@rynx-ai/daemon 0.1.11-beta.3 → 0.1.11-beta.30

package/dist/session-resource-store.js

@@ -1,10 +1,11 @@
 import { createHash, randomUUID } from "node:crypto";
-import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeSync, } from "node:fs";
-import { basename, join } from "node:path";
+import { chmodSync, closeSync, constants, createReadStream, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeSync, } from "node:fs";
+import { basename, extname, isAbsolute, join } from "node:path";
 import { rynxHome, } from "@rynx-ai/core";
-import { defaultSessionResourcePolicy, SESSION_RESOURCE_MAX_IMAGE_PIXELS, SESSION_RESOURCE_MAX_IMAGE_SIDE, SESSION_RESOURCE_MAX_MESSAGE_BYTES, SESSION_RESOURCE_TRANSFER_CHUNK_BYTES, } from "@rynx-ai/protocol/remote-runtime-rpc";
+import { defaultSessionResourcePolicy, SESSION_RESOURCE_MAX_IMAGE_BYTES, SESSION_RESOURCE_MAX_IMAGE_PIXELS, SESSION_RESOURCE_MAX_IMAGE_SIDE, SESSION_RESOURCE_MAX_MESSAGE_BYTES, SESSION_RESOURCE_TRANSFER_CHUNK_BYTES, } from "@rynx-ai/protocol/remote-runtime-rpc";
 import { MachineSessionServiceFailure, } from "@rynx-ai/server";
 import { db } from "./db.js";
+import { transaction } from "./sqlite.js";
 const MAX_STAGED_RESOURCES_PER_SESSION = 16;
 const STAGED_TTL_MS = 24 * 60 * 60 * 1_000;
 export class SqliteSessionResourceStore {
@@ -25,7 +26,8 @@ export class SqliteSessionResourceStore {
           WHERE session_id = ? AND client_upload_id = ?`)
             .get(input.sessionId, input.clientUploadId);
         if (existing) {
-            if (existing.filename !== filename ||
+            if (existing.kind !== resourceKind(input.type) ||
+                existing.filename !== filename ||
                 existing.media_type !== input.mediaType ||
                 existing.byte_length !== input.byteLength) {
                 throw conflict("clientUploadId was already used for different content");
@@ -43,23 +45,27 @@ export class SqliteSessionResourceStore {
                     : { resource: toMetadata(refreshed) }),
             };
         }
+        if (input.type === "input_image" && input.byteLength > SESSION_RESOURCE_MAX_IMAGE_BYTES) {
+            throw invalid("Image exceeds the Session resource policy");
+        }
         const staged = db()
-            .prepare(`SELECT COUNT(*) AS count, COALESCE(SUM(byte_length), 0) AS bytes
+            .prepare(`SELECT COUNT(*) AS count,
+                COALESCE(SUM(CASE WHEN kind = 'image' THEN byte_length ELSE 0 END), 0) AS bytes
            FROM session_resources
           WHERE session_id = ? AND state IN ('uploading', 'staged')`)
             .get(input.sessionId);
         if (staged.count >= MAX_STAGED_RESOURCES_PER_SESSION ||
-            staged.bytes + input.byteLength > SESSION_RESOURCE_MAX_MESSAGE_BYTES) {
-            throw unavailable("Session staged image quota exceeded");
+            (input.type === "input_image" && staged.bytes + input.byteLength > SESSION_RESOURCE_MAX_MESSAGE_BYTES)) {
+            throw unavailable("Session staged resource quota exceeded");
         }
         const resourceId = `res_${randomUUID()}`;
         const uploadId = `upl_${randomUUID()}`;
         const createdAt = Date.now();
         ensurePrivateDirectory(this.sessionDirectory(input.sessionId));
         db().prepare(`INSERT INTO session_resources
-         (id, session_id, client_upload_id, upload_id, filename, media_type,
+         (id, session_id, client_upload_id, upload_id, kind, filename, media_type,
           byte_length, uploaded_bytes, state, created_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, 0, 'uploading', ?)`).run(resourceId, input.sessionId, input.clientUploadId, uploadId, filename, input.mediaType, input.byteLength, createdAt);
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, 'uploading', ?)`).run(resourceId, input.sessionId, input.clientUploadId, uploadId, resourceKind(input.type), filename, input.mediaType, input.byteLength, createdAt);
         return { uploadId, resourceId, offset: 0, complete: false };
     }
     async writeUploadChunk(input) {
@@ -122,23 +128,25 @@ export class SqliteSessionResourceStore {
         const partial = this.partialPath(row);
         const final = this.finalPath(row);
         if (!existsSync(partial) && existsSync(final)) {
-            const bytes = readFileSync(final);
-            return { resource: this.finalizeUpload(row, bytes) };
-        }
-        const bytes = readFileSync(partial);
-        const image = inspectImage(bytes, row.media_type);
-        if (image.width > SESSION_RESOURCE_MAX_IMAGE_SIDE ||
-            image.height > SESSION_RESOURCE_MAX_IMAGE_SIDE ||
-            image.width * image.height > SESSION_RESOURCE_MAX_IMAGE_PIXELS) {
-            throw invalid("Image dimensions exceed the Session resource policy");
+            return { resource: await this.finalizeStoredFile(row, final) };
         }
+        const inspected = row.kind === "image"
+            ? inspectImage(readFileSync(partial), imageMediaType(row.media_type))
+            : undefined;
+        validateImageDimensions(inspected);
         renameSync(partial, final);
         chmodSync(final, 0o600);
-        return { resource: this.finalizeUpload(row, bytes, image) };
+        return { resource: await this.finalizeStoredFile(row, final, inspected) };
     }
     async getResource(input) {
         return { resource: toMetadata(this.requireResource(input.sessionId, input.resourceId)) };
     }
+    resolveCommittedLocalPath(sessionId, resourceId) {
+        const row = this.requireResource(sessionId, resourceId);
+        if (row.state !== "committed")
+            throw unavailable("Resource is not committed");
+        return this.finalPath(row);
+    }
     async readResource(input) {
         const row = this.requireResource(input.sessionId, input.resourceId);
         if (row.state === "uploading")
@@ -173,7 +181,56 @@ export class SqliteSessionResourceStore {
         db().prepare("DELETE FROM session_resources WHERE id = ?").run(row.id);
         return { deleted: true };
     }
-    async prepareInput(sessionId, content, clientMessageId) {
+    async materializeGeneratedImage(input) {
+        const parsed = decodeGeneratedImage(input.result);
+        const clientUploadId = `gen_${createHash("sha256")
+            .update(`${input.sessionId}\0${input.sourceId}`)
+            .digest("hex")}`;
+        const begun = await this.beginUpload({
+            sessionId: input.sessionId,
+            clientUploadId,
+            type: "input_image",
+            filename: `generated-image.${imageExtension(parsed.mediaType)}`,
+            mediaType: parsed.mediaType,
+            byteLength: parsed.bytes.byteLength,
+        });
+        const expectedSha256 = createHash("sha256").update(parsed.bytes).digest("hex");
+        if (begun.complete && begun.resource?.sha256 !== expectedSha256) {
+            throw conflict("Generated image source changed after it was materialized");
+        }
+        if (!begun.complete) {
+            if (begun.offset > 0) {
+                const row = this.requireUpload(input.sessionId, begun.uploadId);
+                const existing = readFileSync(this.partialPath(row));
+                if (existing.byteLength !== begun.offset ||
+                    !existing.equals(parsed.bytes.subarray(0, begun.offset))) {
+                    throw conflict("Generated image source changed while it was being materialized");
+                }
+            }
+            let offset = begun.offset;
+            while (offset < parsed.bytes.byteLength) {
+                const chunk = parsed.bytes.subarray(offset, Math.min(offset + SESSION_RESOURCE_TRANSFER_CHUNK_BYTES, parsed.bytes.byteLength));
+                const written = await this.writeUploadChunk({
+                    sessionId: input.sessionId,
+                    uploadId: begun.uploadId,
+                    offset,
+                    data: chunk.toString("base64"),
+                });
+                offset = written.offset;
+            }
+        }
+        const metadata = begun.complete && begun.resource
+            ? begun.resource
+            : (await this.commitUpload({
+                sessionId: input.sessionId,
+                uploadId: begun.uploadId,
+            })).resource;
+        if (metadata.type !== "input_image")
+            throw conflict("Generated image resource changed type");
+        const { type: _type, state: _state, sha256: _sha256, createdAt: _createdAt, ...reference } = metadata;
+        return reference;
+    }
+    async prepareInput(sessionId, content, clientMessageId, operationExecution) {
         const runtimeContent = [];
         const canonicalContent = [];
         const resourceIds = [];
@@ -186,55 +243,118 @@ export class SqliteSessionResourceStore {
                 title ||= part.text.trim();
                 continue;
             }
+            if ("path" in part && part.path !== undefined) {
+                if (!isAbsolute(part.path))
+                    throw invalid("File path must be absolute");
+                const stats = statSync(part.path);
+                if (!stats.isFile())
+                    throw invalid("File path must reference a regular file");
+                const canonical = {
+                    ...part,
+                    byteLength: part.byteLength ?? stats.size,
+                };
+                canonicalContent.push(canonical);
+                runtimeContent.push({
+                    type: part.type === "input_image" ? "local_image" : "local_file",
+                    path: part.path,
+                    resource: canonical,
+                });
+                title ||= part.filename ?? basename(part.path);
+                continue;
+            }
             const row = this.requireResource(sessionId, part.resourceId);
             if (row.state === "uploading")
-                throw unavailable("Image upload is incomplete");
-            const resource = toImagePart(row);
-            if (resource.mediaType !== part.mediaType ||
+                throw unavailable("Resource upload is incomplete");
+            const resource = toResourcePart(row);
+            if (resource.type !== part.type ||
+                resource.mediaType !== part.mediaType ||
                 (part.byteLength !== undefined && part.byteLength !== resource.byteLength)) {
-                throw conflict("Image reference metadata does not match the stored resource");
+                throw conflict("Resource reference metadata does not match the stored resource");
             }
-            totalImageBytes += row.byte_length;
+            if (row.kind === "image")
+                totalImageBytes += row.byte_length;
             resourceIds.push(row.id);
             canonicalContent.push(resource);
             runtimeContent.push({
-                type: "local_image",
+                type: resource.type === "input_image" ? "local_image" : "local_file",
                 path: this.finalPath(row),
-                resource,
+                resource: resource,
             });
             title ||= row.filename;
         }
         if (runtimeContent.length === 0 || totalImageBytes > SESSION_RESOURCE_MAX_MESSAGE_BYTES) {
             throw invalid("Message content is empty or exceeds the image byte limit");
         }
-        if (!runtimeContent.some((part) => part.type === "local_image" || part.text.trim())) {
-            throw invalid("Message content must contain text or an image");
+        if (!runtimeContent.some((part) => part.type !== "text" || part.text.trim())) {
+            throw invalid("Message content must contain text or a file");
         }
         let operationState;
         if (clientMessageId) {
-            const requestHash = hashMessageContent(canonicalContent);
-            operationState = this.prepareMessageOperation(sessionId, clientMessageId, requestHash, resourceIds);
+            const requestHash = hashMessageContent(canonicalContent, operationExecution?.selection);
+            const operation = this.prepareMessageOperation(sessionId, clientMessageId, requestHash, resourceIds, operationExecution?.snapshot);
+            operationState = operation.state;
+            return {
+                input: {
+                    content: runtimeContent,
+                    clientMessageId,
+                },
+                title: title || "File",
+                operationState,
+                ...(operation.responseId ? { responseId: operation.responseId } : {}),
+                ...(operation.messageItemId ? { messageItemId: operation.messageItemId } : {}),
+                ...(operation.execution ? { operationExecution: operation.execution } : {}),
+            };
         }
         return {
             input: {
                 content: runtimeContent,
                 ...(clientMessageId ? { clientMessageId } : {}),
             },
-            title: title || "Image",
+            title: title || "File",
             ...(operationState ? { operationState } : {}),
         };
     }
-    markMessageInjecting(sessionId, clientMessageId) {
-        this.transitionOperation(sessionId, clientMessageId, ["prepared", "failed_not_started"], "injecting");
+    markMessageInjecting(sessionId, clientMessageId, identity) {
+        const current = db().prepare(`SELECT state, response_id, message_item_id
+         FROM session_message_operations
+        WHERE session_id = ? AND client_message_id = ?`).get(sessionId, clientMessageId);
+        if (!current ||
+            (identity && current.response_id && current.response_id !== identity.responseId) ||
+            (identity && current.message_item_id && current.message_item_id !== identity.messageItemId)) {
+            throw conflict("Message operation identity changed");
+        }
+        const result = db().prepare(`UPDATE session_message_operations
+          SET state = 'injecting', error = NULL,
+              response_id = COALESCE(response_id, ?),
+              message_item_id = COALESCE(message_item_id, ?),
+              updated_at = ?
+        WHERE session_id = ? AND client_message_id = ?
+          AND state IN ('prepared', 'failed_not_started')`).run(identity?.responseId ?? null, identity?.messageItemId ?? null, Date.now(), sessionId, clientMessageId);
+        if (result.changes === 0 && current.state !== "injecting" && current.state !== "mirrored") {
+            throw conflict("Message operation state changed");
+        }
     }
-    markMessageInjected(sessionId, clientMessageId) {
-        this.transitionOperation(sessionId, clientMessageId, ["injecting"], "injected");
+    markMessageInjected(sessionId, clientMessageId, identity) {
+        const current = db().prepare(`SELECT state, response_id
+         FROM session_message_operations
+        WHERE session_id = ? AND client_message_id = ?`).get(sessionId, clientMessageId);
+        if (!current ||
+            (identity && current.response_id && current.response_id !== identity.responseId)) {
+            throw conflict("Message operation identity changed");
+        }
+        const result = db().prepare(`UPDATE session_message_operations
+          SET state = 'injected', error = NULL,
+              response_id = COALESCE(response_id, ?),
+              updated_at = ?
+        WHERE session_id = ? AND client_message_id = ? AND state = 'injecting'`).run(identity?.responseId ?? null, Date.now(), sessionId, clientMessageId);
+        if (result.changes !== 1)
+            throw conflict("Message operation state changed");
     }
     markMessageOutcomeUnknown(sessionId, clientMessageId, reason) {
         this.transitionOperation(sessionId, clientMessageId, ["injecting"], "outcome_unknown", reason);
     }
     markMessageFailedNotStarted(sessionId, clientMessageId, reason) {
-        this.transitionOperation(sessionId, clientMessageId, ["prepared", "injecting"], "failed_not_started", reason);
+        this.transitionOperation(sessionId, clientMessageId, ["prepared", "injecting", "mirrored"], "failed_not_started", reason);
     }
     deleteSession(sessionId) {
         const rows = db()
@@ -244,37 +364,51 @@ export class SqliteSessionResourceStore {
             rmSync(this.partialPath(row), { force: true });
             rmSync(this.finalPath(row), { force: true });
         }
-        db().transaction(() => {
+        transaction(db(), () => {
             db().prepare("DELETE FROM session_message_operations WHERE session_id = ?").run(sessionId);
             db().prepare("DELETE FROM session_resources WHERE session_id = ?").run(sessionId);
         })();
         rmSync(this.sessionDirectory(sessionId), { recursive: true, force: true });
     }
-    prepareMessageOperation(sessionId, clientMessageId, requestHash, resourceIds) {
+    prepareMessageOperation(sessionId, clientMessageId, requestHash, resourceIds, execution) {
         const conn = db();
-        return conn.transaction(() => {
-            const existing = conn.prepare(`SELECT request_hash, state
+        return transaction(conn, () => {
+            const existing = conn.prepare(`SELECT request_hash, state, response_id, message_item_id, execution_snapshot
            FROM session_message_operations
           WHERE session_id = ? AND client_message_id = ?`).get(sessionId, clientMessageId);
             if (existing) {
+                const storedExecution = parseOperationExecution(existing.execution_snapshot);
                 if (existing.request_hash !== requestHash) {
                     throw conflict("clientMessageId was already used for different content");
                 }
                 if (existing.state === "failed_not_started") {
+                    const retryExecution = storedExecution ?? execution;
                     this.bindOperationResources(conn, sessionId, clientMessageId, resourceIds);
                     conn.prepare(`UPDATE session_message_operations
-                SET state = 'prepared', error = NULL, updated_at = ?
-              WHERE session_id = ? AND client_message_id = ?`).run(Date.now(), sessionId, clientMessageId);
-                    return "prepared";
+                SET state = 'prepared', error = NULL,
+                    execution_snapshot = COALESCE(execution_snapshot, ?), updated_at = ?
+              WHERE session_id = ? AND client_message_id = ?`).run(execution ? JSON.stringify(execution) : null, Date.now(), sessionId, clientMessageId);
+                    return {
+                        state: "prepared",
+                        ...(existing.response_id ? { responseId: existing.response_id } : {}),
+                        ...(existing.message_item_id ? { messageItemId: existing.message_item_id } : {}),
+                        ...(retryExecution ? { execution: retryExecution } : {}),
+                    };
                 }
-                return existing.state;
+                return {
+                    state: existing.state,
+                    ...(existing.response_id ? { responseId: existing.response_id } : {}),
+                    ...(existing.message_item_id ? { messageItemId: existing.message_item_id } : {}),
+                    ...(storedExecution ? { execution: storedExecution } : {}),
+                };
             }
             const now = Date.now();
             conn.prepare(`INSERT INTO session_message_operations
-           (session_id, client_message_id, request_hash, state, created_at, updated_at)
-         VALUES (?, ?, ?, 'prepared', ?, ?)`).run(sessionId, clientMessageId, requestHash, now, now);
+           (session_id, client_message_id, request_hash, state, execution_snapshot,
+            created_at, updated_at)
+         VALUES (?, ?, ?, 'prepared', ?, ?, ?)`).run(sessionId, clientMessageId, requestHash, execution ? JSON.stringify(execution) : null, now, now);
             this.bindOperationResources(conn, sessionId, clientMessageId, resourceIds);
-            return "prepared";
+            return { state: "prepared", ...(execution ? { execution } : {}) };
         })();
     }
     bindOperationResources(conn, sessionId, clientMessageId, resourceIds) {
@@ -317,12 +451,12 @@ export class SqliteSessionResourceStore {
             throw conflict("Message operation state changed");
         }
     }
-    finalizeUpload(row, bytes, inspected = inspectImage(bytes, row.media_type)) {
-        const digest = createHash("sha256").update(bytes).digest("hex");
+    async finalizeStoredFile(row, file, inspected) {
+        const digest = await hashFile(file);
         db().prepare(`UPDATE session_resources
           SET state = 'staged', uploaded_bytes = byte_length, sha256 = ?,
               width = ?, height = ?
-        WHERE id = ? AND state = 'uploading'`).run(digest, inspected.width, inspected.height, row.id);
+        WHERE id = ? AND state = 'uploading'`).run(digest, inspected?.width ?? null, inspected?.height ?? null, row.id);
         return toMetadata(this.requireResource(row.session_id, row.id));
     }
     reconcileUploadOffset(row) {
@@ -368,7 +502,7 @@ export class SqliteSessionResourceStore {
         return join(this.sessionDirectory(row.session_id), `${row.id}.part`);
     }
     finalPath(row) {
-        return join(this.sessionDirectory(row.session_id), `${row.id}.${extension(row.media_type)}`);
+        return join(this.sessionDirectory(row.session_id), `${row.id}.${resourceExtension(row)}`);
     }
     sweepExpiredStagedResources(now = Date.now()) {
         const rows = db()
@@ -382,17 +516,25 @@ export class SqliteSessionResourceStore {
         }
     }
 }
-function toImagePart(row) {
-    if (row.state === "uploading" ||
-        !row.sha256 ||
-        !row.width ||
-        !row.height) {
+function toResourcePart(row) {
+    if (row.state === "uploading" || !row.sha256) {
         throw unavailable("Resource upload is incomplete");
     }
+    if (row.kind === "file") {
+        return {
+            type: "input_file",
+            resourceId: row.id,
+            mediaType: row.media_type,
+            filename: row.filename,
+            byteLength: row.byte_length,
+        };
+    }
+    if (!row.width || !row.height)
+        throw unavailable("Image upload is incomplete");
     return {
         type: "input_image",
         resourceId: row.id,
-        mediaType: row.media_type,
+        mediaType: imageMediaType(row.media_type),
         filename: row.filename,
         byteLength: row.byte_length,
         width: row.width,
@@ -400,7 +542,7 @@ function toImagePart(row) {
     };
 }
 function toMetadata(row) {
-    const part = toImagePart(row);
+    const part = toResourcePart(row);
     if (row.state === "uploading")
         throw unavailable("Resource upload is incomplete");
     return {
@@ -410,13 +552,38 @@ function toMetadata(row) {
         createdAt: row.created_at,
     };
 }
-function hashMessageContent(content) {
-    return createHash("sha256")
-        .update(JSON.stringify(content.map((part) => part.type === "input_text"
+function hashMessageContent(content, execution) {
+    const canonicalContent = content.map((part) => part.type === "input_text"
         ? { type: part.type, text: part.text }
-        : { type: part.type, resourceId: part.resourceId })))
+        : "resourceId" in part
+            ? { type: part.type, resourceId: part.resourceId }
+            : { type: part.type, path: part.path });
+    const hasExecutionSelection = execution && (Object.prototype.hasOwnProperty.call(execution, "model") ||
+        Object.prototype.hasOwnProperty.call(execution, "reasoningEffort"));
+    return createHash("sha256")
+        .update(JSON.stringify(hasExecutionSelection
+        ? { content: canonicalContent, execution }
+        : canonicalContent))
         .digest("hex");
 }
+function parseOperationExecution(value) {
+    if (!value)
+        return undefined;
+    try {
+        const parsed = JSON.parse(value);
+        if ((parsed.model !== null && typeof parsed.model !== "string") ||
+            (parsed.reasoningEffort !== null && typeof parsed.reasoningEffort !== "string")) {
+            return undefined;
+        }
+        return {
+            model: parsed.model,
+            reasoningEffort: parsed.reasoningEffort,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
 function inspectImage(bytes, declared) {
     const sniffed = sniffMediaType(bytes);
     if (sniffed !== declared)
@@ -425,14 +592,22 @@ function inspectImage(bytes, declared) {
         ? validatePngContainer(bytes)
         : sniffed === "image/jpeg"
             ? validateJpegContainer(bytes)
-            : validateWebpContainer(bytes);
+            : sniffed === "image/webp"
+                ? validateWebpContainer(bytes)
+                : sniffed === "image/gif"
+                    ? validateGifContainer(bytes)
+                    : validateSvgContainer(bytes);
     if (!structurallyValid)
         throw invalid("Image file is incomplete or malformed");
     const dimensions = sniffed === "image/png"
         ? pngDimensions(bytes)
         : sniffed === "image/jpeg"
             ? jpegDimensions(bytes)
-            : webpDimensions(bytes);
+            : sniffed === "image/webp"
+                ? webpDimensions(bytes)
+                : sniffed === "image/gif"
+                    ? gifDimensions(bytes)
+                    : svgDimensions(bytes);
     if (!dimensions || dimensions.width <= 0 || dimensions.height <= 0) {
         throw invalid("Image dimensions could not be decoded");
     }
@@ -590,8 +765,67 @@ function sniffMediaType(bytes) {
         bytes.toString("ascii", 0, 4) === "RIFF" &&
         bytes.toString("ascii", 8, 12) === "WEBP")
         return "image/webp";
+    if (bytes.length >= 10 &&
+        (bytes.toString("ascii", 0, 6) === "GIF87a" || bytes.toString("ascii", 0, 6) === "GIF89a"))
+        return "image/gif";
+    try {
+        const text = new TextDecoder("utf-8", { fatal: true }).decode(bytes).trimStart();
+        if (/^(?:<\?xml[^>]*>\s*)?(?:<!--[^]*?-->\s*)*<svg\b/i.test(text)) {
+            return "image/svg+xml";
+        }
+    }
+    catch {
+        // Not UTF-8 SVG.
+    }
     return undefined;
 }
+function validateGifContainer(bytes) {
+    return bytes.length >= 14 && bytes.at(-1) === 0x3b;
+}
+function gifDimensions(bytes) {
+    if (bytes.length < 10)
+        return undefined;
+    return { width: bytes.readUInt16LE(6), height: bytes.readUInt16LE(8) };
+}
+function svgText(bytes) {
+    try {
+        return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        return undefined;
+    }
+}
+function validateSvgContainer(bytes) {
+    const text = svgText(bytes)?.trim();
+    if (!text)
+        return false;
+    const withoutProlog = text
+        .replace(/^<\?xml[^>]*>\s*/i, "")
+        .replace(/^(?:<!--[^]*?-->\s*)*/i, "");
+    return /^<svg\b/i.test(withoutProlog) && (/<\/svg>\s*$/i.test(text) || /\/\>\s*$/.test(text));
+}
+function svgDimensions(bytes) {
+    const open = svgText(bytes)?.match(/<svg\b([^>]*)>/i)?.[1];
+    if (open === undefined)
+        return undefined;
+    const width = numericSvgLength(open.match(/\bwidth\s*=\s*["']([^"']+)["']/i)?.[1]);
+    const height = numericSvgLength(open.match(/\bheight\s*=\s*["']([^"']+)["']/i)?.[1]);
+    if (width && height)
+        return { width, height };
+    const viewBox = open.match(/\bviewBox\s*=\s*["']([^"']+)["']/i)?.[1]
+        ?.trim().split(/[\s,]+/).map(Number);
+    if (viewBox?.length === 4 && viewBox.every(Number.isFinite) && viewBox[2] > 0 && viewBox[3] > 0) {
+        return { width: Math.ceil(viewBox[2]), height: Math.ceil(viewBox[3]) };
+    }
+    return { width: width ?? 300, height: height ?? 150 };
+}
+function numericSvgLength(value) {
+    const match = value?.trim().match(/^(\d+(?:\.\d+)?)(?:px)?$/i);
+    if (!match)
+        return undefined;
+    const number = Number(match[1]);
+    return Number.isFinite(number) && number > 0 ? Math.ceil(number) : undefined;
+}
 function pngDimensions(bytes) {
     if (bytes.toString("ascii", 12, 16) !== "IHDR")
         return undefined;
@@ -665,13 +899,75 @@ function decodeBase64(value) {
     }
     return Buffer.from(value, "base64");
 }
-function extension(mediaType) {
-    return mediaType === "image/png" ? "png" : mediaType === "image/jpeg" ? "jpg" : "webp";
+function resourceKind(type) {
+    return type === "input_image" ? "image" : "file";
+}
+function imageMediaType(mediaType) {
+    switch (mediaType) {
+        case "image/png":
+        case "image/jpeg":
+        case "image/webp":
+        case "image/gif":
+        case "image/svg+xml":
+            return mediaType;
+        default:
+            throw invalid("Image media type is invalid");
+    }
+}
+function resourceExtension(row) {
+    if (row.kind === "image") {
+        switch (imageMediaType(row.media_type)) {
+            case "image/png": return "png";
+            case "image/jpeg": return "jpg";
+            case "image/webp": return "webp";
+            case "image/gif": return "gif";
+            case "image/svg+xml": return "svg";
+        }
+    }
+    const extension = extname(row.filename).slice(1).toLowerCase();
+    return /^[a-z0-9][a-z0-9._-]{0,15}$/.test(extension) ? extension : "bin";
+}
+function decodeGeneratedImage(result) {
+    const dataUrl = /^data:(image\/[a-z0-9+.-]+);base64,([A-Za-z0-9+/=]+)$/i.exec(result);
+    const encoded = dataUrl?.[2] ?? result;
+    const bytes = decodeBase64(encoded);
+    if (bytes.byteLength === 0 || bytes.byteLength > SESSION_RESOURCE_MAX_IMAGE_BYTES) {
+        throw invalid("Generated image exceeds the Session image resource policy");
+    }
+    const mediaType = sniffMediaType(bytes);
+    if (!mediaType || (dataUrl && imageMediaType(dataUrl[1].toLowerCase()) !== mediaType)) {
+        throw invalid("Generated image bytes are invalid");
+    }
+    return { bytes, mediaType };
+}
+function imageExtension(mediaType) {
+    switch (mediaType) {
+        case "image/png": return "png";
+        case "image/jpeg": return "jpg";
+        case "image/webp": return "webp";
+        case "image/gif": return "gif";
+        case "image/svg+xml": return "svg";
+    }
+}
+function validateImageDimensions(image) {
+    if (!image)
+        return;
+    if (image.width > SESSION_RESOURCE_MAX_IMAGE_SIDE ||
+        image.height > SESSION_RESOURCE_MAX_IMAGE_SIDE ||
+        image.width * image.height > SESSION_RESOURCE_MAX_IMAGE_PIXELS) {
+        throw invalid("Image dimensions exceed the Session resource policy");
+    }
+}
+async function hashFile(path) {
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(path))
+        hash.update(chunk);
+    return hash.digest("hex");
 }
 function safeFilename(value) {
     const name = basename(value).replace(/[\u0000-\u001f\u007f]/g, "").trim();
     if (!name || name === "." || name === "..")
-        throw invalid("Image filename is invalid");
+        throw invalid("Resource filename is invalid");
     return name;
 }
 function ensurePrivateDirectory(path) {

package/dist/setup-service.d.ts

@@ -1,3 +1,4 @@
+export { inspectSystemDependencies, type SystemDependencySnapshot, } from "./system-dependencies.js";
 export interface DaemonDiagnosticSnapshot {
     databasePath: string;
     databaseExists: boolean;

package/dist/setup-service.js

@@ -4,6 +4,7 @@ import { createChromeForTestingArtifactStore, isChromeForTestingHostSupported }
 import { ensureBundledOfficialPlugins } from "./bundled-plugins.js";
 import { dbPath } from "./db.js";
 import { listPlugins } from "./plugin-store.js";
+export { inspectSystemDependencies, } from "./system-dependencies.js";
 export async function prepareBundledPlugins() {
     return ensureBundledOfficialPlugins();
 }

package/dist/skills-catalog.d.ts

@@ -1,11 +1,20 @@
-import { type SkillInstallRecipe, type SkillMeta } from "@rynx-ai/core";
-import type { SkillDetail } from "@rynx-ai/protocol/control";
+import { type LocalSkillRuntime, type SkillInstallRecipe, type SkillMeta } from "@rynx-ai/core";
+import type { ControlLocalSkillCandidate, ControlLocalSkillImportResult, SkillDetail } from "@rynx-ai/protocol/control";
 export declare function listCatalogSkills(): Promise<SkillMeta[]>;
 /** Install a skill (or a repo's skills) into the catalog per a full install
  *  recipe; delegates to the core catalog layer (which also writes each skill's
  *  `.rynx-skill.json` install-info file — a catalog-only artifact). Returns
  *  the refreshed catalog. */
 export declare function installCatalogSkill(recipe: SkillInstallRecipe): Promise<SkillMeta[]>;
+export declare function scanLocalCatalogSkillCandidates(runtime: LocalSkillRuntime): Promise<ControlLocalSkillCandidate[]>;
+/**
+ * Register complete local runtime Skill bundles into the owner catalog. Every
+ * content hash gets a durable immutable artifact; the mutable catalog entry's
+ * receipt points at that artifact so old Agent specs keep their exact bytes
+ * after a later catalog update.
+ */
+export declare function importLocalCatalogSkills(runtime: LocalSkillRuntime, keys: string[]): Promise<ControlLocalSkillImportResult[]>;
+export declare function importCatalogSkillsFromArchive(filename: string, contentBase64: string): Promise<ControlLocalSkillImportResult[]>;
 /** Detail for one catalog skill: its metadata + the file tree under its dir. */
 export declare function getCatalogSkill(name: string): Promise<SkillDetail | null>;
 /** Read one text file inside a catalog skill. Path-confined to the skill dir,