@volter/teams 0.1.0

package/home.mjs

@@ -0,0 +1,220 @@
+// The files. Everything lives under <SUPERCODE_HOME>/teams — the
+// same home supercode's own receipts use (agent.rs global_instructions_dir):
+// SUPERCODE_HOME, else XDG_CONFIG_HOME/supercode, else ~/.config/supercode.
+//
+//   machine.key / machine.pub   the host key; it signs `describe`, nothing else
+//   machine.sock                the local door: owner-only, the OS user is the caller
+//   machine.json                the running daemon: pid, key id, socket, linked server
+//   launches.jsonl              launch key → pane contextKey
+//   log.jsonl                   hash-chained accountability, no bodies
+//   log.<ts>.jsonl              its rotations, oldest pruned past `logKeep`
+//   limits.json                 the daemon's bounds
+//   attention.json              requested-attention records; rank table
+//   titles.json                 pane → display title
+//   suspended.json              panes whose remote input is refused
+//   products/                   receipts of products served behind the daemon (products.mjs)
+//   workspaces/                 Teams contexts, credentials and connector enrollments
+import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, statSync, renameSync, readdirSync, rmSync } from 'node:fs';
+import { join, dirname, basename } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash } from 'node:crypto';
+
+export function supercodeHome(env = process.env) {
+  if (env.SUPERCODE_HOME) return env.SUPERCODE_HOME;
+  if (env.XDG_CONFIG_HOME) return join(env.XDG_CONFIG_HOME, 'supercode');
+  return join(homedir(), '.config', 'supercode');
+}
+
+export function teamsHome(env = process.env) {
+  const dir = env.SUPERCODE_TEAMS_HOME ?? join(supercodeHome(env), 'teams');
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+/**
+ * A Unix socket path for `name` in `dir`: the path itself when it fits a socket
+ * address (104 bytes on macOS, 108 on Linux); otherwise, as tmux does, a
+ * per-user directory under /tmp that only this user may enter, with the socket
+ * named by a hash of the path it stands for.
+ */
+export function shortSocketPath(dir, name) {
+  const inside = join(dir, name);
+  if (Buffer.byteLength(inside) <= 100) return inside;
+  const uid = typeof process.getuid === 'function' ? process.getuid() : 'user';
+  return join('/tmp', `supercode-machine-${uid}`, `${createHash('sha256').update(inside).digest('hex').slice(0, 24)}.sock`);
+}
+
+/** Where the daemon for `home` serves its local door. */
+export const machineSocketPath = (home) => shortSocketPath(home, 'machine.sock');
+
+/** The socket's directory exists; the shared /tmp fallback must be ours and admit only us, and anything else there is refused, never adopted. */
+export function ensureSocketDirectory(socketPath) {
+  const dir = dirname(socketPath);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  if (!basename(dir).startsWith('supercode-machine-') || dirname(dir) !== '/tmp') return;
+  const stat = statSync(dir);
+  const uid = typeof process.getuid === 'function' ? process.getuid() : stat.uid;
+  if (stat.uid !== uid || (stat.mode & 0o077) !== 0) throw new Error(`${dir} must be owned by this user with mode 0700`);
+}
+
+export const paths = (home) => ({
+  machineKey: join(home, 'machine'),
+  machine: join(home, 'machine.json'),
+  socket: machineSocketPath(home),
+  launches: join(home, 'launches.jsonl'),
+  log: join(home, 'log.jsonl'),
+  attention: join(home, 'attention.json'),
+  titles: join(home, 'titles.json'),
+  suspended: join(home, 'suspended.json'),
+  limits: join(home, 'limits.json'),
+});
+
+/**
+ * The daemon's bounds, read from limits.json when it starts:
+ *
+ *   maxAttachmentsPerPrincipal  live pane attachments one caller may hold at once
+ *   protocolFloor               the lowest caller node protocol this machine speaks to
+ *   logRotateBytes / logKeep    when log.jsonl rotates, and how many rotations survive
+ */
+export const DEFAULT_LIMITS = Object.freeze({
+  maxAttachmentsPerPrincipal: 16,
+  protocolFloor: 2,
+  logRotateBytes: 16 * 1024 * 1024,
+  logKeep: 8,
+});
+
+export function readLimits(path) {
+  return { ...DEFAULT_LIMITS, ...readJson(path, {}) };
+}
+
+export function readJson(path, fallback) {
+  if (!existsSync(path)) return fallback;
+  return JSON.parse(readFileSync(path, 'utf8'));
+}
+
+export function writeJson(path, value, mode = 0o600) {
+  writeFileSync(path, JSON.stringify(value, null, 2) + '\n', { mode });
+}
+
+/** `log.jsonl` → `log.<stamp>.jsonl`, the name a rotation takes. */
+function rotatedPath(path, stamp) {
+  const name = basename(path);
+  const dot = name.indexOf('.');
+  const base = dot < 0 ? name : name.slice(0, dot);
+  const ext = dot < 0 ? '' : name.slice(dot);
+  return join(dirname(path), `${base}.${stamp}${ext}`);
+}
+
+/**
+ * The accountability log: one JSON line per act, each carrying the sha256
+ * of the previous line so tampering breaks the chain. Never a body.
+ *
+ * Retention: past `rotateBytes` the file
+ * is renamed `log.<ts>.jsonl` and a fresh one starts, keeping `logKeep`
+ * rotations. The chain does NOT restart — the first line of the new file names
+ * the last line of the old one — so the whole set verifies as one sequence and
+ * a deleted rotation is visible as a break, not a silent gap.
+ */
+export class AccountLog {
+  constructor(path, { rotateBytes = DEFAULT_LIMITS.logRotateBytes, keep = DEFAULT_LIMITS.logKeep } = {}) {
+    this.path = path;
+    this.rotateBytes = rotateBytes;
+    this.keep = keep;
+    this.last = null;
+    if (existsSync(path)) {
+      const lines = readFileSync(path, 'utf8').trimEnd().split('\n').filter(Boolean);
+      this.last = lines.length ? createHash('sha256').update(lines[lines.length - 1]).digest('hex') : null;
+    }
+  }
+  append({ principal, cap, target, outcome, detail = null }) {
+    const entry = { t: Date.now(), principal, cap, target, outcome, detail, prev: this.last };
+    const line = JSON.stringify(entry);
+    appendFileSync(this.path, line + '\n', { mode: 0o600 });
+    this.last = createHash('sha256').update(line).digest('hex');
+    this.rotate();
+    return entry;
+  }
+  /** Rename the live file aside once it is over its bound, then prune old rotations. */
+  rotate() {
+    if (!Number.isFinite(this.rotateBytes) || this.rotateBytes <= 0) return null;
+    let size = 0;
+    try { size = statSync(this.path).size; } catch { return null; }
+    if (size <= this.rotateBytes) return null;
+    let stamp = Date.now();
+    while (existsSync(rotatedPath(this.path, stamp))) stamp += 1;
+    const rotated = rotatedPath(this.path, stamp);
+    renameSync(this.path, rotated);
+    const rotations = AccountLog.rotations(this.path);
+    for (const old of rotations.slice(0, Math.max(0, rotations.length - this.keep))) rmSync(old, { force: true });
+    return rotated;
+  }
+  /** Every rotation of `path`, oldest first. */
+  static rotations(path) {
+    const dir = dirname(path);
+    if (!existsSync(dir)) return [];
+    const name = basename(path);
+    const dot = name.indexOf('.');
+    const base = dot < 0 ? name : name.slice(0, dot);
+    const ext = dot < 0 ? '' : name.slice(dot);
+    const pattern = new RegExp(`^${base.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\.(\\d+)${ext.replace(/\./g, '\\.')}$`);
+    return readdirSync(dir)
+      .map((entry) => [entry, pattern.exec(entry)])
+      .filter(([, match]) => match)
+      .sort((a, b) => Number(a[1][1]) - Number(b[1][1]))
+      .map(([entry]) => join(dir, entry));
+  }
+  /** The whole set in chain order: rotations oldest first, then the live file. */
+  static files(path) {
+    return [...AccountLog.rotations(path), ...(existsSync(path) ? [path] : [])];
+  }
+  /** Verify the chain across the rotated set; returns { ok, files, entries, brokenAt }. */
+  static verify(path) {
+    const files = AccountLog.files(path);
+    let prev = null;
+    let entries = 0;
+    for (const file of files) {
+      const lines = readFileSync(file, 'utf8').trimEnd().split('\n').filter(Boolean);
+      for (let i = 0; i < lines.length; i += 1) {
+        const entry = JSON.parse(lines[i]);
+        entries += 1;
+        if (entry.prev !== prev) return { ok: false, files, entries, brokenAt: { file, line: i } };
+        prev = createHash('sha256').update(lines[i]).digest('hex');
+      }
+    }
+    return { ok: true, files, entries, brokenAt: null };
+  }
+}
+
+/** launches.jsonl: appended before a launch is issued; the last record per key wins. */
+export class Launches {
+  constructor(path) { this.path = path; }
+  record(entry) { appendFileSync(this.path, JSON.stringify({ t: Date.now(), ...entry }) + '\n', { mode: 0o600 }); }
+  find(key) {
+    if (!existsSync(this.path)) return null;
+    const lines = readFileSync(this.path, 'utf8').trimEnd().split('\n').filter(Boolean);
+    for (let i = lines.length - 1; i >= 0; i -= 1) {
+      const entry = JSON.parse(lines[i]);
+      if (entry.key === key) return entry;
+    }
+    return null;
+  }
+  /** Every key's last record, newest first: what this node has launched for its callers. */
+  all() {
+    if (!existsSync(this.path)) return [];
+    const lines = readFileSync(this.path, 'utf8').trimEnd().split('\n').filter(Boolean);
+    const last = new Map();
+    for (const line of lines) { const entry = JSON.parse(line); last.set(entry.key, entry); }
+    return [...last.values()].sort((a, b) => b.t - a.t);
+  }
+}
+
+/** `host:port` or `[v6]:port` → { host, port }. */
+export function parseHostPort(text, fallback = { host: '127.0.0.1', port: 0 }) {
+  const value = String(text ?? '').trim();
+  if (!value) return fallback;
+  const bracketed = /^\[([^\]]+)\]:(\d+)$/.exec(value);
+  if (bracketed) return { host: bracketed[1], port: Number(bracketed[2]) };
+  const colon = value.lastIndexOf(':');
+  if (colon < 0) return { host: value, port: fallback.port };
+  return { host: value.slice(0, colon) || fallback.host, port: Number(value.slice(colon + 1)) };
+}

package/identity.mjs

@@ -0,0 +1,85 @@
+// The machine's host key: an Ed25519 keypair on disk that signs the daemon's
+// `describe` statement, and nothing else. node:crypto and plain JSON only.
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, createHash } from 'node:crypto';
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+/** Generate an Ed25519 keypair. Returns PEM strings. */
+export function generateKeyPair() {
+  const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+  return {
+    privateKeyPem: privateKey.export({ type: 'pkcs8', format: 'pem' }),
+    publicKeyPem: publicKey.export({ type: 'spki', format: 'pem' }),
+  };
+}
+
+/** Raw 32-byte public key from a PEM, as base64url. This is the principal's id. */
+export function publicKeyId(publicKeyPem) {
+  const key = createPublicKey(publicKeyPem);
+  const der = key.export({ type: 'spki', format: 'der' });
+  // SPKI for Ed25519 is a fixed 12-byte prefix followed by the 32-byte key.
+  return der.subarray(der.length - 32).toString('base64url');
+}
+
+export function publicKeyPemFromId(id) {
+  const raw = Buffer.from(id, 'base64url');
+  if (raw.length !== 32) throw new Error('principal id is not a 32-byte Ed25519 public key');
+  const prefix = Buffer.from('302a300506032b6570032100', 'hex');
+  return createPublicKey({ key: Buffer.concat([prefix, raw]), type: 'spki', format: 'der' })
+    .export({ type: 'spki', format: 'pem' });
+}
+
+/** A short fingerprint for humans: sha256 of the raw key, first 16 hex chars. */
+export function fingerprint(publicKeyPemOrId) {
+  const id = publicKeyPemOrId.includes('-----') ? publicKeyId(publicKeyPemOrId) : publicKeyPemOrId;
+  return createHash('sha256').update(Buffer.from(id, 'base64url')).digest('hex').slice(0, 16);
+}
+
+export function signBytes(privateKeyPem, bytes) {
+  return sign(null, bytes, createPrivateKey(privateKeyPem)).toString('base64url');
+}
+
+export function verifyBytes(publicKeyPemOrId, bytes, signatureB64) {
+  const pem = publicKeyPemOrId.includes('-----') ? publicKeyPemOrId : publicKeyPemFromId(publicKeyPemOrId);
+  try {
+    return verify(null, bytes, createPublicKey(pem), Buffer.from(signatureB64, 'base64url'));
+  } catch {
+    return false;
+  }
+}
+
+/** Canonical JSON: sorted keys, no whitespace. Signatures are over this form. */
+export function canonical(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.keys(value).sort().map((k) => [k, sortKeys(value[k])]));
+  }
+  return value;
+}
+
+/** Load or create a keypair on disk. Files: <base>.key (pkcs8 pem, 0600), <base>.pub (spki pem). */
+export function loadOrCreateKeyPair(basePath) {
+  const keyPath = `${basePath}.key`;
+  const pubPath = `${basePath}.pub`;
+  if (existsSync(keyPath)) {
+    const privateKeyPem = readFileSync(keyPath, 'utf8');
+    const publicKeyPem = existsSync(pubPath)
+      ? readFileSync(pubPath, 'utf8')
+      : createPublicKey(createPrivateKey(privateKeyPem)).export({ type: 'spki', format: 'pem' });
+    return { privateKeyPem, publicKeyPem, created: false };
+  }
+  mkdirSync(dirname(keyPath), { recursive: true });
+  const pair = generateKeyPair();
+  writeFileSync(keyPath, pair.privateKeyPem, { mode: 0o600 });
+  writeFileSync(pubPath, pair.publicKeyPem, { mode: 0o644 });
+  return { ...pair, created: true };
+}
+
+export function readPublicKeyPem(path) {
+  const text = readFileSync(path, 'utf8');
+  if (text.includes('-----')) return text;
+  return publicKeyPemFromId(text.trim());
+}

package/index.mjs

@@ -0,0 +1,8 @@
+// Volter Teams, the neutral team plane (company RFC 0008). A product builds on MachineCore
+// and registers its own doors; the harness is one such product (@volter-ai-dev/supercode-teams).
+export { MachineCore, MACHINE_VERSION } from './machine-core.mjs';
+export { Channel, NODE_PROTOCOL } from './channel.mjs';
+export { holds, targetsCover, admitFromGrants, observesPanes, LOCAL_OPERATOR } from './admission.mjs';
+export { serveProduct, findProduct, productProof, DAEMON_KINDS } from './products.mjs';
+export { loadOrCreateKeyPair, publicKeyId, fingerprint } from './identity.mjs';
+export { teamsHome, paths } from './home.mjs';