@nowcrew/daemon 0.5.52 → 0.6.1

package/dist/agent-ability/controller.js

@@ -0,0 +1,19 @@
+import { AbilityResolveCommandSchema } from "./types.js";
+import { resolveAbilityRelease } from "./resolver.js";
+export function createAgentAbilityController(deps) {
+    const resolver = deps.resolve ?? resolveAbilityRelease;
+    return {
+        async handle(input) {
+            const parsed = AbilityResolveCommandSchema.safeParse(input);
+            if (!parsed.success)
+                return { ok: false, error: "invalid_ability_command" };
+            try {
+                return { ok: true, data: await resolver(deps.agentsRoot, parsed.data) };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : "ability_resolve_failed";
+                return { ok: false, error: /^[a-z0-9_:-]+$/u.test(message) ? message.slice(0, 200) : "ability_resolve_failed" };
+            }
+        },
+    };
+}

package/dist/agent-ability/materializer.js

@@ -0,0 +1,383 @@
+import { createHash, randomUUID } from "node:crypto";
+import { chmod, cp, lstat, mkdir, readFile, readdir, readlink, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { parse } from "yaml";
+import { dslog } from "../slog.js";
+import { abilitySha256, abilityTreeDigest, collectAbilityFiles, resolveAbilityRelease, safeAbilityName, } from "./resolver.js";
+import { abilityWorkspaceProjectionPath, DaemonAbilityLockSchema, DaemonAbilityManifestSchema } from "./types.js";
+const exists = (path) => lstat(path).then(() => true, () => false);
+const repositoryKey = (url) => createHash("sha256").update(url).digest("hex");
+const posixPath = (value) => value.split(sep).join("/");
+const sameSnapshot = (left, right) => JSON.stringify(left) === JSON.stringify(right);
+const readonlyTree = async (root) => {
+    const entries = await readdir(root, { withFileTypes: true });
+    for (const entry of entries) {
+        const path = join(root, entry.name);
+        if (entry.isDirectory()) {
+            await readonlyTree(path);
+            await chmod(path, 0o555);
+        }
+        else if (entry.isFile()) {
+            const current = await lstat(path);
+            await chmod(path, current.mode & 0o111 ? 0o555 : 0o444);
+        }
+    }
+    await chmod(root, 0o555);
+};
+const writableTree = async (root) => {
+    const info = await lstat(root);
+    if (info.isSymbolicLink())
+        return;
+    if (!info.isDirectory()) {
+        await chmod(root, 0o600);
+        return;
+    }
+    await chmod(root, 0o700);
+    for (const entry of await readdir(root))
+        await writableTree(join(root, entry));
+};
+const removeManagedTree = async (root) => {
+    if (!await exists(root))
+        return;
+    await writableTree(root);
+    await rm(root, { recursive: true, force: true });
+};
+const switchDirectory = async (target, staging, backup) => {
+    const hadPrevious = await exists(target);
+    try {
+        if (hadPrevious)
+            await rename(target, backup);
+        await rename(staging, target);
+        if (hadPrevious) {
+            await writableTree(backup);
+            await rm(backup, { recursive: true, force: true });
+        }
+    }
+    catch (error) {
+        if (await exists(target))
+            await removeManagedTree(target).catch(() => { });
+        if (hadPrevious && await exists(backup))
+            await rename(backup, target).catch(() => { });
+        throw error;
+    }
+};
+const copyExistingSkills = async (target, staging, managedRoots) => {
+    const names = new Set();
+    if (!await exists(target))
+        return names;
+    for (const entry of await readdir(target, { withFileTypes: true })) {
+        const source = join(target, entry.name);
+        const destination = join(staging, entry.name);
+        const info = await lstat(source);
+        if (info.isSymbolicLink()) {
+            const link = await readlink(source);
+            const resolvedLink = resolve(dirname(source), link);
+            if (managedRoots.some((root) => resolvedLink === root || resolvedLink.startsWith(`${root}${sep}`)))
+                continue;
+            await symlink(link, destination, "dir");
+        }
+        else
+            await cp(source, destination, { recursive: true, preserveTimestamps: true });
+        names.add(entry.name);
+    }
+    return names;
+};
+const projectNativeSkills = async (agentRoot, trainingRoot, skills) => {
+    const nativeSkills = [];
+    for (const skill of skills) {
+        const source = join(trainingRoot, "skills", safeAbilityName(skill.name));
+        if (await exists(join(source, "SKILL.md"))) {
+            nativeSkills.push({ name: skill.name, source });
+            continue;
+        }
+        for (const entry of await readdir(source, { withFileTypes: true })) {
+            if (entry.isDirectory() && await exists(join(source, entry.name, "SKILL.md"))) {
+                nativeSkills.push({ name: entry.name, source: join(source, entry.name) });
+            }
+        }
+    }
+    const id = randomUUID();
+    const targets = [
+        join(agentRoot, ".agents", "skills"),
+        join(agentRoot, ".crew", "claude-skills", ".claude", "skills"),
+    ];
+    const managedRoots = [trainingRoot, join(agentRoot, ".nowcrew", "ability", "releases")];
+    for (const target of targets) {
+        const staging = join(dirname(target), `.ability-skills-next-${id}`);
+        const backup = join(dirname(target), `.ability-skills-previous-${id}`);
+        await mkdir(dirname(target), { recursive: true });
+        await mkdir(staging, { mode: 0o700 });
+        try {
+            const names = await copyExistingSkills(target, staging, managedRoots);
+            for (const skill of nativeSkills) {
+                if (names.has(skill.name))
+                    throw new Error(`ability_skill_name_conflict:${skill.name}`);
+                await symlink(skill.source, join(staging, skill.name), "dir");
+            }
+            await switchDirectory(target, staging, backup);
+        }
+        catch (error) {
+            await rm(staging, { recursive: true, force: true });
+            throw error;
+        }
+    }
+};
+const verifyCache = async (agentsRoot, ability) => {
+    const root = join(agentsRoot, ".crew", "ability-cache", "artifacts", repositoryKey(ability.repositoryUrl), ability.rootCommit);
+    if (!await exists(root))
+        throw new Error("ability_artifact_cache_missing");
+    const rawManifest = await readFile(join(root, "agent.yaml"));
+    const manifest = DaemonAbilityManifestSchema.parse(parse(rawManifest.toString("utf8")));
+    const lock = DaemonAbilityLockSchema.parse(JSON.parse(await readFile(join(root, "agent.lock.json"), "utf8")));
+    if (lock.manifestDigest !== abilitySha256(rawManifest))
+        throw new Error("ability_manifest_lock_drift");
+    const files = await collectAbilityFiles(root);
+    for (const asset of lock.assets) {
+        if (abilityTreeDigest(asset.path, files) !== asset.contentDigest) {
+            throw new Error(`ability_asset_lock_drift:${asset.path}`);
+        }
+    }
+    const externalPaths = new Map();
+    const external = lock.dependencies.map((dependency) => {
+        const dependencyRoot = join(root, ".nowcrew-external", safeAbilityName(dependency.name));
+        const dependencyFiles = files.filter((file) => file.path.startsWith(`${posixPath(relative(root, dependencyRoot))}/`))
+            .map((file) => ({
+            path: file.path.slice(posixPath(relative(root, dependencyRoot)).length + 1),
+            content: file.content,
+        }));
+        if (abilityTreeDigest(dependency.path, dependencyFiles) !== dependency.contentDigest) {
+            throw new Error(`ability_dependency_lock_drift:${dependency.name}`);
+        }
+        const path = posixPath(join(".nowcrew-external", safeAbilityName(dependency.name), dependency.path));
+        externalPaths.set(dependency.name, path);
+        return [dependency.name, path];
+    }).sort(([left], [right]) => left.localeCompare(right));
+    const artifactDigest = abilitySha256(JSON.stringify({
+        repositoryUrl: ability.repositoryUrl,
+        rootCommit: ability.rootCommit,
+        treeDigest: ability.treeDigest,
+        lock,
+        external,
+    }));
+    if (artifactDigest !== ability.artifactDigest)
+        throw new Error("ability_artifact_digest_mismatch");
+    if (manifest.spec.instructions.path !== ability.instructions.path
+        || (await readFile(join(root, ability.instructions.path), "utf8")) !== ability.instructions.content) {
+        throw new Error("ability_instruction_snapshot_mismatch");
+    }
+    const expectedSkills = manifest.spec.skills.map((skill) => ({
+        name: skill.name,
+        path: skill.source.type === "local" ? skill.source.path : externalPaths.get(skill.name),
+        mode: skill.mode,
+    }));
+    if (expectedSkills.some((skill) => skill.path === undefined)
+        || !sameSnapshot(ability.skills, expectedSkills)) {
+        throw new Error("ability_skill_snapshot_mismatch");
+    }
+    if (new Set(ability.skills.map((skill) => safeAbilityName(skill.name))).size !== ability.skills.length) {
+        throw new Error("ability_skill_projection_collision");
+    }
+    if (!sameSnapshot(ability.workspace, manifest.spec.workspace.assets)) {
+        throw new Error("ability_workspace_snapshot_mismatch");
+    }
+    if (!sameSnapshot(ability.evalProvenance.cases, manifest.spec.evals.cases)) {
+        throw new Error("ability_eval_snapshot_mismatch");
+    }
+    const releaseMemory = ability.memory.filter((memory) => memory.layer === "release-policy" || memory.layer === "release-seed");
+    for (const memory of releaseMemory) {
+        const mounts = memory.layer === "release-policy" ? manifest.spec.memory.policy : manifest.spec.memory.seeds;
+        if (!mounts.some((mount) => memory.path === mount.path || memory.path.startsWith(`${mount.path}/`))
+            || await readFile(join(root, memory.path), "utf8") !== memory.content) {
+            throw new Error("ability_memory_snapshot_mismatch");
+        }
+    }
+    if (ability.memory.reduce((bytes, memory) => bytes + Buffer.byteLength(memory.content, "utf8"), 0) > 64 * 1024) {
+        throw new Error("ability_memory_snapshot_size_exceeded");
+    }
+    return { root, manifest };
+};
+const layerRelativePath = (path, layer) => path.startsWith(`${layer}/`) ? path.slice(layer.length + 1) : path;
+const readManagedCatalog = async (trainingRoot) => JSON.parse(await readFile(join(trainingRoot, "ACTIVE_RELEASE.json"), "utf8"));
+const materializeWorkspaceTraining = async (agentsRoot, handle, ability) => {
+    let verified;
+    try {
+        verified = await verifyCache(agentsRoot, ability);
+    }
+    catch (error) {
+        if (!(error instanceof Error) || error.message !== "ability_artifact_cache_missing")
+            throw error;
+        const resolved = await resolveAbilityRelease(agentsRoot, {
+            type: "agent:ability:resolve",
+            reqId: `workspace-apply-${ability.releaseId}`,
+            handle,
+            repositoryUrl: ability.repositoryUrl,
+            branchGlob: ability.branch,
+            desiredCommit: ability.rootCommit,
+        });
+        if (resolved.artifactDigest !== ability.artifactDigest || resolved.rootCommit !== ability.rootCommit) {
+            throw new Error("ability_workspace_projection_source_mismatch");
+        }
+        verified = await verifyCache(agentsRoot, ability);
+    }
+    const sourceRoot = verified.root;
+    const agentRoot = join(agentsRoot, handle);
+    const trainingRoot = join(agentRoot, "training");
+    const projectionDigest = abilitySha256(JSON.stringify({
+        artifactDigest: ability.artifactDigest,
+        memory: ability.memory,
+        workspace: ability.workspace,
+    }));
+    let previousCatalog = null;
+    if (await exists(trainingRoot)) {
+        previousCatalog = await readManagedCatalog(trainingRoot).catch(() => null);
+        if (previousCatalog?.managedBy !== "nowcrew-agent-training") {
+            throw new Error("ability_workspace_training_conflict");
+        }
+        if (previousCatalog.releaseId === ability.releaseId
+            && previousCatalog.artifactDigest === ability.artifactDigest
+            && previousCatalog.projectionDigest === projectionDigest)
+            return trainingRoot;
+    }
+    await mkdir(agentRoot, { recursive: true });
+    const staging = join(agentRoot, `.training-next-${ability.releaseId}-${randomUUID()}`);
+    const backup = join(agentRoot, `.training-previous-${ability.releaseId}-${randomUUID()}`);
+    await mkdir(staging, { recursive: true, mode: 0o700 });
+    try {
+        const instructionsTarget = join(staging, "instructions", layerRelativePath(ability.instructions.path, "instructions"));
+        await mkdir(dirname(instructionsTarget), { recursive: true });
+        await cp(join(sourceRoot, ability.instructions.path), instructionsTarget, { preserveTimestamps: true });
+        for (const skill of ability.skills) {
+            const target = join(staging, "skills", safeAbilityName(skill.name));
+            await mkdir(dirname(target), { recursive: true });
+            await cp(join(sourceRoot, skill.path), target, { recursive: true, preserveTimestamps: true });
+        }
+        for (const memory of ability.memory) {
+            const target = join(staging, "memory", safeAbilityName(memory.layer), `${safeAbilityName(memory.id)}.md`);
+            await mkdir(dirname(target), { recursive: true });
+            await writeFile(target, memory.content, { encoding: "utf8", mode: 0o600 });
+        }
+        for (const asset of ability.workspace) {
+            const relativeTarget = abilityWorkspaceProjectionPath(asset.target);
+            const target = join(staging, "workspace", relativeTarget);
+            await mkdir(dirname(target), { recursive: true });
+            const previous = join(trainingRoot, "workspace", relativeTarget);
+            const source = asset.mode === "managed-copy" && previousCatalog !== null && await exists(previous)
+                ? previous
+                : join(sourceRoot, asset.source);
+            await cp(source, target, { recursive: true, preserveTimestamps: true });
+        }
+        const evalPaths = [verified.manifest.spec.evals.policy, ...verified.manifest.spec.evals.cases];
+        for (const path of evalPaths) {
+            const target = join(staging, "evals", layerRelativePath(path, "evals"));
+            await mkdir(dirname(target), { recursive: true });
+            await cp(join(sourceRoot, path), target, { recursive: true, preserveTimestamps: true });
+        }
+        await writeFile(join(staging, "ACTIVE_RELEASE.json"), JSON.stringify({
+            managedBy: "nowcrew-agent-training",
+            releaseId: ability.releaseId,
+            rootCommit: ability.rootCommit,
+            artifactDigest: ability.artifactDigest,
+            projectionDigest,
+            instructions: `training/instructions/${layerRelativePath(ability.instructions.path, "instructions")}`,
+            skills: ability.skills.map((skill) => skill.name),
+            memory: ability.memory.map((memory) => ({ id: memory.id, layer: memory.layer })),
+            workspace: ability.workspace.map((asset) => ({
+                ...asset,
+                projectedPath: `training/workspace/${abilityWorkspaceProjectionPath(asset.target)}`,
+            })),
+            evals: evalPaths.map((path) => `training/evals/${layerRelativePath(path, "evals")}`),
+        }, null, 2), { encoding: "utf8", mode: 0o600 });
+        await readonlyTree(staging);
+        for (const asset of ability.workspace) {
+            if (asset.mode === "managed-copy") {
+                await writableTree(join(staging, "workspace", abilityWorkspaceProjectionPath(asset.target)));
+            }
+        }
+        await switchDirectory(trainingRoot, staging, backup);
+    }
+    catch (error) {
+        await removeManagedTree(staging).catch(() => { });
+        throw error;
+    }
+    return trainingRoot;
+};
+const projectWorkspaceTraining = async (agentsRoot, handle, ability, trainingRoot) => {
+    const agentRoot = join(agentsRoot, handle);
+    await projectNativeSkills(agentRoot, trainingRoot, ability.skills);
+    const legacyAbilityRoot = join(agentRoot, ".nowcrew", "ability");
+    if (await exists(join(legacyAbilityRoot, "releases")) || await exists(join(legacyAbilityRoot, "current"))) {
+        await removeManagedTree(legacyAbilityRoot);
+    }
+    await writeFile(join(agentRoot, ".nowwork-root"), "", { encoding: "utf8", mode: 0o600 });
+};
+export function createAgentAbilityMaterializer(expectedAgentsRoot) {
+    const tails = new Map();
+    const withAgentTurn = async (handle, operation) => {
+        const previous = tails.get(handle) ?? Promise.resolve();
+        let release;
+        const turn = new Promise((resolveTurn) => { release = resolveTurn; });
+        const tail = previous.then(() => turn);
+        tails.set(handle, tail);
+        await previous;
+        try {
+            return await operation();
+        }
+        finally {
+            release();
+            if (tails.get(handle) === tail)
+                tails.delete(handle);
+        }
+    };
+    const apply = async (agentsRoot, handle, ability) => {
+        if (agentsRoot !== expectedAgentsRoot)
+            throw new Error("ability_agents_root_mismatch");
+        const trainingRoot = await materializeWorkspaceTraining(agentsRoot, handle, ability);
+        await projectWorkspaceTraining(agentsRoot, handle, ability, trainingRoot);
+        return { directory: "training", releaseId: ability.releaseId, artifactDigest: ability.artifactDigest };
+    };
+    return {
+        apply(agentsRoot, handle, ability) {
+            return withAgentTurn(handle, async () => {
+                const started = Date.now();
+                try {
+                    const result = await apply(agentsRoot, handle, ability);
+                    dslog("ability.workspace.projected", "Agent training projected into workspace", {
+                        level: "INFO", agent_handle: handle, release_id: ability.releaseId,
+                        root_commit: ability.rootCommit, artifact_digest: ability.artifactDigest,
+                        workspace_directory: result.directory, duration_ms: Date.now() - started,
+                    });
+                    return result;
+                }
+                catch (error) {
+                    dslog("ability.workspace.projection_failed", "Agent training workspace projection failed", {
+                        level: "ERROR", agent_handle: handle, release_id: ability.releaseId,
+                        root_commit: ability.rootCommit,
+                        error_code: error instanceof Error ? error.message.slice(0, 120) : "ability_workspace_projection_failed",
+                    });
+                    throw error;
+                }
+            });
+        },
+        async prepareAndLaunch(agentsRoot, handle, ability, launch) {
+            return withAgentTurn(handle, async () => {
+                const started = Date.now();
+                try {
+                    await apply(agentsRoot, handle, ability);
+                    dslog("ability.execution.materialized", "Agent ability release materialized", {
+                        level: "INFO", agent_handle: handle, release_id: ability.releaseId,
+                        root_commit: ability.rootCommit, artifact_digest: ability.artifactDigest,
+                        workspace_directory: "training", duration_ms: Date.now() - started,
+                    });
+                    return await launch();
+                }
+                catch (error) {
+                    dslog("ability.execution.rejected", "Agent ability release materialization failed", {
+                        level: "ERROR", agent_handle: handle, release_id: ability.releaseId,
+                        root_commit: ability.rootCommit, error_code: error instanceof Error ? error.message.slice(0, 120) : "ability_materialization_failed",
+                    });
+                    throw error;
+                }
+            });
+        },
+    };
+}