@passioncode-ai/fabric-agent-adapter 0.39.1 → 0.41.0

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_paths.py

@@ -0,0 +1,102 @@
+"""Where a service's things live (fabric-service/0.1): the services directory, a service's data, config, logs and run
+directories per OS, private directories and atomic writes. Part of the service kit (FAA-65, layer L3)."""
+from __future__ import annotations
+
+import os
+import sys
+import tempfile
+from pathlib import Path
+from typing import Dict
+
+import sys as _sys  # noqa: E402
+from pathlib import Path as _Path  # noqa: E402
+if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from any working directory (FAA-65)
+    _sys.path.insert(0, str(_Path(__file__).resolve().parent))
+from fabric_base import (
+    WINDOWS,
+    _require_id,
+)
+from fabric_platform import (
+    _win_protect,
+)
+
+
+def services_dir() -> Path:
+    """Descriptor directory: FABRIC_SERVICES_DIR, else the per-user OS location."""
+    override = os.environ.get("FABRIC_SERVICES_DIR")
+    if override:
+        return Path(override).expanduser()
+    home = Path.home()
+    if sys.platform == "darwin":
+        return home / "Library/Application Support/ai.passioncode.fabric/services"
+    if sys.platform == "win32":
+        # DEC-0032: LOCALAPPDATA, not APPDATA, so token files never roam with the profile.
+        return _local_app_data() / "passioncode-fabric" / "services"
+    base = os.environ.get("XDG_DATA_HOME") or str(home / ".local/share")
+    return Path(base) / "passioncode-fabric/services"
+
+
+def service_dirs(service_id: str) -> Dict[str, Path]:
+    """State lives outside code: data+config, logs and cache in per-user OS directories."""
+    _require_id(service_id)
+    home = Path.home()
+    if sys.platform == "darwin":
+        return {
+            "data": home / "Library/Application Support" / service_id,
+            "logs": home / "Library/Logs" / service_id,
+            "cache": home / "Library/Caches" / service_id,
+        }
+    if sys.platform == "win32":
+        data = _local_app_data() / service_id
+        return {"data": data, "logs": data / "Logs", "cache": data / "Cache"}
+    data = Path(os.environ.get("XDG_DATA_HOME") or home / ".local/share") / service_id
+    state = Path(os.environ.get("XDG_STATE_HOME") or home / ".local/state") / service_id
+    cache = Path(os.environ.get("XDG_CACHE_HOME") or home / ".cache") / service_id
+    return {"data": data, "logs": state / "logs", "cache": cache}
+
+
+def _read_at(fd: int, n: int, offset: int) -> bytes:
+    """`os.pread` where it exists; Windows has none, so seek and read (the descriptor's appends
+    still go to the end: O_APPEND moves to it before every write)."""
+    if hasattr(os, "pread"):
+        return os.pread(fd, n, offset)
+    os.lseek(fd, offset, os.SEEK_SET)
+    return os.read(fd, n)
+
+
+def _local_app_data() -> Path:
+    value = os.environ.get("LOCALAPPDATA")
+    return Path(value) if value else Path.home() / "AppData" / "Local"
+
+
+def ensure_private_dir(path: Path) -> Path:
+    path.mkdir(parents=True, exist_ok=True)
+    if WINDOWS:
+        _win_protect(path, folder=True)
+    else:
+        os.chmod(path, 0o700)
+    return path
+
+
+def atomic_write(path: Path, data: bytes, mode: int = 0o600) -> None:
+    """Temporary file in the same directory, fsync, rename: a reader never sees half a file."""
+    path.parent.mkdir(parents=True, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(prefix="." + path.name + ".", dir=str(path.parent))
+    try:
+        if WINDOWS:
+            # The file's ACL is its privacy (DEC-0032): set explicitly and protected — before the bytes go in — so
+            # it does not depend on what the folder hands down. A rename keeps it.
+            _win_protect(Path(tmp), folder=False)
+        with os.fdopen(fd, "wb") as handle:
+            handle.write(data)
+            handle.flush()
+            os.fsync(handle.fileno())
+        if not WINDOWS:
+            os.chmod(tmp, mode)
+        os.replace(tmp, path)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except FileNotFoundError:
+            pass
+        raise

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_platform.py

@@ -0,0 +1,338 @@
+"""Windows, where the kit needs it (DEC-0032): named pipes that hold one copy, protecting a file to its owner, and
+reading a file's ACL to refuse a token file others can read. On other systems the same names exist and do nothing
+or answer "absent". Part of the service kit (FAA-65, layer L3)."""
+from __future__ import annotations
+
+import os
+import re
+import stat
+from pathlib import Path
+from typing import Any, Callable, Dict, List, Optional, Tuple
+
+import sys as _sys  # noqa: E402
+from pathlib import Path as _Path  # noqa: E402
+if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from any working directory (FAA-65)
+    _sys.path.insert(0, str(_Path(__file__).resolve().parent))
+from fabric_base import (
+    ServiceError,
+    WINDOWS,
+)
+
+
+#: The trustees a token file may grant anything to besides the current user: LocalSystem and the
+#: Administrators group — the same trust as root reading a 0600 file on POSIX.
+WINDOWS_TRUSTED = ("S-1-5-18", "S-1-5-32-544")
+
+
+def token_file_problem(path: Path, file: Dict[str, Any], user: str) -> Optional[str]:
+    """windows_token_acl_problem as one sentence naming the file and the refusal, or None."""
+    problem = windows_token_acl_problem(file, user)
+    return None if problem is None else "Token file %s refused: %s." % (path, problem["message"])
+
+
+SYSTEM_SID = "S-1-5-18"
+
+
+ADMINISTRATORS_SID = "S-1-5-32-544"
+
+
+#: A string SID: revision 1, an identifier authority and up to 15 sub-authorities of 32 bits each.
+_SID_TEXT = re.compile(r"S-1-[0-9]{1,15}(?:-[0-9]{1,10}){0,15}", re.IGNORECASE | re.ASCII)
+
+
+def _sid(value: Any) -> Optional[str]:
+    """A readable SID in upper case (SIDs compare case-insensitively on their S), or None."""
+    if not isinstance(value, str) or not _SID_TEXT.fullmatch(value):
+        return None
+    return value.upper() if all(int(part) <= 0xFFFFFFFF for part in value.split("-")[3:]) else None
+
+
+def windows_token_acl_problem(file: Any, current_user_sid: Any) -> Optional[Dict[str, Any]]:
+    """service.md "Windows token files" (DEC-0032, DEC-0033, DEC-0057, FAC-SEM-079) on what a reader has read:
+    ``file`` is ``{isRegularFile, isReparsePoint, realPathInProfile, ownerSid, aces: [{type, sid, mask}]}``, the mask
+    the ACE's unsigned 32-bit access mask. The first refusal ``{problem, at, sid?, message}``, or None when the file may
+    be read: a regular file, not a reparse point, inside the profile; owned by the user, SYSTEM or Administrators; every
+    allow ACE with a non-zero mask naming one of those three; deny ACEs ignored; any other ACE type refused; anything
+    unreadable refused. The contract's ``windowsTokenAclProblem``; a refusal names the SID, never the contents."""
+    def refuse(problem: str, at: str, message: str, sid: Optional[str] = None) -> Dict[str, Any]:
+        out = {"problem": problem, "at": at, "message": message}
+        if sid is not None:
+            out["sid"] = sid
+        return out
+    user = _sid(current_user_sid)
+    if user is None:
+        return refuse("unreadable", "/currentUserSid", "the current user's SID is unreadable")
+    if not isinstance(file, dict):
+        return refuse("unreadable", "/file", "the token file's metadata is unreadable")
+    for flag in ("isRegularFile", "isReparsePoint", "realPathInProfile"):
+        if not isinstance(file.get(flag), bool):
+            return refuse("unreadable", "/file/" + flag, flag + " is unreadable")
+    if file["isReparsePoint"]:
+        return refuse("reparse-point", "/file/isReparsePoint", "the token file is a reparse point (a symlink or a junction)")
+    if not file["isRegularFile"]:
+        return refuse("not-regular-file", "/file/isRegularFile", "the token file is not a regular file")
+    if not file["realPathInProfile"]:
+        return refuse("outside-profile", "/file/realPathInProfile", "the token file's real path lies outside the user's profile")
+    trusted = {user, SYSTEM_SID, ADMINISTRATORS_SID}
+    owner = _sid(file.get("ownerSid"))
+    if owner is None:
+        return refuse("unreadable", "/file/ownerSid", "the owner SID is unreadable")
+    if owner not in trusted:
+        return refuse("owner", "/file/ownerSid", "the token file is owned by %s, not by the current user, SYSTEM or Administrators" % owner, owner)
+    aces = file.get("aces")
+    if not isinstance(aces, list):
+        return refuse("unreadable", "/file/aces", "the ACL is unreadable")
+    for index, ace in enumerate(aces):
+        at = "/file/aces/%d" % index
+        if not isinstance(ace, dict):
+            return refuse("unreadable", at, "ACE %d is unreadable" % index)
+        if not isinstance(ace.get("type"), str):
+            return refuse("unreadable", at + "/type", "ACE %d has an unreadable type" % index)
+        trustee = _sid(ace.get("sid"))
+        if trustee is None:
+            return refuse("unreadable", at + "/sid", "ACE %d names an unreadable SID" % index)
+        mask = ace.get("mask")
+        if (not isinstance(mask, (int, float)) or isinstance(mask, bool) or (isinstance(mask, float) and not mask.is_integer())
+                or not 0 <= mask <= 0xFFFFFFFF):
+            return refuse("unreadable", at + "/mask", "ACE %d has an unreadable access mask" % index)
+        if ace["type"] == "deny":
+            continue
+        if ace["type"] != "allow":
+            return refuse("ace-type", at + "/type", "ACE %d for %s is of a type the rule does not read" % (index, trustee), trustee)
+        if mask == 0:
+            continue
+        if trustee not in trusted:
+            return refuse("ace-sid", at + "/sid", "the token file grants access to %s; only the current user, SYSTEM and Administrators may hold any" % trustee, trustee)
+    return None
+
+
+#: SDDL ACE types (MS-DTYP §2.5.1.1) as the rule's ACE type: allow and deny are read, every other type is refused.
+_SDDL_ACE_TYPES = {"A": "allow", "D": "deny", "OA": "allow-object", "OD": "deny-object", "XA": "allow-callback",
+                   "XD": "deny-callback", "ZA": "allow-object-callback"}
+
+
+#: SDDL access-right aliases (MS-DTYP §2.5.1.1, "ace_rights") and their masks.
+_SDDL_RIGHTS = {"GA": 0x10000000, "GR": 0x80000000, "GW": 0x40000000, "GX": 0x20000000, "RC": 0x20000, "SD": 0x10000,
+                "WD": 0x40000, "WO": 0x80000, "RP": 0x10, "WP": 0x20, "CC": 0x1, "DC": 0x2, "LC": 0x4, "SW": 0x8,
+                "LO": 0x80, "DT": 0x40, "CR": 0x100, "FA": 0x1F01FF, "FR": 0x120089, "FW": 0x120116, "FX": 0x1200A0,
+                "KA": 0xF003F, "KR": 0x20019, "KX": 0x20019, "KW": 0x20006}
+
+
+def _sddl_ace_strings(dacl: str) -> List[str]:
+    """The top-level parenthesized ACE strings of an SDDL DACL; a callback ACE's conditional expression may nest."""
+    aces, depth, start = [], 0, 0
+    for index, char in enumerate(dacl):
+        if char == "(":
+            if depth == 0:
+                start = index + 1
+            depth += 1
+        elif char == ")" and depth:
+            depth -= 1
+            if depth == 0:
+                aces.append(dacl[start:index])
+    return aces
+
+
+def _sddl_mask(rights: str) -> Optional[int]:
+    """An SDDL rights field as the unsigned 32-bit mask, or None when it cannot be read."""
+    if re.fullmatch(r"0[xX][0-9a-fA-F]{1,8}", rights):
+        return int(rights, 16)
+    if len(rights) % 2:
+        return None
+    mask = 0
+    for i in range(0, len(rights), 2):
+        if rights[i:i + 2] not in _SDDL_RIGHTS:
+            return None
+        mask |= _SDDL_RIGHTS[rights[i:i + 2]]
+    return mask
+
+
+def acl_from_sddl(sddl: str, canonical: Callable[[str], str] = lambda sid: sid) -> Tuple[str, List[Dict[str, Any]]]:
+    """(owner SID, the ACEs that apply to the object itself as ``{type, sid, mask}``) from an SDDL owner-and-DACL
+    string. ``canonical`` turns an SDDL alias (SY, BA, WD…) into its SID. A missing or NULL DACL grants everyone
+    everything and is read as an allow ACE for Everyone (S-1-1-0); an inherit-only ACE (flag IO) applies to children
+    only and is not read; an unreadable rights field gives mask None, which the rule refuses."""
+    owner = sddl.split("O:", 1)[1].split("G:", 1)[0].split("D:", 1)[0] if "O:" in sddl else ""
+    dacl = sddl.split("D:", 1)[1] if "D:" in sddl else ""
+    owner_sid = canonical(owner) if owner else ""
+    if not dacl or dacl.startswith("NO_ACCESS_CONTROL"):
+        return owner_sid, [{"type": "allow", "sid": "S-1-1-0", "mask": 0x1F01FF}]
+    aces = []
+    for text in _sddl_ace_strings(dacl):
+        fields = text.split(";", 6)
+        if len(fields) < 6:  # unreadable: the rule refuses it
+            aces.append({"type": None, "sid": None, "mask": None})
+            continue
+        kind, flags, rights, trustee = fields[0], fields[1], fields[2], fields[5]
+        if "IO" in [flags[i:i + 2] for i in range(0, len(flags), 2)]:
+            continue
+        aces.append({"type": _SDDL_ACE_TYPES.get(kind, kind), "sid": canonical(trustee), "mask": _sddl_mask(rights)})
+    return owner_sid, aces
+
+
+if WINDOWS:  # pragma: no cover - exercised by the Windows CI job
+    import ctypes
+    from ctypes import wintypes
+
+    _advapi32 = ctypes.WinDLL("advapi32", use_last_error=True)
+    _kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+    _PVOID = ctypes.c_void_p
+    _SE_FILE_OBJECT, _OWNER_INFO, _DACL_INFO, _PROTECTED_DACL = 1, 0x1, 0x4, 0x80000000
+    _REPARSE_POINT = 0x400
+    _advapi32.GetNamedSecurityInfoW.argtypes = [wintypes.LPCWSTR, ctypes.c_int, wintypes.DWORD] + [ctypes.POINTER(_PVOID)] * 5
+    _advapi32.GetNamedSecurityInfoW.restype = wintypes.DWORD
+    _advapi32.SetNamedSecurityInfoW.argtypes = [wintypes.LPWSTR, ctypes.c_int, wintypes.DWORD] + [_PVOID] * 4
+    _advapi32.SetNamedSecurityInfoW.restype = wintypes.DWORD
+    _advapi32.ConvertSecurityDescriptorToStringSecurityDescriptorW.argtypes = [
+        _PVOID, wintypes.DWORD, wintypes.DWORD, ctypes.POINTER(wintypes.LPWSTR), ctypes.POINTER(wintypes.ULONG)]
+    _advapi32.ConvertStringSecurityDescriptorToSecurityDescriptorW.argtypes = [
+        wintypes.LPCWSTR, wintypes.DWORD, ctypes.POINTER(_PVOID), ctypes.POINTER(wintypes.ULONG)]
+    _advapi32.GetSecurityDescriptorDacl.argtypes = [_PVOID, ctypes.POINTER(wintypes.BOOL), ctypes.POINTER(_PVOID),
+                                                    ctypes.POINTER(wintypes.BOOL)]
+    _advapi32.OpenProcessToken.argtypes = [wintypes.HANDLE, wintypes.DWORD, ctypes.POINTER(wintypes.HANDLE)]
+    _advapi32.GetTokenInformation.argtypes = [wintypes.HANDLE, ctypes.c_int, _PVOID, wintypes.DWORD,
+                                              ctypes.POINTER(wintypes.DWORD)]
+    _advapi32.ConvertSidToStringSidW.argtypes = [_PVOID, ctypes.POINTER(wintypes.LPWSTR)]
+    _advapi32.ConvertStringSidToSidW.argtypes = [wintypes.LPCWSTR, ctypes.POINTER(_PVOID)]
+    _kernel32.GetCurrentProcess.restype = wintypes.HANDLE
+    _kernel32.LocalFree.argtypes = [_PVOID]
+    _kernel32.CloseHandle.argtypes = [wintypes.HANDLE]
+    _CANONICAL: Dict[str, str] = {}
+
+    def _win_error(what: str, code: Optional[int] = None) -> OSError:
+        code = ctypes.get_last_error() if code is None else code
+        return OSError(code, "%s: %s" % (what, ctypes.FormatError(code).strip()))
+
+    def _sid_text(sid: Any) -> str:
+        text = wintypes.LPWSTR()
+        if not _advapi32.ConvertSidToStringSidW(sid, ctypes.byref(text)):
+            raise _win_error("ConvertSidToStringSidW")
+        try:
+            return text.value
+        finally:
+            _kernel32.LocalFree(text)
+
+    def _canonical_sid(trustee: str) -> str:
+        """SDDL writes well-known accounts by alias (SY, BA, LA, OW); compare SIDs."""
+        if trustee not in _CANONICAL:
+            sid = _PVOID()
+            if _advapi32.ConvertStringSidToSidW(trustee, ctypes.byref(sid)):
+                try:
+                    _CANONICAL[trustee] = _sid_text(sid)
+                finally:
+                    _kernel32.LocalFree(sid)
+            else:
+                _CANONICAL[trustee] = trustee
+        return _CANONICAL[trustee]
+
+    def windows_user_sid() -> str:
+        token = wintypes.HANDLE()
+        if not _advapi32.OpenProcessToken(_kernel32.GetCurrentProcess(), 0x8, ctypes.byref(token)):
+            raise _win_error("OpenProcessToken")
+        try:
+            size = wintypes.DWORD()
+            _advapi32.GetTokenInformation(token, 1, None, 0, ctypes.byref(size))
+            buf = ctypes.create_string_buffer(size.value)
+            if not _advapi32.GetTokenInformation(token, 1, buf, size, ctypes.byref(size)):
+                raise _win_error("GetTokenInformation")
+            return _sid_text(ctypes.cast(buf, ctypes.POINTER(_PVOID))[0])
+        finally:
+            _kernel32.CloseHandle(token)
+
+    def _sddl(path: Path) -> str:
+        sd = _PVOID()
+        refs = [_PVOID() for _ in range(4)]
+        code = _advapi32.GetNamedSecurityInfoW(str(path), _SE_FILE_OBJECT, _OWNER_INFO | _DACL_INFO,
+                                               *[ctypes.byref(r) for r in refs], ctypes.byref(sd))
+        if code:
+            raise _win_error("GetNamedSecurityInfoW", code)
+        try:
+            text = wintypes.LPWSTR()
+            if not _advapi32.ConvertSecurityDescriptorToStringSecurityDescriptorW(
+                    sd, 1, _OWNER_INFO | _DACL_INFO, ctypes.byref(text), None):
+                raise _win_error("ConvertSecurityDescriptorToStringSecurityDescriptorW")
+            try:
+                return text.value or ""
+            finally:
+                _kernel32.LocalFree(text)
+        finally:
+            _kernel32.LocalFree(sd)
+
+    def windows_acl(path: Path) -> Tuple[str, List[Dict[str, Any]]]:
+        """(owner SID, the ACEs on the object itself as ``{type, sid, mask}``), read from its SDDL (acl_from_sddl)."""
+        return acl_from_sddl(_sddl(path), _canonical_sid)
+
+    def _win_protect(path: Path, folder: bool) -> None:
+        """A protected list (inheritance off): this user, SYSTEM, Administrators, full control;
+        inherited by what a folder holds."""
+        inherit = "OICI" if folder else ""
+        sddl = "D:P" + "".join("(A;%s;FA;;;%s)" % (inherit, who) for who in (windows_user_sid(), "SY", "BA"))
+        sd = _PVOID()
+        if not _advapi32.ConvertStringSecurityDescriptorToSecurityDescriptorW(sddl, 1, ctypes.byref(sd), None):
+            raise _win_error("ConvertStringSecurityDescriptorToSecurityDescriptorW")
+        try:
+            present, defaulted, dacl = wintypes.BOOL(), wintypes.BOOL(), _PVOID()
+            if not _advapi32.GetSecurityDescriptorDacl(sd, ctypes.byref(present), ctypes.byref(dacl), ctypes.byref(defaulted)):
+                raise _win_error("GetSecurityDescriptorDacl")
+            code = _advapi32.SetNamedSecurityInfoW(str(path), _SE_FILE_OBJECT, _DACL_INFO | _PROTECTED_DACL,
+                                                   None, None, dacl, None)
+            if code:
+                raise _win_error("SetNamedSecurityInfoW", code)
+        finally:
+            _kernel32.LocalFree(sd)
+
+    _kernel32.CreateNamedPipeW.argtypes = [wintypes.LPCWSTR] + [wintypes.DWORD] * 6 + [_PVOID]
+    _kernel32.CreateNamedPipeW.restype = wintypes.HANDLE
+    _INVALID_HANDLE = wintypes.HANDLE(-1).value
+
+    def _create_first_pipe(name: str) -> Any:
+        """The pipe's first instance, or None when another process holds it (ERROR_ACCESS_DENIED)."""
+        # PIPE_ACCESS_INBOUND | FILE_FLAG_FIRST_PIPE_INSTANCE; PIPE_REJECT_REMOTE_CLIENTS; unlimited instances,
+        # as libuv creates them: then a second first-instance attempt, ours or the Node kit's, is refused with
+        # ERROR_ACCESS_DENIED (Node: EADDRINUSE), never ERROR_PIPE_BUSY.
+        handle = _kernel32.CreateNamedPipeW(name, 0x1 | 0x00080000, 0x8, 255, 0, 0, 0, None)
+        if handle == _INVALID_HANDLE:
+            code = ctypes.get_last_error()
+            if code in (5, 231):  # ERROR_ACCESS_DENIED, ERROR_PIPE_BUSY: another process holds it
+                return None
+            raise _win_error("CreateNamedPipeW", code)
+        return handle
+
+    def _close_handle(handle: Any) -> None:
+        _kernel32.CloseHandle(handle)
+
+    _kernel32.WaitNamedPipeW.argtypes = [wintypes.LPCWSTR, wintypes.DWORD]
+    _kernel32.WaitNamedPipeW.restype = wintypes.BOOL
+
+    def _pipe_exists(name: str) -> bool:
+        """Some process holds the pipe: waiting for it does not fail with ERROR_FILE_NOT_FOUND. Nothing connects."""
+        if _kernel32.WaitNamedPipeW(name, 1):
+            return True
+        return ctypes.get_last_error() != 2
+
+    def _win_token_problem(path: Path, info: os.stat_result) -> Optional[str]:
+        profile = os.path.normcase(os.path.realpath(os.environ.get("USERPROFILE") or str(Path.home())))
+        real = os.path.normcase(os.path.realpath(str(path)))
+        try:
+            inside = os.path.commonpath([profile, real]) == profile
+        except ValueError:  # another drive
+            inside = False
+        owner, aces = windows_acl(path)
+        file = {"isRegularFile": stat.S_ISREG(info.st_mode), "isReparsePoint": bool(getattr(info, "st_file_attributes", 0) & _REPARSE_POINT),
+                "realPathInProfile": inside, "ownerSid": owner, "aces": aces}
+        return token_file_problem(path, file, windows_user_sid())
+else:
+    def _create_first_pipe(name: str) -> Any:  # noqa: ARG001
+        raise ServiceError("named pipes exist only on Windows")
+
+    def _close_handle(handle: Any) -> None:  # noqa: ARG001
+        raise ServiceError("handles exist only on Windows")
+
+    def _pipe_exists(name: str) -> bool:  # noqa: ARG001
+        raise ServiceError("named pipes exist only on Windows")
+
+    def _win_protect(path: Path, folder: bool) -> None:  # noqa: ARG001 - POSIX uses modes
+        raise ServiceError("Windows ACLs exist only on Windows")
+
+    def _win_token_problem(path: Path, info: os.stat_result) -> Optional[str]:  # noqa: ARG001
+        raise ServiceError("Windows token rules apply only on Windows")

package/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_profiles.py

@@ -19,6 +19,10 @@ import shutil
 import subprocess
 from typing import Any, Callable, Dict, List, Optional, Sequence
 
+import sys as _sys  # noqa: E402
+from pathlib import Path as _Path  # noqa: E402
+if str(_Path(__file__).resolve().parent) not in _sys.path:  # the kit loads from any working directory (FAA-65)
+    _sys.path.insert(0, str(_Path(__file__).resolve().parent))
 import fabric_estate as _estate
 import fabric_identifiers as _ids
 import fabric_secrets as _secrets
@@ -32,34 +36,27 @@ MAX_PROBE_MS = 5000
 #: excludes nothing by it — and what a lane reads when it reads what a member, a client or the public sends.
 OPEN_VENDOR = "open-vendor"
 USER_CONTENT = "user-content"
-_BARE_BINARY = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*$")
+_BARE_BINARY = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*\Z")
 
 
 class ProfileError(ValueError):
     pass
 
 
-def _list(value: Any) -> List[Dict[str, Any]]:
-    return [item for item in value if isinstance(item, dict)] if isinstance(value, list) else []
+from fabric_jsvalue import objects as _list  # noqa: E402 - the core's (FAA-65)
+from fabric_jsvalue import json_equal as _json_equal  # noqa: E402 - the core's (FAA-65)
+from fabric_jsvalue import indexed_objects as _indexed  # noqa: E402 - the core's (FAA-65)
+import fabric_jsvalue as _jsv  # noqa: E402 - the core (FAA-65)
 
 
-_MISSING_KEY = _estate._MISSING
+_MISSING_KEY = _jsv.MISSING
 
 
 def _at(value: Any, key: str) -> Any:
     """value[key] as JavaScript reads a member: absent is distinct from null (``_MISSING_KEY``)."""
-    return _estate._get(value, key)
+    return _jsv.get(value, key)
 
 
-def _json_equal(a: Any, b: Any) -> bool:
-    """The contract's jsonEqual on parsed JSON: arrays by item, objects by member whatever the order, anything else by
-    ===, so 1 and true differ and NaN equals nothing."""
-    if isinstance(a, list) or isinstance(b, list):
-        return isinstance(a, list) and isinstance(b, list) and len(a) == len(b) and all(_json_equal(x, y) for x, y in zip(a, b))
-    if isinstance(a, dict) or isinstance(b, dict):
-        return (isinstance(a, dict) and isinstance(b, dict) and len(a) == len(b)
-                and all(k in b and _json_equal(v, b[k]) for k, v in a.items()))
-    return _estate._same(a, b)  # NaN != NaN in Python too
 
 
 def _without_nan(value: Any) -> Any:
@@ -71,10 +68,6 @@ def _without_nan(value: Any) -> Any:
     return None if isinstance(value, float) and not math.isfinite(value) else value
 
 
-def _indexed(value: Any) -> List[tuple]:
-    """The object items of an array with their index as written, so an instancePath names the item even after a
-    non-object (the contract's ``indexed``)."""
-    return [(item, i) for i, item in enumerate(value) if isinstance(item, dict)] if isinstance(value, list) else []
 
 
 def _set_key(value: Any) -> Any:
@@ -87,7 +80,7 @@ def _set_key(value: Any) -> Any:
     if isinstance(value, bool):
         return ("boolean", value)
     if isinstance(value, (int, float)):
-        return ("number", _estate._double(value))
+        return ("number", _jsv.double(value))
     if isinstance(value, str):
         return ("string", value)
     return ("object", id(value))
@@ -138,7 +131,7 @@ def _resolve(*, catalogue: Any = None, profiles: Any = None, choices: Any = None
         return {"from": level, "profile": profile_id, "models": within}
     meta = policy.get("meta") if isinstance(policy.get("meta"), dict) else {}
     return {"refused": "model-classes-empty", "profile": profile_id,
-            "policy": {"id": _estate._show(_at(meta, "id")), "revision": _estate._js_to_number(_at(meta, "revision"))}}
+            "policy": {"id": _jsv.show(_at(meta, "id")), "revision": _jsv.js_to_number(_at(meta, "revision"))}}
 
 
 def _finding(code: str, path: str, message: str) -> Dict[str, str]:
@@ -171,16 +164,16 @@ def _model_profiles(value: Dict[str, Any]) -> List[Dict[str, str]]:
 def _runner_profile(value: Dict[str, Any]) -> List[Dict[str, str]]:
     findings = []
     if value.get("route") == "subscription" and isinstance(value.get("subscription"), dict):
-        login = _estate._show(_at(value["subscription"], "login"))
+        login = _jsv.show(_at(value["subscription"], "login"))
         runner = SUBSCRIPTION_RUNNER.get(login, _MISSING_KEY)
-        if not _estate._same(runner, _at(value, "runnerKind")):
+        if not _jsv.same(runner, _at(value, "runnerKind")):
             findings.append(_finding("FAC-SEM-059", "/runnerKind", "a %s subscription runs only in %s, not in %s; another runner takes the key route"
-                                     % (login, runner if runner is not _MISSING_KEY else "its vendor's runner", _estate._show(_at(value, "runnerKind")))))
+                                     % (login, runner if runner is not _MISSING_KEY else "its vendor's runner", _jsv.show(_at(value, "runnerKind")))))
     if value.get("route") == "key" and isinstance(value.get("key"), dict):
         key = value["key"]
-        if not _estate._same(_at(key, "modelAllowList"), _at(value, "modelProfile")):
+        if not _jsv.same(_at(key, "modelAllowList"), _at(value, "modelProfile")):
             findings.append(_finding("FAC-SEM-059", "/key/modelAllowList", "the key admits the models of %s, but the profile runs %s"
-                                     % (_estate._show(_at(key, "modelAllowList")), _estate._show(_at(value, "modelProfile")))))
+                                     % (_jsv.show(_at(key, "modelAllowList")), _jsv.show(_at(value, "modelProfile")))))
         if isinstance(key.get("ref"), str) and _secrets.secret_value(key["ref"]):
             findings.append(_finding("FAC-SEM-059", "/key/ref", "the key is named by its secret reference, never by its value"))
     return findings
@@ -206,7 +199,7 @@ def _profile_resolution(value: Dict[str, Any]) -> List[Dict[str, str]]:
     choices = value.get("choices") if isinstance(value.get("choices"), dict) else {}
     expected = _resolve(catalogue=catalogue, profiles=value.get("profiles"), choices=choices, policy=value.get("policy"))
     if not _json_equal(_at(value, "resolved"), expected):
-        findings.append(_finding("FAC-SEM-060", "/resolved", "the resolution is %s" % _estate._json_stringify(_without_nan(expected))))
+        findings.append(_finding("FAC-SEM-060", "/resolved", "the resolution is %s" % _jsv.json_stringify(_without_nan(expected))))
     return findings
 
 
@@ -223,7 +216,7 @@ def closed_user_content_route(profile: Any, catalogue: Any) -> Optional[List[str
                 if isinstance(row.get("id"), str) and OPEN_VENDOR in _strings(row.get("classes"))}
     if any(isinstance(model, str) and model in open_ids for model in route):
         return None
-    return [_estate._show(model) for model in route]
+    return [_jsv.show(model) for model in route]
 
 
 def _closed_route(fallback: Any, closed: List[str]) -> str:
@@ -257,7 +250,7 @@ def _open_vendor_routes(value: Dict[str, Any]) -> List[Dict[str, str]]:
     policy = value.get("policy")
     meta = policy.get("meta") if isinstance(policy, dict) and isinstance(policy.get("meta"), dict) else {}
     findings.append(_finding("FAC-SEM-112", "/resolved/models", "the policy %s leaves profile %s's lane on closed vendors alone: of the "
-                             "models it admits, %s open-vendor in the catalogue" % (_estate._show(meta["id"]) if "id" in meta else "undefined",
+                             "models it admits, %s open-vendor in the catalogue" % (_jsv.show(meta["id"]) if "id" in meta else "undefined",
                                                                                     _show_id(profile), _closed_route(profile.get("fallback"), closed))))
     return findings
 
@@ -265,7 +258,7 @@ def _open_vendor_routes(value: Dict[str, Any]) -> List[Dict[str, str]]:
 
 def _show_id(profile: Dict[str, Any]) -> str:
     """show(profile.id), where an absent id is JavaScript's undefined."""
-    return _estate._show(profile["id"]) if "id" in profile else "undefined"
+    return _jsv.show(profile["id"]) if "id" in profile else "undefined"
 
 
 def profile_problems(kind: str, value: Dict[str, Any]) -> Optional[List[Dict[str, str]]]:
@@ -350,11 +343,11 @@ def model_usable(model: str, catalogue: Any, policy: Any = None) -> List[str]:
     # The last row of an id wins, as a JavaScript Map built from the rows; only a string id can match a model's name.
     rows = {row["id"]: row for row in _list(catalogue.get("models") if isinstance(catalogue, dict) else None) if isinstance(row.get("id"), str)}
     if not isinstance(model, str) or model not in rows:
-        return ["model %s is not in the model catalogue" % _estate._show(model)]
+        return ["model %s is not in the model catalogue" % _jsv.show(model)]
     if isinstance(policy, dict) and isinstance(policy.get("modelClasses"), list):
         allowed = set(_strings(policy["modelClasses"]))
         meta = policy.get("meta") if isinstance(policy.get("meta"), dict) else {}
-        policy_id = _estate._show(_at(meta, "id"))
+        policy_id = _jsv.show(_at(meta, "id"))
         admission = [c for c in _strings(rows[model].get("classes")) if c != OPEN_VENDOR]  # DEC-0083: descriptive
         if not admission:
             return ["model %s has no class but %s, which admits nothing, so policy %s does not allow it" % (model, OPEN_VENDOR, policy_id)]
@@ -406,7 +399,7 @@ _MISSING = object()
 def _field(value: Dict[str, Any], key: str) -> str:
     """The contract's show(value[key]): `undefined` for a missing key, `null` for null, and an object whose own
     `toString` is data as its JSON, where String() would throw."""
-    return _estate._show(_at(value, key))
+    return _jsv.show(_at(value, key))
 
 
 def _object_at(value: Any, key: str) -> Dict[str, Any]:
@@ -501,7 +494,7 @@ def _index_of(ref: Dict[str, Any]) -> float:
     index = ref.get("index")
     if isinstance(index, bool) or not isinstance(index, (int, float)):
         return -1
-    number = _estate._double(index)
+    number = _jsv.double(index)
     return number if math.isfinite(number) and number.is_integer() else -1
 
 
@@ -524,7 +517,7 @@ def _route_event(value: Dict[str, Any]) -> List[Dict[str, str]]:
     def candidate_at(ref: Dict[str, Any], path: str) -> Optional[Dict[str, Any]]:
         index = _index_of(ref)
         candidate = candidates[int(index)] if 0 <= index < len(candidates) else None
-        if (candidate is None or not _estate._same(_at(candidate, "runnerKind"), _at(ref, "runnerKind"))
+        if (candidate is None or not _jsv.same(_at(candidate, "runnerKind"), _at(ref, "runnerKind"))
                 or ("provider" in ref and not _same_ref(candidate.get("provider"), ref["provider"]))):
             wrong(path, "candidate %s (%s) is not that position of the route" % (_field(ref, "index"), _field(ref, "runnerKind")))
             return None
@@ -542,14 +535,14 @@ def _route_event(value: Dict[str, Any]) -> List[Dict[str, str]]:
         indexes = [_index_of(p) for p in probes]
         # Compared with 0...count-1 before any list is built, and the message lists at most 64 candidates, so a count from
         # an index of 2**32 allocates nothing (contract route-rules.ts at DEC-0084, from this kit's report).
-        if _estate._same(len(indexes), count) and all(_estate._same(index, position) for position, index in enumerate(indexes)):
+        if _jsv.same(len(indexes), count) and all(_jsv.same(index, position) for position, index in enumerate(indexes)):
             return
         if count <= 64:  # NaN is not; Array.from({length: count}) takes ToLength
-            expected = ", ".join(map(_estate._js_string, range(int(count) if count > 0 else 0))) or "none"
+            expected = ", ".join(map(_jsv.js_string, range(int(count) if count > 0 else 0))) or "none"
         else:
-            expected = "0 to %s" % _estate._js_string(count - 1)
+            expected = "0 to %s" % _jsv.js_string(count - 1)
         wrong("/probes", "the walk must record candidates %s in order; it records %s"
-              % (expected, ", ".join(map(_estate._js_string, indexes)) or "none"))
+              % (expected, ", ".join(map(_jsv.js_string, indexes)) or "none"))
 
     if event.get("kind") == "runner-exhausted":
         expect_probes(len(candidates))
@@ -565,7 +558,7 @@ def _route_event(value: Dict[str, Any]) -> List[Dict[str, str]]:
             wrong("/selected/session", "%s has attach: never, so the host cannot attach it" % _field(selected, "runnerKind"))
         if selected.get("session") == "spawned" and session.get("spawn") != "allowed":
             wrong("/selected/session", "%s has spawn: never, so the host cannot spawn it" % _field(selected, "runnerKind"))
-        if "drive" in chosen and "drive" in selected and not _estate._same(selected["drive"], chosen["drive"]):
+        if "drive" in chosen and "drive" in selected and not _jsv.same(selected["drive"], chosen["drive"]):
             wrong("/selected/drive", "the route runs %s through %s, not %s" % (_field(selected, "runnerKind"), _field(chosen, "drive"), _field(selected, "drive")))
         if event.get("sticky") is True:
             # A sticky relaunch keeps the conversation's runner and walks nothing above it.