@pasko70/pibo 1.16.6 → 2.0.0

package/dist/agent-runtime/resource-files.js

@@ -0,0 +1,87 @@
+import { createHash } from "node:crypto";
+import { chmod, copyFile, lstat, mkdir, readdir, realpath, } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, relative, sep } from "node:path";
+function safeSegment(value) {
+    const normalized = value.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 96) || "resource";
+    const hash = createHash("sha256").update(value).digest("hex").slice(0, 10);
+    return `${normalized}-${hash}`;
+}
+function isInside(root, candidate) {
+    const child = relative(root, candidate);
+    return child === "" || (!child.startsWith(`..${sep}`) && child !== ".." && !isAbsolute(child));
+}
+async function ensurePrivateDirectory(path) {
+    await mkdir(path, { recursive: true, mode: 0o700 });
+    await chmod(path, 0o700);
+}
+export async function createAgentRuntimeResourcePaths(rootDir, input) {
+    const root = join(rootDir, safeSegment(input.runtimeInstanceId), safeSegment(input.piboSessionId), safeSegment(input.sessionGeneration));
+    const paths = {
+        root,
+        home: join(root, "home"),
+        skills: join(root, "skills"),
+        context: join(root, "context"),
+        config: join(root, "config"),
+        protocol: join(root, "protocol"),
+    };
+    for (const path of Object.values(paths))
+        await ensurePrivateDirectory(path);
+    return paths;
+}
+async function copySkillEntry(source, destination, sourceRoot, budget) {
+    const metadata = await lstat(source);
+    if (metadata.isSymbolicLink()) {
+        const target = await realpath(source);
+        if (!isInside(sourceRoot, target))
+            throw new Error(`Skill symlink escapes its source directory: ${source}`);
+        await copySkillEntry(target, destination, sourceRoot, budget);
+        return;
+    }
+    if (metadata.isDirectory()) {
+        const canonical = await realpath(source);
+        if (budget.activeDirectories.has(canonical))
+            throw new Error(`Skill directory contains a symlink cycle: ${source}`);
+        budget.activeDirectories.add(canonical);
+        try {
+            await mkdir(destination, { recursive: true, mode: metadata.mode & 0o777 });
+            for (const entry of await readdir(source)) {
+                await copySkillEntry(join(source, entry), join(destination, entry), sourceRoot, budget);
+            }
+        }
+        finally {
+            budget.activeDirectories.delete(canonical);
+        }
+        return;
+    }
+    if (!metadata.isFile())
+        throw new Error(`Skill resource is not a regular file: ${source}`);
+    budget.files += 1;
+    budget.bytes += metadata.size;
+    if (budget.files > budget.maxFiles)
+        throw new Error(`Skill exceeds the ${budget.maxFiles}-file materialization limit.`);
+    if (budget.bytes > budget.maxBytes)
+        throw new Error(`Skill exceeds the ${budget.maxBytes}-byte materialization limit.`);
+    await mkdir(dirname(destination), { recursive: true, mode: 0o700 });
+    await copyFile(source, destination);
+    await chmod(destination, metadata.mode & 0o777);
+}
+export async function copyAgentRuntimeSkillDirectory(skill, destinationRoot, limits) {
+    const sourceFile = await realpath(skill.sourcePath);
+    const sourceRoot = basename(sourceFile).toUpperCase() === "SKILL.MD" ? await realpath(dirname(sourceFile)) : dirname(sourceFile);
+    const destination = join(destinationRoot, safeSegment(skill.name));
+    const budget = {
+        files: 0,
+        bytes: 0,
+        maxFiles: limits.maxFiles,
+        maxBytes: limits.maxBytes,
+        activeDirectories: new Set(),
+    };
+    if (basename(sourceFile).toUpperCase() === "SKILL.MD") {
+        await copySkillEntry(sourceRoot, destination, sourceRoot, budget);
+        return join(destination, relative(sourceRoot, sourceFile));
+    }
+    await ensurePrivateDirectory(destination);
+    const target = join(destination, "SKILL.md");
+    await copySkillEntry(sourceFile, target, sourceRoot, budget);
+    return target;
+}