@sigrun/sigrun 0.1.6 → 0.2.0

package/dist/server/schema-fixture.js

@@ -444,6 +444,65 @@ export const VIEW_SCHEMA = {
                                                         }
                                                     }
                                                 },
+                                                {
+                                                    "kind": "object",
+                                                    "fields": {
+                                                        "name": {
+                                                            "kind": "string"
+                                                        },
+                                                        "description": {
+                                                            "kind": "string"
+                                                        },
+                                                        "parameters": {
+                                                            "kind": "object",
+                                                            "fields": {
+                                                                "type": {
+                                                                    "kind": "string"
+                                                                },
+                                                                "required": {
+                                                                    "kind": "array",
+                                                                    "variants": [
+                                                                        {
+                                                                            "kind": "string"
+                                                                        }
+                                                                    ]
+                                                                },
+                                                                "properties": {
+                                                                    "kind": "object",
+                                                                    "fields": {
+                                                                        "title": {
+                                                                            "kind": "object",
+                                                                            "fields": {
+                                                                                "type": {
+                                                                                    "kind": "string"
+                                                                                },
+                                                                                "description": {
+                                                                                    "kind": "string"
+                                                                                }
+                                                                            }
+                                                                        },
+                                                                        "tree": {
+                                                                            "kind": "object",
+                                                                            "fields": {
+                                                                                "description": {
+                                                                                    "kind": "string"
+                                                                                }
+                                                                            }
+                                                                        },
+                                                                        "data": {
+                                                                            "kind": "object",
+                                                                            "fields": {
+                                                                                "description": {
+                                                                                    "kind": "string"
+                                                                                }
+                                                                            }
+                                                                        }
+                                                                    }
+                                                                }
+                                                            }
+                                                        }
+                                                    }
+                                                },
                                                 {
                                                     "kind": "object",
                                                     "fields": {
@@ -541,6 +600,137 @@ export const VIEW_SCHEMA = {
                                                         }
                                                     }
                                                 },
+                                                {
+                                                    "kind": "object",
+                                                    "fields": {
+                                                        "name": {
+                                                            "kind": "string"
+                                                        },
+                                                        "description": {
+                                                            "kind": "string"
+                                                        },
+                                                        "parameters": {
+                                                            "kind": "object",
+                                                            "fields": {
+                                                                "type": {
+                                                                    "kind": "string"
+                                                                },
+                                                                "required": {
+                                                                    "kind": "array",
+                                                                    "variants": [
+                                                                        {
+                                                                            "kind": "string"
+                                                                        }
+                                                                    ]
+                                                                },
+                                                                "properties": {
+                                                                    "kind": "object",
+                                                                    "fields": {
+                                                                        "entryId": {
+                                                                            "kind": "object",
+                                                                            "fields": {
+                                                                                "type": {
+                                                                                    "kind": "string"
+                                                                                },
+                                                                                "description": {
+                                                                                    "kind": "string"
+                                                                                }
+                                                                            }
+                                                                        },
+                                                                        "ops": {
+                                                                            "kind": "object",
+                                                                            "fields": {
+                                                                                "type": {
+                                                                                    "kind": "string"
+                                                                                },
+                                                                                "items": {
+                                                                                    "kind": "object",
+                                                                                    "fields": {}
+                                                                                },
+                                                                                "description": {
+                                                                                    "kind": "string"
+                                                                                }
+                                                                            }
+                                                                        }
+                                                                    }
+                                                                }
+                                                            }
+                                                        }
+                                                    }
+                                                },
+                                                {
+                                                    "kind": "object",
+                                                    "fields": {
+                                                        "name": {
+                                                            "kind": "string"
+                                                        },
+                                                        "description": {
+                                                            "kind": "string"
+                                                        },
+                                                        "parameters": {
+                                                            "kind": "object",
+                                                            "fields": {
+                                                                "type": {
+                                                                    "kind": "string"
+                                                                },
+                                                                "required": {
+                                                                    "kind": "array",
+                                                                    "variants": [
+                                                                        {
+                                                                            "kind": "string"
+                                                                        }
+                                                                    ]
+                                                                },
+                                                                "properties": {
+                                                                    "kind": "object",
+                                                                    "fields": {
+                                                                        "to": {
+                                                                            "kind": "object",
+                                                                            "fields": {
+                                                                                "type": {
+                                                                                    "kind": "string"
+                                                                                },
+                                                                                "description": {
+                                                                                    "kind": "string"
+                                                                                }
+                                                                            }
+                                                                        },
+                                                                        "text": {
+                                                                            "kind": "object",
+                                                                            "fields": {
+                                                                                "type": {
+                                                                                    "kind": "string"
+                                                                                },
+                                                                                "description": {
+                                                                                    "kind": "string"
+                                                                                }
+                                                                            }
+                                                                        },
+                                                                        "files": {
+                                                                            "kind": "object",
+                                                                            "fields": {
+                                                                                "type": {
+                                                                                    "kind": "string"
+                                                                                },
+                                                                                "items": {
+                                                                                    "kind": "object",
+                                                                                    "fields": {
+                                                                                        "type": {
+                                                                                            "kind": "string"
+                                                                                        }
+                                                                                    }
+                                                                                },
+                                                                                "description": {
+                                                                                    "kind": "string"
+                                                                                }
+                                                                            }
+                                                                        }
+                                                                    }
+                                                                }
+                                                            }
+                                                        }
+                                                    }
+                                                },
                                                 {
                                                     "kind": "object",
                                                     "fields": {
@@ -791,6 +981,29 @@ export const VIEW_SCHEMA = {
                                                             }
                                                         }
                                                     }
+                                                },
+                                                {
+                                                    "kind": "object",
+                                                    "fields": {
+                                                        "name": {
+                                                            "kind": "string"
+                                                        },
+                                                        "description": {
+                                                            "kind": "string"
+                                                        },
+                                                        "parameters": {
+                                                            "kind": "object",
+                                                            "fields": {
+                                                                "type": {
+                                                                    "kind": "string"
+                                                                },
+                                                                "properties": {
+                                                                    "kind": "object",
+                                                                    "fields": {}
+                                                                }
+                                                            }
+                                                        }
+                                                    }
                                                 }
                                             ]
                                         },

package/dist/server/session-meta.js

@@ -219,6 +219,9 @@ export function applySessionMetaPatch(draft, patch) {
             draft.sharing = {
                 scope: "people",
                 users: [...patch.sharing.users],
+                ...(patch.sharing.groups === undefined
+                    ? {}
+                    : { groups: [...patch.sharing.groups] }),
                 level: patch.sharing.level,
             };
         }

package/dist/server/shutdown.js

@@ -1,6 +1,6 @@
 /**
  * The ordered shutdown (gateway C2's extraction of serve.ts's inline
- * `shutdown`): seven steps, each in its own try/catch so a failure never
+ * `shutdown`): eight steps, each in its own try/catch so a failure never
  * skips the remaining steps, with every failure collected into one
  * `AggregateError("sigrun shutdown failed")` after ALL steps ran (the
  * pre-extraction semantics, byte-for-byte).
@@ -20,15 +20,16 @@
  *    settles, then deliver `harnessShutdown` — handlers may commit);
  * 5. `gateway.stop` — the engine stops only once every settle has been
  *    delivered (its adapters' outbound side saw the final answers);
- * 6. `stopProviderRefresh` — the interval scheduler + the bounded
+ * 6. `stopSandboxWorkers` — all per-user workers and their commands stop;
+ * 7. `stopProviderRefresh` — the interval scheduler + the bounded
  *    boot-refresh join (no catalog fetch outlives the shutdown);
- * 7. `closeHarness` — the seal (joins tasks, seals storage).
+ * 8. `closeHarness` — the seal (joins tasks, seals storage).
  *
  * Does NOT exit the process — the caller owns exit policy (the deploy
  * entry exits 0/1; the CLI's `run` returns to its exit code).
  */
 /**
- * Build the ordered shutdown over the seven steps. Failures from ANY step
+ * Build the ordered shutdown over the eight steps. Failures from ANY step
  * are collected (the remaining steps still run) and thrown together as
  * `AggregateError(failures, "sigrun shutdown failed")` at the end; a clean
  * run resolves.
@@ -66,6 +67,12 @@ export function createShutdown(steps) {
         catch (error) {
             failures.push(error);
         }
+        try {
+            await steps.stopSandboxWorkers();
+        }
+        catch (error) {
+            failures.push(error);
+        }
         try {
             await steps.stopProviderRefresh();
         }

package/dist/server/static.js

@@ -147,6 +147,17 @@ export async function serveWebuiBundle(app, bundle) {
     await app.register(fastifyStatic, {
         root: bundle.dir,
         prefix: "/",
+        // U7 Task 3 (spec §11.2): the webui's HTML responses carry the
+        // one-directive CSP — remote https image sources are already
+        // rewritten to the /v1/image proxy at serve time, so img-src
+        // stays closed to the server itself plus data: URLs. A single
+        // img-src directive restricts images and nothing else: scripts
+        // and styles are unaffected. Static ASSETS keep no CSP.
+        setHeaders(res, path) {
+            if (path.endsWith(".html")) {
+                res.header("content-security-policy", "img-src 'self' data:");
+            }
+        },
     });
     app.setNotFoundHandler(async (request, reply) => {
         const path = (request.raw.url ?? "/").split("?")[0] ?? "/";
@@ -156,6 +167,13 @@ export async function serveWebuiBundle(app, bundle) {
             return await reply
                 .code(200)
                 .type("text/html; charset=utf-8")
+                // U7 Task 3 (spec §11.2): the webui's HTML responses carry
+                // the one-directive CSP — remote https image sources are
+                // already rewritten to the /v1/image proxy at serve time, so
+                // img-src stays closed to the server itself plus data: URLs.
+                // A single img-src directive restricts images and nothing
+                // else: scripts and styles are unaffected.
+                .header("content-security-policy", "img-src 'self' data:")
                 .send(bundle.indexHtml);
         }
         // Fastify's default 404 body shape, restated so the API error surface

package/dist/server/surfaces/dedup.js

@@ -35,7 +35,7 @@ export class ActionDedup {
      * duplicate, `undefined` when never seen, `null` when the actionId
      * belongs to a different instance (treated as fresh by the caller).
      */
-    check(actionId, composite) {
+    check(actionId, composite, fingerprint) {
         const entry = this.entries.get(actionId);
         if (entry === undefined)
             return undefined;
@@ -45,12 +45,19 @@ export class ActionDedup {
         }
         if (entry.composite !== composite)
             return null;
+        // A fingerprint mismatch is NOT a retry (the class docstring's
+        // rule): the id was reused by another client, so the caller runs
+        // the handler. The new result OVERWRITES the record (the latest
+        // invocation owns the id from here).
+        if (entry.fingerprint !== fingerprint)
+            return undefined;
         return { result: entry.result };
     }
     /** Record the first result of one actionId for one instance. */
-    record(actionId, composite, result) {
+    record(actionId, composite, fingerprint, result) {
         this.entries.set(actionId, {
             composite,
+            fingerprint,
             result,
             expiresAt: this.clock() + DEDUP_WINDOW_MS,
         });

package/dist/server/surfaces/service.js

@@ -24,12 +24,14 @@
  * maps it to `500 surface_failed` (bodies carry `errors` only when
  * `server.dev`). The extension stays loaded.
  */
+import { rewriteImages } from "../images/rewrite.js";
 import { validateTree } from "../../blocks/validate.js";
 import { AccessCache } from "./access-cache.js";
 import { ActionDedup } from "./dedup.js";
 import { eventKey, instanceKey as defaultInstanceKey } from "./instance.js";
 import { sniffMime } from "./mime.js";
 import { ActionRateLimit } from "./rate-limit.js";
+import { NamedUserRequiredError } from "./settings-surfaces.js";
 import { WatcherRegistry } from "./watchers.js";
 /** The shared-data op-log window (spec §7.3): the last 100 updates. */
 export const SHARED_OPS_WINDOW = 100;
@@ -40,6 +42,21 @@ const TIMED_OUT_RESULT = {
     ok: false,
     error: { message: "timed out" },
 };
+/**
+ * The reserved chat "slug" (spec §8.2): a NUL byte can never appear in
+ * an extension slug, so chat composites never collide with one.
+ */
+export const CHAT_SURFACE_SLUG = "\u0000chat";
+/** Decompose either address form into the service's table keys. */
+function partsOf(address) {
+    return "conversationId" in address
+        ? {
+            slug: CHAT_SURFACE_SLUG,
+            id: String(address.conversationId),
+            key: address.entryId,
+        }
+        : { slug: address.slug, id: address.id, key: address.key };
+}
 /** Errors `act` reports without calling the handler. */
 export class ActionRateLimitedError extends Error {
     constructor() {
@@ -119,12 +136,25 @@ export class SurfaceService {
     maxUploadBytes;
     watchers;
     publishChanged;
+    /** The image-signer (U7 Task 1, spec §11.2): every tree/data response passes through the rewriter before leaving the server. */
+    imageSign;
+    extra = [];
     constructor(bindings, options) {
         this.bindings = bindings;
+        this.extra.push(...(options?.settingsSurfaces ?? []));
         this.cache = new AccessCache();
         this.maxUploadBytes = options?.maxUploadBytes ?? Number.MAX_SAFE_INTEGER;
         this.watchers = options?.watchers ?? new WatcherRegistry();
         this.publishChanged = options?.publishChanged;
+        this.imageSign = options?.imageSign;
+    }
+    /**
+     * Attach the settings surfaces post-construction (their save
+     * handlers close over THIS service for the optimistic-concurrency
+     * rev read, so they can only be built once the service exists).
+     */
+    attachSettingsSurfaces(extra) {
+        this.extra.push(...extra);
     }
     /** The watcher registry (the events route reads it per event). */
     get watcherRegistry() {
@@ -139,12 +169,19 @@ export class SurfaceService {
             if (def !== undefined)
                 return { slug, def };
         }
+        for (const binding of this.extra) {
+            if (binding.extension !== slug)
+                continue;
+            const def = binding.defs.find((entry) => entry.id === id);
+            if (def !== undefined)
+                return { slug, def };
+        }
         return undefined;
     }
     /** The instance key: the surface's own `instanceKey` or the default. */
-    keyFor(def, params) {
+    keyFor(def, params, principal) {
         if (def.instanceKey !== undefined)
-            return def.instanceKey(params);
+            return def.instanceKey(params, principal);
         return defaultInstanceKey(params);
     }
     /** The per-instance state, created on first touch (revs start at 0). */
@@ -166,7 +203,7 @@ export class SurfaceService {
         const located = this.locate(slug, id);
         if (located === undefined)
             return undefined;
-        const key = this.keyFor(located.def, params);
+        const key = this.keyFor(located.def, params, principal);
         const result = await this.callRender(located, key, params, principal);
         const validation = validateTree(result.tree, {
             placement: located.def.placement,
@@ -197,8 +234,11 @@ export class SurfaceService {
             }
         }
         return {
-            tree: validation.tree,
-            data: result.data,
+            // SAFETY: the rewriter is a structural JSON walk returning the same
+            // shape; `Tree` (interfaces) has no implicit index signature, so the
+            // generic JsonValue round-trip needs the bridge cast.
+            tree: this.rewriteForWire(validation.tree),
+            data: this.rewriteForWire(result.data),
             rev: state.rev,
             treeRev: state.treeRev,
             access: result.access,
@@ -215,7 +255,7 @@ export class SurfaceService {
         const located = this.locate(slug, id);
         if (located === undefined)
             return undefined;
-        const key = this.keyFor(located.def, params);
+        const key = this.keyFor(located.def, params, principal);
         const state = this.stateFor(slug, id, key);
         const access = await this.accessFor(slug, id, key, params, principal);
         if (access === "none")
@@ -231,7 +271,18 @@ export class SurfaceService {
             const ops = state.ops
                 .filter((entry) => entry.rev > since)
                 .flatMap((entry) => entry.ops);
-            return { rev: state.rev, treeRev: state.treeRev, ops };
+            // Ops answers are data responses too (spec §7.3): the client folds
+            // them into its local copy, so they must carry the SAME rewritten
+            // sources the full data answer would — else fold(data, ops) drifts
+            // from the server's data.
+            return {
+                rev: state.rev,
+                treeRev: state.treeRev,
+                // SAFETY: ops are wire JSON (DataOp values); the rewriter returns
+                // the same shape, and `unknown[]`'s lack of an index signature is
+                // the only reason for the bridge cast.
+                ops: this.rewriteForWire(ops),
+            };
         }
         let data;
         let access2;
@@ -274,7 +325,20 @@ export class SurfaceService {
         if (located.def.sharedData !== true) {
             state.rev += 1;
         }
-        return { rev: state.rev, treeRev: state.treeRev, data };
+        return { rev: state.rev, treeRev: state.treeRev, data: this.rewriteForWire(data) };
+    }
+    /**
+     * The wire-side image rewrite (U7 Task 1, spec §11.1/§11.2): every
+     * tree and data (and ops) response passes through `rewriteImages`
+     * before leaving the server, replacing https image sources with
+     * signed proxy URLs. Absent signer → verbatim pass-through. This is
+     * the hook point U5's chat surfaces reuse when they land: they call
+     * the same `rewriteImages` over their trees/data.
+     */
+    rewriteForWire(value) {
+        return this.imageSign === undefined
+            ? value
+            : rewriteImages(value, this.imageSign);
     }
     /**
      * One principal's access to one instance (spec §6.5): the cached
@@ -292,8 +356,8 @@ export class SurfaceService {
         return result.access;
     }
     /** The composite instance key (`slug
id
key`) for one def + params. */
-    compositeFor(slug, def, params) {
-        return `${slug}
${def.id}
${this.keyFor(def, params)}`;
+    compositeFor(slug, def, params, principal) {
+        return `${slug}
${def.id}
${this.keyFor(def, params, principal)}`;
     }
     /**
      * The effective upload cap for one field (spec §7.1): the field's
@@ -344,18 +408,48 @@ export class SurfaceService {
             throw new ActionRateLimitedError();
         }
         const composite = `${slug}
${id}
${key}`;
+        // The request fingerprint (action + params + payload)
+        // disambiguates a RETRY (same body — replay the stored result)
+        // from an actionId REUSE (a second client whose channel restarted
+        // its id sequence — two tabs of one webui share the module-level
+        // counter; U4 Task 4).
+        const fingerprint = JSON.stringify({ action, params, payload });
         if (actionId !== undefined) {
-            const hit = this.dedup.check(actionId, composite);
+            const hit = this.dedup.check(actionId, composite, fingerprint);
             if (hit !== undefined && hit !== null)
                 return hit.result;
         }
-        const result = await this.invokeWithTimeout(() => handler({ principal, params, key, signal }, payload));
+        let result;
+        try {
+            result = await this.invokeWithTimeout(() => handler({ principal, params, key, signal }, payload));
+        }
+        catch (cause) {
+            if (cause instanceof NamedUserRequiredError)
+                throw cause;
+            throw new SurfaceFailedError(`surface ${slug}/${id} action "${action}" threw: ${cause instanceof Error ? cause.message : String(cause)}`);
+        }
         const wrapped = this.wrapResult(slug, id, key, result);
         if (actionId !== undefined) {
-            this.dedup.record(actionId, composite, wrapped);
+            this.dedup.record(actionId, composite, fingerprint, wrapped);
         }
         return wrapped;
     }
+    /** The instance's current rev (the save action's optimistic check). */
+    currentRev(slug, id, key) {
+        return this.stateFor(slug, id, key).rev;
+    }
+    /**
+     * The instance key for one surface + params, or `undefined` when the
+     * surface is unknown (the routes' located-check — covers extension
+     * views/panels AND settings surfaces, one source). A throwing
+     * `instanceKey` propagates (the extension-fault 500 path).
+     */
+    instanceKeyFor(slug, id, params, principal) {
+        const located = this.locate(slug, id);
+        if (located === undefined)
+            return undefined;
+        return this.keyFor(located.def, params, principal);
+    }
     /**
      * Deliver one upload (spec §7.1/§7.2): the bytes were capped at the
      * route (field `maxBytes` clamped by `server.maxUploadBytes`); the
@@ -476,6 +570,78 @@ export class SurfaceService {
         });
         return state.rev;
     }
+    /**
+     * Record one chat-block change (spec §8.2: chat data is shared by
+     * everyone who can see the conversation, so ops are kept like
+     * `sharedData` surfaces). Only the chat surface ROUTES call this —
+     * the core handler itself publishes the Task-1 `surface.changed`
+     * seam event and never touches this table, and an `update_blocks`
+     * agent edit likewise publishes ONLY the seam event (never an
+     * announceChatRev), so after an agent edit the in-memory rev no
+     * longer continues the recorded sequence and the rev-match guard
+     * below forces the client's next fetch to a full-data answer.
+     * `rev` is the DURABLE family's revision — the chat block's source
+     * of truth — so the table merely mirrors it: a rev that does not
+     * continue the recorded sequence (or a restart resetting memory)
+     * breaks the replay window's contiguity, and the window RESETS
+     * rather than ever answering a fetch across a missing rev.
+     */
+    announceChatRev(address, rev, ops) {
+        const { slug, id, key } = partsOf(address);
+        const state = this.stateFor(slug, id, key);
+        if (ops !== undefined && rev === state.rev + 1) {
+            state.rev = rev;
+            state.ops.push({ rev, ops: [...ops.ops] });
+            while (state.ops.length > SHARED_OPS_WINDOW)
+                state.ops.shift();
+            return;
+        }
+        // An ops-less announcement, or a rev that skips: the window is no
+        // longer contiguous from any `since` — drop it; the next contiguous
+        // recorded action rebuilds it.
+        if (rev > state.rev)
+            state.rev = rev;
+        state.ops = [];
+    }
+    /**
+     * The ops since one rev for a chat block (the `data?since=` answer):
+     * the kept ops when the window still covers `since` AND the in-memory
+     * rev matches the durable one the caller read (a stale table serves
+     * nothing — the caller answers the full data). `undefined` otherwise.
+     */
+    chatOpsSince(address, since, currentRev) {
+        const { slug, id, key } = partsOf(address);
+        const state = this.instances.get(`${slug}\u0001${id}\u0001${key}`);
+        if (state === undefined)
+            return undefined;
+        if (state.rev !== currentRev)
+            return undefined;
+        if (since < state.rev - state.ops.length || since > state.rev) {
+            return undefined;
+        }
+        return {
+            rev: state.rev,
+            ops: state.ops
+                .filter((entry) => entry.rev > since)
+                .flatMap((entry) => entry.ops),
+        };
+    }
+    /** One chat action's rate-limit token (the ext route's own gate). */
+    chatTakeToken(address, user) {
+        const { slug, id } = partsOf(address);
+        return this.rateLimit.take(slug, id, user);
+    }
+    /** The dedup lookup for one chat action (same table as ext actions). */
+    chatDedupCheck(actionId, address, fingerprint) {
+        const { slug, id, key } = partsOf(address);
+        const hit = this.dedup.check(actionId, `${slug}\u0001${id}\u0001${key}`, fingerprint);
+        return hit === undefined || hit === null ? hit : hit.result;
+    }
+    /** Record one chat action's first result (the dedup entry). */
+    chatDedupRecord(actionId, address, fingerprint, result) {
+        const { slug, id, key } = partsOf(address);
+        this.dedup.record(actionId, `${slug}\u0001${id}\u0001${key}`, fingerprint, result);
+    }
     /** Call the surface's `render`, mapping throws to SurfaceFailedError. */
     async callRender(located, key, params, principal) {
         try {
@@ -487,6 +653,8 @@ export class SurfaceService {
             });
         }
         catch (cause) {
+            if (cause instanceof NamedUserRequiredError)
+                throw cause;
             throw new SurfaceFailedError(`surface ${located.slug}/${located.def.id} render() threw: ${cause instanceof Error ? cause.message : String(cause)}`);
         }
     }