@sema-agent/client-core 0.97.1 → 0.99.0

package/dist/deviceRebind.js

@@ -1,5 +1,6 @@
 import { atMostOnceVerdictOf } from './atMostOnce.js';
 import { readOwnDataValue } from './ownKey.js';
+import { isDisplayableWireCode, readErrorString, readThrownSlot, wireFailureShapeOf } from './wireFailureShape.js';
 const LANE_ABSENT = 'capability.device_lane_required';
 const RUN_STORE_ABSENT = 'capability.run_store_required';
 const NOT_FOUND = 'not_found.device';
@@ -40,9 +41,13 @@ function isArraySafely(v) {
         return false;
     }
 }
-function refusedOf(status, code, e) {
-    const message = nonEmpty(slot(e, 'message'));
-    return { kind: 'refused', status, ...(code !== undefined ? { errorCode: code } : {}), ...(message !== undefined ? { message } : {}) };
+function scrubbed(redact, v) {
+    return v !== undefined && redact !== undefined && v.includes(redact) ? undefined : v;
+}
+function refusedOf(status, code, e, redact) {
+    const message = scrubbed(redact, nonEmpty(slot(e, 'message')));
+    const errorCode = scrubbed(redact, code);
+    return { kind: 'refused', status, ...(errorCode !== undefined ? { errorCode } : {}), ...(message !== undefined ? { message } : {}) };
 }
 function transportOf(v) {
     return { kind: 'transport', ...(v.name !== undefined ? { detail: v.name } : {}) };
@@ -240,3 +245,216 @@ export function rebindProvesRequestNotApplied(outcome) {
             return false;
     }
 }
+const RATE_LIMITED = 'limit.rate_exceeded';
+const ENROLLMENT_INVALID = 'device.enrollment_invalid';
+function rateLimitedOf(e) {
+    const sec = wireFailureShapeOf(e).retryAfterSec;
+    return { kind: 'rate-limited', ...(sec !== undefined ? { retryAfterSec: sec } : {}) };
+}
+function unconfirmedOf(v, redact) {
+    const name = scrubbed(redact, v.name);
+    return v.status !== undefined
+        ? { kind: 'unconfirmed', why: 'server-error', detail: String(v.status), mayStillBeRunning: true }
+        : { kind: 'unconfirmed', why: 'transport', ...(name !== undefined ? { detail: name } : {}), mayStillBeRunning: true };
+}
+const acceptedUnreadable = () => ({ kind: 'unconfirmed', why: 'accepted-unreadable', mayStillBeRunning: false });
+function localRefusal(message) {
+    return { kind: 'refused', status: 0, errorCode: 'request.field_invalid', message };
+}
+function issueFailureOf(e) {
+    const v = atMostOnceVerdictOf(e);
+    const common = commonOf(v.status, v.code);
+    if (common !== null)
+        return common.kind === 'not-found' ? refusedOf(404, NOT_FOUND, e) : common;
+    if (v.status === 429 && v.code === RATE_LIMITED)
+        return rateLimitedOf(e);
+    return v.status !== undefined ? refusedOf(v.status, v.code, e) : transportOf(v);
+}
+export async function issueEnrollToken(devices, opts) {
+    const verb = verbOf(devices, 'issueEnrollToken');
+    if (verb === undefined)
+        return { kind: 'unarmed' };
+    let body;
+    try {
+        body = await verb.call(devices, signalOpts(opts));
+    }
+    catch (e) {
+        return issueFailureOf(e);
+    }
+    const token = nonEmpty(own(body, 'token'));
+    if (token === undefined)
+        return { kind: 'unreadable', why: 'the enrollment token response carries no token — refusing to treat it as a token' };
+    const expiresAt = nonEmpty(own(body, 'expiresAt'));
+    const ttl = own(body, 'ttlSec');
+    const ttlSec = typeof ttl === 'number' && Number.isInteger(ttl) && ttl > 0 ? ttl : undefined;
+    return { kind: 'ok', token, ...(expiresAt !== undefined ? { expiresAt } : {}), ...(ttlSec !== undefined ? { ttlSec } : {}) };
+}
+function enrollFailureOf(e, token) {
+    const v = atMostOnceVerdictOf(e);
+    const common = commonOf(v.status, v.code);
+    if (common !== null)
+        return common.kind === 'not-found' ? refusedOf(404, NOT_FOUND, e, token) : common;
+    if (v.status === 403 && v.code === ENROLLMENT_INVALID)
+        return { kind: 'enrollment-invalid' };
+    if (v.status === 429 && v.code === RATE_LIMITED)
+        return rateLimitedOf(e);
+    if (v.status === 503 && v.code === SERVICE_TOKEN_REQUIRED)
+        return refusedOf(v.status, v.code, e, token);
+    if (v.delivery === 'rejected' && v.status !== undefined)
+        return refusedOf(v.status, v.code, e, token);
+    return unconfirmedOf(v, token);
+}
+export async function enrollDevice(devices, req, opts) {
+    const token = nonEmpty(own(req, 'token'));
+    const pubkey = nonEmpty(own(req, 'pubkey'));
+    const platformOs = nonEmpty(own(req, 'platformOs'));
+    const workspaceRoot = nonEmpty(own(req, 'workspaceRoot'));
+    if (token === undefined || pubkey === undefined || platformOs === undefined || workspaceRoot === undefined) {
+        return localRefusal('the enrollment request is missing a required detail (token, public key, platform or workspace root), so nothing was sent');
+    }
+    const platformArch = nonEmpty(own(req, 'platformArch'));
+    const displayName = nonEmpty(own(req, 'displayName'));
+    const verb = verbOf(devices, 'enroll');
+    if (verb === undefined)
+        return { kind: 'unarmed' };
+    const wire = {
+        token,
+        pubkey,
+        platformOs,
+        ...(platformArch !== undefined ? { platformArch } : {}),
+        ...(displayName !== undefined ? { displayName } : {}),
+        workspaceRoot,
+    };
+    let body;
+    try {
+        body = await verb.call(devices, wire, signalOpts(opts));
+    }
+    catch (e) {
+        return enrollFailureOf(e, token);
+    }
+    const deviceId = nonEmpty(own(body, 'deviceId'));
+    if (deviceId === undefined || scrubbed(token, deviceId) === undefined)
+        return acceptedUnreadable();
+    const accept = opts === undefined || opts === null ? undefined : own(opts, 'acceptDeviceId');
+    if (typeof accept === 'function') {
+        let verdict;
+        try {
+            verdict = accept(deviceId);
+        }
+        catch {
+            verdict = false;
+        }
+        if (verdict !== true)
+            return acceptedUnreadable();
+    }
+    return { kind: 'ok', deviceId };
+}
+function revokeFailureOf(e) {
+    const v = atMostOnceVerdictOf(e);
+    const common = commonOf(v.status, v.code);
+    if (common !== null)
+        return common;
+    if (v.status === 503 && v.code === SERVICE_TOKEN_REQUIRED)
+        return refusedOf(v.status, v.code, e);
+    if (v.delivery === 'rejected' && v.status !== undefined)
+        return refusedOf(v.status, v.code, e);
+    return unconfirmedOf(v);
+}
+export async function revokeDevice(devices, deviceId, opts) {
+    const id = nonEmpty(deviceId);
+    if (id === undefined)
+        return localRefusal('the device id is missing, so nothing was sent');
+    const verb = verbOf(devices, 'revoke');
+    if (verb === undefined)
+        return { kind: 'unarmed' };
+    const reason = nonEmpty(own(opts, 'reason'));
+    let body;
+    try {
+        body = await verb.call(devices, id, reason !== undefined ? { reason } : {}, signalOpts(opts));
+    }
+    catch (e) {
+        return revokeFailureOf(e);
+    }
+    if (own(body, 'deviceId') !== id || own(body, 'status') !== 'revoked')
+        return acceptedUnreadable();
+    const revokedAt = nonEmpty(own(body, 'revokedAt'));
+    return { kind: 'ok', deviceId: id, ...(revokedAt !== undefined ? { revokedAt } : {}) };
+}
+const IDENTITY_MISMATCH = 'device.identity_mismatch';
+const IDENTITY_MISMATCH_TEXT_PREFIX = `[${IDENTITY_MISMATCH}] `;
+export function deviceIdentityMismatchOf(err) {
+    if (err === null || err === undefined)
+        return null;
+    if (typeof err === 'string')
+        return err.startsWith(IDENTITY_MISMATCH_TEXT_PREFIX) ? { code: IDENTITY_MISMATCH } : null;
+    if (typeof err !== 'object' && typeof err !== 'function')
+        return null;
+    const code = readThrownSlot(err, 'errorCode', 'data');
+    const message = readThrownSlot(err, 'message');
+    if (code !== IDENTITY_MISMATCH && !(typeof message === 'string' && message.startsWith(IDENTITY_MISMATCH_TEXT_PREFIX)))
+        return null;
+    const bound = readErrorString(err, 'boundDeviceId');
+    return Object.freeze({ code: IDENTITY_MISMATCH, ...(bound !== undefined && bound !== '' ? { boundDeviceId: bound } : {}) });
+}
+export function deviceIdentityMismatchLine(detail) {
+    const bound = nonEmpty(own(detail, 'boundDeviceId'));
+    return [
+        'This session was rebound to a different device after that work was minted',
+        bound !== undefined && isDisplayableWireCode(bound) ? `It now runs on ${bound}` : 'The engine line above names the device it now runs on',
+        'The engine refuses to silently re-target it — the new device has a different workspace',
+        "Re-initiate the work on the currently bound device (the session's device binding shows which one that is)",
+    ].join(' · ');
+}
+export function deviceRegistrationOutcomeLine(verb, outcome) {
+    if (verb !== 'issue' && verb !== 'enroll' && verb !== 'revoke')
+        return undefined;
+    const kind = own(outcome, 'kind');
+    switch (kind) {
+        case 'rate-limited': {
+            const sec = own(outcome, 'retryAfterSec');
+            return typeof sec === 'number' && Number.isFinite(sec) && sec > 0
+                ? `Too many device requests were sent in a short time — wait ${sec} second${sec === 1 ? '' : 's'} and try again.`
+                : 'Too many device requests were sent in a short time — wait a moment and try again.';
+        }
+        case 'enrollment-invalid':
+            return 'Enrollment was refused. The token may have expired, may already have been used by another device, or may have been issued to a different account. Ask for a new enrollment token and try again.';
+        case 'not-found':
+            return 'No such device is visible to you — it may not exist, may belong to someone else, or may already be revoked; the engine deliberately does not say which.';
+        case 'lane-absent':
+            return own(outcome, 'runStoreOnly') === true
+                ? 'Device lane not enabled — this engine has the device lane but no run store.'
+                : 'Device lane not enabled on this engine.';
+        case 'refused': {
+            const status = own(outcome, 'status');
+            if (status === 0)
+                return 'The request is incomplete, so nothing was sent.';
+            const code = own(outcome, 'errorCode');
+            const shown = typeof code === 'string' && isDisplayableWireCode(code) ? ` ${code}` : '';
+            return `The engine refused this request (${typeof status === 'number' ? String(status) : 'no status'}${shown}).`;
+        }
+        case 'unconfirmed': {
+            const accepted = own(outcome, 'why') === 'accepted-unreadable';
+            if (verb === 'enroll') {
+                return accepted
+                    ? 'The engine accepted the enrollment but did not report the resulting device — it may be enrolled. Sending the same token and public key again is safe: it returns the same device.'
+                    : 'The enrollment request went out but no confirmation came back — the device may or may not be enrolled. Sending the same token and public key again is safe: it returns the same device.';
+            }
+            if (verb === 'revoke') {
+                return accepted
+                    ? 'The engine accepted the revocation but did not confirm it — the device may be revoked. Revoking again is safe: a second revocation succeeds without changing anything.'
+                    : 'The revocation request went out but no confirmation came back — the device may or may not be revoked. Revoking again is safe: a second revocation succeeds without changing anything.';
+            }
+            return accepted
+                ? 'The engine accepted the request but did not confirm it — it may or may not have taken effect.'
+                : 'The request went out but no confirmation came back — it may or may not have taken effect.';
+        }
+        case 'transport':
+            return 'The request did not reach the engine, or no answer came back — nothing was confirmed.';
+        case 'unreadable':
+            return 'The engine answered, but the answer could not be read.';
+        case 'unarmed':
+            return 'No device-management connection is set up here, so nothing was sent.';
+        default:
+            return undefined;
+    }
+}

package/dist/devicesFace.d.ts

@@ -0,0 +1,34 @@
+import { type SeatCapabilityReading } from './seatContract.js';
+import { type DeviceExecutorManagementReading } from './deviceExecutorManagementCapability.js';
+import type { DeviceListOutcome } from './deviceRebind.js';
+import type { UiLanguage } from './env/uiLanguage.js';
+export type DevicesFaceUnavailableWhy = 'host_not_wired' | 'host_not_reported' | 'host_report_unreadable' | 'lane_absent' | 'lane_unreported';
+export type DevicesFace = {
+    readonly kind: 'unavailable';
+    readonly why: DevicesFaceUnavailableWhy;
+} | {
+    readonly kind: 'probe_pending';
+} | {
+    readonly kind: 'probe_failed';
+    readonly retryable: true;
+    readonly cause: 'transport' | 'refused' | 'unreadable';
+} | {
+    readonly kind: 'verbs_off';
+} | {
+    readonly kind: 'manage';
+    readonly probe: boolean;
+};
+export interface DevicesFaceInput {
+    readonly host: {
+        readonly kind: 'seat';
+        readonly capability: SeatCapabilityReading;
+    } | {
+        readonly kind: 'direct';
+        readonly sliceArmed: boolean;
+    };
+    readonly engine?: DeviceExecutorManagementReading | undefined;
+    readonly lastList?: DeviceListOutcome | undefined;
+}
+export declare function devicesFaceOf(input: DevicesFaceInput): DevicesFace;
+export declare function devicesWritesAllowed(face: DevicesFace): boolean;
+export declare function devicesFaceDetail(face: DevicesFace, lang?: UiLanguage): string | undefined;

package/dist/devicesFace.js

@@ -0,0 +1,90 @@
+import { seatCapabilityUnavailableDetail } from './seatContract.js';
+import { deviceLaneOpen, deviceManagementVerbsAvailable } from './deviceExecutorManagementCapability.js';
+import { ownDataField } from './ownKey.js';
+import { msg, renderMessage } from './i18n/translate.js';
+const freeze = (v) => Object.freeze(v);
+const field = (v, key) => {
+    if (v === null || typeof v !== 'object')
+        return undefined;
+    try {
+        return ownDataField(v, key);
+    }
+    catch {
+        return undefined;
+    }
+};
+function hostProblem(host) {
+    const kind = field(host, 'kind');
+    if (kind === 'direct')
+        return field(host, 'sliceArmed') === true ? undefined : 'host_not_wired';
+    if (kind !== 'seat')
+        return 'host_report_unreadable';
+    const reading = field(host, 'capability');
+    const rk = field(reading, 'kind');
+    if (rk === 'reported')
+        return field(reading, 'available') === true ? undefined : 'host_not_wired';
+    if (rk === 'not_reported')
+        return 'host_not_reported';
+    return 'host_report_unreadable';
+}
+export function devicesFaceOf(input) {
+    const engineRaw = field(input, 'engine');
+    const engine = { kind: field(engineRaw, 'kind'), management: field(engineRaw, 'management') };
+    const lane = deviceLaneOpen(engine);
+    const listKind = field(field(input, 'lastList'), 'kind');
+    if (lane === 'no' || listKind === 'lane-absent')
+        return freeze({ kind: 'unavailable', why: 'lane_absent' });
+    const host = field(input, 'host');
+    const hostWhy = hostProblem(host);
+    if (hostWhy !== undefined)
+        return freeze({ kind: 'unavailable', why: hostWhy });
+    if (listKind === 'unarmed')
+        return freeze({ kind: 'unavailable', why: 'host_not_wired' });
+    if (lane === 'unknown') {
+        if (field(host, 'kind') === 'direct')
+            return freeze({ kind: 'unavailable', why: 'lane_unreported' });
+        if (listKind === undefined)
+            return freeze({ kind: 'probe_pending' });
+        if (listKind === 'ok')
+            return freeze({ kind: 'manage', probe: true });
+        const cause = listKind === 'transport' || listKind === 'refused' ? listKind : 'unreadable';
+        return freeze({ kind: 'probe_failed', retryable: true, cause });
+    }
+    const verbs = deviceManagementVerbsAvailable(engine);
+    if (verbs === 'no')
+        return freeze({ kind: 'verbs_off' });
+    return freeze({ kind: 'manage', probe: verbs === 'unknown' });
+}
+export function devicesWritesAllowed(face) {
+    return field(face, 'kind') === 'manage';
+}
+const UNWIRED = freeze({ kind: 'reported', available: false });
+const NOT_REPORTED = freeze({ kind: 'not_reported' });
+const MALFORMED = freeze({ kind: 'malformed' });
+export function devicesFaceDetail(face, lang) {
+    const kind = field(face, 'kind');
+    if (kind === 'manage')
+        return undefined;
+    if (kind === 'probe_pending')
+        return renderMessage(msg('session.devices.probePending'), lang);
+    if (kind === 'verbs_off')
+        return renderMessage(msg('session.devices.verbsOff'), lang);
+    if (kind === 'probe_failed') {
+        const cause = field(face, 'cause');
+        if (cause === 'transport')
+            return renderMessage(msg('session.devices.probeFailedTransport'), lang);
+        if (cause === 'refused')
+            return renderMessage(msg('session.devices.probeFailedRefused'), lang);
+        return renderMessage(msg('session.devices.probeFailedUnreadable'), lang);
+    }
+    const why = kind === 'unavailable' ? field(face, 'why') : undefined;
+    if (why === 'lane_absent')
+        return renderMessage(msg('session.devices.laneAbsent'), lang);
+    if (why === 'lane_unreported')
+        return renderMessage(msg('session.devices.laneUnreported'), lang);
+    if (why === 'host_not_wired')
+        return seatCapabilityUnavailableDetail('devices', UNWIRED);
+    if (why === 'host_not_reported')
+        return seatCapabilityUnavailableDetail('devices', NOT_REPORTED);
+    return seatCapabilityUnavailableDetail('devices', MALFORMED);
+}

package/dist/displayUntrusted.d.ts

@@ -1,5 +1,6 @@
 export declare const REDACTION_MARKER_PREFIX = "\u00ABredacted";
 export declare function looksLikeKnownSecret(s: string): boolean;
+export declare function isDiagnosticValueWord(value: string): boolean;
 export declare function washCredentials(text: string): string;
 export type DisplayMark = 'escape' | 'dot' | 'space';
 export interface DisplayFace {
@@ -43,6 +44,7 @@ export declare function credentialWashPasses(text: string, opts?: DisplayUntrust
     capped: boolean;
 };
 export declare function displayUntrusted(text: string, opts?: DisplayUntrustedOptions): string;
+export declare function cleanUntrustedScalar(v: string | number | bigint | boolean | null | undefined): string;
 export declare function queryCarriesCredential(query: string): boolean;
 export declare function displayConfiguredUrl(url: string, opts?: DisplayUntrustedOptions): string;
 export declare function quoteUntrustedForSentence(text: string, max: number): string | undefined;