@sigrun/sigrun 0.1.4 → 0.1.6

package/CHANGELOG.md

@@ -7,6 +7,67 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.6] - 2026-10-24
+### Added
+- Extension surfaces: typed block rendering, actions and uploads, live
+  transports, per-principal access control, and web/TUI surface views.
+- Web and TUI block renderers: content, charts, collections, forms,
+  navigation, live updates, and extension-provided views.
+
+### Fixed
+- The container image preserves the core, webui, shared, and TUI build
+  output paths and compiles the TUI workspace. The published 0.1.5 image
+  flattened core `dist/` into `/app`, so `node dist/index.js` could not
+  start. CI now smoke-checks the built image's runtime layout.
+
+### Changed
+- `@sigrun/shared` 0.1.2: surface and block-instance wire types.
+- `@sigrun/tui` 0.1.1: extension surfaces and the full block renderer.
+- Fastify 5.12.7 and `@fastify/static` 10.1.7 address the server's
+  header-validation and static-file path/authorization advisories; the
+  patched `fast-uri` transitive releases address its URI-normalization
+  advisories. `npm audit` reports zero vulnerabilities.
+
+### Security
+- Agent shells no longer inherit sigrun's environment. pi-durable's bash
+  tool ran every command with the server's full environment, so an
+  agent's `env` printed `SIGRUN_API_TOKEN`, `SIGRUN_PROXY_SECRET` and
+  provider keys. Every command now gets an allowlist (`PATH`, `HOME`,
+  `TMPDIR`, `LANG`, `LC_*`, `TZ`, `TERM`, `USER`, `LOGNAME`, `SHELL`,
+  `NPM_CONFIG_CACHE`, `SSH_AUTH_SOCK`) plus whatever the calling tool
+  sets. `NODE_ENV=production` from the image no longer reaches agent
+  shells, so an agent's `npm install` installs devDependencies again.
+  The bundled MCP extension's stdio servers get the same allowlist.
+
+## [0.1.5] - 2026-10-23
+### Added
+- The image + chart release pipeline: multi-arch (amd64/arm64) container
+  image on `ghcr.io/sigrun-ai/sigrun` and the Helm chart on GHCR's OCI
+  registry (`charts/sigrun/sigrun`), built and published by GitHub Actions
+  on `v*` tags. CI builds and lints both on every PR and main push.
+- The chart manages the extension fleet declaratively: a `sigrun:` values
+  block seeds `settings.json` (fleet list + chart-owned keys re-asserted
+  every boot, per-slug extension settings seed-once), passes secret
+  references through envFrom (never values), and installs deploy-time
+  tools (kubectl/helm/talosctl/flux/k9s) hash-cached onto persistent
+  storage via an initContainer.
+- Deploy hardening: non-root image with a privilege-drop entrypoint (uid
+  1000 default, overridable), agent userland baked in (ripgrep, fd, jq,
+  git, sqlite3), hardened compose defaults (read-only rootfs, caps
+  dropped, init, no-new-privileges).
+- Block-set foundation (`@sigrun/shared/blocks`): the canonical block
+  tree wire types, ops, text rendering and transport shared by server and
+  clients.
+- Gateway core seams: extension `channels` contribution field, the
+  gateway engine field with lifecycle + shutdown ordering, host-surface
+  conversation ops, upload/readFile/models/commands, interaction answer
+  attribution (`interactionSettled`), group-derived admin persisted for
+  host-side checks, and deliver-targets on prompt jobs
+  (`@sigrun/shared/live` narrows the live-doc wire).
+
+### Changed
+- `@sigrun/shared` 0.1.1: new `./live` and `./blocks` export subpaths
+  (all 0.1.0 subpaths unchanged).
 ## [0.1.4] - 2026-10-22
 ### Added
 - The version is visible where operators look: the boot log line (`sigrun

package/README.md

@@ -286,6 +286,20 @@ configurable) when the request comes from a peer inside
 proxy and nothing else: every peer in `trustedProxies` can forge any
 identity, including an admin.
 
+**Group-derived admin (persisted).** `server.auth.adminGroups` lists
+the proxy groups (Authelia's `Remote-Groups`) whose members act as
+admins. The request pipeline computes the grant per request and
+writes it through to the user's directory record as `groupAdmin`
+whenever it differs — so host-side surfaces with no request headers
+(chat commands, channel adapters) see effective admin (`admin ||
+groupAdmin`), while `/v1/users` keeps `admin` as the stored flag the
+users-admin UI toggles and shows `groupAdmin` alongside. The grant
+moves only on proxy-authenticated requests while `adminGroups` is
+non-empty: removal from the admin group takes effect at that user's
+next web request. Group-derived admin never counts toward the
+last-admin guard — demoting or deleting the only stored admin is
+still refused.
+
 **Onboarding (the first claim).** An unclaimed server serves
 `GET /v1/onboarding` + `POST /v1/onboarding/claim`. On a loopback bind
 or through a trusted proxy identity the claim needs no code; otherwise
@@ -640,8 +654,16 @@ is read-only for them (`PATCH`/`DELETE` return `409 job_declared`).
 A `prompt` action submits its prompt as a conversation — `"new"`
 creates one per fire (ownerless, `source: "cron"`), a fixed id submits
 into that conversation (the job's `model`/`thinking` apply only to
-`"new"`). A `task` action creates a pi-durable task owned by the
-schedule task (deleting the job cascades): `{"kind": "task",
+`"new"`). A `prompt` action may also carry `deliver`: an array of
+1–8 gateway delivery targets (each 1–256 chars), valid only with
+`conversation: "new"` — the run's answer is delivered to those chats
+by the loaded gateway engine. The targets are stamped onto the run
+conversation's meta alongside the owning `jobId` (both server-owned,
+never PATCHable); with no engine loaded each fire logs one
+`deliver targets ignored: no gateway` warning, and editing the targets
+is a job revision like any other spec change. A `task` action creates
+a pi-durable task owned by the schedule task (deleting the job
+cascades): `{"kind": "task",
 "task": "<registered task name>", "input": …}`.
 
 **Runs:** a cron run is an ORDINARY CONTINUABLE CONVERSATION — open the

package/THIRD_PARTY_NOTICES.md

@@ -1,5 +1,28 @@
 # Third-party notices
 
+## Lucide
+
+- <https://lucide.dev>
+- The webui's block-set icons (`webui/src/blocks/icons.tsx`) are inline
+  SVGs whose stroke geometry is copied from Lucide (v0.577.0), resized
+  and coloured by the block renderer.
+
+ISC License
+
+Copyright (c) 2020, Lucide Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
 ## hermes-webui
 
 - <https://github.com/nesquena/hermes-webui>

package/dist/blocks/builders.js

@@ -0,0 +1,125 @@
+/**
+ * The typed builders (spec §14.1): one function per block and field,
+ * plus `bind(pointer)` and `tree(root)`. Builders return plain JSON —
+ * there is no runtime besides them.
+ *
+ * Each builder takes its block's props object and returns the block
+ * with the `type` literal stamped in. The literal is spread LAST, so a
+ * stray `type` inside a JavaScript caller's props object can never
+ * override it; TypeScript callers cannot pass one at all (`Props` omits
+ * it). The tree BLOCK builder is exported as `treeBlock`, keeping the
+ * `tree` name for the version-stamping root wrapper.
+ *
+ * `tree(root)` stamps {@link BLOCK_SET_VERSION} from the shared wire
+ * package — the version the SERVER validates against, which is why
+ * extensions import these builders from `@sigrun/sigrun/blocks` (the
+ * host-linked copy, spec §14.1) instead of bundling their own.
+ */
+import { BLOCK_SET_VERSION } from "@sigrun/shared/blocks";
+/** `bind("/cards")` → `{ $: "/cards" }` — a pointer into the surface's data model (§4.2). */
+export function bind(pointer) {
+    return { $: pointer };
+}
+/** Wrap a root block with the server's block-set version (§4.4). */
+export function tree(root) {
+    return { v: BLOCK_SET_VERSION, root };
+}
+// ─── Shell (§5.1) ─────────────────────────────────────────────────────────
+export function page(props) {
+    return { ...props, type: "page" };
+}
+// ─── Layout (§5.2) ────────────────────────────────────────────────────────
+export function stack(props) {
+    return { ...props, type: "stack" };
+}
+export function columns(props) {
+    return { ...props, type: "columns" };
+}
+export function grid(props) {
+    return { ...props, type: "grid" };
+}
+export function section(props) {
+    return { ...props, type: "section" };
+}
+// ─── Content (§5.3) ───────────────────────────────────────────────────────
+export function markdown(props) {
+    return { ...props, type: "markdown" };
+}
+export function fields(props) {
+    return { ...props, type: "fields" };
+}
+export function stat(props) {
+    return { ...props, type: "stat" };
+}
+export function callout(props) {
+    return { ...props, type: "callout" };
+}
+export function image(props) {
+    return { ...props, type: "image" };
+}
+// ─── Chart (§5.4) ─────────────────────────────────────────────────────────
+export function chart(props) {
+    return { ...props, type: "chart" };
+}
+// ─── Meter / log / tree / diff / details (§5.3) ───────────────────────────
+export function meter(props) {
+    return { ...props, type: "meter" };
+}
+export function log(props) {
+    return { ...props, type: "log" };
+}
+/** The tree BLOCK builder (§5.3) — `tree` is the root wrapper. */
+export function treeBlock(props) {
+    return { ...props, type: "tree" };
+}
+export function diff(props) {
+    return { ...props, type: "diff" };
+}
+export function details(props) {
+    return { ...props, type: "details" };
+}
+// ─── Collection (§5.5) and the card template (§5.5.1) ────────────────────
+export function collection(props) {
+    return { ...props, type: "collection" };
+}
+/** The collection item template (§5.5.1) — a slot bundle, not a block. */
+export function card(props) {
+    return { ...props };
+}
+// ─── Form and fields (§5.6) ───────────────────────────────────────────────
+export function form(props) {
+    return { ...props, type: "form" };
+}
+export function text(props) {
+    return { ...props, type: "text" };
+}
+export function longtext(props) {
+    return { ...props, type: "longtext" };
+}
+export function number(props) {
+    return { ...props, type: "number" };
+}
+export function toggle(props) {
+    return { ...props, type: "toggle" };
+}
+export function choice(props) {
+    return { ...props, type: "choice" };
+}
+export function date(props) {
+    return { ...props, type: "date" };
+}
+export function datetime(props) {
+    return { ...props, type: "datetime" };
+}
+export function daterange(props) {
+    return { ...props, type: "daterange" };
+}
+export function secret(props) {
+    return { ...props, type: "secret" };
+}
+export function file(props) {
+    return { ...props, type: "file" };
+}
+export function list(props) {
+    return { ...props, type: "list" };
+}

package/dist/blocks/images.js

@@ -0,0 +1,57 @@
+/**
+ * Image source rules (spec §11.1): `asset:` paths, `data:` URLs of the
+ * four accepted MIME types (capped at 192 KiB of base64 text), and
+ * `https:` URLs. SVG and AVIF are never accepted (script payload; no
+ * TUI decoder), and `http:` URLs are rejected. The proxy that rewrites
+ * and fetches is U7; this module only validates.
+ */
+/** Max base64 characters in a `data:` image URL (spec §11.1: 192 KiB). */
+const MAX_DATA_URL_CHARS = 192 * 1024;
+/** MIME types a `data:` URL may carry. */
+const DATA_MIME_TYPES = new Set(["image/png", "image/jpeg", "image/gif", "image/webp"]);
+/**
+ * Check one image `src` against the §11.1 source rules. Bindings
+ * (`{$: …}` objects) are not checked here — their resolved string is,
+ * where the data model holds one (the data-size limit already covers
+ * the byte cost).
+ */
+export function checkImageSource(src) {
+    if (src.startsWith("asset:")) {
+        const path = src.slice("asset:".length);
+        if (path.length === 0)
+            return { ok: false, message: "asset: path is empty" };
+        return { ok: true, kind: "asset" };
+    }
+    if (src.startsWith("data:")) {
+        const comma = src.indexOf(",");
+        if (comma === -1)
+            return { ok: false, message: "data: URL has no payload" };
+        const meta = src.slice("data:".length, comma);
+        const payload = src.slice(comma + 1);
+        const [type, ...params] = meta.split(";");
+        const normalized = type.toLowerCase();
+        if (!DATA_MIME_TYPES.has(normalized)) {
+            return {
+                ok: false,
+                message: `data: URL type ${type || "(empty)"} is not one of png, jpeg, gif, webp (svg and avif are never accepted)`,
+            };
+        }
+        if (!params.includes("base64")) {
+            return { ok: false, message: "data: URL must be base64" };
+        }
+        if (payload.length > MAX_DATA_URL_CHARS) {
+            return {
+                ok: false,
+                message: `data: URL payload is ${payload.length} base64 characters, over the 192 KiB cap`,
+            };
+        }
+        return { ok: true, kind: "data" };
+    }
+    if (/^https:\/\//.test(src)) {
+        return { ok: true, kind: "https" };
+    }
+    if (/^http:\/\//.test(src)) {
+        return { ok: false, message: "http: image URLs are rejected; use https" };
+    }
+    return { ok: false, message: "image src must be asset:, data: (png/jpeg/gif/webp) or https:" };
+}

package/dist/blocks/index.js

@@ -0,0 +1,20 @@
+/**
+ * `@sigrun/sigrun/blocks` — the extension authoring surface for the
+ * block set (spec §14.1): the typed builders, the wire types, and
+ * `validateTree` (§14.2) so an extension can unit-test its trees
+ * against the same validation the server runs.
+ *
+ * Extensions import this subpath, never a bundled copy: the package is
+ * a `peerDependency: "*"` (see docs/extending.md) and
+ * `@sigrun/sigrun` is a HOST RUNTIME MODULE (src/harness/packages.ts)
+ * — the host links its own running copy into every extension packages
+ * dir, so `tree(...)` always stamps the server's
+ * {@link BLOCK_SET_VERSION}. The `exports` map points here at
+ * `dist/blocks/index.js` (never `src/`), which is what the built
+ * server ships.
+ */
+export * from "./builders.js";
+export { validateTree, validateData, VALID_PLACEMENTS, PLACEMENT_RULES, LIMITS, } from "./validate.js";
+// The wire contract (§4/§5/§6.1) and the block-set version constant,
+// verbatim from the shared leaf — one import site for extension code.
+export { BLOCK_SET_VERSION } from "@sigrun/shared/blocks";

package/dist/blocks/limits.js

@@ -0,0 +1,26 @@
+/**
+ * The per-placement size limits of spec §4.5: max blocks per tree, and
+ * max UTF-8 bytes of the serialized JSON for the tree and the data.
+ *
+ * Over a limit the server rejects with `413 surface_too_large` naming
+ * the limit; `validateTree`/`validateData` surface the same error
+ * strings. A collection counts as one block however many items it
+ * binds, and a `data:` image URL counts toward whichever of the tree or
+ * the data holds it (the sizes are measured over the serialized JSON,
+ * so both hold by construction).
+ */
+const KiB = 1024;
+const MiB = 1024 * 1024;
+/** Spec §4.5, one row per placement. */
+export const LIMITS = {
+    chat: { blocks: 200, treeBytes: 256 * KiB, dataBytes: 256 * KiB },
+    interaction: { blocks: 100, treeBytes: 64 * KiB, dataBytes: 64 * KiB },
+    ambient: { blocks: 100, treeBytes: 64 * KiB, dataBytes: 64 * KiB },
+    view: { blocks: 2000, treeBytes: MiB, dataBytes: 4 * MiB },
+    panel: { blocks: 2000, treeBytes: MiB, dataBytes: 4 * MiB },
+    settings: { blocks: 2000, treeBytes: MiB, dataBytes: 4 * MiB },
+};
+/** UTF-8 byte length of a value's serialized JSON (spec §4.5 sizing). */
+export function jsonBytes(value) {
+    return Buffer.byteLength(JSON.stringify(value), "utf8");
+}

package/dist/blocks/placements.js

@@ -0,0 +1,99 @@
+/**
+ * The placement rules of spec §5.7, as data: which blocks, which
+ * collection displays and which form fields each placement allows,
+ * plus the root-block and `page.sidebar` constraints the table carries.
+ *
+ * `validateTree` walks a tree against these rules; the tests pin the
+ * table's literal cells so this data cannot drift from the spec.
+ */
+const ALL_BLOCKS = [
+    "page",
+    "stack",
+    "columns",
+    "grid",
+    "section",
+    "markdown",
+    "fields",
+    "stat",
+    "callout",
+    "image",
+    "chart",
+    "meter",
+    "log",
+    "tree",
+    "diff",
+    "details",
+    "collection",
+    "form",
+];
+const ALL_FIELDS = [
+    "text",
+    "longtext",
+    "number",
+    "toggle",
+    "choice",
+    "date",
+    "datetime",
+    "daterange",
+    "secret",
+    "file",
+    "list",
+];
+function rule(init) {
+    return {
+        blocks: new Set(init.blocks),
+        rootBlock: init.rootBlock,
+        pageSidebar: init.pageSidebar ?? true,
+        collectionDisplays: init.collectionDisplays,
+        fields: new Set(init.fields),
+    };
+}
+const CONTENT = ["markdown", "fields", "callout", "diff", "details"];
+const STAT_METER_LOG = ["stat", "meter", "log"];
+const CHART_IMAGE_TREE = ["chart", "image", "tree"];
+const ALL_COLLECTION_DISPLAYS = ["list", "table", "lanes", "grid", "calendar"];
+/** Spec §5.7, one row per placement. */
+export const PLACEMENT_RULES = {
+    // view: everything; a required page root.
+    view: rule({
+        blocks: ALL_BLOCKS,
+        rootBlock: "page",
+        pageSidebar: true,
+        fields: ALL_FIELDS,
+    }),
+    // panel: everything but a sidebar on the page root.
+    panel: rule({
+        blocks: ALL_BLOCKS,
+        rootBlock: "page",
+        pageSidebar: false,
+        fields: ALL_FIELDS,
+    }),
+    // settings: section + content + stat-free; forms only at the root;
+    // collections limited to list/table; all fields but file.
+    settings: rule({
+        blocks: ["section", ...CONTENT, "collection", "form"],
+        rootBlock: "form",
+        collectionDisplays: ["list", "table"],
+        fields: ALL_FIELDS.filter((f) => f !== "file"),
+    }),
+    // chat: everything but page; all fields but secret.
+    chat: rule({
+        blocks: ALL_BLOCKS.filter((b) => b !== "page"),
+        fields: ALL_FIELDS.filter((f) => f !== "secret"),
+    }),
+    // interaction: stack/section layout, content, list collections, and a
+    // required form root with the ask-user subset of fields.
+    interaction: rule({
+        blocks: ["stack", "section", ...CONTENT, "collection", "form"],
+        rootBlock: "form",
+        collectionDisplays: ["list"],
+        fields: ["text", "longtext", "number", "toggle", "choice", "secret"],
+    }),
+    // ambient: stack/columns layout, content, stat/meter/log, list
+    // collections; no forms (§9.2 records render read-only state).
+    ambient: rule({
+        blocks: ["stack", "columns", ...CONTENT, ...STAT_METER_LOG, "collection"],
+        collectionDisplays: ["list"],
+        fields: [],
+    }),
+};