@sigrun/sigrun 0.2.0 → 0.3.0

package/dist/server/login/resolve.js

@@ -1,9 +1,85 @@
+import { deriveUsername, withSuffix } from "@sigrun/shared/usernames";
 import { AccountLinkConflictError, } from "../../harness/identity/accounts.js";
 import { AdmissionRefusedError, } from "../../harness/identity/users.js";
 import { setupCodeMatches } from "../../harness/identity/setup-code-check.js";
 import { hashToken } from "../../harness/identity/tokens.js";
 import { withClaimLock } from "../auth/claim-lock.js";
-import { assignUsername } from "./usernames.js";
+/** The first usable profile claim wins; the external subject remains exact. */
+export function loginUsernameCandidate(profile, subject) {
+    for (const candidate of [profile.username, profile.email, subject]) {
+        if (candidate === undefined)
+            continue;
+        const derived = deriveUsername(candidate);
+        if (derived !== undefined)
+            return derived;
+    }
+    return "user";
+}
+function isAddConflict(error) {
+    return error instanceof Error && /^user ".*" already exists$/.test(error.message);
+}
+function isLinkConflict(error) {
+    return error instanceof AccountLinkConflictError || (error instanceof Error && error.message.startsWith("account_link_conflict:"));
+}
+async function sessionForLinkedUser(input, deps) {
+    const existing = deps.accounts.lookup(input.provider, input.result.subject);
+    if (deps.users.get(existing.user) === undefined) {
+        return { kind: "refused", error: "not_allowed" };
+    }
+    await deps.users.setGroups(existing.user, input.provider, input.result.groups ?? []);
+    return { kind: "session", user: existing.user };
+}
+/** Lock-free provisioning body; add/link conflicts become retry signals. */
+async function provisionLogin(input, deps) {
+    if (deps.accounts.lookup(input.provider, input.result.subject) !== undefined) {
+        return sessionForLinkedUser(input, deps);
+    }
+    // Admission is checked before redemption so an M1 refusal burns no invite.
+    deps.users.checkAdmission();
+    const base = loginUsernameCandidate(input.result.profile, input.result.subject);
+    const autoProvision = deps.policy.autoProvision === true;
+    const user = autoProvision
+        ? withSuffix(base, (name) => deps.users.get(name) !== undefined)
+        : base;
+    if (!autoProvision && deps.users.get(user) !== undefined) {
+        return { kind: "refused", error: "not_allowed" };
+    }
+    const grant = autoProvision
+        ? { admin: false }
+        : await deps.invites.redeem(input.code, user);
+    if (grant === undefined)
+        return { kind: "refused", error: "not_allowed" };
+    try {
+        const record = await deps.users.add({
+            user,
+            ...profileFields(input.result.profile),
+            admin: grant.admin,
+            source: "login",
+        });
+        try {
+            await deps.accounts.link({
+                provider: input.provider,
+                subject: input.result.subject,
+                user,
+                via: "login",
+            });
+        }
+        catch (error) {
+            if (isLinkConflict(error)) {
+                await deps.users.remove(record.user);
+                return { kind: "retry", error: error };
+            }
+            throw error;
+        }
+        await deps.users.setGroups(user, input.provider, input.result.groups ?? []);
+        return { kind: "session", user: record.user };
+    }
+    catch (error) {
+        if (isAddConflict(error))
+            return { kind: "retry", error: error };
+        throw error;
+    }
+}
 function allowed(result, policy) {
     if (policy.allowedGroups !== undefined &&
         !policy.allowedGroups.some((group) => result.groups?.includes(group) === true))
@@ -42,13 +118,8 @@ export async function resolveLogin(input, deps) {
             return { kind: "linked", user: input.linkUser };
         }
         const existing = deps.accounts.lookup(provider, result.subject);
-        if (existing !== undefined) {
-            if (deps.users.get(existing.user) === undefined) {
-                return { kind: "refused", error: "not_allowed" };
-            }
-            await deps.users.setGroups(existing.user, provider, result.groups ?? []);
-            return { kind: "session", user: existing.user };
-        }
+        if (existing !== undefined)
+            return sessionForLinkedUser(input, deps);
         const setupResolution = await withClaimLock(async () => {
             const validSetupCode = input.code !== undefined && setupCodeMatches(input.code, deps.setupCode());
             if (deps.users.isClaimed()) {
@@ -69,7 +140,7 @@ export async function resolveLogin(input, deps) {
             if (!validSetupCode)
                 return { kind: "needs_code", reason: "setup" };
             const claim = deps.setupClaims.matches(provider, result.subject, input.code);
-            const user = claim?.user ?? assignUsername(result.profile, result.subject, (name) => deps.users.get(name) !== undefined);
+            const user = claim?.user ?? withSuffix(loginUsernameCandidate(result.profile, result.subject), (name) => deps.users.get(name) !== undefined);
             // Persist the recovery breadcrumb before creating the user. On a
             // retry, only this exact subject may finish the claim; if the user
             // write did not happen, it is retried under the recorded name.
@@ -99,23 +170,9 @@ export async function resolveLogin(input, deps) {
         if (deps.policy.autoProvision !== true && input.code === undefined) {
             return { kind: "needs_code", reason: "invite" };
         }
-        // Admission is checked before redemption so an M1 refusal burns no invite.
-        deps.users.checkAdmission();
-        const user = assignUsername(result.profile, result.subject, (name) => deps.users.get(name) !== undefined);
-        const grant = deps.policy.autoProvision === true
-            ? { admin: false }
-            : await deps.invites.redeem(input.code, user);
-        if (grant === undefined)
-            return { kind: "refused", error: "not_allowed" };
-        const record = await deps.users.add({
-            user,
-            ...profileFields(result.profile),
-            admin: grant.admin,
-            source: "login",
-        });
-        await deps.accounts.link({ provider, subject: result.subject, user, via: "login" });
-        await deps.users.setGroups(user, provider, result.groups ?? []);
-        return { kind: "session", user: record.user };
+        const provisioned = await withClaimLock(() => provisionLogin(input, deps));
+        if (provisioned.kind !== "retry")
+            return provisioned;
     }
     catch (error) {
         if (error instanceof AccountLinkConflictError || (error instanceof Error && error.message.startsWith("account_link_conflict:")))
@@ -130,4 +187,9 @@ export async function resolveLogin(input, deps) {
         }
         throw error;
     }
+    // Conflicts from another writer retry once, only after the section returns.
+    const second = await withClaimLock(() => provisionLogin(input, deps));
+    if (second.kind === "retry")
+        throw second.error;
+    return second;
 }

package/dist/server/notifications.js

@@ -78,6 +78,10 @@ export function startNotifications(ctx) {
                 title: base.title,
                 body: base.body,
                 ...(url === undefined ? {} : { url }),
+                // The settled outcome rides ONLY run.settled events — the
+                // other variants never gain the field (the type is the union;
+                // the conditional spread keeps the wire shape exact).
+                ...(base.outcome === undefined ? {} : { outcome: base.outcome }),
             };
             for (const target of targets) {
                 // Fire-and-forget per transport call: one notifier's failure or
@@ -123,7 +127,7 @@ export function startNotifications(ctx) {
         }, recipients);
     };
     /** run.settled → the owner, gated by the live `notifications.runSettled` mode. */
-    const handleRunSettled = async (conversationId) => {
+    const handleRunSettled = async (conversationId, outcome, reason) => {
         const mode = opened.settings.read().notifications?.runSettled ?? "unwatched";
         if (mode === "never")
             return;
@@ -134,13 +138,26 @@ export function startNotifications(ctx) {
             (watchers.get(conversationId) ?? 0) > 0) {
             return;
         }
+        // Translate the EXISTING wire outcome/reason straight across (no
+        // second answer read, no inferred status). An unanswered run never
+        // titles itself "Reply ready": the reason is the run's own, with
+        // the bare status as the fallback for a reason-less settle.
+        const settledOutcome = outcome === "answered"
+            ? { status: "answered" }
+            : { status: "unanswered", reason: reason ?? "unanswered" };
+        const settledReason = reason ?? "unanswered";
         deliver({
             type: "run.settled",
             conversationId,
             jobId: undefined,
             callId: undefined,
-            title: "Reply ready",
-            body: displayName(meta, conversationId),
+            title: outcome === "answered"
+                ? "Reply ready"
+                : "Run ended without a reply",
+            body: outcome === "answered"
+                ? displayName(meta, conversationId)
+                : `${displayName(meta, conversationId)} — ${settledReason}`,
+            outcome: settledOutcome,
         }, [meta?.owner]);
     };
     /**
@@ -177,7 +194,7 @@ export function startNotifications(ctx) {
             void bus.runBounded("notifications interaction.pending", () => handleInteraction(event.conversationId, event.callId));
         }
         else if (event.type === "run.settled") {
-            void bus.runBounded("notifications run.settled", () => handleRunSettled(event.conversationId));
+            void bus.runBounded("notifications run.settled", () => handleRunSettled(event.conversationId, event.outcome, event.reason));
         }
         else if (event.type === "job.changed") {
             void bus.runBounded("notifications job.changed", () => {

package/dist/server/routes/admin.js

@@ -18,12 +18,24 @@
  * graceful-shutdown + `process.exit(0)`) owns the exit — the route
  * never calls exit itself.
  *
+ * D5 parked-task recovery (pi-durable 1.4.0, Task B6):
+ * `GET /v1/admin/tasks?state=blocked` lists blocked tasks from
+ * `harness.inspect()` (id, kind, reason, conversationId, owner from the
+ * conversation's SessionMeta when present); `POST /v1/admin/tasks/:id/retry`
+ * returns 404 unknown_task / 409 not_parked unless the task is blocked
+ * with reason restart_limit, else calls `harness.retryTask(id)` → 204.
+ * The inspect-first check is load-bearing: retryTask rejects an unknown
+ * id but SILENTLY no-ops for a task that isn't parked. Both endpoints
+ * are admin-only (403 forbidden).
+ *
  * Durability (Review Focus 4): the restart rides the SAME ordered
  * shutdown as the SIGTERM path — the event bus drains pending settles
  * and the harness close seals storage, so a run in flight at restart
  * has its submission durable before exit; pi-durable resumes it after
  * the supervisor brings the process back.
  */
+import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { SessionMetaDoc } from "../session-meta.js";
 /** Register the `/v1/admin` routes. */
 export function registerAdminRoutes(app, ctx) {
     app.post("/v1/admin/restart", async (request, reply) => {
@@ -55,4 +67,89 @@ export function registerAdminRoutes(app, ctx) {
         });
         return await reply.code(202).send({ restarting: true });
     });
+    // D5 parked-task recovery. `GET /v1/admin/tasks?state=blocked` lists
+    // blocked tasks from `harness.inspect()`; `POST /v1/admin/tasks/:id/retry`
+    // re-runs a restart-parked task. Both admin-only (403 before any
+    // inspection, so a non-admin learns nothing about the task graph).
+    app.get("/v1/admin/tasks", async (request, reply) => {
+        if (!request.principal.admin) {
+            return await reply.code(403).send({ error: "forbidden" });
+        }
+        const query = request.query;
+        // Only the blocked projection exists (the recovery surface); any
+        // other state filter is a fail-loud 400, same posture as the
+        // conversations list's strict booleans.
+        if (query.state !== undefined && query.state !== "blocked") {
+            return await reply.code(400).send({ error: "invalid_field", field: "state" });
+        }
+        const inspection = await ctx.opened.harness.inspect(BACKGROUND_CONTEXT);
+        const blocked = inspection.tasks.filter((task) => task.state.kind === "blocked");
+        // Owner: the conversation's SessionMeta.owner when it has one.
+        // Reads are snapshots (never materialize the doc); a raced read
+        // degrades to an omitted owner, not a failed list.
+        const owners = new Map();
+        for (const task of blocked) {
+            const conversationId = Number(task.record.conversationId);
+            if (owners.has(conversationId))
+                continue;
+            try {
+                const meta = await ctx.opened.harness.snapshot(SessionMetaDoc, task.record.conversationId, BACKGROUND_CONTEXT);
+                owners.set(conversationId, meta?.owner);
+            }
+            catch (error) {
+                console.error("admin tasks: SessionMeta snapshot failed:", error);
+                owners.set(conversationId, undefined);
+            }
+        }
+        // Extension: task names are unique across installed extensions, so
+        // ONE registry snapshot resolves the owning extension. Built-in
+        // generation/tool/compaction tasks have no installed extension and
+        // correctly omit the field.
+        const extensionsByTask = new Map();
+        for (const extension of ctx.opened.registry.snapshot().installed()) {
+            for (const task of extension.tasks ?? []) {
+                extensionsByTask.set(task.definition.name, extension.name);
+            }
+        }
+        const tasks = blocked.map((task) => {
+            const conversationId = Number(task.record.conversationId);
+            const owner = owners.get(conversationId);
+            const extension = extensionsByTask.get(task.record.kind);
+            return {
+                id: Number(task.record.id),
+                kind: task.record.kind,
+                reason: task.state.reason,
+                conversationId,
+                ...(owner === undefined ? {} : { owner }),
+                ...(extension === undefined ? {} : { extension }),
+            };
+        });
+        return await reply.send({ tasks });
+    });
+    app.post("/v1/admin/tasks/:id/retry", async (request, reply) => {
+        if (!request.principal.admin) {
+            return await reply.code(403).send({ error: "forbidden" });
+        }
+        const { id } = request.params;
+        const taskId = Number(id);
+        if (!Number.isInteger(taskId) || taskId < 0 || String(taskId) !== id) {
+            return await reply.code(404).send({ error: "unknown_task" });
+        }
+        // Check inspect() FIRST: pi-durable's retryTask rejects an unknown
+        // id but SILENTLY no-ops for a task that isn't parked — the 409
+        // must come from the inspection, not from retryTask.
+        const inspection = await ctx.opened.harness.inspect(BACKGROUND_CONTEXT);
+        const task = inspection.tasks.find((candidate) => String(candidate.record.id) === id);
+        if (task === undefined) {
+            return await reply.code(404).send({ error: "unknown_task" });
+        }
+        if (task.state.kind !== "blocked" || task.state.reason !== "restart_limit") {
+            return await reply.code(409).send({ error: "not_parked" });
+        }
+        // For a schedule task the job's status fields return to `waiting`
+        // on the task's next committed state (the task's own phases patch
+        // the record) — the route deliberately does NOT hand-patch the job.
+        await ctx.opened.harness.retryTask(task.record.id, BACKGROUND_CONTEXT);
+        return await reply.code(204).send();
+    });
 }

package/dist/server/routes/images.js

@@ -17,9 +17,10 @@
  *   POSTed as the raw text body; the route's `bodyLimit` is the §11.1
  *   192 KiB rule (an over-limit body is Fastify's 413 `too_large`).
  *
- * Fetches go through the on-disk LRU cache (`<cacheDir>/images/`,
- * `images/cache.ts`): a hit re-serves without an upstream call, and
- * concurrent requests for one URL share ONE in-flight upstream fetch
+ * Fetches go through the on-disk LRU cache: a hit fresher than its
+ * clamped max-age re-serves without an upstream call; an older hit
+ * revalidates, and a refusal is never replaced by stale bytes.
+ * Concurrent requests for one URL share ONE in-flight upstream fetch
  * (Review Focus 4). Failures are never cached. Responses carry the
  * sniffed Content-Type, `X-Content-Type-Options: nosniff`, and
  * `Cache-Control: private, max-age=<upstream hint clamped to 1 h–7 d>`.
@@ -114,13 +115,17 @@ export function registerImageRoutes(app, ctx) {
     const inflight = new Map();
     /** Fetch one URL through the cache, sharing in-flight work. */
     async function fetchThroughCache(u, variant) {
-        const hit = await cache.get(u, variant);
-        if (hit !== undefined) {
+        const now = deps.now();
+        const hit = await cache.get(u, variant, now);
+        if (hit !== undefined && now - hit.addedAt < hit.maxAge * 1000) {
             const chunks = [];
             for await (const chunk of hit.stream)
                 chunks.push(chunk);
-            return { bytes: Buffer.concat(chunks), type: hit.type };
+            return { bytes: Buffer.concat(chunks), type: hit.type, maxAge: hit.maxAge };
         }
+        // A stale hit is never served: close its pin and revalidate.
+        if (hit !== undefined)
+            hit.stream.destroy();
         const inflightKey = `${variant}${u}`;
         const existing = inflight.get(inflightKey);
         if (existing !== undefined)
@@ -128,11 +133,13 @@ export function registerImageRoutes(app, ctx) {
         const work = (async () => {
             const fetched = await fetchImage(u, deps);
             // Cache the original variant first — `as=png` requests cache
-            // BOTH variants (the conversion reads the fetched bytes).
-            await cache.put(u, "orig", fetched.type, fetched.bytes);
+            // BOTH variants (the conversion reads the fetched bytes). The
+            // clamped hint is BOTH the response header and the cache TTL.
+            const maxAge = clampedMaxAge(fetched.maxAge);
+            await cache.put(u, "orig", fetched.type, fetched.bytes, deps.now(), maxAge);
             if (variant === "png") {
                 const converted = await toPng(fetched.bytes);
-                await cache.put(u, "png", "png", converted);
+                await cache.put(u, "png", "png", converted, deps.now(), maxAge);
                 return {
                     bytes: converted,
                     type: "png",

package/dist/server/routes/login.js

@@ -1,4 +1,5 @@
 import { ipAllowed } from "../auth/ip.js";
+import { requiresProxyVouch } from "../auth/proxy-only.js";
 import { bearerOf, resolveToken, sessionCookieOf } from "../auth/pipeline.js";
 import { LoginFlows } from "../login/flows.js";
 import { clearSetupCode, readSetupCode } from "../../harness/identity/setup-code.js";
@@ -191,6 +192,13 @@ export function registerLoginRoutes(app, ctx, options = {}) {
         // The webui client requests JSON so fetch never follows a redirect
         // into an HTML document. Existing form callers keep the 302 contract.
         const asJson = request.headers.accept?.includes("application/json") === true;
+        // C2: this route creates an account from a parked external-identity
+        // flow plus a setup/invite code — it carries NO proxy identity, so
+        // on a proxy-only non-loopback bind it ALWAYS refuses, before any
+        // code evaluation or account provisioning.
+        if (requiresProxyVouch(ctx.methods, ctx.listenHost)) {
+            return browserError(reply, 403, "proxy_identity_required", asJson);
+        }
         const pending = flows.takePending(record.key);
         if (pending === undefined)
             return browserError(reply, 400, "login_expired", asJson);

package/dist/server/routes/me.js

@@ -52,7 +52,7 @@ export function registerMeRoutes(app, ctx) {
         const settings = body;
         await stores.settings.set(settings);
         const { slug } = request.params;
-        opened.userServices.settingsChanged(slug, request.principal.user);
+        ctx.publishSettingsChanged({ extension: slug }, Object.keys(settings), request.principal.user);
         const response = { settings, pendingRestart: [] };
         return response;
     });

package/dist/server/routes/meta.js

@@ -39,6 +39,10 @@ export function registerMetaRoutes(app, ctx) {
             version: SIGRUN_VERSION,
             harnessVersion: HARNESS_VERSION,
             schemaVersion: SCHEMA_VERSION,
+            // The retained listener facts (release-readiness Task 1, serving
+            // spec §2): measured once at listen, projected verbatim — this
+            // route never probes (a pure synchronous projection).
+            listener: ctx.listener,
             extensions: opened.extensionOutcomes.map((outcome) => {
                 const workers = workerStatuses.get(outcome.name);
                 const surfaces = opened.extensionSurfaces.find((binding) => binding.extension === outcome.name);

package/dist/server/routes/metrics.js

@@ -55,12 +55,14 @@
  * type is `text/plain; version=0.0.4; charset=utf-8`.
  */
 import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
+import { REPORT_TYPES } from "../../harness/reports.js";
 import { readBackupMarker } from "../../backup/marker.js";
 import { scanJobs } from "../../jobs/docs.js";
 import { providerAuthStatus } from "../helpers.js";
 import { checkStorage } from "../readiness.js";
 /** The exposition content type (spec §6.9's format rule). */
 const EXPOSITION_CONTENT_TYPE = "text/plain; version=0.0.4; charset=utf-8";
+const BLOCKED_REASONS = ["missing_task", "task_too_old", "migration_failed", "restart_limit"];
 /** Escape one label value per the exposition format: `\` → `\\`,
  *  `"` → `\"`, newline → `\n`. */
 function escapeLabelValue(value) {
@@ -121,18 +123,28 @@ export function registerMetricsRoutes(app, ctx) {
             // run is live — the alert's `> 1800` must not key on absence).
             const oldestMs = opened.eventBus.oldestLiveAdmissionMs();
             family("sigrun_inflight_submission_oldest_seconds", "Age of the oldest in-flight submission's admission (0 when none; in-process clock — a pre-restart run is invisible until it settles)", [{ labels: {}, value: Math.round((oldestMs ?? 0) / 1000) }]);
-            // Live tasks by scheduler state kind. The full five-kind
-            // vocabulary is emitted (0s included) for label stability.
+            // Live tasks by scheduler state kind. The full six-kind
+            // vocabulary is emitted (0s included) for label stability
+            // (1.4.0 adds `sleeping` — the durable-sleep state).
             const taskStatuses = {
                 running: 0,
                 ready: 0,
                 waiting: 0,
+                sleeping: 0,
                 completing: 0,
                 blocked: 0,
             };
+            const blockedReasons = Object.fromEntries(BLOCKED_REASONS.map((reason) => [reason, 0]));
             for (const task of inspection.tasks) {
                 taskStatuses[task.state.kind] = (taskStatuses[task.state.kind] ?? 0) + 1;
+                if (task.state.kind === "blocked") {
+                    blockedReasons[task.state.reason] = (blockedReasons[task.state.reason] ?? 0) + 1;
+                }
             }
+            family("sigrun_tasks_blocked", "Live tasks blocked by scheduler reason", Object.entries(blockedReasons).map(([reason, count]) => ({
+                labels: { reason },
+                value: count,
+            })));
             family("sigrun_tasks_live", "Live tasks by scheduler state", Object.entries(taskStatuses).map(([status, count]) => ({
                 labels: { status },
                 value: count,
@@ -173,6 +185,10 @@ export function registerMetricsRoutes(app, ctx) {
         // failure even while inspection (and the whole scrape) stays green.
         const storage = await checkStorage(ctx);
         family("sigrun_ready", "1 when the readiness storage check (the /readyz root-conversation read) succeeds", [{ labels: {}, value: storage === "ok" ? 1 : 0 }]);
+        // D5: process-local durable failure reports. Every known type is
+        // emitted, including zeros, for scrape-stable alert expressions.
+        const reportCounts = opened.reports.counts();
+        family("sigrun_durable_reports_total", "Durable failure reports since process start", REPORT_TYPES.map((type) => ({ labels: { type }, value: reportCounts[type] })), "counter");
         // Provider readiness: the shared derivation (`GET /v1/auth/check`'s
         // exact chain), one 1-valued sample per (provider, current status).
         const producersByName = new Map(opened.providerHealth.map((producer) => [producer.name, producer]));