superpowers-manager 0.5.1 → 0.5.2

package/dist/harnesses/codex/recovery.js

@@ -0,0 +1,338 @@
+import { randomBytes } from "node:crypto";
+import { lstat, mkdir, open, readFile, readdir, rmdir, unlink, } from "node:fs/promises";
+import { isAbsolute, join, resolve } from "node:path";
+import { ARTIFACT_DIGEST_RE } from "../../artifact-tree.js";
+import { assertDesignatedParentDirectory, assertNoFollowType, canonicalizeProspectivePath, } from "../../safe-path.js";
+import { SafetyError } from "../../safety-error.js";
+import { parseStrictJson, } from "../../strict-json.js";
+const JOURNAL = "transaction.json";
+const TOKEN_RE = /^[a-f0-9]{32}$/u;
+const PROFILE = {
+    duplicateKeys: "reject",
+    nonStandardConstants: "reject",
+    integerNumbersOnly: true,
+    maxDepth: 8,
+    maxBytes: 64 * 1024,
+};
+const RECORD_KEYS = [
+    "schema",
+    "operation",
+    "token",
+    "marketplaceRoot",
+    "priorNative",
+    "oldDigest",
+    "oldIdentity",
+].sort();
+const NATIVE_KEYS = [
+    "marketplaceRoot",
+    "pluginPresent",
+    "pluginEnabled",
+    "activeVersion",
+    "activeRoot",
+].sort();
+const IDENTITY_KEYS = ["dev", "ino"];
+function recoveryError(message, cause) {
+    return new SafetyError("codex-recovery", message, { cause });
+}
+function recordPath(paths) {
+    return join(paths.recoveryRoot, JOURNAL);
+}
+function stagePath(paths, token) {
+    return join(paths.managerRoot, `.stage-${token}`);
+}
+function backupPath(paths, token) {
+    return join(paths.managerRoot, `.marketplace.bak.${token}`);
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+function exactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    if (actual.length !== expected.length ||
+        actual.some((key, index) => key !== expected[index])) {
+        throw new Error("unexpected recovery fields");
+    }
+}
+function nullableString(value) {
+    if (value === null || typeof value === "string")
+        return value;
+    throw new Error("invalid nullable string");
+}
+function identityValue(value) {
+    if (value === null)
+        return null;
+    const candidate = object(value);
+    if (candidate === null)
+        throw new Error("invalid identity");
+    exactKeys(candidate, IDENTITY_KEYS);
+    const dev = candidate.dev;
+    const ino = candidate.ino;
+    if (typeof dev !== "number" ||
+        typeof ino !== "number" ||
+        !Number.isSafeInteger(dev) ||
+        !Number.isSafeInteger(ino) ||
+        dev < 0 ||
+        ino < 0) {
+        throw new Error("invalid identity");
+    }
+    return { dev, ino };
+}
+function nativeValue(value) {
+    const candidate = object(value);
+    if (candidate === null)
+        throw new Error("invalid native state");
+    exactKeys(candidate, NATIVE_KEYS);
+    const marketplaceRoot = nullableString(candidate.marketplaceRoot);
+    const activeVersion = nullableString(candidate.activeVersion);
+    const activeRoot = nullableString(candidate.activeRoot);
+    if (typeof candidate.pluginPresent !== "boolean" ||
+        typeof candidate.pluginEnabled !== "boolean" ||
+        (candidate.pluginPresent === false && activeVersion !== null) ||
+        (activeVersion === null) !== (activeRoot === null)) {
+        throw new Error("invalid native state");
+    }
+    return {
+        marketplaceRoot,
+        pluginPresent: candidate.pluginPresent,
+        pluginEnabled: candidate.pluginEnabled,
+        activeVersion,
+        activeRoot,
+    };
+}
+function digestValue(value) {
+    if (value === null)
+        return null;
+    if (typeof value !== "string" || !ARTIFACT_DIGEST_RE.test(value)) {
+        throw new Error("invalid recovery digest");
+    }
+    return value;
+}
+function validateEvidenceShape(record) {
+    if ((record.oldDigest === null) !== (record.oldIdentity === null)) {
+        throw new Error("incomplete old recovery evidence");
+    }
+}
+async function decodeRecord(bytes, paths) {
+    const parsed = object(parseStrictJson(bytes, PROFILE));
+    if (parsed === null)
+        throw new Error("recovery journal is not an object");
+    exactKeys(parsed, RECORD_KEYS);
+    if (parsed.schema !== 2)
+        throw new Error("invalid recovery schema");
+    if (parsed.operation !== "install" && parsed.operation !== "uninstall") {
+        throw new Error("invalid recovery operation");
+    }
+    if (typeof parsed.token !== "string" || !TOKEN_RE.test(parsed.token)) {
+        throw new Error("invalid recovery token");
+    }
+    if (typeof parsed.marketplaceRoot !== "string" ||
+        !isAbsolute(parsed.marketplaceRoot) ||
+        resolve(parsed.marketplaceRoot) !== parsed.marketplaceRoot) {
+        throw new Error("invalid recovery marketplace root");
+    }
+    if (parsed.marketplaceRoot !== paths.marketplaceRoot) {
+        throw new Error("foreign recovery marketplace root");
+    }
+    const record = {
+        schema: 2,
+        operation: parsed.operation,
+        token: parsed.token,
+        marketplaceRoot: parsed.marketplaceRoot,
+        priorNative: nativeValue(parsed.priorNative),
+        oldDigest: digestValue(parsed.oldDigest),
+        oldIdentity: identityValue(parsed.oldIdentity),
+    };
+    validateEvidenceShape(record);
+    return record;
+}
+function recordBytes(record) {
+    return Buffer.from(`${JSON.stringify(record)}\n`);
+}
+function sameIdentity(left, right) {
+    return (left !== null &&
+        right !== null &&
+        left.dev === right.dev &&
+        left.ino === right.ino);
+}
+async function identity(path) {
+    await assertNoFollowType(path, ["directory"]);
+    const details = await lstat(path);
+    return { dev: details.dev, ino: details.ino };
+}
+async function optionalIdentity(path) {
+    const kind = await assertNoFollowType(path, ["directory", "missing"]);
+    return kind === "missing" ? null : await identity(path);
+}
+async function syncDirectory(path) {
+    const handle = await open(path, "r");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function readOwnedRecord(paths) {
+    await assertNoFollowType(paths.recoveryRoot, ["directory"]);
+    const entries = await readdir(paths.recoveryRoot);
+    if (entries.length !== 1 || entries[0] !== JOURNAL) {
+        throw new Error("unexpected Codex recovery material");
+    }
+    const path = recordPath(paths);
+    await assertNoFollowType(path, ["regular-file"]);
+    return await decodeRecord(await readFile(path), paths);
+}
+export async function readCodexRecovery(paths) {
+    try {
+        const kind = await assertNoFollowType(paths.recoveryRoot, [
+            "directory",
+            "missing",
+        ]);
+        if (kind === "missing")
+            return null;
+        return await readOwnedRecord(paths);
+    }
+    catch (cause) {
+        throw recoveryError(`cannot inspect Codex recovery state: ${paths.recoveryRoot}`, cause);
+    }
+}
+async function requireInitialSnapshot(paths, input) {
+    if (input.marketplaceRoot !== paths.marketplaceRoot) {
+        throw new Error("unexpected marketplace root");
+    }
+    await assertNoFollowType(paths.codexHome, ["directory", "missing"]);
+    await assertNoFollowType(paths.managerRoot, ["directory", "missing"]);
+    await canonicalizeProspectivePath(paths.marketplaceRoot);
+    const current = await optionalIdentity(paths.marketplaceRoot);
+    if ((current === null) !== (input.oldIdentity === null) ||
+        (current !== null && !sameIdentity(current, input.oldIdentity)) ||
+        (input.oldDigest === null) !== (input.oldIdentity === null)) {
+        throw new Error("previous marketplace changed");
+    }
+}
+export async function beginCodexRecovery(paths, input) {
+    try {
+        const homeKind = await assertNoFollowType(paths.codexHome, [
+            "directory",
+            "missing",
+        ]);
+        if (homeKind === "missing") {
+            await assertDesignatedParentDirectory(paths.codexHome);
+            await mkdir(paths.codexHome, { mode: 0o700 });
+        }
+        await requireInitialSnapshot(paths, input);
+        const managerKind = await assertNoFollowType(paths.managerRoot, [
+            "directory",
+            "missing",
+        ]);
+        if (managerKind === "missing")
+            await mkdir(paths.managerRoot, { mode: 0o700 });
+        if ((await assertNoFollowType(paths.recoveryRoot, [
+            "directory",
+            "missing",
+        ])) !== "missing") {
+            throw new Error("unresolved Codex recovery state");
+        }
+        await mkdir(paths.recoveryRoot, { mode: 0o700 });
+        const recoveryIdentity = await identity(paths.recoveryRoot);
+        const token = randomBytes(16).toString("hex");
+        const record = {
+            schema: 2,
+            operation: input.operation,
+            token,
+            marketplaceRoot: input.marketplaceRoot,
+            priorNative: input.priorNative,
+            oldDigest: input.oldDigest,
+            oldIdentity: input.oldIdentity,
+        };
+        await decodeRecord(recordBytes(record), paths);
+        const path = recordPath(paths);
+        const handle = await open(path, "wx", 0o600);
+        try {
+            await handle.writeFile(recordBytes(record));
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await syncDirectory(paths.recoveryRoot);
+        const journal = await lstat(path);
+        return {
+            paths,
+            stage: stagePath(paths, token),
+            backup: backupPath(paths, token),
+            recoveryIdentity,
+            journalIdentity: { dev: journal.dev, ino: journal.ino },
+            record,
+            newDigest: null,
+            stageIdentity: null,
+            publishedIdentity: null,
+            settled: false,
+        };
+    }
+    catch (cause) {
+        const suffix = cause instanceof Error &&
+            cause.message === "unresolved Codex recovery state"
+            ? ": unresolved Codex recovery state"
+            : "";
+        throw recoveryError(`cannot begin Codex recovery journal${suffix}`, cause);
+    }
+}
+export async function verifyCodexRecovery(pending) {
+    try {
+        await requirePending(pending);
+    }
+    catch (cause) {
+        const message = cause instanceof Error &&
+            (cause.message === "Codex recovery journal changed" ||
+                cause.message === "Codex recovery journal is already settled")
+            ? cause.message
+            : "cannot verify Codex recovery journal";
+        throw recoveryError(message, cause);
+    }
+}
+async function requirePending(pending) {
+    if (pending.settled) {
+        throw new Error("Codex recovery journal is already settled");
+    }
+    if (pending.stage !== stagePath(pending.paths, pending.record.token) ||
+        pending.backup !== backupPath(pending.paths, pending.record.token)) {
+        throw new Error("Codex recovery paths changed");
+    }
+    if (!sameIdentity(await identity(pending.paths.recoveryRoot), pending.recoveryIdentity)) {
+        throw new Error("Codex recovery directory changed");
+    }
+    const path = recordPath(pending.paths);
+    await assertNoFollowType(path, ["regular-file"]);
+    const journal = await lstat(path);
+    if (!sameIdentity({ dev: journal.dev, ino: journal.ino }, pending.journalIdentity) ||
+        !(await readFile(path)).equals(recordBytes(pending.record))) {
+        throw new Error("Codex recovery journal changed");
+    }
+    await decodeRecord(recordBytes(pending.record), pending.paths);
+}
+export async function finishCodexRecovery(pending) {
+    try {
+        await requirePending(pending);
+        const entries = await readdir(pending.paths.recoveryRoot);
+        if (entries.length !== 1 || entries[0] !== JOURNAL) {
+            throw new Error("unexpected Codex recovery material");
+        }
+        pending.settled = true;
+        await unlink(recordPath(pending.paths));
+        if (!sameIdentity(await identity(pending.paths.recoveryRoot), pending.recoveryIdentity)) {
+            throw new Error("Codex recovery directory changed");
+        }
+        await rmdir(pending.paths.recoveryRoot);
+    }
+    catch (cause) {
+        const message = cause instanceof Error &&
+            (cause.message === "unexpected Codex recovery material" ||
+                cause.message === "Codex recovery journal is already settled")
+            ? cause.message
+            : "cannot finish Codex recovery journal";
+        throw recoveryError(message, cause);
+    }
+}

package/dist/harnesses/codex/state.js

@@ -1,8 +1,15 @@
 import { readFile, realpath } from "node:fs/promises";
 import { join, resolve } from "node:path";
+import { failureResult, successResult, } from "../../adapter-result.js";
+import { digestArtifactTree, readArtifactObject } from "../../artifact-tree.js";
 import { COMMIT_INPUT_RE } from "../../domain/refs.js";
 import { SafetyError } from "../../safety-error.js";
 import { parseStrictJson, } from "../../strict-json.js";
+import { codexReadNativeState } from "./adapter.js";
+import { readCodexAssessment } from "./compatibility.js";
+import { readCodexMarketplace } from "./marketplace.js";
+import { codexPaths } from "./paths.js";
+import { classifyPathNoFollow } from "../../safe-path.js";
 const INSTALLED_PROFILE = {
     duplicateKeys: "last-wins",
     nonStandardConstants: "reject",
@@ -76,3 +83,127 @@ async function comparablePath(path) {
 export async function pathsEqual(a, b) {
     return (await comparablePath(a)) === (await comparablePath(b));
 }
+function preserveFailure(result) {
+    if (result.outcome.ok)
+        throw new Error("expected adapter failure");
+    return failureResult(result.outcome.operation, result.outcome.error.code, result.outcome.error.message, result.outcome.error.hints, result.outcome.messages);
+}
+function mismatch(reason, messages = [], observedIdentity = "") {
+    return successResult("inspect-codex-installed", { kind: "mismatch", observedIdentity }, [
+        ...messages,
+        { channel: "stderr", text: `Codex installation state: ${reason}` },
+    ]);
+}
+async function matchesSelection(root, selection) {
+    const provenance = await readArtifactObject(root, join(root, ".superpowers-upstream.json"));
+    return provenance.source === selection.effectiveSource;
+}
+export function hasFilesystemAccessFailure(cause) {
+    let current = cause;
+    for (let depth = 0; depth < 8 && current !== null && typeof current === "object"; depth += 1) {
+        const code = current.code;
+        if (typeof code === "string" && code !== "ENOENT" && code !== "ENOTDIR") {
+            return true;
+        }
+        current = current.cause;
+    }
+    return false;
+}
+function activeInspectionFailure(operation, root, messages) {
+    return failureResult(operation, "inspect-failed", `cannot inspect active Codex plugin payload at ${root}`, [], messages);
+}
+export async function inspectCodexInstallation(selection, ctx, readNative = codexReadNativeState) {
+    const operation = "inspect-codex-installed";
+    const native = await readNative(ctx);
+    if (!native.outcome.ok)
+        return preserveFailure(native);
+    const messages = native.outcome.messages;
+    const paths = codexPaths(ctx.env ?? {}, process.cwd());
+    let marketplace;
+    try {
+        marketplace = await readCodexMarketplace(paths.marketplaceRoot);
+    }
+    catch {
+        return failureResult(operation, "inspect-failed", `cannot inspect owned Codex marketplace at ${paths.marketplaceRoot}`, [], messages);
+    }
+    const observed = native.outcome.result;
+    const observedIdentity = observed.pluginPresent && observed.activeRoot !== null
+        ? await installedCommitFromRoot(observed.activeRoot)
+        : "";
+    if (!observed.pluginPresent && observed.marketplaceRoot === null) {
+        return successResult(operation, { kind: "absent", observedIdentity: "" }, messages);
+    }
+    if (observed.marketplaceRoot === null) {
+        return mismatch("Codex marketplace registration is missing", messages, observedIdentity);
+    }
+    if (!(await pathsEqual(observed.marketplaceRoot, paths.marketplaceRoot))) {
+        return mismatch("legacy Codex marketplace source", messages, observedIdentity);
+    }
+    if (marketplace === null)
+        return mismatch("durable Codex marketplace is missing", messages, observedIdentity);
+    try {
+        if (marketplace.artifact.commit !== selection.desiredCommit ||
+            marketplace.artifact.compatibility.kind !== "supported" ||
+            !(await matchesSelection(marketplace.artifact.root, selection))) {
+            return mismatch("durable Codex marketplace differs from selection", messages, observedIdentity);
+        }
+    }
+    catch {
+        return failureResult(operation, "inspect-failed", `cannot inspect owned Codex marketplace at ${paths.marketplaceRoot}`, [], messages);
+    }
+    if (!observed.pluginPresent ||
+        !observed.pluginEnabled ||
+        observed.activeRoot === null) {
+        return mismatch("Codex manager plugin needs repair", messages, observedIdentity);
+    }
+    let activeKind;
+    try {
+        activeKind = await classifyPathNoFollow(observed.activeRoot);
+    }
+    catch {
+        return activeInspectionFailure(operation, observed.activeRoot, messages);
+    }
+    if (activeKind === "missing") {
+        return mismatch("active Codex plugin payload is missing", messages, observedIdentity);
+    }
+    if (activeKind !== "directory") {
+        return activeInspectionFailure(operation, observed.activeRoot, messages);
+    }
+    let active;
+    let activeDigest;
+    try {
+        active = await readCodexAssessment(observed.activeRoot);
+        activeDigest = await digestArtifactTree(active.root);
+    }
+    catch (cause) {
+        if (hasFilesystemAccessFailure(cause)) {
+            return activeInspectionFailure(operation, observed.activeRoot, messages);
+        }
+        return mismatch("active Codex plugin payload is invalid", messages, observedIdentity);
+    }
+    let durableDigest;
+    try {
+        durableDigest = await digestArtifactTree(marketplace.artifact.root);
+    }
+    catch {
+        return failureResult(operation, "inspect-failed", `cannot inspect owned Codex marketplace at ${paths.marketplaceRoot}`, [], messages);
+    }
+    try {
+        if (active.commit !== selection.desiredCommit ||
+            active.compatibility.kind !== "supported" ||
+            !(await matchesSelection(active.root, selection)) ||
+            activeDigest !== durableDigest) {
+            return mismatch("active Codex plugin payload differs from durable marketplace", messages, active.commit);
+        }
+    }
+    catch (cause) {
+        if (hasFilesystemAccessFailure(cause)) {
+            return activeInspectionFailure(operation, observed.activeRoot, messages);
+        }
+        return mismatch("active Codex plugin payload is invalid", messages, observedIdentity);
+    }
+    return successResult(operation, {
+        kind: "current",
+        observedIdentity: active.commit,
+    }, messages);
+}