my-durable 0.0.0-stage → 0.0.2

package/apps/dpi-backend/src/main.ts

@@ -0,0 +1,76 @@
+// dpi-backend: one device of the Durable Agent Network.
+import express from "express";
+import { assertLimitsConfig } from "../../dpi-sdk/src/protocol/limits.js";
+import { createServer } from "node:http";
+import { networkInterfaces } from "node:os";
+import { loadConfig } from "./config.js";
+import { Store } from "./store.js";
+import { bearerAuth } from "./auth.js";
+import { errorMiddleware } from "./errors.js";
+import { v1 } from "./routes.js";
+import { DevicePairing } from "./pairing.js";
+import { DeviceConnector, readCaPem } from "./tunnel.js";
+
+assertLimitsConfig();
+
+const config = loadConfig();
+const store = await Store.open({
+  dataDir: config.dataDir,
+  startDirs: config.startDirs,
+  name: config.name,
+  provider: config.provider,
+});
+
+const app = express();
+app.disable("x-powered-by");
+app.get("/healthz", (_req, res) => res.json({ ok: true }));
+const pairing = new DevicePairing(store, config.home, config.name, process.env.DPI_HUB_URL, {
+  // Forced hub change (P-5): once the new pairing is persisted the OLD
+  // connector is stopped — never two live tunnels for one device, and the old
+  // hub keeps its tunnel until a replacement exists.
+  stopOldConnector: () => connector.stop("re-pairing: hub changed"),
+  // Pairing success (P2-15/20 glue, F05): adopt the freshly persisted pairing
+  // file — reload() swaps the RUNNING connector onto the new epoch instead of
+  // no-op'ing with stale RAM credential/tuple.
+  onPaired: () => connector.reload("re-paired"),
+});
+// One connector per daemon, from the persisted pairing file (P2-13). DPI_HUB_CA
+// narrows TLS trust for the reference profile; verification is never disabled.
+const connector = new DeviceConnector(
+  config.home,
+  readCaPem(process.env.DPI_HUB_CA),
+  {
+    // The local pairing view follows what the hub did to this pairing.
+    onRevoked: (epoch, reason) => pairing.markRevoked(reason, epoch),
+    onRotated: (file) => pairing.markRotated(file),
+  },
+  { baseUrl: `http://${config.host === "0.0.0.0" ? "127.0.0.1" : config.host}:${config.port}`, token: config.token },
+);
+connector.start();
+app.use("/v1", bearerAuth(config.token), express.json({ limit: "256kb" }), v1(store, pairing, connector));
+app.use((_req, res) => res.status(404).json({ error: { code: "not_found", message: "Route not found" } }));
+app.use(errorMiddleware);
+
+const server = createServer(app);
+server.keepAliveTimeout = 65_000;
+server.listen(config.port, config.host, () => {
+  console.log(`dpi-backend "${config.name}" (uid ${store.uid}) on http://${config.host}:${config.port}`);
+  console.log(`data: ${config.dataDir}  start dirs: ${config.startDirs.join(", ")}  provider: ${config.provider}`);
+  if (config.host === "0.0.0.0")
+    for (const addresses of Object.values(networkInterfaces()))
+      for (const a of addresses ?? [])
+        if (a.family === "IPv4" && !a.internal) console.log(`LAN: http://${a.address}:${config.port}`);
+});
+
+let closing = false;
+const shutdown = async () => {
+  if (closing) return;
+  closing = true;
+  connector.stop("backend shutdown"); // readers/pending ops before storage closes
+  server.close();
+  server.closeAllConnections();
+  await store.close();
+  process.exit(0);
+};
+process.on("SIGTERM", () => void shutdown());
+process.on("SIGINT", () => void shutdown());

package/apps/dpi-backend/src/model-catalog.ts

@@ -0,0 +1,180 @@
+// Source: https://agenticengineer.com/model-stack, retrieved 2026-10-05.
+// Active S+, S, A and B models, matched to https://openrouter.ai/api/v1/models.
+// Gemini 4 Argon is rolling out and has no OpenRouter listing at this snapshot.
+export const curatedModels = [
+  {
+    id: "anthropic/claude-opus-5.5",
+    name: "Claude Opus 5.5",
+    tier: "S+",
+    icon: "anthropic.png",
+  },
+  {
+    id: "anthropic/claude-sonnet-5.5",
+    name: "Claude Sonnet 5.5",
+    tier: "S+",
+    icon: "anthropic.png",
+  },
+  {
+    id: "anthropic/claude-fable-5.1",
+    name: "Claude Fable 5.1",
+    tier: "S+",
+    icon: "anthropic.png",
+  },
+  {
+    id: "openai/gpt-6-astra",
+    name: "GPT-6 Astra",
+    tier: "S+",
+    icon: "openai.png",
+  },
+  {
+    id: "anthropic/claude-opus-5",
+    name: "Opus 5",
+    tier: "S+",
+    icon: "anthropic.png",
+  },
+  {
+    id: "openai/gpt-6.1-sol",
+    name: "GPT-6.1 Sol",
+    tier: "S+",
+    icon: "openai.png",
+  },
+  {
+    id: "anthropic/claude-fable-5",
+    name: "Fable 5",
+    tier: "S",
+    icon: "anthropic.png",
+  },
+  {
+    id: "meta/muse-spark-1.3",
+    name: "Muse Spark 1.3",
+    tier: "S",
+    icon: "meta.png",
+  },
+  {
+    id: "openai/gpt-6-sol",
+    name: "GPT-6 Sol",
+    tier: "S",
+    icon: "openai.png",
+  },
+  {
+    id: "x-ai/grok-4.7",
+    name: "Grok 4.7",
+    tier: "S",
+    icon: "grok.png",
+  },
+  {
+    id: "xiaomi/mimo-v2.6-pro",
+    name: "MiMo-V2.6-Pro",
+    tier: "S",
+    icon: "xiaomi.png",
+  },
+  {
+    id: "x-ai/grok-4.6",
+    name: "Grok 4.6",
+    tier: "S",
+    icon: "grok.png",
+  },
+  {
+    id: "z-ai/glm-5.3",
+    name: "GLM-5.3",
+    tier: "A",
+    icon: "zai.png",
+  },
+  {
+    id: "moonshotai/kimi-k3",
+    name: "Kimi K3",
+    tier: "A",
+    icon: "kimi.png",
+  },
+  {
+    id: "openai/gpt-5.6-terra",
+    name: "GPT 5.6 Terra",
+    tier: "A",
+    icon: "openai.png",
+  },
+  {
+    id: "google/gemini-3.8-flash",
+    name: "Gemini 3.8 Flash",
+    tier: "A",
+    icon: "gemini.png",
+  },
+  {
+    id: "qwen/qwen3.8-2.4t-a95b",
+    name: "Qwen3.8-2.4T-A95B",
+    tier: "A",
+    icon: "qwen.png",
+  },
+  {
+    id: "deepseek/deepseek-v4.1-flash",
+    name: "DeepSeek V4.1 Flash",
+    tier: "A",
+    icon: "deepseek.png",
+  },
+  {
+    id: "google/gemini-3.7-flash",
+    name: "Gemini 3.7 Flash",
+    tier: "A",
+    icon: "gemini.png",
+  },
+  {
+    id: "anthropic/claude-sonnet-5",
+    name: "Sonnet 5",
+    tier: "A",
+    icon: "anthropic.png",
+  },
+  {
+    id: "openai/gpt-6-luna",
+    name: "GPT-6 Luna",
+    tier: "A",
+    icon: "openai.png",
+  },
+  {
+    id: "xiaomi/mimo-v2.6-flash",
+    name: "MiMo-V2.6-Flash",
+    tier: "A",
+    icon: "xiaomi.png",
+  },
+  {
+    id: "openai/gpt-5.6-luna",
+    name: "GPT 5.6 Luna",
+    tier: "A",
+    icon: "openai.png",
+  },
+  {
+    id: "deepseek/deepseek-v4-pro-0813",
+    name: "DeepSeek V4 Pro 0813",
+    tier: "A",
+    icon: "deepseek.png",
+  },
+  {
+    id: "z-ai/glm-5.2",
+    name: "GLM-5.2",
+    tier: "A",
+    icon: "zai.png",
+  },
+  {
+    id: "z-ai/glm-5.3-flash",
+    name: "GLM-5.3-Flash",
+    tier: "B",
+    icon: "zai.png",
+  },
+  {
+    id: "google/gemini-3.1-pro-preview",
+    name: "Gemini 3.1 Pro",
+    tier: "B",
+    icon: "gemini.png",
+  },
+  {
+    id: "minimax/minimax-m3",
+    name: "MiniMax-M3",
+    tier: "B",
+    icon: "minimax.png",
+  },
+  {
+    id: "google/gemini-3.5-flash-lite",
+    name: "Gemini 3.5 Flash-Lite",
+    tier: "B",
+    icon: "gemini.png",
+  },
+] as const;
+export const defaultModelId = "anthropic/claude-sonnet-5.5";

package/apps/dpi-backend/src/pairing-files.ts

@@ -0,0 +1,142 @@
+/**
+ * Atomic secret-file primitives for the device pairing state (spec 03 §7).
+ *
+ * Order is normative: temp file 0600 in the SAME directory → write + fsync →
+ * rename → fsync the directory. A file is only reported as persisted after
+ * every step. Callers must never ACK or use a credential before writeAtomic
+ * resolves, and async latecomers must re-check the active operation before
+ * committing (see pairing.ts).
+ */
+import { chmodSync, closeSync, fsyncSync, openSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { ensurePrivateDir } from "../../dpi-sdk/src/node/private-dir.js";
+
+export { ensurePrivateDir };
+
+/** Write `contents` to `path` atomically (temp → fsync → rename → dir fsync). */
+export function writeAtomic(path: string, contents: string): void {
+  ensurePrivateDir(dirname(path));
+  replaceFileAtomic(path, contents);
+}
+
+/** The write itself, for callers that have already judged the directory (and must not have it chmod'ed). */
+export function replaceFileAtomic(path: string, contents: string): void {
+  const dir = dirname(path);
+  const temp = join(dir, `.${basename(path)}.tmp-${randomBytes(6).toString("hex")}`);
+  let fd: number | undefined;
+  try {
+    fd = openSync(temp, "w", 0o600);
+    writeSync(fd, Buffer.from(contents, "utf8"));
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = undefined;
+    renameSync(temp, path);
+    // fsync the directory so the rename itself is durable.
+    const dirFd = openSync(dir, "r");
+    try {
+      fsyncSync(dirFd);
+    } finally {
+      closeSync(dirFd);
+    }
+  } catch (e) {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd);
+      } catch {}
+    }
+    try {
+      unlinkSync(temp); // cleanup ONLY the temp this function created
+    } catch {}
+    throw e;
+  }
+}
+
+const basename = (p: string) => p.split(/[\\/]/).pop() ?? p;
+
+/** Exactly the names `replaceFileAtomic` gives its temp files for the two state files in the home directory. */
+const STATE_TEMP = /^\.(?:pairing|device-keypair)\.json\.tmp-[0-9a-f]{12}$/;
+
+/**
+ * A writer killed between creating its temp file and renaming it leaves that file behind, holding a credential.
+ * Run before anything in this process writes: it must not race a live writer.
+ */
+export function removeStaleTemps(dir: string): void {
+  for (const name of readdirSync(dir)) {
+    if (!STATE_TEMP.test(name)) continue;
+    const path = join(dir, name);
+    try {
+      unlinkSync(path); // never follows a symlink; refuses a directory
+    } catch {
+      /* raced away or not removable: the next start retries */
+    }
+  }
+}
+
+/** Tolerant JSON load for state files: malformed → undefined (caller decides). */
+export function loadJson<T>(path: string): T | undefined {
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as T;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The device key, or undefined when there is none yet. Anything else that keeps it from being read (permissions,
+ * I/O error, truncated or damaged contents) throws: the caller must not answer that by minting a new identity
+ * over the old file.
+ */
+export function readKeypairFile(path: string): DeviceKeypair | undefined {
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw keypairUnusable(path, (e as Error).message);
+  }
+  let parsed: Partial<DeviceKeypair> | null;
+  try {
+    parsed = JSON.parse(raw) as Partial<DeviceKeypair> | null;
+  } catch {
+    throw keypairUnusable(path, "not valid JSON");
+  }
+  if (!parsed?.privateKeyPem || !parsed.publicKeyPem || !parsed.fingerprint) throw keypairUnusable(path, "key fields are missing");
+  return parsed as DeviceKeypair;
+}
+
+const keypairUnusable = (path: string, why: string) =>
+  new Error(`device keypair ${path} is unusable (${why}); refusing to replace it. Restore it from a backup, or move it away to enroll this device again.`);
+
+/** Tighten a file that must hold secrets if a copy/restore loosened it. */
+export function ensureFileMode0600(path: string): void {
+  try {
+    if ((statSync(path).mode & 0o777) !== 0o600) chmodSync(path, 0o600);
+  } catch {
+    /* file may not exist yet */
+  }
+}
+
+export interface DeviceKeypair {
+  fingerprint: string; // sha256:<64hex> of the DER SPKI
+  publicKeyPem: string;
+  privateKeyPem: string;
+}
+
+export interface PairingFile {
+  version: 1;
+  deviceUid: string;
+  deviceId: string;
+  pairingEpoch: string;
+  credentialId: string;
+  generation: number;
+  hubOrigin: string;
+  hubUrl: string;
+  hubId: string;
+  tunnelToken: string;
+  updatedAt: number;
+  operationId: string;
+}
+
+export const keypairPath = (home: string) => join(home, "device-keypair.json");
+export const pairingPath = (home: string) => join(home, "pairing.json");