@moxt-ai/mobius 0.0.3 → 0.0.5

package/dist/agent-installation/fixed-agent-install-recipes.js

@@ -0,0 +1,163 @@
+import { mkdir, mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { resolveExecutablePath, runBoundedProcess, } from "../process/executable.js";
+import { InstallationManagerError } from "./agent-installation-manager.js";
+import { downloadVerifiedFile } from "./verified-download.js";
+const INSTALLER_DOWNLOAD_LIMIT_BYTES = 1024 * 1024;
+const INSTALLER_DOWNLOAD_TIMEOUT_MILLISECONDS = 60_000;
+const AGENT_INSTALL_TIMEOUT_MILLISECONDS = 5 * 60 * 1_000;
+const MINIMAL_PATH = "/usr/bin:/bin";
+export class FixedAgentInstallRecipe {
+    assertSupportedPlatform = () => {
+        if ((process.platform !== "darwin" && process.platform !== "linux") ||
+            (process.arch !== "arm64" && process.arch !== "x64")) {
+            throw new InstallationManagerError("unsupported_install_platform", "This Agent installation recipe does not support the local platform");
+        }
+    };
+    requireInstalledExecutable = async (path) => {
+        const executable = await resolveExecutablePath(path);
+        if (executable === null) {
+            throw new InstallationManagerError("agent_verification_failed", "The Agent installer did not produce a valid executable");
+        }
+        return executable;
+    };
+}
+class CodexInstallRecipe extends FixedAgentInstallRecipe {
+    id = "codex";
+    label = "Codex";
+    releaseChannel = "latest";
+    install = async (options) => {
+        this.assertSupportedPlatform();
+        const root = join(options.stateDirectory, "agents", this.id);
+        const temporaryRoot = join(options.stateDirectory, "temporary");
+        await Promise.all([
+            mkdir(root, { mode: 0o700, recursive: true }),
+            mkdir(temporaryRoot, { mode: 0o700, recursive: true }),
+        ]);
+        const temporaryDirectory = await mkdtemp(join(temporaryRoot, ".codex-install-"));
+        const installerPath = join(temporaryDirectory, "install.sh");
+        const installDirectory = join(root, "bin");
+        const codexHome = join(root, "home");
+        try {
+            await Promise.all([
+                mkdir(installDirectory, { mode: 0o700, recursive: true }),
+                mkdir(codexHome, { mode: 0o700, recursive: true }),
+            ]);
+            await options.report("downloading");
+            const download = await downloadVerifiedFile({
+                allowedHosts: new Set(["chatgpt.com", "releases.openai.com"]),
+                destination: installerPath,
+                maximumBytes: INSTALLER_DOWNLOAD_LIMIT_BYTES,
+                signal: options.signal,
+                timeoutMilliseconds: INSTALLER_DOWNLOAD_TIMEOUT_MILLISECONDS,
+                url: new URL("https://chatgpt.com/codex/install.sh"),
+            });
+            options.audit.record("agent_installer_download_verified", options.requestId, this.id, {
+                bytes: download.bytes.toString(),
+                releaseChannel: this.releaseChannel,
+                sha256: download.sha256,
+            });
+            await options.report("verifying");
+            await options.report("installing_agent");
+            await runBoundedProcess({
+                arguments: [installerPath],
+                command: "/bin/sh",
+                cwd: temporaryDirectory,
+                environment: {
+                    CODEX_HOME: codexHome,
+                    CODEX_INSTALL_DIR: installDirectory,
+                    CODEX_NON_INTERACTIVE: "1",
+                    CODEX_RELEASE: this.releaseChannel,
+                    HOME: codexHome,
+                    PATH: MINIMAL_PATH,
+                },
+                outputLimitBytes: 64 * 1024,
+                signal: options.signal,
+                timeoutMilliseconds: AGENT_INSTALL_TIMEOUT_MILLISECONDS,
+            });
+            return await this.requireInstalledExecutable(join(installDirectory, "codex"));
+        }
+        catch (error) {
+            if (options.signal.aborted) {
+                options.signal.throwIfAborted();
+            }
+            if (error instanceof InstallationManagerError ||
+                (error instanceof Error && "code" in error)) {
+                throw error;
+            }
+            throw new InstallationManagerError("agent_install_failed", "The fixed Codex installation recipe failed");
+        }
+        finally {
+            await rm(temporaryDirectory, { force: true, recursive: true });
+        }
+    };
+}
+class ClaudeCodeInstallRecipe extends FixedAgentInstallRecipe {
+    id = "claude";
+    label = "Claude Code";
+    releaseChannel = "stable";
+    install = async (options) => {
+        this.assertSupportedPlatform();
+        const root = join(options.stateDirectory, "agents", this.id);
+        const managedHome = join(root, "home");
+        const temporaryRoot = join(options.stateDirectory, "temporary");
+        await Promise.all([
+            mkdir(managedHome, { mode: 0o700, recursive: true }),
+            mkdir(temporaryRoot, { mode: 0o700, recursive: true }),
+        ]);
+        const temporaryDirectory = await mkdtemp(join(temporaryRoot, ".claude-install-"));
+        const installerPath = join(temporaryDirectory, "install.sh");
+        try {
+            await options.report("downloading");
+            const download = await downloadVerifiedFile({
+                allowedHosts: new Set(["claude.ai"]),
+                destination: installerPath,
+                maximumBytes: INSTALLER_DOWNLOAD_LIMIT_BYTES,
+                signal: options.signal,
+                timeoutMilliseconds: INSTALLER_DOWNLOAD_TIMEOUT_MILLISECONDS,
+                url: new URL("https://claude.ai/install.sh"),
+            });
+            options.audit.record("agent_installer_download_verified", options.requestId, this.id, {
+                bytes: download.bytes.toString(),
+                releaseChannel: this.releaseChannel,
+                sha256: download.sha256,
+            });
+            await options.report("verifying");
+            await options.report("installing_agent");
+            await runBoundedProcess({
+                arguments: [installerPath, "stable"],
+                command: "/bin/bash",
+                cwd: temporaryDirectory,
+                environment: {
+                    HOME: managedHome,
+                    PATH: MINIMAL_PATH,
+                    SHELL: "/bin/bash",
+                },
+                outputLimitBytes: 64 * 1024,
+                signal: options.signal,
+                timeoutMilliseconds: AGENT_INSTALL_TIMEOUT_MILLISECONDS,
+            });
+            return await this.requireInstalledExecutable(join(managedHome, ".local", "bin", "claude"));
+        }
+        catch (error) {
+            if (options.signal.aborted) {
+                options.signal.throwIfAborted();
+            }
+            if (error instanceof InstallationManagerError ||
+                (error instanceof Error && "code" in error)) {
+                throw error;
+            }
+            throw new InstallationManagerError("agent_install_failed", "The fixed Claude Code installation recipe failed");
+        }
+        finally {
+            await rm(temporaryDirectory, { force: true, recursive: true });
+        }
+    };
+}
+export function fixedAgentInstallRecipes() {
+    return Object.freeze([
+        new CodexInstallRecipe(),
+        new ClaudeCodeInstallRecipe(),
+    ]);
+}
+//# sourceMappingURL=fixed-agent-install-recipes.js.map

package/dist/agent-installation/fixed-agent-install-recipes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixed-agent-install-recipes.js","sourceRoot":"","sources":["../../src/agent-installation/fixed-agent-install-recipes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAEL,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAE9D,MAAM,8BAA8B,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,uCAAuC,GAAG,MAAM,CAAC;AACvD,MAAM,kCAAkC,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;AAC1D,MAAM,YAAY,GAAG,eAAe,CAAC;AAUrC,MAAM,OAAgB,uBAAuB;IAQxB,uBAAuB,GAAG,GAAS,EAAE;QACtD,IACE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;YAC/D,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,EACpD,CAAC;YACD,MAAM,IAAI,wBAAwB,CAChC,8BAA8B,EAC9B,oEAAoE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEiB,0BAA0B,GAAG,KAAK,EACnD,IAAY,EACiB,EAAE;QAC/B,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,MAAM,IAAI,wBAAwB,CAChC,2BAA2B,EAC3B,wDAAwD,CACzD,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC;CACH;AAED,MAAM,kBAAmB,SAAQ,uBAAuB;IAC7C,EAAE,GAAG,OAAO,CAAC;IACb,KAAK,GAAG,OAAO,CAAC;IAChB,cAAc,GAAG,QAAQ,CAAC;IAE1B,OAAO,GAAG,KAAK,EACtB,OAAkC,EACL,EAAE;QAC/B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC7C,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,MAAM,OAAO,CACtC,IAAI,CAAC,aAAa,EAAE,iBAAiB,CAAC,CACvC,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,KAAK,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;gBACzD,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;aACnD,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;gBAC1C,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC;gBAC7D,WAAW,EAAE,aAAa;gBAC1B,YAAY,EAAE,8BAA8B;gBAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,mBAAmB,EAAE,uCAAuC;gBAC5D,GAAG,EAAE,IAAI,GAAG,CAAC,sCAAsC,CAAC;aACrD,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,MAAM,CAClB,mCAAmC,EACnC,OAAO,CAAC,SAAS,EACjB,IAAI,CAAC,EAAE,EACP;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAChC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CACF,CAAC;YACF,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAClC,MAAM,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACzC,MAAM,iBAAiB,CAAC;gBACtB,SAAS,EAAE,CAAC,aAAa,CAAC;gBAC1B,OAAO,EAAE,SAAS;gBAClB,GAAG,EAAE,kBAAkB;gBACvB,WAAW,EAAE;oBACX,UAAU,EAAE,SAAS;oBACrB,iBAAiB,EAAE,gBAAgB;oBACnC,qBAAqB,EAAE,GAAG;oBAC1B,aAAa,EAAE,IAAI,CAAC,cAAc;oBAClC,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,YAAY;iBACnB;gBACD,gBAAgB,EAAE,EAAE,GAAG,IAAI;gBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,mBAAmB,EAAE,kCAAkC;aACxD,CAAC,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAC1C,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAChC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAClC,CAAC;YACD,IACE,KAAK,YAAY,wBAAwB;gBACzC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,EAC3C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,wBAAwB,CAChC,sBAAsB,EACtB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC;CACH;AAED,MAAM,uBAAwB,SAAQ,uBAAuB;IAClD,EAAE,GAAG,QAAQ,CAAC;IACd,KAAK,GAAG,aAAa,CAAC;IACtB,cAAc,GAAG,QAAQ,CAAC;IAE1B,OAAO,GAAG,KAAK,EACtB,OAAkC,EACL,EAAE;QAC/B,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACpD,KAAK,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,MAAM,kBAAkB,GAAG,MAAM,OAAO,CACtC,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CACxC,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;gBAC1C,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;gBACpC,WAAW,EAAE,aAAa;gBAC1B,YAAY,EAAE,8BAA8B;gBAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,mBAAmB,EAAE,uCAAuC;gBAC5D,GAAG,EAAE,IAAI,GAAG,CAAC,8BAA8B,CAAC;aAC7C,CAAC,CAAC;YACH,OAAO,CAAC,KAAK,CAAC,MAAM,CAClB,mCAAmC,EACnC,OAAO,CAAC,SAAS,EACjB,IAAI,CAAC,EAAE,EACP;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE;gBAChC,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CACF,CAAC;YACF,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAClC,MAAM,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACzC,MAAM,iBAAiB,CAAC;gBACtB,SAAS,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;gBACpC,OAAO,EAAE,WAAW;gBACpB,GAAG,EAAE,kBAAkB;gBACvB,WAAW,EAAE;oBACX,IAAI,EAAE,WAAW;oBACjB,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,WAAW;iBACnB;gBACD,gBAAgB,EAAE,EAAE,GAAG,IAAI;gBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,mBAAmB,EAAE,kCAAkC;aACxD,CAAC,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,0BAA0B,CAC1C,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAC7C,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3B,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAClC,CAAC;YACD,IACE,KAAK,YAAY,wBAAwB;gBACzC,CAAC,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,CAAC,EAC3C,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,wBAAwB,CAChC,sBAAsB,EACtB,kDAAkD,CACnD,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,EAAE,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC,CAAC;CACH;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,kBAAkB,EAAE;QACxB,IAAI,uBAAuB,EAAE;KAC9B,CAAC,CAAC;AACL,CAAC"}

package/dist/agent-installation/fixed-installation-executor.d.ts

@@ -0,0 +1,20 @@
+import type { AgentInstallationStage } from "@moxt-ai/mobius-protocol";
+import { type LocalAgentSpecification } from "../agent-catalog/discover-local-agents.ts";
+import type { LocalAgentCatalog } from "../agent-catalog/local-agent.ts";
+import type { InstallationAudit, InstallationExecutor } from "./agent-installation-manager.ts";
+import { type FixedAgentInstallRecipe } from "./fixed-agent-install-recipes.ts";
+import { type AdapterInstallationPort } from "./managed-adapter-installer.ts";
+export interface FixedInstallationExecutorOptions {
+    readonly approvedRoot: string;
+    readonly audit: InstallationAudit;
+    readonly catalog: LocalAgentCatalog;
+    readonly environment: Readonly<NodeJS.ProcessEnv>;
+    readonly publishCatalog: (signal: AbortSignal) => Promise<void>;
+    readonly stateDirectory: string;
+}
+export declare class FixedInstallationExecutor implements InstallationExecutor {
+    #private;
+    constructor(options: FixedInstallationExecutorOptions, specifications?: readonly LocalAgentSpecification[], recipes?: readonly FixedAgentInstallRecipe[], adapterInstaller?: AdapterInstallationPort);
+    readonly execute: (agentId: string, requestId: string, report: (stage: AgentInstallationStage) => Promise<void>, signal: AbortSignal) => Promise<void>;
+}
+//# sourceMappingURL=fixed-installation-executor.d.ts.map

package/dist/agent-installation/fixed-installation-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixed-installation-executor.d.ts","sourceRoot":"","sources":["../../src/agent-installation/fixed-installation-executor.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAEvE,OAAO,EAGL,KAAK,uBAAuB,EAI7B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEzE,OAAO,KAAK,EACV,iBAAiB,EACjB,oBAAoB,EACrB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,uBAAuB,EAG7B,MAAM,gCAAgC,CAAC;AAGxC,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAkHD,qBAAa,yBAA0B,YAAW,oBAAoB;;IAWpE,YACE,OAAO,EAAE,gCAAgC,EACzC,cAAc,GAAE,SAAS,uBAAuB,EAAwC,EACxF,OAAO,GAAE,SAAS,uBAAuB,EAA+B,EACxE,gBAAgB,CAAC,EAAE,uBAAuB,EA2B3C;IAED,QAAQ,CAAC,OAAO,YACL,MAAM,aACJ,MAAM,UACT,CAAC,KAAK,EAAE,sBAAsB,KAAK,OAAO,CAAC,IAAI,CAAC,UAChD,WAAW,KAClB,OAAO,CAAC,IAAI,CAAC,CAkId;CACH"}

package/dist/agent-installation/fixed-installation-executor.js

@@ -0,0 +1,213 @@
+import { realpathSync, statSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { AvailableAgent, discoverLocalAgentInventory, resolveAdapterExecutable, resolveAgentExecutable, supportedLocalAgentSpecifications, } from "../agent-catalog/discover-local-agents.js";
+import { ProcessExecutionError } from "../process/executable.js";
+import { InstallationManagerError } from "./agent-installation-manager.js";
+import { fixedAgentInstallRecipes, } from "./fixed-agent-install-recipes.js";
+import { ManagedAdapterInstallError, ManagedAdapterInstaller, } from "./managed-adapter-installer.js";
+import { InstallerDownloadError } from "./verified-download.js";
+function findSpecification(specifications, agentId) {
+    for (const specification of specifications) {
+        if (specification.id === agentId) {
+            return specification;
+        }
+    }
+    throw new InstallationManagerError("unknown_agent", "The requested Agent is not supported");
+}
+function findRecipe(recipes, agentId) {
+    for (const recipe of recipes) {
+        if (recipe.id === agentId) {
+            return recipe;
+        }
+    }
+    throw new InstallationManagerError("agent_not_installable", "The requested Agent does not have an approved installation recipe");
+}
+function isInside(root, candidate) {
+    const difference = relative(resolve(root), resolve(candidate));
+    return (difference.length === 0 ||
+        (!difference.startsWith("..") && !isAbsolute(difference)));
+}
+function resolveApprovedRoot(path) {
+    try {
+        const directory = realpathSync(resolve(path));
+        if (!statSync(directory).isDirectory()) {
+            throw new Error("Approved root is not a directory");
+        }
+        return directory;
+    }
+    catch (error) {
+        throw new InstallationManagerError("unsafe_installation_root", "The approved workspace is unavailable or unsafe", { cause: error });
+    }
+}
+function resolveUserInstallationDirectory(path) {
+    try {
+        const directory = realpathSync(resolve(path));
+        const metadata = statSync(directory);
+        if (!metadata.isDirectory() ||
+            (typeof process.getuid === "function" &&
+                metadata.uid !== process.getuid())) {
+            throw new Error("Installation directory is not user-owned");
+        }
+        return directory;
+    }
+    catch (error) {
+        throw new InstallationManagerError("unsafe_installation_root", "The local Agent installation root is unavailable or unsafe", { cause: error });
+    }
+}
+function translateExecutionError(error) {
+    if (error instanceof InstallationManagerError) {
+        return error;
+    }
+    if (error instanceof ManagedAdapterInstallError ||
+        error instanceof InstallerDownloadError ||
+        error instanceof ProcessExecutionError) {
+        return new InstallationManagerError(error.code, error.message, {
+            cause: error,
+        });
+    }
+    return new InstallationManagerError("installation_failed", "The fixed local Agent installation failed", { cause: error });
+}
+function requiresAgentReplacement(code) {
+    return (code === "agent_not_found" ||
+        code === "agent_probe_failed" ||
+        code === "agent_probe_timeout");
+}
+function requiresAdapterReplacement(code) {
+    return (code === "adapter_not_found" ||
+        code === "adapter_probe_failed" ||
+        code === "adapter_probe_timeout" ||
+        code === "acp_incompatible");
+}
+export class FixedInstallationExecutor {
+    #adapterInstaller;
+    #approvedRoot;
+    #audit;
+    #catalog;
+    #environment;
+    #publishCatalog;
+    #recipes;
+    #specifications;
+    #stateDirectory;
+    constructor(options, specifications = supportedLocalAgentSpecifications(), recipes = fixedAgentInstallRecipes(), adapterInstaller) {
+        const approvedRoot = resolveApprovedRoot(options.approvedRoot);
+        const stateDirectory = resolveUserInstallationDirectory(options.stateDirectory);
+        if (isInside(approvedRoot, stateDirectory)) {
+            throw new InstallationManagerError("unsafe_installation_root", "The Mobius state directory cannot be inside the approved workspace");
+        }
+        this.#approvedRoot = approvedRoot;
+        this.#audit = options.audit;
+        this.#catalog = options.catalog;
+        this.#environment = Object.freeze({ ...options.environment });
+        this.#publishCatalog = options.publishCatalog;
+        this.#recipes = Object.freeze([...recipes]);
+        this.#specifications = Object.freeze([...specifications]);
+        this.#stateDirectory = stateDirectory;
+        this.#adapterInstaller =
+            adapterInstaller ??
+                new ManagedAdapterInstaller({
+                    approvedRoot,
+                    environment: this.#environment,
+                    stateDirectory,
+                });
+    }
+    execute = async (agentId, requestId, report, signal) => {
+        try {
+            const specification = findSpecification(this.#specifications, agentId);
+            const recipe = findRecipe(this.#recipes, agentId);
+            this.#audit.record("agent_installation_recipe_resolved", requestId, agentId, {
+                adapterVersion: specification.adapterVersion,
+                releaseChannel: recipe.releaseChannel,
+            });
+            const discoveryOptions = {
+                approvedRoot: this.#approvedRoot,
+                environment: this.#environment,
+                signal,
+            };
+            let agent = await resolveAgentExecutable(specification, discoveryOptions);
+            let installedAgent = false;
+            if (agent === null) {
+                agent = await recipe.install({
+                    audit: this.#audit,
+                    report,
+                    requestId,
+                    signal,
+                    stateDirectory: this.#stateDirectory,
+                });
+                installedAgent = true;
+            }
+            let adapter = await resolveAdapterExecutable(specification, discoveryOptions);
+            let installedAdapter = false;
+            if (adapter === null) {
+                await report("installing_adapter");
+                adapter = await this.#adapterInstaller.install(specification, signal);
+                installedAdapter = true;
+                this.#audit.record("agent_adapter_verified", requestId, agentId, {
+                    version: specification.adapterVersion,
+                });
+            }
+            while (true) {
+                await report("checking_acp");
+                const environment = { ...this.#environment };
+                environment[specification.agentOverrideVariable] = agent.path;
+                environment[specification.adapterOverrideVariable] = adapter.path;
+                const inventory = await discoverLocalAgentInventory({
+                    approvedRoot: this.#approvedRoot,
+                    environment,
+                    signal,
+                    specifications: this.#specifications,
+                });
+                const verified = inventory.available.find((candidate) => candidate.specification.id === agentId);
+                if (verified instanceof AvailableAgent) {
+                    this.#audit.record("agent_installation_acp_verified", requestId, agentId, {
+                        adapterVersion: verified.agent.adapterVersion,
+                        agentVersion: verified.agent.agentVersion,
+                    });
+                    const previous = this.#catalog.read();
+                    this.#catalog.transition(inventory.readyAgents(), inventory.installable);
+                    try {
+                        await this.#publishCatalog(signal);
+                    }
+                    catch (error) {
+                        this.#catalog.transition(previous.agents, previous.installableAgents);
+                        throw error;
+                    }
+                    return;
+                }
+                const unavailable = inventory.unavailable.find((candidate) => candidate.specification.id === agentId);
+                if (unavailable === undefined) {
+                    throw new InstallationManagerError("agent_verification_failed", "The complete Agent ACP path did not pass verification");
+                }
+                if (!installedAdapter && requiresAdapterReplacement(unavailable.code)) {
+                    await report("installing_adapter");
+                    adapter = await this.#adapterInstaller.install(specification, signal);
+                    installedAdapter = true;
+                    this.#audit.record("agent_adapter_verified", requestId, agentId, {
+                        version: specification.adapterVersion,
+                    });
+                    continue;
+                }
+                if (!installedAgent &&
+                    (requiresAgentReplacement(unavailable.code) ||
+                        unavailable.code === "acp_incompatible")) {
+                    agent = await recipe.install({
+                        audit: this.#audit,
+                        report,
+                        requestId,
+                        signal,
+                        stateDirectory: this.#stateDirectory,
+                    });
+                    installedAgent = true;
+                    continue;
+                }
+                throw new InstallationManagerError(unavailable.code, unavailable.message);
+            }
+        }
+        catch (error) {
+            if (signal.aborted) {
+                signal.throwIfAborted();
+            }
+            throw translateExecutionError(error);
+        }
+    };
+}
+//# sourceMappingURL=fixed-installation-executor.js.map

package/dist/agent-installation/fixed-installation-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixed-installation-executor.js","sourceRoot":"","sources":["../../src/agent-installation/fixed-installation-executor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAI1D,OAAO,EACL,cAAc,EACd,2BAA2B,EAE3B,wBAAwB,EACxB,sBAAsB,EACtB,iCAAiC,GAClC,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAKjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAEL,wBAAwB,GACzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAWhE,SAAS,iBAAiB,CACxB,cAAkD,EAClD,OAAe;IAEf,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;QAC3C,IAAI,aAAa,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YACjC,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,sCAAsC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,OAA2C,EAC3C,OAAe;IAEf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,EACvB,mEAAmE,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,SAAiB;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,0BAA0B,EAC1B,iDAAiD,EACjD,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,IAAY;IACpD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,IACE,CAAC,QAAQ,CAAC,WAAW,EAAE;YACvB,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;gBACnC,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,wBAAwB,CAChC,0BAA0B,EAC1B,4DAA4D,EAC5D,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,KAAK,YAAY,wBAAwB,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IACE,KAAK,YAAY,0BAA0B;QAC3C,KAAK,YAAY,sBAAsB;QACvC,KAAK,YAAY,qBAAqB,EACtC,CAAC;QACD,OAAO,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,wBAAwB,CACjC,qBAAqB,EACrB,2CAA2C,EAC3C,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,OAAO,CACL,IAAI,KAAK,iBAAiB;QAC1B,IAAI,KAAK,oBAAoB;QAC7B,IAAI,KAAK,qBAAqB,CAC/B,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY;IAC9C,OAAO,CACL,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,sBAAsB;QAC/B,IAAI,KAAK,uBAAuB;QAChC,IAAI,KAAK,kBAAkB,CAC5B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,yBAAyB;IAC3B,iBAAiB,CAA0B;IAC3C,aAAa,CAAS;IACtB,MAAM,CAAoB;IAC1B,QAAQ,CAAoB;IAC5B,YAAY,CAA8B;IAC1C,eAAe,CAAyC;IACxD,QAAQ,CAAqC;IAC7C,eAAe,CAAqC;IACpD,eAAe,CAAS;IAEjC,YACE,OAAyC,EACzC,cAAc,GAAuC,iCAAiC,EAAE,EACxF,OAAO,GAAuC,wBAAwB,EAAE,EACxE,gBAA0C;QAE1C,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,gCAAgC,CACrD,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,IAAI,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,wBAAwB,CAChC,0BAA0B,EAC1B,oEAAoE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,IAAI,CAAC,iBAAiB;YACpB,gBAAgB;gBAChB,IAAI,uBAAuB,CAAC;oBAC1B,YAAY;oBACZ,WAAW,EAAE,IAAI,CAAC,YAAY;oBAC9B,cAAc;iBACf,CAAC,CAAC;IACP,CAAC;IAEQ,OAAO,GAAG,KAAK,EACtB,OAAe,EACf,SAAiB,EACjB,MAAwD,EACxD,MAAmB,EACJ,EAAE;QACjB,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,oCAAoC,EACpC,SAAS,EACT,OAAO,EACP;gBACE,cAAc,EAAE,aAAa,CAAC,cAAc;gBAC5C,cAAc,EAAE,MAAM,CAAC,cAAc;aACtC,CACF,CAAC;YACF,MAAM,gBAAgB,GAAG;gBACvB,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,MAAM;aACP,CAAC;YACF,IAAI,KAAK,GAAG,MAAM,sBAAsB,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC;YAC1E,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;oBAC3B,KAAK,EAAE,IAAI,CAAC,MAAM;oBAClB,MAAM;oBACN,SAAS;oBACT,MAAM;oBACN,cAAc,EAAE,IAAI,CAAC,eAAe;iBACrC,CAAC,CAAC;gBACH,cAAc,GAAG,IAAI,CAAC;YACxB,CAAC;YACD,IAAI,OAAO,GAAG,MAAM,wBAAwB,CAC1C,aAAa,EACb,gBAAgB,CACjB,CAAC;YACF,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAC7B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACnC,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;gBACtE,gBAAgB,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,EAAE,OAAO,EAAE;oBAC/D,OAAO,EAAE,aAAa,CAAC,cAAc;iBACtC,CAAC,CAAC;YACL,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM,WAAW,GAAsB,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBAChE,WAAW,CAAC,aAAa,CAAC,qBAAqB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;gBAC9D,WAAW,CAAC,aAAa,CAAC,uBAAuB,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;gBAClE,MAAM,SAAS,GAAG,MAAM,2BAA2B,CAAC;oBAClD,YAAY,EAAE,IAAI,CAAC,aAAa;oBAChC,WAAW;oBACX,MAAM;oBACN,cAAc,EAAE,IAAI,CAAC,eAAe;iBACrC,CAAC,CAAC;gBACH,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CACvC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,KAAK,OAAO,CACtD,CAAC;gBACF,IAAI,QAAQ,YAAY,cAAc,EAAE,CAAC;oBACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAChB,iCAAiC,EACjC,SAAS,EACT,OAAO,EACP;wBACE,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,cAAc;wBAC7C,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY;qBAC1C,CACF,CAAC;oBAEF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACtC,IAAI,CAAC,QAAQ,CAAC,UAAU,CACtB,SAAS,CAAC,WAAW,EAAE,EACvB,SAAS,CAAC,WAAW,CACtB,CAAC;oBACF,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;oBACrC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,QAAQ,CAAC,UAAU,CACtB,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;wBACF,MAAM,KAAK,CAAC;oBACd,CAAC;oBACD,OAAO;gBACT,CAAC;gBAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAC5C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,KAAK,OAAO,CACtD,CAAC;gBACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,MAAM,IAAI,wBAAwB,CAChC,2BAA2B,EAC3B,uDAAuD,CACxD,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,gBAAgB,IAAI,0BAA0B,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtE,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;oBACnC,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;oBACtE,gBAAgB,GAAG,IAAI,CAAC;oBACxB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,SAAS,EAAE,OAAO,EAAE;wBAC/D,OAAO,EAAE,aAAa,CAAC,cAAc;qBACtC,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBACD,IACE,CAAC,cAAc;oBACf,CAAC,wBAAwB,CAAC,WAAW,CAAC,IAAI,CAAC;wBACzC,WAAW,CAAC,IAAI,KAAK,kBAAkB,CAAC,EAC1C,CAAC;oBACD,KAAK,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;wBAC3B,KAAK,EAAE,IAAI,CAAC,MAAM;wBAClB,MAAM;wBACN,SAAS;wBACT,MAAM;wBACN,cAAc,EAAE,IAAI,CAAC,eAAe;qBACrC,CAAC,CAAC;oBACH,cAAc,GAAG,IAAI,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,wBAAwB,CAChC,WAAW,CAAC,IAAI,EAChB,WAAW,CAAC,OAAO,CACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,CAAC;YACD,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;CACH"}

package/dist/agent-installation/installation-grants.d.ts

@@ -0,0 +1,2 @@
+export declare function readGrantedAgents(stateDirectory: string): Promise<ReadonlySet<string>>;
+//# sourceMappingURL=installation-grants.d.ts.map

package/dist/agent-installation/installation-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-grants.d.ts","sourceRoot":"","sources":["../../src/agent-installation/installation-grants.ts"],"names":[],"mappings":"AAUA,wBAAsB,iBAAiB,CACrC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CA+C9B"}

package/dist/agent-installation/installation-grants.js

@@ -0,0 +1,52 @@
+import { open } from "node:fs/promises";
+import { join } from "node:path";
+const MAX_GRANT_FILE_LENGTH = 16 * 1024;
+const AGENT_ID_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export async function readGrantedAgents(stateDirectory) {
+    const path = join(stateDirectory, "installation-grants.json");
+    let handle;
+    try {
+        handle = await open(path, "r");
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+            return new Set();
+        }
+        throw error;
+    }
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() ||
+            metadata.size > MAX_GRANT_FILE_LENGTH ||
+            (typeof process.getuid === "function" &&
+                metadata.uid !== process.getuid()) ||
+            (process.platform !== "win32" && (metadata.mode & 0o077) !== 0)) {
+            throw new Error("The local installation grant file is not private");
+        }
+        const encoded = await handle.readFile({ encoding: "utf8" });
+        const value = JSON.parse(encoded);
+        if (!isRecord(value) ||
+            Object.keys(value).length !== 2 ||
+            value["version"] !== 1 ||
+            !Array.isArray(value["agents"])) {
+            throw new Error("The local installation grant file is invalid");
+        }
+        const agents = new Set();
+        for (const candidate of value["agents"]) {
+            if (typeof candidate !== "string" ||
+                !AGENT_ID_PATTERN.test(candidate) ||
+                agents.has(candidate)) {
+                throw new Error("The local installation grant file is invalid");
+            }
+            agents.add(candidate);
+        }
+        return agents;
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=installation-grants.js.map

package/dist/agent-installation/installation-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-grants.js","sourceRoot":"","sources":["../../src/agent-installation/installation-grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,cAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;IAC9D,IAAI,MAAwC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACzE,OAAO,IAAI,GAAG,EAAU,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IACE,CAAC,QAAQ,CAAC,MAAM,EAAE;YAClB,QAAQ,CAAC,IAAI,GAAG,qBAAqB;YACrC,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;gBACnC,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAC/D,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3C,IACE,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;YAC/B,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAC/B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,IACE,OAAO,SAAS,KAAK,QAAQ;gBAC7B,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC;gBACjC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EACrB,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/agent-installation/local-installation-authorizer.d.ts

@@ -0,0 +1,7 @@
+import type { InstallationAuthorizer } from "./agent-installation-manager.ts";
+export declare class ConsoleInstallationAuthorizer implements InstallationAuthorizer {
+    #private;
+    constructor(stateDirectory: string);
+    readonly authorize: (agentId: string, label: string, requestId: string, signal: AbortSignal) => Promise<boolean>;
+}
+//# sourceMappingURL=local-installation-authorizer.d.ts.map

package/dist/agent-installation/local-installation-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-installation-authorizer.d.ts","sourceRoot":"","sources":["../../src/agent-installation/local-installation-authorizer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AAG9E,qBAAa,6BAA8B,YAAW,sBAAsB;;IAG1E,YAAY,cAAc,EAAE,MAAM,EAEjC;IAED,QAAQ,CAAC,SAAS,YACP,MAAM,SACR,MAAM,aACF,MAAM,UACT,WAAW,KAClB,OAAO,CAAC,OAAO,CAAC,CAwBjB;CACH"}

package/dist/agent-installation/local-installation-authorizer.js

@@ -0,0 +1,32 @@
+import { createInterface } from "node:readline/promises";
+import { readGrantedAgents } from "./installation-grants.js";
+export class ConsoleInstallationAuthorizer {
+    #stateDirectory;
+    constructor(stateDirectory) {
+        this.#stateDirectory = stateDirectory;
+    }
+    authorize = async (agentId, label, requestId, signal) => {
+        signal.throwIfAborted();
+        const grants = await readGrantedAgents(this.#stateDirectory);
+        signal.throwIfAborted();
+        if (grants.has(agentId)) {
+            return true;
+        }
+        if (!process.stdin.isTTY || !process.stdout.isTTY) {
+            return false;
+        }
+        const prompt = createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        try {
+            const answer = await prompt.question(`\nMobius Web requested installation of ${label} (${requestId}). Allow this fixed user-level recipe? [y/N] `, { signal });
+            const normalized = answer.trim().toLowerCase();
+            return normalized === "y" || normalized === "yes";
+        }
+        finally {
+            prompt.close();
+        }
+    };
+}
+//# sourceMappingURL=local-installation-authorizer.js.map

package/dist/agent-installation/local-installation-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-installation-authorizer.js","sourceRoot":"","sources":["../../src/agent-installation/local-installation-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,OAAO,6BAA6B;IAC/B,eAAe,CAAS;IAEjC,YAAY,cAAsB;QAChC,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;IACxC,CAAC;IAEQ,SAAS,GAAG,KAAK,EACxB,OAAe,EACf,KAAa,EACb,SAAiB,EACjB,MAAmB,EACD,EAAE;QACpB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC7D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC;YAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAClC,0CAA0C,KAAK,KAAK,SAAS,+CAA+C,EAC5G,EAAE,MAAM,EAAE,CACX,CAAC;YACF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/C,OAAO,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,KAAK,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;CACH"}

package/dist/agent-installation/managed-adapter-installer.d.ts

@@ -0,0 +1,21 @@
+import type { LocalAgentSpecification } from "../agent-catalog/discover-local-agents.ts";
+import { type ResolvedExecutable } from "../process/executable.ts";
+export declare class ManagedAdapterInstallError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string, options?: ErrorOptions);
+}
+export declare function validateManagedAdapter(root: string, specification: LocalAgentSpecification): Promise<ResolvedExecutable>;
+export interface ManagedAdapterInstallerOptions {
+    readonly approvedRoot: string;
+    readonly environment: Readonly<NodeJS.ProcessEnv>;
+    readonly stateDirectory: string;
+}
+export interface AdapterInstallationPort {
+    readonly install: (specification: LocalAgentSpecification, signal: AbortSignal) => Promise<ResolvedExecutable>;
+}
+export declare class ManagedAdapterInstaller implements AdapterInstallationPort {
+    #private;
+    constructor(options: ManagedAdapterInstallerOptions);
+    readonly install: (specification: LocalAgentSpecification, signal: AbortSignal) => Promise<ResolvedExecutable>;
+}
+//# sourceMappingURL=managed-adapter-installer.d.ts.map

package/dist/agent-installation/managed-adapter-installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-adapter-installer.d.ts","sourceRoot":"","sources":["../../src/agent-installation/managed-adapter-installer.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACzF,OAAO,EAEL,KAAK,kBAAkB,EAGxB,MAAM,0BAA0B,CAAC;AAKlC,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,YAAY,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,EAIpE;CACF;AAsDD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,uBAAuB,GACrC,OAAO,CAAC,kBAAkB,CAAC,CA2C7B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAClD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,CAChB,aAAa,EAAE,uBAAuB,EACtC,MAAM,EAAE,WAAW,KAChB,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClC;AAED,qBAAa,uBAAwB,YAAW,uBAAuB;;IAKrE,YAAY,OAAO,EAAE,8BAA8B,EAIlD;IAED,QAAQ,CAAC,OAAO,kBACC,uBAAuB,UAC9B,WAAW,KAClB,OAAO,CAAC,kBAAkB,CAAC,CA8F5B;CACH"}