borgmcp-server 0.1.5 → 0.1.8

package/src/store.ts

@@ -65,7 +65,6 @@ export type ActivityNotificationRecord = EnrichedActivityRecord & (
     readonly claimant_drone_id?: string;
     readonly claimant_role?: string | null;
   }
-  | { readonly kind: "heartbeat_ping" }
 );
 
 export type ActivityStreamRecord = EnrichedActivityRecord | ActivityNotificationRecord;
@@ -180,11 +179,7 @@ export interface StoreRuntime {
 }
 
 export interface LivenessStore {
-  readonly scan: (options?: {
-    readonly silentMs?: number;
-    readonly cooldownMs?: number;
-    readonly limit?: number;
-  }) => ActivityNotificationRecord[];
+  readonly scan: () => ActivityNotificationRecord[];
 }
 
 export interface DigestPair {
@@ -237,6 +232,7 @@ export interface StoredDroneSessionDigest extends StoredSecretDigest {
   readonly droneId: string;
   readonly expiresAt: string;
   readonly evictedAt: string | null;
+  readonly takenOver: boolean;
 }
 
 export interface CredentialStore {
@@ -289,6 +285,8 @@ export interface ScopedStore {
     readonly drones: DroneRecord[];
     readonly since: string;
   };
+  readonly reassignDrone: (cubeId: string, droneId: string, roleId: string) => DroneRecord;
+  readonly evictDrone: (cubeId: string, droneId: string) => void;
   readonly appendLog: (cubeId: string, input: {
     readonly message: string;
     readonly visibility?: "broadcast" | "direct";
@@ -360,6 +358,7 @@ export interface SeatAttachInput {
   readonly credentialId: string;
   readonly credentialDigest: DigestPair;
   readonly expiresAt: string;
+  readonly renewIfExpiresAtOrBefore: string;
 }
 
 export interface SeatAttachRecord {
@@ -441,6 +440,24 @@ export interface MaintenanceStore {
   }) => void;
   readonly revokeClient: (clientId: string) => void;
   readonly revokeDroneSession: (sessionId: string) => void;
+  readonly expireDroneSession: (sessionId: string) => void;
+  readonly inspectManagedDrone: (droneId: string) => {
+    readonly role_id: string;
+    readonly evicted: boolean;
+    readonly session_revoked: boolean;
+  };
+  readonly inspectCubeManagementState: (cubeId: string) => {
+    readonly directive: string;
+    readonly taxonomy_marker: string | null;
+    readonly role_ids: readonly string[];
+    readonly active_decision_ids: readonly string[];
+    readonly drones: ReadonlyArray<{
+      readonly id: string;
+      readonly role_id: string;
+      readonly evicted: boolean;
+      readonly session_revoked: boolean;
+    }>;
+  };
   readonly expireActivityCursor: (cubeId: string, cursor: LogCursor) => void;
 }
 
@@ -480,6 +497,15 @@ export class RoleSectionConflictError extends Error {
   }
 }
 
+export class RoleInUseError extends Error {
+  readonly code = "ROLE_IN_USE";
+
+  constructor() {
+    super("The human-seat role is already occupied.");
+    this.name = "RoleInUseError";
+  }
+}
+
 export class CursorExpiredError extends Error {
   readonly code = "CURSOR_EXPIRED";
 
@@ -498,6 +524,33 @@ export class AttachSessionRejectedError extends Error {
   }
 }
 
+export class AttachSessionExpiredError extends Error {
+  readonly code = "AUTH_EXPIRED";
+
+  constructor() {
+    super("Authentication failed.");
+    this.name = "AttachSessionExpiredError";
+  }
+}
+
+export class AttachSessionRevokedError extends Error {
+  readonly code = "SESSION_REVOKED";
+
+  constructor() {
+    super("Authentication failed.");
+    this.name = "AttachSessionRevokedError";
+  }
+}
+
+export class AttachDroneEvictedError extends Error {
+  readonly code = "DRONE_EVICTED";
+
+  constructor() {
+    super("Authentication failed.");
+    this.name = "AttachDroneEvictedError";
+  }
+}
+
 export class StorageCapacityError extends Error {
   readonly code = "CAPACITY_EXCEEDED";
 
@@ -616,7 +669,7 @@ export async function openStore(options: OpenStoreOptions): Promise<StoreRuntime
   );
   const activityHub = new ActivityHub();
   const maintenance = new SqliteMaintenanceStore(database, clock);
-  const liveness = new SqliteLivenessStore(database, clock, activityHub, capacityGuard);
+  const liveness = new IdleLivenessStore();
   const credentials = new SqliteCredentialStore(database, clock, capacityGuard, options.mutationHook);
   return Object.freeze({
     forPrincipal: (principal: Principal) => {
@@ -1125,6 +1178,85 @@ class SqliteScopedStore implements ScopedStore {
     };
   }
 
+  reassignDrone(cubeId: string, droneId: string, roleId: string): DroneRecord {
+    assertCanonicalUuid(cubeId, "Cube id");
+    assertCanonicalUuid(droneId, "Drone id");
+    assertCanonicalUuid(roleId, "Role id");
+    this.#requireCube(cubeId, "manage");
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#requireCube(cubeId, "manage");
+      const droneRow = this.#database.prepare(`
+        SELECT id, cube_id, role_id, label FROM drones
+        WHERE id = ? AND cube_id = ? AND evicted_at IS NULL
+      `).get(droneId, cubeId);
+      const targetRoleRow = this.#database.prepare(`
+        SELECT id, is_human_seat, role_class FROM roles WHERE id = ? AND cube_id = ?
+      `).get(roleId, cubeId);
+      if (droneRow === undefined || targetRoleRow === undefined) throw new ScopedStoreError();
+      const sourceRoleRow = this.#database.prepare(`
+        SELECT is_human_seat FROM roles WHERE id = ? AND cube_id = ?
+      `).get(requiredText(droneRow, "role_id"), cubeId);
+      if (sourceRoleRow === undefined) throw new ScopedStoreError();
+      if (requiredText(targetRoleRow, "role_class") === "queen" &&
+          requiredInteger(sourceRoleRow, "is_human_seat") !== 1) {
+        throw new AccessDeniedError();
+      }
+      if (requiredInteger(targetRoleRow, "is_human_seat") === 1) {
+        const occupied = this.#database.prepare(`
+          SELECT 1 AS present FROM drones
+          WHERE cube_id = ? AND role_id = ? AND id <> ? AND evicted_at IS NULL
+        `).get(cubeId, roleId, droneId);
+        if (occupied !== undefined) throw new RoleInUseError();
+      }
+      this.#database.prepare("UPDATE drones SET role_id = ? WHERE id = ? AND cube_id = ?")
+        .run(roleId, droneId, cubeId);
+      const row = this.#database.prepare(`
+        SELECT drone.id, drone.cube_id, drone.role_id, drone.label,
+               COALESCE(drone.last_seen, drone.created_at) AS last_seen,
+               drone.hostname, drone.created_at,
+               CASE WHEN client.revoked_at IS NULL AND grant_row.access IN ('write', 'manage')
+                 THEN 'participant' ELSE 'observer' END AS posture
+        FROM drones AS drone
+        LEFT JOIN clients AS client ON client.id = drone.client_id
+        LEFT JOIN client_cube_grants AS grant_row
+          ON grant_row.client_id = drone.client_id AND grant_row.cube_id = drone.cube_id
+        WHERE drone.id = ? AND drone.cube_id = ? AND drone.evicted_at IS NULL
+      `).get(droneId, cubeId);
+      if (row === undefined) throw new ScopedStoreError();
+      this.#database.exec("COMMIT");
+      return droneRecord(row);
+    } catch (error) {
+      try { this.#database.exec("ROLLBACK"); } catch { /* Preserve the original failure. */ }
+      throw error;
+    }
+  }
+
+  evictDrone(cubeId: string, droneId: string): void {
+    assertCanonicalUuid(cubeId, "Cube id");
+    assertCanonicalUuid(droneId, "Drone id");
+    this.#requireCube(cubeId, "manage");
+    this.#database.exec("BEGIN IMMEDIATE");
+    try {
+      this.#requireCube(cubeId, "manage");
+      const active = this.#database.prepare(`
+        SELECT 1 AS present FROM drones WHERE id = ? AND cube_id = ? AND evicted_at IS NULL
+      `).get(droneId, cubeId);
+      if (active === undefined) throw new ScopedStoreError();
+      const now = this.#now();
+      this.#database.prepare("UPDATE drones SET evicted_at = ? WHERE id = ? AND cube_id = ?")
+        .run(now, droneId, cubeId);
+      this.#database.prepare(`
+        UPDATE drone_sessions SET revoked_at = ?
+        WHERE drone_id = ? AND cube_id = ? AND revoked_at IS NULL
+      `).run(now, droneId, cubeId);
+      this.#database.exec("COMMIT");
+    } catch (error) {
+      try { this.#database.exec("ROLLBACK"); } catch { /* Preserve the original failure. */ }
+      throw error;
+    }
+  }
+
   appendLog(cubeId: string, input: {
     readonly message: string;
     readonly visibility?: "broadcast" | "direct";
@@ -1175,7 +1307,6 @@ class SqliteScopedStore implements ScopedStore {
         this.#database.prepare(`
           UPDATE drones SET last_seen = ? WHERE id = ? AND cube_id = ? AND evicted_at IS NULL
         `).run(createdAt, droneId, cubeId);
-        this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
       }
       if (recipients.length > 0) {
         const valid = this.#database.prepare(`
@@ -1362,6 +1493,7 @@ class SqliteScopedStore implements ScopedStore {
     assertCanonicalUuid(input.credentialId, "Drone session credential id");
     validateDigest(input.credentialDigest);
     validateTimestamp(input.expiresAt);
+    validateTimestamp(input.renewIfExpiresAtOrBefore);
     const scope = this.#scope("read");
     const authorizedRole = this.#database.prepare(`
       SELECT 1 FROM cubes AS c JOIN roles AS role ON role.cube_id = c.id
@@ -1384,7 +1516,7 @@ class SqliteScopedStore implements ScopedStore {
         SELECT credential.verifier_digest, credential.revoked_at AS credential_revoked_at,
                session.id AS session_id, session.client_id, session.cube_id, session.drone_id,
                session.expires_at, session.revoked_at AS session_revoked_at,
-               drone.role_id, drone.label, drone.evicted_at
+               session.superseded_at, drone.role_id, drone.label, drone.evicted_at
         FROM drone_session_credentials AS credential
         JOIN drone_sessions AS session ON session.id = credential.session_id
         JOIN drones AS drone ON drone.id = session.drone_id
@@ -1394,10 +1526,6 @@ class SqliteScopedStore implements ScopedStore {
       if (bound !== undefined) {
         const verifier = requiredBuffer(bound, "verifier_digest");
         if (!timingSafeEqual(verifier, input.credentialDigest.verifier) ||
-            optionalText(bound, "credential_revoked_at") !== null ||
-            optionalText(bound, "session_revoked_at") !== null ||
-            optionalText(bound, "evicted_at") !== null ||
-            requiredText(bound, "expires_at") <= now ||
             requiredText(bound, "client_id") !== this.#principal.id ||
             requiredText(bound, "cube_id") !== input.cubeId ||
             requiredText(bound, "role_id") !== input.roleId ||
@@ -1405,9 +1533,27 @@ class SqliteScopedStore implements ScopedStore {
               requiredText(bound, "drone_id") !== input.priorDroneId)) {
           throw new AttachSessionRejectedError();
         }
+        if (optionalText(bound, "evicted_at") !== null) throw new AttachDroneEvictedError();
+        if (optionalText(bound, "credential_revoked_at") !== null ||
+            optionalText(bound, "session_revoked_at") !== null) {
+          throw new AttachSessionRevokedError();
+        }
+        if (optionalText(bound, "superseded_at") !== null) {
+          throw new AttachSessionRejectedError();
+        }
+        if (requiredText(bound, "expires_at") <= now) throw new AttachSessionExpiredError();
         const droneId = requiredText(bound, "drone_id");
+        const sessionId = requiredText(bound, "session_id");
+        const previousExpiry = requiredText(bound, "expires_at");
+        const committedExpiry = input.expiresAt > previousExpiry &&
+            previousExpiry <= input.renewIfExpiresAtOrBefore
+          ? input.expiresAt
+          : previousExpiry;
+        if (committedExpiry !== previousExpiry) {
+          this.#database.prepare("UPDATE drone_sessions SET expires_at = ? WHERE id = ?")
+            .run(committedExpiry, sessionId);
+        }
         this.#database.prepare("UPDATE drones SET last_seen = ? WHERE id = ?").run(now, droneId);
-        this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
         const attachedRoleRow = this.#database.prepare(`
           SELECT id AS role_id, name AS role_name, role_class, is_human_seat
           FROM roles WHERE id = ? AND cube_id = ?
@@ -1430,33 +1576,53 @@ class SqliteScopedStore implements ScopedStore {
             is_human_seat: requiredInteger(attachedRoleRow, "is_human_seat") === 1,
           },
           drone: { id: droneId, label: requiredText(bound, "label") },
-          sessionId: requiredText(bound, "session_id"),
-          expiresAt: requiredText(bound, "expires_at"),
+          sessionId,
+          expiresAt: committedExpiry,
           result: "reused",
         };
       }
 
       const priorSeat = input.priorDroneId === undefined ? undefined : this.#database.prepare(`
-        SELECT id, role_id, label FROM drones
-        WHERE id = ? AND client_id = ? AND cube_id = ? AND evicted_at IS NULL
+        SELECT id, role_id, label, evicted_at FROM drones
+        WHERE id = ? AND client_id = ? AND cube_id = ?
       `).get(input.priorDroneId, this.#principal.id, input.cubeId);
       let droneId: string;
       let droneLabel: string;
-      if (priorSeat !== undefined) {
+      if (input.priorDroneId !== undefined) {
+        if (priorSeat === undefined) throw new AttachSessionRejectedError();
+        if (optionalText(priorSeat, "evicted_at") !== null) throw new AttachDroneEvictedError();
         const priorSeatId = requiredText(priorSeat, "id");
         if (requiredText(priorSeat, "role_id") !== input.roleId) {
           throw new AttachSessionRejectedError();
         }
-        const occupied = this.#database.prepare(`
-          SELECT 1 FROM drone_sessions AS session
+        const latestSession = this.#database.prepare(`
+          SELECT session.id, session.expires_at, session.revoked_at AS session_revoked_at,
+                 MAX(CASE WHEN credential.revoked_at IS NOT NULL THEN 1 ELSE 0 END)
+                   AS credential_revoked
+          FROM drone_sessions AS session
           JOIN drone_session_credentials AS credential ON credential.session_id = session.id
           WHERE session.drone_id = ? AND session.client_id = ? AND session.cube_id = ?
-            AND session.revoked_at IS NULL AND credential.revoked_at IS NULL
-            AND session.expires_at > ?
-        `).get(priorSeatId, this.#principal.id, input.cubeId, now);
-        if (occupied !== undefined) throw new AttachSessionRejectedError();
+            AND session.superseded_at IS NULL
+          GROUP BY session.id
+          LIMIT 1
+        `).get(priorSeatId, this.#principal.id, input.cubeId);
+        if (latestSession === undefined) throw new AttachSessionRejectedError();
+        if (optionalText(latestSession, "session_revoked_at") !== null ||
+            requiredInteger(latestSession, "credential_revoked") === 1) {
+          throw new AttachSessionRevokedError();
+        }
+        if (requiredText(latestSession, "expires_at") > now) {
+          throw new AttachSessionRejectedError();
+        }
         droneId = priorSeatId;
         droneLabel = requiredText(priorSeat, "label");
+        const superseded = this.#database.prepare(`
+          UPDATE drone_sessions SET superseded_at = ?
+          WHERE id = ? AND superseded_at IS NULL
+        `).run(now, requiredText(latestSession, "id"));
+        if (Number(superseded.changes) !== 1) {
+          throw new Error("Expired session supersession was not atomic.");
+        }
         this.#database.prepare("UPDATE drones SET last_seen = ? WHERE id = ?").run(now, droneId);
       } else {
         droneId = input.droneId;
@@ -1468,8 +1634,6 @@ class SqliteScopedStore implements ScopedStore {
           droneId, input.cubeId, input.roleId, this.#principal.id, droneLabel, now, now,
         );
       }
-      this.#database.prepare("DELETE FROM silent_seat_ping_state WHERE drone_id = ?").run(droneId);
-
       this.#database.prepare(`
         INSERT INTO drone_sessions (
           id, client_id, cube_id, drone_id, created_at, expires_at
@@ -1990,6 +2154,59 @@ class SqliteMaintenanceStore implements MaintenanceStore {
     ).run(this.#now(), sessionId);
   }
 
+  expireDroneSession(sessionId: string): void {
+    assertCanonicalUuid(sessionId, "Drone session id");
+    this.#database.prepare("UPDATE drone_sessions SET expires_at = ? WHERE id = ?")
+      .run(new Date(0).toISOString(), sessionId);
+  }
+
+  inspectManagedDrone(droneId: string) {
+    assertCanonicalUuid(droneId, "Drone id");
+    const row = this.#database.prepare(`
+      SELECT drone.role_id, drone.evicted_at,
+             EXISTS(SELECT 1 FROM drone_sessions AS session
+                    WHERE session.drone_id = drone.id AND session.revoked_at IS NOT NULL) AS session_revoked
+      FROM drones AS drone WHERE drone.id = ?
+    `).get(droneId);
+    if (row === undefined) throw new ScopedStoreError();
+    return {
+      role_id: requiredText(row, "role_id"),
+      evicted: nullableText(row, "evicted_at") !== null,
+      session_revoked: requiredInteger(row, "session_revoked") === 1,
+    };
+  }
+
+  inspectCubeManagementState(cubeId: string) {
+    assertCanonicalUuid(cubeId, "Cube id");
+    const cube = this.#database.prepare(
+      "SELECT directive, message_taxonomy FROM cubes WHERE id = ?",
+    ).get(cubeId);
+    if (cube === undefined) throw new ScopedStoreError();
+    const taxonomy = nullableText(cube, "message_taxonomy");
+    const parsed = taxonomy === null ? null : JSON.parse(taxonomy) as Array<{ class?: unknown }>;
+    return {
+      directive: requiredText(cube, "directive"),
+      taxonomy_marker: typeof parsed?.[0]?.class === "string" ? parsed[0].class : null,
+      role_ids: this.#database.prepare(
+        "SELECT id FROM roles WHERE cube_id = ? ORDER BY id",
+      ).all(cubeId).map((row) => requiredText(row, "id")),
+      active_decision_ids: this.#database.prepare(`
+        SELECT id FROM decisions WHERE cube_id = ? AND status = 'active' ORDER BY id
+      `).all(cubeId).map((row) => requiredText(row, "id")),
+      drones: this.#database.prepare(`
+        SELECT drone.id, drone.role_id, drone.evicted_at,
+               EXISTS(SELECT 1 FROM drone_sessions AS session
+                      WHERE session.drone_id = drone.id AND session.revoked_at IS NOT NULL) AS session_revoked
+        FROM drones AS drone WHERE drone.cube_id = ? ORDER BY drone.id
+      `).all(cubeId).map((row) => ({
+        id: requiredText(row, "id"),
+        role_id: requiredText(row, "role_id"),
+        evicted: nullableText(row, "evicted_at") !== null,
+        session_revoked: requiredInteger(row, "session_revoked") === 1,
+      })),
+    };
+  }
+
   expireActivityCursor(cubeId: string, cursor: LogCursor): void {
     assertCanonicalUuid(cubeId, "Cube id");
     assertCanonicalUuid(cursor.id, "Activity cursor id");
@@ -2033,61 +2250,11 @@ class ActivityHub {
   }
 }
 
-class SqliteLivenessStore implements LivenessStore {
-  constructor(
-    readonly database: DatabaseSync,
-    readonly clock: () => Date,
-    readonly hub: ActivityHub,
-    readonly capacityGuard: StorageCapacityGuard,
-  ) {}
-
-  scan(options: { silentMs?: number; cooldownMs?: number; limit?: number } = {}): ActivityNotificationRecord[] {
-    const now = this.clock();
-    const silentBefore = new Date(now.getTime() - (options.silentMs ?? 600_000)).toISOString();
-    const cooldownBefore = new Date(now.getTime() - (options.cooldownMs ?? 600_000)).toISOString();
-    const limit = Math.max(1, Math.min(Math.trunc(options.limit ?? 25), 25));
-    const candidates = this.database.prepare(`
-      SELECT drone.id AS drone_id, drone.cube_id, COALESCE(state.attempts, 0) AS attempts
-      FROM drones AS drone
-      JOIN clients AS client ON client.id = drone.client_id AND client.revoked_at IS NULL
-      JOIN client_cube_grants AS grant_row ON grant_row.client_id = drone.client_id
-        AND grant_row.cube_id = drone.cube_id AND grant_row.access IN ('write', 'manage')
-      LEFT JOIN silent_seat_ping_state AS state ON state.drone_id = drone.id
-      WHERE drone.evicted_at IS NULL AND COALESCE(drone.last_seen, drone.created_at) < ?
-        AND COALESCE(state.attempts, 0) < 3
-        AND (state.last_ping_at IS NULL OR state.last_ping_at < ?)
-        AND EXISTS (SELECT 1 FROM drone_sessions AS session
-          WHERE session.drone_id = drone.id AND session.revoked_at IS NULL AND session.expires_at > ?)
-      ORDER BY COALESCE(drone.last_seen, drone.created_at), drone.id LIMIT ?
-    `).all(silentBefore, cooldownBefore, now.toISOString(), limit);
-    const published: ActivityNotificationRecord[] = [];
-    for (const candidate of candidates) {
-      const droneId = requiredText(candidate, "drone_id");
-      const cubeId = requiredText(candidate, "cube_id");
-      const message = "[HEARTBEAT-PING] No recent activity; confirm this seat is responsive.";
-      this.capacityGuard.assertCanGrow(256);
-      const id = randomUUID();
-      const createdAt = now.toISOString();
-      this.database.exec("BEGIN IMMEDIATE");
-      try {
-        this.database.prepare(`INSERT INTO silent_seat_ping_state (drone_id, attempts, last_ping_at)
-          VALUES (?, 1, ?) ON CONFLICT(drone_id) DO UPDATE
-          SET attempts = attempts + 1, last_ping_at = excluded.last_ping_at
-        `).run(droneId, now.toISOString());
-        this.database.exec("COMMIT");
-      } catch (error) {
-        try { this.database.exec("ROLLBACK"); } catch { /* Preserve original failure. */ }
-        throw error;
-      }
-      const entry: ActivityNotificationRecord = {
-        kind: "heartbeat_ping",
-        id, cube_id: cubeId, drone_id: null, message, visibility: "direct", created_at: createdAt,
-        drone_label: null, role_name: null, recipient_drone_ids: [droneId],
-      };
-      this.hub.publish(cubeId, entry);
-      published.push(entry);
-    }
-    return published;
+class IdleLivenessStore implements LivenessStore {
+  scan(): ActivityNotificationRecord[] {
+    // Silence is not a delivery failure. Keep the scheduler's lifecycle seam without
+    // creating a directed event that crosses the client/model wake boundary.
+    return [];
   }
 }
 
@@ -2416,7 +2583,7 @@ class SqliteCredentialStore implements CredentialStore {
              credential.session_id, session.client_id, session.cube_id, session.drone_id,
              session.expires_at,
              COALESCE(credential.revoked_at, session.revoked_at, client.revoked_at) AS revoked_at,
-             drone.evicted_at
+             drone.evicted_at, session.superseded_at
       FROM drone_session_credentials AS credential
       JOIN drone_sessions AS session ON session.id = credential.session_id
       JOIN clients AS client ON client.id = session.client_id
@@ -2894,6 +3061,7 @@ function storedDroneSessionDigest(row: Record<string, unknown>): StoredDroneSess
     droneId: requiredText(row, "drone_id"),
     expiresAt: requiredText(row, "expires_at"),
     evictedAt: nullableText(row, "evicted_at"),
+    takenOver: nullableText(row, "superseded_at") !== null,
   };
 }