@noopolis/daimon 0.1.2 → 0.2.1

package/dist/runtime/physicalReadiness.js

@@ -0,0 +1,176 @@
+import { constants } from "node:fs";
+import { access, lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+import { GROK_ENGINE_BROKER } from "../contracts/runtimeContractManifest.js";
+import { pathsOverlap } from "./organizationRuntimeRecording.js";
+/** Only a brokered Grok agent's home is worker-traversable; every other engine keeps 0700. */
+function runtimeHomeShape(agent) {
+    return agent.engine.kind === "grok" ? "worker-traversable" : "private";
+}
+export async function prepareOrganizationRuntimePaths(agents) {
+    const workspaces = new Map();
+    const homes = new Map();
+    const recordings = new Map();
+    try {
+        for (const agent of agents) {
+            workspaces.set(agent.id, await verifyDirectory(agent.workspacePath, "workspacePath", "safe"));
+            homes.set(agent.id, await verifyDirectory(agent.runtimeHomePath, "runtimeHomePath", runtimeHomeShape(agent)));
+            if (agent.recording)
+                recordings.set(agent.id, await verifyDirectory(agent.recording.directory, "recording.directory", "private"));
+        }
+        const roots = [...workspaces.values(), ...homes.values(), ...recordings.values()];
+        for (let left = 0; left < roots.length; left += 1)
+            for (let right = left + 1; right < roots.length; right += 1) {
+                const first = roots[left];
+                const second = roots[right];
+                if (sameIdentity(first.identity, second.identity) || overlaps(first.real, second.real)) {
+                    throw new Error(`physical runtime paths overlap: ${first.configured} and ${second.configured}`);
+                }
+            }
+        for (const agent of agents)
+            for (const source of agent.recording?.snapshots ?? []) {
+                const real = await readableSnapshotDirectory(source.path);
+                if (real !== undefined && [...recordings.values()].some((store) => pathsOverlap(store.real, real)))
+                    throw new Error("physical recording and snapshot paths overlap");
+            }
+    }
+    catch (error) {
+        const closeError = await closeAll([...workspaces.values(), ...homes.values(), ...recordings.values()]);
+        if (closeError !== undefined)
+            throw new AggregateError([error, closeError], "runtime path validation cleanup failed");
+        throw error;
+    }
+    let closed = false;
+    const verify = async (agent) => {
+        if (closed)
+            throw new Error("runtime path authority is closed");
+        const workspace = workspaces.get(agent.id);
+        const home = homes.get(agent.id);
+        if (workspace === undefined || home === undefined)
+            throw new Error(`no runtime path authority for ${agent.id}`);
+        await Promise.all([
+            verifyIdentity(workspace, "workspacePath", "safe"),
+            verifyIdentity(home, "runtimeHomePath", runtimeHomeShape(agent))
+        ]);
+    };
+    return {
+        forAgent(agent) {
+            const workspace = workspaces.get(agent.id);
+            const home = homes.get(agent.id);
+            if (workspace === undefined || home === undefined)
+                throw new Error(`no runtime path authority for ${agent.id}`);
+            return { workspacePath: workspace.real, runtimeHomePath: home.real, verify: () => verify(agent),
+                verifyRecording: async () => {
+                    if (closed)
+                        throw new Error("runtime path authority is closed");
+                    const recording = recordings.get(agent.id);
+                    if (recording)
+                        await verifyIdentity(recording, "recording.directory", "private");
+                }
+            };
+        },
+        async close() {
+            if (closed)
+                return;
+            const failure = await closeAll([...workspaces.values(), ...homes.values(), ...recordings.values()]);
+            if (failure !== undefined)
+                throw failure;
+            closed = true;
+        }
+    };
+}
+async function verifyDirectory(configured, label, shape) {
+    await assertNoSymlinkComponents(configured);
+    const before = await lstat(configured);
+    assertDirectory(before, label, shape);
+    const fd = await open(configured, constants.O_RDONLY | directoryFlag() | noFollow());
+    try {
+        const opened = await fd.stat();
+        const real = await realpath(configured);
+        const after = await lstat(configured);
+        if (!sameIdentity(identity(before), identity(opened)) || !sameIdentity(identity(before), identity(after))) {
+            throw new Error(`${label} changed during validation`);
+        }
+        return { configured, real, fd, identity: identity(before), closed: false };
+    }
+    catch (error) {
+        await fd.close().catch(() => undefined);
+        throw error;
+    }
+}
+async function verifyIdentity(directory, label, shape) {
+    if (directory.closed)
+        throw new Error(`${label} authority is closed`);
+    await assertNoSymlinkComponents(directory.configured);
+    const entry = await lstat(directory.configured);
+    const opened = await directory.fd.stat();
+    if (!sameIdentity(identity(entry), directory.identity) || !sameIdentity(identity(opened), directory.identity)) {
+        throw new Error(`${label} changed after readiness validation`);
+    }
+    assertDirectory(entry, label, shape);
+    if (await realpath(directory.configured) !== directory.real)
+        throw new Error(`${label} changed after readiness validation`);
+}
+export async function assertNoSymlinkComponents(target, stat = lstat) {
+    const parsed = path.parse(target);
+    let current = parsed.root;
+    for (const part of path.relative(parsed.root, target).split(path.sep).filter(Boolean)) {
+        current = path.join(current, part);
+        // macOS exposes /var as a system compatibility symlink to /private/var.
+        // It is an OS-root alias, not a caller-controlled component.
+        if ((await stat(current)).isSymbolicLink() && current !== "/var")
+            throw new Error(`path contains symlink: ${current}`);
+    }
+}
+/** Shared sources have no owner/privacy requirement. Missing sources are empty captures. */
+async function readableSnapshotDirectory(target) {
+    try {
+        await assertNoSymlinkComponents(target);
+        const entry = await lstat(target);
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            throw new Error("recording snapshot must be a readable real directory");
+        await access(target, constants.R_OK | constants.X_OK);
+        return await realpath(target);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+/** Pure shape check for a caller-prepared runtime root. */
+export function assertRuntimeDirectory(entry, label, shape, runtime) {
+    if (!entry.isDirectory() || entry.isSymbolicLink())
+        throw new Error(`${label} must be an existing real directory`);
+    if (entry.uid !== runtime.uid)
+        throw new Error(`${label} must be owned by the runtime user`);
+    const permissions = Number(entry.mode) & 0o7777;
+    if (shape === "private" && permissions !== 0o700)
+        throw new Error(`${label} must have mode 0700`);
+    if (shape === "worker-traversable") {
+        const home = GROK_ENGINE_BROKER.worker.home.organizationRuntimeHome;
+        if (permissions !== home.mode)
+            throw new Error(`${label} must have mode 0710 for a brokered Grok agent`);
+        if (entry.gid < (runtime.firstWorkerUid ?? GROK_ENGINE_BROKER.identities.firstWorkerUid) || entry.gid === runtime.gid) {
+            throw new Error(`${label} must be group-owned by the agent's Grok worker group`);
+        }
+    }
+    if (shape === "safe" && (permissions & 0o022) !== 0)
+        throw new Error(`${label} must not grant group or other write access`);
+}
+function assertDirectory(entry, label, shape) {
+    assertRuntimeDirectory(entry, label, shape, { uid: process.getuid?.() ?? -1, gid: process.getgid?.() ?? -1 });
+}
+export function identity(entry) { return { dev: entry.dev, ino: entry.ino, uid: entry.uid, mode: entry.mode & 0o7777 }; }
+export function sameIdentity(left, right) { return left.dev === right.dev && left.ino === right.ino && left.uid === right.uid && left.mode === right.mode; }
+function overlaps(left, right) { return left === right || left.startsWith(`${right}${path.sep}`) || right.startsWith(`${left}${path.sep}`); }
+function noFollow() { return constants.O_NOFOLLOW ?? 0; }
+function directoryFlag() { return constants.O_DIRECTORY ?? 0; }
+async function closeAll(directories) {
+    const results = await Promise.allSettled(directories.filter((directory) => !directory.closed).map(async (directory) => {
+        await directory.fd.close();
+        directory.closed = true;
+    }));
+    const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+    return failures.length === 0 ? undefined : new AggregateError(failures, "runtime path authority cleanup failed");
+}

package/dist/runtime/portableCredentialAuth.d.ts

@@ -0,0 +1,6 @@
+export type PortableCredentialKind = "codex" | "grok";
+/** Validates only the bounded provider-native shape needed for refresh. */
+export declare function hasRefreshablePortableCredential(engine: PortableCredentialKind, bytes: Uint8Array): boolean;
+/** Returns only the provider-native bearer values for exact in-process redaction. */
+export declare function portableCredentialSecretValues(engine: PortableCredentialKind, bytes: Uint8Array): readonly string[];
+//# sourceMappingURL=portableCredentialAuth.d.ts.map

package/dist/runtime/portableCredentialAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portableCredentialAuth.d.ts","sourceRoot":"","sources":["../../src/runtime/portableCredentialAuth.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,MAAM,CAAC;AAEtD,2EAA2E;AAC3E,wBAAgB,gCAAgC,CAC9C,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,UAAU,GAChB,OAAO,CAYT;AAED,qFAAqF;AACrF,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,UAAU,GAChB,SAAS,MAAM,EAAE,CASnB"}

package/dist/runtime/portableCredentialAuth.js

@@ -0,0 +1,70 @@
+/** Validates only the bounded provider-native shape needed for refresh. */
+export function hasRefreshablePortableCredential(engine, bytes) {
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("utf8"));
+    }
+    catch {
+        return false;
+    }
+    const pair = engine === "grok" ? grokTokenPair(value) : tokenPair(value);
+    if (pair.access === undefined || pair.refresh === undefined)
+        return false;
+    if (engine !== "grok")
+        return true;
+    const candidate = firstString(grokTokenEntry(value), ["expires_at"]);
+    return candidate !== undefined && Number.isFinite(Date.parse(candidate));
+}
+/** Returns only the provider-native bearer values for exact in-process redaction. */
+export function portableCredentialSecretValues(engine, bytes) {
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("utf8"));
+    }
+    catch {
+        return [];
+    }
+    const pair = engine === "grok" ? grokTokenPair(value) : tokenPair(value);
+    return [...new Set([pair.access, pair.refresh].filter((entry) => entry !== undefined))];
+}
+function tokenPair(value) {
+    const source = object(value);
+    const nested = object(source?.tokens) ?? source;
+    return {
+        access: firstNonBlankString(nested, ["access_token", "accessToken", "token"]),
+        refresh: firstNonBlankString(nested, ["refresh_token", "refreshToken"])
+    };
+}
+function grokTokenEntry(value) {
+    const source = object(value);
+    if (source === undefined)
+        return undefined;
+    for (const [key, entry] of Object.entries(source)) {
+        if (/^https:\/\/auth\.x\.ai::/u.test(key))
+            return object(entry);
+    }
+    return undefined;
+}
+function grokTokenPair(value) {
+    const entry = grokTokenEntry(value);
+    return {
+        access: firstNonBlankString(entry, ["key"]),
+        refresh: firstNonBlankString(entry, ["refresh_token"])
+    };
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function firstString(value, names) {
+    for (const name of names) {
+        if (typeof value?.[name] === "string" && value[name].length > 0)
+            return value[name];
+    }
+    return undefined;
+}
+function firstNonBlankString(value, names) {
+    const candidate = firstString(value, names);
+    return candidate !== undefined && candidate.trim().length > 0 ? candidate : undefined;
+}

package/dist/runtime/portableCredentialMaterial.d.ts

@@ -0,0 +1,8 @@
+import type { OrganizationRuntimeAgentConfig } from "./organizationRuntime.js";
+/**
+ * Seeds a runtime-writable CLI credential from Daimon's read-only ingress.
+ * A newer runtime copy wins so a CLI refresh survives process/container
+ * restarts; a later operator refresh of the ingress is imported on restart.
+ */
+export declare function materializePortableCredential(configuredAgent: OrganizationRuntimeAgentConfig, runtimeHomePath: string): Promise<"created" | "preserved" | "refreshed">;
+//# sourceMappingURL=portableCredentialMaterial.d.ts.map

package/dist/runtime/portableCredentialMaterial.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"portableCredentialMaterial.d.ts","sourceRoot":"","sources":["../../src/runtime/portableCredentialMaterial.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAc/E;;;;GAIG;AACH,wBAAsB,6BAA6B,CACjD,eAAe,EAAE,8BAA8B,EAC/C,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,SAAS,GAAG,WAAW,GAAG,WAAW,CAAC,CAsChD"}

package/dist/runtime/portableCredentialMaterial.js

@@ -0,0 +1,169 @@
+import { constants } from "node:fs";
+import { chmod, lstat, mkdir, open, rename, unlink } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { ENGINE_CREDENTIAL_MATERIAL } from "./contractManifest.js";
+const MAX_CREDENTIAL_BYTES = 64 * 1024;
+/**
+ * Seeds a runtime-writable CLI credential from Daimon's read-only ingress.
+ * A newer runtime copy wins so a CLI refresh survives process/container
+ * restarts; a later operator refresh of the ingress is imported on restart.
+ */
+export async function materializePortableCredential(configuredAgent, runtimeHomePath) {
+    if (configuredAgent.engine.kind !== "codex") {
+        throw new Error(`agent ${configuredAgent.id} ${configuredAgent.engine.kind} has no portable credential material`);
+    }
+    const agent = configuredAgent;
+    const rule = ENGINE_CREDENTIAL_MATERIAL[agent.engine.kind];
+    const sourcePath = contained(runtimeHomePath, rule.sourceRelativePath);
+    const destinationPath = contained(runtimeHomePath, rule.destinationRelativePath);
+    const destinationDirectory = path.dirname(destinationPath);
+    await assertPrivateDirectory(path.dirname(sourcePath), rule.directoryMode, agent, false);
+    const source = await readCredential(sourcePath, rule.fileMode, agent);
+    await prepareDestinationDirectory(destinationDirectory, rule.directoryMode, agent);
+    const existing = await existingCredential(destinationPath, rule.fileMode, agent);
+    if (existing !== undefined && existing.mtimeMs >= source.identity.mtimeMs)
+        return "preserved";
+    const temporaryPath = path.join(destinationDirectory, `.${path.basename(destinationPath)}.${randomUUID()}.tmp`);
+    let temporary;
+    try {
+        temporary = await open(temporaryPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | noFollow(), rule.fileMode);
+        await temporary.writeFile(source.bytes);
+        await temporary.chmod(rule.fileMode);
+        await temporary.sync();
+        await temporary.close();
+        temporary = undefined;
+        await rename(temporaryPath, destinationPath);
+        await assertCredential(destinationPath, rule.fileMode, agent);
+        return existing === undefined ? "created" : "refreshed";
+    }
+    catch (error) {
+        throw unavailable(agent, error);
+    }
+    finally {
+        await temporary?.close().catch(() => undefined);
+        await unlink(temporaryPath).catch(() => undefined);
+    }
+}
+async function readCredential(filePath, mode, agent) {
+    let handle;
+    try {
+        // Opening a read-only bind can refresh its metadata. Validate the actual
+        // descriptor before consulting the refreshed path or reading any bytes.
+        // Nonblocking open lets us reject a FIFO by type instead of hanging here.
+        handle = await open(filePath, constants.O_RDONLY | noFollow() | constants.O_NONBLOCK);
+        const before = assertCredentialEntry(await handle.stat(), mode, agent);
+        if (!sameIdentity(before, await assertCredential(filePath, mode, agent)))
+            throw new Error("credential changed during import");
+        // One extra byte detects growth without allowing a changing file to drive
+        // an unbounded read/allocation. Partial reads advance within this buffer.
+        const buffer = Buffer.alloc(before.size + 1);
+        let length = 0;
+        while (length < buffer.length) {
+            const result = await handle.read(buffer, length, buffer.length - length, length);
+            if (result.bytesRead === 0)
+                break;
+            length += result.bytesRead;
+        }
+        const bytes = buffer.subarray(0, length);
+        const after = assertCredentialEntry(await handle.stat(), mode, agent);
+        const afterPath = await assertCredential(filePath, mode, agent);
+        if (!sameIdentity(before, after) || !sameIdentity(before, afterPath) || bytes.length !== before.size) {
+            throw new Error("credential changed during import");
+        }
+        return { bytes, identity: before };
+    }
+    catch (error) {
+        throw unavailable(agent, error);
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+async function prepareDestinationDirectory(directoryPath, mode, agent) {
+    try {
+        await mkdir(directoryPath, { mode });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw unavailable(agent, error);
+    }
+    await assertPrivateDirectory(directoryPath, mode, agent, true);
+}
+async function assertPrivateDirectory(directoryPath, mode, agent, repairMode) {
+    try {
+        const entry = await lstat(directoryPath);
+        if (!entry.isDirectory() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()) {
+            throw new Error("unsafe credential directory");
+        }
+        if (repairMode && (entry.mode & 0o777) !== mode)
+            await chmod(directoryPath, mode);
+        const secured = await lstat(directoryPath);
+        if (!secured.isDirectory() || secured.isSymbolicLink() || secured.uid !== process.getuid?.()
+            || (secured.mode & 0o777) !== mode)
+            throw new Error("unsafe credential directory");
+    }
+    catch (error) {
+        throw unavailable(agent, error);
+    }
+}
+async function existingCredential(filePath, mode, agent) {
+    try {
+        return await assertCredential(filePath, mode, agent);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+async function assertCredential(filePath, mode, agent) {
+    let entry;
+    try {
+        entry = await lstat(filePath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            throw error;
+        throw unavailable(agent, error);
+    }
+    return assertCredentialEntry(entry, mode, agent);
+}
+function assertCredentialEntry(entry, mode, agent) {
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.uid !== process.getuid?.()
+        || entry.nlink !== 1 || (entry.mode & 0o777) !== mode
+        || entry.size === 0 || entry.size > MAX_CREDENTIAL_BYTES) {
+        throw unavailable(agent, new Error("unsafe credential artifact"));
+    }
+    return identity(entry);
+}
+function contained(root, relative) {
+    const candidate = path.resolve(root, relative);
+    const relation = path.relative(path.resolve(root), candidate);
+    if (!relation || relation === ".." || relation.startsWith(`..${path.sep}`) || path.isAbsolute(relation)) {
+        throw new Error("Daimon credential contract escapes the runtime home");
+    }
+    return candidate;
+}
+function identity(value) {
+    const numeric = value;
+    return {
+        dev: numeric.dev,
+        ino: numeric.ino,
+        mode: numeric.mode & 0o7777,
+        mtimeMs: numeric.mtimeMs,
+        size: numeric.size,
+        uid: numeric.uid,
+        nlink: numeric.nlink
+    };
+}
+function sameIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.mode === right.mode
+        && left.mtimeMs === right.mtimeMs && left.size === right.size && left.uid === right.uid && left.nlink === right.nlink;
+}
+function noFollow() {
+    return constants.O_NOFOLLOW ?? 0;
+}
+function unavailable(agent, _cause) {
+    return new Error(`agent ${agent.id} ${agent.engine.kind} credential materialization failed`);
+}

package/dist/runtime/productionAgentTools.d.ts

@@ -0,0 +1,5 @@
+import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { OrganizationRuntimeAgentConfig } from "./organizationRuntime.js";
+import type { PiWakeEnvironmentContextRef } from "../pi/piAgentWakeSupport.js";
+export declare function createProductionAgentTools(agent: OrganizationRuntimeAgentConfig, wakeContext?: PiWakeEnvironmentContextRef): Promise<ToolDefinition[]>;
+//# sourceMappingURL=productionAgentTools.d.ts.map

package/dist/runtime/productionAgentTools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"productionAgentTools.d.ts","sourceRoot":"","sources":["../../src/runtime/productionAgentTools.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAMtE,OAAO,KAAK,EAAE,8BAA8B,EAAgC,MAAM,0BAA0B,CAAC;AAO7G,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAe/E,wBAAsB,0BAA0B,CAAC,KAAK,EAAE,8BAA8B,EAAE,WAAW,GAAE,2BAAgC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAahK"}