openrod 0.0.0 → 0.1.0

package/server/activity-store.js

@@ -0,0 +1,168 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { DatabaseSync } from 'node:sqlite'
+import { createHash, randomUUID } from 'node:crypto'
+import { logView } from './gateway.js'
+import { activityRow, SEVERITY_RANK } from '../src/lib/activity-inventory.js'
+
+const FIELDS = new Set(['time', 'sandbox', 'scope', 'sandboxId', 'agent', 'category', 'severity', 'logLevel', 'direction', 'verdict', 'outcome', 'process', 'action', 'destination', 'policy', 'session', 'correlation', 'why'])
+export function createActivityStore(filename) {
+  if (filename !== ':memory:') fs.mkdirSync(path.dirname(filename), { recursive: true, mode: 0o700 })
+  const db = new DatabaseSync(filename)
+  if (filename !== ':memory:') fs.chmodSync(filename, 0o600)
+  db.exec(`PRAGMA journal_mode=WAL; PRAGMA busy_timeout=3000;
+    CREATE TABLE IF NOT EXISTS events (seq INTEGER PRIMARY KEY AUTOINCREMENT, id TEXT UNIQUE NOT NULL, at INTEGER, received TEXT NOT NULL, sandbox TEXT NOT NULL, data TEXT NOT NULL, fields TEXT NOT NULL, search TEXT NOT NULL);
+    CREATE INDEX IF NOT EXISTS events_time ON events(at, seq);
+    CREATE INDEX IF NOT EXISTS events_sandbox ON events(sandbox, at);
+    CREATE TABLE IF NOT EXISTS cursor_aliases (cursor TEXT PRIMARY KEY, event_id TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS deleted_events (id TEXT PRIMARY KEY, had_cursor INTEGER NOT NULL);
+    CREATE TABLE IF NOT EXISTS sources (id TEXT PRIMARY KEY, data TEXT NOT NULL);
+    CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);`)
+  db.prepare("INSERT OR IGNORE INTO meta VALUES ('startedAt', ?)").run(new Date().toISOString())
+  // Rebuild only normalized fields when the parser changes; original envelopes stay intact.
+  if (db.prepare("SELECT value FROM meta WHERE key='normalizer'").get()?.value !== '6') {
+    const update = db.prepare('UPDATE events SET data=?, fields=?, search=? WHERE id=?')
+    db.exec('BEGIN')
+    try {
+      for (const item of db.prepare('SELECT id, data FROM events').all()) {
+        const old = JSON.parse(item.data)
+        const parsed = old.original?.level ? logView(old.sandbox, old.original) : old
+        const event = { ...old, ...parsed, id: old.id, scope: old.scope, receivedAt: old.receivedAt }
+        const row = activityRow(event)
+        update.run(JSON.stringify(event), JSON.stringify(row.values), row.search, item.id)
+      }
+      db.prepare("INSERT INTO meta VALUES ('normalizer', '6') ON CONFLICT(key) DO UPDATE SET value=excluded.value").run()
+      db.exec('COMMIT')
+    } catch (error) { db.exec('ROLLBACK'); throw error }
+  }
+  const plans = new Map()
+  const head = () => Number(db.prepare("SELECT coalesce((SELECT seq FROM sqlite_sequence WHERE name='events'), 0) AS n").get().n)
+  const insert = db.prepare('INSERT OR IGNORE INTO events(id, at, received, sandbox, data, fields, search) VALUES (?, ?, ?, ?, ?, ?, ?)')
+  function ingest(event, scope = '') {
+    const receivedAt = new Date().toISOString()
+    let id = createHash('sha256').update(JSON.stringify([scope, event.id || event.original || event])).digest('hex')
+    const cursorKey = event.sourceCursor ? createHash('sha256').update(JSON.stringify([scope, 'cursor', event.sourceCursor])).digest('hex') : null
+    if (cursorKey) {
+      if (db.prepare('SELECT event_id FROM cursor_aliases WHERE cursor=?').get(cursorKey)) return null
+      const removed = db.prepare('SELECT had_cursor FROM deleted_events WHERE id=?').get(id)
+      if (removed) {
+        if (!removed.had_cursor) {
+          db.prepare('UPDATE deleted_events SET had_cursor=1 WHERE id=?').run(id)
+          db.prepare('INSERT OR IGNORE INTO cursor_aliases VALUES (?, ?)').run(cursorKey, id)
+          return null
+        }
+        id = cursorKey
+      }
+      const existing = db.prepare('SELECT data FROM events WHERE id=?').get(id)
+      if (existing) {
+        const old = JSON.parse(existing.data)
+        if (!old.sourceCursor) {
+          db.prepare('UPDATE events SET data=? WHERE id=?').run(JSON.stringify({ ...old, sourceCursor: event.sourceCursor }), id)
+          db.prepare('INSERT INTO cursor_aliases VALUES (?, ?)').run(cursorKey, id)
+          return null
+        }
+        id = cursorKey // Distinct source positions must not collapse identical log envelopes.
+      }
+    }
+    if (db.prepare('SELECT 1 FROM deleted_events WHERE id=?').get(id)) return null
+    const saved = { ...event, id, scope, receivedAt }
+    const row = activityRow(saved)
+    const result = insert.run(id, Number.isFinite(row.timestamp) ? row.timestamp : null, receivedAt, saved.sandbox, JSON.stringify(saved), JSON.stringify(row.values), row.search)
+    if (cursorKey) db.prepare('INSERT OR IGNORE INTO cursor_aliases VALUES (?, ?)').run(cursorKey, id)
+    return result.changes ? saved : null
+  }
+  function source(id, patch) {
+    const old = db.prepare('SELECT data FROM sources WHERE id = ?').get(id)
+    const value = { ...(old ? JSON.parse(old.data) : {}), ...patch, id }
+    db.prepare('INSERT INTO sources VALUES (?, ?) ON CONFLICT(id) DO UPDATE SET data=excluded.data').run(id, JSON.stringify(value))
+    return value
+  }
+  function coverage() {
+    const counts = db.prepare('SELECT count(*) AS retained, min(at) AS oldest, max(at) AS newest FROM events').get()
+    return { ...counts, deletionRevision: Number(db.prepare("SELECT value FROM meta WHERE key='deletionRevision'").get()?.value || 0), startedAt: db.prepare("SELECT value FROM meta WHERE key='startedAt'").get().value, sources: db.prepare('SELECT data FROM sources ORDER BY id').all().map((r) => JSON.parse(r.data)), complete: false, retention: 'Local archive; collected while the console server runs. No automatic expiry. Reconnects resume from a saved cursor when available; fallback replay is limited to 400 logs and 400 platform events per sandbox.' }
+  }
+  function selection(options = {}) {
+    const bad = () => { throw Object.assign(new Error('Invalid activity query'), { status: 400 }) }
+    if (!options || typeof options !== 'object' || Array.isArray(options)) bad()
+    for (const key of ['query', 'direction', 'range', 'from', 'to']) if (options[key] !== undefined && typeof options[key] !== 'string') bad()
+    for (const key of ['sandboxes', 'verdicts', 'agents']) if (options[key] !== undefined && (!Array.isArray(options[key]) || options[key].length > 10000 || options[key].some((v) => typeof v !== 'string'))) bad()
+    if (options.filters !== undefined && (!options.filters || typeof options.filters !== 'object' || Array.isArray(options.filters))) bad()
+    for (const f of Object.values(options.filters ?? {})) if (!f || typeof f.value !== 'string' || !['equals', 'contains', 'excludes'].includes(f.mode)) bad()
+    if (options.range === 'custom' && ((!options.from && !options.to) || (options.from && !Number.isFinite(Date.parse(options.from))) || (options.to && !Number.isFinite(Date.parse(options.to))) || (options.from && options.to && Date.parse(options.from) > Date.parse(options.to)))) bad()
+    if (options.range && !['all', 'custom', '15', '60', '1440'].includes(options.range)) bad()
+    for (const key of ['limit', 'offset', 'snapshot', 'now']) if (options[key] !== undefined && !Number.isSafeInteger(options[key])) bad()
+    const now = Number.isFinite(options.now) ? options.now : Date.now()
+    const snapshot = Number.isSafeInteger(options.snapshot) && options.snapshot >= 0 ? options.snapshot : head()
+    const clauses = ['seq <= ?'], args = [snapshot]
+    const field = (name) => `json_extract(fields, '$.${name}')`
+    if (options.query?.trim()) { clauses.push('instr(search, ?) > 0'); args.push(options.query.trim().toLowerCase()) }
+    for (const [name, values] of [['sandbox', options.sandboxes], ['verdict', options.verdicts], ['agent', options.agents]]) {
+      if (Array.isArray(values) && values.length) { clauses.push(`${field(name)} IN (${values.map(() => '?').join(',')})`); args.push(...values) }
+    }
+    if (options.direction && options.direction !== 'all') { clauses.push(`${field('direction')} = ?`); args.push(options.direction) }
+    const start = options.range === 'custom' ? Date.parse(options.from) : options.range && options.range !== 'all' ? now - Number(options.range) * 60000 : NaN
+    const end = options.range === 'custom' ? Date.parse(options.to) : NaN
+    if (Number.isFinite(start)) { clauses.push('at >= ?'); args.push(start) }
+    if (Number.isFinite(end)) { clauses.push('at <= ?'); args.push(end) }
+    for (const [key, f] of Object.entries(options.filters ?? {})) {
+      if (!FIELDS.has(key) || !f?.value?.trim()) continue
+      clauses.push(f.mode === 'equals' ? `lower(${field(key)}) = ?` : `instr(lower(${field(key)}), ?) ${f.mode === 'excludes' ? '=' : '>'} 0`)
+      args.push(f.value.trim().toLowerCase())
+    }
+    return { where: clauses.join(' AND '), args, snapshot, now }
+  }
+  function query(options = {}) {
+    const { where, args, snapshot, now } = selection(options)
+    const field = (name) => `json_extract(fields, '$.${name}')`
+    const key = FIELDS.has(options.sort?.key) ? options.sort.key : 'time'
+    const severityOrder = `CASE upper(${field('severity')}) ${Object.entries(SEVERITY_RANK).map(([name, rank]) => `WHEN '${name}' THEN ${rank}`).join(' ')} ELSE -1 END`
+    const order = options.sort?.direction === 'asc' ? 'ASC' : 'DESC'
+    const limit = Math.min(500, Math.max(1, Math.floor(Number(options.limit)) || 200))
+    const offset = Math.max(0, Math.floor(Number(options.offset) || 0))
+    const total = db.prepare(`SELECT count(*) AS n FROM events WHERE ${where}`).get(...args).n
+    const events = db.prepare(`SELECT data FROM events WHERE ${where} ORDER BY ${key === 'time' ? 'coalesce(at, 0)' : key === 'severity' ? severityOrder : field(key)} ${order}, id ASC LIMIT ? OFFSET ?`).all(...args, limit, offset).map((r) => JSON.parse(r.data))
+    const agents = db.prepare("SELECT DISTINCT json_extract(fields, '$.agent') AS agent FROM events WHERE seq <= ? ORDER BY agent").all(snapshot).map((row) => row.agent).filter(Boolean)
+    return { events, total, snapshot, now, agents, sandboxes: db.prepare('SELECT DISTINCT sandbox FROM events ORDER BY sandbox').all().map((r) => r.sandbox), nextOffset: offset + events.length < total ? offset + events.length : null, coverage: coverage() }
+  }
+  function previewDeletion(input) {
+    const bad = () => { throw Object.assign(new Error('Choose selected logs, matching logs, or all logs'), { status: 400 }) }
+    if (!input || !['selected', 'matching', 'all'].includes(input.mode)) bad()
+    const options = input.mode === 'matching' ? input.query : {}
+    if (input.mode === 'matching' && (!options || typeof options !== 'object' || Array.isArray(options))) bad()
+    // The preview fixes both the ingestion snapshot and relative time range.
+    const scope = selection({ ...options, snapshot: head(), now: Date.now() })
+    if (input.mode === 'selected') {
+      if (!Array.isArray(input.ids) || !input.ids.length || input.ids.length > 5000 || input.ids.some((id) => typeof id !== 'string' || !/^[a-f0-9]{64}$/.test(id))) bad()
+      scope.where += ` AND id IN (SELECT value FROM json_each(?))`
+      scope.args.push(JSON.stringify([...new Set(input.ids)]))
+    }
+    const count = Number(db.prepare(`SELECT count(*) AS n FROM events WHERE ${scope.where}`).get(...scope.args).n)
+    for (const [key, plan] of plans) if (plan.expiresAt < Date.now()) plans.delete(key)
+    if (plans.size >= 100) plans.delete(plans.keys().next().value)
+    const token = randomUUID(), expiresAt = Date.now() + 5 * 60000
+    plans.set(token, { ...scope, expiresAt })
+    return { token, mode: input.mode, count, expiresAt, snapshot: scope.snapshot }
+  }
+  function deleteLogs(token) {
+    const plan = typeof token === 'string' ? plans.get(token) : null
+    if (!plan || plan.expiresAt < Date.now()) throw Object.assign(new Error('Deletion review expired. Review the logs again.'), { status: 409 })
+    const { where, args } = plan
+    db.exec('BEGIN IMMEDIATE')
+    try {
+      // Keep only opaque identities so upstream replay cannot resurrect deleted evidence.
+      db.prepare(`INSERT OR IGNORE INTO deleted_events SELECT id, CASE WHEN json_extract(data, '$.sourceCursor') IS NOT NULL AND json_extract(data, '$.sourceCursor') != '' THEN 1 ELSE 0 END FROM events WHERE ${where}`).run(...args)
+      const count = Number(db.prepare(`DELETE FROM events WHERE ${where}`).run(...args).changes)
+      if (count) db.prepare("INSERT INTO meta VALUES ('deletionRevision', '1') ON CONFLICT(key) DO UPDATE SET value=CAST(value AS INTEGER)+1").run()
+      db.exec('COMMIT')
+      plans.delete(token)
+      return { deleted: count, coverage: coverage() }
+    } catch (error) { db.exec('ROLLBACK'); throw error }
+  }
+  return { ingest, source, coverage, query, previewDeletion, deleteLogs,
+    has: (id) => Boolean(db.prepare('SELECT 1 FROM events WHERE id=?').get(id)),
+    countAfter: (seq) => Number(db.prepare('SELECT count(*) AS n FROM events WHERE seq > ?').get(seq).n),
+    getSource: (id) => { const row = db.prepare('SELECT data FROM sources WHERE id=?').get(id); return row ? JSON.parse(row.data) : null },
+    head,
+    after: (seq, limit = 100) => db.prepare('SELECT seq, data FROM events WHERE seq > ? ORDER BY seq LIMIT ?').all(seq, limit).map((r) => ({ seq: Number(r.seq), event: JSON.parse(r.data) })),
+    close: () => db.close() }
+}

package/server/agent-inventory.js

@@ -0,0 +1,76 @@
+import { contextKey, workspaceName } from './gateway.js'
+import { setupPython } from './setup-python.js'
+import { AGENTS } from '../src/lib/agents.js'
+
+const resourceProbe = setupPython('./agent-resources.py')
+
+// Inspect executables without starting an agent, reading credentials, or sourcing
+// user profile scripts. The same check finds image contents and later installs.
+// Cursor's current "agent" alias is ambiguous. Resolve its symlink to the
+// vendor installation instead of running an unknown executable for identification.
+export const agentProbe = `
+report_agent() {
+  candidate="$1"
+  agent_command="$2"
+  [ -f "$candidate" ] && [ -x "$candidate" ] || return 1
+  if [ "$agent_command" = agent ]; then
+    resolved=$(readlink -f "$candidate" 2>/dev/null || :)
+    case "$resolved" in
+      */cursor-agent|*/cursor-agent/*) ;;
+      *) return 1 ;;
+    esac
+  fi
+  printf '%s\\n' "$agent_command"
+}
+` + AGENTS.flatMap((agent) => agent.commands).map((command) => `
+p=$(command -v ${command} 2>/dev/null || :)
+if ! report_agent "$p" '${command}'; then
+  for d in /usr/local/bin /usr/bin /opt/bin "$HOME/.local/bin" "$HOME/.npm-global/bin" "$HOME/.bun/bin" "$HOME/.opencode/bin" "$HOME/bin" "$HOME/.cargo/bin" "$HOME"/.nvm/versions/node/*/bin /opt/node/bin; do
+    if report_agent "$d/${command}" '${command}'; then break; fi
+  done
+fi`).join('\n') + `\npython3 - <<'OPENSHELL_RESOURCES' 2>/dev/null\n${resourceProbe}\nOPENSHELL_RESOURCES\nprintf 'openshell-agent-scan-complete\\n'\n`
+
+export function createAgentInventory({ now = Date.now, ttl = 20_000 } = {}) {
+  const cache = new Map()
+  return async function inventory(client, sandbox, gatewayKey = '', revision = '') {
+    const workspace = sandbox.workspace || workspaceName()
+    const key = JSON.stringify([contextKey(), gatewayKey, workspace, sandbox.id || sandbox.name, sandbox.createdAt, revision])
+    let entry = cache.get(key)
+    if (sandbox.phase !== 'ready') {
+      if (entry) entry.expires = 0
+      return { status: 'unavailable', agents: entry?.result?.agents ?? null, resources: null, checkedAt: entry?.result?.checkedAt ?? null }
+    }
+    if (entry?.pending) return entry.pending
+    if (entry?.expires > now()) return entry.result
+    entry ??= {}
+    cache.set(key, entry)
+    // Bound cached history when many different sandboxes are inspected.
+    if (cache.size > 500) for (const [oldKey, old] of cache) {
+      if (oldKey !== key && !old.pending) { cache.delete(oldKey); break }
+    }
+    entry.pending = (async () => {
+      try {
+        const result = await client.sandbox.exec(sandbox.name, ['/bin/sh', '-c', agentProbe], {
+          workspace, timeoutSecs: 8,
+          noLoginShell: true, signal: AbortSignal.timeout(10_000),
+        })
+        const lines = result.stdout.toString().trim().split('\n')
+        if (result.exitCode !== 0 || lines.at(-1) !== 'openshell-agent-scan-complete') throw new Error('Incomplete scan')
+        const agents = AGENTS.filter((agent) => agent.commands.some((command) => lines.includes(command))).map(({ name }) => name)
+        const resourceLine = lines.find((line) => line.startsWith('openshell-agent-resources:'))
+        let resources = null
+        try { resources = JSON.parse(resourceLine?.slice('openshell-agent-resources:'.length)) } catch { /* Resource scans can fail independently. */ }
+        let installedSetupIds = []
+        try { installedSetupIds = JSON.parse(lines.find(line => line.startsWith('openshell-installed-setups:'))?.slice('openshell-installed-setups:'.length)) ?? [] } catch {}
+        entry.result = { status: 'checked', agents, resources, installedSetupIds, checkedAt: new Date(now()).toISOString() }
+      } catch {
+        entry.result = { status: 'unavailable', agents: entry.result?.agents ?? null, resources: null, checkedAt: entry.result?.checkedAt ?? null }
+      }
+      entry.expires = now() + ttl
+      return entry.result
+    })()
+    try { return await entry.pending } finally { entry.pending = null }
+  }
+}
+
+export const agentInventory = createAgentInventory()

package/server/agent-resources.py

@@ -0,0 +1,60 @@
+"""Read only resource names from known agent user configuration, never values."""
+import json
+from pathlib import Path
+
+home = Path.home()
+if 'parse_agent_json' not in globals(): exec((Path(__file__).parent / 'setup-json.py').read_text())
+catalog = json.loads(globals().get('SETUP_TARGET_CATALOG') or (Path(__file__).parent.parent / 'shared/setup-targets.json').read_text())
+result = {}
+for adapter in catalog:
+    agent = adapter['name']
+    if not adapter.get('config'):
+        result[agent] = {kind: {'status': 'unsupported', 'items': [], 'reason': adapter.get('reason')} for kind in ('mcps', 'skills')}
+        continue
+    config, key = adapter['config'], adapter['key']
+    roots = [adapter['skills']] + adapter.get('extraSkillRoots', [])
+    mcps, skills = [], []
+    mcp_status, skill_status = 'checked', 'checked'
+    try:
+        file = home / config
+        if adapter.get('alternateConfig') and (home / adapter['alternateConfig']).exists(): file = home / adapter['alternateConfig']
+        if file.exists():
+            if file.stat().st_size > 1024 * 1024:
+                raise ValueError('oversized')
+            with file.open('rb') as handle:
+                if file.suffix == '.toml':
+                    import tomllib
+                    data = tomllib.load(handle)
+                else:
+                    data = parse_agent_json(handle.read().decode('utf8')) if adapter['format'] == 'opencode' else json.load(handle)
+            servers = data.get(key, {})
+            if not isinstance(servers, dict):
+                raise ValueError('invalid servers')
+            for name, value in servers.items():
+                if not isinstance(value, dict):
+                    raise ValueError('invalid server')
+                mcps.append({'name': name[:200], 'disabled': value.get('enabled') is False or value.get('disabled') is True})
+    except Exception:
+        mcp_status = 'unavailable'
+        mcps = []
+    try:
+        seen = set(); seen_names = set()
+        for root in roots:
+            folder = home / root
+            if not folder.exists():
+                continue
+            for entry in sorted(folder.iterdir()):
+                if (entry / 'SKILL.md').is_file() and str(entry.resolve()) not in seen and entry.name not in seen_names:
+                    seen.add(str(entry.resolve())); seen_names.add(entry.name)
+                    skills.append({'name': entry.name[:200]})
+    except Exception:
+        skill_status = 'unavailable'
+        skills = []
+    result[agent] = {'mcps': {'status': mcp_status, 'items': mcps}, 'skills': {'status': skill_status, 'items': skills}}
+print('openshell-agent-resources:' + json.dumps(result, separators=(',', ':')))
+
+try:
+    installed = sorted(p.stem for p in (home / '.openshell/installed-setups').glob('*.json') if p.is_file())
+    print('openshell-installed-setups:' + json.dumps(installed))
+except OSError:
+    pass