fraim-hub 2.0.345 → 2.0.348

package/dist/registry/scripts/learning/owner-identity.js

@@ -0,0 +1,148 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ownerArtifactRoot = void 0;
+exports.ownerPath = ownerPath;
+exports.validateOwner = validateOwner;
+exports.ownerKey = ownerKey;
+exports.assertSameOwner = assertSameOwner;
+exports.assertLearningTargetPath = assertLearningTargetPath;
+exports.resolveOwnerHome = resolveOwnerHome;
+exports.ownerArtifactPath = ownerArtifactPath;
+exports.configuredArtifactPath = configuredArtifactPath;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/** A recorded home path is immutable; moving storage requires a newly reviewed run. */
+function ownerPath(root) {
+    const absolute = node_path_1.default.resolve(root).replace(/\\/g, '/');
+    return process.platform === 'win32' ? absolute.toLowerCase() : absolute;
+}
+function validateOwner(owner) {
+    if (!owner || !['Project', 'Manager', 'Org'].includes(owner.level)
+        || Object.keys(owner).some(key => !['level', 'path'].includes(key))
+        || typeof owner.path !== 'string' || !node_path_1.default.isAbsolute(owner.path)
+        || /[\x00-\x1f]/.test(owner.path) || owner.path !== ownerPath(owner.path)) {
+        throw new Error('owner-unresolved: a canonical absolute home path is required');
+    }
+}
+function ownerKey(owner) {
+    validateOwner(owner);
+    return JSON.stringify([owner.level, owner.path]);
+}
+function assertSameOwner(expected, actual) {
+    if (ownerKey(expected) !== ownerKey(actual))
+        throw new Error('owner-path-conflict: the approved home differs from the configured path');
+}
+/** Shared authored-family identity check. Handwritten entries can omit Domain metadata. */
+function assertLearningTargetPath(ref, domain) {
+    const subject = ref.owner.level === 'Org' ? 'org' : ref.learningSubject;
+    if (!subject || !/^[a-zA-Z0-9@._+-]+$/.test(subject))
+        throw new Error('learning-subject-required');
+    const escaped = subject.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const match = ref.relativePath.match(new RegExp(`^learnings/${escaped}-((?:[a-z][a-z-]*-)?)(preferences|mistake-patterns|validated-patterns|manager-coaching)(\\.cold)?\\.md$`));
+    if (!match || (domain !== undefined && match[1] !== (domain === 'global' ? '' : domain + '-')))
+        throw new Error('domain-target-mismatch: learning subject, domain and family must match its file');
+}
+/** Pure read: resolve existing configured homes without migration or identity configuration. */
+function resolveOwnerHome(projectPath, level, options) {
+    const load = (relative) => options.runtimeModule(projectPath, relative);
+    const paths = load('core/utils/project-fraim-paths');
+    let home;
+    if (level === 'Project') {
+        const root = paths.getWorkspaceFraimPath(projectPath);
+        home = { root, artifactRoot: node_path_1.default.resolve(projectPath), contentRoot: node_path_1.default.join(root, 'personalized-employee'), requiresPublish: false, backend: 'project' };
+    }
+    else {
+        if (!['Manager', 'Org'].includes(level))
+            throw new Error('owner-unresolved: invalid owner level');
+        const configFile = node_path_1.default.join(paths.getUserFraimDirPath(), 'config.json');
+        let config;
+        try {
+            config = node_fs_1.default.existsSync(configFile) ? JSON.parse(node_fs_1.default.readFileSync(configFile, 'utf8')) : {};
+        }
+        catch {
+            throw new Error('home-unavailable: user configuration is invalid');
+        }
+        if (!config || typeof config !== 'object' || Array.isArray(config))
+            throw new Error('home-unavailable: user configuration is invalid');
+        const raw = level === 'Manager' ? config.managerStorage : config.organization;
+        if (raw !== undefined && (!raw || typeof raw !== 'object' || Array.isArray(raw)
+            || !['git', 'local-folder', 'fraim-cloud', 'single-machine'].includes(raw.backend)
+            || (raw.backend === 'git' && (typeof raw.gitUrl !== 'string' || !raw.gitUrl.trim()))
+            || (raw.backend === 'local-folder' && (typeof raw.localPath !== 'string' || !raw.localPath.trim())))) {
+            throw new Error('home-unavailable: invalid configured storage home');
+        }
+        const resolved = load('cli/utils/pack-home').resolvePackHome(level === 'Manager' ? 'manager' : 'org', { migrateLegacy: false });
+        home = { root: resolved.root, contentRoot: resolved.contentRoot, requiresPublish: resolved.requiresPublish, backend: resolved.backend, ...(resolved.gitUrl ? { gitUrl: resolved.gitUrl } : {}) };
+    }
+    const owner = { level, path: ownerPath(home.root) };
+    if (options.expectedOwner)
+        assertSameOwner(options.expectedOwner, owner);
+    if (!node_fs_1.default.existsSync(home.root) || !node_fs_1.default.statSync(home.root).isDirectory()
+        || (home.backend === 'git' && !node_fs_1.default.existsSync(node_path_1.default.join(home.root, '.git')))) {
+        throw new Error('home-unavailable: configured home is not available locally');
+    }
+    return { ...home, level, owner };
+}
+/** Resolve a relative artifact without permitting lexical or realpath escapes, including junctions. */
+function ownerArtifactPath(home, relativePath) {
+    assertSameOwner(home.owner, { level: home.level, path: ownerPath(home.root) });
+    if (!relativePath || node_path_1.default.isAbsolute(relativePath) || relativePath.includes('\\')
+        || relativePath.includes(':') || relativePath.split('/').some(part => !part || part === '.' || part === '..')) {
+        throw new Error('invalid-artifact-path');
+    }
+    // Shared project capabilities live in the repository registry, outside its personalized pack.
+    const shared = home.level === 'Project' && relativePath.startsWith('registry/');
+    const containmentRoot = shared ? node_path_1.default.dirname(home.root) : home.root;
+    // The workspace configuration has one explicit reference; arbitrary parent paths stay forbidden.
+    const workspaceConfig = home.level === 'Project' && relativePath === 'config.json';
+    const contentRoot = shared ? containmentRoot : workspaceConfig ? home.root : home.contentRoot;
+    const target = node_path_1.default.resolve(contentRoot, relativePath);
+    const existingAncestor = (file) => {
+        let current = file;
+        while (!node_fs_1.default.existsSync(current)) {
+            const parent = node_path_1.default.dirname(current);
+            if (parent === current)
+                throw new Error('home-unavailable');
+            current = parent;
+        }
+        return current;
+    };
+    const realRoot = node_fs_1.default.realpathSync(containmentRoot);
+    const ancestor = node_fs_1.default.realpathSync(existingAncestor(target));
+    const relative = node_path_1.default.relative(realRoot, ancestor);
+    if (relative === '..' || relative.startsWith('..' + node_path_1.default.sep) || node_path_1.default.isAbsolute(relative))
+        throw new Error('invalid-artifact-path: escaped owner home');
+    // Also reject escaping a content root via a symlink to a sibling in the pack.
+    if (node_fs_1.default.existsSync(contentRoot)) {
+        const contentRelative = node_path_1.default.relative(node_fs_1.default.realpathSync(contentRoot), ancestor);
+        if (contentRelative === '..' || contentRelative.startsWith('..' + node_path_1.default.sep) || node_path_1.default.isAbsolute(contentRelative))
+            throw new Error('invalid-artifact-path: escaped content root');
+    }
+    return target;
+}
+/** Explicit artifact base; never infer a project from its personalized directory. */
+const ownerArtifactRoot = (home) => home.artifactRoot ?? home.root;
+exports.ownerArtifactRoot = ownerArtifactRoot;
+/** Configured artifacts may sit outside the personalized pack, but never outside their owner. */
+function configuredArtifactPath(home, file) {
+    assertSameOwner(home.owner, { level: home.level, path: ownerPath(home.root) });
+    const root = node_path_1.default.resolve((0, exports.ownerArtifactRoot)(home));
+    const target = node_path_1.default.resolve(file);
+    const relative = node_path_1.default.relative(root, target);
+    if (!relative || relative === '..' || relative.startsWith('..' + node_path_1.default.sep) || node_path_1.default.isAbsolute(relative))
+        throw new Error('invalid-artifact-path: escaped owner home');
+    for (let current = target; ownerPath(current) !== ownerPath(root); current = node_path_1.default.dirname(current)) {
+        try {
+            if (node_fs_1.default.lstatSync(current).isSymbolicLink())
+                throw new Error('invalid-artifact-path: linked artifact');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    return target;
+}

package/dist/registry/scripts/learning/proposal-queue.js

@@ -0,0 +1,81 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashContent = void 0;
+exports.atomicWrite = atomicWrite;
+exports.withFileLock = withFileLock;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_crypto_1 = require("node:crypto");
+const node_os_1 = require("node:os");
+const hashContent = (text) => (0, node_crypto_1.createHash)('sha256').update(text).digest('hex');
+exports.hashContent = hashContent;
+function atomicWrite(file, text) {
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(file), { recursive: true });
+    const temporary = file + '.' + (0, node_crypto_1.randomUUID)() + '.tmp';
+    try {
+        node_fs_1.default.writeFileSync(temporary, text, { encoding: 'utf8', flag: 'wx' });
+        const fd = node_fs_1.default.openSync(temporary, 'r+');
+        try {
+            node_fs_1.default.fsyncSync(fd);
+        }
+        finally {
+            node_fs_1.default.closeSync(fd);
+        }
+        node_fs_1.default.renameSync(temporary, file);
+    }
+    finally {
+        if (node_fs_1.default.existsSync(temporary))
+            node_fs_1.default.unlinkSync(temporary);
+    }
+}
+function withFileLock(file, fn) {
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(file), { recursive: true });
+    let fd;
+    try {
+        fd = node_fs_1.default.openSync(file + '.lock', 'wx');
+    }
+    catch {
+        // Serialize recovery so two contenders cannot unlink each other's new lock.
+        let recovery;
+        try {
+            recovery = node_fs_1.default.openSync(file + '.lock.recovery', 'wx');
+        }
+        catch {
+            throw new Error('busy: lock recovery is already in progress');
+        }
+        try {
+            const owner = JSON.parse(node_fs_1.default.readFileSync(file + '.lock', 'utf8'));
+            let stale = false;
+            if (owner.host === (0, node_os_1.hostname)() && Number.isInteger(owner.pid) && owner.pid > 0) {
+                try {
+                    process.kill(owner.pid, 0);
+                }
+                catch (error) {
+                    stale = error.code === 'ESRCH';
+                }
+            }
+            if (!stale)
+                throw new Error('busy');
+            node_fs_1.default.unlinkSync(file + '.lock');
+            fd = node_fs_1.default.openSync(file + '.lock', 'wx');
+        }
+        catch {
+            throw new Error('busy: reconcile outstanding lock before retry');
+        }
+        finally {
+            node_fs_1.default.closeSync(recovery);
+            node_fs_1.default.unlinkSync(file + '.lock.recovery');
+        }
+    }
+    node_fs_1.default.writeFileSync(fd, JSON.stringify({ pid: process.pid, host: (0, node_os_1.hostname)(), at: new Date().toISOString() }));
+    try {
+        return fn();
+    }
+    finally {
+        node_fs_1.default.closeSync(fd);
+        node_fs_1.default.unlinkSync(file + '.lock');
+    }
+}

package/dist/src/ai-hub/hosts.js

@@ -31,6 +31,7 @@ exports.buildDirectStartPlan = buildDirectStartPlan;
 exports.buildDirectContinuePlan = buildDirectContinuePlan;
 exports.parseHostLine = parseHostLine;
 exports.detectCodexCompactTaskFailure = detectCodexCompactTaskFailure;
+exports.wireHostProcess = wireHostProcess;
 exports.describeSpawnError = describeSpawnError;
 exports.hostDefaultUnsetEnv = hostDefaultUnsetEnv;
 exports.buildHostSpawnEnv = buildHostSpawnEnv;
@@ -2398,6 +2399,32 @@ function detectCodexCompactTaskFailure(line) {
     return null;
 }
 function wireHostProcess(hostId, child, handlers, spawnCwd) {
+    // Exec's JSON error has no auth code. Require independent provider stderr
+    // provenance AND the same terminal protocol error; never scan tool/prose text.
+    const codexRefreshFailure = 'Your access token could not be refreshed because your refresh token was already used. Please log out and sign in again.';
+    let codexAuthDiagnostic = false;
+    let codexTerminalAuthFailure = false;
+    const observeCodexAuth = (line, channel) => {
+        if (hostId !== 'codex')
+            return;
+        if (channel === 'stderr') {
+            const clean = line.replace(/\x1b\[[0-9;]*m/g, '').trim();
+            const diagnostic = clean.match(/^(?:\d{4}-\d{2}-\d{2}T[\d:.]+Z\s+)?ERROR\s+codex_login::auth::manager:\s+Failed to refresh token: (.+)$/);
+            if (diagnostic?.[1] === codexRefreshFailure)
+                codexAuthDiagnostic = true;
+            return;
+        }
+        try {
+            const event = JSON.parse(line);
+            if (event.type === 'turn.failed' || event.type === 'error') {
+                codexTerminalAuthFailure = (event.type === 'turn.failed' ? event.error?.message : event.message) === codexRefreshFailure;
+            }
+            else if (event.type === 'turn.started' || event.type === 'turn.completed') {
+                codexTerminalAuthFailure = false;
+            }
+        }
+        catch { /* Plain stdout cannot establish authentication failure. */ }
+    };
     const wire = (buffer, channel) => {
         let pending = '';
         let suppressCodexModelRefreshStderr = false;
@@ -2406,6 +2433,7 @@ function wireHostProcess(hostId, child, handlers, spawnCwd) {
             const lines = pending.split(/\r?\n/);
             pending = lines.pop() || '';
             for (const line of lines) {
+                observeCodexAuth(line, channel);
                 if (hostId === 'codex' && channel === 'stderr') {
                     if (line.includes('codex_models_manager::manager: failed to refresh available models:')) {
                         suppressCodexModelRefreshStderr = true;
@@ -2431,6 +2459,7 @@ function wireHostProcess(hostId, child, handlers, spawnCwd) {
         });
         buffer.on('end', () => {
             if (pending.trim().length > 0) {
+                observeCodexAuth(pending, channel);
                 const parsed = parseHostLine(hostId, pending);
                 if (parsed.message || parsed.sessionId || parsed.raw) {
                     handlers.onEvent(parsed, channel);
@@ -2444,7 +2473,12 @@ function wireHostProcess(hostId, child, handlers, spawnCwd) {
     // signal='SIGSEGV') are NOT treated as clean exits by classifyExit's
     // `exitCode ?? 0` guard. Pass -1 for any signal-terminated child so the
     // non-zero branch fires and recovery is attempted.
-    child.on('close', (code, signal) => handlers.onExit(signal ? -1 : code));
+    child.on('close', (code, signal) => {
+        if (!signal && code !== null && code !== 0 && codexAuthDiagnostic && codexTerminalAuthFailure) {
+            handlers.onEvent({ hostAuthenticationRequired: true, hostError: codexRefreshFailure, raw: codexRefreshFailure }, 'system');
+        }
+        handlers.onExit(signal ? -1 : code);
+    });
     // Issue #1327: without this listener, an OS-level spawn failure (EAGAIN,
     // ENOENT, EACCES) fires an 'error' event on the ChildProcess. An unhandled
     // EventEmitter 'error' throws synchronously and crashes the Hub process.

package/dist/src/ai-hub/hub-app-materializer.js

@@ -10,6 +10,7 @@ exports.resolveHubAppCacheDir = resolveHubAppCacheDir;
 exports.isHubAppCacheComplete = isHubAppCacheComplete;
 exports.listCachedHubAppVersions = listCachedHubAppVersions;
 exports.runNpmInstall = runNpmInstall;
+exports.pruneHubAppCache = pruneHubAppCache;
 exports.ensureMaterializedHubApp = ensureMaterializedHubApp;
 exports.resolveHubAppEntry = resolveHubAppEntry;
 const fs_1 = __importDefault(require("fs"));
@@ -209,6 +210,24 @@ const defaultInstallPackage = async (version, destDir) => {
     }
     fs_1.default.rmSync(installedRoot, { recursive: true, force: true });
 };
+const HUB_APP_CACHE_MAX_VERSIONS = 3;
+/** Prune the hub-app cache to at most HUB_APP_CACHE_MAX_VERSIONS entries, always preserving keepVersion. Non-fatal. */
+function pruneHubAppCache(fraimDir, keepVersion) {
+    try {
+        const all = listCachedHubAppVersions(fraimDir);
+        const sorted = all.map((e) => e.version).sort((a, b) => (semver_1.default.gt(a, b) ? -1 : 1));
+        const toKeep = new Set(sorted.slice(0, HUB_APP_CACHE_MAX_VERSIONS));
+        toKeep.add(keepVersion);
+        for (const v of sorted) {
+            if (!toKeep.has(v)) {
+                fs_1.default.rmSync(resolveHubAppCacheDir(v, fraimDir), { recursive: true, force: true });
+            }
+        }
+    }
+    catch {
+        // Prune failure must never break a launch.
+    }
+}
 /**
  * Return the entry path for `version`, materializing it first if it is not already a complete
  * cache entry. Returns immediately (no npm invocation) when a complete entry already exists.
@@ -248,6 +267,7 @@ async function ensureMaterializedHubApp(version, options = {}) {
     finally {
         fs_1.default.rmSync(stagingDir, { recursive: true, force: true });
     }
+    pruneHubAppCache(fraimDir, version);
     return entryPath;
 }
 /**

package/dist/src/ai-hub/server.js

@@ -2596,7 +2596,9 @@ function summarizeHostErrorForThread(error) {
 // noise that the system handled on its own.
 function pushTerminalFailureToThread(run, exitCode) {
     if (exitCode !== 0 && run.lastHostError) {
-        run.messages.push((0, hosts_1.createHubMessage)('system', `This run stopped: ${summarizeHostErrorForThread(run.lastHostError)}`));
+        const detail = detectLoginFailureSignature(run, exitCode)
+            ? run.lastHostError : summarizeHostErrorForThread(run.lastHostError);
+        run.messages.push((0, hosts_1.createHubMessage)('system', `This run stopped: ${detail}`));
     }
 }
 function createHubRecoveryEvent(run, exitCode, attempt) {
@@ -3017,6 +3019,7 @@ class AiHubServer {
         this.latestVersionPollTimer = null;
         this.catalogSyncChild = null;
         this.attachmentPolicy = (0, attachment_store_1.attachmentPolicy)();
+        this.configureAgentSurface = options.configureAgentSurface ?? configureFraimForHubAgent;
         this.openTerminal = options.openTerminal ?? hubOpenTerminal;
         this.preferencesStore = options.preferencesStore || new preferences_1.AiHubPreferencesStore();
         const launchResolution = options.projectPath
@@ -4254,7 +4257,10 @@ class AiHubServer {
                 const option = hubAgentOption(run.hostId);
                 run.status = 'failed';
                 run.pauseReason = 'awaiting_user';
-                run.loginRequired = option ? { agentLabel: option.label } : undefined;
+                run.loginRequired = option ? {
+                    agentLabel: option.label,
+                    ...(run.hostId === 'codex' && run.lastHostError ? { remediation: run.lastHostError } : {}),
+                } : undefined;
             }
             if (run.status !== 'running') {
                 run.eventLogRefs = (run.eventLogRefs || []).map((ref) => {
@@ -5856,6 +5862,7 @@ class AiHubServer {
             }
             try {
                 const result = (0, learning_context_builder_1.applyLearningEntryChange)(resolveProjectPath(req), userEmail, ref, b.action, {
+                    originalId: b.originalId,
                     originalTitle: b.originalTitle,
                     severity: b.severity,
                     title: b.title,
@@ -7012,7 +7019,7 @@ class AiHubServer {
                 return res.json({ ok: true, configured: [], message: 'No ready CLI agents to configure.' });
             }
             const results = await Promise.all(readyIds.map(async (hubId) => {
-                const result = await configureFraimForHubAgent(hubId);
+                const result = await this.configureAgentSurface(hubId);
                 return { hubId, ...result };
             }));
             const failed = results.filter((r) => !r.configured);