@vascend/talos 0.1.0

package/dist/backend/users.d.ts

@@ -0,0 +1,13 @@
+import { type User, type PublicUser } from "./types.js";
+export declare class UserStore {
+    private readonly file;
+    private readonly byId;
+    private readonly byEmail;
+    private constructor();
+    static open(dataDir: string): UserStore;
+    get(id: string): User | undefined;
+    getPublic(id: string): PublicUser | undefined;
+    register(email: string, password: string, displayName?: string): User;
+    authenticate(email: string, password: string): User;
+    private persist;
+}

package/dist/backend/users.js

@@ -0,0 +1,76 @@
+// Store utenti persistente su file JSONL append-only (l'ultima entry per id
+// vince), nello stile di Session. Zero dipendenze. Indicizzato in memoria per
+// email e id. Pensato per carichi modesti (un processo backend).
+import { appendFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { hashPassword, verifyPassword, newId } from "./crypto.js";
+import { HttpError, toPublicUser } from "./types.js";
+function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}
+export class UserStore {
+    file;
+    byId = new Map();
+    byEmail = new Map();
+    constructor(file) {
+        this.file = file;
+    }
+    static open(dataDir) {
+        mkdirSync(dataDir, { recursive: true });
+        const store = new UserStore(join(dataDir, "users.jsonl"));
+        if (existsSync(store.file)) {
+            const raw = readFileSync(store.file, "utf8");
+            for (const line of raw.split("\n")) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const u = JSON.parse(line);
+                    store.byId.set(u.id, u);
+                    store.byEmail.set(normalizeEmail(u.email), u);
+                }
+                catch { /* riga corrotta: salta */ }
+            }
+        }
+        return store;
+    }
+    get(id) {
+        return this.byId.get(id);
+    }
+    getPublic(id) {
+        const u = this.byId.get(id);
+        return u ? toPublicUser(u) : undefined;
+    }
+    // Registra un nuovo utente. Lancia HttpError 409 se l'email esiste gia'.
+    register(email, password, displayName) {
+        const norm = normalizeEmail(email);
+        if (!norm || !norm.includes("@"))
+            throw new HttpError(400, "email non valida", "invalid_email");
+        if (!password || password.length < 8) {
+            throw new HttpError(400, "password troppo corta (min 8)", "weak_password");
+        }
+        if (this.byEmail.has(norm))
+            throw new HttpError(409, "email gia' registrata", "email_taken");
+        const user = {
+            id: newId("usr"),
+            email: norm,
+            displayName: (displayName ?? norm.split("@")[0] ?? "user").trim(),
+            passwordHash: hashPassword(password),
+            createdAt: Date.now(),
+        };
+        this.persist(user);
+        return user;
+    }
+    // Verifica le credenziali. Lancia HttpError 401 se non combaciano.
+    authenticate(email, password) {
+        const user = this.byEmail.get(normalizeEmail(email));
+        if (!user || !verifyPassword(password, user.passwordHash)) {
+            throw new HttpError(401, "credenziali non valide", "bad_credentials");
+        }
+        return user;
+    }
+    persist(user) {
+        this.byId.set(user.id, user);
+        this.byEmail.set(normalizeEmail(user.email), user);
+        appendFileSync(this.file, JSON.stringify(user) + "\n", "utf8");
+    }
+}

package/dist/backend/ws-handler.d.ts

@@ -0,0 +1,14 @@
+import type { IncomingMessage } from "node:http";
+import type { Duplex } from "node:stream";
+import { type WsConnection } from "./ws.js";
+import { AuthService } from "./auth.js";
+import type { ConversationStore } from "./conversations.js";
+import type { EngineBridge } from "./engine.js";
+export interface WsDeps {
+    readonly auth: AuthService;
+    readonly conversations: ConversationStore;
+    readonly engine: EngineBridge;
+}
+export declare function isChatUpgrade(req: IncomingMessage): boolean;
+export declare function handleUpgrade(req: IncomingMessage, socket: Duplex, deps: WsDeps): void;
+export { type WsConnection };

package/dist/backend/ws-handler.js

@@ -0,0 +1,72 @@
+// Gestore del canale WebSocket di chat. Autentica via token (query param),
+// vincola la connessione a una conversazione, e fa lo streaming in tempo reale
+// degli AgentEvent dell'engine. Protocollo: vedi WsClientMessage/WsServerMessage.
+import { acceptUpgrade } from "./ws.js";
+import { AuthService } from "./auth.js";
+// True se la richiesta punta al path WS di chat.
+export function isChatUpgrade(req) {
+    try {
+        const url = new URL(req.url ?? "", "http://localhost");
+        return url.pathname === "/ws";
+    }
+    catch {
+        return false;
+    }
+}
+export function handleUpgrade(req, socket, deps) {
+    const { auth, conversations, engine } = deps;
+    // Autenticazione prima dell'handshake: se fallisce, rifiuta.
+    const resolved = auth.resolve(AuthService.extractToken(req));
+    if (!resolved) {
+        socket.end("HTTP/1.1 401 Unauthorized\r\n\r\n");
+        return;
+    }
+    const url = new URL(req.url ?? "", "http://localhost");
+    const conversationId = url.searchParams.get("conversation") ?? "";
+    let conv;
+    try {
+        conv = conversations.require(conversationId, resolved.user.id);
+    }
+    catch {
+        socket.end("HTTP/1.1 404 Not Found\r\n\r\n");
+        return;
+    }
+    const ws = acceptUpgrade(req, socket);
+    if (!ws)
+        return;
+    const send = (msg) => ws.send(JSON.stringify(msg));
+    send({ type: "ready", conversationId: conv.id });
+    ws.onMessage(async (raw) => {
+        let msg;
+        try {
+            msg = JSON.parse(raw);
+        }
+        catch {
+            send({ type: "error", message: "messaggio non valido" });
+            return;
+        }
+        if (msg.type === "ping") {
+            send({ type: "pong" });
+            return;
+        }
+        if (msg.type === "abort") {
+            engine.abort(conv.id);
+            return;
+        }
+        if (msg.type === "prompt") {
+            if (!msg.text?.trim()) {
+                send({ type: "error", message: "prompt vuoto" });
+                return;
+            }
+            if (engine.isBusy(conv.id)) {
+                send({ type: "error", message: "giro gia' in corso" });
+                return;
+            }
+            await engine.prompt(conv.id, conv.model, msg.text, (event) => send({ type: "agent", event }));
+            conversations.touch(conv.id);
+            return;
+        }
+        send({ type: "error", message: "tipo messaggio sconosciuto" });
+    });
+}
+export {};

package/dist/backend/ws.d.ts

@@ -0,0 +1,19 @@
+import type { IncomingMessage } from "node:http";
+import type { Duplex } from "node:stream";
+type Listener<T> = (arg: T) => void;
+export declare class WsConnection {
+    private readonly socket;
+    private buffer;
+    private closed;
+    private readonly onMessageCbs;
+    private readonly onCloseCbs;
+    constructor(socket: Duplex);
+    onMessage(cb: Listener<string>): void;
+    onClose(cb: Listener<void>): void;
+    send(text: string): void;
+    close(code?: number): void;
+    private fireClose;
+    private ingest;
+}
+export declare function acceptUpgrade(req: IncomingMessage, socket: Duplex): WsConnection | null;
+export {};

package/dist/backend/ws.js

@@ -0,0 +1,146 @@
+// Implementazione minimale di WebSocket server-side (RFC 6455) sopra
+// node:net Socket, senza dipendenze. Supporta i soli frame testo/ping/pong/
+// close, sufficienti per lo streaming JSON degli AgentEvent. I client
+// browser/Node mascherano i frame (gestito); il server invia frame non
+// mascherati.
+import { createHash } from "node:crypto";
+const GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+// Connessione WS attiva: invio di testo, ricezione di messaggi, chiusura.
+export class WsConnection {
+    socket;
+    buffer = Buffer.alloc(0);
+    closed = false;
+    onMessageCbs = [];
+    onCloseCbs = [];
+    constructor(socket) {
+        this.socket = socket;
+        socket.on("data", (chunk) => this.ingest(chunk));
+        socket.on("close", () => this.fireClose());
+        socket.on("error", () => this.fireClose());
+    }
+    onMessage(cb) { this.onMessageCbs.push(cb); }
+    onClose(cb) { this.onCloseCbs.push(cb); }
+    // Invia un payload testuale (JSON serializzato dal chiamante).
+    send(text) {
+        if (this.closed)
+            return;
+        this.socket.write(encodeFrame(0x1, Buffer.from(text, "utf8")));
+    }
+    close(code = 1000) {
+        if (this.closed)
+            return;
+        this.closed = true;
+        const payload = Buffer.alloc(2);
+        payload.writeUInt16BE(code, 0);
+        try {
+            this.socket.write(encodeFrame(0x8, payload));
+        }
+        catch { /* gia' chiuso */ }
+        this.socket.end();
+    }
+    fireClose() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        for (const cb of this.onCloseCbs)
+            cb();
+    }
+    // Estrae e dispatcha i frame completi dal buffer accumulato.
+    ingest(chunk) {
+        this.buffer = Buffer.concat([this.buffer, chunk]);
+        for (;;) {
+            const frame = decodeFrame(this.buffer);
+            if (!frame)
+                break;
+            this.buffer = frame.rest;
+            if (frame.opcode === 0x8) {
+                this.close();
+                return;
+            } // close
+            if (frame.opcode === 0x9) { // ping -> pong
+                this.socket.write(encodeFrame(0xa, frame.payload));
+                continue;
+            }
+            if (frame.opcode === 0xa)
+                continue; // pong: ignora
+            if (frame.opcode === 0x1 || frame.opcode === 0x0) {
+                const text = frame.payload.toString("utf8");
+                for (const cb of this.onMessageCbs)
+                    cb(text);
+            }
+        }
+    }
+}
+// Completa l'handshake di upgrade e ritorna la connessione, o null se la
+// richiesta non e' un upgrade WebSocket valido.
+export function acceptUpgrade(req, socket) {
+    const key = req.headers["sec-websocket-key"];
+    const upgrade = (req.headers["upgrade"] ?? "").toString().toLowerCase();
+    if (upgrade !== "websocket" || typeof key !== "string") {
+        socket.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+        return null;
+    }
+    const accept = createHash("sha1").update(key + GUID).digest("base64");
+    socket.write("HTTP/1.1 101 Switching Protocols\r\n" +
+        "Upgrade: websocket\r\n" +
+        "Connection: Upgrade\r\n" +
+        `Sec-WebSocket-Accept: ${accept}\r\n\r\n`);
+    return new WsConnection(socket);
+}
+// --- Frame RFC 6455 ----------------------------------------------------------
+function encodeFrame(opcode, payload) {
+    const len = payload.length;
+    let header;
+    if (len < 126) {
+        header = Buffer.from([0x80 | opcode, len]);
+    }
+    else if (len < 65536) {
+        header = Buffer.alloc(4);
+        header[0] = 0x80 | opcode;
+        header[1] = 126;
+        header.writeUInt16BE(len, 2);
+    }
+    else {
+        header = Buffer.alloc(10);
+        header[0] = 0x80 | opcode;
+        header[1] = 127;
+        header.writeBigUInt64BE(BigInt(len), 2);
+    }
+    return Buffer.concat([header, payload]);
+}
+// Decodifica UN frame completo dal buffer; null se i dati non bastano ancora.
+function decodeFrame(buf) {
+    if (buf.length < 2)
+        return null;
+    const opcode = buf[0] & 0x0f;
+    const masked = (buf[1] & 0x80) !== 0;
+    let len = buf[1] & 0x7f;
+    let offset = 2;
+    if (len === 126) {
+        if (buf.length < offset + 2)
+            return null;
+        len = buf.readUInt16BE(offset);
+        offset += 2;
+    }
+    else if (len === 127) {
+        if (buf.length < offset + 8)
+            return null;
+        len = Number(buf.readBigUInt64BE(offset));
+        offset += 8;
+    }
+    let mask = null;
+    if (masked) {
+        if (buf.length < offset + 4)
+            return null;
+        mask = buf.subarray(offset, offset + 4);
+        offset += 4;
+    }
+    if (buf.length < offset + len)
+        return null;
+    const raw = buf.subarray(offset, offset + len);
+    const payload = Buffer.from(raw);
+    if (mask)
+        for (let i = 0; i < payload.length; i += 1)
+            payload[i] = payload[i] ^ mask[i % 4];
+    return { opcode, payload, rest: buf.subarray(offset + len) };
+}

package/dist/core/agent.d.ts

@@ -0,0 +1,56 @@
+import type { EventSink, Message, Provider, ToolContext, ContentPart, ToolCallPart, SpawnAgentSpec } from "./types.js";
+import type { ToolRegistry } from "../tools/registry.js";
+import type { Session } from "./session.js";
+import type { PiConfig } from "./config.js";
+import type { ExtensionHost } from "../extensions/loader.js";
+import { type UserInbox } from "./user-inbox.js";
+import { type ContextFabricResult } from "../vascend/context-fabric.js";
+import { type FileCoordinationContext } from "./file-coordination.js";
+import type { ExecutionTarget } from "./execution-target.js";
+import { type WorkspaceSession } from "./workspace-sessions.js";
+export interface AgentDeps {
+    readonly provider: Provider;
+    readonly tools: ToolRegistry;
+    readonly session: Session;
+    readonly config: PiConfig;
+    readonly env?: NodeJS.ProcessEnv;
+    /** Allowlist filesystem aggiuntiva, isolata al singolo runTurn. */
+    readonly fsRoots?: readonly string[];
+    readonly executionTarget?: ExecutionTarget;
+    readonly workspaceSession?: WorkspaceSession;
+    /** Registro file condiviso con altri agenti e con l'editor umano. */
+    readonly fileCoordination?: FileCoordinationContext;
+    /**
+     * Evidenza aggiuntiva fornita dall'host per il solo turno corrente.
+     * Viene marcata come non attendibile e non entra mai nella sessione.
+     */
+    readonly ephemeralContext?: string;
+    readonly confirm: (action: string, detail: string) => Promise<boolean>;
+    readonly ask?: (question: string, options?: readonly string[]) => Promise<string | null>;
+    readonly spawnKingdom?: (castles: readonly SpawnAgentSpec[], opts?: {
+        baseBranch?: string;
+        detach?: boolean;
+    }) => Promise<string>;
+    readonly kingdom?: ToolContext["kingdom"];
+    readonly host?: ExtensionHost;
+    readonly inbox?: UserInbox;
+}
+export declare function capsuleMarketEnabled(env: NodeJS.ProcessEnv): boolean;
+export declare function isHorizonHostProfile(env: NodeJS.ProcessEnv): boolean;
+export declare function shouldIncludeHorizonContextPack(input: {
+    readonly sessionWasEmpty: boolean;
+    readonly inheritedFrame: boolean;
+    readonly hasCompiledEvidence: boolean;
+    readonly hasMemoryPacket: boolean;
+}): boolean;
+export declare function renderHorizonFabricBlock(fabric: ContextFabricResult): string;
+export declare function parseTextToolCalls(text: string, turn: number): {
+    calls: ToolCallPart[];
+    cleaned: string;
+};
+export declare function runTurn(deps: AgentDeps, userInput: string | readonly ContentPart[], sink: EventSink, signal: AbortSignal): Promise<void>;
+export declare function withTurnContext(messages: readonly Message[], turnMessage: Message, context: string): readonly Message[];
+export declare function projectHistoricalPromptImages(messages: readonly Message[], turnMessage: Message): readonly Message[];
+export declare function contextTokens(deps: AgentDeps, system?: string): number;
+export declare function projectedContextTokens(deps: AgentDeps): number;
+export declare function compactNow(deps: AgentDeps, signal: AbortSignal, sink: EventSink, instructions?: string, anchors?: readonly string[]): Promise<boolean>;