@songsid/agend 2.1.5 → 2.1.6-beta.10

package/dist/secret-store.js

@@ -0,0 +1,165 @@
+/**
+ * Small, deliberately boring secret store for the running Settings API.
+ *
+ * Secrets live in the existing .env file for compatibility with the CLI, but
+ * all writes go through this module.  The write is same-directory atomic,
+ * owner-only, and returns a snapshot that can be restored when an adapter
+ * rebuild fails.  No exception from this module includes the secret value.
+ */
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, chmodSync, } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { dirname, join } from "node:path";
+export const SECRET_ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+const RESERVED_ENV_KEYS = new Set([
+    "PATH", "HOME", "PWD", "SHELL", "ENV", "BASH_ENV", "NODE_OPTIONS", "LD_PRELOAD",
+]);
+function fsyncDirectory(path, fsync) {
+    const fd = openSync(path, "r");
+    try {
+        fsync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Replace one KEY=value while retaining comments and unrelated variables. */
+export function upsertSecretEnvLine(existing, key, value) {
+    const lines = existing.split(/\r?\n/);
+    let replaced = false;
+    const next = lines.map(line => {
+        const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        if (!match || match[1] !== key)
+            return line;
+        replaced = true;
+        return `${key}=${value}`;
+    });
+    if (!replaced) {
+        while (next.length && next[next.length - 1] === "")
+            next.pop();
+        next.push(`${key}=${value}`);
+    }
+    return next.join("\n").replace(/\n*$/, "\n");
+}
+export class SecretStore {
+    path;
+    allowedKeys;
+    fsync;
+    constructor(path, allowedKeys = new Set(), opts = {}) {
+        this.path = path;
+        this.allowedKeys = allowedKeys;
+        this.fsync = opts.fsync ?? fsyncSync;
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        this.rejectSymlink(path);
+    }
+    rejectSymlink(path) {
+        try {
+            if (lstatSync(path).isSymbolicLink())
+                throw new Error("secret file must not be a symlink");
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+    }
+    validateKey(key) {
+        if (!SECRET_ENV_KEY.test(key) || RESERVED_ENV_KEYS.has(key))
+            throw new Error("secret key is not allowed");
+        if (this.allowedKeys.size > 0 && !this.allowedKeys.has(key))
+            throw new Error("secret key is not configured for a connection");
+    }
+    snapshot() {
+        this.rejectSymlink(this.path);
+        try {
+            return { exists: true, content: readFileSync(this.path, "utf8") };
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return { exists: false, content: "" };
+            throw new Error("secret file could not be read");
+        }
+    }
+    /** Atomic replacement; callers should retain snapshot() for rollback. */
+    replace(content) {
+        this.rejectSymlink(this.path);
+        const dir = dirname(this.path);
+        const temp = join(dir, `.${this.path.split(/[\\/]/).pop() ?? "env"}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+        let fd;
+        try {
+            fd = openSync(temp, "wx", 0o600);
+            writeSync(fd, content, undefined, "utf8");
+            this.fsync(fd);
+            closeSync(fd);
+            fd = undefined;
+            // chmod is deliberately a hard error: a successful rename with loose
+            // permissions is never reported as an applied secret.
+            chmodSync(temp, 0o600);
+            this.rejectSymlink(temp);
+            renameSync(temp, this.path);
+            this.fsyncDirectory(dir);
+        }
+        catch (err) {
+            if (fd !== undefined) {
+                try {
+                    closeSync(fd);
+                }
+                catch { /* best effort */ }
+            }
+            try {
+                unlinkSync(temp);
+            }
+            catch { /* best effort */ }
+            if (err instanceof Error && /secret file must not be a symlink/.test(err.message))
+                throw err;
+            throw new Error("secret file could not be written atomically");
+        }
+    }
+    fsyncDirectory(path) {
+        try {
+            fsyncDirectory(path, this.fsync);
+        }
+        catch {
+            throw new Error("secret directory could not be synced");
+        }
+    }
+    restore(snapshot) {
+        if (snapshot.exists)
+            this.replace(snapshot.content);
+        else {
+            this.rejectSymlink(this.path);
+            try {
+                unlinkSync(this.path);
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    throw new Error("secret rollback could not remove file");
+            }
+            try {
+                this.fsyncDirectory(dirname(this.path));
+            }
+            catch {
+                throw new Error("secret rollback could not sync directory");
+            }
+        }
+    }
+    write(key, value) {
+        this.validateKey(key);
+        if (!value || /[\r\n\0]/.test(value))
+            throw new Error("secret value is invalid");
+        const before = this.snapshot();
+        try {
+            this.replace(upsertSecretEnvLine(before.content, key, value));
+        }
+        catch (err) {
+            // A directory fsync can fail after rename has already replaced the
+            // target. Restore the snapshot here so callers never see a failed write
+            // with a new secret left on disk.
+            try {
+                this.restore(before);
+            }
+            catch { /* caller reports rollback failure */ }
+            throw err;
+        }
+        return before;
+    }
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../src/secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,SAAS,EAET,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY;CAChF,CAAC,CAAC;AAYH,SAAS,cAAc,CAAC,IAAY,EAAE,KAA2B;IAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5C,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,WAAW;IAIX;IACQ;IAJF,KAAK,CAAuB;IAE7C,YACW,IAAY,EACJ,cAAmC,IAAI,GAAG,EAAE,EAC7D,OAA2B,EAAE;QAFpB,SAAI,GAAJ,IAAI,CAAQ;QACJ,gBAAW,GAAX,WAAW,CAAiC;QAG7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;QACrC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAEO,aAAa,CAAC,IAAY;QAChC,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC1G,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChI,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAAC,CAAC;QAC1E,OAAO,GAAG,EAAE,CAAC;YACX,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,OAAe;QACrB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3H,IAAI,EAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACf,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,EAAE,GAAG,SAAS,CAAC;YAC9B,qEAAqE;YACrE,sDAAsD;YACtD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACzB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAAC,CAAC;YAC5E,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACrD,IAAI,GAAG,YAAY,KAAK,IAAI,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,CAAC;YAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACzC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,QAAwB;QAC9B,IAAI,QAAQ,CAAC,MAAM;YAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAC/C,CAAC;YACJ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAC1C,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC;gBAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAAC,CAAC;QACzH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,wEAAwE;YACxE,kCAAkC;YAClC,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;YAC7E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/self-restart-limit.d.ts

@@ -0,0 +1,21 @@
+/** At most one panel-triggered self-restart per 10 minutes… */
+export declare const SELF_RESTART_MIN_INTERVAL_MS: number;
+/** …and at most three in an hour, so a slow drip cannot add up to a outage. */
+export declare const SELF_RESTART_WINDOW_MS: number;
+export declare const SELF_RESTART_MAX_PER_WINDOW = 3;
+export interface SelfRestartAllowance {
+    allowed: boolean;
+    /** Seconds until the next attempt would be accepted; 0 when allowed. */
+    retryAfterSeconds: number;
+    reason?: "too-soon" | "hourly-cap" | "unreadable";
+}
+export declare function checkSelfRestartAllowance(dataDir: string, now?: number): SelfRestartAllowance;
+/**
+ * Record an attempt durably, and say whether it reached the disk.
+ *
+ * The caller must refuse to restart when this returns false: an unrecorded
+ * attempt is an unlimited one.
+ */
+export declare function recordSelfRestartAttempt(dataDir: string, now?: number): boolean;
+/** Test seam: the attempts currently on disk, empty when unreadable. */
+export declare function readSelfRestartAttempts(dataDir: string): number[];

package/dist/self-restart-limit.js

@@ -0,0 +1,129 @@
+/**
+ * How often the Settings panel may restart AgEnD itself.
+ *
+ * This is one of the three things that actually hold the DoS line (with the
+ * cookie/Origin gate and the out-of-band notice in the channel). The
+ * "there must be a pending fleet-level change" precondition is *not* one of
+ * them: whoever holds the token can create a pending change at will, so that
+ * check only stops misclicks.
+ *
+ * Three properties the file has to have, all learned from how this fails:
+ *
+ * - **Written and fsynced before the restart is launched.** The process is
+ *   about to be replaced. An attempt recorded after the spawn, or left in the
+ *   OS page cache, is an attempt that never happened — and a rate limit whose
+ *   counter resets on every restart does not limit restarts.
+ * - **Attempts, not successes.** A restart that reliably fails would otherwise
+ *   be retryable without limit, which is the cheapest possible attack.
+ * - **No route may clear it.** A rate limit the attacker can reset is not a
+ *   rate limit. Nothing in the web layer writes this file except `record()`.
+ * - **Unreadable means spent, not fresh.** Treating a corrupt file as an empty
+ *   one would let the control disarm itself exactly when its state is in doubt.
+ *   Recovery is deleting the file on the host — which needs the same access as
+ *   running `agend restart` directly.
+ */
+import { closeSync, fsyncSync, openSync, readFileSync, writeSync } from "node:fs";
+import { join } from "node:path";
+const FILE = "self-restart.json";
+/** At most one panel-triggered self-restart per 10 minutes… */
+export const SELF_RESTART_MIN_INTERVAL_MS = 10 * 60_000;
+/** …and at most three in an hour, so a slow drip cannot add up to a outage. */
+export const SELF_RESTART_WINDOW_MS = 60 * 60_000;
+export const SELF_RESTART_MAX_PER_WINDOW = 3;
+function path(dataDir) {
+    return join(dataDir, FILE);
+}
+function read(dataDir) {
+    let raw;
+    try {
+        raw = readFileSync(path(dataDir), "utf-8");
+    }
+    catch (err) {
+        // Never written yet — the normal first run.
+        if (err.code === "ENOENT")
+            return { state: "empty" };
+        return { state: "unreadable" };
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed.attempts))
+            return { state: "unreadable" };
+        const attempts = parsed.attempts.filter(item => typeof item === "number" && Number.isFinite(item));
+        if (attempts.length !== parsed.attempts.length)
+            return { state: "unreadable" };
+        return { state: "ok", attempts };
+    }
+    catch {
+        // Half-written or corrupt. The one thing this must not do is read as "no
+        // attempts yet" — a rate limit that resets itself when its own state is
+        // damaged is not a rate limit.
+        return { state: "unreadable" };
+    }
+}
+function recordedAttempts(dataDir) {
+    const state = read(dataDir);
+    return state.state === "ok" ? state.attempts : [];
+}
+export function checkSelfRestartAllowance(dataDir, now = Date.now()) {
+    const state = read(dataDir);
+    if (state.state === "unreadable") {
+        return { allowed: false, reason: "unreadable", retryAfterSeconds: 0 };
+    }
+    const attempts = (state.state === "ok" ? state.attempts : [])
+        .filter(at => now - at < SELF_RESTART_WINDOW_MS)
+        .sort((a, b) => a - b);
+    const last = attempts[attempts.length - 1];
+    if (last !== undefined && now - last < SELF_RESTART_MIN_INTERVAL_MS) {
+        return {
+            allowed: false,
+            reason: "too-soon",
+            retryAfterSeconds: Math.max(1, Math.ceil((SELF_RESTART_MIN_INTERVAL_MS - (now - last)) / 1000)),
+        };
+    }
+    if (attempts.length >= SELF_RESTART_MAX_PER_WINDOW) {
+        const oldest = attempts[attempts.length - SELF_RESTART_MAX_PER_WINDOW];
+        return {
+            allowed: false,
+            reason: "hourly-cap",
+            retryAfterSeconds: Math.max(1, Math.ceil((SELF_RESTART_WINDOW_MS - (now - oldest)) / 1000)),
+        };
+    }
+    return { allowed: true, retryAfterSeconds: 0 };
+}
+/**
+ * Record an attempt durably, and say whether it reached the disk.
+ *
+ * The caller must refuse to restart when this returns false: an unrecorded
+ * attempt is an unlimited one.
+ */
+export function recordSelfRestartAttempt(dataDir, now = Date.now()) {
+    const attempts = [...recordedAttempts(dataDir).filter(at => now - at < SELF_RESTART_WINDOW_MS), now];
+    const target = path(dataDir);
+    let fd = null;
+    try {
+        // Written in place with an fsync rather than the usual write-temp-and-rename:
+        // what matters here is that the bytes are on the device before the process
+        // is replaced, and a rename would need its own directory fsync to promise
+        // the same thing.
+        fd = openSync(target, "w", 0o600);
+        writeSync(fd, JSON.stringify({ attempts }));
+        fsyncSync(fd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* already gone */ }
+        }
+    }
+}
+/** Test seam: the attempts currently on disk, empty when unreadable. */
+export function readSelfRestartAttempts(dataDir) {
+    return recordedAttempts(dataDir);
+}
+//# sourceMappingURL=self-restart-limit.js.map

package/dist/self-restart-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-restart-limit.js","sourceRoot":"","sources":["../src/self-restart-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,mBAAmB,CAAC;AAEjC,+DAA+D;AAC/D,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AACxD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,MAAM,CAAC;AAClD,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAa7C,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC7B,CAAC;AAOD,SAAS,IAAI,CAAC,OAAe;IAC3B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4CAA4C;QAC5C,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAChF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACnG,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QAC/E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,wEAAwE;QACxE,+BAA+B;QAC/B,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,KAAK,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,sBAAsB,CAAC;SAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE3C,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,4BAA4B,EAAE,CAAC;QACpE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,UAAU;YAClB,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,4BAA4B,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;SAChG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,2BAA2B,CAAE,CAAC;QACxE,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,YAAY;YACpB,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,sBAAsB,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;SAC5F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACxE,MAAM,QAAQ,GAAG,CAAC,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,sBAAsB,CAAC,EAAE,GAAG,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,8EAA8E;QAC9E,2EAA2E;QAC3E,0EAA0E;QAC1E,kBAAkB;QAClB,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAClC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAsB,CAAC,CAAC,CAAC;QAChE,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,uBAAuB,CAAC,OAAe;IACrD,OAAO,gBAAgB,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}

package/dist/settings-api.d.ts

@@ -25,6 +25,9 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Logger } from "./logger.js";
 import type { FleetConfig, RawFleetConfig } from "./types.js";
+import { type ApplyJob, type ApplyJobStore, type SelfRestartResult } from "./apply-job.js";
+import { type ConnectionMetadata, type ConnectionBinding, type BindingProbe, type SecretApplyJob, type ProviderSecretApplyJob } from "./connection-secrets.js";
+import type { ProviderSecretStatus } from "./provider-secret-registry.js";
 export interface SettingsApiContext {
     fleetConfig: FleetConfig | null;
     configPath: string | null;
@@ -39,6 +42,119 @@ export interface SettingsApiContext {
     };
     isClassicInstance?(name: string): boolean;
     restartClassicInstanceFromSettings?(instanceName: string, changedFields?: string[]): Promise<void>;
+    /** Present on a real fleet; absent in unit contexts that only exercise CRUD. */
+    applyJobs?: ApplyJobStore;
+    startSettingsApply?(key: string): {
+        job: ApplyJob;
+        reused: boolean;
+    } | {
+        busy: ApplyJob | null;
+    };
+    requestSettingsSelfRestart?(jobId: string, key: string): Promise<SelfRestartResult>;
+    /** Non-null when the running config and fleet.yaml disagree on a
+     * startup-only key, in which case a restart cannot clear the fleet row. */
+    fleetSignatureMismatchKeys?(): string[] | null;
+    /** True when a running adapter is already long-polling this bot token. */
+    isBotTokenInUse?(token: string): boolean;
+    /** Secure Connections & Bots operations. The outer fleet HTTP server has
+     * already authenticated the Settings web session before this handler runs. */
+    listSecureConnections?(): ConnectionMetadata[];
+    verifyConnectionSecret?(input: {
+        connectionId: string;
+        secret: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        identity?: {
+            id: string | null;
+            username: string | null;
+        };
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    startConnectionSecretApply?(input: {
+        connectionId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: SecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: SecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    getConnectionSecretApply?(jobId: string, sessionBinding: string): SecretApplyJob | null;
+    /** Generic provider API-key verifier registry (#861). */
+    providerSecretsEnabled?(): boolean;
+    listProviderSecrets?(): ProviderSecretStatus[];
+    verifyProviderSecret?(input: {
+        specId: string;
+        secret: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        spec_id: string;
+        activation: "next_use" | "reload_hook";
+    } | {
+        ok: false;
+        status: string;
+        error: string;
+    }>;
+    startProviderSecretApply?(input: {
+        specId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: ProviderSecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: ProviderSecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    getProviderSecretApply?(jobId: string, sessionBinding: string): ProviderSecretApplyJob | null;
+    verifyConnectionBinding?(input: {
+        connectionId: string;
+        binding: {
+            group_id?: unknown;
+            general_channel_id?: unknown;
+        };
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        binding: ConnectionBinding;
+        probe: BindingProbe;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    startConnectionBindingApply?(input: {
+        connectionId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: SecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: SecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    getConnectionBindingApply?(jobId: string, sessionBinding: string): SecretApplyJob | null;
 }
 /** An explicit user-authored YAML mutation that must be persisted even when
  * its value equals the defaults-expanded runtime snapshot. */