@sema-agent/client-core 0.108.0 → 0.109.0

package/dist/localEngineSpawn.js

@@ -0,0 +1,486 @@
+import { readOwnDataValue } from './ownKey.js';
+import { inSlotReadOf } from './wireFailureShape.js';
+import { normalizeWirePrincipal } from './principalWire.js';
+import { LOCAL_ENGINE_STOP_LADDER } from './localEngineStopLadder.js';
+import { LOCAL_ENGINE_TIMING } from './localEngineTiming.js';
+import { msg, renderMessage } from './i18n/translate.js';
+function isRecord(v) {
+    if (typeof v !== 'object' || v === null)
+        return false;
+    try {
+        return !Array.isArray(v);
+    }
+    catch {
+        return false;
+    }
+}
+function own(v, key) {
+    if (!isRecord(v))
+        return undefined;
+    try {
+        return readOwnDataValue(v, key);
+    }
+    catch {
+        return undefined;
+    }
+}
+function envEntriesOf(v) {
+    const keys = envBlockKeysOf(v);
+    if (keys === undefined)
+        return undefined;
+    if (keys === null)
+        return [];
+    const out = [];
+    for (const k of keys) {
+        const x = own(v, k);
+        const str = x === undefined ? undefined : stringOf(x);
+        if (str !== undefined)
+            out.push([k, str]);
+    }
+    return out;
+}
+function envBlockKeysOf(v) {
+    if (typeof v !== 'object' || v === null)
+        return null;
+    try {
+        if (Array.isArray(v))
+            return null;
+        return Object.keys(v);
+    }
+    catch {
+        return undefined;
+    }
+}
+function stringOf(x) {
+    if (typeof x === 'string')
+        return x;
+    try {
+        return String(x);
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseJsonLine(t) {
+    try {
+        return JSON.parse(t);
+    }
+    catch {
+        return undefined;
+    }
+}
+function freezeRecord(rows) {
+    const out = {};
+    for (const [k, v] of rows)
+        Object.defineProperty(out, k, { value: v, enumerable: true, writable: true, configurable: true });
+    return Object.freeze(out);
+}
+const lit = (value) => Object.freeze({ kind: 'literal', value });
+const del = Object.freeze({ kind: 'delete' });
+const slot = (s) => Object.freeze({ kind: 'path', slot: s });
+const derived = (from) => Object.freeze({ kind: 'derived', from });
+const row = (key, value, userOverridable) => Object.freeze({ key, value, userOverridable });
+export const LOCAL_ENGINE_SPAWN_ENV = Object.freeze([
+    row('DRAIN_GRACE_MS', lit('60000'), true),
+    row('STORE_LOCK_WAIT_MS', derived('drainPlusH'), true),
+    row('ENGINE_AUTO_EXIT', lit('true'), true),
+    row('SEMA_PARENT_PID', del, false),
+    row('SEMA_ENGINE_PARENT_PID', del, false),
+    row('BIND_HOST', lit('127.0.0.1'), true),
+    row('DB_BACKEND', lit('local'), false),
+    row('CONFIG_PROVIDER', lit('local'), false),
+    row('REMOTE_EXEC', lit('host'), true),
+    row('LOCAL_DATA_ROOT', slot('dataRoot'), false),
+    row('AGENT_DATA_DIR', slot('dataRoot'), true),
+    row('MEMORY_ENGINE_DIR', derived('agentDataDir'), true),
+    row('CONFIG_LOCAL_DIR', slot('configLocalDir'), false),
+    row('SEMA_CONFIG_DIR', slot('configHome'), false),
+    row('ALLOW_UNAUTHED_WRITES', lit('false'), false),
+    row('OPERATOR_SINGLE_USER', derived('operatorSingleUser'), true),
+    row('LEADER_ENABLED', del, false),
+    row('REGISTRY_ADMIN_TOKEN', del, false),
+]);
+export const LOCAL_ENGINE_HOST_BITS = Object.freeze(['PORT', 'SERVICE_AUTH_TOKENS', 'ELECTRON_RUN_AS_NODE', 'NODE_ENV', 'HOST_SHELL_PATH']);
+export const LOCAL_ENGINE_SPAWN_SHAPE = Object.freeze({ detachedSession: true, stdio: 'engine-log-file' });
+const BOOL_TRUE = new Set(['true', '1', 'yes', 'on']);
+const OPERATOR_DECLARATION_KEYS = Object.freeze({ requirePrincipal: 'REQUIRE_PRINCIPAL', principals: 'OPERATOR_PRINCIPALS', singleUser: 'OPERATOR_SINGLE_USER' });
+export function localEngineOperatorSingleUserOf(inherited) {
+    try {
+        const requirePrincipal = own(inherited, OPERATOR_DECLARATION_KEYS.requirePrincipal);
+        if (typeof requirePrincipal === 'string' && requirePrincipal !== '' && BOOL_TRUE.has(requirePrincipal.toLowerCase()))
+            return undefined;
+        const principals = own(inherited, OPERATOR_DECLARATION_KEYS.principals);
+        if (typeof principals === 'string' && principals.split(',').some((s) => s.trim() !== ''))
+            return undefined;
+        const declared = own(inherited, OPERATOR_DECLARATION_KEYS.singleUser);
+        if (typeof declared === 'string' && declared !== '')
+            return undefined;
+        return 'true';
+    }
+    catch {
+        return undefined;
+    }
+}
+const BOOT_ALLOWANCE_MS = 180_000;
+const DRAIN_GRACE_FLOOR_MS = 10_000;
+const DRAIN_GRACE_TABLE_MS = 60_000;
+function finiteNumber(s) {
+    if (s === undefined || s === '')
+        return undefined;
+    const n = Number(s);
+    return Number.isFinite(n) ? n : undefined;
+}
+const HOST_BIT_SET = new Set(LOCAL_ENGINE_HOST_BITS);
+const TABLE_KEY_SET = new Set(LOCAL_ENGINE_SPAWN_ENV.map((r) => r.key));
+const DERIVE = Object.freeze({
+    agentDataDir: (env) => env.get('AGENT_DATA_DIR'),
+    drainPlusH: (env) => String(drainGraceOf(env.get('DRAIN_GRACE_MS')) + LOCAL_ENGINE_STOP_LADDER.H),
+    operatorSingleUser: (env) => localEngineOperatorSingleUserOf(Object.fromEntries(env)),
+});
+function drainGraceOf(v) {
+    const n = finiteNumber(v);
+    return n === undefined ? DRAIN_GRACE_TABLE_MS : Math.max(DRAIN_GRACE_FLOOR_MS, n);
+}
+function budgetsOf(env, storeLockFromUser) {
+    const H = LOCAL_ENGINE_STOP_LADDER.H;
+    const D = drainGraceOf(env.get('DRAIN_GRACE_MS'));
+    const userStore = storeLockFromUser ? finiteNumber(env.get('STORE_LOCK_WAIT_MS')) : undefined;
+    const storeLockWaitMs = userStore !== undefined ? Math.max(0, userStore) : D + H;
+    const healthWaitBudgetMs = storeLockWaitMs + BOOT_ALLOWANCE_MS;
+    const stopBoundMs = D + 3 * H;
+    const lockWaitMs = 2 * LOCAL_ENGINE_TIMING.prepareTimeoutMs + stopBoundMs + healthWaitBudgetMs + H;
+    return Object.freeze({ storeLockWaitMs, healthWaitBudgetMs, stopBoundMs, lockWaitMs });
+}
+export function localEngineSpawnEnv(input) {
+    const env = new Map();
+    const applied = [];
+    const refusedHostBits = [];
+    let storeLockFromUser = false;
+    {
+        for (const [k, v] of envEntriesOf(own(input, 'inherited')) ?? [])
+            env.set(k, v);
+        const paths = own(input, 'paths');
+        for (const r of LOCAL_ENGINE_SPAWN_ENV) {
+            const inheritedValue = env.get(r.key);
+            if (r.value.kind === 'delete') {
+                env.delete(r.key);
+                applied.push(Object.freeze({ key: r.key, from: 'table' }));
+                continue;
+            }
+            if (r.userOverridable && inheritedValue !== undefined && inheritedValue !== '') {
+                applied.push(Object.freeze({ key: r.key, from: 'user' }));
+                if (r.key === 'STORE_LOCK_WAIT_MS')
+                    storeLockFromUser = true;
+                continue;
+            }
+            let value;
+            let from = 'table';
+            if (r.value.kind === 'literal')
+                value = r.value.value;
+            else if (r.value.kind === 'path') {
+                const p = own(paths, r.value.slot);
+                value = typeof p === 'string' && p !== '' ? p : undefined;
+            }
+            else {
+                value = DERIVE[r.value.from](env);
+                from = 'derived';
+            }
+            if (value === undefined) {
+                if (!r.userOverridable)
+                    env.delete(r.key);
+                continue;
+            }
+            env.set(r.key, value);
+            applied.push(Object.freeze({ key: r.key, from }));
+        }
+        for (const [k, v] of envEntriesOf(own(input, 'hostBits')) ?? []) {
+            if (!HOST_BIT_SET.has(k) || TABLE_KEY_SET.has(k)) {
+                refusedHostBits.push(k);
+                continue;
+            }
+            env.set(k, v);
+            applied.push(Object.freeze({ key: k, from: 'host' }));
+        }
+    }
+    return Object.freeze({
+        env: freezeRecord([...env.entries()]),
+        applied: Object.freeze(applied),
+        refusedHostBits: Object.freeze(refusedHostBits),
+        budgets: budgetsOf(env, storeLockFromUser),
+    });
+}
+const SEED_LAYER_ORDER = Object.freeze(['userSettings', 'flagSettings', 'policySettings']);
+const SPAWN_SPELLED = new Set([...LOCAL_ENGINE_SPAWN_ENV.map((r) => r.key), ...LOCAL_ENGINE_HOST_BITS, ...Object.values(OPERATOR_DECLARATION_KEYS)]);
+const PINNED_AT_ENTRY = new Set(['SEMA_CONFIG_DIR', 'HOME', 'USERPROFILE']);
+const READ_FACE_VALUES = new Set(['open', 'roots']);
+const WORKFLOW_SIZE_GUIDELINE_VALUES = new Set(['unrestricted', 'small', 'medium', 'large']);
+function layerReadsOf(layers) {
+    const out = new Map();
+    let list = [];
+    try {
+        if (Array.isArray(layers))
+            list = [...layers];
+    }
+    catch {
+        list = [];
+    }
+    for (const entry of list) {
+        const layer = own(entry, 'layer');
+        if (layer !== 'userSettings' && layer !== 'flagSettings' && layer !== 'policySettings')
+            continue;
+        if (out.has(layer))
+            continue;
+        const read = own(entry, 'read');
+        const state = own(read, 'state');
+        if (state === 'ok')
+            out.set(layer, { kind: 'ok', env: own(read, 'env') });
+        else if (state === 'absent')
+            out.set(layer, { kind: 'absent' });
+        else
+            out.set(layer, { kind: 'unreadable', lastHealthy: state === 'unreadable' ? own(read, 'lastHealthy') : undefined });
+    }
+    return out;
+}
+export function localEngineSeedEnv(input) {
+    const ci = own(input, 'platform') === 'win32';
+    const canon = (k) => (ci ? k.toUpperCase() : k);
+    const merged = new Map();
+    const dropped = [];
+    let refuse;
+    const spell = (k) => (ci && SPAWN_SPELLED.has(k.toUpperCase()) ? k.toUpperCase() : k);
+    const put = (key, value, source) => {
+        merged.set(canon(key), { key: spell(key), value, source });
+    };
+    {
+        for (const source of ['baseline', 'external']) {
+            const entries = envEntriesOf(own(input, source));
+            if (entries === undefined)
+                dropped.push(Object.freeze({ key: source, why: 'layer-unreadable' }));
+            else
+                for (const [k, v] of entries)
+                    put(k, v, source);
+        }
+        const reads = layerReadsOf(own(input, 'layers'));
+        for (const layer of SEED_LAYER_ORDER) {
+            const read = reads.get(layer);
+            if (read === undefined || read.kind === 'absent')
+                continue;
+            let entries;
+            if (read.kind === 'ok') {
+                entries = envEntriesOf(read.env);
+                if (entries === undefined)
+                    dropped.push(Object.freeze({ key: layer, why: 'layer-unreadable' }));
+            }
+            else {
+                dropped.push(Object.freeze({ key: layer, why: 'layer-unreadable' }));
+                if (layer === 'policySettings' && isRecord(read.lastHealthy))
+                    entries = envEntriesOf(read.lastHealthy);
+            }
+            if (entries === undefined) {
+                if (layer === 'policySettings')
+                    refuse = 'policy-unreadable';
+                continue;
+            }
+            for (const [k, v] of entries) {
+                if (PINNED_AT_ENTRY.has(k.toUpperCase())) {
+                    dropped.push(Object.freeze({ key: k, why: 'pinned-at-entry' }));
+                    continue;
+                }
+                put(k, v, layer);
+            }
+        }
+        const topLevel = own(input, 'topLevel');
+        const rf = merged.get(canon('READ_FACE'));
+        if (rf !== undefined) {
+            const t = rf.value.trim();
+            if (READ_FACE_VALUES.has(t))
+                merged.set(canon('READ_FACE'), { ...rf, value: t });
+            else {
+                merged.delete(canon('READ_FACE'));
+                if (t !== '')
+                    dropped.push(Object.freeze({ key: 'READ_FACE', why: 'top-level-invalid' }));
+            }
+        }
+        if (!merged.has(canon('READ_FACE'))) {
+            const s = own(topLevel, 'engineReadFace');
+            if (s !== undefined) {
+                const t = typeof s === 'string' ? s.trim() : undefined;
+                if (t !== undefined && READ_FACE_VALUES.has(t))
+                    put('READ_FACE', t, 'top-level');
+                else if (t !== '')
+                    dropped.push(Object.freeze({ key: 'READ_FACE', why: 'top-level-invalid' }));
+            }
+        }
+        if (!merged.has(canon('WORKFLOW_SIZE_GUIDELINE'))) {
+            const s = own(topLevel, 'workflowSizeGuideline');
+            if (typeof s === 'string' && WORKFLOW_SIZE_GUIDELINE_VALUES.has(s))
+                put('WORKFLOW_SIZE_GUIDELINE', s, 'top-level');
+            else if (s !== undefined)
+                dropped.push(Object.freeze({ key: 'WORKFLOW_SIZE_GUIDELINE', why: 'top-level-invalid' }));
+        }
+    }
+    const rows = [...merged.values()];
+    return Object.freeze({
+        env: freezeRecord(rows.map((r) => [r.key, r.value])),
+        from: Object.freeze(rows.map((r) => Object.freeze({ key: r.key, source: r.source }))),
+        dropped: Object.freeze(dropped),
+        ...(refuse !== undefined ? { refuse } : {}),
+    });
+}
+const PRINCIPAL_KEY = 'SEMA_LIVE_PRINCIPAL';
+const PROCESS_PRINCIPAL_KEYS = Object.freeze(['SEMA_LIVE_PRINCIPAL', 'SEMA_FLEET_PRINCIPAL', 'SEMA_WORKFLOW_PRINCIPAL']);
+const DEFAULT_PRINCIPAL = 'default';
+const PRINCIPAL_LAYER_ORDER = Object.freeze(['policySettings', 'flagSettings', 'userSettings']);
+function principalIn(block) {
+    const keys = envBlockKeysOf(block);
+    if (keys === undefined)
+        return { kind: 'unreadable' };
+    if (keys === null)
+        return { kind: 'unset' };
+    const slot = inSlotReadOf(block, PRINCIPAL_KEY);
+    if (slot.state === 'unproven' || slot.state === 'present_unreadable')
+        return { kind: 'unreadable' };
+    const v = slot.state === 'present' ? slot.value : undefined;
+    const p = typeof v === 'string' ? normalizeWirePrincipal(v) : undefined;
+    return p !== undefined ? { kind: 'value', principal: p } : { kind: 'unset' };
+}
+export function localEnginePrincipalOf(view) {
+    try {
+        const reads = layerReadsOf(own(view, 'layers'));
+        let resolved;
+        for (const layer of PRINCIPAL_LAYER_ORDER) {
+            const read = reads.get(layer);
+            if (read === undefined || read.kind === 'absent')
+                continue;
+            if (read.kind === 'unreadable')
+                return Object.freeze({ kind: 'unknown', layer });
+            const p = principalIn(read.env);
+            if (p.kind === 'unreadable')
+                return Object.freeze({ kind: 'unknown', layer });
+            if (p.kind === 'value') {
+                resolved = { principal: p.principal, source: 'settings' };
+                break;
+            }
+        }
+        const result = resolved ?? { principal: DEFAULT_PRINCIPAL, source: 'default' };
+        const processEnv = own(view, 'processEnv');
+        const overridden = PROCESS_PRINCIPAL_KEYS.some((k) => {
+            const v = own(processEnv, k);
+            const p = typeof v === 'string' ? normalizeWirePrincipal(v) : undefined;
+            return p !== undefined && p !== result.principal;
+        });
+        return Object.freeze({ kind: 'principal', principal: result.principal, source: result.source, ...(overridden ? { ignoredProcessOverride: true } : {}) });
+    }
+    catch {
+        return Object.freeze({ kind: 'unknown', layer: 'userSettings' });
+    }
+}
+const LAYER_LABEL_KEYS = Object.freeze({
+    userSettings: 'localEngine.settingsLayer.userSettings',
+    flagSettings: 'localEngine.settingsLayer.flagSettings',
+    policySettings: 'localEngine.settingsLayer.policySettings',
+});
+export function localEnginePrincipalSentence(p, lang) {
+    try {
+        const kind = own(p, 'kind');
+        if (kind === 'unknown') {
+            const layer = own(p, 'layer');
+            if (layer !== 'userSettings' && layer !== 'flagSettings' && layer !== 'policySettings')
+                return undefined;
+            return renderMessage(msg('localEngine.principalUnknown', { layer: msg(LAYER_LABEL_KEYS[layer]) }), lang);
+        }
+        if (kind === 'principal' && own(p, 'ignoredProcessOverride') === true)
+            return renderMessage(msg('localEngine.principalOverrideIgnored'), lang);
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const BOOT_REFUSAL_MAX_CHARS = 800;
+const BOOT_REFUSAL_MAX_HINTS = 2;
+const CONFIG_CODE = /^config\.[A-Za-z0-9_.-]+$/;
+function capSentence(s) {
+    const t = s.trim();
+    return t.length > BOOT_REFUSAL_MAX_CHARS ? `${t.slice(0, BOOT_REFUSAL_MAX_CHARS)}…` : t;
+}
+export function engineBootRefusalOf(lines, scrub) {
+    try {
+        const clean = (s) => {
+            try {
+                const out = scrub(s);
+                return typeof out === 'string' ? out : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        };
+        const hints = [];
+        let code;
+        let hint;
+        let fatal;
+        const list = Array.isArray(lines) ? [...lines] : [];
+        for (const raw of list) {
+            if (typeof raw !== 'string')
+                continue;
+            const line = clean(raw);
+            if (line === undefined)
+                continue;
+            const t = line.trim();
+            if (!t.startsWith('{'))
+                continue;
+            const o = parseJsonLine(t);
+            if (!isRecord(o))
+                continue;
+            const m = own(o, 'msg');
+            const err = own(o, 'err');
+            if (m === 'fatal' && typeof err === 'string' && err.trim() !== '') {
+                const full = clean(err);
+                const s = full === undefined ? undefined : full.replace(/^\s*Error:\s*/, '');
+                if (s !== undefined && s.trim() !== '')
+                    fatal = capSentence(s);
+                continue;
+            }
+            const c = own(o, 'code');
+            const h = own(o, 'hint');
+            if (typeof c === 'string' && CONFIG_CODE.test(c) && typeof h === 'string' && h.trim() !== '') {
+                const model = own(o, 'model');
+                const who = typeof model === 'string' && model !== '' ? `"${model}": ` : '';
+                const s = clean(`${who}${h}`);
+                const cc = clean(c);
+                if (s === undefined || cc === undefined || !CONFIG_CODE.test(cc))
+                    continue;
+                const sentence = capSentence(s);
+                code = cc;
+                const ch = clean(h);
+                hint = ch === undefined ? undefined : capSentence(ch);
+                if (hints.includes(sentence))
+                    continue;
+                hints.push(sentence);
+                if (hints.length > BOOT_REFUSAL_MAX_HINTS)
+                    hints.shift();
+            }
+        }
+        const parts = [...hints, ...(fatal !== undefined ? [fatal] : [])];
+        if (parts.length === 0)
+            return undefined;
+        return Object.freeze({ ...(code !== undefined ? { code } : {}), ...(hint !== undefined ? { hint } : {}), text: parts.join('\n') });
+    }
+    catch {
+        return undefined;
+    }
+}
+export function engineBootRefusalSentence(refusal, lang) {
+    try {
+        const text = own(refusal, 'text');
+        if (typeof text !== 'string' || text.trim() === '')
+            return undefined;
+        return renderMessage(msg('localEngine.bootRefusal', { reason: text }), lang);
+    }
+    catch {
+        return undefined;
+    }
+}
+export function localEngineFirstShareSentence(lang) {
+    return renderMessage(msg('localEngine.firstShare'), lang);
+}