@ouro.bot/cli 0.1.0-alpha.806 → 0.1.0-alpha.808

package/dist/mind/session-transaction.js

@@ -91,7 +91,90 @@ function isSqliteBusy(error) {
     return error instanceof Error && "code" in error
         && error.code === "SQLITE_BUSY";
 }
-function openLeaseDatabase(lockPath, busyTimeoutMs = 0) {
+function refuseConfinement() {
+    (0, runtime_1.emitNervesEvent)({
+        level: "warn", component: "mind", event: "mind.session_confinement_refused",
+        message: "session confinement is invalid or changed", meta: { action: "refused" },
+    });
+    throw new SessionTransactionError("session confinement is invalid or changed");
+}
+function confinedFile(filePath) {
+    let stat;
+    try {
+        stat = fs.lstatSync(filePath);
+    }
+    catch (error) {
+        if (error?.code === "ENOENT")
+            return null;
+        return refuseConfinement();
+    }
+    if (!stat.isFile() || stat.isSymbolicLink())
+        return refuseConfinement();
+    return stat;
+}
+function checkConfinement(pin) {
+    if (!pin)
+        return;
+    for (const directory of pin.directories) {
+        let stat;
+        try {
+            stat = fs.lstatSync(directory.path);
+        }
+        catch {
+            return refuseConfinement();
+        }
+        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.dev !== directory.dev || stat.ino !== directory.ino)
+            return refuseConfinement();
+    }
+    for (const suffix of ["", ".turn.lock", ".turn.lock-journal", ".turn.lock-wal", ".turn.lock-shm"]) {
+        confinedFile(`${pin.sessionPath}${suffix}`);
+    }
+}
+function pinConfinement(sessionPath, root) {
+    if (root === undefined)
+        return null;
+    if (typeof root !== "string" || !path.isAbsolute(root) || path.resolve(root) !== root)
+        return refuseConfinement();
+    const relative = path.relative(root, sessionPath);
+    if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+        return refuseConfinement();
+    const parent = path.dirname(sessionPath);
+    const volumeRoot = path.parse(parent).root;
+    let current = volumeRoot;
+    const paths = [current];
+    for (const segment of parent.slice(volumeRoot.length).split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        paths.push(current);
+    }
+    const directories = paths.map((directory) => {
+        let stat;
+        try {
+            stat = fs.lstatSync(directory);
+        }
+        catch {
+            return refuseConfinement();
+        }
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            return refuseConfinement();
+        return { path: directory, dev: stat.dev, ino: stat.ino };
+    });
+    const pin = { root, sessionPath, directories };
+    checkConfinement(pin);
+    return pin;
+}
+function retainConfinement(held, requestedRoot) {
+    if (requestedRoot !== undefined && requestedRoot !== held.confinement?.root)
+        return refuseConfinement();
+    checkConfinement(held.confinement);
+}
+function checkTemporary(pin, filePath, identity) {
+    checkConfinement(pin);
+    const current = confinedFile(filePath);
+    if (!current || !identity || current.dev !== identity.dev || current.ino !== identity.ino)
+        return refuseConfinement();
+}
+function openLeaseDatabase(lockPath, busyTimeoutMs = 0, confinement = null) {
+    checkConfinement(confinement);
     const database = new better_sqlite3_1.default(lockPath);
     database.pragma(`busy_timeout = ${busyTimeoutMs}`);
     database.exec(`
@@ -123,14 +206,15 @@ function acquisitionRecord(options) {
         processStartedAt,
     };
 }
-function claimLeaseRecord(lockPath, record, isProcessAlive, getProcessStartedAt) {
-    const database = openLeaseDatabase(lockPath);
+function claimLeaseRecord(lockPath, record, isProcessAlive, getProcessStartedAt, confinement) {
+    const database = openLeaseDatabase(lockPath, 0, confinement);
     try {
         return database.transaction(() => {
             const current = database.prepare(`
         SELECT pid, owner_id, owner_token, boot_identity, process_started_at FROM session_turn_lease WHERE singleton = 1
       `).get();
             if (!current) {
+                checkConfinement(confinement);
                 database.prepare(`
           INSERT INTO session_turn_lease (singleton, pid, owner_id, owner_token, boot_identity, process_started_at) VALUES (1, ?, ?, ?, ?, ?)
         `).run(record.pid, record.ownerId, record.ownerToken, record.bootIdentity, record.processStartedAt);
@@ -161,6 +245,7 @@ function claimLeaseRecord(lockPath, record, isProcessAlive, getProcessStartedAt)
             }
             if (!differentBoot && !differentProcess && isProcessAlive(observed.pid))
                 return { acquired: false, stale: null };
+            checkConfinement(confinement);
             const changed = database.prepare(`
         UPDATE session_turn_lease SET pid = ?, owner_id = ?, owner_token = ?, boot_identity = ?, process_started_at = ?
         WHERE singleton = 1 AND pid = ? AND owner_id = ? AND owner_token = ?
@@ -174,7 +259,7 @@ function claimLeaseRecord(lockPath, record, isProcessAlive, getProcessStartedAt)
     }
 }
 function releaseLeaseRecord(lockPath, record) {
-    const database = openLeaseDatabase(lockPath, 5_000);
+    const database = openLeaseDatabase(lockPath, 5_000, record.confinement);
     try {
         return database.prepare(`
       DELETE FROM session_turn_lease WHERE singleton = 1 AND pid = ? AND owner_id = ? AND owner_token = ?
@@ -187,27 +272,42 @@ function releaseLeaseRecord(lockPath, record) {
 }
 function makeLease(held) {
     let localReleased = false;
-    return {
-        sessionPath: held.sessionPath,
-        ownerId: held.ownerId,
-        ownerToken: held.ownerToken,
-        release: async () => {
-            if (localReleased)
-                return;
-            localReleased = true;
-            held.depth -= 1;
-            if (held.depth > 0 || held.released)
-                return;
-            held.released = true;
+    const release = () => {
+        if (localReleased)
+            return;
+        localReleased = true;
+        held.depth -= 1;
+        if (held.depth > 0 || held.released)
+            return;
+        held.released = true;
+        try {
             releaseLeaseRecord(held.lockPath, held);
-            heldLeases.delete(held.sessionPath);
+        }
+        catch (error) {
             (0, runtime_1.emitNervesEvent)({
-                component: "mind",
-                event: "mind.session_turn_lease_released",
-                message: "released session turn lease",
+                level: "warn", component: "mind", event: "mind.session_turn_lease_release_failed",
+                message: "durable lease release failed; original recovery evidence retained",
                 meta: { sessionPath: held.sessionPath, ownerId: held.ownerId },
             });
+            throw error;
+        }
+        finally {
+            if (heldLeases.get(held.sessionPath) === held)
+                heldLeases.delete(held.sessionPath);
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "mind",
+            event: "mind.session_turn_lease_released",
+            message: "released session turn lease",
+            meta: { sessionPath: held.sessionPath, ownerId: held.ownerId },
+        });
+    };
+    return {
+        lease: {
+            sessionPath: held.sessionPath, ownerId: held.ownerId, ownerToken: held.ownerToken,
+            release: async () => release(),
         },
+        release,
     };
 }
 async function acquireSessionTurnLease(sessionPath, options = {}) {
@@ -215,10 +315,12 @@ async function acquireSessionTurnLease(sessionPath, options = {}) {
     const existing = heldLeases.get(canonical);
     if (existing && !existing.released) {
         if (options.ownerId === existing.ownerId && options.ownerToken === existing.ownerToken) {
+            retainConfinement(existing, options.confinementRoot);
             existing.depth += 1;
-            return makeLease(existing);
+            return makeLease(existing).lease;
         }
     }
+    const confinement = pinConfinement(canonical, options.confinementRoot);
     const record = acquisitionRecord(options);
     const { ownerId } = record;
     const timeoutMs = options.timeoutMs ?? 5_000;
@@ -226,18 +328,19 @@ async function acquireSessionTurnLease(sessionPath, options = {}) {
     const isProcessAlive = options.isProcessAlive ?? processAlive;
     const lockPath = `${canonical}.turn.lock`;
     const started = Date.now();
+    checkConfinement(confinement);
     fs.mkdirSync(path.dirname(canonical), { recursive: true });
     for (;;) {
         let claim = null;
         try {
-            claim = claimLeaseRecord(lockPath, record, isProcessAlive, options.getProcessStartedAt ?? habit_lifecycle_1.probeHabitProcessStartedAt);
+            claim = claimLeaseRecord(lockPath, record, isProcessAlive, options.getProcessStartedAt ?? habit_lifecycle_1.probeHabitProcessStartedAt, confinement);
         }
         catch (error) {
             if (!isSqliteBusy(error))
                 throw error;
         }
         if (claim?.acquired) {
-            const held = { sessionPath: canonical, lockPath, ...record, depth: 1, released: false };
+            const held = { sessionPath: canonical, lockPath, ...record, depth: 1, released: false, confinement };
             heldLeases.set(canonical, held);
             (0, runtime_1.emitNervesEvent)({
                 component: "mind",
@@ -255,7 +358,7 @@ async function acquireSessionTurnLease(sessionPath, options = {}) {
                     meta: { sessionPath: canonical, stalePid: claim.stale.pid, staleOwnerId: claim.stale.ownerId },
                 });
             }
-            return makeLease(held);
+            return makeLease(held).lease;
         }
         if (Date.now() - started >= timeoutMs) {
             (0, runtime_1.emitNervesEvent)({
@@ -272,25 +375,43 @@ async function acquireSessionTurnLease(sessionPath, options = {}) {
 }
 async function withSessionTurnLease(sessionPath, work, options = {}) {
     const lease = await acquireSessionTurnLease(sessionPath, options);
+    let failed = false;
     try {
         return await leaseContext.run(lease, () => work(lease));
     }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
     finally {
-        await lease.release();
+        try {
+            await lease.release();
+        }
+        catch (error) {
+            if (!failed)
+                throw error;
+        }
     }
 }
 function withImmediateSessionTurnLease(sessionPath, work, options = {}) {
     const canonical = canonicalSessionPath(sessionPath);
     const contextual = currentSessionTurnLease(canonical);
-    if (contextual)
+    if (contextual) {
+        const held = heldLeases.get(canonical);
+        if (!held || held.released)
+            throw new SessionTransactionError("session lease owner token mismatch");
+        retainConfinement(held, options.confinementRoot);
         return work(contextual);
+    }
+    const confinement = pinConfinement(canonical, options.confinementRoot);
     const record = acquisitionRecord(options);
     const lockPath = `${canonical}.turn.lock`;
+    checkConfinement(confinement);
     fs.mkdirSync(path.dirname(canonical), { recursive: true });
     const tryAcquire = () => {
         let claim;
         try {
-            claim = claimLeaseRecord(lockPath, record, options.isProcessAlive ?? processAlive, options.getProcessStartedAt ?? habit_lifecycle_1.probeHabitProcessStartedAt);
+            claim = claimLeaseRecord(lockPath, record, options.isProcessAlive ?? processAlive, options.getProcessStartedAt ?? habit_lifecycle_1.probeHabitProcessStartedAt, confinement);
         }
         catch (error) {
             if (isSqliteBusy(error))
@@ -298,7 +419,7 @@ function withImmediateSessionTurnLease(sessionPath, work, options = {}) {
             throw error;
         }
         if (claim.acquired) {
-            const held = { sessionPath: canonical, lockPath, ...record, depth: 1, released: false };
+            const held = { sessionPath: canonical, lockPath, ...record, depth: 1, released: false, confinement };
             heldLeases.set(canonical, held);
             if (claim.stale) {
                 options.onStaleLease?.(claim.stale);
@@ -317,12 +438,23 @@ function withImmediateSessionTurnLease(sessionPath, work, options = {}) {
     const held = tryAcquire();
     if (!held)
         throw new SessionTurnBusyError(`session turn busy: ${canonical}`);
-    const lease = makeLease(held);
+    const { lease, release } = makeLease(held);
+    let failed = false;
     try {
         return leaseContext.run(lease, () => work(lease));
     }
+    catch (error) {
+        failed = true;
+        throw error;
+    }
     finally {
-        void lease.release();
+        try {
+            release();
+        }
+        catch (error) {
+            if (!failed)
+                throw error;
+        }
     }
 }
 function currentSessionTurnLease(sessionPath) {
@@ -337,6 +469,7 @@ function assertSessionTurnLease(sessionPath, lease) {
     if (!held || held.released || held.ownerId !== lease.ownerId || held.ownerToken !== lease.ownerToken) {
         throw new SessionTransactionError("session lease owner token mismatch");
     }
+    checkConfinement(held.confinement);
 }
 function readSessionTransaction(sessionPath, lease) {
     assertSessionTurnLease(sessionPath, lease);
@@ -353,6 +486,7 @@ function readSessionTransaction(sessionPath, lease) {
 function writeSessionTransaction(sessionPath, value, options) {
     assertSessionTurnLease(sessionPath, options.lease);
     const canonical = canonicalSessionPath(sessionPath);
+    const confinement = heldLeases.get(canonical).confinement;
     const current = readSessionTransaction(canonical, options.lease);
     if (current.revision !== options.expectedRevision)
         throw new SessionTransactionError("session revision changed");
@@ -360,14 +494,20 @@ function writeSessionTransaction(sessionPath, value, options) {
     const bytes = JSON.stringify(value, null, 2);
     const tempPath = path.join(path.dirname(canonical), `.${path.basename(canonical)}.tmp-${process.pid}-${(0, node_crypto_1.randomUUID)()}`);
     let fd = null;
+    let temporaryIdentity = null;
     try {
         fd = fs.openSync(tempPath, "wx", 0o600);
+        if (confinement)
+            temporaryIdentity = fs.fstatSync(fd);
         fs.writeFileSync(fd, bytes, "utf8");
         fs.fsyncSync(fd);
         fs.closeSync(fd);
         fd = null;
         options.hooks?.beforeRename?.();
+        if (confinement)
+            checkTemporary(confinement, tempPath, temporaryIdentity);
         fs.renameSync(tempPath, canonical);
+        checkConfinement(confinement);
         const directoryFd = fs.openSync(path.dirname(canonical), "r");
         try {
             fs.fsyncSync(directoryFd);
@@ -384,9 +524,18 @@ function writeSessionTransaction(sessionPath, value, options) {
             }
             catch { /* best effort */ }
         try {
+            if (confinement)
+                checkTemporary(confinement, tempPath, temporaryIdentity);
             fs.unlinkSync(tempPath);
         }
-        catch { /* best effort */ }
+        catch {
+            if (confinement)
+                (0, runtime_1.emitNervesEvent)({
+                    level: "warn", component: "mind", event: "mind.session_transaction_cleanup_refused",
+                    message: "temporary cleanup unavailable; original evidence retained",
+                    meta: { sessionPath: canonical },
+                });
+        }
         throw error;
     }
     (0, runtime_1.emitNervesEvent)({

package/dist/senses/shared-turn.js

@@ -253,7 +253,7 @@ function causalSessionEventIds(view, attempts, finalAttemptIndex, finalCoordinat
 function currentIngressEventId(events, existingEventIds, userMessage, precommittedIngress, ingressRelations) {
     const reference = ingressRelations?.references[0];
     const carriesReference = (event, expected) => Array.isArray(event.relations?.references) && event.relations.references.includes(expected);
-    const matches = events.filter((event) => (event.role === "user"
+    const matches = (0, session_events_1.selectEffectiveSessionEvents)(events).filter((event) => (event.role === "user"
         && event.content === userMessage
         && event.provenance?.captureKind === "live"
         && (precommittedIngress
@@ -273,6 +273,7 @@ function exactProjectedIngressMessage(existing, messages, eventId) {
     if (eventsById.size !== existing.events.length)
         return null;
     const seenProjectionIds = new Set();
+    const effectiveIds = new Set((0, session_events_1.selectEffectiveSessionEvents)(existing.events).map((event) => event.id));
     const projectedEvents = [];
     for (const projectedId of existing.projectionEventIds) {
         if (typeof projectedId !== "string" || !projectedId.trim() || seenProjectionIds.has(projectedId))
@@ -281,7 +282,8 @@ function exactProjectedIngressMessage(existing, messages, eventId) {
         if (!event)
             return null;
         seenProjectionIds.add(projectedId);
-        projectedEvents.push(event);
+        if (effectiveIds.has(event.id))
+            projectedEvents.push(event);
     }
     if (existing.projectionEventIds.filter((projectedId) => projectedId === eventId).length !== 1)
         return null;
@@ -404,7 +406,7 @@ async function runSenseTurnExclusive(options) {
                 ? existing?.events?.find((candidate) => candidate.id === options.precommittedIngress.eventId)
                 : undefined;
             if (options.precommittedIngress) {
-                const latestUserEvent = existing?.events?.filter((candidate) => candidate.role === "user").at(-1);
+                const latestUserEvent = (0, session_events_1.selectEffectiveSessionEvents)(existing?.events ?? []).filter((candidate) => candidate.role === "user").at(-1);
                 if (!precommittedIngressEvent || precommittedIngressEvent !== latestUserEvent || precommittedIngressEvent.role !== "user" || precommittedIngressEvent.content !== userMessage
                     || !precommittedIngressEvent.relations.references.includes(options.precommittedIngress.reference)) {
                     throw new Error("shared turn precommitted ingress is missing, mismatched, or no longer current");