in2-agent-server 0.20260821.185429

package/dist/core/gate.js

@@ -0,0 +1,201 @@
+import { runProcess, sfCliEnv } from "./spawn.js";
+import { isOrgGranted } from "./writeGrants.js";
+// Execution-gate semantics copied from apps/in2-interactive/lib/flue/execution-gate.ts:
+// default-closed, enforced in code before any mutating handler runs, org allowlist by Org ID.
+const T_PINTO_ORG_ID = "00Dfn00000BFjbBEAT";
+export class GateError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "GateError";
+    }
+}
+const orgIdCache = new Map();
+export async function defaultOrgIdResolver(alias) {
+    const cached = orgIdCache.get(alias);
+    if (cached)
+        return cached;
+    let run = await runProcess("sf", ["org", "display", "--target-org", alias, "--json"], {
+        env: sfCliEnv(),
+        timeoutMs: 60_000
+    });
+    if (run.timedOut) {
+        // Read-only — one retry on a stalled CLI child is safe (live-caught intermittent hang).
+        run = await runProcess("sf", ["org", "display", "--target-org", alias, "--json"], {
+            env: sfCliEnv(),
+            timeoutMs: 60_000
+        });
+    }
+    if (run.exitCode !== 0)
+        return null;
+    try {
+        const parsed = JSON.parse(run.stdout);
+        const id = parsed.result?.id;
+        if (typeof id === "string" && id.length >= 15) {
+            orgIdCache.set(alias, id);
+            return id;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * DELIBERATELY UNCACHED, unlike `defaultOrgIdResolver` above.
+ *
+ * Which org an alias points at is stable for a process lifetime, so memoizing it is free. Whether
+ * that org's credential still works is the opposite kind of fact: it is exactly what changes
+ * underneath a long run, and the whole reason this probe exists. `orgIdCache` memoizing a successful
+ * resolution is already why a mid-run auth death moves the failure downstream into the SOQL/PATCH
+ * itself, as a less legible error, once the gate has passed from cache once.
+ */
+export async function defaultOrgLivenessProbe(alias) {
+    const run = await runProcess("sf", ["org", "display", "--target-org", alias, "--json"], {
+        env: sfCliEnv(),
+        timeoutMs: 60_000
+    });
+    if (run.timedOut)
+        return null;
+    try {
+        const parsed = JSON.parse(run.stdout);
+        if (parsed.result)
+            return { ...(parsed.result.connectedStatus ? { connectedStatus: parsed.result.connectedStatus } : {}) };
+        // A parseable answer with no result is the CLI saying it has no auth for this alias — a real
+        // answer, and a negative one. Distinct from the unparseable case below, which is no answer.
+        return parsed.message ? { connectedStatus: parsed.message } : null;
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeOrgId(orgId) {
+    return orgId.slice(0, 15);
+}
+// Allowlist wildcard for INTERNAL DEV TESTING. The per-org allowlist is fixed at server spawn,
+// but an org's id is only knowable AFTER logging into it — so testing a fresh org forced a
+// re-registration plus a new session every time, which is pure drag when the whole point is to
+// try the harness against many orgs. Setting CC_MCP_DIRECT_ALLOWLIST=* opts out ONCE: any org
+// the sf CLI is authenticated to becomes writable, no re-registration.
+//
+// This deliberately stays an explicit opt-in rather than the default — default-closed is worth
+// keeping — and it NEVER overrides the consultant-org refusal, which is checked first and by
+// org id, so the real shared org is unreachable no matter what the allowlist says.
+const ALLOWLIST_WILDCARD = "*";
+function allowlistIsOpen(raw) {
+    if (!raw)
+        return false;
+    return raw.split(",").map((entry) => entry.trim()).includes(ALLOWLIST_WILDCARD);
+}
+export function directAllowlistOpen() {
+    return allowlistIsOpen(process.env.CC_MCP_DIRECT_ALLOWLIST);
+}
+export function assertTargetOrg(targetOrg) {
+    if (!targetOrg || !targetOrg.trim()) {
+        throw new GateError("TARGET_ORG_REQUIRED", "Every live-org tool call requires an explicit targetOrg alias. There is no default org.");
+    }
+}
+// The consultant/Campfire org (VF-partial) is REAL and SHARED — writes there have the
+// largest blast radius in the system, larger than target-org deploys. They ride their
+// OWN gate, deliberately separate from the direct tier: opening live deploys to a mock
+// client org must never implicitly authorize writes to the shared consultant org.
+export const VF_PARTIAL_ORG_ID = "00DRu00000Mpj50MAB";
+// True when an org id is the REAL shared consultant org, which the direct tier refuses
+// regardless of allowlist. Exported so guidance never suggests allowlisting it.
+export function isConsultantOrg(orgId) {
+    return orgId.slice(0, 15) === VF_PARTIAL_ORG_ID.slice(0, 15);
+}
+export function campfireWriteEnabled() {
+    return process.env.CC_MCP_CAMPFIRE_WRITE === "1";
+}
+export function campfireAllowlistedOrgIds() {
+    const raw = process.env.CC_MCP_CAMPFIRE_ALLOWLIST?.trim();
+    const ids = raw ? raw.split(",").map((entry) => entry.trim()).filter(Boolean) : [VF_PARTIAL_ORG_ID];
+    return ids.map(normalizeOrgId);
+}
+export async function assertCampfireWriteAllowed(consultantOrg, resolveOrgId = defaultOrgIdResolver) {
+    assertTargetOrg(consultantOrg);
+    if (!campfireWriteEnabled()) {
+        throw new GateError("CAMPFIRE_WRITE_NOT_AUTHORIZED", "Campfire writes are default-closed (the consultant org is real and shared). Start the server with CC_MCP_CAMPFIRE_WRITE=1 to enable them — this gate is deliberately separate from CC_MCP_EXECUTION.");
+    }
+    const orgId = await resolveOrgId(consultantOrg);
+    if (!orgId) {
+        throw new GateError("ORG_ID_UNRESOLVED", `Could not resolve the Org ID for consultant alias ${JSON.stringify(consultantOrg)}. Refusing fail-closed.`);
+    }
+    const allowlist = campfireAllowlistedOrgIds();
+    if (!allowlist.includes(normalizeOrgId(orgId))) {
+        throw new GateError("CONSULTANT_ORG_NOT_ALLOWLISTED", `Org ${orgId} (alias ${consultantOrg}) is not on the Campfire write allowlist [${allowlist.join(", ")}].`);
+    }
+}
+// Direct working tier (Amendment A, plan 2026-07-22-001): raw metadata writes with
+// mandatory lint -> checkOnly -> deploy -> re-project -> three-way diff. Own gate,
+// own allowlist (default T-Pinto). The consultant org is HARD-refused by id even if
+// allowlisted — the direct tier must never touch the shared org.
+export function directWriteEnabled() {
+    return process.env.CC_MCP_DIRECT_WRITE === "1";
+}
+export function directAllowlistedOrgIds() {
+    const raw = process.env.CC_MCP_DIRECT_ALLOWLIST?.trim();
+    const ids = raw ? raw.split(",").map((entry) => entry.trim()).filter(Boolean) : [T_PINTO_ORG_ID];
+    return ids.map(normalizeOrgId);
+}
+export async function assertDirectWriteAllowed(targetOrg, resolveOrgId = defaultOrgIdResolver, orgIsGranted = isOrgGranted, probeLiveness = defaultOrgLivenessProbe) {
+    assertTargetOrg(targetOrg);
+    if (!directWriteEnabled()) {
+        throw new GateError("DIRECT_WRITE_NOT_AUTHORIZED", "The direct working tier is default-closed. Start the server with CC_MCP_DIRECT_WRITE=1 to enable it (org authority then comes from activate_session, or from CC_MCP_DIRECT_ALLOWLIST for internal testing).");
+    }
+    const orgId = await resolveOrgId(targetOrg);
+    if (!orgId) {
+        throw new GateError("ORG_ID_UNRESOLVED", `Could not resolve the Org ID for alias ${JSON.stringify(targetOrg)}. Refusing fail-closed.`);
+    }
+    // The consultant refusal is checked BEFORE any grant or wildcard on purpose — no allowlist
+    // setting and no activation can ever make the real shared org writable by this tier.
+    if (normalizeOrgId(orgId) === normalizeOrgId(VF_PARTIAL_ORG_ID)) {
+        throw new GateError("CONSULTANT_ORG_FORBIDDEN", "The consultant org (VF-partial) is hard-refused by the direct tier regardless of allowlist — it is real and shared.");
+    }
+    // The customer path: activate_session authenticated THIS org and verified the CLI landed on the
+    // org the launch service named. That is a narrower and better-evidenced claim than any env var —
+    // it names one org, proven at the moment of authentication, rather than a list guessed at spawn.
+    //
+    // AUTHORITY IS DECIDED BEFORE LIVENESS, and the order is doctrine rather than taste: the two
+    // refusals send the operator to different places. DIRECT_ORG_NOT_ALLOWLISTED means "this install
+    // was never authorized here" and the fix is a fresh Campfire activation; ORG_AUTH_EXPIRED means
+    // "you hold authority over an org you can no longer reach" and the fix is a re-auth of an org they
+    // already have. Reporting the second when the first is true has them re-authenticate their way
+    // into the same refusal.
+    const authorized = (await orgIsGranted(orgId)) ||
+        directAllowlistOpen() || // CC_MCP_DIRECT_ALLOWLIST=* — INTERNAL DEV ONLY, never shipped
+        directAllowlistedOrgIds().includes(normalizeOrgId(orgId));
+    if (!authorized) {
+        const allowlist = directAllowlistedOrgIds();
+        throw new GateError("DIRECT_ORG_NOT_ALLOWLISTED", `Org ${orgId} (alias ${targetOrg}) is not writable by this install. It has no activation grant and is not on CC_MCP_DIRECT_ALLOWLIST [${allowlist.join(", ")}].\n` +
+            `Normal fix: re-send the requirements from Campfire and redeem the code with activate_session — that authenticates the org and grants write to exactly it.\n` +
+            `Internal testing only: add the id to CC_MCP_DIRECT_ALLOWLIST (server env is fixed at spawn, so that needs a re-register + fresh session).`);
+    }
+    // THE GRANT AND THE TOKEN IT AUTHORIZES ARE ON DIFFERENT CLOCKS, and until this check existed the
+    // gate read only the slower one. A grant lasts 30 days (`writeGrants.ts`); the activation refresh
+    // token it authorizes lasts about ONE (`docs/orgs-and-credentials.md`). So for 29 of 30 days an
+    // install believed it could write to an org it could no longer reach, and the truth arrived from
+    // Salesforce as `Session expired` mid-deploy — discovered on the first request rather than at
+    // connect (`direct/rollbackRun.ts` header), which is the worst possible moment for it.
+    //
+    // A liveness probe rather than a shorter calendar TTL, deliberately. The doctrine's own
+    // first-choice recovery is `sf org login web --alias <the session alias>`, which re-mints a
+    // durable CLI token under the SAME alias without touching the grant. Shortening the TTL would
+    // revoke authority the operator had just legitimately restored. Calendar time bounds the
+    // ENGAGEMENT; the probe answers whether the org is reachable right now.
+    //
+    // ONLY A DEFINITE NEGATIVE REFUSES. A probe that returns nothing, or an answer that names no
+    // status at all, is the CLI declining to say — which is the same evidence state as not having
+    // looked, and this file's own doctrine is that "I could not verify that" is only true after you
+    // looked. Refusing on silence would turn a flaky child process, or an org whose auth shape does
+    // not report a status, into a blocked delivery.
+    const liveness = await probeLiveness(targetOrg);
+    if (liveness?.connectedStatus && liveness.connectedStatus !== "Connected") {
+        throw new GateError("ORG_AUTH_EXPIRED", `Org ${orgId} (alias ${targetOrg}) is authorized by this install, but its stored sign-in is no longer valid (${liveness.connectedStatus}). ` +
+            `Activation-minted tokens last about a day, so a session resumed the next morning reads this way — the write authority outlives the credential it authorizes.\n` +
+            `Fix, either way: sign in directly with \`sf org login web --alias ${targetOrg} --instance-url <their org url>\` (one clean attempt — rapid retries trip Salesforce's integration-user auto-freeze), or re-send the requirements from Campfire and redeem a fresh code with activate_session.\n` +
+            `Refusing fail-closed: nothing was deployed, so there is nothing to undo.`);
+    }
+}

package/dist/core/ids.js

@@ -0,0 +1,9 @@
+import { semanticContentHash } from "./semanticHash.js";
+// Matches @in2/contracts OpaqueIdSchema: /^[A-Za-z][A-Za-z0-9_-]{5,127}$/
+export const OPAQUE_ID_RE = /^[A-Za-z][A-Za-z0-9_-]{5,127}$/;
+export function opaqueId(prefix, value) {
+    return `${prefix}_${semanticContentHash(value).slice(0, 24)}`;
+}
+export function isoNow() {
+    return new Date().toISOString();
+}

package/dist/core/install.js

@@ -0,0 +1,60 @@
+// Where this install lives, and which version it is running.
+//
+// The server is DISTRIBUTED VIA NPM (`npm install -g in2-agent-server`). npm owns the layout, the
+// bin links, and the replace-on-update semantics — the bespoke ~/.in2-agent/versions/<v> layout,
+// its launcher shims, and the in-process hot swap are gone with the updater that needed them
+// (docs/plans/2026-08-07-017-npm-distribution-decision.md, resolved 2026-08-21 as Option B).
+//
+// Everything here is derived from where this module actually is, never from configuration. A stored
+// path is a path that can be wrong.
+import { readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+// .../node_modules/in2-agent-server/dist/core/install.js -> .../node_modules/in2-agent-server
+const MODULE_DIR = path.dirname(fileURLToPath(import.meta.url));
+export const SERVER_ROOT = path.resolve(MODULE_DIR, "..", "..");
+/** The published package name — the one string the updater and the registry check share. */
+export const PACKAGE_NAME = "in2-agent-server";
+// Durable machine state (grants, telemetry outboxes, session workspaces, org mirrors) lives here,
+// NOT under the install. An npm update replaces the package directory wholesale, and `npm i -g`'s
+// prefix moves when the consultant's Node does — state that lived beside the code would silently
+// relocate or vanish on exactly the machines least able to notice.
+export const IN2_HOME = process.env.IN2_HOME?.trim() || path.join(os.homedir(), ".in2-agent");
+// MEMOIZED, and that is a correctness decision, not a performance one: npm installs a new build
+// IN PLACE (close_batch's deferred update), so after it runs the package.json on disk names a
+// version this process is NOT running. A re-read would make a second activation in the same
+// conversation report the new version as current — silently defeating the staleness gate for a
+// run still executing the old modules. The running build cannot change; neither may this answer.
+let cachedInstalledVersion;
+export function installedVersion() {
+    if (cachedInstalledVersion !== undefined)
+        return cachedInstalledVersion;
+    try {
+        const pkg = JSON.parse(readFileSync(path.join(SERVER_ROOT, "package.json"), "utf8"));
+        cachedInstalledVersion = pkg.version ?? "0.0.0";
+    }
+    catch {
+        cachedInstalledVersion = "0.0.0";
+    }
+    return cachedInstalledVersion;
+}
+// True when this process runs from an npm-installed copy — the layout `npm install -g` can replace.
+// A repo checkout is NOT updatable this way (updating it means `git pull`), so the updater refuses
+// rather than pretending.
+export function isNpmInstall() {
+    return SERVER_ROOT.split(path.sep).includes("node_modules");
+}
+// Compare dotted numeric versions. Deliberately not semver-complete: releases are plain numeric
+// triples (0.YYYYMMDD.N), and pulling a comparator dependency into the update path — the one path
+// that must keep working when everything else is broken — is not a trade worth making.
+export function isNewer(candidate, current) {
+    const parse = (v) => v.split(".").map((p) => Number.parseInt(p, 10) || 0);
+    const [a, b] = [parse(candidate), parse(current)];
+    for (let i = 0; i < Math.max(a.length, b.length); i++) {
+        const [x, y] = [a[i] ?? 0, b[i] ?? 0];
+        if (x !== y)
+            return x > y;
+    }
+    return false;
+}