loadout-ai 0.1.0

package/dist/src/core/agent-versions.js

@@ -0,0 +1,131 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { detectAgents, executableCandidates, userHome } from "./paths.js";
+const execFileAsync = promisify(execFile);
+function versionEnvironment() {
+    const names = [
+        "PATH",
+        "Path",
+        "PATHEXT",
+        "SystemRoot",
+        "WINDIR",
+        "TMPDIR",
+        "TMP",
+        "TEMP",
+    ];
+    return {
+        ...Object.fromEntries(names.flatMap((name) => process.env[name] === undefined ? [] : [[name, process.env[name]]])),
+        HOME: userHome(),
+        USERPROFILE: userHome(),
+        NO_COLOR: "1",
+    };
+}
+const defaultRunner = async (command, args, options) => {
+    try {
+        const result = await execFileAsync(command, [...args], {
+            env: options.env,
+            timeout: options.timeoutMs,
+            windowsHide: true,
+            maxBuffer: 64 * 1024,
+        });
+        return { stdout: result.stdout, stderr: result.stderr, exitCode: 0 };
+    }
+    catch (error) {
+        const failure = error;
+        return {
+            stdout: failure.stdout ?? "",
+            stderr: failure.killed
+                ? "version command timed out"
+                : (failure.stderr ?? ""),
+            exitCode: typeof failure.code === "number" ? failure.code : 1,
+        };
+    }
+};
+export function parseAgentVersion(output) {
+    const bounded = output.trim().slice(0, 1024);
+    const version = bounded.match(/(?:^|[^0-9A-Za-z.])v?(\d+\.\d+(?:\.\d+)?(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?)(?:$|[^0-9A-Za-z.-])/);
+    return version?.[1];
+}
+export async function inspectAgentVersions(options = {}) {
+    const agents = options.agents ?? (await detectAgents());
+    const runner = options.runner ?? defaultRunner;
+    const env = versionEnvironment();
+    return Promise.all(agents.map(async (agent) => {
+        if (!agent.installed)
+            return {
+                agent: agent.id,
+                displayName: agent.displayName,
+                installed: false,
+                ...(agent.binary ? { binary: agent.binary } : {}),
+                status: "not-installed",
+                message: "Agent is not detected.",
+            };
+        if (!agent.binary)
+            return {
+                agent: agent.id,
+                displayName: agent.displayName,
+                installed: true,
+                status: "no-version-command",
+                message: "Agent is detected from local configuration, but no reviewed CLI version command is available.",
+            };
+        const candidates = executableCandidates(agent.binary, options.platform ?? process.platform);
+        const attempts = [];
+        for (const candidate of candidates) {
+            const result = await runner(candidate, ["--version"], {
+                env,
+                timeoutMs: options.timeoutMs ?? 5_000,
+            });
+            attempts.push({ command: candidate, ...result });
+            const output = `${result.stdout}\n${result.stderr}`;
+            const version = parseAgentVersion(output);
+            if (result.exitCode === 0 && version) {
+                const prerelease = version.includes("-");
+                return {
+                    agent: agent.id,
+                    displayName: agent.displayName,
+                    installed: true,
+                    binary: candidate,
+                    status: "detected",
+                    version,
+                    releaseChannel: prerelease ? "prerelease" : "stable",
+                    command: [candidate, "--version"],
+                    message: prerelease
+                        ? "Local prerelease detected. Compatibility notices may be incomplete unless they explicitly include prereleases."
+                        : "Local version detected. No latest-version or compatibility claim is made without a signed compatibility feed.",
+                };
+            }
+        }
+        const timedOut = attempts.find((attempt) => /timed out|timeout/i.test(attempt.stderr));
+        const failed = attempts.find((attempt) => attempt.exitCode !== 0);
+        const last = attempts.at(-1);
+        const errorKind = timedOut
+            ? "timeout"
+            : failed
+                ? "command-failed"
+                : "malformed-output";
+        return {
+            agent: agent.id,
+            displayName: agent.displayName,
+            installed: true,
+            binary: last.command,
+            status: "error",
+            command: [last.command, "--version"],
+            errorKind,
+            message: errorKind === "timeout"
+                ? `Version command timed out after ${options.timeoutMs ?? 5_000}ms.`
+                : errorKind === "command-failed"
+                    ? `Version command failed with exit code ${failed.exitCode}.`
+                    : "Version command returned no recognized version.",
+        };
+    }));
+}
+export function formatAgentVersions(items) {
+    return [
+        "Agent versions",
+        ...items.map((item) => {
+            const marker = item.status === "detected" ? "✓" : item.status === "error" ? "!" : "•";
+            return `${marker} ${item.displayName}: ${item.version ?? item.status} — ${item.message}`;
+        }),
+        "Compatibility updates require a separately verified signed feed; this command does not guess from model memory.",
+    ].join("\n");
+}

package/dist/src/core/api.js

@@ -0,0 +1,90 @@
+import { createServer, } from "node:http";
+import { loadEffectiveCatalog, rankCatalog } from "./catalog.js";
+import { detectAgents } from "./paths.js";
+import { buildUpdatePlan } from "./update.js";
+import { buildHealthReport } from "./health.js";
+function json(response, statusCode, body) {
+    const payload = JSON.stringify(body);
+    response.writeHead(statusCode, {
+        "content-type": "application/json; charset=utf-8",
+        "content-length": Buffer.byteLength(payload),
+        "cache-control": "no-store",
+    });
+    response.end(payload);
+}
+function success(data) {
+    return { ok: true, data };
+}
+function errorBody(code, message) {
+    return { ok: false, error: { code, message } };
+}
+function pathOf(request) {
+    try {
+        return new URL(request.url ?? "/", "http://127.0.0.1").pathname;
+    }
+    catch {
+        return "/";
+    }
+}
+export async function startApiServer(options = {}) {
+    const host = options.host ?? "127.0.0.1";
+    const port = options.port ?? 0;
+    if (host !== "127.0.0.1" && host !== "::1") {
+        throw new Error("Loadout API is loopback-only; use 127.0.0.1 or ::1");
+    }
+    const status = options.status ?? (async () => detectAgents());
+    const catalog = options.catalog ?? (async () => rankCatalog(await loadEffectiveCatalog()));
+    const updates = options.updates ?? (async () => buildUpdatePlan());
+    const health = options.health ?? (async () => buildHealthReport());
+    const server = createServer(async (request, response) => {
+        if (request.method !== "GET") {
+            json(response, 405, errorBody("METHOD_NOT_ALLOWED", "Only GET requests are supported."));
+            return;
+        }
+        const path = pathOf(request);
+        const handler = path === "/status"
+            ? status
+            : path === "/catalog"
+                ? catalog
+                : path === "/health"
+                    ? health
+                    : path === "/update" || path === "/updates"
+                        ? updates
+                        : undefined;
+        if (!handler) {
+            json(response, 404, errorBody("NOT_FOUND", "Endpoint not found."));
+            return;
+        }
+        try {
+            json(response, 200, success(await handler()));
+        }
+        catch (cause) {
+            const message = cause instanceof Error ? cause.message : String(cause);
+            json(response, 500, errorBody("INTERNAL_ERROR", message));
+        }
+    });
+    await new Promise((resolve, reject) => {
+        const onError = (cause) => {
+            server.off("listening", onListening);
+            reject(cause);
+        };
+        const onListening = () => {
+            server.off("error", onError);
+            resolve();
+        };
+        server.once("error", onError);
+        server.once("listening", onListening);
+        server.listen(port, host);
+    });
+    const address = server.address();
+    if (!address || typeof address === "string") {
+        await new Promise((resolve) => server.close(() => resolve()));
+        throw new Error("Could not determine API server address");
+    }
+    return {
+        server,
+        host,
+        port: address.port,
+        close: () => new Promise((resolve, reject) => server.close((cause) => (cause ? reject(cause) : resolve()))),
+    };
+}

package/dist/src/core/atomic-file.js

@@ -0,0 +1,22 @@
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+/**
+ * Replace one file using a temporary sibling and rename. Keeping the temporary
+ * file in the destination directory makes the replacement a single filesystem
+ * operation on supported local filesystems, instead of exposing a truncated
+ * JSON file while it is being written.
+ */
+export async function writeFileAtomically(path, content, mode = 0o600) {
+    const directory = dirname(path);
+    await mkdir(directory, { recursive: true });
+    const temporary = join(directory, `.${basename(path)}.loadout-${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, content, { mode });
+        await rename(temporary, path);
+    }
+    catch (error) {
+        await rm(temporary, { force: true });
+        throw error;
+    }
+}

package/dist/src/core/audit.js

@@ -0,0 +1,174 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { formatSchemaError, loadoutLockfileSchema } from "../shared/schemas.js";
+import { readManifest } from "./manifest.js";
+import { readInstallState } from "./state.js";
+import { managedFileReadPath } from "./active-set.js";
+export function parseLockfile(value) {
+    const result = loadoutLockfileSchema.safeParse(value);
+    if (!result.success)
+        throw new Error(`Lockfile schema is invalid: ${formatSchemaError(result.error)}`);
+    return result.data;
+}
+export async function readLockfile(path = "loadout.lock") {
+    try {
+        return parseLockfile(JSON.parse(await readFile(resolve(path), "utf8")));
+    }
+    catch (error) {
+        throw new Error(`Invalid Loadout lockfile at ${resolve(path)}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function expectedPackages(manifest) {
+    return manifest.packages
+        .filter((pkg) => pkg.enabled !== false)
+        .map((pkg) => pkg.id)
+        .sort();
+}
+export async function auditLoadout(manifestPath = "loadout.json", lockPath = "loadout.lock") {
+    const [manifest, lockfile, state] = await Promise.all([
+        readManifest(manifestPath),
+        readLockfile(lockPath),
+        readInstallState(),
+    ]);
+    const findings = [];
+    if (lockfile.manifestName !== manifest.name)
+        findings.push({
+            level: "error",
+            code: "manifest-name",
+            message: `Lockfile belongs to '${lockfile.manifestName}', not '${manifest.name}'.`,
+        });
+    const expected = expectedPackages(manifest);
+    const locked = lockfile.packages.map((pkg) => pkg.id).sort();
+    for (const id of expected.filter((id) => !locked.includes(id)))
+        findings.push({
+            level: "error",
+            code: "missing-lock",
+            message: `Package '${id}' is enabled but missing from the lockfile.`,
+        });
+    for (const id of locked.filter((id) => !expected.includes(id)))
+        findings.push({
+            level: "error",
+            code: "extra-lock",
+            message: `Lockfile contains package '${id}' that is not enabled in the manifest.`,
+        });
+    const stateById = new Map(state.installs.map((entry) => [entry.packageId, entry]));
+    for (const lockedPackage of lockfile.packages) {
+        const manifestPackage = manifest.packages.find((pkg) => pkg.id === lockedPackage.id);
+        if (manifestPackage &&
+            JSON.stringify(manifestPackage.source) !==
+                JSON.stringify(lockedPackage.source))
+            findings.push({
+                level: "error",
+                code: "source-mismatch",
+                message: `Package '${lockedPackage.id}' source differs between manifest and lockfile.`,
+            });
+        const installed = stateById.get(lockedPackage.id);
+        if (!installed) {
+            findings.push({
+                level: "warning",
+                code: "not-installed",
+                message: `Package '${lockedPackage.id}' is locked but not installed on this machine.`,
+            });
+            continue;
+        }
+        if ((lockedPackage.resolvedCommit ?? "") !== (installed.resolvedCommit ?? ""))
+            findings.push({
+                level: "error",
+                code: "commit-mismatch",
+                message: `Package '${lockedPackage.id}' installed revision differs from the lockfile.`,
+            });
+        const lockedFiles = new Map(lockedPackage.files.map((file) => [file.path, file.sha256]));
+        const installedFiles = new Set(installed.files.map((file) => file.path));
+        for (const path of lockedFiles.keys())
+            if (!installedFiles.has(path))
+                findings.push({
+                    level: "error",
+                    code: "missing-state-file",
+                    message: `Lockfile-managed path is missing from installed state: ${path}`,
+                });
+        for (const file of installed.files) {
+            if (lockedFiles.get(file.path) !== file.sha256)
+                findings.push({
+                    level: "error",
+                    code: "state-lock-mismatch",
+                    message: `Managed file record differs from lockfile: ${file.path}`,
+                });
+            try {
+                const digest = createHash("sha256")
+                    .update(await readFile(managedFileReadPath(installed.packageId, file.path, state.activations ?? [])))
+                    .digest("hex");
+                if (digest !== file.sha256)
+                    findings.push({
+                        level: "error",
+                        code: "file-drift",
+                        message: `Managed file changed or is corrupt: ${file.path}`,
+                    });
+            }
+            catch {
+                findings.push({
+                    level: "error",
+                    code: "file-missing",
+                    message: `Managed file is missing: ${file.path}`,
+                });
+            }
+        }
+    }
+    const stateMcp = state.mcpInstalls ?? [];
+    for (const lockedMcp of lockfile.mcpServers ?? []) {
+        const installed = stateMcp.find((entry) => entry.packageId === lockedMcp.packageId &&
+            entry.configPath === lockedMcp.configPath &&
+            entry.serverName === lockedMcp.serverName);
+        if (!installed) {
+            findings.push({
+                level: "error",
+                code: "missing-mcp-state",
+                message: `MCP server '${lockedMcp.serverName}' for '${lockedMcp.packageId}' is missing from installed state.`,
+            });
+            continue;
+        }
+        if (installed.fingerprint !== lockedMcp.fingerprint)
+            findings.push({
+                level: "error",
+                code: "mcp-lock-mismatch",
+                message: `MCP server '${lockedMcp.serverName}' state differs from the lockfile.`,
+            });
+        try {
+            const config = JSON.parse(await readFile(lockedMcp.configPath, "utf8"));
+            const fingerprint = createHash("sha256")
+                .update(JSON.stringify(config.mcpServers?.[lockedMcp.serverName] ?? null))
+                .digest("hex");
+            if (fingerprint !== lockedMcp.fingerprint)
+                findings.push({
+                    level: "error",
+                    code: "mcp-drift",
+                    message: `MCP server '${lockedMcp.serverName}' changed or is missing in ${lockedMcp.configPath}.`,
+                });
+        }
+        catch {
+            findings.push({
+                level: "error",
+                code: "mcp-config-missing",
+                message: `MCP configuration is missing or invalid: ${lockedMcp.configPath}`,
+            });
+        }
+    }
+    if (!findings.length)
+        findings.push({
+            level: "ok",
+            code: "reproducible",
+            message: "Manifest, lockfile, installed state, and managed file hashes agree.",
+        });
+    return {
+        valid: !findings.some((finding) => finding.level === "error"),
+        manifest: resolve(manifestPath),
+        lockfile: resolve(lockPath),
+        findings,
+    };
+}
+export function formatAuditReport(report) {
+    return [
+        `Loadout audit: ${report.valid ? "PASS" : "FAIL"}`,
+        ...report.findings.map((finding) => `${finding.level === "ok" ? "✓" : finding.level === "warning" ? "!" : "✗"} ${finding.message}`),
+    ].join("\n");
+}