@rynx-ai/daemon 0.1.11-beta.2 → 0.1.11-beta.21

package/dist/session-launch-operations.js

@@ -1,5 +1,6 @@
 import { newSessionId } from "@rynx-ai/core";
 import { db } from "./db.js";
+import { scalar, transaction } from "./sqlite.js";
 import { createSessionMeta } from "./session-meta-store.js";
 const MAX_ID_LENGTH = 512;
 const SHA256_PATTERN = /^[a-fA-F0-9]{64}$/;
@@ -48,14 +49,17 @@ export function replayPluginSessionLaunch(input) {
     const existing = readOperation(pluginId, scopeId, operationId);
     if (!existing)
         return undefined;
-    if (existing.request_hash !== requestHash) {
+    if (existing.request_hash !== requestHash &&
+        existing.raw_request_hash !== requestHash) {
+        if (input.allowRequestHashMismatch)
+            return undefined;
         throw new SessionLaunchOperationConflictError(pluginId, scopeId, operationId);
     }
     if (existing.state === "deleted") {
         throw new SessionLaunchOperationTargetDeletedError(pluginId, scopeId, operationId, existing.session_id);
     }
     if (!sessionExists(existing.session_id)) {
-        db().transaction(() => {
+        transaction(db(), () => {
             tombstoneOperations(existing.session_id, new Date().toISOString());
         }).immediate();
         throw new SessionLaunchOperationTargetDeletedError(pluginId, scopeId, operationId, existing.session_id);
@@ -75,10 +79,16 @@ export function ensurePluginSessionLaunch(input) {
     const scopeId = requiredId(input.scopeId, "scopeId");
     const operationId = requiredId(input.operationId, "operationId");
     const requestHash = requiredRequestHash(input.requestHash);
-    const ensure = db().transaction(() => {
+    const rawRequestHash = input.rawRequestHash
+        ? requiredRequestHash(input.rawRequestHash)
+        : requestHash;
+    const ensure = transaction(db(), () => {
         const existing = readOperation(pluginId, scopeId, operationId);
         if (existing) {
-            if (existing.request_hash !== requestHash) {
+            if (existing.request_hash !== requestHash &&
+                existing.raw_request_hash !== requestHash &&
+                existing.request_hash !== rawRequestHash &&
+                existing.raw_request_hash !== rawRequestHash) {
                 throw new SessionLaunchOperationConflictError(pluginId, scopeId, operationId);
             }
             if (existing.state === "deleted") {
@@ -110,10 +120,10 @@ export function ensurePluginSessionLaunch(input) {
         }
         db()
             .prepare(`INSERT INTO plugin_session_launch_operations
-           (plugin_id, scope_id, operation_id, request_hash, session_id, state,
+           (plugin_id, scope_id, operation_id, request_hash, raw_request_hash, session_id, state,
             created_at, updated_at, deleted_at)
-         VALUES (?, ?, ?, ?, ?, 'active', ?, ?, NULL)`)
-            .run(pluginId, scopeId, operationId, requestHash, sessionId, now, now);
+         VALUES (?, ?, ?, ?, ?, ?, 'active', ?, ?, NULL)`)
+            .run(pluginId, scopeId, operationId, requestHash, rawRequestHash, sessionId, now, now);
         return { disposition: "created", sessionId };
     });
     const result = ensure.immediate();
@@ -124,20 +134,20 @@ export function ensurePluginSessionLaunch(input) {
 }
 function readOperation(pluginId, scopeId, operationId) {
     return db()
-        .prepare(`SELECT request_hash, session_id, state
+        .prepare(`SELECT request_hash, raw_request_hash, session_id, state
        FROM plugin_session_launch_operations
        WHERE plugin_id = ? AND scope_id = ? AND operation_id = ?`)
         .get(pluginId, scopeId, operationId);
 }
 function sessionExists(sessionId) {
-    return Boolean(db().prepare("SELECT 1 FROM sessions WHERE id = ?").pluck().get(sessionId));
+    return Boolean(scalar(db().prepare("SELECT 1 FROM sessions WHERE id = ?")).get(sessionId));
 }
 function tombstoneOperations(sessionId, now) {
-    return db()
+    return Number(db()
         .prepare(`UPDATE plugin_session_launch_operations
        SET state = 'deleted', updated_at = ?, deleted_at = ?
        WHERE session_id = ? AND state = 'active'`)
-        .run(now, now, sessionId).changes;
+        .run(now, now, sessionId).changes);
 }
 function requiredId(value, label) {
     const normalized = value?.trim();

package/dist/session-log-store.js

@@ -1,4 +1,5 @@
 import { db } from "./db.js";
+import { transaction } from "./sqlite.js";
 function toItem(row) {
     return {
         id: row.id,
@@ -21,7 +22,7 @@ export class SqliteSessionLogStore {
          (id, session_id, position, response_id, type, status, data, created_by, created_at)
        VALUES (@id, @session_id, @position, @response_id, @type, @status, @data, @created_by, @created_at)`);
         const maxStmt = conn.prepare("SELECT MAX(position) AS max FROM session_items WHERE session_id = ?");
-        const tx = conn.transaction((batch) => {
+        const tx = transaction(conn, (batch) => {
             const { max } = maxStmt.get(sessionId);
             let next = (max ?? -1) + 1;
             return batch.map((item) => {

package/dist/session-meta-store.d.ts

@@ -18,6 +18,11 @@ export declare function listSessionMetas(): StoredSessionMeta[];
 export declare function getSessionMeta(id: string): StoredSessionMeta | undefined;
 export declare function createSessionMeta(meta: StoredSessionMeta): void;
 export declare function setSessionTitle(id: string, title: string): void;
+export declare function setSessionExecution(id: string, execution: MachineSessionRecord["execution"]): void;
 export declare function removeSessionMeta(id: string): void;
 /** {@link SessionRegistry} over the same `sessions` table. */
 export declare const sessionRegistry: SessionRegistry;
+/** Generic plugin-principal ownership, including descendants forked from a
+ * plugin-created Session. Portal authorization calls this on every request so
+ * a grant cannot cross into console or another plugin's Sessions. */
+export declare function sessionBelongsToPlugin(pluginId: string, sessionId: string): boolean;

package/dist/session-meta-store.js

@@ -13,6 +13,7 @@
  */
 import { normalizeSessionTitle, resolvedExecutionSnapshotSchema, sessionWorkspaceSnapshotSchema, } from "@rynx-ai/core";
 import { db } from "./db.js";
+import { transaction } from "./sqlite.js";
 const COLS = "id, workspace, execution, title, forked_from_session_id, source, created_at, updated_at";
 export function listSessionMetas() {
     return db()
@@ -46,10 +47,15 @@ export function createSessionMeta(meta) {
 export function setSessionTitle(id, title) {
     db()
         .prepare("UPDATE sessions SET title = ?, updated_at = ? WHERE id = ?")
-        .run(normalizeSessionTitle(title), new Date().toISOString(), id);
+        .run(normalizeSessionTitle(title) ?? null, new Date().toISOString(), id);
+}
+export function setSessionExecution(id, execution) {
+    db()
+        .prepare("UPDATE sessions SET execution = ?, updated_at = ? WHERE id = ?")
+        .run(JSON.stringify(resolvedExecutionSnapshotSchema.parse(execution)), new Date().toISOString(), id);
 }
 export function removeSessionMeta(id) {
-    db().transaction(() => {
+    transaction(db(), () => {
         const now = new Date().toISOString();
         db()
             .prepare(`UPDATE plugin_session_launch_operations
@@ -70,8 +76,25 @@ export const sessionRegistry = {
     get: getSessionMeta,
     list: listSessionMetas,
     setTitle: setSessionTitle,
+    setExecution: setSessionExecution,
     remove: removeSessionMeta,
 };
+/** Generic plugin-principal ownership, including descendants forked from a
+ * plugin-created Session. Portal authorization calls this on every request so
+ * a grant cannot cross into console or another plugin's Sessions. */
+export function sessionBelongsToPlugin(pluginId, sessionId) {
+    const seen = new Set();
+    let current = sessionRegistry.get(sessionId);
+    while (current && !seen.has(current.id)) {
+        if (current.source === `plugin:${pluginId}`)
+            return true;
+        seen.add(current.id);
+        current = current.forkedFromSessionId
+            ? sessionRegistry.get(current.forkedFromSessionId)
+            : undefined;
+    }
+    return false;
+}
 function rowToMeta(row) {
     return {
         id: row.id,

package/dist/session-portal-grant-store.d.ts

@@ -0,0 +1,29 @@
+export type SessionPortalScope = "plugin_sessions" | "single_session";
+export type SessionPortalAccess = "read_only" | "read_write";
+export interface SessionPortalAuthorization {
+    portalId: string;
+    pluginId: string;
+    scope: SessionPortalScope;
+    access: SessionPortalAccess;
+    sessionId?: string;
+    expiresAt: string;
+}
+/** Issue a browser handoff into the native Session workbench. The Host knows
+ * only the generic Session scope and access level; product/user policy stays in
+ * the plugin that asks for the ticket. */
+export declare function issueSessionPortalTicket(input: {
+    pluginId: string;
+    scope: SessionPortalScope;
+    access: SessionPortalAccess;
+    sessionId?: string;
+    now?: Date;
+}): {
+    path: string;
+    expiresAt: string;
+};
+/** Atomically consume a one-use ticket and mint a fixed-lifetime browser grant. */
+export declare function redeemSessionPortalTicket(ticket: string, now?: Date): (SessionPortalAuthorization & {
+    secret: string;
+}) | undefined;
+export declare function authorizeSessionPortalGrant(portalId: string, secret: string, now?: Date): SessionPortalAuthorization | undefined;
+export declare function pruneSessionPortalAuthorization(now?: Date): void;

package/dist/session-portal-grant-store.js

@@ -0,0 +1,85 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { db } from "./db.js";
+import { transaction } from "./sqlite.js";
+const TICKET_TTL_MS = 5 * 60 * 1_000;
+const GRANT_TTL_MS = 30 * 60 * 1_000;
+/** Issue a browser handoff into the native Session workbench. The Host knows
+ * only the generic Session scope and access level; product/user policy stays in
+ * the plugin that asks for the ticket. */
+export function issueSessionPortalTicket(input) {
+    if ((input.scope === "single_session") !== Boolean(input.sessionId)) {
+        throw new Error("single_session Portal tickets require exactly one Session id");
+    }
+    const now = input.now ?? new Date();
+    const expiresAt = new Date(now.getTime() + TICKET_TTL_MS).toISOString();
+    const ticket = randomToken();
+    pruneSessionPortalAuthorization(now);
+    db().prepare(`INSERT INTO session_portal_tickets
+       (ticket_hash, plugin_id, scope, access, session_id, created_at, expires_at, used_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, NULL)`).run(hash(ticket), input.pluginId, input.scope, input.access, input.sessionId ?? null, now.toISOString(), expiresAt);
+    return {
+        path: `/session-portal/redeem#ticket=${encodeURIComponent(ticket)}`,
+        expiresAt,
+    };
+}
+/** Atomically consume a one-use ticket and mint a fixed-lifetime browser grant. */
+export function redeemSessionPortalTicket(ticket, now = new Date()) {
+    const connection = db();
+    return transaction(connection, () => {
+        const ticketHash = hash(ticket);
+        const row = connection.prepare(`SELECT plugin_id, scope, access, session_id, expires_at, used_at
+         FROM session_portal_tickets
+        WHERE ticket_hash = ?`).get(ticketHash);
+        if (!row || row.used_at !== null || row.expires_at <= now.toISOString())
+            return undefined;
+        const consumed = connection.prepare(`UPDATE session_portal_tickets SET used_at = ?
+        WHERE ticket_hash = ? AND used_at IS NULL AND expires_at > ?`).run(now.toISOString(), ticketHash, now.toISOString());
+        if (consumed.changes !== 1)
+            return undefined;
+        const portalId = randomUUID();
+        const secret = randomToken();
+        const expiresAt = new Date(now.getTime() + GRANT_TTL_MS).toISOString();
+        connection.prepare(`INSERT INTO session_portal_grants
+         (portal_id, secret_hash, plugin_id, scope, access, session_id, created_at, expires_at, revoked_at)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, NULL)`).run(portalId, hash(secret), row.plugin_id, row.scope, row.access, row.session_id, now.toISOString(), expiresAt);
+        return {
+            portalId,
+            secret,
+            pluginId: row.plugin_id,
+            scope: row.scope,
+            access: row.access,
+            ...(row.session_id ? { sessionId: row.session_id } : {}),
+            expiresAt,
+        };
+    })();
+}
+export function authorizeSessionPortalGrant(portalId, secret, now = new Date()) {
+    const row = db().prepare(`SELECT portal_id, secret_hash, plugin_id, scope, access, session_id, expires_at, revoked_at
+       FROM session_portal_grants
+      WHERE portal_id = ?`).get(portalId);
+    if (!row || row.revoked_at !== null || row.expires_at <= now.toISOString())
+        return undefined;
+    const actual = Buffer.from(hash(secret), "hex");
+    const expected = Buffer.from(row.secret_hash, "hex");
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+        return undefined;
+    return {
+        portalId: row.portal_id,
+        pluginId: row.plugin_id,
+        scope: row.scope,
+        access: row.access,
+        ...(row.session_id ? { sessionId: row.session_id } : {}),
+        expiresAt: row.expires_at,
+    };
+}
+export function pruneSessionPortalAuthorization(now = new Date()) {
+    const connection = db();
+    connection.prepare("DELETE FROM session_portal_tickets WHERE expires_at <= ? OR used_at IS NOT NULL").run(now.toISOString());
+    connection.prepare("DELETE FROM session_portal_grants WHERE expires_at <= ? OR revoked_at IS NOT NULL").run(now.toISOString());
+}
+function randomToken() {
+    return randomBytes(32).toString("base64url");
+}
+function hash(value) {
+    return createHash("sha256").update(value, "utf8").digest("hex");
+}

package/dist/session-resource-store.js

@@ -5,6 +5,7 @@ import { rynxHome, } from "@rynx-ai/core";
 import { defaultSessionResourcePolicy, SESSION_RESOURCE_MAX_IMAGE_PIXELS, SESSION_RESOURCE_MAX_IMAGE_SIDE, SESSION_RESOURCE_MAX_MESSAGE_BYTES, SESSION_RESOURCE_TRANSFER_CHUNK_BYTES, } from "@rynx-ai/protocol/remote-runtime-rpc";
 import { MachineSessionServiceFailure, } from "@rynx-ai/server";
 import { db } from "./db.js";
+import { transaction } from "./sqlite.js";
 const MAX_STAGED_RESOURCES_PER_SESSION = 16;
 const STAGED_TTL_MS = 24 * 60 * 60 * 1_000;
 export class SqliteSessionResourceStore {
@@ -244,7 +245,7 @@ export class SqliteSessionResourceStore {
             rmSync(this.partialPath(row), { force: true });
             rmSync(this.finalPath(row), { force: true });
         }
-        db().transaction(() => {
+        transaction(db(), () => {
             db().prepare("DELETE FROM session_message_operations WHERE session_id = ?").run(sessionId);
             db().prepare("DELETE FROM session_resources WHERE session_id = ?").run(sessionId);
         })();
@@ -252,7 +253,7 @@ export class SqliteSessionResourceStore {
     }
     prepareMessageOperation(sessionId, clientMessageId, requestHash, resourceIds) {
         const conn = db();
-        return conn.transaction(() => {
+        return transaction(conn, () => {
             const existing = conn.prepare(`SELECT request_hash, state
            FROM session_message_operations
           WHERE session_id = ? AND client_message_id = ?`).get(sessionId, clientMessageId);

package/dist/setup-service.d.ts

@@ -0,0 +1,21 @@
+export { inspectSystemDependencies, type SystemDependencySnapshot, } from "./system-dependencies.js";
+export interface DaemonDiagnosticSnapshot {
+    databasePath: string;
+    databaseExists: boolean;
+    pluginCount: number;
+    agentCount: number;
+    browser: {
+        supported: false;
+    } | {
+        supported: true;
+        installedVersion?: string;
+        error?: string;
+    };
+}
+export declare function prepareBundledPlugins(): Promise<{
+    status: "ready" | "unavailable";
+    installed: string[];
+    updated: string[];
+    unchanged: string[];
+}>;
+export declare function inspectDaemonDiagnostics(): Promise<DaemonDiagnosticSnapshot>;

package/dist/setup-service.js

@@ -0,0 +1,39 @@
+import { existsSync } from "node:fs";
+import { listAgentSpecs } from "@rynx-ai/core";
+import { createChromeForTestingArtifactStore, isChromeForTestingHostSupported } from "./chrome-for-testing-store.js";
+import { ensureBundledOfficialPlugins } from "./bundled-plugins.js";
+import { dbPath } from "./db.js";
+import { listPlugins } from "./plugin-store.js";
+export { inspectSystemDependencies, } from "./system-dependencies.js";
+export async function prepareBundledPlugins() {
+    return ensureBundledOfficialPlugins();
+}
+export async function inspectDaemonDiagnostics() {
+    const databasePath = dbPath();
+    let browser;
+    if (!isChromeForTestingHostSupported()) {
+        browser = { supported: false };
+    }
+    else {
+        try {
+            const installed = createChromeForTestingArtifactStore().readActive();
+            browser = {
+                supported: true,
+                ...(installed ? { installedVersion: installed.version } : {}),
+            };
+        }
+        catch (error) {
+            browser = {
+                supported: true,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    return {
+        databasePath,
+        databaseExists: existsSync(databasePath),
+        pluginCount: existsSync(databasePath) ? listPlugins().length : 0,
+        agentCount: (await listAgentSpecs()).length,
+        browser,
+    };
+}

package/dist/skills-catalog.d.ts

@@ -1,11 +1,20 @@
-import { type SkillInstallRecipe, type SkillMeta } from "@rynx-ai/core";
-import type { SkillDetail } from "@rynx-ai/protocol/control";
+import { type LocalSkillRuntime, type SkillInstallRecipe, type SkillMeta } from "@rynx-ai/core";
+import type { ControlLocalSkillCandidate, ControlLocalSkillImportResult, SkillDetail } from "@rynx-ai/protocol/control";
 export declare function listCatalogSkills(): Promise<SkillMeta[]>;
 /** Install a skill (or a repo's skills) into the catalog per a full install
  *  recipe; delegates to the core catalog layer (which also writes each skill's
  *  `.rynx-skill.json` install-info file — a catalog-only artifact). Returns
  *  the refreshed catalog. */
 export declare function installCatalogSkill(recipe: SkillInstallRecipe): Promise<SkillMeta[]>;
+export declare function scanLocalCatalogSkillCandidates(runtime: LocalSkillRuntime): Promise<ControlLocalSkillCandidate[]>;
+/**
+ * Register complete local runtime Skill bundles into the owner catalog. Every
+ * content hash gets a durable immutable artifact; the mutable catalog entry's
+ * receipt points at that artifact so old Agent specs keep their exact bytes
+ * after a later catalog update.
+ */
+export declare function importLocalCatalogSkills(runtime: LocalSkillRuntime, keys: string[]): Promise<ControlLocalSkillImportResult[]>;
+export declare function importCatalogSkillsFromArchive(filename: string, contentBase64: string): Promise<ControlLocalSkillImportResult[]>;
 /** Detail for one catalog skill: its metadata + the file tree under its dir. */
 export declare function getCatalogSkill(name: string): Promise<SkillDetail | null>;
 /** Read one text file inside a catalog skill. Path-confined to the skill dir,