@nowcrew/daemon 0.5.51 → 0.6.0

package/dist/agent-ability/controller.js

@@ -0,0 +1,19 @@
+import { AbilityResolveCommandSchema } from "./types.js";
+import { resolveAbilityRelease } from "./resolver.js";
+export function createAgentAbilityController(deps) {
+    const resolver = deps.resolve ?? resolveAbilityRelease;
+    return {
+        async handle(input) {
+            const parsed = AbilityResolveCommandSchema.safeParse(input);
+            if (!parsed.success)
+                return { ok: false, error: "invalid_ability_command" };
+            try {
+                return { ok: true, data: await resolver(deps.agentsRoot, parsed.data) };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : "ability_resolve_failed";
+                return { ok: false, error: /^[a-z0-9_:-]+$/u.test(message) ? message.slice(0, 200) : "ability_resolve_failed" };
+            }
+        },
+    };
+}

package/dist/agent-ability/materializer.js

@@ -0,0 +1,327 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, cp, lstat, mkdir, readFile, readdir, readlink, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { parse } from "yaml";
+import { dslog } from "../slog.js";
+import { abilitySha256, abilityTreeDigest, collectAbilityFiles, safeAbilityName, } from "./resolver.js";
+import { DaemonAbilityLockSchema, DaemonAbilityManifestSchema } from "./types.js";
+const exists = (path) => lstat(path).then(() => true, () => false);
+const repositoryKey = (url) => createHash("sha256").update(url).digest("hex");
+const posixPath = (value) => value.split(sep).join("/");
+const sameSnapshot = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const readonlyTree = async (root) => {
+    const entries = await readdir(root, { withFileTypes: true });
+    for (const entry of entries) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory()) {
+            await readonlyTree(path);
+            await chmod(path, 0o555);
+        }
+        else if (entry.isFile()) {
+            const current = await lstat(path);
+            await chmod(path, current.mode & 0o111 ? 0o555 : 0o444);
+        }
+    }
+    await chmod(root, 0o555);
+};
+const writableTree = async (root) => {
+    const info = await lstat(root);
+    if (info.isSymbolicLink())
+        return;
+    if (!info.isDirectory()) {
+        await chmod(root, 0o600);
+        return;
+    }
+    await chmod(root, 0o700);
+    for (const entry of await readdir(root))
+        await writableTree(join(root, entry));
+};
+const removeManagedTree = async (root) => {
+    if (!await exists(root))
+        return;
+    await writableTree(root);
+    await rm(root, { recursive: true, force: true });
+};
+const switchDirectory = async (target, staging, backup) => {
+    const hadPrevious = await exists(target);
+    try {
+        if (hadPrevious)
+            await rename(target, backup);
+        await rename(staging, target);
+        if (hadPrevious)
+            await rm(backup, { recursive: true, force: true });
+    }
+    catch (error) {
+        if (await exists(target))
+            await rm(target, { recursive: true, force: true }).catch(() => { });
+        if (hadPrevious && await exists(backup))
+            await rename(backup, target).catch(() => { });
+        throw error;
+    }
+};
+const copyExistingSkills = async (target, staging, managedReleaseRoot) => {
+    const names = new Set();
+    if (!await exists(target))
+        return names;
+    for (const entry of await readdir(target, { withFileTypes: true })) {
+        const source = join(target, entry.name);
+        const destination = join(staging, entry.name);
+        const info = await lstat(source);
+        if (info.isSymbolicLink()) {
+            const link = await readlink(source);
+            const resolvedLink = resolve(dirname(source), link);
+            if (resolvedLink === managedReleaseRoot || resolvedLink.startsWith(`${managedReleaseRoot}${sep}`))
+                continue;
+            await symlink(link, destination, "dir");
+        }
+        else
+            await cp(source, destination, { recursive: true, preserveTimestamps: true });
+        names.add(entry.name);
+    }
+    return names;
+};
+const projectNativeSkills = async (agentRoot, releaseRoot, skills) => {
+    const nativeSkills = [];
+    for (const skill of skills) {
+        const source = join(releaseRoot, "skills", safeAbilityName(skill.name));
+        if (await exists(join(source, "SKILL.md"))) {
+            nativeSkills.push({ name: skill.name, source });
+            continue;
+        }
+        for (const entry of await readdir(source, { withFileTypes: true })) {
+            if (entry.isDirectory() && await exists(join(source, entry.name, "SKILL.md"))) {
+                nativeSkills.push({ name: entry.name, source: join(source, entry.name) });
+            }
+        }
+    }
+    const id = randomUUID();
+    const targets = [
+        join(agentRoot, ".agents", "skills"),
+        join(agentRoot, ".crew", "claude-skills", ".claude", "skills"),
+    ];
+    const managedReleaseRoot = join(agentRoot, ".nowcrew", "ability", "releases");
+    for (const target of targets) {
+        const staging = join(dirname(target), `.ability-skills-next-${id}`);
+        const backup = join(dirname(target), `.ability-skills-previous-${id}`);
+        await mkdir(dirname(target), { recursive: true });
+        await mkdir(staging, { mode: 0o700 });
+        try {
+            const names = await copyExistingSkills(target, staging, managedReleaseRoot);
+            for (const skill of nativeSkills) {
+                if (names.has(skill.name))
+                    throw new Error(`ability_skill_name_conflict:${skill.name}`);
+                await symlink(skill.source, join(staging, skill.name), "dir");
+            }
+            await switchDirectory(target, staging, backup);
+        }
+        catch (error) {
+            await rm(staging, { recursive: true, force: true });
+            throw error;
+        }
+    }
+};
+const verifyCache = async (agentsRoot, ability) => {
+    const root = join(agentsRoot, ".crew", "ability-cache", "artifacts", repositoryKey(ability.repositoryUrl), ability.rootCommit);
+    if (!await exists(root))
+        throw new Error("ability_artifact_cache_missing");
+    const rawManifest = await readFile(join(root, "agent.yaml"));
+    const manifest = DaemonAbilityManifestSchema.parse(parse(rawManifest.toString("utf8")));
+    const lock = DaemonAbilityLockSchema.parse(JSON.parse(await readFile(join(root, "agent.lock.json"), "utf8")));
+    if (lock.manifestDigest !== abilitySha256(rawManifest))
+        throw new Error("ability_manifest_lock_drift");
+    const files = await collectAbilityFiles(root);
+    for (const asset of lock.assets) {
+        if (abilityTreeDigest(asset.path, files) !== asset.contentDigest) {
+            throw new Error(`ability_asset_lock_drift:${asset.path}`);
+        }
+    }
+    const externalPaths = new Map();
+    const external = lock.dependencies.map((dependency) => {
+        const dependencyRoot = join(root, ".nowcrew-external", safeAbilityName(dependency.name));
+        const dependencyFiles = files.filter((file) => file.path.startsWith(`${posixPath(relative(root, dependencyRoot))}/`))
+            .map((file) => ({
+            path: file.path.slice(posixPath(relative(root, dependencyRoot)).length + 1),
+            content: file.content,
+        }));
+        if (abilityTreeDigest(dependency.path, dependencyFiles) !== dependency.contentDigest) {
+            throw new Error(`ability_dependency_lock_drift:${dependency.name}`);
+        }
+        const path = posixPath(join(".nowcrew-external", safeAbilityName(dependency.name), dependency.path));
+        externalPaths.set(dependency.name, path);
+        return [dependency.name, path];
+    }).sort(([left], [right]) => left.localeCompare(right));
+    const artifactDigest = abilitySha256(JSON.stringify({
+        repositoryUrl: ability.repositoryUrl,
+        rootCommit: ability.rootCommit,
+        treeDigest: ability.treeDigest,
+        lock,
+        external,
+    }));
+    if (artifactDigest !== ability.artifactDigest)
+        throw new Error("ability_artifact_digest_mismatch");
+    if (manifest.spec.instructions.path !== ability.instructions.path
+        || (await readFile(join(root, ability.instructions.path), "utf8")) !== ability.instructions.content) {
+        throw new Error("ability_instruction_snapshot_mismatch");
+    }
+    const expectedSkills = manifest.spec.skills.map((skill) => ({
+        name: skill.name,
+        path: skill.source.type === "local" ? skill.source.path : externalPaths.get(skill.name),
+        mode: skill.mode,
+    }));
+    if (expectedSkills.some((skill) => skill.path === undefined)
+        || !sameSnapshot(ability.skills, expectedSkills)) {
+        throw new Error("ability_skill_snapshot_mismatch");
+    }
+    if (new Set(ability.skills.map((skill) => safeAbilityName(skill.name))).size !== ability.skills.length) {
+        throw new Error("ability_skill_projection_collision");
+    }
+    if (!sameSnapshot(ability.workspace, manifest.spec.workspace.assets)) {
+        throw new Error("ability_workspace_snapshot_mismatch");
+    }
+    if (!sameSnapshot(ability.evalProvenance.cases, manifest.spec.evals.cases)) {
+        throw new Error("ability_eval_snapshot_mismatch");
+    }
+    const releaseMemory = ability.memory.filter((memory) => memory.layer === "release-policy" || memory.layer === "release-seed");
+    for (const memory of releaseMemory) {
+        const mounts = memory.layer === "release-policy" ? manifest.spec.memory.policy : manifest.spec.memory.seeds;
+        if (!mounts.some((mount) => memory.path === mount.path || memory.path.startsWith(`${mount.path}/`))
+            || await readFile(join(root, memory.path), "utf8") !== memory.content) {
+            throw new Error("ability_memory_snapshot_mismatch");
+        }
+    }
+    if (ability.memory.reduce((bytes, memory) => bytes + Buffer.byteLength(memory.content, "utf8"), 0) > 64 * 1024) {
+        throw new Error("ability_memory_snapshot_size_exceeded");
+    }
+    return root;
+};
+const materializeRelease = async (agentsRoot, handle, ability) => {
+    const sourceRoot = await verifyCache(agentsRoot, ability);
+    const agentRoot = join(agentsRoot, handle);
+    const abilityRoot = join(agentRoot, ".nowcrew", "ability");
+    const releaseRoot = join(abilityRoot, "releases", ability.releaseId);
+    const catalogPath = join(releaseRoot, "catalog.json");
+    if (await exists(catalogPath)) {
+        const catalog = JSON.parse(await readFile(catalogPath, "utf8"));
+        if (catalog.artifactDigest === ability.artifactDigest)
+            return releaseRoot;
+        await removeManagedTree(releaseRoot);
+    }
+    const staging = join(abilityRoot, "releases", `.next-${ability.releaseId}-${randomUUID()}`);
+    await mkdir(staging, { recursive: true, mode: 0o700 });
+    try {
+        const instructionsTarget = join(staging, "instructions", ability.instructions.path);
+        await mkdir(dirname(instructionsTarget), { recursive: true });
+        await cp(join(sourceRoot, ability.instructions.path), instructionsTarget, { preserveTimestamps: true });
+        for (const skill of ability.skills) {
+            const target = join(staging, "skills", safeAbilityName(skill.name));
+            await mkdir(dirname(target), { recursive: true });
+            await cp(join(sourceRoot, skill.path), target, { recursive: true, preserveTimestamps: true });
+        }
+        for (const memory of ability.memory) {
+            const target = join(staging, "memory", safeAbilityName(memory.layer), `${safeAbilityName(memory.id)}.md`);
+            await mkdir(dirname(target), { recursive: true });
+            await writeFile(target, memory.content, { encoding: "utf8", mode: 0o600 });
+        }
+        for (const asset of ability.workspace) {
+            const relativeTarget = asset.target.replace(/^\.nowcrew\/ability\//u, "");
+            const target = join(staging, "workspace", relativeTarget);
+            await mkdir(dirname(target), { recursive: true });
+            await cp(join(sourceRoot, asset.source), target, { recursive: true, preserveTimestamps: true });
+        }
+        await writeFile(join(staging, "catalog.json"), JSON.stringify({
+            releaseId: ability.releaseId,
+            rootCommit: ability.rootCommit,
+            artifactDigest: ability.artifactDigest,
+            instructions: ability.instructions.path,
+            skills: ability.skills.map((skill) => skill.name),
+            memory: ability.memory.map((memory) => ({ id: memory.id, layer: memory.layer })),
+            workspace: ability.workspace,
+            evalProvenance: ability.evalProvenance,
+        }, null, 2), { encoding: "utf8", mode: 0o600 });
+        await readonlyTree(staging);
+        await rename(staging, releaseRoot);
+    }
+    catch (error) {
+        await removeManagedTree(staging).catch(() => { });
+        throw error;
+    }
+    return releaseRoot;
+};
+const activatePointerAndWorkspace = async (agentsRoot, handle, ability, releaseRoot) => {
+    const agentRoot = join(agentsRoot, handle);
+    const abilityRoot = join(agentRoot, ".nowcrew", "ability");
+    const next = join(abilityRoot, `.current-next-${randomUUID()}`);
+    const previous = join(abilityRoot, `.current-previous-${randomUUID()}`);
+    await mkdir(abilityRoot, { recursive: true });
+    await symlink(releaseRoot, next, "dir");
+    const current = join(abilityRoot, "current");
+    const hadCurrent = await exists(current);
+    if (hadCurrent)
+        await rename(current, previous);
+    try {
+        await rename(next, current);
+        if (hadCurrent)
+            await rm(previous, { recursive: true, force: true });
+    }
+    catch (error) {
+        if (hadCurrent)
+            await rename(previous, current).catch(() => { });
+        throw error;
+    }
+    for (const asset of ability.workspace) {
+        const relativeTarget = asset.target.replace(/^\.nowcrew\/ability\//u, "");
+        const source = join(current, "workspace", relativeTarget);
+        const target = join(agentRoot, ...asset.target.split("/"));
+        await mkdir(dirname(target), { recursive: true });
+        if (asset.mode === "managed-copy") {
+            if (!await exists(target))
+                await cp(source, target, { recursive: true, preserveTimestamps: true });
+            continue;
+        }
+        const staging = `${target}.next-${randomUUID()}`;
+        await symlink(source, staging, "dir");
+        if (await exists(target))
+            await rm(target, { recursive: true, force: true });
+        await rename(staging, target);
+    }
+    await projectNativeSkills(agentRoot, releaseRoot, ability.skills);
+    await writeFile(join(agentRoot, ".nowwork-root"), "", { encoding: "utf8", mode: 0o600 });
+};
+export function createAgentAbilityMaterializer(expectedAgentsRoot) {
+    const tails = new Map();
+    return {
+        async prepareAndLaunch(agentsRoot, handle, ability, launch) {
+            if (agentsRoot !== expectedAgentsRoot)
+                throw new Error("ability_agents_root_mismatch");
+            const previous = tails.get(handle) ?? Promise.resolve();
+            let release;
+            const turn = new Promise((resolveTurn) => { release = resolveTurn; });
+            const tail = previous.then(() => turn);
+            tails.set(handle, tail);
+            await previous;
+            const started = Date.now();
+            try {
+                const releaseRoot = await materializeRelease(agentsRoot, handle, ability);
+                await activatePointerAndWorkspace(agentsRoot, handle, ability, releaseRoot);
+                dslog("ability.execution.materialized", "Agent ability release materialized", {
+                    level: "INFO", agent_handle: handle, release_id: ability.releaseId,
+                    root_commit: ability.rootCommit, artifact_digest: ability.artifactDigest,
+                    duration_ms: Date.now() - started,
+                });
+                return await launch();
+            }
+            catch (error) {
+                dslog("ability.execution.rejected", "Agent ability release materialization failed", {
+                    level: "ERROR", agent_handle: handle, release_id: ability.releaseId,
+                    root_commit: ability.rootCommit, error_code: error instanceof Error ? error.message.slice(0, 120) : "ability_materialization_failed",
+                });
+                throw error;
+            }
+            finally {
+                release();
+                if (tails.get(handle) === tail)
+                    tails.delete(handle);
+            }
+        },
+    };
+}