livedesk 0.1.209 → 0.1.211

package/hub/src/agents/agent-audit-store.js

@@ -1,76 +1,93 @@
-import { appendFile, mkdir, readFile } from 'node:fs/promises';
-import crypto from 'node:crypto';
-import os from 'node:os';
-import path from 'node:path';
-
-const MAX_AUDIT_RECORDS = 2000;
-const MAX_AUDIT_FIELD = 4000;
-
-function safeText(value, max = MAX_AUDIT_FIELD) {
-  return String(value ?? '').replace(/[\0\r\n]/g, ' ').trim().slice(0, max);
-}
-
-function redact(value, depth = 0) {
-  if (depth > 4) return '[truncated]';
-  if (Array.isArray(value)) return value.slice(0, 100).map(item => redact(item, depth + 1));
-  if (!value || typeof value !== 'object') return typeof value === 'string' ? safeText(value) : value;
-  return Object.fromEntries(Object.entries(value).slice(0, 100).map(([key, child]) => [
-    key,
-    /content|command|script|token|secret|password|credential|api[-_]?key|authorization/i.test(key) ? '[redacted]' : redact(child, depth + 1)
-  ]));
-}
-
-export function createAgentAuditStore({ dataDir = path.join(os.homedir(), '.livedesk') } = {}) {
-  const filePath = path.join(dataDir, 'agent-audit.jsonl');
-  let records = null;
-  let writeQueue = Promise.resolve();
-
-  async function load() {
-    if (records) return records;
-    try {
-      const lines = (await readFile(filePath, 'utf8')).split(/\r?\n/).filter(Boolean).slice(-MAX_AUDIT_RECORDS);
-      records = lines.map(line => JSON.parse(line)).filter(item => item && typeof item === 'object');
-    } catch {
-      records = [];
-    }
-    return records;
-  }
-
-  function normalize(event = {}) {
-    return {
-      auditId: safeText(event.auditId || crypto.randomUUID(), 100),
-      timestamp: new Date().toISOString(),
-      runId: safeText(event.runId, 100),
-      deviceIds: Array.isArray(event.deviceIds) ? [...new Set(event.deviceIds.map(item => safeText(item, 128)).filter(Boolean))].slice(0, 500) : [],
-      event: safeText(event.event, 100),
-      toolName: safeText(event.toolName, 120),
-      category: safeText(event.category, 80),
-      decision: safeText(event.decision, 40),
-      status: safeText(event.status, 40),
-      permissionMode: safeText(event.permissionMode, 40),
-      policyHash: safeText(event.policyHash, 100),
-      argumentsHash: safeText(event.argumentsHash, 100),
-      details: redact(event.details || {})
-    };
-  }
-
-  return {
-    async record(event) {
-      const record = normalize(event);
-      const current = await load();
-      current.push(record);
-      if (current.length > MAX_AUDIT_RECORDS) current.splice(0, current.length - MAX_AUDIT_RECORDS);
-      writeQueue = writeQueue.then(async () => {
-        await mkdir(path.dirname(filePath), { recursive: true });
-        await appendFile(filePath, `${JSON.stringify(record)}\n`, { encoding: 'utf8', mode: 0o600 });
-      });
-      await writeQueue;
-      return record;
-    },
-    async list({ runId = '', limit = 200 } = {}) {
-      const current = await load();
-      const normalizedLimit = Math.max(1, Math.min(500, Number(limit) || 200));
-      return current.filter(item => !runId || item.runId === String(runId)).slice(-normalizedLimit).reverse();
-    }
-  };
-}
+import { appendFile, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import crypto from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+
+const MAX_AUDIT_RECORDS = 2000;
+const MAX_AUDIT_FILE_RECORDS = 2250;
+const MAX_AUDIT_FIELD = 4000;
+
+function safeText(value, max = MAX_AUDIT_FIELD) {
+  return String(value ?? '').replace(/[\0\r\n]/g, ' ').trim().slice(0, max);
+}
+
+function redact(value, depth = 0) {
+  if (depth > 4) return '[truncated]';
+  if (Array.isArray(value)) return value.slice(0, 100).map(item => redact(item, depth + 1));
+  if (!value || typeof value !== 'object') return typeof value === 'string' ? safeText(value) : value;
+  return Object.fromEntries(Object.entries(value).slice(0, 100).map(([key, child]) => [
+    key,
+    /content|command|script|token|secret|password|credential|api[-_]?key|authorization/i.test(key) ? '[redacted]' : redact(child, depth + 1)
+  ]));
+}
+
+export function createAgentAuditStore({ dataDir = path.join(os.homedir(), '.livedesk') } = {}) {
+  const filePath = path.join(dataDir, 'agent-audit.jsonl');
+  let records = null;
+  let rewriteNeeded = false;
+  let fileRecordCount = 0;
+  let writeQueue = Promise.resolve();
+
+  async function load() {
+    if (records) return records;
+    try {
+      const allLines = (await readFile(filePath, 'utf8')).split(/\r?\n/).filter(Boolean);
+      fileRecordCount = allLines.length;
+      rewriteNeeded = allLines.length > MAX_AUDIT_FILE_RECORDS;
+      records = allLines.slice(-MAX_AUDIT_RECORDS).map(line => JSON.parse(line)).filter(item => item && typeof item === 'object');
+    } catch {
+      records = [];
+    }
+    return records;
+  }
+
+  function normalize(event = {}) {
+    return {
+      auditId: safeText(event.auditId || crypto.randomUUID(), 100),
+      timestamp: new Date().toISOString(),
+      runId: safeText(event.runId, 100),
+      deviceIds: Array.isArray(event.deviceIds) ? [...new Set(event.deviceIds.map(item => safeText(item, 128)).filter(Boolean))].slice(0, 500) : [],
+      event: safeText(event.event, 100),
+      toolName: safeText(event.toolName, 120),
+      category: safeText(event.category, 80),
+      decision: safeText(event.decision, 40),
+      status: safeText(event.status, 40),
+      permissionMode: safeText(event.permissionMode, 40),
+      policyHash: safeText(event.policyHash, 100),
+      argumentsHash: safeText(event.argumentsHash, 100),
+      details: redact(event.details || {})
+    };
+  }
+
+  return {
+    async record(event) {
+      const record = normalize(event);
+      writeQueue = writeQueue.then(async () => {
+        const current = await load();
+        current.push(record);
+        fileRecordCount += 1;
+        if (current.length > MAX_AUDIT_RECORDS) {
+          current.splice(0, current.length - MAX_AUDIT_RECORDS);
+        }
+        if (fileRecordCount > MAX_AUDIT_FILE_RECORDS) rewriteNeeded = true;
+        await mkdir(path.dirname(filePath), { recursive: true });
+        if (rewriteNeeded) {
+          const tempPath = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+          await writeFile(tempPath, `${current.map(item => JSON.stringify(item)).join('\n')}\n`, { encoding: 'utf8', mode: 0o600 });
+          await rename(tempPath, filePath);
+          fileRecordCount = current.length;
+          rewriteNeeded = false;
+        } else {
+          await appendFile(filePath, `${JSON.stringify(record)}\n`, { encoding: 'utf8', mode: 0o600 });
+        }
+      });
+      await writeQueue;
+      return record;
+    },
+    async list({ runId = '', limit = 200 } = {}) {
+      const current = await load();
+      const normalizedLimit = Math.max(1, Math.min(500, Number(limit) || 200));
+      return current.filter(item => !runId || item.runId === String(runId)).slice(-normalizedLimit).reverse();
+    }
+  };
+}

package/hub/src/agents/agent-manager.js

@@ -1,174 +1,175 @@
-import os from 'node:os';
-import path from 'node:path';
-import { AgentSettingsStore, AGENT_PROVIDER_CODEX, AGENT_PROVIDER_OPENCODE_GO } from './agent-settings.js';
-import { createOsSecretStore } from './secret-store.js';
-import { createOpenCodeGoProvider } from './opencode-go-provider.js';
-import { AgentProviderError } from './provider-errors.js';
-import { createCodexAgentRuntime } from './codex-agent-runtime.js';
-
-function maskApiKey(value) {
-  const key = String(value || '');
-  return key.length >= 4 ? `••••${key.slice(-4)}` : '';
-}
-
-function publicCodexStatus(status = {}) {
-  return {
-    installed: status.installed === true,
-    authenticated: ['signed-in', 'not-signed-in'].includes(status.authenticated) ? status.authenticated : 'unknown',
-    status: String(status.status || 'unknown').slice(0, 40),
-    codexPath: String(status.codexPath || '').slice(0, 500),
-    detail: String(status.detail || '').slice(0, 300)
-  };
-}
-
-export function createAgentManager({
-  dataDir = path.join(os.homedir(), '.livedesk'),
-  settingsStore,
-  secretStore,
-  provider,
-  codexRuntime
-} = {}) {
-  const settings = settingsStore || new AgentSettingsStore({ dataDir });
-  const secrets = secretStore || createOsSecretStore({ dataDir });
-  const legacyProvider = provider || createOpenCodeGoProvider();
-  const runtime = codexRuntime;
-  let statusCache = { expiresAt: 0, value: null };
-
-  async function getCodexStatus() {
-    if (!runtime) return { installed: false, authenticated: 'unknown', status: 'unavailable', codexPath: '' };
-    if (statusCache.value && statusCache.expiresAt > Date.now()) return statusCache.value;
-    let value;
-    try {
-      value = publicCodexStatus(await runtime.getStatus());
-    } catch (error) {
-      value = publicCodexStatus({ installed: true, authenticated: 'unknown', status: error?.code || 'security-unavailable', detail: error?.message || 'Codex security isolation is unavailable.' });
-    }
-    statusCache = { value, expiresAt: Date.now() + 10000 };
-    return value;
-  }
-
-  async function publicSettings() {
-    const current = await settings.get();
-    const { codexMaxTurns: _codexMaxTurns, ...exposedSettings } = current;
-    let hasApiKey = false;
-    let apiKeyPreview = '';
-    let secretStoreAvailable = true;
-    if (current.provider === AGENT_PROVIDER_OPENCODE_GO) {
-      try {
-        const key = await secrets.getApiKey(AGENT_PROVIDER_OPENCODE_GO);
-        hasApiKey = Boolean(key);
-        apiKeyPreview = maskApiKey(key);
-      } catch {
-        secretStoreAvailable = false;
-      }
-    }
-    const codex = await getCodexStatus();
-    const securityStatus = runtime?.getSecurityStatus?.() || {
-      isolatedCodexHome: false,
-      restrictedEnvironment: false,
-      livedeskMcpOnly: false,
-      selectedDeviceScopeEnforced: false,
-      failClosed: true,
-      verified: false,
-      state: 'unavailable'
-    };
-    return {
-      ...exposedSettings,
-      hasApiKey,
-      apiKeyPreview,
-      secretStoreAvailable,
-      codexInstallation: codex.installed ? 'installed' : 'not-installed',
-      codexAuth: codex.authenticated,
-      codexStatus: codex.status,
-      codexPath: codex.codexPath,
-      agentWorkspacePath: current.codexWorkingDirectory,
-      securityStatus
-    };
-  }
-
-  async function legacyApiKey() {
-    const key = await secrets.getApiKey(AGENT_PROVIDER_OPENCODE_GO);
-    if (!key) throw new AgentProviderError('agent-api-key-missing', 'OpenCode Go API key is not configured.', { status: 401 });
-    return key;
-  }
-
-  async function currentProvider() {
-    const current = await settings.get();
-    return { current, active: current.provider === AGENT_PROVIDER_CODEX ? runtime : legacyProvider };
-  }
-
-  return {
-    getSettings: publicSettings,
-    async updateSettings(patch = {}) {
-      const nextPatch = { ...patch };
-      const apiKey = typeof nextPatch.apiKey === 'string' ? nextPatch.apiKey.trim() : '';
-      delete nextPatch.apiKey;
-      const current = await settings.get();
-      const requestedProvider = String(nextPatch.provider || current.provider);
-      if (apiKey) {
-        if (requestedProvider !== AGENT_PROVIDER_OPENCODE_GO) {
-          throw new AgentProviderError('agent-codex-does-not-use-api-key', 'Codex authentication is owned by the installed Codex CLI.', { status: 400 });
-        }
-        await secrets.setApiKey(AGENT_PROVIDER_OPENCODE_GO, apiKey);
-      }
-      await settings.update(nextPatch);
-      statusCache = { expiresAt: 0, value: null };
-      return publicSettings();
-    },
-    async resetSettings() {
-      await settings.reset();
-      statusCache = { expiresAt: 0, value: null };
-      return publicSettings();
-    },
-    async deleteApiKey() {
-      await secrets.deleteApiKey(AGENT_PROVIDER_OPENCODE_GO);
-      return publicSettings();
-    },
-    async getModels() {
-      const { current, active } = await currentProvider();
-      if (current.provider === AGENT_PROVIDER_CODEX) {
-        return [{ id: '', name: 'Codex default', protocol: 'codex-sdk', available: true, capabilities: { supportsReasoningLevel: true, supportsStreaming: true, supportsTools: true } }];
-      }
-      return active.getModels(current, await legacyApiKey());
-    },
-    async testConnection() {
-      const { current, active } = await currentProvider();
-      if (current.provider === AGENT_PROVIDER_CODEX) {
-        if (!active) throw new AgentProviderError('codex-sdk-not-installed', 'Codex SDK is not installed.', { status: 503 });
-        statusCache = { expiresAt: 0, value: null };
-        return active.testConnection();
-      }
-      return active.testConnection(current, await legacyApiKey());
-    },
-    async createPlan(input) {
-      const { current, active } = await currentProvider();
-      if (!current.enabled) throw new AgentProviderError('agent-ai-disabled', 'Agent AI is disabled in Settings.', { status: 409 });
-      if (current.provider === AGENT_PROVIDER_CODEX) {
-        throw new AgentProviderError('agent-codex-run-required', 'Codex runs use the LiveDesk tool loop.', { status: 409 });
-      }
-      return active.createPlan(input, current, await legacyApiKey());
-    },
-    async createSummary(input) {
-      const { current, active } = await currentProvider();
-      if (!current.enabled || !current.generateSummary) throw new AgentProviderError('agent-summary-disabled', 'Agent summaries are disabled in Settings.', { status: 409 });
-      if (current.provider === AGENT_PROVIDER_CODEX) {
-        const source = input && typeof input === 'object' ? input : {};
-        const results = Array.isArray(source.results) ? source.results : [];
-        return { summary: String(results.length ? `${source.completed || 0} completed, ${source.failed || 0} failed.` : 'LiveDesk Agent run completed.').slice(0, 1200), modelId: current.codexModelId || 'Codex default' };
-      }
-      const source = input && typeof input === 'object' ? input : {};
-      const results = Array.isArray(source.results) ? source.results : [];
-      const safeResults = current.includeRawDeviceDetails
-        ? results.map(result => ({ deviceName: String(result?.deviceName || '').slice(0, 120), status: String(result?.status || '').slice(0, 40), result: String(result?.result || '').slice(0, 1200), error: String(result?.error || '').slice(0, 500) }))
-        : results.map(result => ({ deviceName: String(result?.deviceName || '').slice(0, 120), status: String(result?.status || '').slice(0, 40), hasResult: Boolean(result?.result), hasError: Boolean(result?.error) }));
-      return active.createSummary({ instruction: String(source.instruction || '').slice(0, 500), operation: String(source.operation || '').slice(0, 80), summary: { total: Number(source.total || results.length), completed: Number(source.completed || 0), failed: Number(source.failed || 0), results: safeResults } }, current, await legacyApiKey());
-    },
-    async startRun(input) {
-      const current = await settings.get();
-      if (current.provider !== AGENT_PROVIDER_CODEX || !runtime) throw new AgentProviderError('agent-codex-not-active', 'Codex SDK is not the active Agent provider.', { status: 409 });
-      return runtime.start(input);
-    },
-    getRun(runId) { return runtime?.get(runId) || null; },
-    cancelRun(runId) { return runtime?.cancel(runId) || null; }
-  };
-}
+import os from 'node:os';
+import path from 'node:path';
+import { AgentSettingsStore, AGENT_PROVIDER_CODEX, AGENT_PROVIDER_OPENCODE_GO } from './agent-settings.js';
+import { createOsSecretStore } from './secret-store.js';
+import { createOpenCodeGoProvider } from './opencode-go-provider.js';
+import { AgentProviderError } from './provider-errors.js';
+import { createCodexAgentRuntime } from './codex-agent-runtime.js';
+
+function maskApiKey(value) {
+  const key = String(value || '');
+  return key.length >= 4 ? `••••${key.slice(-4)}` : '';
+}
+
+function publicCodexStatus(status = {}) {
+  return {
+    installed: status.installed === true,
+    authenticated: ['signed-in', 'not-signed-in'].includes(status.authenticated) ? status.authenticated : 'unknown',
+    status: String(status.status || 'unknown').slice(0, 40),
+    codexPath: String(status.codexPath || '').slice(0, 500),
+    detail: String(status.detail || '').slice(0, 300)
+  };
+}
+
+export function createAgentManager({
+  dataDir = path.join(os.homedir(), '.livedesk'),
+  settingsStore,
+  secretStore,
+  provider,
+  codexRuntime
+} = {}) {
+  const settings = settingsStore || new AgentSettingsStore({ dataDir });
+  const secrets = secretStore || createOsSecretStore({ dataDir });
+  const legacyProvider = provider || createOpenCodeGoProvider();
+  const runtime = codexRuntime;
+  let statusCache = { expiresAt: 0, value: null };
+
+  async function getCodexStatus() {
+    if (!runtime) return { installed: false, authenticated: 'unknown', status: 'unavailable', codexPath: '' };
+    if (statusCache.value && statusCache.expiresAt > Date.now()) return statusCache.value;
+    let value;
+    try {
+      value = publicCodexStatus(await runtime.getStatus());
+    } catch (error) {
+      value = publicCodexStatus({ installed: true, authenticated: 'unknown', status: error?.code || 'security-unavailable', detail: error?.message || 'Codex security isolation is unavailable.' });
+    }
+    statusCache = { value, expiresAt: Date.now() + 10000 };
+    return value;
+  }
+
+  async function publicSettings() {
+    const current = await settings.get();
+    const { codexMaxTurns: _codexMaxTurns, ...exposedSettings } = current;
+    let hasApiKey = false;
+    let apiKeyPreview = '';
+    let secretStoreAvailable = true;
+    if (current.provider === AGENT_PROVIDER_OPENCODE_GO) {
+      try {
+        const key = await secrets.getApiKey(AGENT_PROVIDER_OPENCODE_GO);
+        hasApiKey = Boolean(key);
+        apiKeyPreview = maskApiKey(key);
+      } catch {
+        secretStoreAvailable = false;
+      }
+    }
+    const codex = await getCodexStatus();
+    const securityStatus = runtime?.getSecurityStatus?.() || {
+      isolatedCodexHome: false,
+      restrictedEnvironment: false,
+      livedeskMcpOnly: false,
+      selectedDeviceScopeEnforced: false,
+      failClosed: true,
+      verified: false,
+      state: 'unavailable'
+    };
+    return {
+      ...exposedSettings,
+      hasApiKey,
+      apiKeyPreview,
+      secretStoreAvailable,
+      codexInstallation: codex.installed ? 'installed' : 'not-installed',
+      codexAuth: codex.authenticated,
+      codexStatus: codex.status,
+      codexPath: codex.codexPath,
+      agentWorkspacePath: current.codexWorkingDirectory,
+      securityStatus
+    };
+  }
+
+  async function legacyApiKey() {
+    const key = await secrets.getApiKey(AGENT_PROVIDER_OPENCODE_GO);
+    if (!key) throw new AgentProviderError('agent-api-key-missing', 'OpenCode Go API key is not configured.', { status: 401 });
+    return key;
+  }
+
+  async function currentProvider() {
+    const current = await settings.get();
+    return { current, active: current.provider === AGENT_PROVIDER_CODEX ? runtime : legacyProvider };
+  }
+
+  return {
+    getSettings: publicSettings,
+    async updateSettings(patch = {}) {
+      const nextPatch = { ...patch };
+      const apiKey = typeof nextPatch.apiKey === 'string' ? nextPatch.apiKey.trim() : '';
+      delete nextPatch.apiKey;
+      const current = await settings.get();
+      const requestedProvider = String(nextPatch.provider || current.provider);
+      if (apiKey) {
+        if (requestedProvider !== AGENT_PROVIDER_OPENCODE_GO) {
+          throw new AgentProviderError('agent-codex-does-not-use-api-key', 'Codex authentication is owned by the installed Codex CLI.', { status: 400 });
+        }
+        await secrets.setApiKey(AGENT_PROVIDER_OPENCODE_GO, apiKey);
+      }
+      await settings.update(nextPatch);
+      statusCache = { expiresAt: 0, value: null };
+      return publicSettings();
+    },
+    async resetSettings() {
+      await settings.reset();
+      statusCache = { expiresAt: 0, value: null };
+      return publicSettings();
+    },
+    async deleteApiKey() {
+      await secrets.deleteApiKey(AGENT_PROVIDER_OPENCODE_GO);
+      return publicSettings();
+    },
+    async getModels() {
+      const { current, active } = await currentProvider();
+      if (current.provider === AGENT_PROVIDER_CODEX) {
+        return [{ id: '', name: 'Codex default', protocol: 'codex-sdk', available: true, capabilities: { supportsReasoningLevel: true, supportsStreaming: true, supportsTools: true } }];
+      }
+      return active.getModels(current, await legacyApiKey());
+    },
+    async testConnection() {
+      const { current, active } = await currentProvider();
+      if (current.provider === AGENT_PROVIDER_CODEX) {
+        if (!active) throw new AgentProviderError('codex-sdk-not-installed', 'Codex SDK is not installed.', { status: 503 });
+        statusCache = { expiresAt: 0, value: null };
+        return active.testConnection();
+      }
+      return active.testConnection(current, await legacyApiKey());
+    },
+    async createPlan(input) {
+      const { current, active } = await currentProvider();
+      if (!current.enabled) throw new AgentProviderError('agent-ai-disabled', 'Agent AI is disabled in Settings.', { status: 409 });
+      if (current.provider === AGENT_PROVIDER_CODEX) {
+        throw new AgentProviderError('agent-codex-run-required', 'Codex runs use the LiveDesk tool loop.', { status: 409 });
+      }
+      return active.createPlan(input, current, await legacyApiKey());
+    },
+    async createSummary(input) {
+      const { current, active } = await currentProvider();
+      if (!current.enabled || !current.generateSummary) throw new AgentProviderError('agent-summary-disabled', 'Agent summaries are disabled in Settings.', { status: 409 });
+      if (current.provider === AGENT_PROVIDER_CODEX) {
+        const source = input && typeof input === 'object' ? input : {};
+        const results = Array.isArray(source.results) ? source.results : [];
+        return { summary: String(results.length ? `${source.completed || 0} completed, ${source.failed || 0} failed.` : 'LiveDesk Agent run completed.').slice(0, 1200), modelId: current.codexModelId || 'Codex default' };
+      }
+      const source = input && typeof input === 'object' ? input : {};
+      const results = Array.isArray(source.results) ? source.results : [];
+      const safeResults = current.includeRawDeviceDetails
+        ? results.map(result => ({ deviceName: String(result?.deviceName || '').slice(0, 120), status: String(result?.status || '').slice(0, 40), result: String(result?.result || '').slice(0, 1200), error: String(result?.error || '').slice(0, 500) }))
+        : results.map(result => ({ deviceName: String(result?.deviceName || '').slice(0, 120), status: String(result?.status || '').slice(0, 40), hasResult: Boolean(result?.result), hasError: Boolean(result?.error) }));
+      return active.createSummary({ instruction: String(source.instruction || '').slice(0, 500), operation: String(source.operation || '').slice(0, 80), summary: { total: Number(source.total || results.length), completed: Number(source.completed || 0), failed: Number(source.failed || 0), results: safeResults } }, current, await legacyApiKey());
+    },
+    async startRun(input) {
+      const current = await settings.get();
+      if (current.provider !== AGENT_PROVIDER_CODEX || !runtime) throw new AgentProviderError('agent-codex-not-active', 'Codex SDK is not the active Agent provider.', { status: 409 });
+      return runtime.start(input);
+    },
+    getRun(runId) { return runtime?.get(runId) || null; },
+    cancelRun(runId) { return runtime?.cancel(runId) || null; },
+    cancelAllRuns() { return runtime?.cancelAll?.() || 0; }
+  };
+}