@visual-z/xeno 0.8.4 → 0.9.0

package/src/store/secrets.ts

@@ -1,44 +0,0 @@
-/**
- * The per-session vault behind `[[xeno-secret-N]]` placeholders (S.9).
- *
- * A separate append-only file, never a log event: projections, handoffs,
- * exports and history pages read the log, so a value kept here cannot reach a
- * model request or a shared transcript. 0600 like every session file. It is
- * read back at start so a placeholder written by an earlier run still expands
- * after a restart.
- */
-import { copyFile, readFile } from "node:fs/promises";
-import { join } from "node:path";
-import { durableAppend } from "./atomic.ts";
-import type { SecretEntry } from "../core/secrets.ts";
-
-export const SECRETS_FILE = "secrets.jsonl";
-
-export async function readVault(dir: string): Promise<SecretEntry[]> {
-  let text: string;
-  try { text = await readFile(join(dir, SECRETS_FILE), "utf8"); }
-  catch (error) { if ((error as { code?: string }).code === "ENOENT") return []; throw error; }
-  const entries: SecretEntry[] = [];
-  for (const line of text.split("\n")) {
-    if (!line) continue;
-    // A torn final line from a crash loses that one entry; its placeholder then
-    // stays literal rather than expanding to something else.
-    try {
-      const value = JSON.parse(line) as Partial<SecretEntry>;
-      if (Number.isSafeInteger(value.n) && typeof value.value === "string" && typeof value.rule === "string" &&
-        !entries.some(entry => entry.n === value.n)) entries.push({ n: value.n!, value: value.value, rule: value.rule });
-    } catch { /* see above */ }
-  }
-  return entries;
-}
-
-export async function appendVault(dir: string, entries: readonly SecretEntry[]): Promise<void> {
-  if (entries.length === 0) return;
-  await durableAppend(join(dir, SECRETS_FILE), entries.map(entry => JSON.stringify(entry) + "\n").join(""));
-}
-
-/** A fork's log carries the parent's placeholders, so it needs their values. */
-export async function copyVault(from: string, to: string): Promise<void> {
-  try { await copyFile(join(from, SECRETS_FILE), join(to, SECRETS_FILE)); }
-  catch (error) { if ((error as { code?: string }).code !== "ENOENT") throw error; }
-}

package/src/store/serial.ts

@@ -1,13 +0,0 @@
-/** O.5: one in-process coordinator per journal; callers never nest the same key. */
-import { resolve } from "node:path";
-
-const tails = new Map<string, Promise<void>>();
-export async function serialized<T>(key: string, run: () => Promise<T>): Promise<T> {
-  const id = resolve(key), previous = tails.get(id) ?? Promise.resolve();
-  let release!: () => void;
-  const current = new Promise<void>(done => { release = done; });
-  tails.set(id, current);
-  await previous;
-  try { return await run(); }
-  finally { release(); if (tails.get(id) === current) tails.delete(id); }
-}

package/src/store/session-archive.ts

@@ -1,165 +0,0 @@
-/** Portable log graphs. No provider calls, workspace writes, or executable package payloads (D3/D8). */
-import { createReadStream } from "node:fs";
-import { lstat, mkdir, mkdtemp, open, readdir, rename, rm } from "node:fs/promises";
-import { createHash, randomUUID } from "node:crypto";
-import { dirname, join, resolve } from "node:path";
-import { archivePath } from "../core/session-archive.ts";
-import { blobFilePath, digestFile, verifyBlob } from "./blobs.ts";
-import { listNodes, readCursor, readCursorAt, readManifest, readNode, relocateSession, type Cursor } from "./log.ts";
-import { readNodeHistory } from "./restore.ts";
-import { replayContext } from "./replay.ts";
-
-// Wire chunk size, not a content limit: bounded JSON lines keep large snapshots streamable.
-const CHUNK = 64 * 1024;
-type FileEntry = { path: string; source: string };
-
-async function regular(path: string): Promise<void> {
-  if (!(await lstat(path)).isFile()) throw new Error(`Archive requires a regular file: ${path}`);
-}
-
-async function storedFiles(root: string, prefix = ""): Promise<FileEntry[]> {
-  const files: FileEntry[] = [];
-  for (const entry of await readdir(join(root, prefix), { withFileTypes: true })) {
-    const path = prefix ? `${prefix}/${entry.name}` : entry.name;
-    if (archivePath(path)) { await regular(join(root, path)); files.push({ path, source: join(root, path) }); }
-    else if ((path === "artifacts" || /^artifacts\/[a-f0-9]{2}$/.test(path)) && entry.isDirectory()) files.push(...await storedFiles(root, path));
-    else if (path === "artifacts" || path === "blobs") {
-      if (!entry.isDirectory()) throw new Error(`Invalid archive store: ${path}`);
-    }
-  }
-  return files;
-}
-
-async function referencedBlobs(dir: string, fallback?: string): Promise<Map<string, string[]>> {
-  const refs = new Map<string, string[]>(), cursor = await readCursor(dir);
-  for (const node of await listNodes(dir)) {
-    const read = await readNode(dir, node);
-    if (!read.header || read.corrupt.length) throw new Error(`Corrupt archive node ${node}`);
-    const historical = await readCursorAt(dir, node);
-    const roots = [...new Set([historical?.blob_dir, cursor?.blob_dir, fallback, join(dir, "blobs")].filter((p): p is string => !!p))];
-    const add = (sha: string) => { refs.set(sha, [...new Set([...(refs.get(sha) ?? []), ...roots])]); };
-    for (const event of read.events) {
-      if (event.t === "checkpoint") for (const change of Object.values(event.changes)) {
-        if (change.before) add(change.before.sha256);
-        if (change.after) add(change.after.sha256);
-      }
-      if (event.t === "user" || event.t === "tool_result") for (const image of event.images ?? []) { add(image.sha256); if (image.original) add(image.original.sha256); }
-    }
-  }
-  return refs;
-}
-
-async function validateSession(dir: string): Promise<Cursor> {
-  const cursor = await readCursor(dir);
-  if (!cursor) throw new Error("Archive has no resumable cursor");
-  const manifest = await readManifest(dir), nodes = await listNodes(dir);
-  if (!nodes.includes(cursor.node)) throw new Error("Archive cursor points to a missing node");
-  for (const closed of manifest.nodes) {
-    if (!nodes.includes(closed.node) || await digestFile(join(dir, `node-${String(closed.node).padStart(4, "0")}.jsonl`)) !== closed.sha256) throw new Error("Archive closed node digest mismatch");
-    if (closed.handoff_ref) await regular(join(dir, `handoff-${String(closed.node).padStart(4, "0")}.yaml`));
-  }
-  const contexts = new Set<string>();
-  for (const node of nodes) {
-    const history = await readNodeHistory(dir, node);
-    if (!history.ok) throw new Error(`Invalid archive graph: ${history.error}`);
-    await replayContext(dir, node, manifest);
-    const state = await readCursorAt(dir, node); if (state?.context_ref) contexts.add(state.context_ref);
-    for (const event of (await readNode(dir, node)).events) if (event.t === "cut" && event.next_context_ref) contexts.add(event.next_context_ref);
-  }
-  if (cursor.context_ref) contexts.add(cursor.context_ref);
-  for (const sha of contexts) if (!await verifyBlob(join(dir, "artifacts"), sha)) throw new Error(`Missing frozen context ${sha}`);
-  return cursor;
-}
-
-export async function exportSessionArchive(dir: string, destination: string, blobDir?: string): Promise<void> {
-  await validateSession(dir);
-  const files = await storedFiles(dir);
-  for (const [sha, roots] of await referencedBlobs(dir, blobDir)) {
-    let source: string | undefined;
-    for (const root of roots) if (await verifyBlob(root, sha)) { source = blobFilePath(root, sha); break; }
-    if (!source) throw new Error(`Missing session blob ${sha}`);
-    files.push({ path: `blobs/${sha.slice(0, 2)}/${sha.slice(2)}`, source });
-  }
-  if (files.some(file => resolve(file.source) === resolve(destination))) throw new Error("Cannot export over session storage");
-  const temp = `${destination}.${randomUUID()}.tmp`, out = await open(temp, "wx", 0o600);
-  const digest = createHash("sha256"); let count = 0;
-  const emit = async (record: unknown, hashed = true) => { const line = JSON.stringify(record) + "\n"; if (hashed) digest.update(line); await out.writeFile(line); };
-  try {
-    await emit({ format: "xeno-session", version: 1 });
-    for (const file of files.sort((a, b) => a.path.localeCompare(b.path))) {
-      await regular(file.source);
-      const hash = createHash("sha256"); let size = 0;
-      await emit({ file: file.path });
-      for await (const chunk of createReadStream(file.source, { highWaterMark: CHUNK })) {
-        const bytes = chunk as Buffer; size += bytes.length; hash.update(bytes); await emit({ data: bytes.toString("base64") });
-      }
-      const sha256 = hash.digest("hex");
-      if (/^(artifacts|blobs)\//.test(file.path) && file.path.split("/").slice(1).join("") !== sha256) throw new Error(`Corrupt archive blob ${file.path}`);
-      await emit({ end: file.path, size, sha256 }); count++;
-    }
-    await emit({ complete: count, sha256: digest.digest("hex") }, false);
-    await out.sync(); await out.close(); await rename(temp, destination);
-  } finally { await out.close(); await rm(temp, { force: true }); }
-}
-
-/** Bound a hostile or truncated line before JSON parsing, without a whole-archive size cap. */
-async function* lines(path: string): AsyncGenerator<string> {
-  let pending = "";
-  for await (const chunk of createReadStream(path, { encoding: "utf8", highWaterMark: CHUNK })) {
-    pending += chunk; let end: number;
-    while ((end = pending.indexOf("\n")) !== -1) {
-      if (end > CHUNK * 2) throw new Error("Archive line exceeds chunk envelope");
-      yield pending.slice(0, end); pending = pending.slice(end + 1);
-    }
-    if (pending.length > CHUNK * 2) throw new Error("Archive line exceeds chunk envelope");
-  }
-  if (pending) throw new Error("Incomplete archive tail");
-}
-
-/** Only a validated staging directory is published; failed imports never become browser entries. */
-export async function importSessionArchive(file: string, sessionRoot: string, workspace: string): Promise<string> {
-  await regular(file); await mkdir(sessionRoot, { recursive: true });
-  const stage = await mkdtemp(join(sessionRoot, ".xeno-import-"));
-  const destination = join(sessionRoot, `${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`);
-  const seen = new Set<string>(), digest = createHash("sha256");
-  let header = false, complete = false, active: { path: string; file: Awaited<ReturnType<typeof open>>; hash: ReturnType<typeof createHash>; size: number } | undefined;
-  try {
-    for await (const line of lines(file)) {
-      if (complete) throw new Error("Unexpected data after archive footer");
-      const value: unknown = JSON.parse(line);
-      if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Invalid archive record");
-      const record = value as Record<string, unknown>;
-      if (!header) {
-        if (record["format"] !== "xeno-session" || record["version"] !== 1) throw new Error("Expected xeno-session v1 archive. Legacy event-only JSONL lacks recovery metadata; re-export the original session.");
-        header = true;
-      } else if (record["complete"] !== undefined) {
-        if (active || record["complete"] !== seen.size || record["sha256"] !== digest.digest("hex")) throw new Error("Archive completeness digest mismatch");
-        complete = true; continue;
-      } else if (record["file"] !== undefined) {
-        const path = record["file"];
-        if (active || !archivePath(path) || seen.has(path)) throw new Error("Invalid or duplicate archive path");
-        seen.add(path); await mkdir(dirname(join(stage, path)), { recursive: true });
-        active = { path, file: await open(join(stage, path), "wx", 0o600), hash: createHash("sha256"), size: 0 };
-      } else if (record["data"] !== undefined) {
-        const data = record["data"];
-        if (!active || typeof data !== "string" || data.length > Math.ceil(CHUNK / 3) * 4) throw new Error("Invalid archive chunk");
-        const bytes = Buffer.from(data, "base64");
-        if (bytes.toString("base64") !== data) throw new Error("Invalid archive base64");
-        active.hash.update(bytes); active.size += bytes.length; await active.file.writeFile(bytes);
-      } else if (record["end"] !== undefined) {
-        if (!active || record["end"] !== active.path || record["size"] !== active.size || record["sha256"] !== active.hash.digest("hex")) throw new Error("Archive file digest mismatch");
-        if (/^(artifacts|blobs)\//.test(active.path) && active.path.split("/").slice(1).join("") !== record["sha256"]) throw new Error("Archive blob address mismatch");
-        await active.file.sync(); await active.file.close(); active = undefined;
-      } else throw new Error("Unknown archive record");
-      digest.update(line + "\n");
-    }
-    if (!complete) throw new Error("Incomplete archive: missing footer");
-    await validateSession(stage);
-    for (const sha of (await referencedBlobs(stage)).keys()) if (!await verifyBlob(join(stage, "blobs"), sha)) throw new Error(`Missing session blob ${sha}`);
-    await mkdir(join(stage, "blobs"), { recursive: true });
-    await relocateSession(stage, workspace);
-    await rename(stage, destination);
-    const parent = await open(sessionRoot, "r"); try { await parent.sync(); } finally { await parent.close(); }
-    return destination;
-  } finally { await active?.file.close(); await rm(stage, { recursive: true, force: true }); }
-}

package/src/store/session-browser.ts

@@ -1,68 +0,0 @@
-/** Location discovery only; session data is always read from its append-only journals (D3/D8). */
-import { readdir, readFile, mkdir, rename, realpath } from "node:fs/promises";
-import { dirname, join, resolve } from "node:path";
-import { randomUUID } from "node:crypto";
-import { configDir } from "./config.ts";
-import { atomicWrite } from "./atomic.ts";
-import { serialized } from "./serial.ts";
-import { readListed, type ListedSession } from "./sessions.ts";
-import { readCursor, writeCursor } from "./log.ts";
-
-export interface SessionRoot { path: string; workspace: string }
-const registryPath = () => join(configDir(), "session-roots.json");
-export async function sessionRoots(current: SessionRoot): Promise<SessionRoot[]> {
-  let rows: SessionRoot[] = [];
-  try {
-    const data: unknown = JSON.parse(await readFile(registryPath(), "utf8"));
-    if (!Array.isArray(data)) throw new Error("Session root registry is not an array");
-    rows = data.filter((row): row is SessionRoot => row !== null && typeof row === "object" && typeof row.path === "string" && typeof row.workspace === "string");
-  } catch (error) { if ((error as { code?: string }).code !== "ENOENT") throw error; }
-  return [...new Map([...rows, current].map(row => [resolve(row.path), { ...row, path: resolve(row.path), workspace: resolve(row.workspace) }])).values()];
-}
-export async function registerSessionRoot(root: SessionRoot): Promise<void> {
-  const path = registryPath();
-  return serialized(path, async () => {
-    const rows = await sessionRoots(root);
-    await mkdir(dirname(path), { recursive: true });
-    await atomicWrite(path, JSON.stringify(rows, null, 2) + "\n");
-  });
-}
-export interface SessionScan { sessions: ListedSession[]; loaded: number; total: number; root: string }
-export async function* scanSessionRoots(roots: readonly SessionRoot[], signal?: AbortSignal): AsyncGenerator<SessionScan> {
-  const found: { id: string; path: string; workspace: string }[] = [];
-  for (const root of roots) {
-    if (signal?.aborted) return;
-    try {
-      const entries = await readdir(root.path, { withFileTypes: true });
-      found.push(...entries.filter(entry => entry.isDirectory() && !entry.name.startsWith(".")).map(entry => ({ id: entry.name, path: join(root.path, entry.name), workspace: root.workspace })));
-    } catch (error) {
-      if ((error as { code?: string }).code !== "ENOENT") yield { sessions: [{ ok: false, id: root.path, path: root.path, error: String(error) }], loaded: 0, total: 0, root: root.path };
-    }
-  }
-  const unique = [...new Map(found.map(row => [resolve(row.path), row])).values()];
-  // Eight concurrent reads bound descriptors and let cancellation run between batches; no total-result cap.
-  for (let offset = 0; offset < unique.length; offset += 8) {
-    if (signal?.aborted) return;
-    const batch = unique.slice(offset, offset + 8);
-    const sessions = await Promise.all(batch.map(async row => {
-      try { return await readListed(row.id, row.path, { workspace: row.workspace, ...(signal ? { signal } : {}) }); }
-      catch (error) { return { ok: false as const, id: row.id, path: row.path, error: String(error) }; }
-    }));
-    if (signal?.aborted) return;
-    yield { sessions, loaded: Math.min(offset + batch.length, unique.length), total: unique.length, root: batch[0]!.workspace };
-  }
-}
-export async function renameSession(path: string, name: string): Promise<void> {
-  const cursor = await readCursor(path);
-  if (!cursor) throw new Error("This empty session has no saved cursor to rename");
-  await writeCursor(path, { ...cursor, name: name.trim() });
-}
-export async function archiveSession(path: string, active?: string): Promise<string> {
-  const target = await realpath(path);
-  if (active && target === await realpath(active)) throw new Error("Cannot remove the currently active session");
-  const trash = join(dirname(target), ".trash");
-  await mkdir(trash, { recursive: true });
-  const destination = join(trash, `${target.split(/[\\/]/).at(-1)!}-${randomUUID()}`);
-  await rename(target, destination);
-  return destination;
-}

package/src/store/session-position.ts

@@ -1,27 +0,0 @@
-/** Position lookup is shared by in-session navigation and copied forks (D8, Pi before/at semantics). */
-import type { NodeRef } from "../core/events.ts";
-import { digestNode, listNodes, nodePath, readCursorAt, readNode, type Basis, type Cursor } from "./log.ts";
-
-export async function resolveHistoryPosition(dir: string, eventId: string, position: "at" | "before" = "at"): Promise<{
-  node: number; parent: NodeRef | null; basis: Basis; selection: Cursor | null; editorText?: string;
-}> {
-  let found: Awaited<ReturnType<typeof readNode>> | undefined;
-  let node = -1;
-  for (const candidate of await listNodes(dir)) {
-    const read = await readNode(dir, candidate);
-    if (!read.events.some(e => e.id === eventId)) continue;
-    if (found) throw new Error(`ambiguous history event ${eventId}`);
-    if (!read.header || read.corrupt.length) throw new Error(`corrupt history node ${candidate}`);
-    node = candidate; found = read;
-  }
-  if (!found?.header) throw new Error(`NO_SUCH_EVENT: ${eventId}`);
-  const index = found.events.findIndex(e => e.id === eventId);
-  const event = found.events[index]!;
-  if (position === "before" && event.t !== "user") throw new Error("fork before requires a user message");
-  const selection = await readCursorAt(dir, node, eventId);
-  const cutoff = position === "before" ? found.events[index - 1]?.id : eventId;
-  const parent = cutoff === undefined ? found.header.parent
-    : { node, log_ref: nodePath(dir, node), sha256: await digestNode(dir, node), at_event: cutoff };
-  return { node, parent, basis: cutoff === undefined ? found.header.basis : "inherit", selection,
-    ...(position === "before" && event.t === "user" ? { editorText: event.text } : {}) };
-}