@songsid/agend 2.2.0 → 2.3.0-beta.1

package/dist/daemon.js

@@ -1,5 +1,6 @@
 import { AGENT_WHATS_NEW, agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, whatsNewNotice } from "./agent-whats-new.js";
-import { join, dirname, basename, resolve } from "node:path";
+import { join, dirname, resolve } from "node:path";
+import { checkoutTarget, readCheckouts, releaseCandidate, reposRoot, verifyWorktree, writeCheckouts } from "./repo-worktree-guard.js";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
 import { COMPACT_WATCH_TIMEOUT_MS, launchIdentity } from "./compact-watch.js";
 import { KIRO_COMPACT_PANE_LINES, KiroCompactPaneFollower } from "./kiro-compact-pane.js";
@@ -19,6 +20,9 @@ import { TranscriptTurnLedger } from "./transcript-turns.js";
 import { credentialProfileStoreHome, resolveCredentialProfile } from "./backend/credential-profile.js";
 import { resolveToolSet } from "./tool-permissions.js";
 import { getAgendHome } from "./paths.js";
+import { readAgentEffect, sendEffectInParts } from "./web-effect-upload.js";
+import { readAgentFile } from "./agent-file-read.js";
+import { ASSET_UPLOAD_MAX_BYTES, MOD_FILE, MOD_MAX_PARTS, MOD_UPLOAD_MAX_BYTES, receiveFiles, receivePreview, sendAssetInParts, writeModFile, writePreview } from "./web-asset-parts.js";
 import { LOGIN_FLOWS } from "./login-flows.js";
 import { ProgressAccumulator, summarizeProgress } from "./tool-progress.js";
 import { assembleSystemPrompt, resolveWorkflowText } from "./prompt-file-ref.js";
@@ -55,6 +59,26 @@ import { unrecognisedPromptShape } from "./unrecognised-prompt.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
+/** #1629: the caller's own web theme tools, each its own typed IPC message (one tool per type, for the permission check). */
+const WEB_THEME_IPC = Object.freeze({
+    get_web_theme: "fleet_get_web_theme", set_web_theme: "fleet_set_web_theme",
+    set_web_theme_asset: "fleet_set_web_theme_asset", reset_web_theme: "fleet_reset_web_theme",
+    // r4 §1: how it appears — read-only; a preview's files are written here, on the agent's side.
+    get_web_appearance: "fleet_get_web_appearance", preview_web_appearance: "fleet_preview_web_appearance",
+    // r4-4: its own declarative widgets.
+    set_web_widget: "fleet_set_web_widget", remove_web_widget: "fleet_remove_web_widget",
+    // r4-5b: mods — an export's file is written here, a proposal's file read here (on the agent's side).
+    export_web_mod: "fleet_export_web_mod", propose_web_mod: "fleet_propose_web_mod",
+    upload_web_effect: "fleet_upload_web_effect",
+    list_web_effects: "fleet_list_web_effects",
+    preview_web_effect: "fleet_preview_web_effect",
+    profile_web_effect: "fleet_profile_web_effect",
+    apply_web_effect: "fleet_apply_web_effect",
+    remove_web_effect: "fleet_remove_web_effect",
+    delete_web_effect: "fleet_delete_web_effect",
+});
+/** The largest picture any slot may take (a card slot's ceiling; the fleet checks the limit in force): read no more. */
+const WEB_THEME_ASSET_MAX_BYTES = ASSET_UPLOAD_MAX_BYTES;
 const CROSS_INSTANCE_TOOLS = new Set(["send_to_instance", "broadcast", "list_instances", "start_instance", "restart_instance", "create_instance", "delete_instance", "replace_instance", "request_information", "delegate_task", "report_result", "delivery_status", "describe_instance"]);
 const SCHEDULE_TOOLS = new Set(["create_schedule", "list_schedules", "update_schedule", "delete_schedule"]);
 const DECISION_TOOLS = new Set(["post_decision", "list_decisions", "update_decision"]);
@@ -1073,7 +1097,7 @@ export class BlockingProcessDetector {
 /** Response types the fleet sends back for tool calls the daemon forwarded. */
 const FLEET_RESPONSE_TYPES = new Set([
     "fleet_schedule_response", "fleet_outbound_response", "fleet_decision_response", "fleet_task_response",
-    "fleet_display_name_response", "fleet_description_response", "fleet_persona_emoji_response",
+    "fleet_display_name_response", "fleet_description_response", "fleet_persona_emoji_response", "fleet_web_theme_response",
 ]);
 export class Daemon extends EventEmitter {
     name;
@@ -9945,6 +9969,169 @@ export class Daemon extends EventEmitter {
             });
             return;
         }
+        // #1629: the caller's own web theme. set_web_theme_asset's file is read HERE, on the agent's side (in its working
+        // directory, no symlink, size-capped): the fleet receives bytes, never a workspace path.
+        if (Object.hasOwn(WEB_THEME_IPC, tool)) {
+            // Answered exactly once, whatever happens on the way (#1887 review: a throw here once left the call unanswered).
+            let answered = false;
+            const reply = (result, error) => { if (answered)
+                return; answered = true; respond(result, error); };
+            // One fleet request; resolves with its answer, or an error string (never rejects).
+            const ask = (payload) => new Promise((resolve) => {
+                const fleetReqId = `theme_${++this.fleetRequestSeq}_${requestId}`;
+                const timeout = setTimeout(() => {
+                    this.pendingIpcRequests.delete(fleetReqId);
+                    resolve({ result: null, error: `${tool} timed out` });
+                }, daemonBudgetMs(tool));
+                this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
+                    clearTimeout(timeout);
+                    resolve({ result: respMsg.result, error: respMsg.error });
+                });
+                this.ipcServer?.broadcast({ type: WEB_THEME_IPC[tool], payload, meta: { instance_name: this.name }, fleetRequestId: fleetReqId });
+            });
+            void (async () => {
+                if (tool === "preview_web_appearance") {
+                    // The fleet builds the SVGs (whole, or in parts); they are written here, in the working directory.
+                    const first = await ask({ ...(args.modes !== undefined ? { modes: args.modes } : {}) });
+                    if (first.error) {
+                        reply(null, first.error);
+                        return;
+                    }
+                    let failed;
+                    const got = await receivePreview((first.result && typeof first.result === "object" ? first.result : {}), async (payload) => {
+                        const r = await ask(payload);
+                        if (r.error) {
+                            failed = r.error;
+                            return { error: r.error };
+                        }
+                        return (r.result && typeof r.result === "object" ? r.result : {});
+                    });
+                    if (failed) {
+                        reply(null, failed);
+                        return;
+                    }
+                    if ("error" in got) {
+                        reply(got, undefined);
+                        return;
+                    }
+                    const written = await writePreview(got.files, { workspace: this.config.working_directory, stateDir: getAgendHome() });
+                    if ("error" in written) {
+                        reply(null, `preview_web_appearance: ${written.error}`);
+                        return;
+                    }
+                    reply(written, undefined);
+                    return;
+                }
+                if (tool === "export_web_mod") {
+                    // The fleet builds the file (whole, or in parts); it is written here, in the working directory.
+                    const first = await ask(args);
+                    if (first.error) {
+                        reply(null, first.error);
+                        return;
+                    }
+                    let failed;
+                    const firstResult = (first.result && typeof first.result === "object" ? first.result : {});
+                    const got = await receiveFiles(firstResult, async (payload) => {
+                        const r = await ask(payload);
+                        if (r.error) {
+                            failed = r.error;
+                            return { error: r.error };
+                        }
+                        return (r.result && typeof r.result === "object" ? r.result : {});
+                    }, { name: MOD_FILE, idKey: "transfer", what: "export", maxParts: MOD_MAX_PARTS });
+                    if (failed) {
+                        reply(null, failed);
+                        return;
+                    }
+                    if ("error" in got) {
+                        reply(got, undefined);
+                        return;
+                    }
+                    const written = await writeModFile(got.files, { workspace: this.config.working_directory, stateDir: getAgendHome() });
+                    if ("error" in written) {
+                        reply(null, `export_web_mod: ${written.error}`);
+                        return;
+                    }
+                    reply({ ...written, ...(firstResult.effects_omitted ? { effects_omitted: firstResult.effects_omitted } : {}) }, undefined);
+                    return;
+                }
+                if (tool === "propose_web_mod") {
+                    const read = await readAgentFile(args.file, { workspace: this.config.working_directory, stateDir: getAgendHome(), maxBytes: MOD_UPLOAD_MAX_BYTES });
+                    const named = typeof args.file === "string" ? args.file.slice(0, 200) : "the file argument";
+                    if (!read.ok) {
+                        reply(null, `propose_web_mod: ${named} — ${read.reason}`);
+                        return;
+                    }
+                    let failed;
+                    const answer = await sendAssetInParts("mod", read.bytes, async (payload) => {
+                        const r = await ask(payload);
+                        if (r.error) {
+                            failed = r.error;
+                            return { error: r.error };
+                        }
+                        return (r.result && typeof r.result === "object" ? r.result : {});
+                    });
+                    reply(failed ? null : answer, failed);
+                    return;
+                }
+                if (tool === "upload_web_effect") {
+                    const owner = { fence: this.launchFenceEpoch, spawn: this.spawnGeneration, boot: this.bootId, ipc: this.ipcServer };
+                    const current = () => !!owner.ipc && owner.ipc === this.ipcServer && owner.fence === this.launchFenceEpoch && owner.spawn === this.spawnGeneration && owner.boot === this.bootId && !this.deliveryWritesStopping && !this.startupAborted;
+                    if (!current()) {
+                        reply(null, "upload_web_effect: launch no longer current");
+                        return;
+                    }
+                    const read = await readAgentEffect(args.dir, { workspace: this.config.working_directory, stateDir: getAgendHome() });
+                    if (!current()) {
+                        reply(null, "upload_web_effect: launch no longer current");
+                        return;
+                    }
+                    if (!read.ok) {
+                        reply(null, `upload_web_effect: ${read.reason}`);
+                        return;
+                    }
+                    let failed;
+                    const answer = await sendEffectInParts(read.files, async (payload) => {
+                        if (!current()) {
+                            failed = "upload_web_effect: launch no longer current";
+                            return { error: failed };
+                        }
+                        const r = await ask(payload);
+                        if (r.error) {
+                            failed = r.error;
+                            return { error: r.error };
+                        }
+                        return (r.result && typeof r.result === "object" ? r.result : {});
+                    });
+                    reply(failed ? null : answer, failed);
+                    return;
+                }
+                if (tool !== "set_web_theme_asset") {
+                    const r = await ask(args);
+                    reply(r.result, r.error);
+                    return;
+                }
+                const read = await readAgentFile(args.file, { workspace: this.config.working_directory, stateDir: getAgendHome(), maxBytes: WEB_THEME_ASSET_MAX_BYTES });
+                // The path as the agent gave it — only a string is shown (an object from raw JSON args is never coerced).
+                const named = typeof args.file === "string" ? args.file.slice(0, 200) : "the file argument";
+                if (!read.ok) {
+                    reply(null, `set_web_theme_asset: ${named} — ${read.reason}`);
+                    return;
+                }
+                // A picture larger than one IPC message goes up in parts (r4 §1: a card portrait may be megabytes).
+                let failed;
+                const answer = await sendAssetInParts(args.slot, read.bytes, async (payload) => {
+                    const r = await ask(payload);
+                    if (r.error) {
+                        failed = r.error;
+                        return { error: r.error };
+                    }
+                    return (r.result && typeof r.result === "object" ? r.result : {});
+                });
+                reply(failed ? null : answer, failed);
+            })().catch((err) => reply(null, `${tool} failed: ${err instanceof Error ? err.message : "error"}`));
+            return;
+        }
         if (tool === TASK_TOOL) {
             const fleetReqId = `task_${++this.fleetRequestSeq}_${requestId}`;
             const timeout = setTimeout(() => {
@@ -12055,16 +12242,29 @@ export class Daemon extends EventEmitter {
             respond(null, `Not a git repository: ${source}`);
             return;
         }
-        const repoDir = join(this.instanceDir, "repos");
-        mkdirSync(repoDir, { recursive: true });
-        const safeName = `${basename(source)}-${branch.replace(/\//g, "-")}`;
-        const worktreePath = join(repoDir, safeName);
+        mkdirSync(join(this.instanceDir, "repos"), { recursive: true });
+        // Only a fresh direct child of a real repos/ directory (never through a symlinked repos/, never an existing path).
+        const target = checkoutTarget(this.instanceDir, source, branch);
+        if (!target.ok) {
+            respond(null, `checkout_repo: ${target.reason}`);
+            return;
+        }
+        const worktreePath = target.path;
         try {
-            // Resolve branch/ref to verify it exists. Use `--` so git never treats
-            // branch as an option flag (defense in depth on top of the regex above).
-            await execFileAsync("git", ["rev-parse", "--verify", "--", branch], { cwd: source });
-            await execFileAsync("git", ["worktree", "add", "--detach", worktreePath, branch], { cwd: source });
+            // Resolve branch/ref to verify it exists. `--end-of-options` keeps git from ever reading branch as an option
+            // flag (defense in depth on top of the regex above). Not `--`: rev-parse then reads branch as a path, and
+            // `--verify` fails for every ref ("Needed a single revision"), which broke checkout_repo entirely.
+            await execFileAsync("git", ["rev-parse", "--verify", "--end-of-options", `${branch}^{commit}`], { cwd: source });
+            await execFileAsync("git", ["worktree", "add", "--detach", worktreePath, "--end-of-options", branch], { cwd: source });
             const { stdout: commitHash } = await execFileAsync("git", ["rev-parse", "--short", "HEAD"], { cwd: worktreePath });
+            // Recorded so release_repo can tell this instance's checkout of this repository from anything else.
+            try {
+                const { stdout: common } = await execFileAsync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], { cwd: worktreePath });
+                const root = reposRoot(this.instanceDir);
+                if (root.ok)
+                    writeCheckouts(root.path, { ...readCheckouts(root.path), [worktreePath]: common.trim() });
+            }
+            catch { /* unrecorded: release still requires a listed linked worktree */ }
             respond({ path: worktreePath, branch, source, commit: commitHash.trim() });
         }
         catch (err) {
@@ -12072,26 +12272,50 @@ export class Daemon extends EventEmitter {
         }
     }
     async handleReleaseRepo(args, respond) {
-        const repoPath = args.path;
-        const reposDir = join(this.instanceDir, "repos");
-        // Safety: only allow releasing paths under our repos/ directory
-        if (!repoPath.startsWith(reposDir)) {
-            respond(null, `Cannot release path outside instance repos directory`);
+        // Containment first (real paths, strictly inside this instance's repos/), then proof it is a git worktree.
+        // Nothing that fails either check is ever removed.
+        const candidate = releaseCandidate(this.instanceDir, args.path);
+        if (!candidate.ok) {
+            respond(null, `Cannot release: ${candidate.reason}`);
             return;
         }
+        const root = reposRoot(this.instanceDir);
+        if (!root.ok) {
+            respond(null, `Cannot release: ${root.reason}`);
+            return;
+        }
+        const { execFile: execFileCb } = await import("node:child_process");
+        const { promisify } = await import("node:util");
+        const execFileAsync = promisify(execFileCb);
+        const git = async (gitArgs, cwd) => (await execFileAsync("git", gitArgs, { cwd })).stdout;
+        const worktree = await verifyWorktree(root.path, candidate.path, git);
+        if (!worktree.ok) {
+            respond(null, `Cannot release: ${worktree.reason}`);
+            return;
+        }
+        const repoPath = candidate.path;
         try {
-            const { execFile: execFileCb } = await import("node:child_process");
-            const { promisify } = await import("node:util");
-            const execFileAsync = promisify(execFileCb);
-            await execFileAsync("git", ["worktree", "remove", "--force", repoPath]);
+            await git(["--git-dir", worktree.commonDir, "worktree", "remove", "--force", repoPath], worktree.commonDir);
         }
         catch {
-            // Fallback: rm directly if git worktree remove fails
+            // Fallback for a verified worktree only: remove it, then let its repository forget it.
             try {
                 rmSync(repoPath, { recursive: true, force: true });
             }
             catch { /* best effort */ }
+            try {
+                await git(["--git-dir", worktree.commonDir, "worktree", "prune"], worktree.commonDir);
+            }
+            catch { /* best effort */ }
+        }
+        try {
+            const records = readCheckouts(root.path);
+            if (repoPath in records) {
+                delete records[repoPath];
+                writeCheckouts(root.path, records);
+            }
         }
+        catch { /* the worktree is gone; a stale record only refuses a later, different repo at this path */ }
         respond({ released: true, path: repoPath });
     }
     buildSnapshotPrompt() {