@tea-agent/loop-agent 0.22.0 → 0.24.0

package/dist/worker/console/chat/contract-apply-receipt-store.js

@@ -0,0 +1,174 @@
+/**
+ * Contract-apply Human Gate receipts with atomic prepared → dispatching →
+ * dispatched consumption so concurrent confirm POSTs cannot create duplicate
+ * operations.
+ */
+import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import path from "node:path";
+export class ContractApplyReceiptStore {
+    dir;
+    constructor(appData) {
+        this.dir = path.join(appData.root, "contract-apply-receipts");
+    }
+    file(id) {
+        return path.join(this.dir, `${id.replace(/[^a-zA-Z0-9_-]/g, "_")}.json`);
+    }
+    async prepare(input) {
+        const receipt = {
+            schemaVersion: 1,
+            state: "prepared",
+            ...input,
+        };
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        await writeFile(this.file(receipt.receiptId), `${JSON.stringify(receipt, null, 2)}\n`, { mode: 0o600 });
+        return receipt;
+    }
+    async get(id) {
+        try {
+            return JSON.parse(await readFile(this.file(id), "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return undefined;
+            throw error;
+        }
+    }
+    async tryReserve(id) {
+        const receipt = await this.get(id);
+        if (!receipt) {
+            return {
+                ok: false,
+                code: "NOT_FOUND",
+                message: `receipt not found: ${id}`,
+            };
+        }
+        if (Date.parse(receipt.expiresAt) <= Date.now()) {
+            return {
+                ok: false,
+                code: "EXPIRED",
+                message: "contract apply receipt expired",
+                receipt,
+            };
+        }
+        if (receipt.state === "dispatching") {
+            return {
+                ok: true,
+                receipt,
+                reserved: false,
+                reason: "already-dispatching",
+            };
+        }
+        if (receipt.state === "dispatched") {
+            return {
+                ok: true,
+                receipt,
+                reserved: false,
+                reason: "already-dispatched",
+            };
+        }
+        if (receipt.state !== "prepared") {
+            return {
+                ok: false,
+                code: "INVALID_STATE",
+                message: `receipt is ${receipt.state}`,
+                receipt,
+            };
+        }
+        const next = {
+            ...receipt,
+            state: "dispatching",
+            reservedAt: new Date().toISOString(),
+        };
+        const claimed = await this.compareAndSwap(id, "prepared", next);
+        if (!claimed.ok) {
+            const current = claimed.current;
+            if (current?.state === "dispatching") {
+                return {
+                    ok: true,
+                    receipt: current,
+                    reserved: false,
+                    reason: "already-dispatching",
+                };
+            }
+            if (current?.state === "dispatched") {
+                return {
+                    ok: true,
+                    receipt: current,
+                    reserved: false,
+                    reason: "already-dispatched",
+                };
+            }
+            return {
+                ok: false,
+                code: "INVALID_STATE",
+                message: `receipt raced into ${current?.state ?? "missing"}`,
+                receipt: current,
+            };
+        }
+        return { ok: true, receipt: next, reserved: true };
+    }
+    async markDispatched(id, operationId) {
+        const receipt = await this.get(id);
+        if (!receipt)
+            throw new Error(`receipt not found: ${id}`);
+        const next = {
+            ...receipt,
+            state: "dispatched",
+            ...(operationId ? { operationId } : {}),
+            dispatchedAt: new Date().toISOString(),
+        };
+        await writeFile(this.file(id), `${JSON.stringify(next, null, 2)}\n`, {
+            mode: 0o600,
+        });
+        return next;
+    }
+    async releaseToPrepared(id) {
+        const receipt = await this.get(id);
+        if (!receipt || receipt.state !== "dispatching")
+            return receipt;
+        const next = {
+            ...receipt,
+            state: "prepared",
+            reservedAt: undefined,
+        };
+        await writeFile(this.file(id), `${JSON.stringify(next, null, 2)}\n`, {
+            mode: 0o600,
+        });
+        return next;
+    }
+    async compareAndSwap(id, expectedState, next) {
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        const target = this.file(id);
+        const lockPath = `${target}.lock`;
+        try {
+            await writeFile(lockPath, `${process.pid}\n`, { flag: "wx", mode: 0o600 });
+        }
+        catch (error) {
+            if (error.code === "EEXIST") {
+                await new Promise((r) => setTimeout(r, 25));
+                return { ok: false, current: await this.get(id) };
+            }
+            throw error;
+        }
+        try {
+            const current = await this.get(id);
+            if (!current || current.state !== expectedState) {
+                return { ok: false, current };
+            }
+            const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
+            await writeFile(tmp, `${JSON.stringify(next, null, 2)}\n`, {
+                mode: 0o600,
+            });
+            await rename(tmp, target);
+            return { ok: true };
+        }
+        finally {
+            try {
+                await unlink(lockPath);
+            }
+            catch {
+                // lock cleanup is best-effort
+            }
+        }
+    }
+}

package/dist/worker/console/chat/explore-tools.js

@@ -0,0 +1,299 @@
+/**
+ * Operator Chat — safe read-only explore tools (roadmap M0-A / G16).
+ *
+ * Replaces the bare SDK built-in bash/read/grep with a typed, boundary-
+ * enforced read-only surface. The model can still probe the repo, but:
+ *
+ *   - No shell escapes (no `echo >`, `tee`, `sed -i`, `node -e`, pipes to
+ *     shell, redirects, subshells). The write-via-redirect residual is gone.
+ *   - read/grep enforce a repo-relative path boundary (no `..`, no absolute
+ *     paths outside repo, no symlink escape) and a sensitive-file denylist
+ *     (env files, key/pem, .git internals, Pi auth.json, sessions dir,
+ *     harness dag-run session facts).
+ *   - All returned content is run through secret scrubbing so API keys, OAuth
+ *     tokens and private keys never reach the model context (prompt injection
+ *     / credential leak defense — roadmap §3.2 read-face gap, G16).
+ *   - gitStatus / gitDiff are typed read-only git probes (no `git` shell).
+ *
+ * These are registered as Pi customTools alongside the operator-action tools.
+ * They are NOT operator actions (not in the capabilities registry) — they are
+ * the Chat's built-in explore surface, parallel to find/ls.
+ */
+import path from "node:path";
+import { open, readFile, realpath } from "node:fs/promises";
+import { createHash } from "node:crypto";
+/** Repo-relative path patterns that are ALWAYS denied to read/grep (G16). */
+export const SENSITIVE_PATH_PATTERNS = [
+    // Environment / secrets
+    /(^|\/)\.env(\.|$)/i,
+    /(^|\/)\.env\.[a-z0-9_-]+$/i,
+    /\.key$/i,
+    /\.pem$/i,
+    /\.pfx$/i,
+    /\.keystore$/i,
+    // Git internals
+    /(^|\/)\.git\//i,
+    // Pi credential / session store (user-level + project-level + console app-data)
+    /(^|\/)auth\.json$/i,
+    /(^|\/)sessions\//i,
+    // DAG run-owned session facts (runtime internals, not for model eyes)
+    /(^|\/)\.harness\/dag-runs\/.*\/session\b/i,
+    // Generic credential filenames
+    /(^|\/)(credentials|secrets)\.json$/i,
+    /(^|\/)id_rsa/i,
+    /(^|\/)id_ecdsa/i,
+    /(^|\/)id_ed25519/i,
+];
+/** Secret-like patterns scrubbed from any tool result content (G16). */
+export const SECRET_SCRUB_PATTERNS = [
+    // AWS access key id
+    { name: "aws-access-key-id", re: /\bAKIA[0-9A-Z]{16}\b/g },
+    // AWS secret access key (40 char base64-ish after the key id context)
+    {
+        name: "aws-secret",
+        re: /\b(?:aws_secret_access_key|secret_access_key)["'\s:=]+([A-Za-z0-9/+=]{40})\b/gi,
+    },
+    // Google API key / OAuth
+    { name: "google-api-key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    // Generic API key assignments (header style)
+    {
+        name: "api-key-assign",
+        re: /\b(?:api[_-]?key|apikey|x-api-key)["'\s:=]+([A-Za-z0-9_-]{20,})/gi,
+    },
+    // Bearer tokens
+    { name: "bearer-token", re: /\bBearer\s+[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g },
+    // GitHub tokens
+    { name: "github-token", re: /\b(?:gh[pousr]_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{22}_[A-Za-z0-9]{59})\b/g },
+    // Slack tokens
+    { name: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]+\b/g },
+    // Private key blocks (PEM)
+    {
+        name: "private-key-block",
+        re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |DSA |)PRIVATE KEY-----/g,
+    },
+];
+/** Throw a typed explore error (kept as a value object so callers can read .code). */
+export class ExploreDeniedError extends Error {
+    code;
+    ok = false;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "ExploreDeniedError";
+    }
+}
+/**
+ * Replace secret-like substrings with a redaction marker. Returns the scrubbed
+ * text plus a tally (no secret values). Used by safe-read / safe-grep before
+ * any content reaches the model context.
+ */
+export function scrubSecrets(input) {
+    let out = input;
+    const redactions = [];
+    for (const { name, re } of SECRET_SCRUB_PATTERNS) {
+        re.lastIndex = 0;
+        const matches = out.match(re);
+        if (matches && matches.length > 0) {
+            out = out.replace(re, `[REDACTED:${name}]`);
+            redactions.push({ name, count: matches.length });
+        }
+    }
+    return { scrubbed: out, redactions };
+}
+/** True if a repo-relative path matches a sensitive-file denylist pattern. */
+export function isSensitivePath(repoRelative) {
+    const normalized = repoRelative.replace(/\\/g, "/").replace(/^\.\/+/, "");
+    for (const re of SENSITIVE_PATH_PATTERNS) {
+        if (re.test(normalized))
+            return true;
+    }
+    return false;
+}
+/**
+ * Resolve a model-supplied path against the repo root and enforce:
+ *   - repo-relative only (no absolute paths, no `..` escape, no symlink escape
+ *     outside repo via realpath),
+ *   - sensitive-file denylist.
+ */
+export async function guardReadPath(repoRoot, rawPath) {
+    if (!rawPath || typeof rawPath !== "string") {
+        return {
+            ok: false,
+            code: "PATH_OUTSIDE_REPO",
+            message: "path is required",
+        };
+    }
+    // Reject absolute paths (Windows drive letters too) — model must use repo-relative.
+    if (path.isAbsolute(rawPath)) {
+        return {
+            ok: false,
+            code: "PATH_OUTSIDE_REPO",
+            message: `absolute paths are not allowed; use a repo-relative path (got ${rawPath})`,
+        };
+    }
+    // Reject `..` segments outright (defense before realpath).
+    if (rawPath.split(/[\\/]/).some((seg) => seg === "..")) {
+        return {
+            ok: false,
+            code: "PATH_OUTSIDE_REPO",
+            message: `path traversal (..) is not allowed: ${rawPath}`,
+        };
+    }
+    const normalizedRepoRelative = rawPath.replace(/\\/g, "/").replace(/^\.\/+/, "");
+    if (isSensitivePath(normalizedRepoRelative)) {
+        return {
+            ok: false,
+            code: "SENSITIVE_PATH_DENIED",
+            message: `path "${normalizedRepoRelative}" matches a sensitive-file denylist (.env* / *.key / *.pem / .git/** / auth.json / sessions/** / dag-runs session); reading is denied to protect credentials`,
+        };
+    }
+    const abs = path.resolve(repoRoot, normalizedRepoRelative);
+    // Lexical containment rejects traversal before touching the filesystem.
+    const rel = path.relative(repoRoot, abs);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+        return {
+            ok: false,
+            code: "PATH_OUTSIDE_REPO",
+            message: `resolved path escapes repo root: ${rawPath}`,
+        };
+    }
+    // path.resolve() alone does not stop `repo/link -> /private/file`: readFile
+    // follows the link and would expose the target outside the repo. Resolve both
+    // ends when the candidate exists, then repeat the containment and denylist
+    // checks against its canonical location. A nonexistent candidate remains
+    // lexically valid so callers such as git-diff can still ask Git about it;
+    // safeReadFile will subsequently report its normal read failure.
+    try {
+        const [realRepoRoot, realCandidate] = await Promise.all([
+            realpath(repoRoot),
+            realpath(abs),
+        ]);
+        const realRelative = path.relative(realRepoRoot, realCandidate);
+        if (realRelative.startsWith("..") || path.isAbsolute(realRelative)) {
+            return {
+                ok: false,
+                code: "PATH_OUTSIDE_REPO",
+                message: `symlink target escapes repo root: ${rawPath}`,
+            };
+        }
+        if (isSensitivePath(realRelative.replace(/\\/g, "/"))) {
+            return {
+                ok: false,
+                code: "SENSITIVE_PATH_DENIED",
+                message: `symlink target is a sensitive path: ${rawPath}`,
+            };
+        }
+        return { ok: true, abs, repoRelative: normalizedRepoRelative };
+    }
+    catch {
+        return { ok: true, abs, repoRelative: normalizedRepoRelative };
+    }
+}
+/** Cap read size so the model context cannot be flooded (G12). */
+export const READ_BYTE_LIMIT = 256 * 1024; // 256 KiB
+/**
+ * Read a repo-relative file with full M0-A guards. Throws a typed error
+ * object (code/message) on denial so the customTool wrapper can surface it.
+ */
+export async function safeReadFile(repoRoot, rawPath) {
+    const guard = await guardReadPath(repoRoot, rawPath);
+    if (!guard.ok) {
+        throw new ExploreDeniedError(guard.code, guard.message);
+    }
+    // Do not call readFile() here: it allocates the entire file before the
+    // truncation check, so an oversized repo file could exhaust the Console
+    // process even though the response is bounded. Read at most the public cap.
+    const handle = await open(guard.abs, "r");
+    try {
+        const info = await handle.stat();
+        if (!info.isFile()) {
+            throw new ExploreDeniedError("READ_FAILED", `not a regular file: ${guard.repoRelative}`);
+        }
+        const bytes = info.size;
+        const bytesToRead = Math.min(bytes, READ_BYTE_LIMIT);
+        const buffer = Buffer.alloc(bytesToRead);
+        const bytesRead = bytesToRead > 0
+            ? (await handle.read(buffer, 0, bytesToRead, 0)).bytesRead
+            : 0;
+        const { scrubbed, redactions } = scrubSecrets(buffer.subarray(0, bytesRead).toString("utf8"));
+        return {
+            path: guard.repoRelative,
+            bytes,
+            truncated: bytes > READ_BYTE_LIMIT,
+            redactions,
+            content: scrubbed,
+        };
+    }
+    finally {
+        await handle.close();
+    }
+}
+export const GREP_MATCH_LIMIT = 100;
+/**
+ * Repo-bounded, secret-scrubbed line search. The pattern is a plain string or
+ * regex source (no shell, no flags beyond `i`). Scans files under repoRoot,
+ * skipping the sensitive denylist and binary-looking files.
+ */
+export async function safeGrep(repoRoot, pattern, options) {
+    if (!pattern) {
+        throw new ExploreDeniedError("INVALID_INPUT", "pattern is required");
+    }
+    let re;
+    try {
+        re = new RegExp(pattern, options?.caseInsensitive ? "i" : undefined);
+    }
+    catch (e) {
+        throw new ExploreDeniedError("INVALID_INPUT", `invalid regex pattern: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    // Dynamic import to keep the explore module free of a hard chokidar dep at
+    // module load (rg is not guaranteed cross-platform; use node fs walk).
+    const { walkRepoFiles } = await import("./repo-walk.js");
+    const files = await walkRepoFiles(repoRoot, {
+        glob: options?.glob,
+        skipSensitive: true,
+    });
+    const matches = [];
+    let totalRedactions = [];
+    for (const file of files) {
+        if (matches.length >= GREP_MATCH_LIMIT)
+            break;
+        try {
+            const buf = await readFile(file.abs);
+            if (buf.byteLength > READ_BYTE_LIMIT)
+                continue;
+            const text = buf.toString("utf8");
+            const lines = text.split(/\r?\n/);
+            for (let i = 0; i < lines.length; i++) {
+                if (matches.length >= GREP_MATCH_LIMIT)
+                    break;
+                if (re.test(lines[i])) {
+                    const { scrubbed, redactions } = scrubSecrets(lines[i]);
+                    if (redactions.length > 0) {
+                        for (const r of redactions) {
+                            const found = totalRedactions.find((t) => t.name === r.name);
+                            if (found)
+                                found.count += r.count;
+                            else
+                                totalRedactions.push({ ...r });
+                        }
+                    }
+                    matches.push({ path: file.repoRelative, line: i + 1, text: scrubbed });
+                }
+            }
+        }
+        catch {
+            // skip unreadable / binary files
+        }
+    }
+    return {
+        pattern,
+        matchCount: matches.length,
+        truncated: matches.length >= GREP_MATCH_LIMIT,
+        redactions: totalRedactions,
+        matches,
+    };
+}
+/** A stable, denoised fingerprint of the repo root (for hashing). */
+export function repoRootKey(repoRoot) {
+    return createHash("sha256").update(path.resolve(repoRoot)).digest("hex").slice(0, 16);
+}

package/dist/worker/console/chat/human-gate-card.js

@@ -0,0 +1,37 @@
+export function makeHumanGateCard(input) {
+    const canonical = JSON.stringify({
+        cardId: input.cardId,
+        gateType: input.gateType,
+        state: input.state,
+        taskId: input.taskId,
+        confirmationId: input.confirmationId,
+        receiptId: input.receiptId,
+        contractRevision: input.contractRevision,
+        dagSpine: input.dagSpine,
+    });
+    let hash = 2166136261;
+    for (let i = 0; i < canonical.length; i += 1)
+        hash = Math.imul(hash ^ canonical.charCodeAt(i), 16777619);
+    const previewHash = `fnv1a-${(hash >>> 0).toString(16).padStart(8, "0")}`;
+    return { schemaVersion: 1, ...input, previewHash };
+}
+export function humanGateCardFromEventPayload(value) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const card = value;
+    if (card.schemaVersion !== 1 || typeof card.cardId !== "string" ||
+        (card.gateType !== "contract-apply" && card.gateType !== "dag-run") ||
+        typeof card.taskId !== "string" || typeof card.state !== "string" ||
+        typeof card.expiresAt !== "string" || typeof card.inspectHref !== "string" ||
+        typeof card.previewHash !== "string")
+        return undefined;
+    return card;
+}
+export function mergeHumanGateCardState(cards, next) {
+    const index = cards.findIndex((card) => card.cardId === next.cardId);
+    if (index < 0)
+        return [...cards, next];
+    const copy = [...cards];
+    copy[index] = next;
+    return copy;
+}