImpl = deps.fetchImpl ?? defaultFetch;
+    const entry = getCacheEntry(dir);
+    if (!entry.loadedFromDisk) {
+        entry.data = loadFromDisk(dir);
+        entry.loadedFromDisk = true;
+    }
+    const refresh = options.refresh === true;
+    if (!entry.data || refresh) {
+        const stored = await (entry.pending ?? startFetch(dir, entry, fetchImpl));
+        return { payload: buildPayload(stored, false, false), didFetch: true };
+    }
+    const age = Date.now() - Date.parse(entry.data.fetchedAt);
+    const isStaleByAge = !Number.isFinite(age) || age > CACHE_TTL_MS;
+    if (isStaleByAge && !entry.pending) {
+        const backgroundRefresh = startFetch(dir, entry, fetchImpl).then((stored) => buildPayload(stored, false, false));
+        return { payload: buildPayload(entry.data, true, true), didFetch: false, backgroundRefresh };
+    }
+    const refreshing = Boolean(entry.pending);
+    return { payload: buildPayload(entry.data, isStaleByAge || refreshing, refreshing), didFetch: false };
+}

package/dist/server/services/observability/posthog.js

@@ -0,0 +1,153 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { trackEvent } from '../analytics.js';
+export const BROWSER_V3_SESSION_STATS_EVENT = 'browser_v3_session_stats';
+export const BROWSER_V3_SESSION_START_EVENT = 'browser_v3_session_start';
+export const BROWSER_V3_FALLBACK_EVENT = 'browser_v3_fallback';
+export const BROWSER_V3_SESSION_END_EVENT = 'browser_v3_session_end';
+export function trackBrowserV3SessionStart(props, emit = trackEvent) {
+    emit(BROWSER_V3_SESSION_START_EVENT, stripUndefined({ ...props }));
+}
+export function trackBrowserV3Fallback(props, emit = trackEvent) {
+    emit(BROWSER_V3_FALLBACK_EVENT, stripUndefined({ ...props }));
+}
+export function trackBrowserV3SessionEnd(props, emit = trackEvent) {
+    emit(BROWSER_V3_SESSION_END_EVENT, stripUndefined({ ...props }));
+}
+function stripUndefined(o) {
+    for (const [k, v] of Object.entries(o)) {
+        if (v === undefined)
+            delete o[k];
+    }
+    return o;
+}
+export const DEFAULT_BROWSER_V3_FLUSH_INTERVAL_MS = 10_000;
+export class BrowserV3StatsBatcher {
+    context;
+    flushIntervalMs;
+    emit;
+    now;
+    timer = null;
+    samples = [];
+    windowStart = null;
+    closed = false;
+    constructor(opts) {
+        this.context = opts.context;
+        this.flushIntervalMs = opts.flushIntervalMs ?? DEFAULT_BROWSER_V3_FLUSH_INTERVAL_MS;
+        this.emit =
+            opts.emit ??
+                ((event, properties) => {
+                    trackEvent(event, properties);
+                });
+        this.now = opts.now ?? (() => Date.now());
+    }
+    start() {
+        if (this.timer || this.closed)
+            return;
+        this.timer = setInterval(() => this.flush(), this.flushIntervalMs);
+        if (typeof this.timer.unref === 'function')
+            this.timer.unref();
+    }
+    add(sample) {
+        if (this.closed)
+            return;
+        if (!this.windowStart) {
+            this.windowStart = {
+                packets_sent: sample.packets_sent,
+                bytes_sent: sample.bytes_sent,
+                nack_count: sample.nack_count,
+                pli_count: sample.pli_count,
+                frames_encoded: sample.frames_encoded,
+                packets_lost: sample.packets_lost,
+            };
+        }
+        this.samples.push(sample);
+    }
+    flush() {
+        if (this.samples.length === 0)
+            return;
+        const last = this.samples[this.samples.length - 1];
+        const baseline = this.windowStart ?? {};
+        const numericValues = (key) => this.samples.map((s) => {
+            const v = s[key];
+            return typeof v === 'number' ? v : undefined;
+        });
+        const mean = (key) => meanFiniteNumber(numericValues(key));
+        const max = (key) => maxFiniteNumber(numericValues(key));
+        const delta = (key) => finiteDelta(last[key], baseline[key]);
+        const payload = {
+            session_id: this.context.session_id,
+            orchestra_id: this.context.orchestra_id,
+            sample_count: this.samples.length,
+            candidate_pair_type: last.candidate_pair_type ?? 'unknown',
+            rtt_mean: mean('current_round_trip_time'),
+            rtt_max: max('current_round_trip_time'),
+            jitter_mean: mean('jitter'),
+            jitter_max: max('jitter'),
+            frames_per_second_mean: mean('frames_per_second'),
+            available_outgoing_bitrate_mean: mean('available_outgoing_bitrate'),
+            available_outgoing_bitrate_max: max('available_outgoing_bitrate'),
+            packets_sent_delta: delta('packets_sent'),
+            packets_sent_total: last.packets_sent,
+            bytes_sent_delta: delta('bytes_sent'),
+            bytes_sent_total: last.bytes_sent,
+            nack_count_delta: delta('nack_count'),
+            nack_count_total: last.nack_count,
+            pli_count_delta: delta('pli_count'),
+            pli_count_total: last.pli_count,
+            frames_encoded_delta: delta('frames_encoded'),
+            frames_encoded_total: last.frames_encoded,
+            packets_lost_delta: delta('packets_lost'),
+            packets_lost_total: last.packets_lost,
+            window_end_ts: last.timestamp ?? this.now(),
+        };
+        for (const [k, v] of Object.entries(payload)) {
+            if (v === undefined)
+                delete payload[k];
+        }
+        this.emit(BROWSER_V3_SESSION_STATS_EVENT, payload);
+        this.samples = [];
+        this.windowStart = null;
+    }
+    close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+        this.flush();
+    }
+}
+function meanFiniteNumber(values) {
+    let sum = 0;
+    let count = 0;
+    for (const v of values) {
+        if (typeof v === 'number' && Number.isFinite(v)) {
+            sum += v;
+            count += 1;
+        }
+    }
+    if (count === 0)
+        return undefined;
+    return sum / count;
+}
+function maxFiniteNumber(values) {
+    let best;
+    for (const v of values) {
+        if (typeof v === 'number' && Number.isFinite(v)) {
+            if (best === undefined || v > best)
+                best = v;
+        }
+    }
+    return best;
+}
+function finiteDelta(end, start) {
+    if (typeof end !== 'number' || !Number.isFinite(end))
+        return undefined;
+    if (typeof start !== 'number' || !Number.isFinite(start))
+        return end;
+    const diff = end - start;
+    return Number.isFinite(diff) ? diff : undefined;
+}

package/dist/server/services/pathUtils.js

@@ -0,0 +1,114 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, realpathSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, normalize, relative, resolve } from 'node:path';
+function ensureTrailingSep(dir) {
+    return dir.endsWith('/') ? dir : `${dir}/`;
+}
+function canonicalizeIfExists(path) {
+    return existsSync(path) ? realpathSync(path) : path;
+}
+function validateParentSymlink(resolvedPath, normalizedWorkingDir, targetPath) {
+    const parentDir = dirname(resolvedPath);
+    if (!existsSync(parentDir))
+        return null;
+    const realParent = realpathSync(parentDir);
+    const parentWithSep = ensureTrailingSep(normalizedWorkingDir);
+    if (realParent !== normalizedWorkingDir && !realParent.startsWith(parentWithSep)) {
+        console.error(`[PathUtils] SECURITY: Symlink traversal in parent directory blocked. ` +
+            `Target: "${targetPath}", RealParent: "${realParent}", WorkingDir: "${normalizedWorkingDir}"`);
+        return {
+            valid: false,
+            resolvedPath: '',
+            error: 'Access denied: parent directory resolves outside working directory'
+        };
+    }
+    return null;
+}
+function isPathWithinDir(resolvedPath, normalizedWorkingDir) {
+    return resolvedPath === normalizedWorkingDir ||
+        resolvedPath.startsWith(ensureTrailingSep(normalizedWorkingDir));
+}
+export function validatePathWithinWorkingDir(targetPath, workingDir) {
+    try {
+        const normalizedWorkingDir = canonicalizeIfExists(resolve(workingDir));
+        let resolvedPath = isAbsolute(targetPath)
+            ? resolve(targetPath)
+            : resolve(normalizedWorkingDir, targetPath);
+        resolvedPath = normalize(resolvedPath);
+        if (existsSync(resolvedPath)) {
+            resolvedPath = canonicalizeIfExists(resolvedPath);
+        }
+        else {
+            const parentError = validateParentSymlink(resolvedPath, normalizedWorkingDir, targetPath);
+            if (parentError)
+                return parentError;
+        }
+        if (!isPathWithinDir(resolvedPath, normalizedWorkingDir)) {
+            console.error(`[PathUtils] SECURITY: Path traversal attempt blocked. ` +
+                `Target: "${targetPath}", Resolved: "${resolvedPath}", WorkingDir: "${normalizedWorkingDir}"`);
+            return {
+                valid: false,
+                resolvedPath: '',
+                error: 'Access denied: path is outside working directory'
+            };
+        }
+        return {
+            valid: true,
+            resolvedPath
+        };
+    }
+    catch (error) {
+        console.error('[PathUtils] Error validating path:', error);
+        return {
+            valid: false,
+            resolvedPath: '',
+            error: `Invalid path: ${error instanceof Error ? error.message : String(error)}`
+        };
+    }
+}
+export function validateBothPathsWithinWorkingDir(sourcePath, destPath, workingDir) {
+    const sourceValidation = validatePathWithinWorkingDir(sourcePath, workingDir);
+    if (!sourceValidation.valid) {
+        return {
+            valid: false,
+            resolvedSourcePath: '',
+            resolvedDestPath: '',
+            error: `Source path error: ${sourceValidation.error}`
+        };
+    }
+    const destValidation = validatePathWithinWorkingDir(destPath, workingDir);
+    if (!destValidation.valid) {
+        return {
+            valid: false,
+            resolvedSourcePath: '',
+            resolvedDestPath: '',
+            error: `Destination path error: ${destValidation.error}`
+        };
+    }
+    return {
+        valid: true,
+        resolvedSourcePath: sourceValidation.resolvedPath,
+        resolvedDestPath: destValidation.resolvedPath
+    };
+}
+export function getRelativePath(absolutePath, workingDir) {
+    return relative(resolve(workingDir), absolutePath);
+}
+export function isDirectory(path) {
+    try {
+        return statSync(path, { throwIfNoEntry: false })?.isDirectory() === true;
+    }
+    catch {
+        return false;
+    }
+}
+export function containsDangerousPatterns(path) {
+    const dangerousPatterns = [
+        /\0/,
+        /^~/,
+        /\$\{/,
+        /\$\(/,
+    ];
+    return dangerousPatterns.some(pattern => pattern.test(path));
+}

package/dist/server/services/plan/agent-loader.js

@@ -0,0 +1,97 @@
+// Copyright (c) 2025-present Minionry, Inc.
+// SPDX-License-Identifier: LicenseRef-Minionry-Software
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { findSkillsDir } from '../../utils/paths.js';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SYSTEM_AGENTS_DIR = join(__dirname, 'agents');
+function stripFrontmatter(content) {
+    if (!content.startsWith('---'))
+        return content;
+    const endIdx = content.indexOf('---', 3);
+    if (endIdx === -1)
+        return content;
+    return content.slice(endIdx + 3).trimStart();
+}
+function extractFrontmatter(content) {
+    if (!content.startsWith('---'))
+        return '';
+    const endIdx = content.indexOf('---', 3);
+    if (endIdx === -1)
+        return '';
+    return content.slice(3, endIdx);
+}
+function interpolate(template, variables) {
+    return template.replace(/\{\{(\w+)\}\}/g, (match, key) => {
+        return key in variables ? variables[key] : match;
+    });
+}
+function tryLoadFile(filePath, variables) {
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const raw = readFileSync(filePath, 'utf-8');
+        return interpolate(stripFrontmatter(raw), variables);
+    }
+    catch {
+        return null;
+    }
+}
+export function loadAgentPrompt(agentName, variables, boardDir, workingDir) {
+    const fileName = `${agentName}.md`;
+    if (boardDir) {
+        const result = tryLoadFile(join(boardDir, 'agents', fileName), variables);
+        if (result)
+            return result;
+    }
+    if (workingDir) {
+        const skillsDir = findSkillsDir(workingDir);
+        if (skillsDir) {
+            const result = tryLoadFile(join(skillsDir, agentName, 'SKILL.md'), variables);
+            if (result)
+                return result;
+        }
+    }
+    return tryLoadFile(join(SYSTEM_AGENTS_DIR, fileName), variables);
+}
+export function loadSkillTemplate(skillName, workingDir) {
+    const raw = readSkillFile(skillName, workingDir);
+    return raw === null ? null : stripFrontmatter(raw);
+}
+function readSkillFile(skillName, workingDir) {
+    const candidates = [];
+    if (workingDir) {
+        const skillsDir = findSkillsDir(workingDir);
+        if (skillsDir)
+            candidates.push(join(skillsDir, skillName, 'SKILL.md'));
+    }
+    candidates.push(join(SYSTEM_AGENTS_DIR, `${skillName}.md`));
+    for (const path of candidates) {
+        if (!existsSync(path))
+            continue;
+        try {
+            return readFileSync(path, 'utf-8');
+        }
+        catch {   }
+    }
+    return null;
+}
+export function declaredSkillVariables(skillName, workingDir) {
+    const raw = readSkillFile(skillName, workingDir);
+    if (raw === null)
+        return null;
+    const match = extractFrontmatter(raw).match(/^variables:\s*\[([^\]]*)\]\s*$/m);
+    if (!match)
+        return null;
+    return match[1]
+        .split(',')
+        .map((name) => name.trim())
+        .filter((name) => name.length > 0);
+}
+export function loadSkillPrompt(skillName, variables, workingDir) {
+    const template = loadSkillTemplate(skillName, workingDir);
+    if (!template)
+        return null;
+    return interpolate(template, variables);
+}