chainlesschain 0.166.109 → 0.166.112

package/src/lib/evolution/agent-evolution-runtime-composition.js

@@ -22,6 +22,7 @@ import { EvolutionRunLedgerAdapter } from "./evolution-run-ledger-adapter.js";
 import { createEvolutionRunWikiEvidenceResolver } from "./evolution-run-wiki-evidence-resolver.js";
 import { WikiMaintainerLedgerAdapter } from "./wiki-maintainer-ledger-adapter.js";
 import { EvidenceBackedWikiMaintainer } from "./evidence-backed-wiki-maintainer.js";
+import { ensureDirectoryTreeDurable } from "./evolution-windows-directory-durability.js";
 import { createWikiEvidenceCommitGuard } from "./wiki-evidence-commit-guard.js";
 import { EvolutionWorkbenchMetricsLedgerAdapter } from "./evolution-workbench-metrics-ledger-adapter.js";
 import { EvolutionReleaseTrainLedgerAdapter } from "./evolution-release-train-ledger-adapter.js";
@@ -158,7 +159,7 @@ function normalizeClock(clock) {
   });
 }
 
-function layout(stateRootDir, tenantId, runId, initialize = true) {
+function layout(stateRootDir, tenantId, runId, initialize = true, fsImpl = fs) {
   if (typeof stateRootDir !== "string" || stateRootDir.trim() === "") {
     throw new TypeError("stateRootDir is required");
   }
@@ -176,11 +177,12 @@ function layout(stateRootDir, tenantId, runId, initialize = true) {
     ledgerAuthorityRootDir: path.join(scope, "ledger-authority"),
     witnessFilePath: path.join(scope, "witness", "checkpoint.json"),
   });
-  if (initialize)
-    fs.mkdirSync(path.dirname(result.witnessFilePath), {
-      recursive: true,
-      mode: 0o700,
-    });
+  if (initialize) {
+    ensureDirectoryTreeDurable(
+      fsImpl,
+      path.dirname(result.witnessFilePath),
+    );
+  }
   return result;
 }
 
@@ -408,7 +410,7 @@ export function createAgentEvolutionRuntimeComposition({
   capture(authorities.witness?.signer, "sign", "witness signer");
   capture(authorities.witness?.verifier, "verify", "witness verifier");
   assertIndependentSigningAuthorities(authorities.ledger, authorities.witness);
-  const storage = layout(stateRootDir, tenantId, runId);
+  const storage = layout(stateRootDir, tenantId, runId, true, fsImpl ?? fs);
   const artifactPorts = new EvolutionArtifactPorts({
     tenantId,
     audience,
@@ -712,6 +714,7 @@ export function createAgentEvolutionRuntimeComposition({
         tenantId,
         sourceRunId,
         false,
+        fsImpl ?? fs,
       );
       if (!fs.existsSync(sourceStorage.witnessFilePath))
         throw new Error("Cache source Run witness does not exist");

package/src/lib/evolution/evolution-deployment-config.js

@@ -103,6 +103,9 @@ function withDeploymentReadiness(status) {
   return Object.freeze({
     ...status,
     readiness: Object.freeze({
+      ui: assessEvolutionDeploymentReadiness(status, {
+        requiredCommands: ["ui"],
+      }),
       ask: assessEvolutionDeploymentReadiness(status, {
         requiredCommands: ["ask"],
       }),
@@ -197,6 +200,13 @@ export async function configureEvolutionDeployment(
     options,
   );
   updateEvolutionDeploymentProfile((current) => {
+    if (options.expectedProfileAbsent === true && current) {
+      const error = new Error(
+        "Evolution deployment profile was configured during local initialization",
+      );
+      error.code = "EVOLUTION_DEPLOYMENT_PROFILE_ALREADY_CONFIGURED";
+      throw error;
+    }
     if (
       current?.activeTrustRootDigest &&
       current.activeTrustRootDigest !== verified.descriptor.trustRootDigest
@@ -245,6 +255,11 @@ export async function configureEvolutionDeployment(
         verified.descriptor.revision,
       ),
     };
+    const preserveLocalMode =
+      deploymentMode === undefined &&
+      current?.deploymentMode === "local" &&
+      current.descriptorPath === verified.descriptorPath &&
+      current.trustRootPath === verified.trustRootPath;
     const preserveTestMode =
       deploymentMode === undefined &&
       current?.deploymentMode === "test" &&
@@ -257,10 +272,18 @@ export async function configureEvolutionDeployment(
       revisionFloors,
       activeTrustRootDigest: verified.descriptor.trustRootDigest,
       revokedDescriptorRevisions,
-      deploymentMode: preserveTestMode ? "test" : deploymentMode || "managed",
-      testPrivateKeyPath: preserveTestMode
-        ? current.testPrivateKeyPath
-        : testPrivateKeyPath || null,
+      deploymentMode:
+        preserveLocalMode
+          ? "local"
+          : preserveTestMode
+            ? "test"
+            : deploymentMode || "managed",
+      testPrivateKeyPath:
+        deploymentMode === "test"
+          ? testPrivateKeyPath || null
+          : preserveTestMode
+            ? current.testPrivateKeyPath
+            : null,
     };
   }, options);
   return getEvolutionDeploymentStatus(options);

package/src/lib/evolution/evolution-deployment-loader.js

@@ -1,6 +1,6 @@
 import { createHash, createPublicKey, verify } from "node:crypto";
 import { readFile, realpath } from "node:fs/promises";
-import { isAbsolute } from "node:path";
+import { dirname, isAbsolute, join } from "node:path";
 import { types as utilTypes } from "node:util";
 import {
   assertEvolutionDeploymentActiveTrustRoot,
@@ -840,6 +840,15 @@ function bindFactoriesToModule(factories, moduleDigest) {
       return factories[name](options);
     };
   }
+  if (typeof factories.createLocalUiEvolutionComposition === "function") {
+    result.createLocalUiEvolutionComposition = (options = {}) => {
+      if (options?.handlerArtifactDigest !== moduleDigest)
+        throw new Error(
+          "Local UI Evolution host digest must equal the authenticated deployment module digest",
+        );
+      return factories.createLocalUiEvolutionComposition(options);
+    };
+  }
   for (const name of [
     "createSkillEvaluatedPromotionProvider",
     "createSkillPromotionReviewProvider",
@@ -1012,19 +1021,32 @@ export async function loadEvolutionDeploymentCommandDependencies(
   commandName,
   {
     env = process.env,
+    cwd = process.cwd(),
     read = readFile,
     resolveRealPath = realpath,
     importModule = (url) => import(url),
     additionalFactories = {},
+    initializeDefaultLocalUi = false,
   } = {},
 ) {
   if (!SUPPORTED_COMMANDS.has(commandName)) return null;
   let descriptorPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_DESCRIPTOR;
   let trustRootPath = env.CHAINLESSCHAIN_EVOLUTION_DEPLOYMENT_TRUST_ROOT;
+  if (
+    initializeDefaultLocalUi === true &&
+    commandName === "ui" &&
+    !descriptorPath &&
+    !trustRootPath
+  ) {
+    const { initializeDefaultLocalUiEvolutionDeployment } = await import(
+      "./local-ui-evolution-deployment.js"
+    );
+    await initializeDefaultLocalUiEvolutionDeployment({ env, cwd });
+  }
   let fromSavedProfile = false;
   let saved = null;
   if (!descriptorPath && !trustRootPath) {
-    saved = await readEvolutionDeploymentProfile({ env });
+    saved = await readEvolutionDeploymentProfile({ env, cwd });
     if (saved.error) {
       return deniedAgentDependencies(
         commandName,
@@ -1086,6 +1108,23 @@ export async function loadEvolutionDeploymentCommandDependencies(
     throw error;
   }
   const { descriptor, moduleBytes } = verified;
+  const localProfile =
+    fromSavedProfile && saved.profile.deploymentMode === "local";
+  if (localProfile) {
+    const localHostPath = join(
+      dirname(saved.filePath),
+      "local-ui-host",
+      "ui-host.mjs",
+    );
+    const canonicalLocalHostPath = await realpath(localHostPath);
+    if (
+      descriptor.commands.length !== 1 ||
+      descriptor.commands[0] !== "ui" ||
+      verified.modulePath !== canonicalLocalHostPath
+    ) {
+      throw new Error("Local Evolution deployment is not the protected UI host");
+    }
+  }
   if (!descriptor.commands.includes(commandName)) {
     return deniedAgentDependencies(
       commandName,
@@ -1105,8 +1144,24 @@ export async function loadEvolutionDeploymentCommandDependencies(
     throw new Error(
       "evolution deployment module must export createChainlessChainCommandDependencies",
     );
+  const builtIn = await loadBuiltInFactories(commandName);
+  let localFactories = null;
+  if (localProfile) {
+    const { createLocalUiEvolutionComposition } = await import(
+      "./local-ui-evolution-runtime.js"
+    );
+    localFactories = {
+      createLocalUiEvolutionComposition: (options = {}) =>
+        createLocalUiEvolutionComposition({
+          ...options,
+          localDirectory: join(dirname(saved.filePath), "local-ui-host"),
+          env,
+          cwd,
+        }),
+    };
+  }
   const builtInFactories = bindFactoriesToModule(
-    await loadBuiltInFactories(commandName),
+    { ...builtIn, ...(localFactories || {}) },
     descriptor.moduleDigest,
   );
   if (

package/src/lib/evolution/evolution-deployment-profile.js

@@ -124,7 +124,7 @@ function normalizeProfile(value) {
   const deploymentMode = beforeDeploymentMode
     ? "managed"
     : value.deploymentMode;
-  if (!["managed", "test"].includes(deploymentMode))
+  if (!["managed", "test", "local"].includes(deploymentMode))
     throw new TypeError("evolution deployment profile mode is invalid");
   const testPrivateKeyPath = beforeDeploymentMode
     ? null
@@ -133,7 +133,7 @@ function normalizeProfile(value) {
     (deploymentMode === "test" &&
       (typeof testPrivateKeyPath !== "string" ||
         !isAbsolute(testPrivateKeyPath))) ||
-    (deploymentMode === "managed" && testPrivateKeyPath !== null)
+    (deploymentMode !== "test" && testPrivateKeyPath !== null)
   ) {
     throw new TypeError(
       "evolution deployment profile test private key path is invalid",

package/src/lib/evolution/evolution-evidence-projector.js

@@ -20,6 +20,7 @@ import {
   EVIDENCE_JSON_POLICY,
   isAgentToolArgumentsPath,
 } from "./evidence-json-text.js";
+import { formatLocalUiTenantReferenceId } from "./opaque-hex-id.js";
 
 export const EVOLUTION_SOURCE_VERIFICATION_SCHEMA =
   "chainlesschain.evolution-source-verification/v1";
@@ -89,6 +90,9 @@ const SOURCE_SCHEMES = new Set(["rollout", "tool", "outcome", "recording"]);
 const SOURCE_COMMITMENT_PURPOSE = "chainlesschain.evolution-source-payload/v1";
 const TRUSTED_PAYLOAD_COMMITMENT_PURPOSE =
   "chainlesschain.evolution-trusted-payload/v1";
+const LEGACY_LOCAL_UI_TENANT_ID_PATTERN = /^local-ui-[a-f0-9]{32}$/u;
+const FORMATTED_LOCAL_UI_TENANT_ID_PATTERN =
+  /^local-ui-(?:[a-f0-9]{8}-){3}[a-f0-9]{8}$/u;
 
 const INPUT_KEYS = new Set(["sourceEnvelope", "payload"]);
 const SOURCE_VERIFICATION_KEYS = new Set([
@@ -873,6 +877,17 @@ function normalizeId(value, label, maximum = 256) {
   return value;
 }
 
+function normalizeTenantId(value, label) {
+  if (
+    typeof value === "string" &&
+    (LEGACY_LOCAL_UI_TENANT_ID_PATTERN.test(value) ||
+      FORMATTED_LOCAL_UI_TENANT_ID_PATTERN.test(value))
+  ) {
+    return value;
+  }
+  return normalizeId(value, label);
+}
+
 function normalizeDigest(
   value,
   label,
@@ -970,7 +985,7 @@ function normalizeOpaqueUri(value, { label, schemes, tenantId }) {
     parsed.port ||
     parsed.search ||
     parsed.hash ||
-    parsed.hostname !== tenantId ||
+    parsed.hostname !== formatLocalUiTenantReferenceId(tenantId) ||
     !decodedPath.startsWith("/") ||
     decodedPath
       .split("/")
@@ -1635,7 +1650,7 @@ function validateSourceVerification(
       { failures },
     );
   }
-  const tenantId = normalizeId(value.tenantId, "source tenantId");
+  const tenantId = normalizeTenantId(value.tenantId, "source tenantId");
   const principalId = normalizeId(value.principalId, "source principalId");
   const sourceRef = normalizeOpaqueUri(value.sourceRef, {
     label: "sourceRef",
@@ -2737,7 +2752,7 @@ function validateRawMetadata(raw, receipt) {
   }
   const createdAtMs = new Date(createdAt).getTime();
   normalizeId(raw.evidenceId, "Raw evidenceId");
-  normalizeId(raw.tenantId, "Raw tenantId");
+  normalizeTenantId(raw.tenantId, "Raw tenantId");
   normalizeId(raw.principalId, "Raw principalId");
   normalizeOpaqueUri(raw.sourceRef, {
     label: "Raw sourceRef",

package/src/lib/evolution/evolution-file-witness.js

@@ -685,6 +685,16 @@ export function createEvolutionFileWitness({
   };
 
   const syncDirectory = (directoryPath = directory) => {
+    const directorySync = Object.getOwnPropertyDescriptor(
+      fsImpl,
+      "syncDirectorySync",
+    );
+    if (directorySync) {
+      if (typeof directorySync.value !== "function") {
+        throw new Error("syncDirectorySync must be a data function");
+      }
+      return Reflect.apply(directorySync.value, fsImpl, [directoryPath]);
+    }
     let descriptor;
     try {
       descriptor = fsImpl.openSync(directoryPath, "r");