@raidiant/notifai 10.1.1 → 10.1.2

package/src/send-attempts.test.ts

@@ -1,143 +0,0 @@
-import { mkdtempSync, readFileSync, readdirSync, rmSync, statSync, symlinkSync, writeFileSync } from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { afterEach, describe, expect, it } from 'vitest'
-import type { NotificationDraftT } from '@raidiant/notifai-protocol'
-import type { MachineCredential } from './credentials.js'
-import {
-  SEND_ATTEMPT_TTL_MS,
-  beginSendAttempt,
-  semanticMediaIds,
-  sendDraftFingerprint,
-  settleSendAttempt,
-} from './send-attempts.js'
-
-const roots: string[] = []
-afterEach(() => {
-  while (roots.length > 0) rmSync(roots.pop()!, { recursive: true, force: true })
-})
-
-function fixture() {
-  const root = mkdtempSync(path.join(os.tmpdir(), 'notifai-send-attempt-'))
-  roots.push(root)
-  const env = { XDG_STATE_HOME: path.join(root, 'state') }
-  const credential: MachineCredential = {
-    machineId: 'mac_attempt',
-    machineName: 'Attempt Machine',
-    baseUrl: 'https://app.notifai.test',
-    secret: 'private-machine-secret',
-  }
-  const draft = {
-    schema_version: 1,
-    kind: 'done',
-    project: 'private-project',
-    presentation: { title: 'Sensitive result', body: 'Private body text' },
-    targets: { mode: 'all' },
-  } as NotificationDraftT
-  return { root, env, credential, draft }
-}
-
-describe('opaque interrupted-send recovery', () => {
-  it('matches one exact semantic retry without storing notification content', () => {
-    const { env, credential, draft } = fixture()
-    const fingerprint = sendDraftFingerprint(draft, credential)
-    const first = beginSendAttempt({ env, credential, fingerprint, retry: false, now: 10 })
-    expect(first.ok).toBe(true)
-    if (!first.ok) return
-
-    const files = readdirSync(path.join(env.XDG_STATE_HOME, 'notifai', 'send-attempts'))
-    expect(files).toHaveLength(1)
-    const file = path.join(env.XDG_STATE_HOME, 'notifai', 'send-attempts', files[0]!)
-    const stored = readFileSync(file, 'utf8')
-    expect(stored).not.toContain('Sensitive result')
-    expect(stored).not.toContain('Private body text')
-    if (process.platform !== 'win32') expect(statSync(file).mode & 0o777).toBe(0o600)
-    if (process.platform !== 'win32') {
-      expect(statSync(path.dirname(file)).mode & 0o777).toBe(0o700)
-    }
-
-    const retry = beginSendAttempt({ env, credential, fingerprint, retry: true, now: 11 })
-    expect(retry).toMatchObject({
-      ok: true,
-      attemptId: first.attemptId,
-      idempotencyKey: first.idempotencyKey,
-      replay: true,
-    })
-    settleSendAttempt(env, first.attemptId)
-    expect(beginSendAttempt({ env, credential, fingerprint, retry: true, now: 12 })).toMatchObject({
-      ok: false,
-      code: 'retry_not_found',
-    })
-  })
-
-  it('does not follow a symlink presented as an attempt record', () => {
-    const { root, env, credential, draft } = fixture()
-    if (process.platform === 'win32') return
-    const fingerprint = sendDraftFingerprint(draft, credential)
-    const first = beginSendAttempt({ env, credential, fingerprint, retry: false, now: 10 })
-    expect(first.ok).toBe(true)
-    if (!first.ok) return
-    const directory = path.join(env.XDG_STATE_HOME, 'notifai', 'send-attempts')
-    const file = path.join(directory, `${first.attemptId}.json`)
-    const target = path.join(root, 'foreign.json')
-    writeFileSync(target, readFileSync(file, 'utf8'))
-    rmSync(file)
-    symlinkSync(target, file)
-
-    expect(beginSendAttempt({ env, credential, fingerprint, retry: true, now: 11 })).toMatchObject({
-      ok: false,
-      code: 'retry_not_found',
-    })
-    expect(readFileSync(target, 'utf8')).toContain(first.idempotencyKey)
-  })
-
-  it('refuses ambiguity instead of choosing between identical unresolved events', () => {
-    const { env, credential, draft } = fixture()
-    const fingerprint = sendDraftFingerprint(draft, credential)
-    beginSendAttempt({ env, credential, fingerprint, retry: false, now: 10 })
-    beginSendAttempt({ env, credential, fingerprint, retry: false, now: 11 })
-    expect(beginSendAttempt({ env, credential, fingerprint, retry: true, now: 12 })).toMatchObject({
-      ok: false,
-      code: 'retry_ambiguous',
-    })
-  })
-
-  it('invalidates attempts after expiry or credential rotation', () => {
-    const { env, credential, draft } = fixture()
-    const fingerprint = sendDraftFingerprint(draft, credential)
-    beginSendAttempt({ env, credential, fingerprint, retry: false, now: 10 })
-    expect(
-      beginSendAttempt({
-        env,
-        credential,
-        fingerprint,
-        retry: true,
-        now: 10 + SEND_ATTEMPT_TTL_MS + 1,
-      }),
-    ).toMatchObject({ ok: false, code: 'retry_not_found' })
-
-    beginSendAttempt({ env, credential, fingerprint, retry: false, now: 20 })
-    const rotated = { ...credential, secret: 'rotated-secret' }
-    expect(
-      beginSendAttempt({
-        env,
-        credential: rotated,
-        fingerprint: sendDraftFingerprint(draft, rotated),
-        retry: true,
-        now: 21,
-      }),
-    ).toMatchObject({ ok: false, code: 'retry_not_found' })
-  })
-
-  it('fingerprints local media bytes without retaining paths or bytes', () => {
-    const { root } = fixture()
-    const file = path.join(root, 'private.png')
-    writeFileSync(file, 'first bytes')
-    const first = semanticMediaIds([file], root)
-    writeFileSync(file, 'different bytes')
-    const second = semanticMediaIds([file], root)
-    expect(first).not.toEqual(second)
-    expect(first[0]).not.toContain(file)
-    expect(first[0]).not.toContain('first bytes')
-  })
-})

package/src/send-attempts.ts

@@ -1,188 +0,0 @@
-import { createHash, createHmac, randomBytes } from 'node:crypto'
-import {
-  closeSync,
-  constants,
-  existsSync,
-  fstatSync,
-  lstatSync,
-  openSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-} from 'node:fs'
-import path from 'node:path'
-import type { NotificationDraftT } from '@raidiant/notifai-protocol'
-import { atomicWriteFileSync } from './atomic-file.js'
-import { stateDir } from './config.js'
-import type { MachineCredential } from './credentials.js'
-
-interface SendAttemptRecord {
-  version: 1
-  attempt_id: string
-  fingerprint: string
-  idempotency_key: string
-  credential_tag: string
-  machine_id: string
-  service: string
-  created_at: string
-  expires_at: string
-}
-
-export const SEND_ATTEMPT_TTL_MS = 24 * 60 * 60 * 1000
-
-/** Stable pre-upload media identities used only inside the keyed draft digest. */
-export function semanticMediaIds(images: readonly string[], cwd: string): string[] {
-  return images.map((image) => {
-    if (image.startsWith('med_')) return image
-    const digest = createHash('sha256')
-    if (/^https?:\/\//i.test(image)) digest.update(`url\0${image}`)
-    else digest.update('file\0').update(readFileSync(path.resolve(cwd, image)))
-    return `med_retry_${digest.digest('base64url')}`
-  })
-}
-
-function directory(env: NodeJS.ProcessEnv): string {
-  return path.join(stateDir(env), 'send-attempts')
-}
-
-function credentialTag(credential: MachineCredential): string {
-  return createHmac('sha256', credential.secret)
-    .update('notifai-send-attempt-credential-v1')
-    .digest('base64url')
-}
-
-/** A keyed digest proves equality without persisting notification content. */
-export function sendDraftFingerprint(
-  draft: NotificationDraftT,
-  credential: MachineCredential,
-): string {
-  return createHmac('sha256', credential.secret)
-    .update('notifai-send-draft-v1\0')
-    .update(JSON.stringify(draft))
-    .digest('base64url')
-}
-
-function parseRecord(file: string): SendAttemptRecord | null {
-  let descriptor: number | undefined
-  try {
-    const before = lstatSync(file)
-    const uid = typeof process.getuid === 'function' ? process.getuid() : undefined
-    if (before.isSymbolicLink() || !before.isFile() || (uid !== undefined && before.uid !== uid)) {
-      return null
-    }
-    const flags = constants.O_RDONLY | (process.platform === 'win32' ? 0 : constants.O_NOFOLLOW)
-    descriptor = openSync(file, flags)
-    const opened = fstatSync(descriptor)
-    if (!opened.isFile() || opened.dev !== before.dev || opened.ino !== before.ino) return null
-    const value = JSON.parse(readFileSync(descriptor, 'utf8')) as Partial<SendAttemptRecord>
-    return value.version === 1 &&
-      typeof value.attempt_id === 'string' &&
-      typeof value.fingerprint === 'string' &&
-      typeof value.idempotency_key === 'string' &&
-      typeof value.credential_tag === 'string' &&
-      typeof value.machine_id === 'string' &&
-      typeof value.service === 'string' &&
-      typeof value.created_at === 'string' &&
-      typeof value.expires_at === 'string'
-      ? value as SendAttemptRecord
-      : null
-  } catch {
-    return null
-  } finally {
-    if (descriptor !== undefined) closeSync(descriptor)
-  }
-}
-
-function liveRecords(
-  env: NodeJS.ProcessEnv,
-  credential: MachineCredential,
-  now: number,
-): SendAttemptRecord[] {
-  const dir = directory(env)
-  if (!existsSync(dir)) return []
-  const directoryStat = lstatSync(dir)
-  const uid = typeof process.getuid === 'function' ? process.getuid() : undefined
-  if (
-    directoryStat.isSymbolicLink() ||
-    !directoryStat.isDirectory() ||
-    (uid !== undefined && directoryStat.uid !== uid)
-  ) return []
-  const tag = credentialTag(credential)
-  const records: SendAttemptRecord[] = []
-  for (const name of readdirSync(dir)) {
-    if (!name.endsWith('.json')) continue
-    const file = path.join(dir, name)
-    const record = parseRecord(file)
-    const expired = record === null || Date.parse(record.expires_at) <= now
-    const rotated = record !== null && (
-      record.machine_id !== credential.machineId ||
-      record.service !== credential.baseUrl ||
-      record.credential_tag !== tag
-    )
-    if (expired || rotated) {
-      rmSync(file, { force: true })
-      continue
-    }
-    records.push(record)
-  }
-  return records
-}
-
-export type BeginAttempt =
-  | { ok: true; attemptId: string; idempotencyKey: string; replay: boolean }
-  | { ok: false; code: 'retry_not_found' | 'retry_ambiguous'; message: string }
-
-export function beginSendAttempt(options: {
-  env: NodeJS.ProcessEnv
-  credential: MachineCredential
-  fingerprint: string
-  retry: boolean
-  idempotencyKey?: string
-  now?: number
-}): BeginAttempt {
-  const now = options.now ?? Date.now()
-  const live = liveRecords(options.env, options.credential, now)
-  if (options.retry) {
-    const matches = live.filter((record) => record.fingerprint === options.fingerprint)
-    if (matches.length === 0) {
-      return {
-        ok: false,
-        code: 'retry_not_found',
-        message: 'No unresolved opaque attempt matches this exact send on the current Approved Machine.',
-      }
-    }
-    if (matches.length > 1) {
-      return {
-        ok: false,
-        code: 'retry_ambiguous',
-        message: 'More than one unresolved opaque attempt matches this exact send; refusing to guess or create another notification.',
-      }
-    }
-    const match = matches[0]!
-    return { ok: true, attemptId: match.attempt_id, idempotencyKey: match.idempotency_key, replay: true }
-  }
-
-  const attemptId = `sat_${randomBytes(12).toString('base64url')}`
-  const idempotencyKey = options.idempotencyKey ?? `cli-${randomBytes(12).toString('base64url')}`
-  const record: SendAttemptRecord = {
-    version: 1,
-    attempt_id: attemptId,
-    fingerprint: options.fingerprint,
-    idempotency_key: idempotencyKey,
-    credential_tag: credentialTag(options.credential),
-    machine_id: options.credential.machineId,
-    service: options.credential.baseUrl,
-    created_at: new Date(now).toISOString(),
-    expires_at: new Date(now + SEND_ATTEMPT_TTL_MS).toISOString(),
-  }
-  atomicWriteFileSync(
-    path.join(directory(options.env), `${attemptId}.json`),
-    `${JSON.stringify(record)}\n`,
-    { mode: 0o600, directoryMode: 0o700, requireCurrentUserOwner: true },
-  )
-  return { ok: true, attemptId, idempotencyKey, replay: false }
-}
-
-export function settleSendAttempt(env: NodeJS.ProcessEnv, attemptId: string): void {
-  rmSync(path.join(directory(env), `${attemptId}.json`), { force: true })
-}

package/src/send.test.ts

@@ -1,28 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import {
-  accidentalEscapedNewlineMessage,
-  hasAccidentalEscapedNewlines,
-  rejectAccidentalEscapedNewlines,
-} from './send.js'
-
-describe('accidental escaped newlines', () => {
-  it('catches a shell-quoted backslash-n body', () => {
-    expect(hasAccidentalEscapedNewlines('line1\\nline2')).toBe(true)
-    expect(rejectAccidentalEscapedNewlines('line1\\nline2', false)).toBe(
-      accidentalEscapedNewlineMessage(),
-    )
-  })
-
-  it('preserves real multiline Markdown', () => {
-    expect(hasAccidentalEscapedNewlines('line1\nline2')).toBe(false)
-    expect(rejectAccidentalEscapedNewlines('line1\nline2', false)).toBeNull()
-  })
-
-  it('lets an explicit flag keep visible backslash-n text', () => {
-    expect(rejectAccidentalEscapedNewlines('use \\n in the sample', true)).toBeNull()
-  })
-
-  it('does not treat an escaped backslash plus n as accidental', () => {
-    expect(hasAccidentalEscapedNewlines('escape as \\\\n')).toBe(false)
-  })
-})