ima2-gen 3.13.1 → 3.14.0

package/lib/agyArtifactRead.js

@@ -0,0 +1,249 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath, rmdir, unlink } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { dirname, isAbsolute, join, relative, sep } from "node:path";
+import { AGY_ARTIFACT_POLICY } from "../config.js";
+import { agyError } from "./agyProcess.js";
+// Only an issued receipt authorizes cleanup; exposed metadata is not authority.
+const receipts = new WeakMap();
+const pathRejected = () => agyError("Agy artifact path was rejected", 502, "AGY_PATH_REJECTED");
+const tooLarge = () => agyError("Agy artifact exceeds the size limit", 502, "AGY_ARTIFACT_TOO_LARGE");
+function rejectPathOrIo(error) {
+    if (error instanceof Error && Reflect.get(error, "code") === "EIO")
+        throw error;
+    throw pathRejected();
+}
+function abortIfNeeded(signal) {
+    if (signal?.aborted)
+        throw agyError("Generation canceled", 499, "GENERATION_CANCELED");
+}
+function canceled(error) {
+    return error instanceof Error && Reflect.get(error, "code") === "GENERATION_CANCELED"
+        && Reflect.get(error, "status") === 499;
+}
+function contained(root, target) {
+    const part = relative(root, target);
+    return part !== "" && part !== ".." && !part.startsWith(`..${sep}`) && !isAbsolute(part);
+}
+function identity(info) {
+    // Filesystems without usable inode identity cannot satisfy this contract.
+    if (info.ino <= 0n)
+        throw pathRejected();
+    return Object.freeze({ dev: info.dev, ino: info.ino });
+}
+function sameIdentity(info, expected) {
+    return info.dev === expected.dev && info.ino === expected.ino;
+}
+async function approvedRoots() {
+    const roots = [];
+    for (const source of [join(homedir(), ".gemini"), join(homedir(), ".cache"), tmpdir()]) {
+        try {
+            const canonical = await realpath(source);
+            const info = await lstat(canonical, { bigint: true });
+            if (!info.isDirectory())
+                throw pathRejected();
+            roots.push({ source, canonical, identity: identity(info) });
+        }
+        catch (error) {
+            if (error instanceof Error && Reflect.get(error, "code") === "ENOENT")
+                continue;
+            throw pathRejected();
+        }
+    }
+    return roots;
+}
+async function validateRoot(root) {
+    const current = await realpath(root.source);
+    const info = await lstat(current, { bigint: true });
+    if (current !== root.canonical || !info.isDirectory() || !sameIdentity(info, root.identity)) {
+        throw pathRejected();
+    }
+}
+async function inspectCandidate(candidate) {
+    if (!isAbsolute(candidate) || candidate.includes("\0")
+        || (process.platform === "win32" && candidate.slice(2).includes(":")))
+        throw pathRejected();
+    const roots = await approvedRoots();
+    if (!roots.some((root) => contained(root.source, candidate) || contained(root.canonical, candidate))) {
+        throw pathRejected();
+    }
+    let info;
+    try {
+        info = await lstat(candidate, { bigint: true });
+    }
+    catch (error) {
+        if (error instanceof Error && ["ENOENT", "ENOTDIR"].includes(String(Reflect.get(error, "code")))) {
+            throw agyError("Agy artifact was not found", 502, "AGY_ARTIFACT_NOT_FOUND");
+        }
+        rejectPathOrIo(error);
+    }
+    try {
+        if (info.isSymbolicLink() || !info.isFile())
+            throw pathRejected();
+        const canonicalPath = await realpath(candidate);
+        const root = roots.find((entry) => contained(entry.canonical, canonicalPath));
+        if (!root)
+            throw pathRejected();
+        const parent = await lstat(dirname(canonicalPath), { bigint: true });
+        if (!parent.isDirectory())
+            throw pathRejected();
+        return { candidate, canonicalPath, roots, root, identity: identity(info), parentIdentity: identity(parent) };
+    }
+    catch (error) {
+        rejectPathOrIo(error);
+    }
+}
+async function validateMapping(snapshot) {
+    try {
+        await validateRoot(snapshot.root);
+        const candidateInfo = await lstat(snapshot.candidate, { bigint: true });
+        const canonical = await realpath(snapshot.candidate);
+        const canonicalInfo = await lstat(snapshot.canonicalPath, { bigint: true });
+        if (!candidateInfo.isFile() || candidateInfo.isSymbolicLink()
+            || !sameIdentity(candidateInfo, snapshot.identity) || canonical !== snapshot.canonicalPath
+            || !canonicalInfo.isFile() || canonicalInfo.isSymbolicLink()
+            || !sameIdentity(canonicalInfo, snapshot.identity)
+            || !contained(snapshot.root.canonical, canonical))
+            throw pathRejected();
+    }
+    catch (error) {
+        rejectPathOrIo(error);
+    }
+}
+async function openChecked(candidate) {
+    const snapshot = await inspectCandidate(candidate);
+    let handle;
+    try {
+        const flags = constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        handle = await open(snapshot.canonicalPath, flags);
+        const info = await handle.stat({ bigint: true });
+        if (!info.isFile() || !sameIdentity(info, snapshot.identity))
+            throw pathRejected();
+        await validateMapping(snapshot);
+        return { handle, snapshot, size: info.size };
+    }
+    catch (error) {
+        if (handle)
+            await handle.close().catch(() => { }); // Preserve the failed trust check.
+        // No descriptor receipt exists until every trust check above succeeds.
+        rejectPathOrIo(error);
+    }
+}
+async function readBytes(handle, signal) {
+    const { maxBytes, chunkBytes } = AGY_ARTIFACT_POLICY;
+    const chunks = [];
+    let total = 0;
+    try {
+        while (total < maxBytes) {
+            abortIfNeeded(signal);
+            const block = Buffer.allocUnsafe(Math.min(chunkBytes, maxBytes - total));
+            let filled = 0;
+            while (filled < block.length) {
+                const { bytesRead } = await handle.read(block, filled, block.length - filled, total);
+                abortIfNeeded(signal);
+                if (bytesRead === 0) {
+                    if (filled)
+                        chunks.push(block.subarray(0, filled));
+                    return Buffer.concat(chunks, total);
+                }
+                filled += bytesRead;
+                total += bytesRead;
+            }
+            chunks.push(block);
+        }
+        const { bytesRead } = await handle.read(Buffer.allocUnsafe(1), 0, 1, total);
+        abortIfNeeded(signal);
+        if (bytesRead)
+            throw tooLarge();
+        return Buffer.concat(chunks, total);
+    }
+    catch (error) {
+        throw error;
+    }
+    finally {
+        chunks.length = 0;
+    }
+}
+async function cleanupSnapshot(snapshot) {
+    try {
+        await validateMapping(snapshot);
+        const parent = dirname(snapshot.canonicalPath);
+        const info = await lstat(parent, { bigint: true });
+        if (!info.isDirectory() || !sameIdentity(info, snapshot.parentIdentity))
+            return;
+        await unlink(snapshot.canonicalPath);
+        if (snapshot.roots.some((root) => root.canonical === parent))
+            return;
+        await validateRoot(snapshot.root);
+        const currentParent = await realpath(parent);
+        const currentInfo = await lstat(parent, { bigint: true });
+        if (currentParent !== parent || !contained(snapshot.root.canonical, parent)
+            || !currentInfo.isDirectory() || !sameIdentity(currentInfo, snapshot.parentIdentity))
+            return;
+        // A concurrent sibling makes this fail ENOTEMPTY; never recursively sweep it.
+        await rmdir(parent);
+    }
+    catch { /* Best effort: policy rejection or replacement grants no further deletion. */ }
+}
+export async function cleanupAgyArtifact(receipt) {
+    const snapshot = receipts.get(receipt);
+    if (!snapshot)
+        return;
+    receipts.delete(receipt);
+    await cleanupSnapshot(snapshot);
+}
+/** Static/detected path confinement, not an atomic sandbox against same-user races. */
+export async function readAgyArtifact(candidate, signal) {
+    abortIfNeeded(signal);
+    let opened;
+    let buffer;
+    let failure;
+    let failed = false;
+    try {
+        opened = await openChecked(candidate);
+        if (opened.size > BigInt(AGY_ARTIFACT_POLICY.maxBytes))
+            throw tooLarge();
+        abortIfNeeded(signal);
+        buffer = await readBytes(opened.handle, signal);
+        await validateMapping(opened.snapshot);
+    }
+    catch (error) {
+        failure = error;
+        failed = true;
+    }
+    finally {
+        if (opened) {
+            try {
+                await opened.handle.close();
+            }
+            catch (error) {
+                if (!failed) {
+                    failure = error;
+                    failed = true;
+                }
+            }
+        }
+    }
+    if (failed) {
+        if (opened && canceled(failure))
+            await cleanupSnapshot(opened.snapshot);
+        throw failure;
+    }
+    // The successful path necessarily acquired both; no external receipt exists yet.
+    if (!opened || !buffer)
+        throw pathRejected();
+    try {
+        abortIfNeeded(signal);
+        await validateMapping(opened.snapshot);
+        abortIfNeeded(signal);
+    }
+    catch (error) {
+        if (canceled(error))
+            await cleanupSnapshot(opened.snapshot);
+        throw error;
+    }
+    const receipt = Object.freeze({ buffer, canonicalPath: opened.snapshot.canonicalPath,
+        identity: opened.snapshot.identity, approvedRoots: Object.freeze(opened.snapshot.roots.map((root) => root.canonical)) });
+    receipts.set(receipt, opened.snapshot);
+    return receipt;
+}

package/lib/agyImageAdapter.js

@@ -1,329 +1,2 @@
-import { spawn } from "node:child_process";
-import { readFile, readdir, rm, stat, writeFile, mkdir } from "node:fs/promises";
-import { extname, dirname, join, resolve } from "node:path";
-import { homedir, tmpdir } from "node:os";
-import { randomBytes } from "node:crypto";
-import { buildAgyPathEnv, resolveAgyBin } from "./agyCli.js";
-import { logEvent } from "./logger.js";
-import { SAFETY_INTENT_POLICY } from "./promptSafetyPolicy.js";
-import { detectImageMimeFromB64 } from "./refs.js";
-import { deriveReferenceLimit } from "./providers/derive.js";
-const AGY_TIMEOUT_MS = 360_000;
-const AGY_OUTPUT_RESOLUTION = "1024x1024";
-const AGY_MAX_OUTPUT_BYTES = 1024 * 1024;
-function agyError(message, status, code) {
-    const err = new Error(message);
-    err.status = status;
-    err.code = code;
-    return err;
-}
-function buildAgyPrompt(userPrompt, referencePaths) {
-    const imagePathsJson = referencePaths.length > 0
-        ? JSON.stringify(referencePaths)
-        : "[]";
-    return [
-        "You are an image generation assistant inside a professional creative tool used by designers and artists. Users create content for legitimate creative, commercial, or educational purposes.",
-        SAFETY_INTENT_POLICY,
-        "",
-        "Generate one image by calling the tool default_api:generate_image once.",
-        "After the tool finishes, print one machine-readable result line so ima2-gen can copy the artifact.",
-        "",
-        "Tool parameters:",
-        `  Prompt: ${JSON.stringify(userPrompt)}`,
-        '  ImageName: "ima2_generated"',
-        `  ImagePaths: ${imagePathsJson}`,
-        '  toolSummary: "ima2 pipeline generation"',
-        '  toolAction: "Generating ima2 image"',
-        "",
-        `Reference count: ${referencePaths.length}. The output resolution is fixed at ${AGY_OUTPUT_RESOLUTION}.`,
-        "",
-        "PROMPT HANDLING:",
-        "- Preserve the user's prompt as-is for compliant requests. Do not translate, restyle, or soften benign adult clothing requests such as swimwear.",
-        "- If the user wrote in Korean, Japanese, or any non-English language, keep visible text and dialogue in that language.",
-        "- Do not sexualize, intensify exposure, or add sexualized/fetish framing to benign swimwear, sportswear, or catalog fashion prompts.",
-        "- Do not copy safety labels, refusal reasons, or negative safety constraints into the final image prompt.",
-        "- If the request includes minors, underage-looking subjects, explicit sexual activity, or fetish framing, do not rewrite it as a benign allowed prompt.",
-        "- Content moderation is still handled downstream by the provider.",
-        "",
-        "OUTPUT:",
-        "If generation succeeds, print: RESULT|<absolute_artifact_path>|<file_extension>",
-        "If generation fails, print: ERROR|<concise error message>",
-    ].join("\n");
-}
-function parseAgyOutput(stdout) {
-    const lines = stdout.replace(/\r/g, "").trim().split("\n").filter((l) => l.trim().length > 0);
-    const resultLine = lines.find((l) => l.startsWith("RESULT|"));
-    if (resultLine) {
-        const parts = resultLine.split("|");
-        const artifactPath = parts[1];
-        const ext = parts[2];
-        if (parts.length >= 3 && artifactPath && ext) {
-            return { artifactPath: artifactPath.trim(), ext: ext.trim() };
-        }
-        throw agyError(`Malformed RESULT line: ${resultLine}`, 502, "AGY_MALFORMED_RESULT");
-    }
-    const errorLine = lines.find((l) => l.startsWith("ERROR|"));
-    if (errorLine) {
-        const msg = errorLine.slice("ERROR|".length).trim() || "Unknown agy error";
-        const lower = msg.toLowerCase();
-        if (lower.includes("resource exhausted") || lower.includes("exhausted your capacity") || lower.includes("quota will reset")) {
-            throw agyError(`Agy generation failed: ${msg}`, 429, "AGY_QUOTA_EXHAUSTED");
-        }
-        throw agyError(`Agy generation failed: ${msg}`, 502, "AGY_GENERATION_FAILED");
-    }
-    const fullLower = stdout.toLowerCase();
-    if (fullLower.includes("resource exhausted") || fullLower.includes("exhausted your capacity")) {
-        throw agyError(`Agy quota exhausted: ${stdout.trim().slice(0, 200)}`, 429, "AGY_QUOTA_EXHAUSTED");
-    }
-    const savedPathLine = lines.find((l) => l.startsWith("SAVED_PATH="));
-    if (savedPathLine) {
-        const p = savedPathLine.slice("SAVED_PATH=".length).trim();
-        const ext = p.split(".").pop() || "png";
-        return { artifactPath: p, ext };
-    }
-    const normalizedStdout = stdout.replace(/\r/g, "").replace(/\\/g, "/");
-    const pathMatch = normalizedStdout.match(/(?:[A-Za-z]:)?\/[^\s"']+\/(brain|artifacts|\.gemini)\/[^\s"']+\.(png|jpg|jpeg|webp)/i);
-    if (pathMatch) {
-        const matched = pathMatch[0];
-        const artifactPath = process.platform === "win32" ? matched.replace(/\//g, "\\") : matched;
-        const ext = extname(artifactPath).slice(1) || "png";
-        return { artifactPath, ext };
-    }
-    throw agyError(`Could not parse artifact path from agy output (${stdout.length} chars): ${stdout.slice(0, 200)}`, 502, "AGY_PARSE_FAILED");
-}
-export async function findRecentAgyArtifact(sinceMs, rootOverrides) {
-    const roots = rootOverrides ?? [
-        join(homedir(), ".gemini", "antigravity-cli", "brain"),
-        join(homedir(), ".gemini"),
-    ];
-    const candidates = [];
-    const seen = new Set();
-    async function walk(dir, depth) {
-        if (depth > 5 || seen.has(dir))
-            return;
-        seen.add(dir);
-        const entries = await readdir(dir, { withFileTypes: true }).catch(() => []);
-        for (const entry of entries) {
-            const p = join(dir, entry.name);
-            if (!entry.isSymbolicLink() && entry.isDirectory()) {
-                await walk(p, depth + 1);
-                continue;
-            }
-            if (!/^ima2_generated.*\.(png|jpg|jpeg|webp)$/i.test(entry.name)) {
-                continue;
-            }
-            const s = await stat(p).catch(() => null);
-            if (!s)
-                continue;
-            if (s.mtimeMs >= sinceMs - 5_000) {
-                candidates.push({ path: p, mtimeMs: s.mtimeMs });
-            }
-        }
-    }
-    for (const root of roots) {
-        await walk(root, 0);
-    }
-    candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
-    return candidates[0]?.path ?? null;
-}
-function spawnAgy(prompt, signal) {
-    return new Promise((resolve, reject) => {
-        const child = spawn(resolveAgyBin(), ["-p", "-"], {
-            stdio: ["pipe", "pipe", "pipe"],
-            env: {
-                PATH: buildAgyPathEnv(),
-                HOME: process.env.HOME,
-                USERPROFILE: process.env.USERPROFILE,
-                TMPDIR: process.env.TMPDIR,
-                TEMP: process.env.TEMP,
-                LANG: process.env.LANG,
-                GEMINI_API_KEY: process.env.GEMINI_API_KEY,
-            },
-        });
-        let stdout = "";
-        let stderr = "";
-        let settled = false;
-        const timer = setTimeout(() => {
-            if (!settled) {
-                settled = true;
-                child.kill("SIGTERM");
-                reject(agyError("Agy generation timed out", 504, "AGY_TIMEOUT"));
-            }
-        }, AGY_TIMEOUT_MS);
-        child.stdout.on("data", (chunk) => { if (stdout.length < AGY_MAX_OUTPUT_BYTES)
-            stdout += chunk.toString(); });
-        child.stderr.on("data", (chunk) => { if (stderr.length < AGY_MAX_OUTPUT_BYTES)
-            stderr += chunk.toString(); });
-        child.on("error", (err) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            const bin = resolveAgyBin();
-            const hint = err.code === "ENOENT"
-                ? `. "${bin}" was not found — install agy or set IMA2_AGY_BIN=/absolute/path/to/agy`
-                : "";
-            reject(agyError(`Agy process error: ${err.message}${hint}`, 502, "AGY_PROCESS_ERROR"));
-        });
-        child.on("close", (code) => {
-            if (settled)
-                return;
-            settled = true;
-            clearTimeout(timer);
-            if (code !== 0 && !stdout.trim()) {
-                reject(agyError(`Agy exited with code ${code}: ${stderr.slice(0, 200)}`, 502, "AGY_PROCESS_ERROR"));
-                return;
-            }
-            resolve({ stdout, stderr });
-        });
-        if (signal) {
-            const onAbort = () => {
-                if (!settled) {
-                    settled = true;
-                    clearTimeout(timer);
-                    child.kill("SIGTERM");
-                    reject(agyError("Generation canceled", 499, "GENERATION_CANCELED"));
-                }
-            };
-            signal.addEventListener("abort", onAbort, { once: true });
-            child.on("close", () => signal.removeEventListener("abort", onAbort));
-        }
-        if (signal?.aborted) {
-            settled = true;
-            clearTimeout(timer);
-            child.kill("SIGTERM");
-            return reject(agyError("Generation canceled", 499, "GENERATION_CANCELED"));
-        }
-        child.stdin.on("error", () => { });
-        child.stdin.write(prompt);
-        child.stdin.end();
-    });
-}
-const MIME_TO_EXT = {
-    "image/png": "png",
-    "image/jpeg": "jpg",
-    "image/webp": "webp",
-};
-async function writeRefsToTempFiles(refs) {
-    if (refs.length === 0)
-        return { paths: [], cleanup: async () => { } };
-    const dir = join(tmpdir(), `ima2-agy-refs-${randomBytes(6).toString("hex")}`);
-    await mkdir(dir, { recursive: true });
-    const paths = [];
-    for (let i = 0; i < refs.length; i++) {
-        const ref = refs[i];
-        if (!ref)
-            continue;
-        const mime = ref.detectedMime || ref.declaredMime || detectImageMimeFromB64(ref.b64) || "image/png";
-        const ext = MIME_TO_EXT[mime] || "png";
-        const p = join(dir, `ref_${i}.${ext}`);
-        await writeFile(p, Buffer.from(ref.b64, "base64"));
-        paths.push(p);
-    }
-    return {
-        paths,
-        cleanup: async () => {
-            await rm(dir, { recursive: true, force: true }).catch(() => { });
-        },
-    };
-}
-async function cleanupAgyArtifact(artifactPath) {
-    try {
-        await rm(artifactPath, { force: true }).catch(() => { });
-        const dir = dirname(artifactPath);
-        const entries = await readdir(dir).catch(() => null);
-        if (entries && entries.length === 0) {
-            await rm(dir, { recursive: true, force: true }).catch(() => { });
-        }
-    }
-    catch { /* best-effort */ }
-}
-export async function generateViaAgy(prompt, options = {}) {
-    const refDetails = (options.references || []).slice(0, deriveReferenceLimit("agy", "edit"));
-    const { paths: refPaths, cleanup } = await writeRefsToTempFiles(refDetails);
-    const agyPrompt = buildAgyPrompt(prompt, refPaths);
-    logEvent("agy", "generate:start", {
-        requestId: options.requestId,
-        promptChars: prompt.length,
-        agyPromptChars: agyPrompt.length,
-        refs: refPaths.length,
-    });
-    try {
-        const generationStartedAtMs = Date.now();
-        const { stdout, stderr } = await spawnAgy(agyPrompt, options.signal);
-        if (stderr && stderr.trim().length > 0) {
-            logEvent("agy", "generate:stderr", {
-                requestId: options.requestId,
-                stderrChars: stderr.length,
-                stderrPreview: stderr.slice(0, 200),
-            });
-        }
-        const agyCombinedOutput = [stdout, stderr].filter(Boolean).join("\n");
-        let artifactPath;
-        try {
-            artifactPath = parseAgyOutput(agyCombinedOutput).artifactPath;
-        }
-        catch (err) {
-            if (err?.code !== "AGY_PARSE_FAILED") {
-                throw err;
-            }
-            const fallbackPath = await findRecentAgyArtifact(generationStartedAtMs);
-            if (!fallbackPath) {
-                throw err;
-            }
-            logEvent("agy", "generate:fallback_artifact_found", {
-                requestId: options.requestId,
-                artifactPath: fallbackPath,
-                stdoutChars: stdout.length,
-                stderrChars: stderr.length,
-            });
-            artifactPath = fallbackPath;
-        }
-        // Validate artifact path is within allowed directories
-        const resolvedPath = resolve(artifactPath);
-        const allowedPrefixes = [
-            join(homedir(), ".gemini"),
-            join(homedir(), ".cache"),
-            tmpdir(),
-        ];
-        const normalizedResolved = resolvedPath.replace(/\\/g, "/");
-        const isSafePath = allowedPrefixes.some((prefix) => {
-            const normalizedPrefix = prefix.replace(/\\/g, "/");
-            return normalizedResolved.startsWith(normalizedPrefix + "/") || normalizedResolved === normalizedPrefix;
-        });
-        if (!isSafePath) {
-            throw agyError(`Agy artifact path outside allowed directories: ${resolvedPath}`, 502, "AGY_PATH_REJECTED");
-        }
-        try {
-            await stat(resolvedPath);
-        }
-        catch {
-            throw agyError(`Agy artifact not found at parsed path: ${resolvedPath}`, 502, "AGY_ARTIFACT_NOT_FOUND");
-        }
-        const buffer = await readFile(resolvedPath);
-        const b64 = buffer.toString("base64");
-        const mime = detectImageMimeFromB64(b64) || "image/png";
-        logEvent("agy", "generate:done", {
-            requestId: options.requestId,
-            artifactPath,
-            b64Len: b64.length,
-            mime,
-            fileBytes: buffer.length,
-        });
-        await cleanupAgyArtifact(resolvedPath);
-        return {
-            b64,
-            revisedPrompt: prompt,
-            usage: { agy_artifact_bytes: buffer.length },
-            webSearchCalls: 0,
-            mime,
-        };
-    }
-    catch (err) {
-        logEvent("agy", "generate:failed_cleanup", { requestId: options.requestId });
-        throw err;
-    }
-    finally {
-        await cleanup();
-    }
-}
+export { generateViaAgy } from "./providers/adapters/agyOperations.js";
+export { findRecentAgyArtifact } from "./agyArtifact.js";