hoi4-agent-tools 4.0.5 → 4.2.0

package/dist/hoi4_agent_tools/core/job-worker-host.js

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 import { closeSync, fstatSync, openSync, readSync, readdirSync, rmSync, statSync } from 'node:fs';
-import { mkdir } from 'node:fs/promises';
+import { mkdir, stat } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { setTimeout as delay } from 'node:timers/promises';
@@ -134,6 +134,16 @@ function retainOrRemoveLog(file, evidence, logRoot) {
  * Bounded, fixed-entry child execution. Client disconnection never kills a worker; an
  * overdue or unresponsive cancelled read-only worker is stopped by its supervising host.
  */
+/**
+ * Select the workspaces a job worker resolves again. A mod folder removed after the host
+ * discovered it must not stop jobs for every other workspace, so absent roots are left out.
+ * The job's own workspace is always kept, and a missing root still fails that job explicitly.
+ */
+export async function workerWorkspaces(workspaces, workspaceId) {
+    const retained = await Promise.all(workspaces.map(async (workspace) => workspace.id === workspaceId ||
+        (await stat(workspace.modRoot).then((metadata) => metadata.isDirectory(), () => false))));
+    return workspaces.filter((_workspace, index) => retained[index]);
+}
 export class JobWorkerHost {
     engine;
     jobs;
@@ -234,7 +244,7 @@ export class JobWorkerHost {
             return;
         const configuration = this.engine.resolver.config();
         const registeredWorkspaceIds = new Set(configuration.workspaces.map((workspace) => workspace.id));
-        const resolvedWorkspaces = this.engine.resolver.list();
+        const resolvedWorkspaces = await workerWorkspaces(this.engine.resolver.list(), workspaceId);
         const discoveredWorkspaceIds = resolvedWorkspaces
             .map((workspace) => workspace.id)
             .filter((workspaceId) => !registeredWorkspaceIds.has(workspaceId));

package/dist/hoi4_agent_tools/core/managed-outputs.js

@@ -0,0 +1,72 @@
+import { z } from 'zod';
+import { canonicalJson, compareCodeUnits, sha256Bytes } from './canonical.js';
+import { ServiceError } from './result.js';
+const manifestSchema = z
+    .object({
+    version: z.literal(1),
+    files: z
+        .array(z
+        .object({
+        relativePath: z.string().min(1).max(512),
+        sha256: z.string().regex(/^[a-f0-9]{64}$/u),
+    })
+        .strict())
+        .max(5000),
+})
+    .strict();
+/** Pure planning only: the shared transaction engine performs every replacement and deletion. */
+export function reconcileManagedOutputs(input) {
+    const sources = new Map(input.sources
+        .filter((f) => f.rootKind === 'mod')
+        .map((f) => [f.relativePath.replaceAll('\\', '/').toLowerCase(), f]));
+    const manifest = sources.get(input.manifestPath.toLowerCase());
+    const previous = manifest === undefined
+        ? []
+        : (() => {
+            if (manifest.bytes.length > 2_000_000)
+                throw new ServiceError('MANAGED_OUTPUT_MANIFEST_INVALID', 'Generated-output inventory exceeds its byte limit');
+            try {
+                return manifestSchema.parse(JSON.parse(manifest.bytes.toString('utf8'))).files;
+            }
+            catch {
+                throw new ServiceError('MANAGED_OUTPUT_MANIFEST_INVALID', 'Generated-output inventory is invalid');
+            }
+        })();
+    const seen = new Set();
+    for (const file of previous) {
+        const key = file.relativePath.toLowerCase();
+        if (file.relativePath.includes('\\') ||
+            file.relativePath.split('/').some((s) => !s || s === '.' || s === '..') ||
+            /^[a-z]:/iu.test(file.relativePath) ||
+            !input.permitsPath(file.relativePath) ||
+            seen.has(key))
+            throw new ServiceError('MANAGED_OUTPUT_MANIFEST_INVALID', 'Generated-output inventory contains an unsupported or duplicate path');
+        seen.add(key);
+        const current = sources.get(key);
+        if (current !== undefined && sha256Bytes(current.bytes) !== file.sha256)
+            throw new ServiceError('MANAGED_OUTPUT_EDITED', 'A generated file has been edited; regeneration would discard those changes', { relativePath: file.relativePath });
+    }
+    const outputs = input.proposed.filter((f) => f.content !== null && input.permitsPath(f.relativePath));
+    const next = new Set(outputs.map((f) => f.relativePath.toLowerCase()));
+    const deletions = previous
+        .filter((f) => !next.has(f.relativePath.toLowerCase()) && sources.has(f.relativePath.toLowerCase()))
+        .map((f) => ({
+        relativePath: f.relativePath,
+        content: null,
+        operationIds: [input.operationId],
+    }));
+    return [
+        ...deletions,
+        {
+            relativePath: input.manifestPath,
+            content: Buffer.from(canonicalJson({
+                version: 1,
+                files: outputs
+                    .map((f) => ({ relativePath: f.relativePath, sha256: sha256Bytes(f.content) }))
+                    .sort((a, b) => compareCodeUnits(a.relativePath, b.relativePath)),
+            }) + '\n'),
+            operationIds: [input.operationId],
+            mediaType: 'application/json',
+        },
+    ];
+}

package/dist/hoi4_agent_tools/core/operation-result.js

@@ -500,10 +500,36 @@ export function errorResult(error, workspaceId = '', context = {}) {
         ? `REWRITE_${serviceError.code.slice('TRANSACTION_'.length)}`
         : serviceError.code;
     const publicMessage = internalWriteError
-        ? 'Rewrite could not be completed'
+        ? serviceError.code === 'TRANSACTION_STRUCTURE_LIMIT'
+            ? 'Rewrite exceeds the supported file, operation, validation, or evidence limits'
+            : serviceError.code === 'TRANSACTION_JOURNAL_LIMIT'
+                ? 'The requested rewrite exceeds the bounded rollback storage allowance'
+                : 'Rewrite could not be completed'
         : serviceError.message;
     const publicDetails = internalWriteError
-        ? {}
+        ? ['TRANSACTION_STRUCTURE_LIMIT', 'TRANSACTION_JOURNAL_LIMIT'].includes(serviceError.code)
+            ? Object.fromEntries(Object.entries(serviceError.details).filter(([key, value]) => [
+                'files',
+                'filesLimit',
+                'operations',
+                'operationsLimit',
+                'readDependencies',
+                'readDependenciesLimit',
+                'artifacts',
+                'artifactsLimit',
+                'diagnostics',
+                'diagnosticsLimit',
+                'checks',
+                'checksLimit',
+                'requestedWorkBytes',
+                'plannedJournalBytes',
+                'retainedBytes',
+                'maximumBytes',
+            ].includes(key) &&
+                typeof value === 'number' &&
+                Number.isSafeInteger(value) &&
+                value >= 0))
+            : {}
         : Object.fromEntries(Object.entries(serviceError.details).filter(([key]) => ![
             'cause',
             'stack',

package/dist/hoi4_agent_tools/core/scanner.js

@@ -1,4 +1,5 @@
 import { open, realpath, stat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
 import path from 'node:path';
 import { iterateFiles } from './file-glob.js';
 import { compareCodeUnits, sha256Bytes } from './canonical.js';
@@ -7,6 +8,22 @@ import { ServiceError } from './result.js';
 import { isWithin } from './workspace.js';
 const SCAN_IO_CONCURRENCY = 8;
 const SCAN_READ_BATCH_BYTES = 16_777_216;
+/** Hash an open source using fixed memory; callers verify its canonical identity afterwards. */
+export async function hashSourceBytes(source, signal) {
+    const hash = createHash('sha256');
+    const chunk = Buffer.alloc(Math.max(1, Math.min(1_048_576, source.metadata.size)));
+    let offset = 0;
+    while (offset < source.metadata.size) {
+        signal?.throwIfAborted();
+        const read = await source.handle.read(chunk, 0, Math.min(chunk.length, source.metadata.size - offset), offset);
+        if (!read.bytesRead)
+            throw new ServiceError('SCAN_SOURCE_CHANGED', 'Source changed while being hashed');
+        hash.update(chunk.subarray(0, read.bytesRead));
+        offset += read.bytesRead;
+    }
+    signal?.throwIfAborted();
+    return hash.digest('hex');
+}
 export async function verifySource(root, source) {
     const resolved = await realpath(source.absolutePath);
     if (!isWithin(root.path, resolved))

package/dist/hoi4_agent_tools/core/server-state.js

@@ -4,6 +4,7 @@ import path from 'node:path';
 import { z } from 'zod/v4';
 import { compareCodeUnits, canonicalJson, secureId } from './canonical.js';
 import { ServiceError } from './result.js';
+import { TRANSACTION_MAX_MANIFEST_BYTES } from './transaction-limits.js';
 const journalKeyFile = 'journal-hmac.key';
 const journalKeyBytes = 32;
 const sha256Schema = z.string().regex(/^[a-f0-9]{64}$/u);
@@ -157,7 +158,14 @@ export class ServerState {
         return new ServerState(canonicalRoot, Buffer.from(key));
     }
     authenticateJournal(payload) {
-        return createHmac('sha256', this.journalKey).update(canonicalJson(payload)).digest('hex');
+        return this.authenticateCanonicalJournal(canonicalJson(payload));
+    }
+    /** Internal canonical-byte path; the signature is identical to authenticateJournal. */
+    authenticateCanonicalJournal(payload) {
+        if (Buffer.byteLength(payload, 'utf8') > TRANSACTION_MAX_MANIFEST_BYTES) {
+            throw stateError('TRANSACTION_MANIFEST_LIMIT', 'Transaction manifest exceeds its fixed byte limit');
+        }
+        return createHmac('sha256', this.journalKey).update(payload).digest('hex');
     }
     verifyJournal(payload, authenticationTag) {
         if (!/^[a-f0-9]{64}$/u.test(authenticationTag))

package/dist/hoi4_agent_tools/core/temporary-directories.js

@@ -10,6 +10,7 @@ export const TEMPORARY_MAX_BYTES = 256 * 1024 * 1024;
 export const TEMPORARY_STALE_MS = 3 * 60 * 60 * 1000;
 // Dated event evaluation directories contain retained benchmark evidence, not scratch files.
 const scratchName = /^hoi4-(?:reference-source|event-eval)-[A-Za-z0-9]{6}$/u;
+const referenceSnapshotName = /^\.reference-snapshot-[A-Za-z0-9]{6}$/u;
 const ownerSchema = z
     .object({
     version: z.literal(1),
@@ -100,7 +101,8 @@ export async function sweepTemporaryDirectories(parent, options = {}) {
         }
     }))).flat();
     const candidates = [];
-    for (const name of (await readdir(root)).filter((name) => scratchName.test(name)).sort()) {
+    const names = options.referenceSnapshotsOnly ? referenceSnapshotName : scratchName;
+    for (const name of (await readdir(root)).filter((name) => names.test(name)).sort()) {
         const directory = path.join(root, name);
         if (protectedRoots.some((protectedRoot) => overlaps(directory, protectedRoot)))
             continue;
@@ -112,6 +114,8 @@ export async function sweepTemporaryDirectories(parent, options = {}) {
                 (await realpath(directory)) !== directory)
                 continue;
             const record = await owner(directory);
+            if (options.referenceSnapshotsOnly && record == null)
+                continue;
             // An interrupted sweep must not leave a permanent lock. Malformed or live locks
             // stay protected; only a confirmed dead local owner can relinquish its lock.
             const previousSweep = await owner(directory, SWEEP_LOCK);

package/dist/hoi4_agent_tools/core/transaction-canonical.js

@@ -0,0 +1,43 @@
+import { canonicalJson, compareCodeUnits } from './canonical.js';
+import { ServiceError } from './result.js';
+import { TRANSACTION_MAX_MANIFEST_BYTES } from './transaction-limits.js';
+/** A request-local snapshot of canonical immutable fields, without shared writable references. */
+export class TransactionCanonicalSnapshot {
+    immutable = new Map();
+    mutable;
+    constructor(source, mutableKeys) {
+        this.mutable = new Set(mutableKeys);
+        let bytes = 2;
+        for (const [key, value] of Object.entries(source)) {
+            if (this.mutable.has(key) || value === undefined)
+                continue;
+            const encoded = canonicalJson(value);
+            bytes += Buffer.byteLength(JSON.stringify(key)) + Buffer.byteLength(encoded) + 2;
+            this.assertBound(bytes);
+            this.immutable.set(key, encoded);
+        }
+    }
+    serialize(source, excludedKeys = []) {
+        const mutable = source;
+        const excluded = new Set(excludedKeys);
+        const keys = [...new Set([...this.immutable.keys(), ...this.mutable])]
+            .filter((key) => !excluded.has(key) && (this.immutable.has(key) || mutable[key] !== undefined))
+            .sort(compareCodeUnits);
+        // JSON objects emit integer keys before other keys, including after canonical insertion.
+        const orderedKeys = Object.keys(Object.fromEntries(keys.map((key) => [key, null])));
+        let bytes = 2;
+        const entries = orderedKeys.map((key) => {
+            const value = this.immutable.get(key) ?? canonicalJson(mutable[key]);
+            const entry = `${JSON.stringify(key)}:${value}`;
+            bytes += Buffer.byteLength(entry) + 1;
+            this.assertBound(bytes);
+            return entry;
+        });
+        return `{${entries.join(',')}}`;
+    }
+    assertBound(bytes) {
+        if (bytes > TRANSACTION_MAX_MANIFEST_BYTES) {
+            throw new ServiceError('TRANSACTION_MANIFEST_LIMIT', 'Transaction manifest exceeds its fixed byte limit');
+        }
+    }
+}

package/dist/hoi4_agent_tools/core/transaction-limits.js

@@ -1,8 +1,13 @@
-export const TRANSACTION_MAX_FILES = 1_000;
+// A generated world can contain thousands of state/region files. Review collections
+// remain bounded independently of the unchanged 16 MiB authenticated manifest cap.
+export const TRANSACTION_MAX_FILES = 5_000;
 export const TRANSACTION_MAX_OPERATIONS = 1_000;
 export const TRANSACTION_MAX_VALIDATION_CHECKS = 100;
 export const TRANSACTION_MAX_DIAGNOSTICS = 100;
-export const TRANSACTION_MAX_ARTIFACTS = 512;
+export const TRANSACTION_MAX_ARTIFACTS = 6_000;
 export const TRANSACTION_MAX_APPLIED_FILES = TRANSACTION_MAX_FILES;
 export const TRANSACTION_MAX_READ_DEPENDENCIES = 10_000;
 export const TRANSACTION_MAX_MANIFEST_BYTES = 16_777_216;
+export const TRANSACTION_MAX_PENDING_FILES = 16;
+// A maximum-size world needs before/after blobs plus staging and rollback copies.
+export const TRANSACTION_MAX_JOURNAL_BYTES = 1_073_741_824;