engineering-memory 0.1.0

package/runtime/dist/src/auth/credential-store.js

@@ -0,0 +1,181 @@
+import { join, win32 } from 'node:path';
+import { atomicWrite, ensureWithinRoot, isNodeError, readJson, removeFile, } from '../utilities/files.js';
+import { sha256 } from '../utilities/hash.js';
+import { NativeCommandRunner } from '../utilities/process.js';
+class CommandCredentialStore {
+    service;
+    account;
+    runner;
+    constructor(service, account, runner) {
+        this.service = service;
+        this.account = account;
+        this.runner = runner ?? new NativeCommandRunner();
+    }
+    async clear() {
+        await Promise.all([
+            this.delete('access-token'),
+            this.delete('refresh-token'),
+            this.delete('browser-session'),
+        ]);
+    }
+    credentialAccount(name) {
+        return `${this.account}:${name}`;
+    }
+}
+export class WindowsDpapiCredentialStore extends CommandCredentialStore {
+    credentialRoot;
+    powerShellPath;
+    constructor(options) {
+        super(options.service, options.account, options.runner);
+        const windowsDirectory = options.windowsDirectory ?? process.env.SystemRoot ?? process.env.WINDIR;
+        if (!windowsDirectory || !win32.isAbsolute(windowsDirectory)) {
+            throw new Error('A trusted absolute Windows system directory is required');
+        }
+        this.powerShellPath = win32.join(windowsDirectory, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+        const credentialNamespace = sha256(`${options.service}\0${options.account}`);
+        this.credentialRoot = ensureWithinRoot(options.stateRoot, join(options.stateRoot, 'credentials', credentialNamespace));
+    }
+    async get(name) {
+        const path = this.credentialPath(name);
+        const stored = await readJson(path, this.credentialRoot);
+        if (!stored) {
+            return null;
+        }
+        const script = [
+            "$ErrorActionPreference='Stop'",
+            "Add-Type -AssemblyName 'System.Security'",
+            '$value=[Console]::In.ReadToEnd()',
+            '$bytes=[Convert]::FromBase64String($value)',
+            '$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($bytes,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
+            '[Console]::Out.Write([Text.Encoding]::UTF8.GetString($plain))',
+        ].join(';');
+        const result = await this.runner.run(this.powerShellPath, ['-NoProfile', '-NonInteractive', '-Command', script], { input: stored.protectedValue });
+        if (result.exitCode !== 0) {
+            throw new Error(`Windows credential lookup failed: ${result.stderr.trim()}`);
+        }
+        return result.stdout;
+    }
+    async set(name, value) {
+        const script = [
+            "$ErrorActionPreference='Stop'",
+            "Add-Type -AssemblyName 'System.Security'",
+            '$value=[Console]::In.ReadToEnd()',
+            '$bytes=[Text.Encoding]::UTF8.GetBytes($value)',
+            '$protected=[System.Security.Cryptography.ProtectedData]::Protect($bytes,$null,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)',
+            '[Console]::Out.Write([Convert]::ToBase64String($protected))',
+        ].join(';');
+        const result = await this.runner.run(this.powerShellPath, ['-NoProfile', '-NonInteractive', '-Command', script], { input: value });
+        if (result.exitCode !== 0 || !result.stdout) {
+            throw new Error(`Windows credential storage failed: ${result.stderr.trim()}`);
+        }
+        await atomicWrite(this.credentialPath(name), `${JSON.stringify({ protectedValue: result.stdout.trim() })}\n`, this.credentialRoot);
+    }
+    async delete(name) {
+        try {
+            await removeFile(this.credentialPath(name), this.credentialRoot);
+        }
+        catch (error) {
+            if (!isNodeError(error) || error.code !== 'ENOENT') {
+                throw error;
+            }
+        }
+    }
+    credentialPath(name) {
+        return ensureWithinRoot(this.credentialRoot, join(this.credentialRoot, `${name}.json`));
+    }
+}
+export class MacOsKeychainCredentialStore extends CommandCredentialStore {
+    async get(name) {
+        const result = await this.runner.run('/usr/bin/security', [
+            'find-generic-password',
+            '-s',
+            this.service,
+            '-a',
+            this.credentialAccount(name),
+            '-w',
+        ]);
+        if (result.exitCode === 44) {
+            return null;
+        }
+        if (result.exitCode !== 0) {
+            throw new Error(`macOS credential lookup failed: ${result.stderr.trim()}`);
+        }
+        return result.stdout.replace(/\r?\n$/, '');
+    }
+    async set(name, value) {
+        const script = 'IFS= read -r secret; exec /usr/bin/security add-generic-password -U -s "$1" -a "$2" -w "$secret"';
+        const result = await this.runner.run('/bin/sh', ['-c', script, 'credential-store', this.service, this.credentialAccount(name)], { input: `${value}\n` });
+        if (result.exitCode !== 0) {
+            throw new Error(`macOS credential storage failed: ${result.stderr.trim()}`);
+        }
+    }
+    async delete(name) {
+        const result = await this.runner.run('/usr/bin/security', [
+            'delete-generic-password',
+            '-s',
+            this.service,
+            '-a',
+            this.credentialAccount(name),
+        ]);
+        if (result.exitCode !== 0 && result.exitCode !== 44) {
+            throw new Error(`macOS credential deletion failed: ${result.stderr.trim()}`);
+        }
+    }
+}
+export class LinuxSecretToolCredentialStore extends CommandCredentialStore {
+    async get(name) {
+        const result = await this.runner.run('secret-tool', [
+            'lookup',
+            'service',
+            this.service,
+            'account',
+            this.credentialAccount(name),
+        ]);
+        if (result.exitCode === 1) {
+            return null;
+        }
+        if (result.exitCode !== 0) {
+            throw new Error(`Linux credential lookup failed: ${result.stderr.trim()}`);
+        }
+        return result.stdout.replace(/\r?\n$/, '');
+    }
+    async set(name, value) {
+        const result = await this.runner.run('secret-tool', [
+            'store',
+            '--label',
+            this.service,
+            'service',
+            this.service,
+            'account',
+            this.credentialAccount(name),
+        ], { input: value });
+        if (result.exitCode !== 0) {
+            throw new Error(`Linux credential storage failed: ${result.stderr.trim()}`);
+        }
+    }
+    async delete(name) {
+        const result = await this.runner.run('secret-tool', [
+            'clear',
+            'service',
+            this.service,
+            'account',
+            this.credentialAccount(name),
+        ]);
+        if (result.exitCode !== 0 && result.exitCode !== 1) {
+            throw new Error(`Linux credential deletion failed: ${result.stderr.trim()}`);
+        }
+    }
+}
+export function createCredentialStore(options, platform = process.platform) {
+    if (platform === 'win32') {
+        return new WindowsDpapiCredentialStore(options);
+    }
+    if (platform === 'darwin') {
+        return new MacOsKeychainCredentialStore(options.service, options.account, options.runner);
+    }
+    if (platform === 'linux') {
+        return new LinuxSecretToolCredentialStore(options.service, options.account, options.runner);
+    }
+    throw new Error(`Credential storage is not supported on ${platform}`);
+}
+//# sourceMappingURL=credential-store.js.map

package/runtime/dist/src/cache/etag-cache.js

@@ -0,0 +1,123 @@
+import { join } from 'node:path';
+import { readJson, writeJson } from '../utilities/files.js';
+import { stableStringify } from '../utilities/hash.js';
+import { redactForCache } from '../runtime/offline-outbox.js';
+export class EtagCache {
+    options;
+    path;
+    entries = new Map();
+    loaded = false;
+    clock;
+    queue = Promise.resolve();
+    constructor(options) {
+        this.options = options;
+        this.path = join(options.stateRoot, 'cache', 'etag-cache.json');
+        this.clock = options.clock ?? (() => new Date());
+    }
+    async get(key) {
+        return await this.exclusive(async () => {
+            await this.load();
+            const entry = this.entries.get(key);
+            if (!entry) {
+                return null;
+            }
+            if (this.clock().getTime() - Date.parse(entry.storedAt) > this.options.maxAgeMs) {
+                this.entries.delete(key);
+                await this.persist();
+                return null;
+            }
+            entry.lastAccessedAt = this.clock().toISOString();
+            this.entries.delete(key);
+            this.entries.set(key, entry);
+            await this.persist();
+            return entry;
+        });
+    }
+    async set(key, etag, value) {
+        await this.exclusive(async () => {
+            await this.load();
+            const persistedValue = redactForCache(JSON.parse(JSON.stringify(value)));
+            const now = this.clock().toISOString();
+            const bytes = persistedValue ? Buffer.byteLength(stableStringify(persistedValue), 'utf8') : 0;
+            if (!persistedValue || bytes > this.options.maxBytes) {
+                this.entries.delete(key);
+                await this.persist();
+                return;
+            }
+            this.entries.delete(key);
+            this.entries.set(key, {
+                key,
+                etag,
+                value: persistedValue,
+                storedAt: now,
+                lastAccessedAt: now,
+                bytes,
+            });
+            this.prune();
+            await this.persist();
+        });
+    }
+    async delete(key) {
+        await this.exclusive(async () => {
+            await this.load();
+            this.entries.delete(key);
+            await this.persist();
+        });
+    }
+    async clear() {
+        await this.exclusive(async () => {
+            await this.load();
+            this.entries.clear();
+            await this.persist();
+        });
+    }
+    async load() {
+        if (this.loaded) {
+            return;
+        }
+        const file = await readJson(this.path, this.options.stateRoot);
+        for (const entry of file?.entries ?? []) {
+            const safeValue = redactForCache(JSON.parse(JSON.stringify(entry.value)));
+            if (safeValue) {
+                this.entries.set(entry.key, { ...entry, value: safeValue });
+            }
+        }
+        this.loaded = true;
+        this.prune();
+    }
+    prune() {
+        while (this.entries.size > this.options.maxEntries ||
+            this.totalBytes() > this.options.maxBytes) {
+            const oldestKey = this.entries.keys().next().value;
+            if (!oldestKey) {
+                return;
+            }
+            this.entries.delete(oldestKey);
+        }
+    }
+    totalBytes() {
+        return [...this.entries.values()].reduce((total, entry) => total + entry.bytes, 0);
+    }
+    async persist() {
+        await writeJson(this.path, {
+            schemaVersion: 1,
+            entries: [...this.entries.values()],
+        }, this.options.stateRoot);
+    }
+    async exclusive(action) {
+        const previous = this.queue;
+        let release = () => undefined;
+        const current = new Promise((resolvePromise) => {
+            release = resolvePromise;
+        });
+        this.queue = previous.then(() => current);
+        await previous;
+        try {
+            return await action();
+        }
+        finally {
+            release();
+        }
+    }
+}
+//# sourceMappingURL=etag-cache.js.map

package/runtime/dist/src/config.js

@@ -0,0 +1,59 @@
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { sha256 } from './utilities/hash.js';
+function positiveInteger(value, fallback) {
+    const parsed = Number(value);
+    return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+export function loadBridgeConfig(env = process.env) {
+    return {
+        apiBaseUrl: (env.ENGINEERING_MEMORY_API_URL ?? 'http://127.0.0.1:3000').replace(/\/$/, ''),
+        stateRoot: resolve(env.ENGINEERING_MEMORY_STATE_DIR ?? join(homedir(), '.engineering-memory')),
+        requestTimeoutMs: positiveInteger(env.ENGINEERING_MEMORY_TIMEOUT_MS, 15_000),
+        cacheMaxEntries: positiveInteger(env.ENGINEERING_MEMORY_CACHE_MAX_ENTRIES, 64),
+        cacheMaxBytes: positiveInteger(env.ENGINEERING_MEMORY_CACHE_MAX_BYTES, 5 * 1024 * 1024),
+        cacheMaxAgeMs: positiveInteger(env.ENGINEERING_MEMORY_CACHE_MAX_AGE_MS, 24 * 60 * 60 * 1000),
+        markerSchemaVersion: positiveInteger(env.ENGINEERING_MEMORY_MARKER_SCHEMA_VERSION, 1),
+        credentialService: env.ENGINEERING_MEMORY_CREDENTIAL_SERVICE ?? 'engineering-memory',
+        credentialAccount: env.ENGINEERING_MEMORY_CREDENTIAL_ACCOUNT ?? 'default',
+    };
+}
+export function apiNamespaceKey(apiBaseUrl) {
+    return sha256(new URL(apiBaseUrl).toString().replace(/\/$/, ''));
+}
+export function apiStateRoot(config) {
+    return join(config.stateRoot, 'origins', apiNamespaceKey(config.apiBaseUrl));
+}
+export const endpoints = {
+    authRefresh: '/auth/refresh',
+    authLogout: '/auth/logout',
+    authBrowserStart: '/auth/browser/start',
+    authBrowserExchange: '/auth/browser/exchange',
+    sessionBootstrap: '/runtime/session/bootstrap',
+    sessionResume: '/runtime/session/resume',
+    contextPrepareChange: '/runtime/context/prepare-change',
+    contextRefresh: '/runtime/context/refresh',
+    memoryQuery: '/memory/query',
+    memoryHistory: '/memory/history',
+    memoryScaffoldPlan: '/memory/scaffold-plan',
+    memoryArchitectureModule: '/memory/architecture-module',
+    memoryProposeRevision: '/memory/proposals',
+    memoryListProposals: '/memory/proposals/pending',
+    memoryReviewProposal: (proposalId) => `/memory/proposals/${proposalId}/review`,
+    taskCheckpoint: '/tasks/checkpoint',
+    taskCorrection: '/tasks/record-correction',
+    taskReconcile: '/tasks/reconcile',
+    taskSelfReview: '/tasks/self-review',
+    taskScaffoldApplication: '/tasks/scaffold-application',
+    organizationList: '/organizations',
+    organizationCreate: '/organizations',
+    taskVerify: '/runtime/task/verify',
+    taskClose: '/runtime/task/close',
+    taskCommitGate: '/runtime/task/commit-gate',
+    projectSetup: '/projects/setup',
+    projectList: '/projects',
+    projectResolve: '/projects/resolve',
+    projectBind: (projectId) => `/projects/${projectId}/bind`,
+    projectMemberAdd: (projectId) => `/projects/${projectId}/members`,
+};
+//# sourceMappingURL=config.js.map