@nowcrew/daemon 0.6.60 → 0.6.64

package/dist/storage-copy.js

@@ -1,444 +0,0 @@
-import { createHash } from "node:crypto";
-import { constants } from "node:fs";
-import { lstat, realpath, rename, } from "node:fs/promises";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { containsStorageCredentialMaterial } from "./storage-credential-guard.js";
-import { chmodAnchoredDirectory, createAnchoredFile, createAnchoredSymlink, ensureAnchoredDirectory, inspectAnchoredEntry, openAnchoredFile, readAnchoredDirectory, removeAnchoredEntry, } from "./storage-safe-fs.js";
-export const REDACTED_STORAGE_TOKEN = "[REDACTED: historical generic_sk credential removed during NOWWORK_HOME migration]";
-const WORKSPACE_DIRECTORIES = ["agent-items", "daemon", "repos", "suite-tools"];
-const LIVE_LIKE_TOKEN = /(?:bearer[ \t]+[a-z0-9._~-]{20,}|sk-[a-z0-9_-]{20,}|AKIA[0-9A-Z]{16})/giu;
-const MAX_TRANSFORM_FILE_BYTES = 8 * 1024 * 1024;
-const CREDENTIAL_SCAN_OVERLAP_BYTES = 4 * 1024;
-const FILE_OPERATION_CONCURRENCY = 8;
-function containedPath(root, logicalPath) {
-    if (logicalPath.length === 0 || isAbsolute(logicalPath) || logicalPath.includes("\0")
-        || logicalPath.includes("\n") || logicalPath.includes("\r")) {
-        throw new Error(`unsafe logical migration path: ${logicalPath}`);
-    }
-    const target = resolve(root, logicalPath);
-    const child = relative(root, target);
-    if (child === "" || child.startsWith("..") || isAbsolute(child)) {
-        throw new Error(`logical migration path escapes staging: ${logicalPath}`);
-    }
-    return target;
-}
-function sourcePath(input) {
-    const root = input.sourceRoots[input.entry.sourceKind];
-    if (root === undefined)
-        throw new Error(`missing source root: ${input.entry.sourceKind}`);
-    return containedPath(root, input.entry.sourcePath);
-}
-async function exists(path) {
-    try {
-        await lstat(path);
-        return true;
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return false;
-        throw error;
-    }
-}
-async function copyVerifiedFile(source, target, stagingWorkspaceRoot, entry, replaceExisting, afterSourceLstat, afterTargetParentOpen) {
-    if (entry.sha256 === undefined)
-        throw new Error(`manifest file digest is missing: ${source}`);
-    const sourceHandle = await openAnchoredFile(source, constants.O_RDONLY).catch((error) => {
-        throw new Error(`migration source cannot be opened without following links: ${entry.sourcePath}`, { cause: error });
-    });
-    try {
-        const opened = await sourceHandle.stat();
-        if (!opened.isFile())
-            throw new Error(`migration source is no longer a file: ${entry.sourcePath}`);
-        await afterSourceLstat?.(source);
-        let sourceAfterHook;
-        try {
-            sourceAfterHook = inspectAnchoredEntry(dirname(source), source);
-        }
-        catch (error) {
-            throw new Error(`migration source changed before copy: ${entry.sourcePath}`, { cause: error });
-        }
-        if (sourceAfterHook.kind !== "file" || sourceAfterHook.stats.dev !== opened.dev
-            || sourceAfterHook.stats.ino !== opened.ino) {
-            throw new Error(`migration source changed before copy: ${entry.sourcePath}`);
-        }
-        if (replaceExisting)
-            removeReplaceableTarget(stagingWorkspaceRoot, target, entry.logicalDestination ?? entry.sourcePath);
-        const targetHandle = await createAnchoredFile(stagingWorkspaceRoot, target, 0o600, afterTargetParentOpen).catch((error) => {
-            throw new Error(`migration target cannot be opened without following links: ${entry.logicalDestination}`, { cause: error });
-        });
-        const targetOpened = await targetHandle.stat();
-        const digest = createHash("sha256");
-        const sourceStream = sourceHandle.createReadStream({ autoClose: false });
-        try {
-            for await (const rawChunk of sourceStream) {
-                const chunk = Buffer.from(rawChunk);
-                digest.update(chunk);
-                await targetHandle.write(chunk, 0, chunk.length, null);
-            }
-            await targetHandle.sync();
-            await targetHandle.chmod(Number.parseInt(entry.mode, 8));
-        }
-        finally {
-            await targetHandle.close();
-        }
-        const after = await sourceHandle.stat();
-        const sourceCurrent = inspectAnchoredEntry(dirname(source), source);
-        if (opened.dev !== after.dev || opened.ino !== after.ino || opened.size !== after.size
-            || opened.mtimeMs !== after.mtimeMs || digest.digest("hex") !== entry.sha256
-            || sourceCurrent.kind !== "file" || sourceCurrent.stats.dev !== opened.dev
-            || sourceCurrent.stats.ino !== opened.ino) {
-            throw new Error(`source digest mismatch: ${source}`);
-        }
-        let targetCurrent;
-        try {
-            targetCurrent = inspectAnchoredEntry(stagingWorkspaceRoot, target);
-        }
-        catch (error) {
-            throw new Error(`migration target changed while copying: ${entry.logicalDestination}`, { cause: error });
-        }
-        if (targetCurrent.kind !== "file" || targetCurrent.stats.dev !== targetOpened.dev
-            || targetCurrent.stats.ino !== targetOpened.ino) {
-            throw new Error(`migration target changed while copying: ${entry.logicalDestination}`);
-        }
-    }
-    finally {
-        await sourceHandle.close();
-    }
-}
-async function createSafeDirectory(root, target) {
-    try {
-        ensureAnchoredDirectory(root, target, 0o700);
-    }
-    catch (error) {
-        throw new Error(`migration target ancestor is a symbolic link or non-directory: ${target}`, { cause: error });
-    }
-}
-async function createSafeParent(root, path) {
-    await createSafeDirectory(root, dirname(path));
-}
-function removeReplaceableTarget(root, path, logicalDestination) {
-    try {
-        const existing = inspectAnchoredEntry(root, path);
-        if (existing.kind === "symlink") {
-            throw new Error(`migration target is a symbolic link: ${logicalDestination}`);
-        }
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return;
-        throw new Error(`migration target ancestor is a symbolic link or non-directory: ${logicalDestination}`, { cause: error });
-    }
-    removeAnchoredEntry(root, path);
-}
-async function assertRealpathWithin(root, candidate, message) {
-    const [canonicalRoot, canonicalCandidate] = await Promise.all([realpath(root), realpath(candidate)]);
-    const child = relative(canonicalRoot, canonicalCandidate);
-    if (child.startsWith("..") || isAbsolute(child))
-        throw new Error(message);
-}
-async function mapInBatches(items, concurrency, operation) {
-    const results = [];
-    for (let offset = 0; offset < items.length; offset += concurrency) {
-        results.push(...await Promise.all(items.slice(offset, offset + concurrency).map(operation)));
-    }
-    return results;
-}
-async function transformFile(source, target, stagingWorkspaceRoot, entry, replaceExisting, afterSourceLstat, afterTargetParentOpen) {
-    if (entry.sha256 === undefined)
-        throw new Error(`manifest file digest is missing: ${source}`);
-    const sourceHandle = await openAnchoredFile(source, constants.O_RDONLY).catch((error) => {
-        throw new Error(`migration source cannot be opened without following links: ${entry.sourcePath}`, { cause: error });
-    });
-    let input;
-    try {
-        const opened = await sourceHandle.stat();
-        if (!opened.isFile())
-            throw new Error(`migration source is no longer a file: ${entry.sourcePath}`);
-        await afterSourceLstat?.(source);
-        let sourceAfterHook;
-        try {
-            sourceAfterHook = inspectAnchoredEntry(dirname(source), source);
-        }
-        catch (error) {
-            throw new Error(`migration source changed before transform: ${entry.sourcePath}`, { cause: error });
-        }
-        if (sourceAfterHook.kind !== "file" || sourceAfterHook.stats.dev !== opened.dev
-            || sourceAfterHook.stats.ino !== opened.ino) {
-            throw new Error(`migration source changed before transform: ${entry.sourcePath}`);
-        }
-        if (opened.size > MAX_TRANSFORM_FILE_BYTES) {
-            throw new Error(`target transformation source exceeds bounded size: ${entry.sourcePath}`);
-        }
-        input = await sourceHandle.readFile("utf8");
-        const after = await sourceHandle.stat();
-        const sourceCurrent = inspectAnchoredEntry(dirname(source), source);
-        if (opened.dev !== after.dev || opened.ino !== after.ino || opened.size !== after.size
-            || opened.mtimeMs !== after.mtimeMs || createHash("sha256").update(input).digest("hex") !== entry.sha256
-            || sourceCurrent.kind !== "file" || sourceCurrent.stats.dev !== opened.dev
-            || sourceCurrent.stats.ino !== opened.ino) {
-            throw new Error(`source digest mismatch: ${source}`);
-        }
-    }
-    finally {
-        await sourceHandle.close();
-    }
-    const output = input.replaceAll(LIVE_LIKE_TOKEN, REDACTED_STORAGE_TOKEN);
-    if (output === input || LIVE_LIKE_TOKEN.test(output))
-        throw new Error(`target transformation did not remove live-like tokens: ${entry.sourcePath}`);
-    LIVE_LIKE_TOKEN.lastIndex = 0;
-    if (entry.targetSha256 === undefined || createHash("sha256").update(output).digest("hex") !== entry.targetSha256) {
-        throw new Error(`transformed target digest mismatch: ${entry.sourcePath}`);
-    }
-    if (replaceExisting)
-        removeReplaceableTarget(stagingWorkspaceRoot, target, entry.logicalDestination ?? entry.sourcePath);
-    const targetHandle = await createAnchoredFile(stagingWorkspaceRoot, target, 0o600, afterTargetParentOpen).catch((error) => {
-        throw new Error(`migration target cannot be opened without following links: ${entry.logicalDestination}`, { cause: error });
-    });
-    const targetOpened = await targetHandle.stat();
-    try {
-        await targetHandle.writeFile(output, "utf8");
-        await targetHandle.sync();
-        await targetHandle.chmod(Number.parseInt(entry.targetMode ?? "0600", 8));
-    }
-    finally {
-        await targetHandle.close();
-    }
-    let targetCurrent;
-    try {
-        targetCurrent = inspectAnchoredEntry(stagingWorkspaceRoot, target);
-    }
-    catch (error) {
-        throw new Error(`migration target changed while transforming: ${entry.logicalDestination}`, { cause: error });
-    }
-    if (targetCurrent.kind !== "file" || targetCurrent.stats.dev !== targetOpened.dev
-        || targetCurrent.stats.ino !== targetOpened.ino) {
-        throw new Error(`migration target changed while transforming: ${entry.logicalDestination}`);
-    }
-    return Buffer.byteLength(output);
-}
-export async function materializeStorageManifest(input, injected = {}) {
-    if (await exists(input.stagingWorkspaceRoot)) {
-        if (!(await lstat(input.stagingWorkspaceRoot)).isDirectory()
-            || (!input.mergeIntoExisting
-                && (await readAnchoredDirectory(input.stagingWorkspaceRoot, input.stagingWorkspaceRoot)).length > 0)) {
-            throw new Error("staging collision: staging workspace root is not empty");
-        }
-    }
-    else {
-        ensureAnchoredDirectory(dirname(input.stagingWorkspaceRoot), input.stagingWorkspaceRoot, 0o700);
-    }
-    let createdDirectories = 0;
-    for (const directory of WORKSPACE_DIRECTORIES) {
-        const path = containedPath(input.stagingWorkspaceRoot, directory);
-        await createSafeDirectory(input.stagingWorkspaceRoot, path);
-        createdDirectories += 1;
-    }
-    const directoryModes = [];
-    const symlinks = [];
-    const files = [];
-    for (const entry of input.manifest.entries) {
-        if (entry.disposition === "skip" || entry.logicalDestination === null)
-            continue;
-        const target = containedPath(input.stagingWorkspaceRoot, entry.logicalDestination);
-        if (entry.type === "directory") {
-            await createSafeDirectory(input.stagingWorkspaceRoot, target);
-            directoryModes.push({ path: target, mode: Number.parseInt(entry.mode, 8) });
-            createdDirectories += 1;
-            continue;
-        }
-        if (entry.type === "file") {
-            files.push(entry);
-            continue;
-        }
-        if (entry.type === "symlink") {
-            if (entry.link?.classification !== "internal" || !entry.link.portable || entry.link.relativeTarget === undefined) {
-                throw new Error(`manifest contains a non-portable copied symlink: ${entry.sourcePath}`);
-            }
-            symlinks.push({ entry, target });
-            continue;
-        }
-        throw new Error(`unsupported copied manifest entry: ${entry.sourcePath}`);
-    }
-    const fileResults = await mapInBatches(files, FILE_OPERATION_CONCURRENCY, async (entry) => {
-        const target = containedPath(input.stagingWorkspaceRoot, entry.logicalDestination);
-        const source = sourcePath({ sourceRoots: input.sourceRoots, entry });
-        if (entry.disposition === "transform") {
-            return {
-                transformed: true,
-                bytesWritten: await transformFile(source, target, input.stagingWorkspaceRoot, entry, input.mergeIntoExisting === true, injected.afterSourceLstat, injected.afterTargetParentOpen),
-            };
-        }
-        await copyVerifiedFile(source, target, input.stagingWorkspaceRoot, entry, input.mergeIntoExisting === true, injected.afterSourceLstat, injected.afterTargetParentOpen);
-        return { transformed: false, bytesWritten: entry.sizeBytes };
-    });
-    for (const { entry, target } of symlinks) {
-        await createSafeParent(input.stagingWorkspaceRoot, target);
-        if (input.mergeIntoExisting)
-            removeReplaceableTarget(input.stagingWorkspaceRoot, target, entry.logicalDestination ?? entry.sourcePath);
-        createAnchoredSymlink(input.stagingWorkspaceRoot, target, entry.link.relativeTarget);
-    }
-    for (const { entry, target } of symlinks) {
-        await assertRealpathWithin(input.stagingWorkspaceRoot, target, `staged symlink escapes workspace: ${entry.sourcePath}`);
-    }
-    directoryModes.sort((left, right) => right.path.length - left.path.length);
-    for (const directory of directoryModes) {
-        chmodAnchoredDirectory(input.stagingWorkspaceRoot, directory.path, directory.mode);
-    }
-    const transformedFiles = fileResults.filter((result) => result.transformed).length;
-    return Object.freeze({
-        copiedFiles: fileResults.length - transformedFiles,
-        transformedFiles,
-        copiedSymlinks: symlinks.length,
-        createdDirectories,
-        bytesWritten: fileResults.reduce((total, result) => total + result.bytesWritten, 0),
-    });
-}
-function copiedEntries(manifest) {
-    return new Map(manifest.entries
-        .filter((entry) => entry.disposition !== "skip" && entry.logicalDestination !== null)
-        .map((entry) => [entry.logicalDestination, entry]));
-}
-export async function reconcileStorageManifest(input) {
-    if (input.previousManifest.migrationId !== input.manifest.migrationId
-        || input.previousManifest.workspaceId !== input.manifest.workspaceId
-        || input.previousManifest.targetWorkspaceRoot !== input.manifest.targetWorkspaceRoot) {
-        throw new Error("storage reconciliation manifest identity mismatch");
-    }
-    const stagingRoot = await lstat(input.stagingWorkspaceRoot);
-    if (!stagingRoot.isDirectory() || stagingRoot.isSymbolicLink()) {
-        throw new Error("storage reconciliation requires existing staging");
-    }
-    const previous = copiedEntries(input.previousManifest);
-    const next = copiedEntries(input.manifest);
-    const removals = [...previous.entries()].filter(([logical, entry]) => {
-        const current = next.get(logical);
-        return current === undefined || current.type !== entry.type;
-    }).sort(([left], [right]) => right.length - left.length);
-    for (const [logical] of removals) {
-        const target = containedPath(input.stagingWorkspaceRoot, logical);
-        try {
-            removeAnchoredEntry(input.stagingWorkspaceRoot, target);
-        }
-        catch (error) {
-            throw new Error(`migration target ancestor is a symbolic link or non-directory: ${logical}`, { cause: error });
-        }
-    }
-    const changed = input.manifest.entries.filter((entry) => {
-        if (entry.logicalDestination === null || entry.disposition === "skip")
-            return false;
-        const prior = previous.get(entry.logicalDestination);
-        return prior === undefined || JSON.stringify(prior) !== JSON.stringify(entry);
-    });
-    return materializeStorageManifest({
-        manifest: { ...input.manifest, entries: changed },
-        sourceRoots: input.sourceRoots,
-        stagingWorkspaceRoot: input.stagingWorkspaceRoot,
-        mergeIntoExisting: true,
-    });
-}
-async function inspectStorageFile(root, path, afterTargetLstat) {
-    const handle = await openAnchoredFile(path, constants.O_RDONLY).catch((error) => {
-        throw new Error(`staged file cannot be opened without following links: ${path}`, { cause: error });
-    });
-    try {
-        const opened = await handle.stat();
-        if (!opened.isFile())
-            throw new Error(`staged file is no longer a regular file: ${path}`);
-        await afterTargetLstat?.(path);
-        const digest = createHash("sha256");
-        let tail = "";
-        let credentialMaterial = false;
-        const stream = handle.createReadStream({ autoClose: false });
-        for await (const chunk of stream) {
-            digest.update(chunk);
-            const text = tail + Buffer.from(chunk).toString("latin1");
-            if (containsStorageCredentialMaterial(text))
-                credentialMaterial = true;
-            tail = text.slice(-CREDENTIAL_SCAN_OVERLAP_BYTES);
-        }
-        const after = await handle.stat();
-        const pathAfter = inspectAnchoredEntry(root, path);
-        if (pathAfter.kind !== "file" || opened.dev !== after.dev || opened.ino !== after.ino
-            || opened.size !== after.size || opened.mtimeMs !== after.mtimeMs
-            || opened.dev !== pathAfter.stats.dev || opened.ino !== pathAfter.stats.ino) {
-            throw new Error(`staged file changed while verifying: ${path}`);
-        }
-        return Object.freeze({ digest: digest.digest("hex"), credentialMaterial });
-    }
-    finally {
-        await handle.close();
-    }
-}
-async function scanLiveLikeMatches(root, alreadyScanned) {
-    let matches = 0;
-    const pending = [root];
-    while (pending.length > 0) {
-        const directory = pending.pop();
-        for (const name of await readAnchoredDirectory(root, directory)) {
-            const path = resolve(directory, name);
-            const entry = inspectAnchoredEntry(root, path);
-            if (entry.kind === "directory")
-                pending.push(path);
-            else if (entry.kind === "file" && !alreadyScanned.has(path)
-                && (await inspectStorageFile(root, path)).credentialMaterial)
-                matches += 1;
-        }
-    }
-    return matches;
-}
-export async function verifyStagedStorage(input, injected = {}) {
-    let checkedEntries = 0;
-    let liveLikeMatches = 0;
-    const scannedFiles = new Set();
-    for (const directory of WORKSPACE_DIRECTORIES) {
-        const target = containedPath(input.stagingWorkspaceRoot, directory);
-        const targetEntry = inspectAnchoredEntry(input.stagingWorkspaceRoot, target);
-        if (targetEntry.kind !== "directory" || (targetEntry.stats.mode & 0o777) !== 0o700) {
-            throw new Error(`required workspace directory is invalid: ${directory}`);
-        }
-    }
-    for (const entry of input.manifest.entries) {
-        const logical = entry.logicalDestination;
-        if (entry.disposition === "skip" || logical === null)
-            continue;
-        const target = containedPath(input.stagingWorkspaceRoot, logical);
-        const targetEntry = inspectAnchoredEntry(input.stagingWorkspaceRoot, target);
-        if (entry.type === "directory" && targetEntry.kind !== "directory")
-            throw new Error(`staged type mismatch: ${logical}`);
-        if (entry.type === "file") {
-            if (targetEntry.kind !== "file")
-                throw new Error(`staged type mismatch: ${logical}`);
-            const expected = entry.disposition === "transform" ? entry.targetSha256 : entry.sha256;
-            const inspected = await inspectStorageFile(input.stagingWorkspaceRoot, target, injected.afterTargetLstat);
-            scannedFiles.add(target);
-            if (expected === undefined || inspected.digest !== expected)
-                throw new Error(`staged digest mismatch: ${logical}`);
-            if (inspected.credentialMaterial)
-                liveLikeMatches += 1;
-            const expectedMode = Number.parseInt(entry.disposition === "transform" ? entry.targetMode ?? "0600" : entry.mode, 8);
-            if ((targetEntry.stats.mode & 0o7777) !== expectedMode)
-                throw new Error(`staged mode mismatch: ${logical}`);
-        }
-        if (entry.type === "symlink") {
-            if (targetEntry.kind !== "symlink" || targetEntry.linkTarget !== entry.link?.relativeTarget) {
-                throw new Error(`staged symlink mismatch: ${logical}`);
-            }
-            await assertRealpathWithin(input.stagingWorkspaceRoot, target, `staged symlink escapes workspace: ${logical}`);
-        }
-        checkedEntries += 1;
-    }
-    liveLikeMatches += await scanLiveLikeMatches(input.stagingWorkspaceRoot, scannedFiles);
-    if (liveLikeMatches !== 0)
-        throw new Error(`staging contains credential material in ${liveLikeMatches} file(s)`);
-    return Object.freeze({ valid: true, checkedEntries, liveLikeMatches: 0 });
-}
-export async function publishStagedStorage(input, dependencies = {}) {
-    if (dirname(input.stagingWorkspaceRoot) !== dirname(input.targetWorkspaceRoot)) {
-        throw new Error("staging and target workspace roots must be siblings on one filesystem");
-    }
-    if (await exists(input.targetWorkspaceRoot))
-        throw new Error("target collision: target workspace root already exists");
-    if (!(await lstat(input.stagingWorkspaceRoot)).isDirectory())
-        throw new Error("staging workspace root is not a directory");
-    await (dependencies.rename ?? rename)(input.stagingWorkspaceRoot, input.targetWorkspaceRoot);
-}

package/dist/storage-credential-guard.js

@@ -1,21 +0,0 @@
-const CREDENTIAL_PATTERNS = Object.freeze([
-    /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/iu,
-    /\bAuthorization\s*:\s*(?:Bearer|Basic)\s+\S{8,}/iu,
-    /\bCookie\s*:\s*[^\n]*(?:session|token|auth)[^\n]{8,}/iu,
-    /\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis):\/\/[^\s:/]+:[^\s@]+@/iu,
-    /\bsk_(?:machine|user|agent)_[A-Za-z0-9_-]{4,}\b/u,
-    /\bAKIA[0-9A-Z]{16}\b/u,
-    /\b(?:sk|gh[oprsu]|xox[baprs])-[-A-Za-z0-9_]{12,}\b/u,
-    /(?:^|[^A-Za-z0-9])(?:[A-Z0-9]+_)*(?:PASSWORD|PASSWD|SECRET|TOKEN|API_KEY|ACCESS_KEY|PRIVATE_KEY)["']?\s*[:=]\s*["']?[^\s"';&,}]{8,}/imu,
-    /\b(?:AWS_SECRET_ACCESS_KEY|TENCENTCLOUD_SECRET_KEY|SECRET_KEY|API_KEY|ACCESS_TOKEN|AUTH_TOKEN|SESSION_TOKEN)\s*[:=]\s*\S{8,}/iu,
-    /\b(?:api[-_]?key|access[-_]?token|refresh[-_]?token|password|passwd|secret|credential|authorization|session|token)\s*[:=]\s*["']?[^\s"';&]{8,}/iu,
-    /\bbearer[ \t]+[A-Za-z0-9._~+/=-]{12,}\b/iu,
-]);
-export function containsStorageCredentialMaterial(value) {
-    return CREDENTIAL_PATTERNS.some((pattern) => pattern.test(value));
-}
-export function assertStorageControlMaterialTokenFree(value, source) {
-    if (containsStorageCredentialMaterial(value)) {
-        throw new Error(`credential material detected in ${source}`);
-    }
-}

package/dist/storage-doctor.js

@@ -1,175 +0,0 @@
-import { constants } from "node:fs";
-import { access, lstat, readdir, realpath, statfs } from "node:fs/promises";
-import { dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { generateStorageManifest, parseStorageManifest, storageManifestDigest, } from "./storage-manifest.js";
-import { validateStorageEnvironment } from "./storage-layout.js";
-export function discoverLegacyStorageSources(input) {
-    if (!isAbsolute(input.legacyRoot))
-        throw new Error("legacy root must be absolute");
-    for (const value of [input.daemonDirectory, input.agentsDirectory]) {
-        if (!/^[a-z0-9][a-z0-9_-]{0,127}$/u.test(value))
-            throw new Error("legacy directory name is invalid");
-    }
-    return Object.freeze([
-        Object.freeze({ kind: "daemon-home", root: join(input.legacyRoot, input.daemonDirectory), logicalPrefix: "daemon" }),
-        Object.freeze({ kind: "agents-root", root: join(input.legacyRoot, input.agentsDirectory), logicalPrefix: "agent-items" }),
-    ]);
-}
-async function nearestExistingAncestor(path) {
-    let candidate = path;
-    for (;;) {
-        try {
-            await lstat(candidate);
-            return candidate;
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-        }
-        const parent = dirname(candidate);
-        if (parent === candidate)
-            throw new Error("target storage has no existing ancestor");
-        candidate = parent;
-    }
-}
-async function canonicalPotentialPath(path) {
-    const absolute = resolve(path);
-    const ancestor = await nearestExistingAncestor(absolute);
-    const canonicalAncestor = await realpath(ancestor);
-    return resolve(canonicalAncestor, relative(ancestor, absolute));
-}
-async function pathsOverlap(left, right) {
-    const [canonicalLeft, canonicalRight] = await Promise.all([
-        canonicalPotentialPath(left),
-        canonicalPotentialPath(right),
-    ]);
-    const leftToRight = relative(canonicalLeft, canonicalRight);
-    const rightToLeft = relative(canonicalRight, canonicalLeft);
-    const contained = (value) => value === "" || (!value.startsWith("..") && !isAbsolute(value));
-    return contained(leftToRight) || contained(rightToLeft);
-}
-async function defaultProbeTarget(targetWorkspaceRoot) {
-    try {
-        const ancestor = await nearestExistingAncestor(targetWorkspaceRoot);
-        await access(ancestor, constants.R_OK | constants.W_OK);
-        let targetState = "absent";
-        try {
-            const target = await lstat(targetWorkspaceRoot);
-            targetState = target.isDirectory() && (await readdir(targetWorkspaceRoot)).length === 0 ? "empty" : "non_empty";
-        }
-        catch (error) {
-            if (error.code !== "ENOENT")
-                throw error;
-        }
-        const filesystem = await statfs(ancestor, { bigint: true });
-        const available = filesystem.bavail * filesystem.bsize;
-        return Object.freeze({
-            status: "available",
-            targetState,
-            availableBytes: available > BigInt(Number.MAX_SAFE_INTEGER) ? Number.MAX_SAFE_INTEGER : Number(available),
-            writable: true,
-            // Staging and final roots are siblings on this filesystem. A destructive rename probe belongs
-            // to the separately approved write preflight, not this read-only doctor.
-            atomicRenameSupported: true,
-        });
-    }
-    catch (error) {
-        const code = error.code;
-        return Object.freeze({
-            status: code === "EACCES" || code === "EPERM" ? "permission_denied" : "unavailable",
-            targetState: "absent",
-            availableBytes: 0,
-            writable: false,
-            atomicRenameSupported: false,
-        });
-    }
-}
-const issue = (code, detail) => Object.freeze({ code, detail });
-function inspectManifestLinks(manifest) {
-    const warnings = [];
-    const blockers = [];
-    const credentialLinks = manifest.entries.filter((entry) => entry.link?.classification === "external" && entry.reason === "credential_material").length;
-    const unapprovedLinks = manifest.entries.filter((entry) => entry.link?.classification === "external" && entry.reason !== "credential_material" && entry.reason !== "local_runtime").length;
-    const brokenLinks = manifest.entries.filter((entry) => entry.link?.classification === "broken").length;
-    const unsupportedItems = manifest.entries.filter((entry) => entry.type === "unsupported").length;
-    if (credentialLinks > 0)
-        warnings.push(issue("credential_link_excluded", `${credentialLinks} credential link(s) excluded from migration`));
-    if (unapprovedLinks > 0)
-        blockers.push(issue("external_symlink_unapproved", `${unapprovedLinks} external link(s) require an explicit exclusion or portable mapping`));
-    if (brokenLinks > 0)
-        blockers.push(issue("broken_symlink", `${brokenLinks} broken link(s) cannot be migrated safely`));
-    if (unsupportedItems > 0)
-        blockers.push(issue("unsupported_file_type", `${unsupportedItems} unsupported filesystem item(s) found`));
-    if (manifest.summary.transformations > 0) {
-        warnings.push(issue("target_transformations_required", `${manifest.summary.transformations} target-only transformation(s) must be verified during apply`));
-    }
-    return { warnings, blockers };
-}
-export async function runStorageDoctor(input, dependencies = {}) {
-    const environment = validateStorageEnvironment(input.environment);
-    const manifest = typeof input.manifest === "string"
-        ? parseStorageManifest(input.manifest)
-        : input.manifest === undefined
-            ? await generateStorageManifest({
-                migrationId: input.migrationId,
-                generatedAt: input.generatedAt,
-                environment,
-                workspaceId: input.workspaceId,
-                targetWorkspaceRoot: input.targetWorkspaceRoot,
-                sources: input.sources,
-                policy: input.policy,
-            })
-            : parseStorageManifest(JSON.stringify(input.manifest));
-    const target = await (dependencies.probeTarget ?? defaultProbeTarget)(input.targetWorkspaceRoot);
-    const warnings = [];
-    const blockers = [];
-    if (manifest.migrationId !== input.migrationId || manifest.workspaceId !== input.workspaceId.toLowerCase()
-        || manifest.environment !== environment || manifest.targetWorkspaceRoot !== input.targetWorkspaceRoot) {
-        blockers.push(issue("manifest_identity_mismatch", "manifest identity does not match the requested migration"));
-    }
-    if (!input.state.profileIdentityExact)
-        blockers.push(issue("profile_identity_drift", "profile, service or managed registry identity drifted"));
-    if ((await Promise.all(input.sources.map((source) => pathsOverlap(source.root, input.targetWorkspaceRoot))))
-        .some(Boolean)) {
-        blockers.push(issue("source_target_overlap", "target workspace and source roots must not contain one another"));
-    }
-    if (input.state.duplicateWorkspaceMappings > 0)
-        blockers.push(issue("duplicate_workspace_mapping", "more than one profile maps to this workspace"));
-    if (input.state.activeAgentExecutions > 0 || input.state.activeScheduledRuns > 0) {
-        blockers.push(issue("active_execution", "active agent execution or scheduled run must finish before migration"));
-    }
-    if (target.status === "unavailable")
-        blockers.push(issue("target_unavailable", "target storage is unavailable"));
-    if (target.status === "permission_denied" || !target.writable)
-        blockers.push(issue("target_permission_denied", "target storage is not writable by the daemon user"));
-    if (target.targetState === "non_empty")
-        blockers.push(issue("target_non_empty", "target workspace root is not empty"));
-    const multiplier = input.freeSpaceMultiplier ?? 1.2;
-    if (!Number.isFinite(multiplier) || multiplier < 1)
-        throw new Error("free space multiplier must be at least 1");
-    const requiredBytes = Math.ceil(manifest.summary.bytesToCopy * multiplier);
-    if (target.status === "available" && target.availableBytes < requiredBytes) {
-        blockers.push(issue("insufficient_space", `target requires at least ${requiredBytes} available bytes`));
-    }
-    if (!target.atomicRenameSupported)
-        blockers.push(issue("atomic_rename_unsupported", "target filesystem rename semantics are not verified"));
-    const links = inspectManifestLinks(manifest);
-    warnings.push(...links.warnings);
-    blockers.push(...links.blockers);
-    const applyAllowed = blockers.length === 0;
-    const status = !applyAllowed ? "blocked" : warnings.length > 0 ? "warnings" : "safe";
-    const exitCode = status === "safe" ? 0 : status === "warnings" ? 2 : 3;
-    return Object.freeze({
-        status,
-        exitCode,
-        applyAllowed,
-        environment,
-        workspaceId: input.workspaceId.toLowerCase(),
-        profile: input.profile,
-        manifest,
-        manifestDigest: storageManifestDigest(manifest),
-        target,
-        warnings: Object.freeze(warnings),
-        blockers: Object.freeze(blockers),
-    });
-}

package/dist/storage-identity.js

@@ -1,29 +0,0 @@
-import { createHash } from "node:crypto";
-import { STORAGE_LAYOUT_VERSION } from "./storage-layout.js";
-function fingerprint(namespace, value) {
-    return `sha256:${createHash("sha256").update(`${namespace}\0${value}`).digest("hex")}`;
-}
-export function storageIdFingerprint(storageId) {
-    return fingerprint("storage", storageId);
-}
-export function storageHelloIdentity(input) {
-    const { installation, layout } = input;
-    if (installation.environment !== layout.environment
-        || installation.workspaceId !== layout.workspaceId
-        || installation.nowworkHome !== layout.persistentRoot
-        || installation.runtimeRoot !== layout.runtimeRoot) {
-        throw new Error("installation storage identity does not match resolved layout");
-    }
-    return Object.freeze({
-        storageLayoutVersion: STORAGE_LAYOUT_VERSION,
-        storageEnvironment: layout.environment,
-        storageWorkspaceId: layout.workspaceId,
-        storageIdFingerprint: storageIdFingerprint(installation.storageId),
-        workspaceRootFingerprint: fingerprint("workspace-root", layout.workspaceRoot),
-        daemonRootFingerprint: fingerprint("daemon-root", layout.daemonRoot),
-        agentRootFingerprint: fingerprint("agent-root", layout.agentItemsRoot),
-        ...(installation.storageMigrationId === undefined
-            ? {}
-            : { storageMigrationId: installation.storageMigrationId }),
-    });
-}