@sigrun/sigrun 0.1.6 → 0.2.1

package/dist/server/helpers.js

@@ -8,6 +8,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { isAbsolute, resolve } from "node:path";
 import { effectiveServerSection, } from "../config.js";
+import { pendingRestart } from "../settings/pending.js";
 import { DEFAULT_AUTH_KEY } from "../harness/auth.js";
 import { OPENAI_API_KEY_ENV } from "../harness/providers/index.js";
 import { SessionMetaDoc } from "./session-meta.js";
@@ -198,12 +199,15 @@ export const ID_PARAMS_SCHEMA = {
 /** The settings response over the live store + registry snapshot. */
 /**
  * The `/v1/settings` payload (GET and the post-PATCH readback): the
- * file's effective contents, the registry-computed `toolRoster`, and
- * the `effective` block (spec §6.6) — every server key's resolved value
- * and source, computed PER REQUEST over the fresh file read (a PATCH
- * lands as a `file` source on the next GET) and the boot env/config.
+ * file's effective contents, the registry-computed `toolRoster`, the
+ * `effective` block (spec §6.6), and the `pendingRestart` diff
+ * (UI-blocks U4 §13.2) — every server key's resolved value and source,
+ * computed PER REQUEST over the fresh file read (a PATCH lands as a
+ * `file` source on the next GET) and the boot env/config. A PATCH
+ * response additionally carries the write's own `applied`/`pending`
+ * classification (§13.1) via the optional `write` argument.
  */
-export function settingsResponse(opened, config, env) {
+export function settingsResponse(opened, config, env, write) {
     const names = opened.registry
         .snapshot()
         .tools()
@@ -215,6 +219,8 @@ export function settingsResponse(opened, config, env) {
         ...file,
         toolRoster: [...new Set(names)],
         effective: effectiveServerSection(env, file.server, config),
+        pendingRestart: pendingRestart(file, opened.settingsBootSnapshot),
+        ...(write === undefined ? {} : { applied: write.applied, pending: write.pending }),
     };
 }
 /** Re-brand a route id as a ConversationId (the branded Id type is a number). */
@@ -241,12 +247,18 @@ export async function readView(conversation) {
  * copied state (`fork: "current"`), so the caller's identity OVERWRITES
  * the source's.
  */
-export async function stampSessionOwner(conversation, owner) {
+export async function stampSessionOwner(conversation, owner, opened) {
     if (owner === undefined)
         return;
+    await stampOwnerInCommit(conversation, owner, opened);
+}
+/** Stamp/replace an owner and rewrite per-user selection in ONE commit. */
+export async function stampOwnerInCommit(conversation, owner, opened) {
     await conversation.commit(async (tx) => {
         const draft = await tx.doc(SessionMetaDoc, conversation.id);
+        const previous = draft.owner;
         draft.owner = owner;
+        await opened.rewriteUserSelection(tx, conversation.id, previous, owner);
     }, BACKGROUND_CONTEXT);
 }
 /**

package/dist/server/host-bridge.js

@@ -16,25 +16,22 @@
  * superuser's HTTP list does: every row visible, `access: "write"`.
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
-import { accessOf as accessOfShared, } from "@sigrun/shared/access";
-import { isSuperuser } from "./auth/principal.js";
+import { accessOf as accessOfShared } from "@sigrun/shared/access";
+import { effectiveAdmin } from "../harness/identity/groups.js";
+import { userWire } from "./routes/users.js";
+import { accessPrincipalOf } from "./auth/access-principal.js";
 import { abortOp, compactOp, configureOp, ConversationOpError, createConversationOp, forkOp, listConversationsOp, patchMetaOp, readFileOp, readMetaOp, submitOp, uploadOp, } from "./conversation-ops.js";
 import { listModels } from "./helpers.js";
 import { SessionMetaDoc } from "./session-meta.js";
-import { serializeConversationView } from "./views.js";
+import { accountLinkWire, serializeConversationView } from "./views.js";
 /**
- * The effective-admin projection of one directory user (gateway C8):
- * host-side callers (chat commands, no request headers) see the STORED
- * flag OR the persisted group grant, plus the raw `groupAdmin` as a
- * definite boolean. The `/v1/users` wire keeps `admin` = the stored
- * flag (the users-admin UI toggles that one); the two surfaces are
- * deliberately different.
+ * Host-side callers see effective admin derived from stored groups;
+ * `groupAdmin` remains the derived compatibility field on the wire.
  */
-function effectiveAdminOf(record) {
+function effectiveAdminOf(record, adminGroups) {
     return {
-        ...record,
-        admin: record.admin || record.groupAdmin === true,
-        groupAdmin: record.groupAdmin === true,
+        ...userWire(record, adminGroups),
+        admin: effectiveAdmin(record, adminGroups),
     };
 }
 /** Build the host bridge over one server context. */
@@ -136,6 +133,7 @@ export function createHostBridge(ctx) {
                 await configureOp(ctx, conversation, {
                     ...(opts.model === undefined ? {} : { model: opts.model }),
                     ...(opts.thinking === undefined ? {} : { thinking: opts.thinking }),
+                    ...(opts.extensions === undefined ? {} : { extensions: opts.extensions }),
                 });
             },
             async compact(id) {
@@ -176,11 +174,36 @@ export function createHostBridge(ctx) {
             // admin-gated /v1/users routes) — with EFFECTIVE admin (gateway
             // C8): a persisted group grant counts for host-side checks.
             async list() {
-                return opened.identity.users.list().map(effectiveAdminOf);
+                return opened.identity.users.list().map((record) => effectiveAdminOf(record, ctx.config.auth.adminGroups));
             },
             async get(user) {
                 const record = opened.identity.users.get(user);
-                return record === undefined ? undefined : effectiveAdminOf(record);
+                return record === undefined ? undefined : effectiveAdminOf(record, ctx.config.auth.adminGroups);
+            },
+        },
+        accounts: {
+            // The one link table (multi-user §11.3): core code over core's
+            // store — the single write path, with the store's own validation
+            // and conflict refusal. `account_link_conflict:` errors cross the
+            // bridge as plain Errors (extensions match the message prefix).
+            async lookup(provider, subject) {
+                const link = opened.identity.accounts.lookup(provider, subject);
+                return link === undefined ? undefined : accountLinkWire(link);
+            },
+            async link(provider, subject, user, via) {
+                const link = await opened.identity.accounts.link({
+                    provider,
+                    subject,
+                    user,
+                    via,
+                });
+                return accountLinkWire(link);
+            },
+            async unlink(provider, subject) {
+                return await opened.identity.accounts.unlink(provider, subject);
+            },
+            async listForUser(user) {
+                return opened.identity.accounts.listForUser(user).map(accountLinkWire);
             },
         },
         access: {
@@ -190,10 +213,7 @@ export function createHostBridge(ctx) {
                 // directory admin is not a superuser for accessOf); the bare
                 // `{user}` shape is the shared rule's own principal.
                 const resolved = "admin" in principal
-                    ? {
-                        user: principal.user,
-                        superuser: isSuperuser(principal),
-                    }
+                    ? accessPrincipalOf(principal, opened.identity.users)
                     : { user: principal.user };
                 return accessOfShared(resolved, resource);
             },
@@ -241,7 +261,7 @@ export function createHostBridge(ctx) {
                     user: record.user,
                     ...(record.name === undefined ? {} : { name: record.name }),
                     ...(record.email === undefined ? {} : { email: record.email }),
-                    admin: effectiveAdminOf(record).admin,
+                    admin: effectiveAdmin(record, ctx.config.auth.adminGroups),
                     service: false,
                     method: "host",
                 };

package/dist/server/images/cache.js

@@ -0,0 +1,213 @@
+/**
+ * The image proxy's on-disk LRU cache (UI-blocks U7 Task 3, spec §11.2):
+ * entries live under `<cacheDir>/images/` (pod-local and outside backups,
+ * like the other cache roots), keyed by `sha256(u)` plus the `as`
+ * variant — NEVER the signed URL, whose signature changes on every
+ * serve. Capacity is 256 MiB by default; eviction is least-recently-hit
+ * first. Failures are never cached (callers `put` successful fetches
+ * only).
+ *
+ * Layout: each entry is one file `<sha256(u)>.<variant>` beside ONE
+ * `index.json` (the metadata table: type, size, added-at, clamped
+ * max-age, last-hit, pin). The index is written atomically on every mutation, so a re-open
+ * (the same cache dir, a new process) serves the prior entries.
+ *
+ * Eviction never deletes a file currently being STREAMED or WRITTEN
+ * (Review Focus 5): a `get` hit pins its entry until the returned
+ * stream closes (or the caller's response finishes), and a `put` holds
+ * its pin for the write's duration; the eviction pass skips pinned
+ * entries and takes the next-oldest instead.
+ */
+import { createHash, randomUUID } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { chmod, mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+/** The images subdirectory under the cache root. */
+export const IMAGES_CACHE_DIR = "images";
+/** The default capacity: 256 MiB (spec §11.2). */
+export const CACHE_CAPACITY_BYTES = 256 * 1024 * 1024;
+/** The sha256-of-url + variant entry key (never the signed URL). */
+function entryKey(u, variant) {
+    return `${createHash("sha256").update(u, "utf8").digest("hex")}.${variant}`;
+}
+/**
+ * The `<cacheDir>/images/` LRU cache. Construct with the CACHE ROOT (the
+ * `images/` child is created lazily on the first put / at open when the
+ * index exists). `capacityBytes` is test-overridable; the default is the
+ * spec's 256 MiB.
+ */
+export class ImageCache {
+    dir;
+    indexPath;
+    capacityBytes;
+    entries = new Map();
+    opened = false;
+    closed = false;
+    constructor(cacheRoot, options) {
+        this.dir = join(cacheRoot, IMAGES_CACHE_DIR);
+        this.indexPath = join(this.dir, "index.json");
+        this.capacityBytes = options?.capacityBytes ?? CACHE_CAPACITY_BYTES;
+    }
+    /** Open: load the index (creating the dir lazily). Idempotent. */
+    async open() {
+        if (this.opened)
+            return;
+        this.opened = true;
+        let raw;
+        try {
+            raw = await readFile(this.indexPath, "utf8");
+        }
+        catch (cause) {
+            if (cause.code === "ENOENT")
+                return;
+            throw cause;
+        }
+        // A corrupt index is rebuilt EMPTY (the files on disk are then
+        // orphaned until their names recur; a fresh fetch rewrites them).
+        // The cache is a cache: losing it is never an error worth
+        // refusing to boot over.
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return;
+        }
+        for (const [key, entry] of Object.entries(parsed.entries)) {
+            // Pre-max-age indexes used the original default: one hour.
+            this.entries.set(key, { ...entry, maxAge: entry.maxAge ?? 3600, pins: 0 });
+        }
+    }
+    /** One hit, or `undefined` on a miss. `now` stamps the LRU order. */
+    async get(u, variant, now) {
+        await this.open();
+        const key = entryKey(u, variant);
+        const entry = this.entries.get(key);
+        if (entry === undefined)
+            return undefined;
+        const file = join(this.dir, key);
+        try {
+            await stat(file);
+        }
+        catch {
+            // The index names a file that isn't there (a hand-cleaned dir):
+            // drop the row and miss.
+            this.entries.delete(key);
+            await this.persist();
+            return undefined;
+        }
+        entry.lastHit = now ?? Date.now();
+        entry.pins += 1;
+        await this.persist();
+        const stream = createReadStream(file);
+        let unpinned = false;
+        const unpin = () => {
+            // Node emits close after error: one hit releases one pin.
+            if (unpinned)
+                return;
+            unpinned = true;
+            entry.pins -= 1;
+        };
+        stream.once("close", unpin);
+        stream.once("error", unpin);
+        return { type: entry.type, addedAt: entry.addedAt, maxAge: entry.maxAge, stream };
+    }
+    /**
+     * Store one fetched image. The write is staged and renamed (atomic:
+     * a concurrent `get` never reads a half-written file) and the entry
+     * is pinned for the write's duration — the eviction pass a same-key
+     * overwrite triggers can never remove the file mid-rename.
+     */
+    async put(u, variant, type, body, now, maxAge = 3600) {
+        await this.open();
+        if (this.closed)
+            return;
+        const key = entryKey(u, variant);
+        const at = now ?? Date.now();
+        const entry = {
+            type,
+            size: body.byteLength,
+            addedAt: at,
+            maxAge,
+            lastHit: at,
+            pins: 1,
+        };
+        this.entries.set(key, entry);
+        await mkdir(this.dir, { recursive: true });
+        const file = join(this.dir, key);
+        const staged = `${file}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(staged, body, { mode: 0o644 });
+            await rename(staged, file);
+        }
+        catch (cause) {
+            await rm(staged, { force: true }).catch(() => { });
+            this.entries.delete(key);
+            throw cause;
+        }
+        finally {
+            entry.pins -= 1;
+        }
+        await this.evict();
+        await this.persist();
+    }
+    /** Evict least-recently-hit entries until total size fits capacity. */
+    async evict() {
+        let total = 0;
+        for (const entry of this.entries.values())
+            total += entry.size;
+        if (total <= this.capacityBytes)
+            return;
+        const oldestFirst = [...this.entries.entries()].sort((a, b) => a[1].lastHit - b[1].lastHit || a[1].addedAt - b[1].addedAt);
+        for (const [key, entry] of oldestFirst) {
+            if (total <= this.capacityBytes)
+                break;
+            // Never delete a file a response is streaming or a put is
+            // writing (Review Focus 5): skip it and take the next-oldest.
+            if (entry.pins > 0)
+                continue;
+            this.entries.delete(key);
+            total -= entry.size;
+            await rm(join(this.dir, key), { force: true }).catch(() => { });
+        }
+    }
+    /** Write the index (staged + renamed; the stores' discipline). */
+    async persist() {
+        if (this.closed)
+            return;
+        if (this.entries.size === 0) {
+            // An empty table is written too — a re-open then starts empty
+            // instead of resurrecting rows whose files are gone.
+        }
+        await mkdir(this.dir, { recursive: true });
+        const file = {
+            entries: Object.fromEntries([...this.entries.entries()].map(([key, entry]) => [
+                key,
+                {
+                    type: entry.type,
+                    size: entry.size,
+                    addedAt: entry.addedAt,
+                    maxAge: entry.maxAge,
+                    lastHit: entry.lastHit,
+                },
+            ])),
+        };
+        const staged = `${this.indexPath}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(staged, `${JSON.stringify(file)}\n`, { mode: 0o644 });
+            await chmod(staged, 0o644);
+            await rename(staged, this.indexPath);
+        }
+        catch (cause) {
+            await rm(staged, { force: true }).catch(() => { });
+            throw cause;
+        }
+    }
+    /** Flush the index; further `put`/`persist` calls no-op. */
+    async close() {
+        if (this.closed)
+            return;
+        await this.persist();
+        this.closed = true;
+    }
+}

package/dist/server/images/convert.js

@@ -0,0 +1,13 @@
+/**
+ * PNG conversion for the image proxy (UI-blocks U7 Task 3, spec §11.2
+ * ruling 17): with `as=png`, the server converts the fetched (or
+ * source-form) image to PNG with `sharp` (a server dependency) and the
+ * route caches the result beside the original variant. The TUI asks for
+ * it (pi-tui draws only PNG on Kitty without a registered transcoder);
+ * the webui doesn't.
+ */
+import sharp from "sharp";
+/** Convert image bytes (PNG/JPEG/GIF/WebP) to PNG bytes. */
+export async function toPng(bytes) {
+    return await sharp(bytes).png().toBuffer();
+}