archgraph-argo 0.26.2 → 0.27.0

package/argo/scripts/external-graph-query.js

@@ -0,0 +1,162 @@
+'use strict';
+
+// Cross-project graph query (federation client side).
+//
+// A read tool call may carry an optional `projectId`. Absent => the local
+// workspace (unchanged). Present => the call is routed to the federation center
+// (`POST <centerUrl>/graph/read`), which authorizes and forwards to the mirror
+// engine; the native ARGO result is passed through with a `namespaceKey`. There
+// is NO silent fallback to the local graph.
+//
+// The requester identity is the project's own `projectId`, read from
+// `<workspace>/.argo/federation.json`. If it is missing, external queries fail
+// with an explicit "register first" error — the id is never guessed.
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const EXTERNAL_READ_TOOLS = new Set([
+  'getSystemArchitecture',
+  'getIntentElementContext',
+  'getArchitectureViewContext',
+  'queryNeo4jGraph',
+  'memory_search',
+]);
+
+const FEDERATION_FILE = path.join('.argo', 'federation.json');
+const DEFAULT_CENTER_URL = 'https://argo.derekworkspacev5.com';
+
+function loadFederationIdentity(workspaceRoot) {
+  const file = path.join(workspaceRoot || process.cwd(), FEDERATION_FILE);
+  if (!fs.existsSync(file)) {
+    return null;
+  }
+  try {
+    const identity = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return identity && typeof identity === 'object' ? identity : null;
+  } catch {
+    return null;
+  }
+}
+
+function isExternalQuery(args) {
+  return Boolean(args) && typeof args.projectId === 'string' && args.projectId.trim() !== '';
+}
+
+// A tool call is external iff it is one of the readable tools AND carries projectId.
+function externalQueryRequested(toolName, args) {
+  return EXTERNAL_READ_TOOLS.has(toolName) && isExternalQuery(args);
+}
+
+function forwardedArgs(args) {
+  const out = { ...(args || {}) };
+  // projectId is the router parameter; workspaceRoot/architecturePath are local-only.
+  delete out.projectId;
+  delete out.workspaceRoot;
+  delete out.architecturePath;
+  return out;
+}
+
+/**
+ * Route an external read. Returns the native ARGO result (with an added
+ * `namespaceKey`) on success, or `{ status:'failed', error:{...} }` — never the
+ * local result.
+ *
+ * @param {object} options
+ * @param {string} options.workspaceRoot
+ * @param {string} options.tool
+ * @param {object} options.args
+ * @param {Function} [options.fetchImpl] - injectable fetch (tests)
+ */
+async function queryExternalRead({ workspaceRoot, tool, args, fetchImpl }) {
+  const fetchFn = fetchImpl || globalThis.fetch;
+  if (typeof fetchFn !== 'function') {
+    return { status: 'failed', error: { category: 'EXTERNAL_QUERY_UNREACHABLE', message: 'global fetch is unavailable in this runtime' } };
+  }
+
+  const identity = loadFederationIdentity(workspaceRoot);
+  if (!identity || typeof identity.projectId !== 'string' || identity.projectId.trim() === '') {
+    return {
+      status: 'failed',
+      error: {
+        category: 'EXTERNAL_QUERY_NOT_REGISTERED',
+        message: `No federation identity at ${FEDERATION_FILE}. Register this project with the federation center first (registry_register) and write its projectId to ${FEDERATION_FILE}.`,
+      },
+    };
+  }
+
+  if (!EXTERNAL_READ_TOOLS.has(tool)) {
+    return {
+      status: 'failed',
+      error: { category: 'EXTERNAL_QUERY_TOOL_NOT_ALLOWED', message: `tool '${tool}' is not externally readable`, allowed: [...EXTERNAL_READ_TOOLS] },
+    };
+  }
+
+  const centerUrl = String(identity.centerUrl || DEFAULT_CENTER_URL).replace(/\/+$/, '');
+  const url = `${centerUrl}/graph/read`;
+  const body = {
+    requester: identity.projectId,
+    projectId: args.projectId,
+    tool,
+    args: forwardedArgs(args),
+  };
+
+  let response;
+  try {
+    response = await fetchFn(url, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(body),
+    });
+  } catch (error) {
+    return {
+      status: 'failed',
+      error: {
+        category: 'EXTERNAL_QUERY_UNREACHABLE',
+        message: `federation center unreachable: ${error && error.message ? error.message : error}`,
+        centerUrl,
+      },
+    };
+  }
+
+  let payload = null;
+  try { payload = await response.json(); } catch { /* leave null */ }
+
+  if (response.status === 200 && payload && payload.status === 'ok') {
+    // The engine returns the ARGO tool result; unwrap a {content:[{text}]}
+    // envelope so callers get the native payload, then stamp the namespaceKey.
+    let result = payload.result;
+    if (result && Array.isArray(result.content) && result.content[0] && typeof result.content[0].text === 'string') {
+      try { result = JSON.parse(result.content[0].text); } catch { /* keep the envelope */ }
+    }
+    if (result && typeof result === 'object') {
+      result = { ...result, namespaceKey: payload.namespaceKey || `proj:${args.projectId}` };
+    }
+    return result;
+  }
+
+  const denied = Boolean(payload && payload.status === 'denied');
+  const reason = (payload && payload.reason)
+    || (response.status === 403 ? 'not_authorized' : `http_${response.status}`);
+  return {
+    status: 'failed',
+    error: {
+      category: denied ? 'EXTERNAL_QUERY_DENIED' : 'EXTERNAL_QUERY_FAILED',
+      reason,
+      httpStatus: response.status,
+      requester: identity.projectId,
+      projectId: args.projectId,
+      namespaceKey: `proj:${args.projectId}`,
+    },
+  };
+}
+
+module.exports = {
+  EXTERNAL_READ_TOOLS,
+  FEDERATION_FILE,
+  DEFAULT_CENTER_URL,
+  loadFederationIdentity,
+  isExternalQuery,
+  externalQueryRequested,
+  queryExternalRead,
+};

package/argo/scripts/graph-rag/defaultSemanticRetrieval.js

@@ -611,19 +611,6 @@ function assertProtectedSecretFile(expectedFilePath, adapters) {
   ) {
     throw safeError('SECRET_FILE_GIT_STATE_UNSAFE');
   }
-  const acl = adapters.acl && adapters.acl.inspect();
-  if (!acl || acl.status !== 0 || !acl.identity || typeof acl.stdout !== 'string') {
-    throw safeError('SECRET_FILE_ACL_UNVERIFIABLE');
-  }
-  const broadRead = acl.stdout
-    .split(/\r?\n/)
-    .some(line => /^(Everyone|BUILTIN\\Users|Authenticated Users):.*\((?:R|RX|F|M)\)/i.test(line.trim()));
-  const identityRead = acl.stdout
-    .split(/\r?\n/)
-    .some(line => line.trim().startsWith(`${acl.identity}:`) && /\((?:R|RX|F|M)\)/i.test(line));
-  if (broadRead || !identityRead) {
-    throw safeError('SECRET_FILE_ACL_UNSAFE');
-  }
 }
 
 function requireApprovedProfile(values) {

package/argo/scripts/graph-rag/liveEmbeddingProviderConfig.js

@@ -86,6 +86,8 @@ const LEGACY_KEYS = Object.freeze(['ARGO_NEO4J_URI', 'ARGO_NEO4J_USERNAME', 'ARG
 const HOST_ONLY_ENV_KEYS = Object.freeze([
   'ARGO_ENV_FILE',
   'ARGO_REPO_ROOT',
+  'ARGO_SCHEMA_DIR',
+  'ARGO_ACTOR_ELEMENT_TYPE',
   'ARGO_EA_QEA',
   'ARGO_WORKSPACE_ROOTS',
   'ARGO_SERVER_PATH',
@@ -97,6 +99,8 @@ const HOST_ONLY_ENV_KEYS = Object.freeze([
   'ARGO_MCP_SEMANTIC_DEDUP',
   'ARGO_MCP_SEMANTIC_DEDUP_THRESHOLD',
   'ARGO_SEMANTIC_DEDUP_THRESHOLD',
+  'ARGO_COST_PROFILER',
+  'ARGO_COST_TRACE_MAX_BYTES',
 ]);
 const PROHIBITED_RUNTIME_FIELD_KEYS = Object.freeze(['neo4jUri', 'embeddingCredential']);
 const SECRET_KEYS = new Set(['ARGO_NEO4J_DATABASE_PASSWORD', 'QWEN_KEY', 'ARGO_RERANK_API_KEY', EMBEDDING_API_KEY_KEY]);
@@ -451,76 +455,18 @@ function preflightFile({ canonicalFilePath, configuredFilePath, filesystem, adap
 
   let ignored;
   let tracked;
-  let aclEvidence;
   if (adapters.systemMetadata) {
     const insideRepository = adapters.systemMetadata.isSecretFileInsideGitRepository().status === 0;
     ignored = insideRepository ? adapters.systemMetadata.isSecretFileIgnored() : true;
     tracked = insideRepository ? adapters.systemMetadata.isSecretFileTracked() : false;
-    if (process.platform === 'win32') {
-      const identityResult = adapters.systemMetadata.readCurrentIdentity();
-      const aclResult = adapters.systemMetadata.readSecretFileAcl();
-      aclEvidence = {
-        status: aclResult.status,
-        stdout: aclResult.stdout,
-        identity: identityResult.status === 0 ? identityResult.stdout.trim() : '',
-      };
-    }
   } else {
     ignored = adapters.git.isIgnored(configuredFilePath);
     tracked = adapters.git.isTracked(configuredFilePath);
-    aclEvidence = adapters.acl.inspect(configuredFilePath);
   }
+  // Only the "never committed" guarantee is enforced. OS-level ACL / file-mode
+  // hardening is intentionally NOT required (it caused frequent false failures).
   if (tracked) throw safeError('SECRET_FILE_TRACKED');
   if (!ignored) throw safeError('SECRET_FILE_NOT_IGNORED');
-  if (process.platform === 'win32') {
-    validateAcl(aclEvidence);
-  } else {
-    validatePosixSecretFileAcl(configuredFilePath, filesystem);
-  }
-}
-
-function validateAcl(result) {
-  if (!result || result.status !== 0 || typeof result.stdout !== 'string' || !result.identity) {
-    throw safeError('SECRET_FILE_ACL_UNVERIFIABLE');
-  }
-  const permissions = parseAcl(result.stdout);
-  const current = permissions.get(String(result.identity).toLowerCase());
-  if (!current || !current.allow || current.deny) throw safeError('SECRET_FILE_ACL_UNSAFE');
-  for (const broad of ['everyone', 'builtin\\users', 'authenticated users', 'nt authority\\authenticated users']) {
-    const permission = permissions.get(broad);
-    if (permission && permission.allow && !permission.deny) throw safeError('SECRET_FILE_ACL_UNSAFE');
-  }
-}
-
-function parseAcl(output) {
-  const result = new Map();
-  for (const line of output.split(/\r?\n/)) {
-    const normalizedLine = line.trim().replace(/^[A-Za-z]:\\.*?\.env\s+/, '');
-    const match = normalizedLine.match(/^(.+?):((?:\([^)]*\))+)\s*$/);
-    if (!match) continue;
-    const tokens = [...match[2].matchAll(/\(([^)]*)\)/g)].map(item => item[1].toUpperCase());
-    if (!tokens.some(token => /^(?:F|M|R|RX)$/.test(token))) continue;
-    const key = match[1].trim().toLowerCase();
-    const entry = result.get(key) || { allow: false, deny: false };
-    if (tokens.includes('DENY')) entry.deny = true;
-    else entry.allow = true;
-    result.set(key, entry);
-  }
-  return result;
-}
-
-function posixModeIsSecretSafe(mode) {
-  return (mode & 0o077) === 0 && (mode & 0o600) === 0o600;
-}
-
-function validatePosixSecretFileAcl(configuredFilePath, filesystem) {
-  const stat = filesystem.lstatSync(configuredFilePath);
-  if (!posixModeIsSecretSafe(stat.mode)) {
-    throw safeError('SECRET_FILE_ACL_UNSAFE');
-  }
-  if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) {
-    throw safeError('SECRET_FILE_ACL_UNSAFE');
-  }
 }
 
 function productionSourceBehavior(repositoryRoot) {
@@ -612,7 +558,6 @@ function safeError(category) {
 module.exports = {
   resolveApprovedLiveConfiguration,
   withApprovedLiveConfigurationTestComposition,
-  posixModeIsSecretSafe,
   buildProfileConfiguration,
   APPROVED_EMBEDDING_VALUES: APPROVED,
   // The authoritative set of keys an approved `.env` file may carry. The