@rynx-ai/daemon 0.1.10 → 0.1.11-beta.10

package/dist/session-portal-grant-store.js

@@ -0,0 +1,84 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { db } from "./db.js";
+const TICKET_TTL_MS = 5 * 60 * 1_000;
+const GRANT_TTL_MS = 30 * 60 * 1_000;
+/** Issue a browser handoff into the native Session workbench. The Host knows
+ * only the generic Session scope and access level; product/user policy stays in
+ * the plugin that asks for the ticket. */
+export function issueSessionPortalTicket(input) {
+    if ((input.scope === "single_session") !== Boolean(input.sessionId)) {
+        throw new Error("single_session Portal tickets require exactly one Session id");
+    }
+    const now = input.now ?? new Date();
+    const expiresAt = new Date(now.getTime() + TICKET_TTL_MS).toISOString();
+    const ticket = randomToken();
+    pruneSessionPortalAuthorization(now);
+    db().prepare(`INSERT INTO session_portal_tickets
+       (ticket_hash, plugin_id, scope, access, session_id, created_at, expires_at, used_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, NULL)`).run(hash(ticket), input.pluginId, input.scope, input.access, input.sessionId ?? null, now.toISOString(), expiresAt);
+    return {
+        path: `/session-portal/redeem#ticket=${encodeURIComponent(ticket)}`,
+        expiresAt,
+    };
+}
+/** Atomically consume a one-use ticket and mint a fixed-lifetime browser grant. */
+export function redeemSessionPortalTicket(ticket, now = new Date()) {
+    const connection = db();
+    return connection.transaction(() => {
+        const ticketHash = hash(ticket);
+        const row = connection.prepare(`SELECT plugin_id, scope, access, session_id, expires_at, used_at
+         FROM session_portal_tickets
+        WHERE ticket_hash = ?`).get(ticketHash);
+        if (!row || row.used_at !== null || row.expires_at <= now.toISOString())
+            return undefined;
+        const consumed = connection.prepare(`UPDATE session_portal_tickets SET used_at = ?
+        WHERE ticket_hash = ? AND used_at IS NULL AND expires_at > ?`).run(now.toISOString(), ticketHash, now.toISOString());
+        if (consumed.changes !== 1)
+            return undefined;
+        const portalId = randomUUID();
+        const secret = randomToken();
+        const expiresAt = new Date(now.getTime() + GRANT_TTL_MS).toISOString();
+        connection.prepare(`INSERT INTO session_portal_grants
+         (portal_id, secret_hash, plugin_id, scope, access, session_id, created_at, expires_at, revoked_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`).run(portalId, hash(secret), row.plugin_id, row.scope, row.access, row.session_id, now.toISOString(), expiresAt);
+        return {
+            portalId,
+            secret,
+            pluginId: row.plugin_id,
+            scope: row.scope,
+            access: row.access,
+            ...(row.session_id ? { sessionId: row.session_id } : {}),
+            expiresAt,
+        };
+    })();
+}
+export function authorizeSessionPortalGrant(portalId, secret, now = new Date()) {
+    const row = db().prepare(`SELECT portal_id, secret_hash, plugin_id, scope, access, session_id, expires_at, revoked_at
+       FROM session_portal_grants
+      WHERE portal_id = ?`).get(portalId);
+    if (!row || row.revoked_at !== null || row.expires_at <= now.toISOString())
+        return undefined;
+    const actual = Buffer.from(hash(secret), "hex");
+    const expected = Buffer.from(row.secret_hash, "hex");
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+        return undefined;
+    return {
+        portalId: row.portal_id,
+        pluginId: row.plugin_id,
+        scope: row.scope,
+        access: row.access,
+        ...(row.session_id ? { sessionId: row.session_id } : {}),
+        expiresAt: row.expires_at,
+    };
+}
+export function pruneSessionPortalAuthorization(now = new Date()) {
+    const connection = db();
+    connection.prepare("DELETE FROM session_portal_tickets WHERE expires_at <= ? OR used_at IS NOT NULL").run(now.toISOString());
+    connection.prepare("DELETE FROM session_portal_grants WHERE expires_at <= ? OR revoked_at IS NOT NULL").run(now.toISOString());
+}
+function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+function hash(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}

package/dist/setup-service.d.ts

@@ -0,0 +1,21 @@
+export { ensureSystemDependencies, inspectSystemDependencies, type SystemDependencySnapshot, } from "./system-dependencies.js";
+export interface DaemonDiagnosticSnapshot {
+    databasePath: string;
+    databaseExists: boolean;
+    pluginCount: number;
+    agentCount: number;
+    browser: {
+        supported: false;
+    } | {
+        supported: true;
+        installedVersion?: string;
+        error?: string;
+    };
+}
+export declare function prepareBundledPlugins(): Promise<{
+    status: "ready" | "unavailable";
+    installed: string[];
+    updated: string[];
+    unchanged: string[];
+}>;
+export declare function inspectDaemonDiagnostics(): Promise<DaemonDiagnosticSnapshot>;

package/dist/setup-service.js

@@ -0,0 +1,39 @@
+import { existsSync } from "node:fs";
+import { listAgentSpecs } from "@rynx-ai/core";
+import { createChromeForTestingArtifactStore, isChromeForTestingHostSupported } from "./chrome-for-testing-store.js";
+import { ensureBundledOfficialPlugins } from "./bundled-plugins.js";
+import { dbPath } from "./db.js";
+import { listPlugins } from "./plugin-store.js";
+export { ensureSystemDependencies, inspectSystemDependencies, } from "./system-dependencies.js";
+export async function prepareBundledPlugins() {
+    return ensureBundledOfficialPlugins();
+}
+export async function inspectDaemonDiagnostics() {
+    const databasePath = dbPath();
+    let browser;
+    if (!isChromeForTestingHostSupported()) {
+        browser = { supported: false };
+    }
+    else {
+        try {
+            const installed = createChromeForTestingArtifactStore().readActive();
+            browser = {
+                supported: true,
+                ...(installed ? { installedVersion: installed.version } : {}),
+            };
+        }
+        catch (error) {
+            browser = {
+                supported: true,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    return {
+        databasePath,
+        databaseExists: existsSync(databasePath),
+        pluginCount: existsSync(databasePath) ? listPlugins().length : 0,
+        agentCount: (await listAgentSpecs()).length,
+        browser,
+    };
+}

package/dist/skills-catalog.d.ts

@@ -1,11 +1,20 @@
-import { type SkillInstallRecipe, type SkillMeta } from "@rynx-ai/core";
-import type { SkillDetail } from "@rynx-ai/protocol/control";
+import { type LocalSkillRuntime, type SkillInstallRecipe, type SkillMeta } from "@rynx-ai/core";
+import type { ControlLocalSkillCandidate, ControlLocalSkillImportResult, SkillDetail } from "@rynx-ai/protocol/control";
 export declare function listCatalogSkills(): Promise<SkillMeta[]>;
 /** Install a skill (or a repo's skills) into the catalog per a full install
  *  recipe; delegates to the core catalog layer (which also writes each skill's
  *  `.rynx-skill.json` install-info file — a catalog-only artifact). Returns
  *  the refreshed catalog. */
 export declare function installCatalogSkill(recipe: SkillInstallRecipe): Promise<SkillMeta[]>;
+export declare function scanLocalCatalogSkillCandidates(runtime: LocalSkillRuntime): Promise<ControlLocalSkillCandidate[]>;
+/**
+ * Register complete local runtime Skill bundles into the owner catalog. Every
+ * content hash gets a durable immutable artifact; the mutable catalog entry's
+ * receipt points at that artifact so old Agent specs keep their exact bytes
+ * after a later catalog update.
+ */
+export declare function importLocalCatalogSkills(runtime: LocalSkillRuntime, keys: string[]): Promise<ControlLocalSkillImportResult[]>;
+export declare function importCatalogSkillsFromArchive(filename: string, contentBase64: string): Promise<ControlLocalSkillImportResult[]>;
 /** Detail for one catalog skill: its metadata + the file tree under its dir. */
 export declare function getCatalogSkill(name: string): Promise<SkillDetail | null>;
 /** Read one text file inside a catalog skill. Path-confined to the skill dir,

package/dist/skills-catalog.js

@@ -4,13 +4,19 @@
  * env-build share one implementation; this module is the daemon-facing wrapper
  * plus the read-only detail/file helpers the Skills page uses.
  */
-import { readdir, readFile, rm, stat } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { cp, mkdir, mkdtemp, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
 import path from "node:path";
-import { extractSkillFrontmatter, installIntoCatalog, rynxSkillsDir, scanSkillsDir, readSkillMeta, } from "@rynx-ai/core";
-/** Catalog skill ids are kebab-case (matches the SKILL.md `name` convention). */
-const SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
+import extractZipArchive from "extract-zip";
+import { extractSkillFrontmatter, installIntoCatalog, collectLocalSkillBundlesInWorker, collectSkillBundlesFromDirectory, scanLocalSkillCandidatesInWorker, rynxSkillsDir, rynxSkillArtifactDir, rynxSkillArtifactsDir, scanSkillsDir, SAFE_SKILL_NAME, readSkillMeta, writeSkillInstallInfo, } from "@rynx-ai/core";
 /** A single file's contents are capped to keep responses small. */
 const MAX_SKILL_FILE_BYTES = 256 * 1024;
+const MAX_ARCHIVE_ENTRIES = 1_000;
+const MAX_ARCHIVE_EXTRACTED_BYTES = 24 * 1024 * 1024;
+/** Concurrent Control API requests for the same Skill are serialized so the
+ * catalog's backup/swap transaction cannot interleave. */
+const localRegistrationTails = new Map();
 export function listCatalogSkills() {
     return listMergedSkills();
 }
@@ -22,9 +28,91 @@ export async function installCatalogSkill(recipe) {
     await installIntoCatalog(recipe, rynxSkillsDir());
     return listMergedSkills();
 }
+export function scanLocalCatalogSkillCandidates(runtime) {
+    return scanLocalSkillCandidatesInWorker(runtime);
+}
+/**
+ * Register complete local runtime Skill bundles into the owner catalog. Every
+ * content hash gets a durable immutable artifact; the mutable catalog entry's
+ * receipt points at that artifact so old Agent specs keep their exact bytes
+ * after a later catalog update.
+ */
+export async function importLocalCatalogSkills(runtime, keys) {
+    const collected = await collectLocalSkillBundlesInWorker(runtime, keys);
+    return registerCollectedBundles(collected);
+}
+export async function importCatalogSkillsFromArchive(filename, contentBase64) {
+    if (!filename.toLowerCase().endsWith(".zip"))
+        throw new Error("archive must be a .zip file");
+    const content = Buffer.from(contentBase64, "base64");
+    if (content.byteLength === 0)
+        throw new Error("archive is empty");
+    if (content.byteLength > 20 * 1024 * 1024)
+        throw new Error("archive exceeds the 20 MB limit");
+    const staging = await mkdtemp(path.join(tmpdir(), "rynx-skill-archive-"));
+    const archive = path.join(staging, "upload.zip");
+    const extracted = path.join(staging, "extracted");
+    try {
+        await writeFile(archive, content);
+        await mkdir(extracted, { recursive: true });
+        let entryCount = 0;
+        let extractedBytes = 0;
+        await extractZipArchive(archive, {
+            dir: extracted,
+            onEntry: (entry) => {
+                entryCount += 1;
+                extractedBytes += entry.uncompressedSize;
+                if (entryCount > MAX_ARCHIVE_ENTRIES) {
+                    throw new Error(`archive exceeds the ${MAX_ARCHIVE_ENTRIES}-entry limit`);
+                }
+                if (extractedBytes > MAX_ARCHIVE_EXTRACTED_BYTES) {
+                    throw new Error("archive exceeds the 24 MB extracted-size limit");
+                }
+            },
+        });
+        const collected = collectSkillBundlesFromDirectory(extracted);
+        if (collected.bundles.length === 0 && collected.failures.length === 0) {
+            return [{
+                    status: "failed",
+                    name: path.basename(filename, path.extname(filename)),
+                    sourcePath: filename,
+                    message: "No valid Skill bundle was found in the archive.",
+                }];
+        }
+        return registerCollectedBundles({
+            bundles: collected.bundles.map((bundle) => ({ ...bundle, sourcePath: filename })),
+            failures: collected.failures.map((failure) => ({ ...failure, sourcePath: filename })),
+        });
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+async function registerCollectedBundles(collected) {
+    const results = collected.failures.map((failure) => ({
+        status: "failed",
+        name: failure.name,
+        ...(failure.sourcePath ? { sourcePath: failure.sourcePath } : {}),
+        message: failure.message,
+    }));
+    for (const bundle of collected.bundles) {
+        try {
+            results.push(await registerLocalBundle(bundle));
+        }
+        catch (error) {
+            results.push({
+                status: "failed",
+                name: bundle.name,
+                sourcePath: bundle.sourcePath,
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return results;
+}
 /** Detail for one catalog skill: its metadata + the file tree under its dir. */
 export async function getCatalogSkill(name) {
-    if (!SKILL_NAME_PATTERN.test(name))
+    if (!SAFE_SKILL_NAME.test(name))
         throw new Error(`invalid skill name: ${name}`);
     const dir = path.join(rynxSkillsDir(), name);
     const meta = await readSkillMeta(dir);
@@ -62,7 +150,7 @@ async function walkSkillFiles(root, dir) {
 /** Read one text file inside a catalog skill. Path-confined to the skill dir,
  *  size-capped, and binary files are rejected. */
 export async function readCatalogSkillFile(name, relPath) {
-    if (!SKILL_NAME_PATTERN.test(name))
+    if (!SAFE_SKILL_NAME.test(name))
         throw new Error(`invalid skill name: ${name}`);
     const dir = path.resolve(path.join(rynxSkillsDir(), name));
     const target = path.resolve(dir, relPath);
@@ -82,9 +170,221 @@ export async function readCatalogSkillFile(name, relPath) {
 async function listMergedSkills() {
     return (await scanSkillsDir(rynxSkillsDir())).sort((a, b) => a.name.localeCompare(b.name));
 }
+async function registerLocalBundle(bundle) {
+    const previous = localRegistrationTails.get(bundle.name) ?? Promise.resolve();
+    const pending = previous.catch(() => undefined).then(() => registerLocalBundleUnlocked(bundle));
+    localRegistrationTails.set(bundle.name, pending);
+    try {
+        return await pending;
+    }
+    finally {
+        if (localRegistrationTails.get(bundle.name) === pending) {
+            localRegistrationTails.delete(bundle.name);
+        }
+    }
+}
+async function registerLocalBundleUnlocked(bundle) {
+    const catalogRoot = rynxSkillsDir();
+    const currentDir = path.join(catalogRoot, bundle.name);
+    const existing = await readSkillMeta(currentDir);
+    if (existing?.ref && !isManagedLocalArtifact(existing.ref.install)) {
+        return {
+            status: "conflict",
+            name: bundle.name,
+            sourcePath: bundle.sourcePath,
+            skill: toSummary(existing),
+            message: "A Skill with this name is registered from another source.",
+        };
+    }
+    if (existing?.ref?.contentHash === bundle.contentHash) {
+        return {
+            status: "skipped",
+            name: bundle.name,
+            sourcePath: bundle.sourcePath,
+            skill: toSummary(existing),
+            message: "Skill is already up to date.",
+        };
+    }
+    if (await pathExists(currentDir) && !existing) {
+        return {
+            status: "conflict",
+            name: bundle.name,
+            sourcePath: bundle.sourcePath,
+            message: "A receipt-less Skill with this name already exists. Remove it before importing.",
+        };
+    }
+    const artifactDir = rynxSkillArtifactDir(bundle.name, bundle.contentHash);
+    await materializeArtifact(bundle, artifactDir);
+    const ref = {
+        name: bundle.name,
+        install: { tool: "skills-cli", source: artifactDir },
+        contentHash: bundle.contentHash,
+    };
+    await mkdir(catalogRoot, { recursive: true });
+    const stagingRoot = await mkdtemp(path.join(catalogRoot, `.import-${bundle.name}-`));
+    const stagedDir = path.join(stagingRoot, bundle.name);
+    const backupDir = path.join(catalogRoot, `.backup-${bundle.name}-${process.pid}-${randomUUID()}`);
+    let backedUp = false;
+    try {
+        await cp(artifactDir, stagedDir, { recursive: true });
+        await writeSkillInstallInfo(stagedDir, ref);
+        if (await pathExists(currentDir)) {
+            await rename(currentDir, backupDir);
+            backedUp = true;
+        }
+        try {
+            await rename(stagedDir, currentDir);
+        }
+        catch (error) {
+            if (backedUp) {
+                await rename(backupDir, currentDir);
+                backedUp = false;
+            }
+            throw error;
+        }
+        if (backedUp) {
+            await rm(backupDir, { recursive: true, force: true });
+            backedUp = false;
+        }
+    }
+    finally {
+        await rm(stagingRoot, { recursive: true, force: true });
+        if (backedUp && !(await pathExists(currentDir))) {
+            await rename(backupDir, currentDir);
+        }
+    }
+    const meta = await readSkillMeta(currentDir);
+    if (!meta)
+        throw new Error("Imported Skill failed catalog validation");
+    return {
+        status: existing ? "updated" : "created",
+        name: meta.name,
+        sourcePath: bundle.sourcePath,
+        skill: toSummary(meta),
+    };
+}
+async function materializeArtifact(bundle, artifactDir) {
+    if (await pathExists(artifactDir)) {
+        if (await artifactMatchesBundle(bundle, artifactDir))
+            return;
+        throw new Error("Immutable Skill artifact already exists but does not match its content hash");
+    }
+    const artifactsRoot = rynxSkillArtifactsDir();
+    await mkdir(artifactsRoot, { recursive: true });
+    const stagingRoot = await mkdtemp(path.join(artifactsRoot, `.artifact-${bundle.name}-`));
+    const stagedDir = path.join(stagingRoot, bundle.name);
+    try {
+        await mkdir(stagedDir, { recursive: true });
+        const aggregate = createHash("sha256");
+        for (const file of [...bundle.files].sort((left, right) => left.path.localeCompare(right.path))) {
+            const relative = normalizeBundlePath(file.path);
+            const content = Buffer.from(file.contentBase64, "base64");
+            if (content.byteLength !== file.sizeBytes)
+                throw new Error(`Skill file size mismatch: ${relative}`);
+            const sha256 = createHash("sha256").update(content).digest("hex");
+            if (sha256 !== file.sha256)
+                throw new Error(`Skill file hash mismatch: ${relative}`);
+            aggregate.update(relative);
+            aggregate.update("\0");
+            aggregate.update(sha256);
+            aggregate.update("\0");
+            aggregate.update(String(content.byteLength));
+            aggregate.update("\0");
+            const target = path.join(stagedDir, ...relative.split("/"));
+            await mkdir(path.dirname(target), { recursive: true });
+            await writeFile(target, content);
+        }
+        if (aggregate.digest("hex") !== bundle.contentHash)
+            throw new Error("Skill bundle hash mismatch");
+        const parent = path.dirname(artifactDir);
+        await mkdir(parent, { recursive: true });
+        try {
+            await rename(stagedDir, artifactDir);
+        }
+        catch (error) {
+            if (await artifactMatchesBundle(bundle, artifactDir))
+                return;
+            throw error;
+        }
+    }
+    finally {
+        await rm(stagingRoot, { recursive: true, force: true });
+    }
+}
+async function artifactMatchesBundle(bundle, artifactDir) {
+    try {
+        const actualFiles = await walkArtifactFiles(artifactDir, artifactDir);
+        const expectedFiles = [...bundle.files].sort((left, right) => left.path.localeCompare(right.path));
+        if (!actualFiles || actualFiles.length !== expectedFiles.length)
+            return false;
+        for (let index = 0; index < expectedFiles.length; index += 1) {
+            const expected = expectedFiles[index];
+            if (actualFiles[index] !== expected.path)
+                return false;
+            const content = await readFile(path.join(artifactDir, ...expected.path.split("/")));
+            if (content.byteLength !== expected.sizeBytes)
+                return false;
+            if (createHash("sha256").update(content).digest("hex") !== expected.sha256)
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function walkArtifactFiles(root, dir) {
+    const files = [];
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+        if (entry.isSymbolicLink())
+            return null;
+        const absolute = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            const nested = await walkArtifactFiles(root, absolute);
+            if (!nested)
+                return null;
+            files.push(...nested);
+        }
+        else if (entry.isFile()) {
+            files.push(normalizeBundlePath(path.relative(root, absolute)));
+        }
+    }
+    return files.sort((left, right) => left.localeCompare(right));
+}
+function normalizeBundlePath(value) {
+    const parts = value.replace(/\\/g, "/").split("/");
+    if (parts.some((part) => !part || part === "." || part === "..")) {
+        throw new Error(`Invalid Skill file path: ${value}`);
+    }
+    return parts.join("/");
+}
+function isManagedLocalArtifact(recipe) {
+    if (recipe.tool !== "skills-cli" || !path.isAbsolute(recipe.source))
+        return false;
+    const root = path.resolve(rynxSkillArtifactsDir());
+    const source = path.resolve(recipe.source);
+    const relative = path.relative(root, source);
+    return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+function toSummary(meta) {
+    return {
+        name: meta.name,
+        description: meta.description,
+        ...(meta.ref ? { ref: meta.ref } : {}),
+    };
+}
+async function pathExists(value) {
+    try {
+        await stat(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /** Remove a catalog skill by name. Returns false if it wasn't present. */
 export async function removeCatalogSkill(name) {
-    if (!SKILL_NAME_PATTERN.test(name))
+    if (!SAFE_SKILL_NAME.test(name))
         throw new Error(`invalid skill name: ${name}`);
     const dir = path.join(rynxSkillsDir(), name);
     try {

package/dist/system-dependencies.d.ts

@@ -0,0 +1,26 @@
+export interface SystemDependencyStatus {
+    installed: boolean;
+    detail?: string;
+}
+export interface SystemDependencySnapshot {
+    tmux: SystemDependencyStatus;
+}
+export interface SystemDependencyCommandResult {
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    errorCode?: string;
+}
+export interface SystemDependencyCommandOptions {
+    timeoutMs: number;
+}
+export type SystemDependencyCommandRunner = (command: string, args: readonly string[], options: SystemDependencyCommandOptions) => Promise<SystemDependencyCommandResult>;
+export interface SystemDependencyOptions {
+    platform?: string;
+    getuid?: () => number | undefined;
+    findSystemExecutable?: (name: string) => Promise<string | undefined>;
+    runCommand?: SystemDependencyCommandRunner;
+    onProgress?: (message: string) => void;
+}
+export declare function inspectSystemDependencies(options?: Pick<SystemDependencyOptions, "runCommand">): Promise<SystemDependencySnapshot>;
+export declare function ensureSystemDependencies(options?: SystemDependencyOptions): Promise<SystemDependencySnapshot>;