@nebutra/agent-runtime 0.2.1 → 2.0.0

package/src/rollout-store-persistent.ts

@@ -1,166 +0,0 @@
-/**
- * Production-grade, tenant-scoped {@link RolloutStore} backed by an injectable
- * persistence port. This package depends on NO datastore: a Postgres /
- * ClickHouse / `@nebutra/db` / `@nebutra/audit` adapter satisfies
- * {@link RolloutPersistencePort} from the outside, so the "no infra change"
- * promise stays honest — swap the adapter, keep the interface.
- *
- * Tenancy is structural: `tenantId` is part of the storage key AND Zod-validated
- * on every read and write. Cross-tenant access is impossible by construction.
- * The store fails closed — empty identifiers and malformed stored payloads
- * raise typed errors; records are never silently dropped.
- */
-
-import { z } from "zod";
-import type { RolloutLine, RolloutStore } from "./rollout";
-
-/**
- * Minimal append-only persistence seam. Implementations MUST persist records
- * durably and return them ascending by `seq` for a given (tenant, thread).
- */
-export interface RolloutPersistencePort {
-  put(record: {
-    tenantId: string;
-    threadId: string;
-    seq: number;
-    at: string;
-    payload: string;
-  }): Promise<void>;
-  /** Records for one (tenant, thread), ascending by seq. */
-  list(tenantId: string, threadId: string): Promise<{ seq: number; payload: string }[]>;
-}
-
-/** Raised when a stored payload cannot be faithfully reconstructed. */
-export class RoundTripError extends Error {
-  constructor(message: string, options?: { cause?: unknown }) {
-    super(message, options);
-    this.name = "RoundTripError";
-  }
-}
-
-const tenantId = z.string().min(1, "tenantId is required");
-const threadId = z.string().min(1, "threadId is required");
-const at = z.string().min(1);
-
-const turnConfigSchema = z.object({
-  model: z.string(),
-  provider: z.string(),
-  approvalPolicy: z.string(),
-  capabilityPolicy: z.string(),
-  reasoningEffort: z.enum(["low", "medium", "high"]).optional(),
-});
-
-const threadEventSchema = z.custom<RolloutLine extends { event: infer E } ? E : never>(
-  (v) => typeof v === "object" && v !== null && typeof (v as { type?: unknown }).type === "string",
-  { message: "invalid ThreadEvent" },
-);
-
-const rolloutLineSchema: z.ZodType<RolloutLine> = z.discriminatedUnion("type", [
-  z.object({
-    tenantId,
-    threadId,
-    type: z.literal("session_meta"),
-    config: turnConfigSchema,
-    at,
-  }),
-  z.object({
-    tenantId,
-    threadId,
-    type: z.literal("event"),
-    event: threadEventSchema,
-    at,
-  }),
-  z.object({
-    tenantId,
-    threadId,
-    type: z.literal("turn_context"),
-    config: turnConfigSchema,
-    at,
-  }),
-  z.object({
-    tenantId,
-    threadId,
-    type: z.literal("compacted"),
-    summary: z.string(),
-    droppedThrough: z.string(),
-    at,
-  }),
-]) as z.ZodType<RolloutLine>;
-
-const tenantThreadSchema = z.object({ tenantId, threadId });
-
-export class PersistentRolloutStore implements RolloutStore {
-  readonly #port: RolloutPersistencePort;
-  /**
-   * Per-(tenant,thread) seq allocation chained through a promise so concurrent
-   * `append` calls to the same thread serialize and never collide on seq —
-   * without blocking appends to other threads.
-   */
-  readonly #tails = new Map<string, Promise<number>>();
-
-  constructor(port: RolloutPersistencePort) {
-    this.#port = port;
-  }
-
-  #key(t: string, th: string): string {
-    return `${t}::${th}`;
-  }
-
-  async append(line: RolloutLine): Promise<void> {
-    const validated = rolloutLineSchema.parse(line);
-    const key = this.#key(validated.tenantId, validated.threadId);
-
-    const prev = this.#tails.get(key) ?? Promise.resolve(-1);
-    const next = prev.then(async (last) => {
-      const seq = last + 1;
-      await this.#port.put({
-        tenantId: validated.tenantId,
-        threadId: validated.threadId,
-        seq,
-        at: validated.at,
-        payload: JSON.stringify(validated),
-      });
-      return seq;
-    });
-    // Keep the chain advancing even if a put fails (fail-closed for the caller,
-    // but the next append must not deadlock on a rejected tail).
-    this.#tails.set(
-      key,
-      next.catch(() => (this.#tails.get(key) === next ? -1 : next)),
-    );
-    await next;
-  }
-
-  async read(tenantIdArg: string, threadIdArg: string): Promise<readonly RolloutLine[]> {
-    const { tenantId: t, threadId: th } = tenantThreadSchema.parse({
-      tenantId: tenantIdArg,
-      threadId: threadIdArg,
-    });
-
-    const records = await this.#port.list(t, th);
-    const ordered = [...records].sort((a, b) => a.seq - b.seq);
-
-    return ordered.map((r) => {
-      let parsed: unknown;
-      try {
-        parsed = JSON.parse(r.payload);
-      } catch (cause) {
-        throw new RoundTripError(`malformed stored payload at seq ${r.seq} for ${t}::${th}`, {
-          cause,
-        });
-      }
-      const result = rolloutLineSchema.safeParse(parsed);
-      if (!result.success) {
-        throw new RoundTripError(
-          `structurally-invalid stored payload at seq ${r.seq} for ${t}::${th}`,
-          { cause: result.error },
-        );
-      }
-      const reconstructed = result.data;
-      if (reconstructed.tenantId !== t || reconstructed.threadId !== th) {
-        throw new RoundTripError(`tenant/thread mismatch at seq ${r.seq} for ${t}::${th}`);
-      }
-      return reconstructed;
-    });
-  }
-}

package/src/rollout.ts

@@ -1,150 +0,0 @@
-/**
- * Event-sourced rollout / session trace (WRAP — capability #7).
- *
- * Faithful re-expression of the upstream rollout model: an append-only typed
- * event log, state derived by replay, a first-class context-compaction marker
- * (so replay stays bounded), and a per-item persistence policy that sanitizes
- * and size-caps outputs before they are durable.
- *
- * Multi-tenant adaptation: every rollout line carries `tenantId`; the store
- * interface is tenant-scoped so a Postgres/ClickHouse-backed implementation
- * (via `@nebutra/audit` providers / `@nebutra/db`) replaces the upstream
- * single-host jsonl + embedded-SQLite assumptions. Only an in-memory
- * reference store ships here.
- */
-
-import type { ThreadEvent, ThreadItem, TurnConfig } from "./model";
-
-/** Cap mirrors the upstream persisted-output ceiling. */
-export const PERSISTED_OUTPUT_MAX_BYTES = 10_000;
-
-export type EventPersistenceMode = "limited" | "extended";
-
-/** One durable line in a thread's append-only log. */
-export type RolloutLine =
-  | {
-      readonly tenantId: string;
-      readonly threadId: string;
-      readonly type: "session_meta";
-      readonly config: TurnConfig;
-      readonly at: string;
-    }
-  | {
-      readonly tenantId: string;
-      readonly threadId: string;
-      readonly type: "event";
-      readonly event: ThreadEvent;
-      readonly at: string;
-    }
-  | {
-      readonly tenantId: string;
-      readonly threadId: string;
-      readonly type: "turn_context";
-      readonly config: TurnConfig;
-      readonly at: string;
-    }
-  | {
-      readonly tenantId: string;
-      readonly threadId: string;
-      readonly type: "compacted";
-      readonly summary: string;
-      readonly droppedThrough: string;
-      readonly at: string;
-    };
-
-/**
- * Persistence policy: decide per item whether it is durable, and sanitize +
- * size-cap its output first. Executive markers are always persisted.
- */
-export function isPersisted(item: ThreadItem, mode: EventPersistenceMode): boolean {
-  if (item.type === "reasoning") return mode === "extended";
-  return true;
-}
-
-/** Truncate aggregated command output to the persisted ceiling. */
-export function sanitizeForPersist(item: ThreadItem): ThreadItem {
-  if (item.type !== "command_execution") return item;
-  const bytes = Buffer.byteLength(item.aggregatedOutput, "utf8");
-  if (bytes <= PERSISTED_OUTPUT_MAX_BYTES) return item;
-  const truncated = Buffer.from(item.aggregatedOutput, "utf8")
-    .subarray(0, PERSISTED_OUTPUT_MAX_BYTES)
-    .toString("utf8");
-  return { ...item, aggregatedOutput: `${truncated}\n…[truncated]` };
-}
-
-/** Tenant-scoped append-only store. Replace the impl, keep the interface. */
-export interface RolloutStore {
-  append(line: RolloutLine): Promise<void>;
-  /** Lines for a thread, in append order. */
-  read(tenantId: string, threadId: string): Promise<readonly RolloutLine[]>;
-}
-
-/** In-memory reference store (dev/test only — never multi-instance safe). */
-export class InMemoryRolloutStore implements RolloutStore {
-  readonly #lines = new Map<string, RolloutLine[]>();
-
-  #key(tenantId: string, threadId: string): string {
-    return `${tenantId}::${threadId}`;
-  }
-
-  async append(line: RolloutLine): Promise<void> {
-    const key = this.#key(line.tenantId, line.threadId);
-    const list = this.#lines.get(key) ?? [];
-    list.push(line);
-    this.#lines.set(key, list);
-  }
-
-  async read(tenantId: string, threadId: string): Promise<readonly RolloutLine[]> {
-    return [...(this.#lines.get(this.#key(tenantId, threadId)) ?? [])];
-  }
-}
-
-/** Derived thread state — the projection rebuilt by replaying the log. */
-export interface ThreadProjection {
-  readonly tenantId: string;
-  readonly threadId: string;
-  config?: TurnConfig;
-  readonly items: ThreadItem[];
-  /** Marks where a compaction summary replaced earlier history. */
-  compactionSummary?: string;
-}
-
-/**
- * Replay an append-only log into derived state. A `compacted` line bounds
- * replay: items prior to it are represented by the summary, not re-applied.
- */
-export function replay(lines: readonly RolloutLine[]): ThreadProjection | null {
-  const first = lines[0];
-  if (!first) return null;
-  const projection: ThreadProjection = {
-    tenantId: first.tenantId,
-    threadId: first.threadId,
-    items: [],
-  };
-  for (const line of lines) {
-    switch (line.type) {
-      case "session_meta":
-      case "turn_context":
-        projection.config = line.config;
-        break;
-      case "compacted":
-        projection.compactionSummary = line.summary;
-        projection.items.length = 0;
-        break;
-      case "event": {
-        const e = line.event;
-        if (e.type === "item.completed" || e.type === "item.started") {
-          const idx = projection.items.findIndex((i) => i.id === e.item.id);
-          if (idx >= 0) projection.items[idx] = e.item;
-          else projection.items.push(e.item);
-        } else if (e.type === "item.updated") {
-          const idx = projection.items.findIndex((i) => i.id === e.item.id);
-          if (idx >= 0) projection.items[idx] = e.item;
-          else projection.items.push(e.item);
-        }
-        break;
-      }
-    }
-  }
-  return projection;
-}

package/src/sandbox.ts

@@ -1,113 +0,0 @@
-/**
- * External-sandbox delegation seam (PORT — capability #11).
- *
- * Governance decision (dual-track, ExternalSandbox posture): this multi-tenant
- * web runtime NEVER executes untrusted code itself and introduces no isolation
- * infrastructure. It only:
- *   1. carries the capability policy (see ./policy),
- *   2. delegates execution to an external isolator behind this interface
- *      (a self-hosted kernel sidecar — Track B — or any other executor),
- *   3. records the outcome as a `command_execution` item (see ./model).
- *
- * The upstream OS enforcers (Seatbelt / Landlock / bubblewrap / Windows
- * restricted token) are deliberately NOT ported — they are single-host and
- * out of scope for a multi-tenant web product.
- */
-
-import type { CapabilityPolicy } from "./policy";
-
-export interface SandboxExecRequest {
-  /** Mandatory tenant scope — every delegated exec is tenant-bound. */
-  readonly tenantId: string;
-  readonly threadId: string;
-  readonly command: string;
-  /** The capabilities the external isolator must honor. */
-  readonly capabilityPolicy: CapabilityPolicy;
-  /** Optional inputs the executor should materialize before running. */
-  readonly inputs?: Readonly<Record<string, string>>;
-}
-
-export interface SandboxExecResult {
-  readonly exitCode: number;
-  readonly aggregatedOutput: string;
-  /** Identifier of the isolator that actually ran the command. */
-  readonly executedOn: string;
-}
-
-/**
- * The only thing Track A depends on for execution. Implemented by a decoupled
- * isolator over the ./protocol contract; never implemented in-process here.
- */
-export interface ExternalSandbox {
-  exec(request: SandboxExecRequest): Promise<SandboxExecResult>;
-}
-
-/**
- * Fail-closed default. Wiring this in production requires a real
- * {@link ExternalSandbox}; absent one, untrusted code never runs — by design.
- */
-export class NoExecutorConfiguredError extends Error {
-  constructor() {
-    super(
-      "No ExternalSandbox configured. This runtime never executes untrusted " +
-        "code in-process; delegate to a decoupled isolator (Track B).",
-    );
-    this.name = "NoExecutorConfiguredError";
-  }
-}
-
-export const REFUSING_SANDBOX: ExternalSandbox = {
-  async exec(): Promise<SandboxExecResult> {
-    throw new NoExecutorConfiguredError();
-  },
-};
-
-export class SandboxDelegationError extends Error {
-  constructor(
-    message: string,
-    readonly status: number,
-  ) {
-    super(message);
-    this.name = "SandboxDelegationError";
-  }
-}
-
-/**
- * The concrete Track-B coupling: delegate execution over HTTP to the decoupled
- * Rust isolator (`backends/rust/sandbox`, `POST /api/v1/sandbox/exec`). The
- * isolator is fail-closed; a non-2xx (e.g. 403 refusal) is surfaced as an
- * error and never coerced into a fabricated result.
- */
-export function createHttpSandbox(
-  baseUrl: string,
-  fetchImpl: typeof fetch = fetch,
-): ExternalSandbox {
-  const endpoint = `${baseUrl.replace(/\/$/, "")}/api/v1/sandbox/exec`;
-  return {
-    async exec(request: SandboxExecRequest): Promise<SandboxExecResult> {
-      const response = await fetchImpl(endpoint, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify(request),
-      });
-      if (!response.ok) {
-        const detail = await response.text().catch(() => "");
-        throw new SandboxDelegationError(
-          `Isolator refused execution (${response.status}): ${detail}`,
-          response.status,
-        );
-      }
-      return (await response.json()) as SandboxExecResult;
-    },
-  };
-}
-
-/** Guard: reject the most dangerous posture unless explicitly opted in. */
-export function assertSafePosture(policy: CapabilityPolicy, allowDanger = false): void {
-  if (policy.kind === "danger_full_access" && !allowDanger) {
-    throw new Error(
-      "danger_full_access capability policy refused: not permitted for " +
-        "multi-tenant delegation without explicit opt-in.",
-    );
-  }
-}