@nurix/nustack 0.10.0-dev.10

package/dist/lib/package_manager.js

@@ -0,0 +1,23 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { assertSafePackageName } from "./guards.js";
+export function detectPackageManager(cwd) {
+    if (existsSync(path.join(cwd, "pnpm-lock.yaml")))
+        return "pnpm";
+    if (existsSync(path.join(cwd, "yarn.lock")))
+        return "yarn";
+    return "npm";
+}
+export async function installPackage(manager, packageName, cwd) {
+    const safeName = assertSafePackageName(packageName);
+    const verb = manager === "npm" ? "install" : "add";
+    const args = [verb, "--", safeName];
+    return new Promise((resolve, reject) => {
+        const child = spawn(manager, args, { cwd, stdio: "inherit" });
+        child.on("error", reject);
+        child.on("exit", (code) => code === 0
+            ? resolve()
+            : reject(new Error(`${manager} ${args.join(" ")} exited with code ${code}`)));
+    });
+}

package/dist/lib/review/client.js

@@ -0,0 +1,66 @@
+const REQUEST_TIMEOUT_MS = 10_000;
+export class ReviewUnreachableError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ReviewUnreachableError";
+    }
+}
+function errorMessage(payload, status, label) {
+    const enveloped = typeof payload?.error === "object" ? payload.error?.message : undefined;
+    return enveloped ?? `${label}: HTTP ${status}`;
+}
+export function makeReviewClient(baseUrl, accessToken) {
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+    };
+    async function call(path, init, label) {
+        let response;
+        try {
+            response = await globalThis.fetch(`${baseUrl}${path}`, {
+                ...init,
+                headers,
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+        }
+        catch (error) {
+            throw new ReviewUnreachableError(error instanceof Error ? error.message : String(error));
+        }
+        const payload = (await response.json().catch(() => null));
+        if (!response.ok) {
+            if (response.status === 401 || response.status === 403) {
+                throw new ReviewUnreachableError(errorMessage(payload, response.status, label));
+            }
+            throw new Error(errorMessage(payload, response.status, label));
+        }
+        return payload?.data ?? null;
+    }
+    return {
+        async createReviewItem(input) {
+            const data = await call("/api/v2/review", {
+                method: "POST",
+                body: JSON.stringify({
+                    kind: "blocking_approval",
+                    workspaceId: input.workspaceId,
+                    sessionId: input.sessionId,
+                    subject: input.subject,
+                    ...(input.answerableByUserId ? { answerableByUserId: input.answerableByUserId } : {}),
+                    ...(input.answer ? { answer: input.answer } : {}),
+                }),
+            }, "review mirror");
+            return data;
+        },
+        async answerReviewItem(id, verdict) {
+            const data = await call(`/api/v2/review/${encodeURIComponent(id)}/answer`, { method: "POST", body: JSON.stringify({ verdict }) }, "review answer");
+            return data;
+        },
+        async readDecisions(commit, repositoryUrl) {
+            const query = new URLSearchParams({ commit });
+            if (repositoryUrl)
+                query.set("repositoryUrl", repositoryUrl);
+            const data = await call(`/api/v2/review/decisions?${query.toString()}`, { method: "GET" }, "review check");
+            const items = data?.items;
+            return Array.isArray(items) ? items : [];
+        },
+    };
+}

package/dist/lib/schema_validator.js

@@ -0,0 +1,24 @@
+import { readFile } from "node:fs/promises";
+import { Ajv } from "ajv";
+import addFormatsImport from "ajv-formats";
+const addFormats = addFormatsImport;
+export async function loadSchema(override) {
+    if (override?.startsWith("http://") || override?.startsWith("https://")) {
+        const response = await fetch(override, { signal: AbortSignal.timeout(10_000) });
+        if (!response.ok)
+            throw new Error(`schema fetch failed: HTTP ${response.status}`);
+        return (await response.json());
+    }
+    const schemaUrl = override
+        ? new URL(override, `file://${process.cwd()}/`)
+        : new URL("../spec_schema.json", import.meta.url);
+    return JSON.parse(await readFile(schemaUrl, "utf8"));
+}
+export function validateManifest(schema, manifest) {
+    const ajv = new Ajv({ allErrors: true, strict: false });
+    addFormats(ajv);
+    const validate = ajv.compile(schema);
+    const isValid = validate(manifest);
+    const errors = (validate.errors ?? []).map((error) => `${error.instancePath || "/"} ${error.message ?? "invalid"}`);
+    return { isValid, errors };
+}

package/dist/lib/secure_file.js

@@ -0,0 +1,10 @@
+import { chmod, mkdir, writeFile } from "node:fs/promises";
+const OWNER_ONLY_FILE = 0o600;
+const OWNER_ONLY_DIR = 0o700;
+export async function writeFileSecure(filePath, data) {
+    await writeFile(filePath, data, { encoding: "utf8", mode: OWNER_ONLY_FILE });
+    await chmod(filePath, OWNER_ONLY_FILE).catch(() => { });
+}
+export async function mkdirSecure(dirPath) {
+    await mkdir(dirPath, { recursive: true, mode: OWNER_ONLY_DIR });
+}

package/dist/lib/session_telemetry.js

@@ -0,0 +1,263 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readdir } from "node:fs/promises";
+import path from "node:path";
+import { ensureAccessToken } from "./auth_grant.js";
+import { fetchBrokeredCredential } from "./nustack_client.js";
+import { readLegacyDeviceRecord } from "./nustack_store.js";
+import { openLocalStore } from "./local_store/database.js";
+import { readDeviceState } from "./local_store/device_state.js";
+import { listActiveBindings } from "./local_store/bindings.js";
+import { listActivityBindings, readFilebeatState, upsertActivityBinding, upsertFilebeatState, } from "./local_store/filebeat_state.js";
+import { ensureFilebeatBinary, filebeatBinPath, filebeatDir, desiredFilebeatVersion, observedFilebeatVersion, probeServiceRegistered, registerAndStartService, restartService, testFilebeatConfig, } from "./filebeat_installer.js";
+import { renderBindingInput, renderCentralConfig, renderCodexSharedInput, } from "./telemetry/config_renderer.js";
+import { applyConfigChange, removeInputFile } from "./telemetry/reload.js";
+import { discoverProviderBindings } from "./telemetry/provider_paths.js";
+import { reportTelemetryHealth } from "./telemetry/health_report.js";
+const TELEMETRY_SERVICE = "elastic-observability";
+const DEFAULT_INDEX = "claude-sessions";
+const NO_OP_LOG = () => { };
+function defaultSeams() {
+    return {
+        ensureBinary: (log) => ensureFilebeatBinary(log),
+        reloadContext: (configDir) => ({
+            configDir,
+            testConfig: (ctx) => testFilebeatConfig(ctx),
+            restartService: () => ({ ok: true }),
+        }),
+        registerService: () => registerAndStartService(),
+        serviceRegistered: () => probeServiceRegistered(),
+        restartService: () => restartService(),
+        fetchImpl: fetch,
+        ensureAccessToken: (baseUrl) => ensureAccessToken(baseUrl),
+    };
+}
+function centralReloadContext(seams, configDir) {
+    const base = seams.reloadContext(configDir);
+    return { ...base, restartService: async () => ({ ok: await seams.restartService() }) };
+}
+function optedOutByEnv() {
+    return process.env.NUSTACK_TELEMETRY === "off";
+}
+function toTelemetryBinding(binding, deviceRef, userId) {
+    return {
+        bindingId: binding.id,
+        repoRoot: binding.repositoryRoot,
+        organizationId: binding.organizationId,
+        workspaceId: binding.workspaceId,
+        deviceRef,
+        userId,
+    };
+}
+function activityRowId(bindingId, provider, pathFingerprint) {
+    return `act_${createHash("sha256").update(`${bindingId}:${provider}:${pathFingerprint}`).digest("hex").slice(0, 24)}`;
+}
+async function resolveStore(injected) {
+    if (injected)
+        return { store: injected, close: () => { } };
+    const store = await openLocalStore();
+    return { store, close: () => store.close() };
+}
+export async function ensureDeviceTelemetry(opts) {
+    if (optedOutByEnv())
+        return;
+    const log = opts.log ?? NO_OP_LOG;
+    const seams = { ...defaultSeams(), ...opts.seams };
+    let handle = null;
+    try {
+        handle = await resolveStore(opts.store);
+        const { store } = handle;
+        const firstRun = readFilebeatState(store) === null;
+        let telemetryEnabled = true;
+        if (firstRun) {
+            const legacy = await readLegacyDeviceRecord();
+            if (legacy?.telemetry?.enabled === false)
+                telemetryEnabled = false;
+        }
+        else {
+            telemetryEnabled = readFilebeatState(store).telemetryEnabled;
+        }
+        await seams.ensureBinary(log);
+        const observed = observedFilebeatVersion();
+        upsertFilebeatState(store, {
+            binaryPath: existsSync(filebeatBinPath()) ? filebeatBinPath() : null,
+            configDir: filebeatDir(),
+            desiredVersion: desiredFilebeatVersion(),
+            observedVersion: observed,
+            telemetryEnabled,
+            lastErrorCode: "no_output_credential",
+        });
+        await reportBestEffort(opts.baseUrl, store, seams);
+    }
+    catch (error) {
+        recordDegraded(handle?.store, "device_bootstrap_failed");
+        log(`Telemetry bootstrap skipped (non-blocking): ${message(error)}`);
+    }
+    finally {
+        handle?.close();
+    }
+}
+export async function ensureBindingTelemetry(opts) {
+    if (optedOutByEnv())
+        return;
+    const seams = { ...defaultSeams(), ...opts.seams };
+    const { store, binding, baseUrl } = opts;
+    try {
+        const state = readFilebeatState(store);
+        if (state && !state.telemetryEnabled)
+            return;
+        const device = readDeviceState(store);
+        const deviceRef = device?.deviceRef ?? "";
+        const userId = device?.activeUserId ?? "";
+        const auth = await seams.ensureAccessToken(baseUrl);
+        if (!auth) {
+            recordDegraded(store, "no_device_token");
+            await reportBestEffort(baseUrl, store, seams, null);
+            return;
+        }
+        if (!binding.telemetryEnabled) {
+            await removeBindingTelemetry({ store, bindingId: binding.id, seams: opts.seams });
+            await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+            return;
+        }
+        let brokerFailure = null;
+        const credential = await fetchBrokeredCredential(baseUrl, auth.accessToken, {
+            workspaceId: binding.workspaceId,
+            service: TELEMETRY_SERVICE,
+        }).catch((error) => {
+            brokerFailure = error instanceof Error ? error.message : String(error);
+            return null;
+        });
+        if (!credential?.url) {
+            const unserved = brokerFailure !== null && brokerFailure.includes("does not serve");
+            recordDegraded(store, unserved ? "credential_plane_unserved" : "no_output_credential");
+            await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+            return;
+        }
+        const index = credential.meta?.index || DEFAULT_INDEX;
+        const central = {
+            relativePath: "filebeat.yml",
+            contents: renderCentralConfig({ elkUrl: credential.url, apiKey: credential.key, index }),
+        };
+        const centralApply = await applyConfigChange({
+            files: [central],
+            scope: "central",
+            context: centralReloadContext(seams, filebeatDir()),
+        });
+        if (!centralApply.ok) {
+            recordDegraded(store, centralApply.errorCode);
+            await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+            return;
+        }
+        if (!seams.serviceRegistered())
+            await seams.registerService();
+        const bindings = activeBindingSet(store, binding, deviceRef, userId);
+        const inputs = [
+            { relativePath: `inputs.d/${binding.id}.yml`, contents: renderBindingInput(toTelemetryBinding(binding, deviceRef, userId)) },
+            { relativePath: "inputs.d/codex-shared.yml", contents: renderCodexSharedInput(bindings) },
+        ];
+        await removeOrphanInputs(bindings);
+        const inputsApply = await applyConfigChange({
+            files: inputs,
+            scope: "inputs",
+            context: seams.reloadContext(filebeatDir()),
+        });
+        if (!inputsApply.ok) {
+            recordDegraded(store, inputsApply.errorCode);
+            await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+            return;
+        }
+        for (const discovered of discoverProviderBindings(binding.repositoryRoot)) {
+            upsertActivityBinding(store, {
+                id: activityRowId(binding.id, discovered.provider, discovered.pathFingerprint),
+                bindingId: binding.id,
+                provider: discovered.provider,
+                providerProjectPath: discovered.absolutePath,
+                pathFingerprint: discovered.pathFingerprint,
+                state: discovered.state,
+            });
+        }
+        upsertFilebeatState(store, {
+            binaryPath: existsSync(filebeatBinPath()) ? filebeatBinPath() : null,
+            configDir: filebeatDir(),
+            desiredVersion: desiredFilebeatVersion(),
+            observedVersion: observedFilebeatVersion(),
+            processState: "running",
+            lastErrorCode: null,
+        });
+        await reportBestEffort(baseUrl, store, seams, auth.accessToken);
+    }
+    catch (error) {
+        recordDegraded(store, "binding_reconcile_failed");
+        void message(error);
+    }
+}
+export async function removeBindingTelemetry(opts) {
+    const seams = { ...defaultSeams(), ...opts.seams };
+    const { store, bindingId } = opts;
+    try {
+        await removeInputFile(filebeatDir(), `inputs.d/${bindingId}.yml`);
+        const device = readDeviceState(store);
+        const remaining = listActiveBindings(store)
+            .filter((b) => b.id !== bindingId)
+            .map((b) => toTelemetryBinding(b, device?.deviceRef ?? "", device?.activeUserId ?? ""));
+        if (remaining.length === 0) {
+            await removeInputFile(filebeatDir(), "inputs.d/codex-shared.yml");
+        }
+        else {
+            await applyConfigChange({
+                files: [{ relativePath: "inputs.d/codex-shared.yml", contents: renderCodexSharedInput(remaining) }],
+                scope: "inputs",
+                context: seams.reloadContext(filebeatDir()),
+            });
+        }
+        for (const row of listActivityBindings(store, bindingId)) {
+            upsertActivityBinding(store, {
+                id: row.id,
+                bindingId: row.bindingId,
+                provider: row.provider,
+                providerProjectPath: row.providerProjectPath,
+                pathFingerprint: row.pathFingerprint,
+                state: "disabled",
+            });
+        }
+    }
+    catch {
+    }
+}
+function activeBindingSet(store, binding, deviceRef, userId) {
+    const byId = new Map();
+    for (const b of listActiveBindings(store)) {
+        if (b.telemetryEnabled)
+            byId.set(b.id, toTelemetryBinding(b, deviceRef, userId));
+    }
+    byId.set(binding.id, toTelemetryBinding(binding, deviceRef, userId));
+    return [...byId.values()];
+}
+async function removeOrphanInputs(bindings) {
+    const inputsDirPath = path.join(filebeatDir(), "inputs.d");
+    if (!existsSync(inputsDirPath))
+        return;
+    const keep = new Set(["codex-shared.yml", ...bindings.map((b) => `${b.bindingId}.yml`)]);
+    for (const name of await readdir(inputsDirPath)) {
+        if (name.endsWith(".yml") && !keep.has(name)) {
+            await removeInputFile(filebeatDir(), `inputs.d/${name}`);
+        }
+    }
+}
+function recordDegraded(store, errorCode) {
+    if (!store)
+        return;
+    try {
+        upsertFilebeatState(store, { lastErrorCode: errorCode });
+    }
+    catch {
+    }
+}
+async function reportBestEffort(baseUrl, store, seams, accessToken) {
+    const token = accessToken ?? (await seams.ensureAccessToken(baseUrl).catch(() => null))?.accessToken ?? null;
+    await reportTelemetryHealth({ baseUrl, store, accessToken: token, fetchImpl: seams.fetchImpl });
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/lib/sessions/client.js

@@ -0,0 +1,48 @@
+import { assertSafeOpaqueId } from "../guards.js";
+const REQUEST_TIMEOUT_MS = 10_000;
+function errorMessage(payload, status, label) {
+    const enveloped = typeof payload?.error === "object" ? payload.error?.message : undefined;
+    return enveloped ?? `${label}: HTTP ${status}`;
+}
+export function makeSessionsClient(baseUrl, accessToken) {
+    const headers = {
+        Authorization: `Bearer ${accessToken}`,
+        "Content-Type": "application/json",
+    };
+    async function post(path, body, label) {
+        const response = await globalThis.fetch(`${baseUrl}${path}`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify(body),
+            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+        });
+        const payload = (await response.json().catch(() => null));
+        if (!response.ok || !payload?.data?.id) {
+            throw new Error(errorMessage(payload, response.status, label));
+        }
+        return { status: response.status, session: payload.data };
+    }
+    return {
+        async createSession(workspaceId, input) {
+            const safeId = assertSafeOpaqueId("The Workspace id", workspaceId);
+            const answered = await post(`/api/v2/workspaces/${encodeURIComponent(safeId)}/sessions`, input, "session create failed");
+            return { created: answered.status === 201, session: answered.session };
+        },
+        async transitionSession(workspaceId, sessionId, to, patch = {}) {
+            const safeWorkspace = assertSafeOpaqueId("The Workspace id", workspaceId);
+            const safeSession = assertSafeOpaqueId("The session id", sessionId);
+            const answered = await post(`/api/v2/workspaces/${encodeURIComponent(safeWorkspace)}/sessions/${encodeURIComponent(safeSession)}/transition`, { to, ...patch }, "session transition failed");
+            return answered.session;
+        },
+        async setVendorSessionId(workspaceId, sessionId, vendorSessionId) {
+            return this.transitionSession(workspaceId, sessionId, "running", { vendorSessionId });
+        },
+    };
+}
+export function sessionsClientFromEnv(env = process.env) {
+    const baseUrl = env.NUSTACK_API_BASE_URL?.trim();
+    const token = env.NUSTACK_DEVICE_TOKEN?.trim();
+    if (!baseUrl || !token)
+        return null;
+    return makeSessionsClient(baseUrl.replace(/\/+$/, ""), token);
+}

package/dist/lib/sessions/outsideSessions.js

@@ -0,0 +1,54 @@
+export const STOPPED_GROWING_MS = 10 * 60 * 1000;
+function vendorOf(provider) {
+    if (provider === "claude_code")
+        return { vendor: "claude_code", renderer: "claude_transcript" };
+    if (provider === "codex")
+        return { vendor: "codex", renderer: "codex_transcript" };
+    return null;
+}
+const AT_REST = new Set(["done", "failed", "cancelled"]);
+export async function recordOutsideSessions(client, input) {
+    const now = input.now ?? Date.now;
+    const laneIds = new Set((input.laneSessionIds ?? []).filter((id) => Boolean(id)));
+    const report = { created: 0, finished: 0, skipped: 0, failed: 0 };
+    for (const transcript of input.transcripts) {
+        if (!transcript.workspaceId) {
+            report.skipped += 1;
+            continue;
+        }
+        const kinds = vendorOf(transcript.provider);
+        if (!kinds) {
+            report.skipped += 1;
+            continue;
+        }
+        const stale = now() - transcript.modifiedMs >= STOPPED_GROWING_MS;
+        const vendorSessionId = transcript.vendorSessionId?.trim() || null;
+        const isLane = vendorSessionId !== null && laneIds.has(vendorSessionId);
+        try {
+            const { created, session } = await client.createSession(transcript.workspaceId, {
+                id: transcript.sessionKey,
+                startedBy: "person",
+                substrate: "device",
+                mode: "synchronous",
+                origin: isLane ? "inside" : "outside",
+                vendor: kinds.vendor,
+                renderer: kinds.renderer,
+                status: stale ? "done" : "running",
+                ...(vendorSessionId ? { vendorSessionId } : {}),
+            });
+            if (created)
+                report.created += 1;
+            if (stale && !AT_REST.has(session.status)) {
+                await client.transitionSession(transcript.workspaceId, transcript.sessionKey, "done");
+                report.finished += 1;
+            }
+            else if (!created) {
+                report.skipped += 1;
+            }
+        }
+        catch {
+            report.failed += 1;
+        }
+    }
+    return report;
+}

package/dist/lib/sse_framing.js

@@ -0,0 +1,48 @@
+export function createSseParser() {
+    let buffer = "";
+    return {
+        push(chunk) {
+            buffer += chunk;
+            const blocks = [];
+            let split = buffer.indexOf("\n\n");
+            while (split !== -1) {
+                const block = parseBlock(buffer.slice(0, split));
+                buffer = buffer.slice(split + 2);
+                if (block)
+                    blocks.push(block);
+                split = buffer.indexOf("\n\n");
+            }
+            return blocks;
+        },
+        flush() {
+            const rest = buffer;
+            buffer = "";
+            if (rest.trim().length === 0)
+                return [];
+            const block = parseBlock(rest);
+            return block ? [block] : [];
+        },
+    };
+}
+function parseBlock(raw) {
+    let event = "message";
+    const data = [];
+    for (const line of raw.split("\n")) {
+        const cleaned = line.endsWith("\r") ? line.slice(0, -1) : line;
+        if (cleaned.startsWith(":"))
+            continue;
+        const colon = cleaned.indexOf(":");
+        if (colon === -1)
+            continue;
+        const field = cleaned.slice(0, colon);
+        const raw_value = cleaned.slice(colon + 1);
+        const value = raw_value.startsWith(" ") ? raw_value.slice(1) : raw_value;
+        if (field === "event")
+            event = value;
+        else if (field === "data")
+            data.push(value);
+    }
+    if (data.length === 0)
+        return null;
+    return { event, data: data.join("\n") };
+}