@nowcrew/daemon 0.6.103 → 0.6.104

package/dist/storage-worker-handoff.js

@@ -1,151 +0,0 @@
-import { execFile } from "node:child_process";
-import { readFile, rm } from "node:fs/promises";
-import { join, posix, resolve, win32 } from "node:path";
-import { promisify } from "node:util";
-import { z } from "zod";
-import { atomicPrivateWrite } from "./atomic-private-write.js";
-import { readStorageWorkerOperation } from "./storage-worker-operation.js";
-const AbsolutePathSchema = z.string().min(1).max(32768)
-    .refine((value) => !/[\0\r\n]/u.test(value), "path must be a single line")
-    .refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "path must be absolute");
-const HandoffSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    profile: z.string().regex(/^[a-z0-9][a-z0-9_-]{0,47}$/u),
-    operationPath: AbsolutePathSchema,
-    operationSha256: z.string().regex(/^[0-9a-f]{64}$/u),
-}).strict();
-export async function writeStorageWorkerHandoff(raw, input) {
-    let handoff;
-    try {
-        handoff = HandoffSchema.parse(raw);
-        AbsolutePathSchema.parse(input.stateRoot);
-    }
-    catch (error) {
-        throw new Error("Invalid storage worker handoff", { cause: error });
-    }
-    const path = join(input.stateRoot, "migrations", handoff.migrationId, "handoff.json");
-    await atomicPrivateWrite(path, `${JSON.stringify(handoff, null, 2)}\n`);
-    return path;
-}
-export async function readStorageWorkerHandoff(path) {
-    try {
-        AbsolutePathSchema.parse(path);
-        return HandoffSchema.parse(JSON.parse(await readFile(path, "utf8")));
-    }
-    catch (error) {
-        throw new Error("Invalid storage worker handoff", { cause: error });
-    }
-}
-const execFileAsync = promisify(execFile);
-const systemSupervisorRun = async (command, args) => {
-    try {
-        const result = await execFileAsync(command, [...args], {
-            encoding: "utf8",
-            timeout: 15_000,
-            maxBuffer: 64 * 1024,
-        });
-        return { exitCode: 0, stdout: result.stdout, stderr: result.stderr };
-    }
-    catch (error) {
-        const failure = error;
-        return {
-            exitCode: typeof failure.code === "number" ? failure.code : 127,
-            stdout: failure.stdout ?? "",
-            stderr: failure.stderr ?? failure.message,
-        };
-    }
-};
-function workerUnitName(migrationId) {
-    return `nowwork-storage-migration-${migrationId}.service`;
-}
-function workerUnitPath(userHome, migrationId) {
-    return resolve(userHome, ".config", "systemd", "user", workerUnitName(migrationId));
-}
-function workerLaunchdLabel(migrationId) {
-    return `com.nowcrew.storage-migration.${migrationId}`;
-}
-function workerLaunchdPath(userHome, migrationId) {
-    return resolve(userHome, "Library", "LaunchAgents", `${workerLaunchdLabel(migrationId)}.plist`);
-}
-function xml(value) {
-    return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;")
-        .replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-}
-function systemdArg(value) {
-    if (/[\0\r\n]/u.test(value))
-        throw new Error("storage worker service argument must be a single line");
-    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
-}
-async function checkedSupervisor(run, command, args) {
-    const result = await run(command, args);
-    if (result.exitCode !== 0)
-        throw new Error(result.stderr.trim() || result.stdout.trim() || `exit ${result.exitCode}`);
-}
-export async function launchStorageMigrationWorker(input, runSupervisor = systemSupervisorRun) {
-    AbsolutePathSchema.parse(input.entryPath);
-    AbsolutePathSchema.parse(input.handoffPath);
-    AbsolutePathSchema.parse(input.userHome);
-    const migrationId = z.string().uuid().parse(input.migrationId).toLowerCase();
-    const worker = [process.execPath, input.entryPath, "storage-migration-worker", "--job", input.handoffPath];
-    if (input.platform === "darwin") {
-        if (input.uid === undefined || !Number.isSafeInteger(input.uid) || input.uid < 0) {
-            throw new Error("Persistent storage migration launchd worker requires a numeric uid");
-        }
-        const label = workerLaunchdLabel(migrationId);
-        const path = workerLaunchdPath(input.userHome, migrationId);
-        const args = worker.map((arg) => `      <string>${xml(arg)}</string>`).join("\n");
-        const descriptor = `<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0">\n<dict>\n  <key>Label</key><string>${xml(label)}</string>\n  <key>ProgramArguments</key>\n  <array>\n${args}\n  </array>\n  <key>RunAtLoad</key><true/>\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key><false/>\n  </dict>\n  <key>ProcessType</key><string>Background</string>\n</dict>\n</plist>\n`;
-        await atomicPrivateWrite(path, descriptor);
-        try {
-            await checkedSupervisor(runSupervisor, "launchctl", ["bootstrap", `gui/${input.uid}`, path]);
-        }
-        catch (error) {
-            await runSupervisor("launchctl", ["bootout", `gui/${input.uid}/${label}`]).catch(() => undefined);
-            await rm(path, { force: true });
-            throw new Error("Storage migration persistent service launch failed", { cause: error });
-        }
-        return;
-    }
-    const unit = workerUnitName(migrationId);
-    const path = workerUnitPath(input.userHome, migrationId);
-    const descriptor = `[Unit]\nDescription=NowWork storage migration ${migrationId}\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=exec\nExecStart=${worker.map(systemdArg).join(" ")}\nRestart=on-abnormal\nRestartSec=5\n\n[Install]\nWantedBy=default.target\n`;
-    await atomicPrivateWrite(path, descriptor);
-    try {
-        await checkedSupervisor(runSupervisor, "systemctl", ["--user", "daemon-reload"]);
-        await checkedSupervisor(runSupervisor, "systemctl", ["--user", "enable", "--now", unit]);
-    }
-    catch (error) {
-        await runSupervisor("systemctl", ["--user", "disable", "--now", unit]).catch(() => undefined);
-        await rm(path, { force: true });
-        await runSupervisor("systemctl", ["--user", "daemon-reload"]).catch(() => undefined);
-        throw new Error("Storage migration persistent service launch failed", { cause: error });
-    }
-}
-export async function completeStorageMigrationWorkerService(input, runSupervisor = systemSupervisorRun) {
-    const migrationId = z.string().uuid().parse(input.migrationId).toLowerCase();
-    AbsolutePathSchema.parse(input.userHome);
-    if (input.platform === "darwin") {
-        if (input.uid === undefined || !Number.isSafeInteger(input.uid) || input.uid < 0) {
-            throw new Error("Persistent storage migration launchd worker requires a numeric uid");
-        }
-        const label = workerLaunchdLabel(migrationId);
-        await rm(workerLaunchdPath(input.userHome, migrationId), { force: true });
-        await runSupervisor("launchctl", ["bootout", `gui/${input.uid}/${label}`]);
-        return;
-    }
-    const unit = workerUnitName(migrationId);
-    await checkedSupervisor(runSupervisor, "systemctl", ["--user", "disable", unit]);
-    await rm(workerUnitPath(input.userHome, migrationId), { force: true });
-    await checkedSupervisor(runSupervisor, "systemctl", ["--user", "daemon-reload"]);
-}
-export async function completeStorageMigrationWorkerServiceForHandoff(path) {
-    const handoff = await readStorageWorkerHandoff(path);
-    const operation = await readStorageWorkerOperation(handoff.operationPath, handoff.operationSha256);
-    await completeStorageMigrationWorkerService({
-        migrationId: operation.migrationId,
-        platform: operation.service.platform,
-        userHome: operation.service.userHome,
-        ...(operation.service.uid === undefined ? {} : { uid: operation.service.uid }),
-    });
-}

package/dist/storage-worker-operation.js

@@ -1,288 +0,0 @@
-import { createHash, timingSafeEqual } from "node:crypto";
-import { realpathSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { basename, dirname, join, posix, win32 } from "node:path";
-import { z } from "zod";
-import { atomicPrivateWrite } from "./atomic-private-write.js";
-import { assertStorageControlMaterialTokenFree } from "./storage-credential-guard.js";
-import { storageLayout } from "./storage-layout.js";
-import { StorageMigrationWarningCodeSchema } from "./storage-migration-policy.js";
-const CONTROL = /[\0\r\n]/u;
-const PROFILE = /^[a-z0-9][a-z0-9_-]{0,47}$/u;
-const ENVIRONMENT = /^[a-z0-9][a-z0-9_-]{0,31}$/u;
-const HASH = /^[0-9a-f]{64}$/u;
-const AbsolutePathSchema = z.string().min(1).max(32768)
-    .refine((value) => !CONTROL.test(value), "path must be a single line")
-    .refine((value) => posix.isAbsolute(value) || win32.isAbsolute(value), "path must be absolute");
-const RelativePathSchema = z.string().min(1).max(32768)
-    .refine((value) => !CONTROL.test(value), "path must be a single line")
-    .refine((value) => !posix.isAbsolute(value) && !win32.isAbsolute(value), "path must be relative")
-    .refine((value) => !value.split(/[\\/]/u).some((segment) => segment === "" || segment === "." || segment === ".."), "path must be normalized");
-const SourceKindSchema = z.enum(["daemon-home", "agents-root", "legacy-agents-root"]);
-const PolicySchema = z.object({
-    exclusions: z.array(z.object({
-        sourceKind: SourceKindSchema,
-        sourcePath: RelativePathSchema,
-        reason: z.string().min(1).max(256),
-    }).strict()).max(100_000),
-    transformations: z.array(z.object({
-        sourceKind: SourceKindSchema,
-        sourcePath: RelativePathSchema,
-        logicalDestination: RelativePathSchema,
-        sourceSha256: z.string().regex(HASH),
-        targetSha256: z.string().regex(HASH),
-        targetMode: z.string().regex(/^[0-7]{4}$/u),
-        transform: z.literal("redact_live_like_tokens_v1"),
-    }).strict()).max(100_000),
-}).strict();
-const DoctorInputSchema = z.object({
-    migrationId: z.string().uuid(),
-    generatedAt: z.string().datetime({ offset: true }),
-    environment: z.string().regex(ENVIRONMENT),
-    workspaceId: z.string().uuid(),
-    profile: z.string().regex(PROFILE),
-    targetWorkspaceRoot: AbsolutePathSchema,
-    sources: z.array(z.object({
-        kind: SourceKindSchema,
-        root: AbsolutePathSchema,
-        logicalPrefix: RelativePathSchema,
-    }).strict()).min(1).max(3),
-    policy: PolicySchema,
-    manifestStoreRoot: AbsolutePathSchema.optional(),
-    state: z.object({
-        profileIdentityExact: z.boolean(),
-        duplicateWorkspaceMappings: z.number().int().nonnegative(),
-        activeAgentExecutions: z.number().int().nonnegative(),
-        activeScheduledRuns: z.number().int().nonnegative(),
-    }).strict(),
-    freeSpaceMultiplier: z.number().finite().min(1).max(10).optional(),
-}).strict();
-const ManagedServiceRecordSchema = z.object({
-    version: z.literal(1),
-    generation: z.string().uuid(),
-    platform: z.enum(["darwin", "linux"]),
-    serviceId: z.string().min(1).max(256),
-    profile: z.string().regex(PROFILE),
-    daemonHome: AbsolutePathSchema,
-    agentsRoot: AbsolutePathSchema,
-    nodePath: AbsolutePathSchema,
-    entryPath: AbsolutePathSchema,
-    packageRoot: AbsolutePathSchema,
-    npmPrefix: AbsolutePathSchema,
-    descriptorPath: AbsolutePathSchema,
-    descriptorSha256: z.string().regex(HASH),
-    createdAt: z.string().datetime({ offset: true }),
-}).strict();
-const InstallationRecordSchema = z.object({
-    version: z.literal(1),
-    installationId: z.string().uuid(),
-    profile: z.string().regex(PROFILE),
-    serverUrl: z.string().url().max(2048).refine((value) => {
-        const url = new URL(value);
-        return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
-    }, "serverUrl must be HTTP(S) without credentials"),
-    environment: z.string().regex(ENVIRONMENT),
-    workspaceId: z.string().uuid(),
-    storageId: z.string().min(1).max(128).regex(/^[A-Za-z0-9_-]+$/u),
-    nowworkHome: AbsolutePathSchema,
-    runtimeRoot: AbsolutePathSchema,
-    credentialRef: z.string().regex(/^profile:[a-z0-9][a-z0-9_-]{0,47}$/u),
-    storageMigrationId: z.string().uuid(),
-    createdAt: z.string().datetime({ offset: true }),
-    updatedAt: z.string().datetime({ offset: true }),
-}).strict();
-const StorageServiceEnvironmentSchema = z.object({
-    NOWWORK_HOME: AbsolutePathSchema.optional(),
-    NOWWORK_ENV_TAG: z.string().regex(ENVIRONMENT).optional(),
-    NOWWORK_STORAGE_POLICY_PATH: AbsolutePathSchema.optional(),
-}).strict();
-const OperationSchema = z.object({
-    version: z.literal(1),
-    migrationId: z.string().uuid(),
-    createdAt: z.string().datetime({ offset: true }),
-    environment: z.string().regex(ENVIRONMENT),
-    workspaceId: z.string().uuid(),
-    profile: z.string().regex(PROFILE),
-    expectedManifestDigest: z.string().regex(HASH),
-    doctorInput: DoctorInputSchema,
-    migration: z.object({
-        sourceRoots: z.object({
-            "daemon-home": AbsolutePathSchema.optional(),
-            "agents-root": AbsolutePathSchema.optional(),
-            "legacy-agents-root": AbsolutePathSchema.optional(),
-        }).strict(),
-        stagingWorkspaceRoot: AbsolutePathSchema,
-        targetWorkspaceRoot: AbsolutePathSchema,
-        backupsRoot: AbsolutePathSchema,
-        backupArtifacts: z.array(z.object({
-            name: z.string().regex(/^[a-z0-9][a-z0-9_.-]{0,127}$/u),
-            path: AbsolutePathSchema,
-        }).strict()).max(32),
-        ownership: z.object({
-            ownerEpoch: z.number().int().positive().safe(),
-            ownershipClaimFingerprint: z.string().regex(/^sha256:[0-9a-f]{64}$/u),
-        }).strict().optional(),
-        acceptedWarnings: z.array(StorageMigrationWarningCodeSchema)
-            .max(StorageMigrationWarningCodeSchema.options.length),
-    }).strict(),
-    service: z.object({
-        platform: z.enum(["darwin", "linux"]),
-        userHome: AbsolutePathSchema,
-        uid: z.number().int().nonnegative().optional(),
-        serviceEnvironment: StorageServiceEnvironmentSchema.optional(),
-        sourceWasRunning: z.boolean(),
-        sourceRecord: ManagedServiceRecordSchema,
-        targetRecord: ManagedServiceRecordSchema,
-    }).strict(),
-    installation: z.object({
-        configRoot: AbsolutePathSchema,
-        target: InstallationRecordSchema,
-    }).strict(),
-}).strict();
-const pathsFor = (_platform) => posix;
-function canonicalPath(value, platform) {
-    const paths = pathsFor(platform);
-    const absolute = paths.resolve(value);
-    try {
-        return realpathSync.native(absolute);
-    }
-    catch (error) {
-        const code = error.code;
-        if (code === "ENOTDIR")
-            return absolute;
-        if (code !== "ENOENT")
-            throw error;
-    }
-    const missing = [];
-    let ancestor = absolute;
-    for (;;) {
-        const parent = paths.dirname(ancestor);
-        if (parent === ancestor)
-            return absolute;
-        missing.unshift(paths.basename(ancestor));
-        ancestor = parent;
-        try {
-            return paths.resolve(realpathSync.native(ancestor), ...missing);
-        }
-        catch (error) {
-            const code = error.code;
-            if (code === "ENOTDIR")
-                return absolute;
-            if (code !== "ENOENT")
-                throw error;
-        }
-    }
-}
-function samePath(left, right, platform) {
-    return canonicalPath(left, platform) === canonicalPath(right, platform);
-}
-function isInside(root, candidate, platform) {
-    const paths = pathsFor(platform);
-    const child = paths.relative(canonicalPath(root, platform), canonicalPath(candidate, platform));
-    return child === "" || (!child.startsWith("..") && !paths.isAbsolute(child));
-}
-function assertSemanticIdentity(operation) {
-    const identity = [operation.doctorInput, operation.installation.target];
-    if (identity.some((value) => value.workspaceId !== operation.workspaceId
-        || value.environment !== operation.environment || value.profile !== operation.profile)
-        || operation.doctorInput.migrationId !== operation.migrationId
-        || operation.installation.target.storageMigrationId !== operation.migrationId
-        || operation.installation.target.credentialRef !== `profile:${operation.profile}`) {
-        throw new Error("storage worker operation identity does not match");
-    }
-    if (operation.doctorInput.state.profileIdentityExact !== true
-        || operation.doctorInput.state.duplicateWorkspaceMappings !== 0
-        || operation.doctorInput.state.activeAgentExecutions !== 0
-        || operation.doctorInput.state.activeScheduledRuns !== 0) {
-        throw new Error("storage worker operation doctor state is not safe");
-    }
-    const { platform, sourceRecord, targetRecord } = operation.service;
-    if (sourceRecord.platform !== platform || targetRecord.platform !== platform
-        || sourceRecord.profile !== operation.profile || targetRecord.profile !== operation.profile
-        || sourceRecord.serviceId === targetRecord.serviceId
-        || !samePath(sourceRecord.nodePath, targetRecord.nodePath, platform)
-        || !samePath(sourceRecord.entryPath, targetRecord.entryPath, platform)
-        || !samePath(sourceRecord.packageRoot, targetRecord.packageRoot, platform)
-        || !samePath(sourceRecord.npmPrefix, targetRecord.npmPrefix, platform)
-        || !samePath(targetRecord.daemonHome, operation.installation.configRoot, platform)) {
-        throw new Error("storage worker service identity does not match");
-    }
-    const sourceKinds = new Set();
-    for (const source of operation.doctorInput.sources) {
-        if (sourceKinds.has(source.kind) || !samePath(operation.migration.sourceRoots[source.kind] ?? "", source.root, platform)) {
-            throw new Error("storage worker source roots do not match doctor input");
-        }
-        sourceKinds.add(source.kind);
-    }
-    const configuredSourceKinds = Object.entries(operation.migration.sourceRoots)
-        .filter(([, value]) => value !== undefined)
-        .map(([kind]) => kind);
-    if (configuredSourceKinds.length !== sourceKinds.size || configuredSourceKinds.some((kind) => !sourceKinds.has(kind))
-        || !samePath(operation.migration.sourceRoots["daemon-home"] ?? "", sourceRecord.daemonHome, platform)
-        || !samePath(operation.migration.sourceRoots["agents-root"] ?? "", sourceRecord.agentsRoot, platform)) {
-        throw new Error("storage worker source service roots do not match");
-    }
-    const projected = storageLayout({
-        nowworkHome: operation.installation.target.nowworkHome,
-        environment: operation.environment,
-        workspaceId: operation.workspaceId,
-        runtimeBase: join(operation.service.userHome, ".nowwork-worker-runtime-validation"),
-        platform,
-    });
-    if (!samePath(projected.workspaceRoot, operation.migration.targetWorkspaceRoot, platform)
-        || !samePath(projected.workspaceRoot, operation.doctorInput.targetWorkspaceRoot, platform)
-        || !samePath(projected.agentItemsRoot, targetRecord.agentsRoot, platform)) {
-        throw new Error("storage worker target layout does not match installation identity");
-    }
-    if (dirname(operation.migration.stagingWorkspaceRoot) !== dirname(operation.migration.targetWorkspaceRoot)
-        || !basename(operation.migration.stagingWorkspaceRoot).includes(operation.migrationId)) {
-        throw new Error("storage worker staging identity does not match target");
-    }
-    if (isInside(operation.installation.target.nowworkHome, operation.migration.backupsRoot, platform)
-        || isInside(operation.installation.target.nowworkHome, operation.installation.configRoot, platform)) {
-        throw new Error("storage worker local state must remain outside NOWWORK_HOME");
-    }
-}
-function parseOperation(raw) {
-    const operation = OperationSchema.parse(raw);
-    assertSemanticIdentity(operation);
-    return operation;
-}
-function sha256(value) {
-    return createHash("sha256").update(value).digest("hex");
-}
-export async function writeStorageWorkerOperation(raw, input) {
-    try {
-        const operation = parseOperation(raw);
-        const stateRoot = AbsolutePathSchema.parse(input.stateRoot);
-        const path = join(stateRoot, "migrations", operation.migrationId, "operation.json");
-        const serialized = `${JSON.stringify(operation, null, 2)}\n`;
-        assertStorageControlMaterialTokenFree(serialized, "storage worker operation");
-        await atomicPrivateWrite(path, serialized);
-        return Object.freeze({ path, sha256: sha256(serialized) });
-    }
-    catch (error) {
-        throw new Error("Invalid storage worker operation", { cause: error });
-    }
-}
-export async function readStorageWorkerOperation(path, expectedSha256) {
-    try {
-        AbsolutePathSchema.parse(path);
-        z.string().regex(HASH).parse(expectedSha256);
-        const raw = await readFile(path);
-        assertStorageControlMaterialTokenFree(raw.toString("utf8"), "storage worker operation");
-        const actual = Buffer.from(sha256(raw), "hex");
-        const expected = Buffer.from(expectedSha256, "hex");
-        if (!timingSafeEqual(actual, expected))
-            throw new Error("storage worker operation digest mismatch");
-        const operation = parseOperation(JSON.parse(raw.toString("utf8")));
-        if (basename(path) !== "operation.json" || basename(dirname(path)) !== operation.migrationId
-            || basename(dirname(dirname(path))) !== "migrations") {
-            throw new Error("storage worker operation path does not match migration identity");
-        }
-        return operation;
-    }
-    catch (error) {
-        throw new Error("Invalid storage worker operation", { cause: error });
-    }
-}