@sigrun/sigrun 0.1.6 → 0.2.0

package/dist/harness/seam-host.js

@@ -17,7 +17,7 @@
  * extension; a throw later (tool execute) surfaces to the caller.
  */
 import { AmbientDoc, AmbientOwnersDoc, validateAmbient, } from "./ambient.js";
-import { InteractionDoc, InteractionsIndexDoc, applyAnswer, indexPending, indexSettled, validateInteraction, } from "./interactions.js";
+import { InteractionDoc, InteractionsIndexDoc, applyAnswer, asInteractionRecord, indexPending, indexSettled, sweepSecretDelivery, takeSecretDelivery, validateInteraction, } from "./interactions.js";
 import { scopedExtensionStores, } from "./stores.js";
 /** One seam violation. Name carries the surface ("interaction"/"ambient"). */
 export class SeamError extends Error {
@@ -36,7 +36,7 @@ export class SeamError extends Error {
  * boot-built store trio (one per boot, from the resolved roots); the
  * host scopes it to its identity's slug — `rekey` re-scopes in place.
  */
-export function createSeamHost(identity, kinds, bind, sharedStores) {
+export function createSeamHost(identity, kinds, bind, sharedStores, perUserTools, services) {
     const interactionKinds = new Set(kinds.interaction ?? []);
     const ambientKinds = new Set(kinds.ambient ?? []);
     // The scoped stores view, keyed on the CURRENT identity — the same
@@ -45,6 +45,19 @@ export function createSeamHost(identity, kinds, bind, sharedStores) {
     // factory-captured host object re-scopes IN PLACE (never a second
     // host, never a stale view).
     let stores = scopedExtensionStores(sharedStores, identity.name);
+    const userStores = (user) => {
+        const scoped = stores.user(user);
+        return {
+            ...scoped,
+            settings: {
+                get: scoped.settings.get,
+                set: async (value) => {
+                    await scoped.settings.set(value);
+                    services?.settingsChanged(identity.name, user);
+                },
+            },
+        };
+    };
     async function harness(context) {
         const h = await bind.harness();
         // The caller's context gates the wait: an aborted request/tool call
@@ -69,7 +82,22 @@ export function createSeamHost(identity, kinds, bind, sharedStores) {
     };
     return {
         get stores() {
-            return stores;
+            return { ...stores, user: userStores };
+        },
+        tools: {
+            setUserTools(user, tools) {
+                if (perUserTools?.declared(identity.name) !== true) {
+                    throw new Error("perUserTools not declared");
+                }
+                perUserTools.set(identity.name, user, tools);
+            },
+        },
+        services: {
+            connect: (name, user, ctx) => {
+                if (services === undefined)
+                    return Promise.reject(new Error("user services unavailable"));
+                return services.connect(identity.name, name, user, ctx);
+            },
         },
         rekey(nextIdentity, nextKinds) {
             // In place, by design: the factory already captured THIS object, so
@@ -111,8 +139,9 @@ export function createSeamHost(identity, kinds, bind, sharedStores) {
                     return false;
                 // Gateway C5: a host caller naming a user answers AS that human
                 // (the route's path — the same applyAnswer line); without a user
-                // the extension answered itself.
-                const applied = applyAnswer(draft, answer, opts?.user === undefined ? "extension" : "human", Date.now(), opts?.user);
+                // the extension answered itself. The conversationId rides the opts
+                // so applyAnswer can record a secret delivery (Review Focus 4).
+                const applied = applyAnswer(draft, answer, opts?.user === undefined ? "extension" : "human", Date.now(), opts?.user, { conversationId });
                 if (applied) {
                     const index = await tx.doc(InteractionsIndexDoc);
                     indexSettled(index, conversationId, callId);
@@ -122,21 +151,49 @@ export function createSeamHost(identity, kinds, bind, sharedStores) {
         },
         async settleInteraction(conversationId, callId, status, context) {
             const h = await harness(context);
+            // The sweep (Review Focus 4) is INSIDE the commit, applied only on
+            // the terminal transition: sweeping before the pending check would
+            // delete a delivery that still belongs to a live answer record
+            // (a no-op settle on an already-answered record must not eat the
+            // winner's unread secret).
             return await h.commit(async (tx) => {
                 const draft = await tx.doc(InteractionDoc, conversationId, callId, callId);
                 if (draft.status !== "pending")
                     return false;
+                // SAFETY: the tracked-draft write pattern mutates through a
+                // structural record view; every key exists by construction.
                 const mutable = draft;
                 mutable.status = status;
                 mutable.settledAt = Date.now();
                 const index = await tx.doc(InteractionsIndexDoc);
                 indexSettled(index, conversationId, callId);
+                sweepSecretDelivery(conversationId, callId);
                 return true;
             }, context);
         },
         async snapshotInteraction(conversationId, callId, context) {
             const h = await harness(context);
-            return await h.snapshot(InteractionDoc, conversationId, callId, context);
+            const stored = await h.snapshot(InteractionDoc, conversationId, callId, context);
+            if (stored === undefined)
+                return undefined;
+            const record = asInteractionRecord(stored);
+            // An unanswered record cannot have a delivery — and taking before
+            // this check would DELETE a delivery in flight in the
+            // record-then-commit-visible window (the poll returns the pending
+            // record and the true value is lost). Check the record FIRST.
+            if (record.answer === undefined)
+                return record;
+            // Review Focus 4 (the extension-only read): a secret delivery for
+            // this record merges its TRUE values back ONCE — the take is
+            // one-shot, so a second read sees the stored MASK. HTTP GETs never
+            // come through here (they serve the stored record verbatim).
+            const delivery = takeSecretDelivery(conversationId, callId);
+            if (delivery === undefined)
+                return record;
+            return {
+                ...record,
+                answer: { values: delivery.values },
+            };
         },
         async setAmbient(conversationId, record, context) {
             if (!ambientKinds.has(record.key)) {
@@ -166,6 +223,9 @@ export function createSeamHost(identity, kinds, bind, sharedStores) {
                 const problem = validateAmbient(full);
                 if (problem !== null)
                     throw new SeamError("ambient", problem);
+                // SAFETY: `full` carries a validated block tree as its body
+                // (validateAmbient's validateTree gate just passed); the stored
+                // mirror's body differs only in the structural JSON naming.
                 Object.assign(draft, full);
             }, context);
         },
@@ -250,6 +310,20 @@ export function createSeamHost(identity, kinds, bind, sharedStores) {
                 return (await hostBridge()).users.get(user);
             },
         },
+        accounts: {
+            async lookup(provider, subject) {
+                return (await hostBridge()).accounts.lookup(provider, subject);
+            },
+            async link(provider, subject, user, via) {
+                return (await hostBridge()).accounts.link(provider, subject, user, via);
+            },
+            async unlink(provider, subject) {
+                return (await hostBridge()).accounts.unlink(provider, subject);
+            },
+            async listForUser(user) {
+                return (await hostBridge()).accounts.listForUser(user);
+            },
+        },
         access: {
             async accessOf(principal, resource) {
                 return (await hostBridge()).access.accessOf(principal, resource);

package/dist/harness/settings.js

@@ -53,6 +53,7 @@ import { dirname, join } from "node:path";
 import { resolveStoreRoots } from "./stores.js";
 import { isAbsoluteHttpUrl } from "../config.js";
 import { isIanaTimeZone, validateJobSpec } from "../jobs/spec.js";
+import { classifyPatch, } from "../settings/pending.js";
 /** The queue modes pi-durable accepts (its `QueueMode`). */
 const QUEUE_MODES = ["all", "one-at-a-time"];
 /**
@@ -367,8 +368,8 @@ function validate(value) {
         if (builtins === undefined) {
             throw new SettingsValidationError("builtinExtensions", "must be an object");
         }
-        checkKeys("builtinExtensions.", builtins, ["codemode", "mcp", "toolSearch"]);
-        for (const key of ["codemode", "mcp", "toolSearch"]) {
+        checkKeys("builtinExtensions.", builtins, ["codemode", "mcp", "toolSearch", "gateway", "oauth"]);
+        for (const key of ["codemode", "mcp", "toolSearch", "gateway", "oauth"]) {
             if (builtins[key] !== undefined && typeof builtins[key] !== "boolean") {
                 throw new SettingsValidationError(`builtinExtensions.${key}`, "must be a boolean");
             }
@@ -410,10 +411,12 @@ function validateServer(server) {
         "webuiBundle",
         "compaction",
         "memorySeam",
+        "isolation",
         "providers",
         "auth",
         "metrics",
         "dev",
+        "supervised",
         "backup",
     ]);
     // The jobs default timezone (§8.2): an IANA name — `Intl` accepts
@@ -538,6 +541,30 @@ function validateServer(server) {
             }
         }
     }
+    if (record.isolation !== undefined) {
+        const isolation = asRecord(record.isolation);
+        if (isolation === undefined) {
+            throw new SettingsValidationError("server.isolation", "must be an object");
+        }
+        checkKeys("server.isolation.", isolation, [
+            "mode",
+            "osUsers",
+            "workerIdleMinutes",
+        ]);
+        if (isolation.mode !== undefined &&
+            isolation.mode !== "auto" &&
+            isolation.mode !== "always" &&
+            isolation.mode !== "off") {
+            throw new SettingsValidationError("server.isolation.mode", 'must be "auto", "always", or "off"');
+        }
+        if (isolation.osUsers !== undefined && typeof isolation.osUsers !== "boolean") {
+            throw new SettingsValidationError("server.isolation.osUsers", "must be a boolean");
+        }
+        if (isolation.workerIdleMinutes !== undefined &&
+            !isPositiveInt(isolation.workerIdleMinutes)) {
+            throw new SettingsValidationError("server.isolation.workerIdleMinutes", "must be a positive integer");
+        }
+    }
     if (record.providers !== undefined) {
         const providers = asRecord(record.providers);
         if (providers === undefined) {
@@ -556,11 +583,15 @@ function validateServer(server) {
         }
         checkKeys("server.auth.", auth, [
             "methods",
+            "sessionDays",
             "proxy",
             "adminGroups",
             "allowedHosts",
             "allowedOrigins",
         ]);
+        if (auth.sessionDays !== undefined && !isPositiveInt(auth.sessionDays)) {
+            throw new SettingsValidationError("server.auth.sessionDays", "must be a positive integer");
+        }
         if (auth.methods !== undefined) {
             if (!Array.isArray(auth.methods) ||
                 auth.methods.some((m) => m !== "token" && m !== "proxy")) {
@@ -616,6 +647,11 @@ function validateServer(server) {
     if (record.dev !== undefined && typeof record.dev !== "boolean") {
         throw new SettingsValidationError("server.dev", "must be a boolean");
     }
+    // The supervised flag (U4 §13.3) — same shape.
+    if (record.supervised !== undefined &&
+        typeof record.supervised !== "boolean") {
+        throw new SettingsValidationError("server.supervised", "must be a boolean");
+    }
     if (record.backup !== undefined) {
         const backup = asRecord(record.backup);
         if (backup === undefined) {
@@ -699,8 +735,10 @@ function checkKeys(prefix, record, allowed, reason = "is not a settable field")
  */
 export class SettingsStore {
     path;
+    #onWrite;
     constructor(options = {}) {
         this.path = settingsPath(options.dir ?? defaultSettingsDir());
+        this.#onWrite = options.onWrite;
     }
     /** The current settings; absent file = `{}` (all defaults). */
     read() {
@@ -1025,6 +1063,29 @@ export class SettingsStore {
         writeFileSync(this.path, `${JSON.stringify(file, null, "\t")}\n`);
         return file;
     }
+    /**
+     * The settings-change write (UI-blocks U4 Task 1, spec §13.2): the
+     * PATCH body merged + validated + persisted (exactly `update()`),
+     * THEN classified against the apply registry. Returns which keys
+     * applied live vs. which are pending a restart, plus the effective
+     * file; the committed-write observer fires after the write lands.
+     *
+     * @throws SettingsValidationError naming the offending field.
+     */
+    apply(patch) {
+        const outcome = classifyPatch(patch);
+        const file = this.update(patch);
+        this.#onWrite?.(outcome.keys);
+        // SAFETY: the intersection is structural — `update` returns the
+        // validated `SettingsFile`, and `ApplyOutcome`'s three fields are
+        // freshly created here, so no field collision can occur.
+        return {
+            ...file,
+            keys: outcome.keys,
+            applied: outcome.applied,
+            pending: outcome.pending,
+        };
+    }
     /**
      * A live `HarnessSettings` object for `openHarness`: every property
      * reads the file AT ACCESS TIME, so pi-durable's per-resolution

package/dist/harness/stores.js

@@ -36,8 +36,10 @@
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { mkdirSync } from "node:fs";
-import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { chmod, lstat, mkdir, readFile, readdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { dirname, join, sep } from "node:path";
+import { MutationQueue, invalidateJsonCache, readJson, writeJson, } from "./identity/json-store.js";
+import { UserDirectory } from "./identity/users.js";
 /**
  * The tier-3 defaults (spec §4): `~/.config/sigrun`,
  * `~/.local/share/sigrun`, `~/.cache/sigrun`, `~/.local/state/sigrun`.
@@ -154,7 +156,10 @@ export async function ensureCacheDir(roots, slug) {
 }
 /** The synchronous mkdir core behind {@link ensureCacheDir}. */
 function ensureCacheDirAt(roots, slug) {
-    const dir = join(roots.cacheDir, slug);
+    return ensureDirAt(join(roots.cacheDir, slug));
+}
+/** The synchronous mkdir core behind lazy path getters. */
+function ensureDirAt(dir) {
     try {
         mkdirSync(dir, { recursive: true });
     }
@@ -354,14 +359,101 @@ export function resolveSecretFor(slug, section, key, env) {
 }
 /** The `secrets.json` file name at the config root (spec §3 map). */
 const SECRETS_FILE_NAME = "secrets.json";
+/**
+ * One user's secrets file (multi-user M2): the same object-map discipline
+ * as the shared SecretsStore, plus the identity helpers' mtime reload and
+ * MutationQueue. A queued write re-reads the CURRENT file inside its
+ * mutation, so sibling sections survive concurrent sets.
+ */
+/** One FIFO per secrets file, shared by independently constructed views. */
+const userSecretMutations = new Map();
+export class UserSecretsStore {
+    path;
+    mutations;
+    constructor(path) {
+        this.path = path;
+        this.mutations = userSecretMutations.get(path) ?? new MutationQueue();
+        userSecretMutations.set(path, this.mutations);
+    }
+    readAll() {
+        const value = readJson(this.path, {});
+        if (!isPlainObject(value)) {
+            throw new Error(`sigrun: ${this.path} must contain a JSON object`);
+        }
+        return value;
+    }
+    readSection(slug) {
+        const section = this.readAll()[slug];
+        return isPlainObject(section) ? section : {};
+    }
+    writeSection(slug, section) {
+        return this.mutate(slug, (draft) => {
+            for (const key of Object.keys(draft))
+                delete draft[key];
+            Object.assign(draft, section);
+        });
+    }
+    /** One serialized read-modify-write; validation runs INSIDE the queue. */
+    mutate(slug, update) {
+        return this.mutations.run(async () => {
+            const all = this.readAll();
+            const current = all[slug];
+            const draft = isPlainObject(current) ? { ...current } : {};
+            update(draft);
+            all[slug] = draft;
+            // The parent is created only on the first actual secret write.
+            await ensureDir(dirname(this.path));
+            // writeJson -> writeFileAtomic(..., 0600), on create AND rewrite.
+            await writeJson(this.path, all);
+        });
+    }
+}
+/** In-memory only: active userDeleted fan-out windows (Task 5 owns begin/end). */
+const deletingUsers = new Map();
+/**
+ * Mark one user's deletion fan-out active. The returned idempotent end hook
+ * releases only this window; nested fan-outs cannot clear each other early.
+ * No marker is persisted and no catch-all allowMissing flag exists.
+ */
+export function beginUserDeletion(user) {
+    deletingUsers.set(user, (deletingUsers.get(user) ?? 0) + 1);
+    let active = true;
+    return () => {
+        if (!active)
+            return;
+        active = false;
+        const remaining = (deletingUsers.get(user) ?? 1) - 1;
+        if (remaining <= 0)
+            deletingUsers.delete(user);
+        else
+            deletingUsers.set(user, remaining);
+    };
+}
+/** Resolve one directory user, or the explicit deletion-window exception. */
+function requireStoreUser(users, user) {
+    if (users.get(user) === undefined && !deletingUsers.has(user)) {
+        throw new Error(`unknown user "${user}"`);
+    }
+}
 /** Build the shared trio from resolved roots (cheap, no I/O). */
-export function sharedExtensionStores(roots, env = {}) {
+export function sharedExtensionStores(roots, env = {}, users) {
     const settings = new ExtensionSettingsStore(join(roots.configDir, SETTINGS_DIR_NAME));
     const secrets = new SecretsStore(join(roots.configDir, SECRETS_FILE_NAME));
+    // The optional fallback keeps this low-level factory usable without an
+    // identity bundle; production boot always passes its LIVE directory.
+    const directory = users ?? new UserDirectory(join(roots.configDir, "users.json"));
     return {
         secrets,
         settings,
         roots,
+        users: directory,
+        removeUserData: (user) => removeUserData(roots, user),
+        userExtensionStores: (slug, user) => userExtensionStores(roots, directory, slug, user),
+        userSecretKeys: async (slug, user) => {
+            requireStoreUser(directory, user);
+            const store = new UserSecretsStore(join(roots.configDir, USER_SECRETS_DIR, `${user}.json`));
+            return Object.keys(store.readSection(slug));
+        },
         settingsFor: (slug) => ({
             get: () => settings.read(slug),
             set: (value) => settings.write(slug, value),
@@ -421,6 +513,7 @@ export function sharedExtensionStores(roots, env = {}) {
  */
 export function scopedExtensionStores(shared, slug) {
     return {
+        user: (user) => shared.userExtensionStores(slug, user),
         secrets: {
             async get(key) {
                 const section = await shared.secrets.readSection(slug);
@@ -448,3 +541,147 @@ export function scopedExtensionStores(shared, slug) {
         },
     };
 }
+/** The per-user file/dir layout (multi-user M2 §10.2, verbatim). */
+const USER_SECRETS_DIR = "user-secrets";
+const USER_SETTINGS_DIR = "user-settings";
+/** Whether a filesystem error is just an absent cleanup candidate. */
+function isEnoent(error) {
+    return error.code === "ENOENT";
+}
+/** Delete one cache user dir only when every existing parent component is
+ * a real directory inside the cache root. Symlink parents are skipped, so
+ * recursive rm can never follow one outside the root.
+ */
+async function removeCacheUserDir(cacheRoot, slug, user) {
+    const parentComponents = [slug, "users"];
+    let resolvedParent = cacheRoot;
+    for (const component of parentComponents) {
+        const candidate = join(resolvedParent, component);
+        let stats;
+        try {
+            stats = await lstat(candidate);
+        }
+        catch (error) {
+            if (isEnoent(error))
+                return;
+            throw error;
+        }
+        if (!stats.isDirectory() || stats.isSymbolicLink())
+            return;
+        const resolved = await realpath(candidate);
+        if (resolved !== cacheRoot && !resolved.startsWith(cacheRoot + sep))
+            return;
+        resolvedParent = resolved;
+    }
+    const target = join(resolvedParent, user);
+    try {
+        const stats = await lstat(target);
+        // Deleting the symlink itself is confined; its target is untouched.
+        if (!stats.isDirectory() && !stats.isSymbolicLink())
+            return;
+    }
+    catch (error) {
+        if (isEnoent(error))
+            return;
+        throw error;
+    }
+    await rm(target, { recursive: true, force: true });
+}
+/** Core's §10.6 step-5 cleanup, after userDeleted and directory removal.
+ * Cache entries are enumerated because per-user registry entries may already
+ * have uninstalled slugs. Data/state deliberately remain extension-owned.
+ */
+async function removeUserData(roots, user) {
+    await rm(join(roots.configDir, USER_SECRETS_DIR, `${user}.json`), { force: true });
+    await rm(join(roots.configDir, USER_SETTINGS_DIR, user), { recursive: true, force: true });
+    let cacheRoot;
+    let entries;
+    try {
+        cacheRoot = await realpath(roots.cacheDir);
+        entries = await readdir(cacheRoot, { withFileTypes: true });
+    }
+    catch (error) {
+        if (isEnoent(error))
+            return;
+        throw error;
+    }
+    await Promise.all(entries.flatMap((entry) => entry.isDirectory() && !entry.isSymbolicLink()
+        ? [removeCacheUserDir(cacheRoot, entry.name, user)]
+        : []));
+}
+/** Settings use sync mtime reload + queued atomic writes (0644, like shared settings). */
+const userSettingQueues = new Map();
+const userSettingMutations = {
+    run(path, op) {
+        const queue = userSettingQueues.get(path) ?? new MutationQueue();
+        userSettingQueues.set(path, queue);
+        return queue.run(op);
+    },
+};
+function readUserSettings(path) {
+    const value = readJson(path, {});
+    if (!isPlainObject(value)) {
+        throw new Error(`sigrun: ${path} must contain a JSON object`);
+    }
+    return value;
+}
+async function writeUserSettings(path, value) {
+    try {
+        await writeFileAtomic(path, serializeJson(value), 0o644);
+    }
+    finally {
+        invalidateJsonCache(path);
+    }
+}
+/** One user/slug view; user validity is checked at EVERY operation, not cached. */
+// Directory usernames are validated at creation, and extension slugs are
+// loader-sanitized; the joins below therefore cannot escape the store roots.
+// The deleting marker is the ONLY missing-record exception, and its release
+// immediately re-enables checks on handles already captured during fan-out.
+export function userExtensionStores(roots, users, slug, user) {
+    requireStoreUser(users, user);
+    const secrets = new UserSecretsStore(join(roots.configDir, USER_SECRETS_DIR, `${user}.json`));
+    const rawPath = (root) => {
+        requireStoreUser(users, user);
+        return ensureDirAt(join(root, slug, "users", user));
+    };
+    return {
+        secrets: {
+            async get(key) {
+                requireStoreUser(users, user);
+                const value = secrets.readSection(slug)[key];
+                return value === undefined || value === null ? undefined : String(value);
+            },
+            async set(key, value) {
+                await secrets.mutate(slug, (section) => {
+                    requireStoreUser(users, user);
+                    section[key] = value;
+                });
+            },
+            async delete(key) {
+                await secrets.mutate(slug, (section) => {
+                    requireStoreUser(users, user);
+                    delete section[key];
+                });
+            },
+        },
+        settings: {
+            async get() {
+                requireStoreUser(users, user);
+                return readUserSettings(join(roots.configDir, USER_SETTINGS_DIR, user, `${slug}.json`));
+            },
+            async set(value) {
+                await userSettingMutations.run(join(roots.configDir, USER_SETTINGS_DIR, user, `${slug}.json`), async () => {
+                    requireStoreUser(users, user);
+                    await ensureDir(join(roots.configDir, USER_SETTINGS_DIR, user));
+                    await writeUserSettings(join(roots.configDir, USER_SETTINGS_DIR, user, `${slug}.json`), value);
+                });
+            },
+        },
+        paths: {
+            get data() { return rawPath(roots.dataDir); },
+            get state() { return rawPath(roots.stateDir); },
+            get cache() { return rawPath(roots.cacheDir); },
+        },
+    };
+}