@twin3-ai/agent-id 0.1.0 → 0.3.0

package/static-edge-adapter.js

@@ -0,0 +1,115 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const { AUTO_MANAGED_PATHS } = require("./repository-connector.js");
+const SECRET_CONTENT = /(?:-----BEGIN [A-Z ]*PRIVATE KEY-----|\bak_aeo_[A-Za-z0-9_-]{6,}\b|\bav_[A-Za-z0-9_-]{8,}\b|\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b)/i;
+
+function edgeError(code) { const error = new Error(code); error.code = code; return error; }
+function hashText(value) { return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`; }
+function normalizePath(value) {
+  const path = String(value || "").replace(/^\/+/, "");
+  if (!AUTO_MANAGED_PATHS.has(path)) throw edgeError("EDGE_PATH_NOT_ALLOWED");
+  return path;
+}
+function assertPublicAsset(path, content) {
+  if (typeof content !== "string" || Buffer.byteLength(content, "utf8") > 1024 * 1024 || SECRET_CONTENT.test(content)) throw edgeError("EDGE_CONTENT_INVALID");
+  if (path.endsWith(".json")) {
+    try { JSON.parse(content); } catch (_error) { throw edgeError("EDGE_JSON_INVALID"); }
+  }
+}
+function createMemoryAssetStore(initial = {}) {
+  const values = new Map(Object.entries(initial));
+  return Object.freeze({
+    async get(key) { return values.has(key) ? structuredClone(values.get(key)) : null; },
+    async put(key, value) { values.set(key, structuredClone(value)); },
+    async delete(key) { values.delete(key); },
+    async list() { return [...values.keys()].sort(); }
+  });
+}
+function createStaticEdgeConnector({ store, verifiedRoutes = [...AUTO_MANAGED_PATHS] } = {}) {
+  if (!store || !["get", "put", "delete"].every((name) => typeof store[name] === "function")) throw edgeError("EDGE_STORE_REQUIRED");
+  const allowed = new Set(verifiedRoutes.map(normalizePath));
+  return Object.freeze({
+    describeCapabilities() {
+      return { connector: "static_edge", operations: ["upsert", "replace", "delete"], paths: [...allowed].sort(), customer_site_write_access: false };
+    },
+    async readResource(resource) {
+      const path = normalizePath(resource && resource.path);
+      if (!allowed.has(path)) throw edgeError("EDGE_ROUTE_NOT_VERIFIED");
+      const current = await store.get(path);
+      return { connector: "static_edge", environment: String(resource.environment || "production"), resource_type: "route", resource_id: String(resource.resource_id || path), path, content: current && current.content || null, sha256: current && current.sha256 || "" };
+    },
+    async planOperations(task, currentResource) {
+      if (!task || !Array.isArray(task.operations) || !task.operations.length) throw edgeError("EDGE_OPERATIONS_REQUIRED");
+      const changes = task.operations.map((operation) => {
+        const path = normalizePath(operation.path);
+        if (!allowed.has(path) || path !== currentResource.path) throw edgeError("EDGE_ROUTE_NOT_VERIFIED");
+        if (!["upsert", "replace", "delete"].includes(operation.operation)) throw edgeError("EDGE_OPERATION_NOT_SUPPORTED");
+        const content = operation.operation === "delete" ? "" : operation.value;
+        assertPublicAsset(path, content);
+        if (operation.expected_hash !== currentResource.sha256) throw edgeError("EDGE_STALE_RESOURCE");
+        return { path, operation: operation.operation, before_sha256: currentResource.sha256, after_sha256: operation.operation === "delete" ? "" : hashText(content), after_content: content, content_type: path.endsWith(".json") ? "application/json; charset=utf-8" : "text/plain; charset=utf-8" };
+      });
+      return { schema: "agentx-static-edge-plan-v1", approval_required: true, customer_site_write_access: false, changes };
+    },
+    async applyOperations(plan) {
+      if (!plan || plan.schema !== "agentx-static-edge-plan-v1") throw edgeError("EDGE_PLAN_INVALID");
+      const rollbackEntries = [];
+      for (const change of plan.changes) {
+        const current = await store.get(change.path);
+        const currentHash = current && current.sha256 || "";
+        if (currentHash !== change.before_sha256) throw edgeError("EDGE_STALE_RESOURCE");
+        rollbackEntries.push({ path: change.path, before: current, after_sha256: change.after_sha256 });
+      }
+      const applied = [];
+      try {
+        for (const change of plan.changes) {
+          if (change.operation === "delete") await store.delete(change.path);
+          else await store.put(change.path, { content: change.after_content, content_type: change.content_type, sha256: change.after_sha256, updated_at: Date.now() });
+          applied.push(change.path);
+        }
+      } catch (error) {
+        for (const item of rollbackEntries.filter((entry) => applied.includes(entry.path)).reverse()) {
+          if (item.before) await store.put(item.path, item.before);
+          else await store.delete(item.path);
+        }
+        throw error;
+      }
+      return { schema: "agentx-static-edge-receipt-v1", connector: "static_edge", applied_changes: plan.changes.map(({ after_content, ...change }) => change), rollback_entries: rollbackEntries, customer_site_write_access: false };
+    },
+    async verifyLocalResult(receipt) {
+      for (const change of receipt.applied_changes || []) {
+        const current = await store.get(change.path);
+        const currentHash = current && current.sha256 || "";
+        if (currentHash !== change.after_sha256) throw edgeError("EDGE_VERIFY_FAILED");
+      }
+      return { verified: true };
+    },
+    async rollback(receipt) {
+      if (!receipt || receipt.schema !== "agentx-static-edge-receipt-v1") throw edgeError("EDGE_ROLLBACK_RECEIPT_INVALID");
+      for (const item of receipt.rollback_entries || []) {
+        const current = await store.get(item.path);
+        if ((current && current.sha256 || "") !== item.after_sha256) throw edgeError("EDGE_ROLLBACK_CONFLICT");
+      }
+      for (const item of [...(receipt.rollback_entries || [])].reverse()) {
+        if (item.before) await store.put(item.path, item.before);
+        else await store.delete(item.path);
+      }
+      return { schema: "agentx-static-edge-rollback-receipt-v1", connector: "static_edge", rolled_back: true, paths: (receipt.rollback_entries || []).map((item) => item.path) };
+    }
+  });
+}
+function createStaticEdgeHandler({ store } = {}) {
+  if (!store || typeof store.get !== "function") throw edgeError("EDGE_STORE_REQUIRED");
+  return async function handle(request) {
+    const method = String(request && request.method || "GET").toUpperCase();
+    if (!['GET', 'HEAD'].includes(method)) return new Response("Method Not Allowed", { status: 405, headers: { Allow: "GET, HEAD" } });
+    let path;
+    try { path = normalizePath(new URL(request.url).pathname); } catch (_error) { return new Response("Not Found", { status: 404 }); }
+    const asset = await store.get(path);
+    if (!asset) return new Response("Not Found", { status: 404 });
+    return new Response(method === "HEAD" ? null : asset.content, { status: 200, headers: { "Content-Type": asset.content_type, "Cache-Control": "public, max-age=300", "ETag": `\"${asset.sha256}\"`, "X-Agent-ID-Managed": "true", "X-Content-Type-Options": "nosniff" } });
+  };
+}
+
+module.exports = { createMemoryAssetStore, createStaticEdgeConnector, createStaticEdgeHandler };

package/sync-service.js

@@ -125,7 +125,7 @@ function createSiteAgentSyncService(options = {}) {
   const intervalMs = Math.max(1000, Number(options.intervalMs || process.env.AGENT_ID_SYNC_INTERVAL_MS || 900000));
   const heartbeatIntervalMs = Math.max(300000, Number(options.heartbeatIntervalMs || process.env.AGENT_ID_HEARTBEAT_INTERVAL_MS || options.intervalMs || 900000));
   const collector = options.collector || null;
-  const runtimeVersion = String(options.runtimeVersion || process.env.AGENT_ID_RUNTIME_VERSION || "0.1.0");
+  const runtimeVersion = String(options.runtimeVersion || process.env.AGENT_ID_RUNTIME_VERSION || "0.3.0");
   const capabilities = Array.from(new Set((Array.isArray(options.capabilities) ? options.capabilities : ["heartbeat", "insights_feed"]).map((item) => String(item).trim()).filter(Boolean))).sort();
   const now = options.now || Date.now;
   const sleep = options.sleep || ((ms, signal) => new Promise((resolve) => {

package/task-executor.js

@@ -15,6 +15,44 @@ function stableValue(value) {
 }
 function canonical(value) { return Buffer.from(JSON.stringify(stableValue(value)), "utf8"); }
 function hash(value) { return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`; }
+function rollbackEvidence(connectorReceipt) {
+  if (!connectorReceipt || typeof connectorReceipt !== "object" || connectorReceipt.rolled_back !== true) {
+    throw executorError("rollback_not_confirmed");
+  }
+  return {
+    schema: String(connectorReceipt.schema || ""),
+    connector: String(connectorReceipt.connector || ""),
+    plan_id: String(connectorReceipt.plan_id || ""),
+    artifact_bundle_hash: String(connectorReceipt.artifact_bundle_hash || ""),
+    rolled_back: true,
+    files: Array.isArray(connectorReceipt.files)
+      ? connectorReceipt.files.map((item) => ({
+        path: String(item && (item.path || item.relative_path) || ""),
+        before_sha256: String(item && item.before_sha256 || "")
+      }))
+      : [],
+    paths: Array.isArray(connectorReceipt.paths) ? connectorReceipt.paths.map((item) => String(item)) : []
+  };
+}
+function signedRollbackReceipt({ task, subject, originalReceipt, connectorReceipt, privateKey, now }) {
+  const connectorRollbackReceipt = rollbackEvidence(connectorReceipt);
+  const payload = {
+    schema: "agentx-customer-rollback-receipt-v1",
+    receipt_nonce: crypto.randomUUID(),
+    task_id: task.task_id,
+    subject,
+    connector: task.connector,
+    policy_digest: task.policy_digest,
+    resource: task.resource,
+    original_receipt_hash: String(originalReceipt && originalReceipt.receipt_hash || ""),
+    connector_rollback_hash: hash(canonical(connectorRollbackReceipt)),
+    connector_rollback_receipt: connectorRollbackReceipt,
+    rolled_back: true,
+    rolled_back_at: Number(now),
+  };
+  const signature = crypto.sign(null, canonical(payload), privateKey).toString("base64url");
+  return { ...payload, signature, receipt_hash: hash(canonical({ ...payload, signature })) };
+}
 function exactSubject(left, right) {
   return ["tenant_id","host","environment","agent_id"].every((field) => String(left && left[field] || "") === String(right && right[field] || ""));
 }
@@ -69,23 +107,28 @@ function createTaskExecutor({ issuerPublicKey, identity, policy, connectors, sta
       environment: task.subject.environment,
       operations: task.operations.map((operation) => ({ ...operation, operation: operation.op }))
     };
-    authorizeTask(policy, policyTask, current);
+    const authorization = authorizeTask(policy, policyTask, current);
     const plan = await connector.planOperations(policyTask, current);
-    return { connector, current, plan, policyTask };
+    return { connector, current, plan, policyTask, authorization };
   }
   return Object.freeze({
     async plan(task) {
       const prepared = await prepare(task);
       runtime.set(task.task_id, { task, ...prepared });
-      state.tasks[task.task_id] = { task_id: task.task_id, connector: task.connector, idempotency_key: task.idempotency_key, state: "planned", policy_digest: task.policy_digest, envelope_hash: hash(canonical(Object.fromEntries(SIGNED_FIELDS.map((field) => [field, task[field]])))) };
+      state.tasks[task.task_id] = { task_id: task.task_id, connector: task.connector, idempotency_key: task.idempotency_key, resource: task.resource, state: "planned", policy_digest: task.policy_digest, envelope_hash: hash(canonical(Object.fromEntries(SIGNED_FIELDS.map((field) => [field, task[field]])))) };
       persist();
-      return { schema: "agentx-local-execution-plan-v1", task_id: task.task_id, connector: task.connector, approval_required: true, plan_hash: hash(canonical(prepared.plan)), changes: prepared.plan.changes.map(({ after_content, rollback_entries, ...item }) => item) };
+      return { schema: "agentx-local-execution-plan-v1", task_id: task.task_id, connector: task.connector, decision: prepared.authorization.decision, approval_required: prepared.authorization.decision !== "auto", plan_hash: hash(canonical(prepared.plan)), changes: prepared.plan.changes.map(({ after_content, rollback_entries, ...item }) => item) };
     },
     async apply(task, approval = {}) {
       const existing = state.tasks[task.task_id];
-      if (existing && existing.state === "deployed" && existing.result) return existing.result;
-      if (approval.approved !== true || approval.task_id !== task.task_id || approval.policy_digest !== policy.digest) throw executorError("approval_required");
+      if (existing && existing.state === "deployed" && existing.result) {
+        const connector = connectors && connectors[task.connector];
+        if (!connector) throw executorError("unknown_connector");
+        if (existing.connector_receipt) runtime.set(task.task_id, { task, connector, connectorReceipt: existing.connector_receipt });
+        return existing.result;
+      }
       const prepared = runtime.get(task.task_id) || { task, ...(await prepare(task)) };
+      if (prepared.authorization.decision !== "auto" && (approval.approved !== true || approval.task_id !== task.task_id || approval.policy_digest !== policy.digest)) throw executorError("approval_required");
       const receipt = await prepared.connector.applyOperations(prepared.plan);
       await prepared.connector.verifyLocalResult(receipt);
       const appliedResource = (receipt.applied_changes || []).find((item) => item.path === task.resource.path) || {};
@@ -105,20 +148,47 @@ function createTaskExecutor({ issuerPublicKey, identity, policy, connectors, sta
       const privateKey = crypto.createPrivateKey(fs.readFileSync(identity.key_path, "utf8"));
       publicReceipt.signature = crypto.sign(null, canonical(publicReceipt), privateKey).toString("base64url");
       publicReceipt.receipt_hash = hash(canonical(publicReceipt));
-      state.tasks[task.task_id] = { ...state.tasks[task.task_id], state: "deployed", receipt_hash: publicReceipt.receipt_hash, result: publicReceipt };
+      state.tasks[task.task_id] = {
+        ...state.tasks[task.task_id],
+        state: "deployed",
+        receipt_hash: publicReceipt.receipt_hash,
+        result: publicReceipt,
+        connector_receipt: receipt,
+      };
       runtime.set(task.task_id, { ...prepared, connectorReceipt: receipt });
       persist();
       return publicReceipt;
     },
     async rollback(taskId, approval = {}) {
       if (approval.approved !== true || approval.task_id !== taskId) throw executorError("approval_required");
-      const prepared = runtime.get(taskId);
       const taskState = state.tasks[taskId];
+      const prepared = runtime.get(taskId) || {
+        task: {
+          task_id: taskId,
+          connector: taskState && taskState.connector,
+          policy_digest: taskState && taskState.policy_digest,
+          subject: identity.subject,
+          resource: taskState && taskState.resource,
+        },
+        connector: connectors && connectors[taskState && taskState.connector],
+        connectorReceipt: taskState && taskState.connector_receipt,
+      };
       if (!taskState || taskState.state !== "deployed") throw executorError("rollback_receipt_unavailable");
+      if (!taskState.connector_receipt) throw executorError("rollback_receipt_unavailable");
       const connector = prepared && prepared.connector || connectors && connectors[taskState.connector];
       if (!connector) throw executorError("unknown_connector");
-      const receipt = await connector.rollback(prepared && prepared.connectorReceipt);
-      state.tasks[taskId] = { ...taskState, state: "rolled_back", rollback_receipt_hash: hash(canonical(receipt)) };
+      const connectorReceipt = await connector.rollback(prepared && prepared.connectorReceipt);
+      rollbackEvidence(connectorReceipt);
+      const privateKey = crypto.createPrivateKey(fs.readFileSync(identity.key_path, "utf8"));
+      const receipt = signedRollbackReceipt({
+        task: prepared.task,
+        subject: identity.subject,
+        originalReceipt: taskState.result,
+        connectorReceipt,
+        privateKey,
+        now: now(),
+      });
+      state.tasks[taskId] = { ...taskState, state: "rolled_back", rollback_receipt_hash: receipt.receipt_hash };
       persist();
       return receipt;
     },