sigild 0.0.1 → 0.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (163) hide show
  1. package/README.md +142 -33
  2. package/THREAT_MODEL.md +47 -19
  3. package/dist/src/bin/sigil-hook-post.d.ts +3 -0
  4. package/dist/src/bin/sigil-hook-post.d.ts.map +1 -0
  5. package/dist/src/bin/sigil-hook-post.js +15 -0
  6. package/dist/src/bin/sigil-hook-post.js.map +1 -0
  7. package/dist/src/bin/sigil-hook-pre.d.ts +3 -0
  8. package/dist/src/bin/sigil-hook-pre.d.ts.map +1 -0
  9. package/dist/src/bin/sigil-hook-pre.js +18 -0
  10. package/dist/src/bin/sigil-hook-pre.js.map +1 -0
  11. package/dist/src/bin/sigil-mcp.d.ts +3 -0
  12. package/dist/src/bin/sigil-mcp.d.ts.map +1 -0
  13. package/dist/src/bin/sigil-mcp.js +90 -0
  14. package/dist/src/bin/sigil-mcp.js.map +1 -0
  15. package/dist/src/bin/sigil.d.ts +3 -0
  16. package/dist/src/bin/sigil.d.ts.map +1 -0
  17. package/dist/src/bin/sigil.js +9 -0
  18. package/dist/src/bin/sigil.js.map +1 -0
  19. package/dist/src/cli/args.d.ts +26 -0
  20. package/dist/src/cli/args.d.ts.map +1 -0
  21. package/dist/src/cli/args.js +36 -0
  22. package/dist/src/cli/args.js.map +1 -0
  23. package/dist/src/cli/index.d.ts +7 -0
  24. package/dist/src/cli/index.d.ts.map +1 -0
  25. package/dist/src/cli/index.js +7 -0
  26. package/dist/src/cli/index.js.map +1 -0
  27. package/dist/src/cli/main.d.ts +26 -0
  28. package/dist/src/cli/main.d.ts.map +1 -0
  29. package/dist/src/cli/main.js +197 -0
  30. package/dist/src/cli/main.js.map +1 -0
  31. package/dist/src/cli/paths.d.ts +18 -0
  32. package/dist/src/cli/paths.d.ts.map +1 -0
  33. package/dist/src/cli/paths.js +13 -0
  34. package/dist/src/cli/paths.js.map +1 -0
  35. package/dist/src/cli/portal.d.ts +59 -0
  36. package/dist/src/cli/portal.d.ts.map +1 -0
  37. package/dist/src/cli/portal.js +112 -0
  38. package/dist/src/cli/portal.js.map +1 -0
  39. package/dist/src/cli/status.d.ts +28 -0
  40. package/dist/src/cli/status.d.ts.map +1 -0
  41. package/dist/src/cli/status.js +59 -0
  42. package/dist/src/cli/status.js.map +1 -0
  43. package/dist/src/cli/unlock.d.ts +36 -0
  44. package/dist/src/cli/unlock.d.ts.map +1 -0
  45. package/dist/src/cli/unlock.js +77 -0
  46. package/dist/src/cli/unlock.js.map +1 -0
  47. package/dist/src/control/client.d.ts +26 -0
  48. package/dist/src/control/client.d.ts.map +1 -0
  49. package/dist/src/control/client.js +76 -0
  50. package/dist/src/control/client.js.map +1 -0
  51. package/dist/src/control/index.d.ts +4 -0
  52. package/dist/src/control/index.d.ts.map +1 -0
  53. package/dist/src/control/index.js +4 -0
  54. package/dist/src/control/index.js.map +1 -0
  55. package/dist/src/control/protocol.d.ts +54 -0
  56. package/dist/src/control/protocol.d.ts.map +1 -0
  57. package/dist/src/control/protocol.js +60 -0
  58. package/dist/src/control/protocol.js.map +1 -0
  59. package/dist/src/control/server.d.ts +52 -0
  60. package/dist/src/control/server.d.ts.map +1 -0
  61. package/dist/src/control/server.js +199 -0
  62. package/dist/src/control/server.js.map +1 -0
  63. package/dist/src/daemon/handles.d.ts +35 -6
  64. package/dist/src/daemon/handles.d.ts.map +1 -1
  65. package/dist/src/daemon/handles.js +83 -28
  66. package/dist/src/daemon/handles.js.map +1 -1
  67. package/dist/src/daemon/index.d.ts +2 -3
  68. package/dist/src/daemon/index.d.ts.map +1 -1
  69. package/dist/src/daemon/index.js +2 -3
  70. package/dist/src/daemon/index.js.map +1 -1
  71. package/dist/src/daemon/methods.d.ts +13 -0
  72. package/dist/src/daemon/methods.d.ts.map +1 -1
  73. package/dist/src/daemon/methods.js +50 -1
  74. package/dist/src/daemon/methods.js.map +1 -1
  75. package/dist/src/hooks/command-scanner.d.ts +5 -0
  76. package/dist/src/hooks/command-scanner.d.ts.map +1 -0
  77. package/dist/src/hooks/command-scanner.js +117 -0
  78. package/dist/src/hooks/command-scanner.js.map +1 -0
  79. package/dist/src/hooks/glob.d.ts +8 -0
  80. package/dist/src/hooks/glob.d.ts.map +1 -0
  81. package/dist/src/hooks/glob.js +98 -0
  82. package/dist/src/hooks/glob.js.map +1 -0
  83. package/dist/src/hooks/index.d.ts +9 -0
  84. package/dist/src/hooks/index.d.ts.map +1 -0
  85. package/dist/src/hooks/index.js +9 -0
  86. package/dist/src/hooks/index.js.map +1 -0
  87. package/dist/src/hooks/install.d.ts +29 -0
  88. package/dist/src/hooks/install.d.ts.map +1 -0
  89. package/dist/src/hooks/install.js +86 -0
  90. package/dist/src/hooks/install.js.map +1 -0
  91. package/dist/src/hooks/path-blocker.d.ts +29 -0
  92. package/dist/src/hooks/path-blocker.d.ts.map +1 -0
  93. package/dist/src/hooks/path-blocker.js +59 -0
  94. package/dist/src/hooks/path-blocker.js.map +1 -0
  95. package/dist/src/hooks/post-tool-use.d.ts +13 -0
  96. package/dist/src/hooks/post-tool-use.d.ts.map +1 -0
  97. package/dist/src/hooks/post-tool-use.js +45 -0
  98. package/dist/src/hooks/post-tool-use.js.map +1 -0
  99. package/dist/src/hooks/pre-tool-use.d.ts +8 -0
  100. package/dist/src/hooks/pre-tool-use.d.ts.map +1 -0
  101. package/dist/src/hooks/pre-tool-use.js +38 -0
  102. package/dist/src/hooks/pre-tool-use.js.map +1 -0
  103. package/dist/src/hooks/protocol.d.ts +41 -0
  104. package/dist/src/hooks/protocol.d.ts.map +1 -0
  105. package/dist/src/hooks/protocol.js +27 -0
  106. package/dist/src/hooks/protocol.js.map +1 -0
  107. package/dist/src/hooks/redactor.d.ts +19 -0
  108. package/dist/src/hooks/redactor.d.ts.map +1 -0
  109. package/dist/src/hooks/redactor.js +71 -0
  110. package/dist/src/hooks/redactor.js.map +1 -0
  111. package/dist/src/mcp/index.d.ts +4 -0
  112. package/dist/src/mcp/index.d.ts.map +1 -0
  113. package/dist/src/mcp/index.js +4 -0
  114. package/dist/src/mcp/index.js.map +1 -0
  115. package/dist/src/mcp/protocol.d.ts +98 -0
  116. package/dist/src/mcp/protocol.d.ts.map +1 -0
  117. package/dist/src/mcp/protocol.js +79 -0
  118. package/dist/src/mcp/protocol.js.map +1 -0
  119. package/dist/src/mcp/server.d.ts +46 -0
  120. package/dist/src/mcp/server.d.ts.map +1 -0
  121. package/dist/src/mcp/server.js +108 -0
  122. package/dist/src/mcp/server.js.map +1 -0
  123. package/dist/src/mcp/tools.d.ts +16 -0
  124. package/dist/src/mcp/tools.d.ts.map +1 -0
  125. package/dist/src/mcp/tools.js +117 -0
  126. package/dist/src/mcp/tools.js.map +1 -0
  127. package/dist/src/policy/evaluate.d.ts +13 -0
  128. package/dist/src/policy/evaluate.d.ts.map +1 -0
  129. package/dist/src/policy/evaluate.js +73 -0
  130. package/dist/src/policy/evaluate.js.map +1 -0
  131. package/dist/src/policy/index.d.ts +5 -0
  132. package/dist/src/policy/index.d.ts.map +1 -0
  133. package/dist/src/policy/index.js +5 -0
  134. package/dist/src/policy/index.js.map +1 -0
  135. package/dist/src/policy/loader.d.ts +33 -0
  136. package/dist/src/policy/loader.d.ts.map +1 -0
  137. package/dist/src/policy/loader.js +170 -0
  138. package/dist/src/policy/loader.js.map +1 -0
  139. package/dist/src/policy/template.d.ts +10 -0
  140. package/dist/src/policy/template.d.ts.map +1 -0
  141. package/dist/src/policy/template.js +69 -0
  142. package/dist/src/policy/template.js.map +1 -0
  143. package/dist/src/policy/types.d.ts +62 -0
  144. package/dist/src/policy/types.d.ts.map +1 -0
  145. package/dist/src/policy/types.js +10 -0
  146. package/dist/src/policy/types.js.map +1 -0
  147. package/package.json +9 -3
  148. package/dist/src/bin/sigild.d.ts +0 -3
  149. package/dist/src/bin/sigild.d.ts.map +0 -1
  150. package/dist/src/bin/sigild.js +0 -30
  151. package/dist/src/bin/sigild.js.map +0 -1
  152. package/dist/src/daemon/rpc.d.ts +0 -61
  153. package/dist/src/daemon/rpc.d.ts.map +0 -1
  154. package/dist/src/daemon/rpc.js +0 -76
  155. package/dist/src/daemon/rpc.js.map +0 -1
  156. package/dist/src/daemon/runtime.d.ts +0 -40
  157. package/dist/src/daemon/runtime.d.ts.map +0 -1
  158. package/dist/src/daemon/runtime.js +0 -61
  159. package/dist/src/daemon/runtime.js.map +0 -1
  160. package/dist/src/daemon/server.d.ts +0 -53
  161. package/dist/src/daemon/server.d.ts.map +0 -1
  162. package/dist/src/daemon/server.js +0 -103
  163. package/dist/src/daemon/server.js.map +0 -1
@@ -1,76 +0,0 @@
1
- /**
2
- * JSON-RPC 2.0 over newline-delimited JSON (NDJSON).
3
- * Pure functions only — no IO. The server in server.ts wires this onto sockets.
4
- *
5
- * We use the strict JSON-RPC 2.0 envelope: every request has `jsonrpc: "2.0"`,
6
- * a method, and either an id (for requests expecting a response) or no id (for
7
- * notifications, which sigil currently rejects since every sign decision needs
8
- * to round-trip through the audit log).
9
- */
10
- export const RPC_VERSION = '2.0';
11
- // Standard JSON-RPC 2.0 error codes.
12
- export const RPC_PARSE_ERROR = -32700;
13
- export const RPC_INVALID_REQUEST = -32600;
14
- export const RPC_METHOD_NOT_FOUND = -32601;
15
- export const RPC_INVALID_PARAMS = -32602;
16
- export const RPC_INTERNAL_ERROR = -32603;
17
- // Reserved range for sigil-specific errors: -32000 .. -32099.
18
- export const RPC_PORTAL_NOT_FOUND = -32000;
19
- export const RPC_POLICY_DENIED = -32001;
20
- export const RPC_INVALID_PAYLOAD = -32002;
21
- /**
22
- * Parse a single NDJSON line into a JSON-RPC request.
23
- * Returns either a valid request, a parse_error (if the line is not JSON), or
24
- * an invalid envelope along with the id that should be echoed in the error
25
- * response (which is null if the id couldn't be extracted).
26
- */
27
- export function parseRequest(line) {
28
- let parsed;
29
- try {
30
- parsed = JSON.parse(line);
31
- }
32
- catch {
33
- return { kind: 'parse_error' };
34
- }
35
- if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
36
- return { kind: 'invalid', id: null, reason: 'request must be a JSON object' };
37
- }
38
- const obj = parsed;
39
- // Try to extract an id even if the rest is malformed, so the error
40
- // response can be correlated.
41
- const rawId = obj['id'];
42
- const id = typeof rawId === 'string' || typeof rawId === 'number' || rawId === null ? rawId : null;
43
- if (obj['jsonrpc'] !== RPC_VERSION) {
44
- return { kind: 'invalid', id, reason: 'jsonrpc must be "2.0"' };
45
- }
46
- if (typeof obj['method'] !== 'string' || obj['method'].length === 0) {
47
- return { kind: 'invalid', id, reason: 'method must be a non-empty string' };
48
- }
49
- // Notifications (no id) are not supported — every call must be acknowledged
50
- // because every sign call needs an audit-log roundtrip.
51
- if (!('id' in obj)) {
52
- return { kind: 'invalid', id: null, reason: 'notifications are not supported' };
53
- }
54
- if (typeof rawId !== 'string' && typeof rawId !== 'number' && rawId !== null) {
55
- return { kind: 'invalid', id: null, reason: 'id must be string, number, or null' };
56
- }
57
- return {
58
- kind: 'request',
59
- request: {
60
- jsonrpc: '2.0',
61
- id,
62
- method: obj['method'],
63
- params: obj['params'],
64
- },
65
- };
66
- }
67
- export function encodeResponse(id, result) {
68
- const r = { jsonrpc: RPC_VERSION, id, result };
69
- return JSON.stringify(r);
70
- }
71
- export function encodeError(id, code, message, data) {
72
- const error = data === undefined ? { code, message } : { code, message, data };
73
- const r = { jsonrpc: RPC_VERSION, id, error };
74
- return JSON.stringify(r);
75
- }
76
- //# sourceMappingURL=rpc.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"rpc.js","sourceRoot":"","sources":["../../../src/daemon/rpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AA+BjC,qCAAqC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAK,CAAC;AACtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAK,CAAC;AACzC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAK,CAAC;AAEzC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAK,CAAC;AACxC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAO1C;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,mEAAmE;IACnE,8BAA8B;IAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,EAAE,GACN,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAC9E,CAAC;IACD,4EAA4E;IAC5E,wDAAwD;IACxD,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IACrF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE;YACP,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;YACrB,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;SACtB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAS,EAAE,MAAe;IACvD,MAAM,CAAC,GAAe,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAS,EAAE,IAAY,EAAE,OAAe,EAAE,IAAc;IAClF,MAAM,KAAK,GAAmB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC/F,MAAM,CAAC,GAAa,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACxD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC"}
@@ -1,40 +0,0 @@
1
- import { type DaemonServerHandle, type LogEvent } from './server.js';
2
- export interface DaemonRuntimeOpts {
3
- /** Sigil home directory. Defaults to $SIGIL_HOME or ~/.sigil. */
4
- sigilHome: string;
5
- /** Returns the unlock passphrase. Called once at startup; the runtime zeroes it after use. */
6
- passphrase: () => Promise<Buffer> | Buffer;
7
- /** Optional log sink for daemon and server events. */
8
- onLog?: (event: LogEvent | RuntimeEvent) => void;
9
- }
10
- export type RuntimeEvent = {
11
- kind: 'runtime_starting';
12
- sigilHome: string;
13
- } | {
14
- kind: 'runtime_ready';
15
- portals: number;
16
- socketPath: string;
17
- } | {
18
- kind: 'runtime_shutdown_begin';
19
- } | {
20
- kind: 'runtime_shutdown_complete';
21
- };
22
- export interface DaemonRuntimeHandle {
23
- readonly socketPath: string;
24
- readonly auditPath: string;
25
- readonly portals: number;
26
- readonly server: DaemonServerHandle;
27
- shutdown: () => Promise<void>;
28
- }
29
- /**
30
- * Bring up the daemon: ensure directories exist, prompt for the passphrase,
31
- * load every keyfile from <sigilHome>/keys, open the audit log, and start
32
- * the Unix-socket server. The returned handle exposes a single `shutdown`
33
- * function that closes the server, closes the audit writer, and zeroes
34
- * every key in memory.
35
- *
36
- * The runtime is testable end-to-end by passing a `passphrase` callback that
37
- * returns a known buffer and pointing `sigilHome` at a tmpdir.
38
- */
39
- export declare function runDaemon(opts: DaemonRuntimeOpts): Promise<DaemonRuntimeHandle>;
40
- //# sourceMappingURL=runtime.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/daemon/runtime.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,KAAK,kBAAkB,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAExF,MAAM,WAAW,iBAAiB;IAChC,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC3C,sDAAsD;IACtD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,KAAK,IAAI,CAAC;CAClD;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC9D;IAAE,IAAI,EAAE,wBAAwB,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,2BAA2B,CAAA;CAAE,CAAC;AAE1C,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/B;AAED;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiDrF"}
@@ -1,61 +0,0 @@
1
- import { mkdirSync } from 'node:fs';
2
- import { join } from 'node:path';
3
- import { AuditWriter } from '../audit/index.js';
4
- import { HandleTable } from './handles.js';
5
- import { startDaemonServer } from './server.js';
6
- /**
7
- * Bring up the daemon: ensure directories exist, prompt for the passphrase,
8
- * load every keyfile from <sigilHome>/keys, open the audit log, and start
9
- * the Unix-socket server. The returned handle exposes a single `shutdown`
10
- * function that closes the server, closes the audit writer, and zeroes
11
- * every key in memory.
12
- *
13
- * The runtime is testable end-to-end by passing a `passphrase` callback that
14
- * returns a known buffer and pointing `sigilHome` at a tmpdir.
15
- */
16
- export async function runDaemon(opts) {
17
- const log = (e) => opts.onLog?.(e);
18
- const sigilHome = opts.sigilHome;
19
- const keysDir = join(sigilHome, 'keys');
20
- const auditPath = join(sigilHome, 'audit.log');
21
- const socketPath = join(sigilHome, 'sock');
22
- log({ kind: 'runtime_starting', sigilHome });
23
- mkdirSync(sigilHome, { recursive: true, mode: 0o700 });
24
- mkdirSync(keysDir, { recursive: true, mode: 0o700 });
25
- const passphrase = await opts.passphrase();
26
- const handles = new HandleTable();
27
- try {
28
- handles.loadFromDir(keysDir, passphrase);
29
- }
30
- finally {
31
- passphrase.fill(0);
32
- }
33
- const audit = new AuditWriter(auditPath);
34
- const server = await startDaemonServer({
35
- socketPath,
36
- context: { handles, audit },
37
- ...(opts.onLog ? { onLog: (e) => opts.onLog(e) } : {}),
38
- });
39
- log({ kind: 'runtime_ready', portals: handles.list().length, socketPath });
40
- let shutdownPromise = null;
41
- const shutdown = () => {
42
- if (shutdownPromise)
43
- return shutdownPromise;
44
- log({ kind: 'runtime_shutdown_begin' });
45
- shutdownPromise = (async () => {
46
- await server.close();
47
- audit.close();
48
- handles.dispose();
49
- log({ kind: 'runtime_shutdown_complete' });
50
- })();
51
- return shutdownPromise;
52
- };
53
- return {
54
- socketPath,
55
- auditPath,
56
- portals: handles.list().length,
57
- server,
58
- shutdown,
59
- };
60
- }
61
- //# sourceMappingURL=runtime.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/daemon/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAA0C,MAAM,aAAa,CAAC;AAyBxF;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAuB;IACrD,MAAM,GAAG,GAAG,CAAC,CAA0B,EAAQ,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAE3C,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;IAE7C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QACT,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,UAAU;QACV,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;QAC3B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAW,EAAE,EAAE,CAAC,IAAI,CAAC,KAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3E,IAAI,eAAe,GAAyB,IAAI,CAAC;IACjD,MAAM,QAAQ,GAAG,GAAkB,EAAE;QACnC,IAAI,eAAe;YAAE,OAAO,eAAe,CAAC;QAC5C,GAAG,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACxC,eAAe,GAAG,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACrB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC7C,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,eAAe,CAAC;IACzB,CAAC,CAAC;IAEF,OAAO;QACL,UAAU;QACV,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM;QAC9B,MAAM;QACN,QAAQ;KACT,CAAC;AACJ,CAAC"}
@@ -1,53 +0,0 @@
1
- import { type Server, type Socket } from 'node:net';
2
- import { type MethodContext } from './methods.js';
3
- import { type RpcId } from './rpc.js';
4
- export interface DaemonServerOpts {
5
- socketPath: string;
6
- context: MethodContext;
7
- /**
8
- * Called for every connection that opens, with the peer socket. Useful for
9
- * tests; in production we don't need it.
10
- */
11
- onConnection?: (socket: Socket) => void;
12
- /**
13
- * Called when the server logs an event. Receives a structured payload.
14
- * Keep this lightweight; production wiring will swap in something real.
15
- */
16
- onLog?: (event: LogEvent) => void;
17
- }
18
- export type LogEvent = {
19
- kind: 'listening';
20
- path: string;
21
- } | {
22
- kind: 'connection_open';
23
- } | {
24
- kind: 'connection_close';
25
- } | {
26
- kind: 'connection_error';
27
- error: string;
28
- } | {
29
- kind: 'request';
30
- method: string;
31
- id: RpcId;
32
- } | {
33
- kind: 'response';
34
- id: RpcId;
35
- ok: boolean;
36
- } | {
37
- kind: 'closed';
38
- };
39
- export interface DaemonServerHandle {
40
- readonly server: Server;
41
- close: () => Promise<void>;
42
- }
43
- /**
44
- * Start a Unix-socket JSON-RPC server. The socket file is created at
45
- * `socketPath` with mode 0o600 (owner read/write only). If a stale socket
46
- * file exists at that path we remove it first.
47
- *
48
- * Each connection is line-delimited JSON: one request per line, one response
49
- * per line. Pipelining is supported (multiple requests per connection); they
50
- * are processed in order.
51
- */
52
- export declare function startDaemonServer(opts: DaemonServerOpts): Promise<DaemonServerHandle>;
53
- //# sourceMappingURL=server.d.ts.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAElE,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAOL,KAAK,KAAK,EACX,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,aAAa,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,KAAK,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiErF"}
@@ -1,103 +0,0 @@
1
- import { createServer } from 'node:net';
2
- import { chmodSync, existsSync, unlinkSync } from 'node:fs';
3
- import { dispatch, RpcMethodError } from './methods.js';
4
- import { encodeError, encodeResponse, parseRequest, RPC_INTERNAL_ERROR, RPC_INVALID_REQUEST, RPC_PARSE_ERROR, } from './rpc.js';
5
- /**
6
- * Start a Unix-socket JSON-RPC server. The socket file is created at
7
- * `socketPath` with mode 0o600 (owner read/write only). If a stale socket
8
- * file exists at that path we remove it first.
9
- *
10
- * Each connection is line-delimited JSON: one request per line, one response
11
- * per line. Pipelining is supported (multiple requests per connection); they
12
- * are processed in order.
13
- */
14
- export function startDaemonServer(opts) {
15
- const { socketPath, context } = opts;
16
- const log = (e) => opts.onLog?.(e);
17
- // If a stale file (e.g. from a crashed previous run) sits at the path,
18
- // remove it before binding. We don't check whether a process is actually
19
- // listening — that would need OS-specific calls. The 0o600 perms make it
20
- // impossible for another user to drop a file here.
21
- if (existsSync(socketPath)) {
22
- try {
23
- unlinkSync(socketPath);
24
- }
25
- catch { /* let listen() report the bind failure */ }
26
- }
27
- const server = createServer((socket) => {
28
- log({ kind: 'connection_open' });
29
- opts.onConnection?.(socket);
30
- let buf = '';
31
- socket.setEncoding('utf8');
32
- socket.on('data', (chunk) => {
33
- buf += chunk;
34
- let nl;
35
- while ((nl = buf.indexOf('\n')) !== -1) {
36
- const line = buf.slice(0, nl);
37
- buf = buf.slice(nl + 1);
38
- if (line.length === 0)
39
- continue;
40
- const response = handleLine(line, context, log);
41
- socket.write(response + '\n');
42
- }
43
- });
44
- socket.on('error', (err) => {
45
- log({ kind: 'connection_error', error: err.message });
46
- });
47
- socket.on('close', () => {
48
- log({ kind: 'connection_close' });
49
- });
50
- });
51
- return new Promise((resolve, reject) => {
52
- server.once('error', reject);
53
- server.listen(socketPath, () => {
54
- // Tighten perms — Node's default may be 0o755 depending on umask.
55
- try {
56
- chmodSync(socketPath, 0o600);
57
- }
58
- catch (err) {
59
- server.close();
60
- reject(err);
61
- return;
62
- }
63
- log({ kind: 'listening', path: socketPath });
64
- server.removeListener('error', reject);
65
- resolve({
66
- server,
67
- close: () => new Promise((res) => {
68
- server.close(() => {
69
- log({ kind: 'closed' });
70
- res();
71
- });
72
- }),
73
- });
74
- });
75
- });
76
- }
77
- function handleLine(line, context, log) {
78
- const parsed = parseRequest(line);
79
- if (parsed.kind === 'parse_error') {
80
- log({ kind: 'response', id: null, ok: false });
81
- return encodeError(null, RPC_PARSE_ERROR, 'parse error');
82
- }
83
- if (parsed.kind === 'invalid') {
84
- log({ kind: 'response', id: parsed.id, ok: false });
85
- return encodeError(parsed.id, RPC_INVALID_REQUEST, parsed.reason);
86
- }
87
- const { request } = parsed;
88
- log({ kind: 'request', method: request.method, id: request.id });
89
- try {
90
- const result = dispatch(request.method, request.params, context);
91
- log({ kind: 'response', id: request.id, ok: true });
92
- return encodeResponse(request.id, result);
93
- }
94
- catch (err) {
95
- if (err instanceof RpcMethodError) {
96
- log({ kind: 'response', id: request.id, ok: false });
97
- return encodeError(request.id, err.code, err.message, err.data);
98
- }
99
- log({ kind: 'response', id: request.id, ok: false });
100
- return encodeError(request.id, RPC_INTERNAL_ERROR, `internal error: ${err.message}`);
101
- }
102
- }
103
- //# sourceMappingURL=server.js.map
@@ -1 +0,0 @@
1
- {"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/daemon/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAsB,MAAM,cAAc,CAAC;AAC5E,OAAO,EACL,WAAW,EACX,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,GAEhB,MAAM,UAAU,CAAC;AA+BlB;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,CAAW,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAE7C,uEAAuE;IACvE,yEAAyE;IACzE,yEAAyE;IACzE,mDAAmD;IACnD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACrC,GAAG,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC;QAE5B,IAAI,GAAG,GAAG,EAAE,CAAC;QAEb,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAChC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBAChD,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;YAC7B,kEAAkE;YAClE,IAAI,CAAC;gBACH,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,GAAG,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7C,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO,CAAC;gBACN,MAAM;gBACN,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE;oBACxB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;wBAChB,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;wBACxB,GAAG,EAAE,CAAC;oBACR,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CACjB,IAAY,EACZ,OAAsB,EACtB,GAA0B;IAE1B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,OAAO,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,OAAO,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjE,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACrD,OAAO,WAAW,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAClE,CAAC;QACD,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACrD,OAAO,WAAW,CAChB,OAAO,CAAC,EAAE,EACV,kBAAkB,EAClB,mBAAoB,GAAa,CAAC,OAAO,EAAE,CAC5C,CAAC;IACJ,CAAC;AACH,CAAC"}