@wrenai/genbi 0.0.1

package/dist-server/server/native-producer-fence.d.ts

@@ -0,0 +1,14 @@
+import type { NativeProducerHostFence } from "../harness/native-producer/index.js";
+import type { EnrichmentBinding } from "./enrichment.js";
+import type { Store } from "./db.js";
+/**
+ * Bridges the producer's public-safe scope to the same durable native-session
+ * and live-binding fence used by native artifact persistence. No path, token,
+ * or session credential is returned to the producer contract.
+ */
+export declare function createNativeProducerHostFence(input: {
+    readonly store: Store;
+    readonly getBinding: () => EnrichmentBinding | undefined;
+    /** Selected by the server from durable native-session state; never public. */
+    readonly nativeSessionId: string;
+}): NativeProducerHostFence;

package/dist-server/server/native-producer-fence.js

@@ -0,0 +1,48 @@
+import { createHash } from "node:crypto";
+/**
+ * Bridges the producer's public-safe scope to the same durable native-session
+ * and live-binding fence used by native artifact persistence. No path, token,
+ * or session credential is returned to the producer contract.
+ */
+export function createNativeProducerHostFence(input) {
+    const session = input.store.getNativeSession(input.nativeSessionId);
+    const binding = input.getBinding();
+    if (!session || !binding || !matchesBinding(session, binding)) {
+        throw new Error("cannot create a native producer fence without a live bound native session");
+    }
+    const bindingDigest = digestBinding(session.id, binding);
+    const validRun = (request, userProject) => {
+        const live = input.getBinding();
+        const currentSession = input.store.getNativeSession(input.nativeSessionId);
+        return Boolean(live && currentSession && userProject !== undefined && live.path === userProject &&
+            request.scope.bindingDigest === bindingDigest &&
+            matchesBinding(currentSession, live) && currentSession.vendor === request.vendor &&
+            (currentSession.status === "running" || currentSession.status === "detached"));
+    };
+    return {
+        bindingDigest,
+        validateRun: (request) => validRun(request, input.getBinding()?.path),
+        validateRoute: validRun,
+        validateArtifact: (artifact, request) => {
+            const live = input.getBinding();
+            const currentSession = input.store.getNativeSession(input.nativeSessionId);
+            if (!live || !currentSession || !validRun(request, live.path) || !matchesBinding(currentSession, live))
+                return false;
+            const row = input.store.getArtifact(artifact.id);
+            return Boolean(row && row.nativeSessionId === input.nativeSessionId &&
+                row.projectIdentity === live.identity && row.bindingGeneration === live.generation && row.projectRevision === live.revision &&
+                row.contentDigest === artifact.digest && row.idempotencyKey === artifact.idempotencyKey);
+        },
+    };
+}
+function matchesBinding(session, binding) {
+    return session.projectIdentity === binding.identity &&
+        session.bindingGeneration === binding.generation && session.projectRevision === binding.revision;
+}
+function digestBinding(nativeSessionId, binding) {
+    // Delimit and length-prefix each private value so different tuples cannot
+    // collide through concatenation. Only this one-way digest leaves the host.
+    const fields = [nativeSessionId, binding.identity, String(binding.generation), binding.revision];
+    const encoded = fields.map((field) => `${Buffer.byteLength(field)}:${field}`).join("|");
+    return `sha256:${createHash("sha256").update(encoded).digest("hex")}`;
+}

package/dist-server/server/native-session-resume.d.ts

@@ -0,0 +1,6 @@
+import type { NativeSessionStateBase } from "./native-session-workspace.js";
+export type NativeResumeProvider = "claude" | "codex";
+export declare function sealNativeResumeHandle(state: NativeSessionStateBase, sessionId: string, provider: NativeResumeProvider, handle: string): string;
+export declare function unsealNativeResumeHandle(state: NativeSessionStateBase, sessionId: string, provider: NativeResumeProvider, sealed: string): string;
+export declare const sealNativeClaudeResumeHandle: (state: NativeSessionStateBase, sessionId: string, handle: string) => string;
+export declare const unsealNativeClaudeResumeHandle: (state: NativeSessionStateBase, sessionId: string, sealed: string) => string;

package/dist-server/server/native-session-resume.js

@@ -0,0 +1,103 @@
+/**
+ * Persistent sealing for provider-owned native conversation identifiers.
+ *
+ * The SQLite database holds ciphertext only. Its AES key is a separate,
+ * private BFF-state file, so a copied database neither reveals nor authorizes
+ * a provider conversation. This is intentionally local-state encryption, not
+ * a browser capability or a general-purpose secret store.
+ */
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { closeSync, constants, existsSync, lstatSync, openSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { InteractiveLaunchError, validateNativeSessionStateBase } from "./native-session-workspace.js";
+const KEY_FILE = "native-resume-key-v1";
+const KEY_BYTES = 32;
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+function keyPath(state) {
+    const root = validateNativeSessionStateBase(state).root;
+    const file = path.join(root, KEY_FILE);
+    if (path.dirname(file) !== root)
+        throw new InteractiveLaunchError("native session resume storage is unavailable");
+    return file;
+}
+function loadOrCreateKey(state) {
+    const file = keyPath(state);
+    if (!existsSync(file)) {
+        const key = randomBytes(KEY_BYTES);
+        try {
+            const fd = openSync(file, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY, 0o600);
+            try {
+                writeFileSync(fd, key);
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw new InteractiveLaunchError("native session resume storage is unavailable");
+        }
+    }
+    try {
+        const entry = lstatSync(file);
+        if (!entry.isFile() || entry.isSymbolicLink() || (entry.mode & 0o777) !== 0o600 || realpathSync(file) !== file)
+            throw new Error("unsafe key file");
+        const key = readFileSync(file);
+        if (key.length !== KEY_BYTES)
+            throw new Error("wrong key length");
+        return key;
+    }
+    catch {
+        throw new InteractiveLaunchError("native session resume storage is unavailable");
+    }
+}
+function parseEnvelope(value) {
+    try {
+        const parsed = JSON.parse(value);
+        if (parsed.version !== "1" || typeof parsed.iv !== "string" || typeof parsed.tag !== "string" || typeof parsed.ciphertext !== "string")
+            return undefined;
+        const iv = Buffer.from(parsed.iv, "base64url");
+        const tag = Buffer.from(parsed.tag, "base64url");
+        const ciphertext = Buffer.from(parsed.ciphertext, "base64url");
+        if (iv.length !== IV_BYTES || tag.length !== TAG_BYTES || ciphertext.length < 1)
+            return undefined;
+        return { version: "1", iv: parsed.iv, tag: parsed.tag, ciphertext: parsed.ciphertext };
+    }
+    catch {
+        return undefined;
+    }
+}
+function aad(sessionId, provider) { return Buffer.from(`genbi-native-resume-v1\u0000${provider}\u0000${sessionId}`, "utf8"); }
+export function sealNativeResumeHandle(state, sessionId, provider, handle) {
+    if (!UUID.test(handle))
+        throw new InteractiveLaunchError("native session resume handle is invalid");
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv("aes-256-gcm", loadOrCreateKey(state), iv);
+    cipher.setAAD(aad(sessionId, provider));
+    const ciphertext = Buffer.concat([cipher.update(handle, "utf8"), cipher.final()]);
+    const envelope = { version: "1", iv: iv.toString("base64url"), tag: cipher.getAuthTag().toString("base64url"), ciphertext: ciphertext.toString("base64url") };
+    return JSON.stringify(envelope);
+}
+export function unsealNativeResumeHandle(state, sessionId, provider, sealed) {
+    const envelope = parseEnvelope(sealed);
+    if (!envelope)
+        throw new InteractiveLaunchError("native session resume handle is unavailable");
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", loadOrCreateKey(state), Buffer.from(envelope.iv, "base64url"));
+        decipher.setAAD(aad(sessionId, provider));
+        decipher.setAuthTag(Buffer.from(envelope.tag, "base64url"));
+        const handle = Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64url")), decipher.final()]).toString("utf8");
+        if (!UUID.test(handle))
+            throw new Error("invalid handle");
+        return handle;
+    }
+    catch (error) {
+        if (error instanceof InteractiveLaunchError)
+            throw error;
+        throw new InteractiveLaunchError("native session resume handle is unavailable");
+    }
+}
+export const sealNativeClaudeResumeHandle = (state, sessionId, handle) => sealNativeResumeHandle(state, sessionId, "claude", handle);
+export const unsealNativeClaudeResumeHandle = (state, sessionId, sealed) => unsealNativeResumeHandle(state, sessionId, "claude", sealed);

package/dist-server/server/native-session-workspace.d.ts

@@ -0,0 +1,40 @@
+import type { InteractiveTarget } from "./interactive-terminal.js";
+export declare class InteractiveLaunchError extends Error {
+}
+export interface NativeSessionStateBase {
+    /** Canonical BFF-owned state root, initialized from the configured DB path. */
+    readonly root: string;
+}
+/**
+ * Initializes the only persistent materialization base for this BFF. The
+ * fixed digest makes it stable per configured SQLite state path without
+ * deriving any path from a browser-selected project.
+ */
+export declare function initializeNativeSessionStateBase(dbPath: string): NativeSessionStateBase;
+/** Non-mutating validation used by readiness and every launch boundary. */
+export declare function validateNativeSessionStateBase(state: NativeSessionStateBase): NativeSessionStateBase;
+export declare function nativeSessionStateBaseAvailable(state: NativeSessionStateBase | undefined): boolean;
+/**
+ * Non-mutating readiness validation for a specific authorized project root.
+ * This intentionally shares create-time's canonical containment check, so a
+ * valid BFF state base nested below a project is still unavailable before a
+ * session row or vendor artifact can be created.
+ */
+export declare function nativeSessionStateBaseAvailableForProject(state: NativeSessionStateBase | undefined, projectRoot: string): boolean;
+/** Creates one atomic, private bound-session root outside the user project. */
+export declare function createNativeSessionWorkspace(state: NativeSessionStateBase, projectRoot: string, sessionId: string): string;
+/**
+ * Revalidates a native root immediately before dispatch, spec parsing, or PTY
+ * spawn. A same-UID actor can still replace a path after this last check and
+ * therefore has equivalent local authority to the BFF; that post-check race
+ * is outside this boundary's threat model. Symlink, mode, and containment
+ * replacement at every checked boundary fail closed.
+ */
+export declare function validateNativeSessionWorkspace(state: NativeSessionStateBase, projectRoot: string, workspace: string): string;
+/**
+ * The compatibility terminal has no durable session ID. Its target is
+ * server-bound, and it is materialized under the distinct legacy namespace.
+ */
+export declare function legacyInteractiveWorkspace(state: NativeSessionStateBase, projectRoot: string, target: InteractiveTarget): string;
+/** Revalidates the legacy root with the same post-check threat-model boundary. */
+export declare function validateLegacyInteractiveWorkspace(state: NativeSessionStateBase, projectRoot: string, workspace: string): string;

package/dist-server/server/native-session-workspace.js

@@ -0,0 +1,175 @@
+/**
+ * BFF-owned native interactive materialization roots. Bound projects retain
+ * their identity and remain Warble's authorization root, but vendor-owned
+ * discovery files are emitted only under the BFF state directory. This keeps
+ * user project files out of the producer's ownership plan.
+ */
+import { createHash } from "node:crypto";
+import { accessSync, chmodSync, constants, lstatSync, mkdirSync, realpathSync } from "node:fs";
+import path from "node:path";
+export class InteractiveLaunchError extends Error {
+}
+const NATIVE_NAMESPACE = "native";
+const LEGACY_NAMESPACE = "legacy";
+const MODE = 0o700;
+function unavailable() {
+    throw new InteractiveLaunchError("native session workspace is unavailable");
+}
+function contained(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+function canonicalDirectory(directory, requirePrivateMode, requireWritable = true) {
+    try {
+        const entry = lstatSync(directory);
+        if (!entry.isDirectory() || entry.isSymbolicLink() || (requirePrivateMode && (entry.mode & 0o777) !== MODE))
+            unavailable();
+        accessSync(directory, requireWritable ? constants.W_OK | constants.X_OK : constants.X_OK);
+        const canonical = realpathSync(directory);
+        const canonicalEntry = lstatSync(canonical);
+        if (!canonicalEntry.isDirectory() || canonicalEntry.isSymbolicLink() || (requirePrivateMode && (canonicalEntry.mode & 0o777) !== MODE))
+            unavailable();
+        accessSync(canonical, requireWritable ? constants.W_OK | constants.X_OK : constants.X_OK);
+        return canonical;
+    }
+    catch (error) {
+        if (error instanceof InteractiveLaunchError)
+            throw error;
+        return unavailable();
+    }
+}
+function privateChild(parent, segment, create) {
+    const candidate = path.join(parent, segment);
+    if (!contained(parent, candidate) || path.basename(candidate) !== segment)
+        return unavailable();
+    if (create) {
+        try {
+            mkdirSync(candidate, { mode: MODE });
+            // mkdir honors umask; make the freshly-created component exact before
+            // validating it. Existing components are never repaired silently.
+            chmodSync(candidate, MODE);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                return unavailable();
+        }
+    }
+    const canonical = canonicalDirectory(candidate, true);
+    if (!contained(parent, canonical))
+        return unavailable();
+    return canonical;
+}
+function exclusivePrivateChild(parent, segment) {
+    const candidate = path.join(parent, segment);
+    if (!contained(parent, candidate) || path.basename(candidate) !== segment)
+        return unavailable();
+    try {
+        mkdirSync(candidate, { mode: MODE });
+        chmodSync(candidate, MODE);
+    }
+    catch {
+        return unavailable();
+    }
+    return privateChild(parent, segment, false);
+}
+function verifyOutsideProject(stateRoot, projectRoot) {
+    const project = canonicalDirectory(projectRoot, false, false);
+    if (contained(project, stateRoot))
+        unavailable();
+}
+/**
+ * Initializes the only persistent materialization base for this BFF. The
+ * fixed digest makes it stable per configured SQLite state path without
+ * deriving any path from a browser-selected project.
+ */
+export function initializeNativeSessionStateBase(dbPath) {
+    if (!dbPath || dbPath === ":memory:")
+        return unavailable();
+    const absoluteDbPath = path.resolve(dbPath);
+    const parent = canonicalDirectory(path.dirname(absoluteDbPath), false);
+    const digest = createHash("sha256").update(absoluteDbPath).digest("hex").slice(0, 24);
+    const root = privateChild(parent, `.genbi-native-state-${digest}`, true);
+    // Initialize both namespaces at startup so readiness can stay non-mutating.
+    privateChild(root, NATIVE_NAMESPACE, true);
+    privateChild(root, LEGACY_NAMESPACE, true);
+    return { root };
+}
+/** Non-mutating validation used by readiness and every launch boundary. */
+export function validateNativeSessionStateBase(state) {
+    const root = canonicalDirectory(state.root, true);
+    privateChild(root, NATIVE_NAMESPACE, false);
+    privateChild(root, LEGACY_NAMESPACE, false);
+    return { root };
+}
+export function nativeSessionStateBaseAvailable(state) {
+    if (!state)
+        return false;
+    try {
+        validateNativeSessionStateBase(state);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Non-mutating readiness validation for a specific authorized project root.
+ * This intentionally shares create-time's canonical containment check, so a
+ * valid BFF state base nested below a project is still unavailable before a
+ * session row or vendor artifact can be created.
+ */
+export function nativeSessionStateBaseAvailableForProject(state, projectRoot) {
+    if (!state)
+        return false;
+    try {
+        verifyOutsideProject(validateNativeSessionStateBase(state).root, projectRoot);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Creates one atomic, private bound-session root outside the user project. */
+export function createNativeSessionWorkspace(state, projectRoot, sessionId) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9-]{0,127}$/.test(sessionId))
+        return unavailable();
+    const root = validateNativeSessionStateBase(state).root;
+    verifyOutsideProject(root, projectRoot);
+    return exclusivePrivateChild(privateChild(root, NATIVE_NAMESPACE, false), sessionId);
+}
+/**
+ * Revalidates a native root immediately before dispatch, spec parsing, or PTY
+ * spawn. A same-UID actor can still replace a path after this last check and
+ * therefore has equivalent local authority to the BFF; that post-check race
+ * is outside this boundary's threat model. Symlink, mode, and containment
+ * replacement at every checked boundary fail closed.
+ */
+export function validateNativeSessionWorkspace(state, projectRoot, workspace) {
+    const root = validateNativeSessionStateBase(state).root;
+    verifyOutsideProject(root, projectRoot);
+    const native = privateChild(root, NATIVE_NAMESPACE, false);
+    const canonical = canonicalDirectory(workspace, true);
+    if (!contained(native, canonical) || canonical === native)
+        return unavailable();
+    return canonical;
+}
+/**
+ * The compatibility terminal has no durable session ID. Its target is
+ * server-bound, and it is materialized under the distinct legacy namespace.
+ */
+export function legacyInteractiveWorkspace(state, projectRoot, target) {
+    const root = validateNativeSessionStateBase(state).root;
+    verifyOutsideProject(root, projectRoot);
+    const targetRoot = target === "claude-code:interactive" ? "claude" : "codex";
+    return privateChild(privateChild(root, LEGACY_NAMESPACE, false), targetRoot, true);
+}
+/** Revalidates the legacy root with the same post-check threat-model boundary. */
+export function validateLegacyInteractiveWorkspace(state, projectRoot, workspace) {
+    const root = validateNativeSessionStateBase(state).root;
+    verifyOutsideProject(root, projectRoot);
+    const legacy = privateChild(root, LEGACY_NAMESPACE, false);
+    const canonical = canonicalDirectory(workspace, true);
+    if (!contained(legacy, canonical) || canonical === legacy)
+        return unavailable();
+    return canonical;
+}