talos-code 0.0.1 → 0.2.0

package/dist/provider/system-keyring.js

@@ -0,0 +1,214 @@
+import { randomUUID } from 'node:crypto';
+import { lstatSync, readlinkSync, realpathSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from 'node:path';
+import { t } from "../i18n/index.js";
+/*
+ * ⛔⛔⛔ WHY THE APPROVED-ROOTS GUARD EXISTS — read for B1 slice 19. The file arrived whole with the gold
+ * baseline (7e5b048b, "restore verified gold baseline"), and no commit records the reason, so it is read
+ * from the code, from its test (a fake module in an ANCESTOR `node_modules` must be refused) and from
+ * this host:
+ *
+ * - Node's resolution does not stop at TALOS's own folders. From `harness-ui/package.json` it walks every
+ *   ancestor `node_modules` up to the drive root, then `~/.node_modules`, `~/.node_libraries` and
+ *   `<prefix>/lib/node`.
+ * - On Windows the drive root lets any signed-in account create a folder (`icacls C:\` on this host:
+ *   `NT AUTHORITY\Authenticated Users:(AD)`, and Modify on what they create). Anyone with a local account
+ *   can therefore create `C:\node_modules`.
+ * - `@napi-rs/keyring` is native code that is handed every provider key TALOS stores. Loaded from such a
+ *   folder, it would run with the owner's rights and could read or send the keys anywhere.
+ *
+ * On this host that is what happened, harmlessly: `C:\node_modules` is a junction into another
+ * checkout's `harness-ui\node_modules`, and a worktree without `harness-ui\node_modules` resolved the
+ * keyring there. The guard refused it, correctly; `doctor` just could not say so.
+ *
+ * ⛔ THE CURE: the module must be resolvable INSIDE the approved roots.
+ * - Installed: `cli/scripts/stage-windows.mjs` copies the dependency trees to `app/node_modules` and
+ *   `app/vendor/harness-ui/node_modules`, both approved (read in code, not staged).
+ * - CI: `npm --prefix harness-ui ci`, inside the checkout.
+ * - Development: a `harness-ui\node_modules` inside the checkout — a real install, or ONE junction like the
+ *   `cli\node_modules` every worktree here already has. Node reports the REAL path behind a junction, so
+ *   the lexical roots alone refuse even that.
+ *
+ * ⛔⛔ Round 2, after adversarial review: "the real path of an approved root is approved" was too wide. A
+ * link at the root can be trusted as far as whoever placed it, but not further: the reviewer loaded an
+ * attacker module through a second link someone else could re-point (A2), through a junction into the real
+ * `C:\node_modules` (A3), into an ancestor folder (E), and into the drive root itself (E2). A real path is
+ * approved now only when ALL of these hold:
+ *  1. the approved root is at most a single link, and its target is not a link and not below one — checked
+ *     as realpath(target) equal to the target, which fails for both;
+ *  2. the target is not a drive root;
+ *  3. the target is not an ancestor of the checkout;
+ *  4. the target is not inside a `node_modules` folder of an ancestor of the checkout — the folders Node's
+ *     own lookup reaches, and exactly what `C:\node_modules` is; without this, A3 passes 1-3 on any host
+ *     where that folder is a plain directory instead of a junction;
+ *  5. the module lies under `<target>\@napi-rs\keyring\`.
+ * ⛔ The verdict is reached BEFORE anything is loaded: a refused module never runs a line of code.
+ * ⛔ What this does NOT judge: who may write to the target. A junction to a folder other accounts can write
+ *   into (a shared temporary folder, another drive's subfolder) passes when it satisfies 1-5. The guard
+ *   reads no ACLs.
+ * ⛔ REFUSED as a design: recognising a junction ABOVE the checkout because its target looks like a TALOS
+ *   location. Whoever creates `C:\node_modules` chooses where it points.
+ */
+function inside(root, candidate) {
+    const rel = relative(resolve(root), resolve(candidate));
+    return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel));
+}
+function strictlyInside(root, candidate) { return inside(root, candidate) && relative(resolve(root), resolve(candidate)) !== ''; }
+function samePath(a, b) { return relative(resolve(a), resolve(b)) === ''; }
+function approvedModuleRoots(repoRoot) {
+    const roots = [join(repoRoot, 'harness-ui', 'node_modules'), join(repoRoot, 'node_modules')];
+    if (basename(repoRoot).toLowerCase() === 'vendor')
+        roots.push(join(dirname(repoRoot), 'node_modules'));
+    return roots;
+}
+/** Every folder above the checkout, nearest first, up to the drive root. */
+function ancestorsOf(path) {
+    const out = [];
+    let current = dirname(resolve(path));
+    for (;;) {
+        out.push(current);
+        const next = dirname(current);
+        if (next === current)
+            break;
+        current = next;
+    }
+    return out;
+}
+/** One line, bounded: an error's later lines are stack frames, and doctor prints one line per check. */
+function firstLine(error) {
+    const text = error instanceof Error ? error.message : String(error);
+    return (text.split(/\r?\n/u)[0] ?? '').slice(0, 300);
+}
+/**
+ * The keyring folder a single link at an approved root may stand for, or null. Rules 1-4 of the block
+ * above; rule 5 is the caller's containment check against the folder returned here.
+ */
+function linkedKeyringFolder(root, repoRoot, fs) {
+    try {
+        if (!fs.lstat(root).isSymbolicLink())
+            return null;
+        const target = resolve(dirname(root), fs.readlink(root));
+        if (!fs.lstat(target).isDirectory())
+            return null;
+        const real = fs.realpath(target);
+        if (!samePath(real, target))
+            return null; /* 1 */
+        if (samePath(parse(real).root, real))
+            return null; /* 2 */
+        if (inside(real, repoRoot))
+            return null; /* 3 */
+        if (ancestorsOf(repoRoot).some(ancestor => inside(join(ancestor, 'node_modules'), real)))
+            return null; /* 4 */
+        return join(real, '@napi-rs', 'keyring');
+    }
+    catch {
+        return null;
+    }
+}
+/*
+ * R2 (gate E13): how many times this process tried to LOAD the native module (after resolution and the approved-roots check, the
+ * step that runs its code). `doctor` reports whether its own run moved it (`nativeModuleLoaded`): the observable by which the
+ * acceptance scenario s16 proves that a memory profile never opened the OS store.
+ */
+let moduleLoads = 0;
+export function systemKeyringModuleLoads() { return moduleLoads; }
+export function loadTalosSystemKeyring(repoRoot, deps = {}) {
+    /* Created on first use and inside the try below: a repoRoot Node refuses as an anchor is a reason, never a throw. */
+    let requireFromTalos;
+    const talosRequire = () => requireFromTalos ??= createRequire(join(repoRoot, 'harness-ui', 'package.json'));
+    const resolveModule = deps.resolve ?? ((request) => talosRequire().resolve(request));
+    const loadModule = deps.load ?? ((file) => talosRequire()(file));
+    const fs = {
+        lstat: deps.lstat ?? ((path) => lstatSync(path)),
+        readlink: deps.readlink ?? ((path) => readlinkSync(path)),
+        realpath: deps.realpath ?? ((path) => realpathSync(path)),
+    };
+    const roots = approvedModuleRoots(repoRoot);
+    let location;
+    try {
+        location = resolveModule('@napi-rs/keyring');
+    }
+    catch (error) {
+        if (error?.code === 'MODULE_NOT_FOUND')
+            return { ok: false, reason: 'module-missing', approvedRoots: roots };
+        return { ok: false, reason: 'load-failed', detail: firstLine(error) };
+    }
+    const lexical = roots.some(root => inside(root, location));
+    const linked = roots.map(root => linkedKeyringFolder(root, repoRoot, fs)).filter((folder) => folder !== null);
+    if (!lexical && !linked.some(folder => strictlyInside(folder, location)))
+        return { ok: false, reason: 'outside-approved-roots', location, approvedRoots: roots }; /* 5 */
+    let mod;
+    moduleLoads++;
+    try {
+        mod = loadModule(location);
+    }
+    catch (error) {
+        return { ok: false, reason: 'load-failed', location, detail: firstLine(error) };
+    }
+    return typeof mod?.Entry === 'function' ? { ok: true, Entry: mod.Entry, location } : { ok: false, reason: 'invalid-module', location };
+}
+export function keyringModuleAvailable(repoRoot, deps = {}) { return loadTalosSystemKeyring(repoRoot, deps).ok; }
+export async function diagnoseKeyringProbe(keyring, account = randomUUID()) {
+    const service = 'talos-cli-doctor';
+    const value = `probe-${randomUUID()}`;
+    try {
+        try {
+            await keyring.set(service, account, value);
+        }
+        catch (error) {
+            return { ok: false, stage: 'write', detail: firstLine(error) };
+        }
+        let read;
+        try {
+            read = await keyring.get(service, account);
+        }
+        catch (error) {
+            return { ok: false, stage: 'read', detail: firstLine(error) };
+        }
+        return read === value ? { ok: true } : { ok: false, stage: 'mismatch' };
+    }
+    finally {
+        try {
+            await keyring.remove(service, account);
+        }
+        catch { /* diagnostic cleanup is best effort */ }
+    }
+}
+export async function probeSystemKeyring(keyring, account = randomUUID()) { return (await diagnoseKeyringProbe(keyring, account)).ok; }
+/*
+ * R2 (gate E1): `KEYRING_TEXT` moved into the dictionary (`i18n/en/credentials.ts`, `store.keyring.*`), words unchanged. These
+ * two functions stay the only place that picks them: `doctor` prints them, and the next surface that needs the reason reuses them.
+ */
+export function describeKeyringProblem(problem) {
+    switch (problem.reason) {
+        case 'module-missing': return t('store.keyring.moduleMissing', { roots: problem.approvedRoots.join('; ') });
+        case 'outside-approved-roots': return t('store.keyring.outsideApprovedRoots', { location: problem.location, roots: problem.approvedRoots.join('; ') });
+        case 'load-failed': return problem.location === undefined ? t('store.keyring.unresolved', { detail: problem.detail }) : t('store.keyring.loadFailed', { location: problem.location, detail: problem.detail });
+        case 'invalid-module': return t('store.keyring.invalidModule', { location: problem.location });
+    }
+}
+export function describeKeyringProbeFailure(outcome) {
+    if (outcome.stage === 'mismatch')
+        return t('store.keyring.probeMismatch');
+    return t(outcome.stage === 'write' ? 'store.keyring.probeWriteFailed' : 'store.keyring.probeReadFailed', { detail: outcome.detail });
+}
+export function systemKeyringAdapter(Entry) {
+    return {
+        get(service, account) { try {
+            return new Entry(service, account).getPassword() || null;
+        }
+        catch {
+            return null;
+        } },
+        set(service, account, value) { new Entry(service, account).setPassword(value); },
+        remove(service, account) { try {
+            new Entry(service, account).deletePassword();
+        }
+        catch { /* idempotent removal */ } },
+    };
+}
+export function createTalosSystemKeyring(repoRoot, deps = {}) {
+    const loaded = loadTalosSystemKeyring(repoRoot, deps);
+    return loaded.ok ? systemKeyringAdapter(loaded.Entry) : null;
+}

package/dist/runtime/active-run.js

@@ -0,0 +1,63 @@
+import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+function dir(paths) { return join(paths.dataRoot, 'active-runs'); }
+function marker(paths, pid = process.pid) { return join(dir(paths), `${pid}.json`); }
+function alive(pid) { try {
+    process.kill(pid, 0);
+    return true;
+}
+catch (error) {
+    return error?.code === 'EPERM';
+} }
+export async function registerActiveRun(paths, info = {}) {
+    const root = dir(paths);
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    const file = marker(paths);
+    const record = { pid: process.pid, startedAt: new Date().toISOString(), ...info };
+    await writeFile(file, `${JSON.stringify(record)}\n`, { encoding: 'utf8', mode: 0o600 });
+    let released = false;
+    return async () => { if (released)
+        return; released = true; await rm(file, { force: true }); };
+}
+/* R5b D3: `exceptPid` leaves out a process (the TUI asking about the others: main.ts registers it for its whole life) and
+   `projectRoot` counts only the runs of that project; a marker that does not name its project still counts. */
+function sameRoot(a, b) { const x = resolve(a), y = resolve(b); return process.platform === 'win32' ? x.toLowerCase() === y.toLowerCase() : x === y; }
+export async function hasActiveRuns(paths, deps = {}) {
+    const isProcessAlive = deps.isProcessAlive ?? alive;
+    let names;
+    try {
+        names = await readdir(dir(paths));
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+    let any = false;
+    for (const name of names) {
+        if (!/^\d+\.json$/u.test(name))
+            continue;
+        const file = join(dir(paths), name);
+        let pid = 0;
+        let root = null;
+        try {
+            const data = JSON.parse(await readFile(file, 'utf8'));
+            pid = Number(data?.pid);
+            root = data?.projectRoot;
+        }
+        catch {
+            await rm(file, { force: true });
+            continue;
+        }
+        if (!Number.isSafeInteger(pid) || pid <= 0 || !isProcessAlive(pid)) {
+            await rm(file, { force: true });
+            continue;
+        }
+        if (deps.exceptPid === pid)
+            continue;
+        if (deps.projectRoot && typeof root === 'string' && root && !sameRoot(root, deps.projectRoot))
+            continue;
+        any = true;
+    }
+    return any;
+}

package/dist/runtime/agent-tree.js

@@ -0,0 +1,74 @@
+export class CliAgentTreeError extends Error {
+    code = 'AGENT_TREE_INVALID';
+    constructor(message = 'Agent tree input is invalid.') { super(message); this.name = 'CliAgentTreeError'; }
+}
+function copyUsage(value) { return value ? { ...value } : null; }
+function copyCollisions(value) { return value.map(row => ({ ...row })); }
+function copyEvidence(value) { return value ? { ...value } : null; }
+function nodeOf(row, children) {
+    return {
+        id: row.id,
+        parentId: row.parentId,
+        nativeDepth: row.depth,
+        name: row.name,
+        task: row.delegatedTask,
+        model: row.model,
+        outcome: row.outcome,
+        interrupted: row.interrupted,
+        startedAt: row.startedAt,
+        updatedAt: row.updatedAt,
+        endedAt: row.endedAt,
+        usage: copyUsage(row.usage),
+        collisions: copyCollisions(row.collisions),
+        delegationOutcome: row.delegationOutcome,
+        delegationEvidence: copyEvidence(row.delegationEvidence),
+        children,
+    };
+}
+export function buildAgentTree(rows, focusId) {
+    const byId = new Map();
+    for (const row of rows) {
+        if (typeof row.id !== 'string' || !row.id)
+            throw new CliAgentTreeError('Agent tree contains an empty session id.');
+        if (byId.has(row.id))
+            throw new CliAgentTreeError('Agent tree contains duplicate session ids.');
+        byId.set(row.id, row);
+    }
+    const focus = byId.get(focusId);
+    if (!focus)
+        return null;
+    const validParent = new Map();
+    const childIds = new Map();
+    for (const row of rows) {
+        if (!row.parentId)
+            continue;
+        const parent = byId.get(row.parentId);
+        if (!parent || row.depth !== parent.depth + 1)
+            continue;
+        validParent.set(row.id, parent.id);
+        const siblings = childIds.get(parent.id);
+        if (siblings)
+            siblings.push(row.id);
+        else
+            childIds.set(parent.id, [row.id]);
+    }
+    let root = focus;
+    const climbSeen = new Set();
+    while (validParent.has(root.id)) {
+        if (climbSeen.has(root.id))
+            throw new CliAgentTreeError('Agent tree contains a delegation cycle.');
+        climbSeen.add(root.id);
+        const parent = byId.get(validParent.get(root.id));
+        if (!parent)
+            break;
+        root = parent;
+    }
+    const build = (id) => {
+        const row = byId.get(id);
+        if (!row)
+            throw new CliAgentTreeError('Agent tree references a missing session.');
+        const children = (childIds.get(id) ?? []).map(build);
+        return nodeOf(row, children);
+    };
+    return { focusId: focus.id, root: build(root.id) };
+}

package/dist/runtime/attachments.js

@@ -0,0 +1,84 @@
+import path from 'node:path';
+export const ATTACHMENT_MAX_COUNT = 10;
+export const TEXT_ATTACHMENT_MAX_BYTES = 256 * 1024;
+export const TEXT_ATTACHMENTS_MAX_BYTES = 1024 * 1024;
+export const IMAGE_ATTACHMENT_MAX_BYTES = 5 * 1024 * 1024;
+export const IMAGE_ATTACHMENTS_MAX_BYTES = 12 * 1024 * 1024;
+export class CliAttachmentError extends Error {
+    code;
+    constructor(code, message = code) { super(message); this.name = 'CliAttachmentError'; this.code = code; }
+}
+function safePath(value) {
+    if (typeof value !== 'string' || value.length === 0 || value.length > 1024 || /[\0\r\n]/u.test(value) || value.includes('\\') || path.posix.isAbsolute(value) || path.win32.isAbsolute(value) || value.split('/').some(part => part === '..'))
+        throw new CliAttachmentError('ATTACHMENT_INVALID', 'Attachment path is invalid.');
+    return value;
+}
+function exactBase64(value) {
+    if (typeof value !== 'string' || value.length === 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(value))
+        throw new CliAttachmentError('ATTACHMENT_INVALID', 'Attachment image data is invalid.');
+    const bytes = Buffer.from(value, 'base64');
+    if (bytes.toString('base64') !== value)
+        throw new CliAttachmentError('ATTACHMENT_INVALID', 'Attachment image data is not canonical base64.');
+    return bytes;
+}
+export function imageMimeFromBytes(value) {
+    const bytes = Buffer.from(value);
+    if (bytes.length >= 8 && bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])))
+        return 'image/png';
+    if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255)
+        return 'image/jpeg';
+    if (bytes.length >= 12 && bytes.toString('ascii', 0, 4) === 'RIFF' && bytes.toString('ascii', 8, 12) === 'WEBP')
+        return 'image/webp';
+    return null;
+}
+export function validateCliAttachments(input) {
+    if (input === undefined)
+        return [];
+    if (!Array.isArray(input))
+        throw new CliAttachmentError('ATTACHMENT_INVALID', 'Attachments must be an array.');
+    if (input.length > ATTACHMENT_MAX_COUNT)
+        throw new CliAttachmentError('ATTACHMENT_COUNT_LIMIT', `A message can attach at most ${ATTACHMENT_MAX_COUNT} files.`);
+    let textBytes = 0, imageBytes = 0;
+    const out = [];
+    for (const row of input) {
+        if (!row || typeof row !== 'object')
+            throw new CliAttachmentError('ATTACHMENT_INVALID');
+        const attachmentPath = safePath(row.path);
+        if (row.kind === 'text') {
+            if (row.mimeType !== 'text/plain' || typeof row.text !== 'string' || !Number.isSafeInteger(row.bytes) || row.bytes < 0 || Buffer.byteLength(row.text, 'utf8') !== row.bytes)
+                throw new CliAttachmentError('ATTACHMENT_INVALID', 'Text attachment metadata does not match its content.');
+            if (row.bytes > TEXT_ATTACHMENT_MAX_BYTES)
+                throw new CliAttachmentError('ATTACHMENT_TEXT_TOO_LARGE', `Text references are limited to ${TEXT_ATTACHMENT_MAX_BYTES} bytes each.`);
+            textBytes += row.bytes;
+            if (textBytes > TEXT_ATTACHMENTS_MAX_BYTES)
+                throw new CliAttachmentError('ATTACHMENT_TEXT_TOTAL_LIMIT', `Text references are limited to ${TEXT_ATTACHMENTS_MAX_BYTES} bytes per message.`);
+            out.push({ kind: 'text', path: attachmentPath, mimeType: 'text/plain', bytes: row.bytes, text: row.text });
+            continue;
+        }
+        if (row.kind === 'image') {
+            if (!['image/png', 'image/jpeg', 'image/webp'].includes(row.mimeType) || !Number.isSafeInteger(row.bytes) || row.bytes <= 0)
+                throw new CliAttachmentError('ATTACHMENT_INVALID', 'Image attachment metadata is invalid.');
+            const bytes = exactBase64(row.dataBase64);
+            if (bytes.length !== row.bytes)
+                throw new CliAttachmentError('ATTACHMENT_INVALID', 'Image attachment byte count does not match its content.');
+            if (row.bytes > IMAGE_ATTACHMENT_MAX_BYTES)
+                throw new CliAttachmentError('ATTACHMENT_IMAGE_TOO_LARGE', `Images are limited to ${IMAGE_ATTACHMENT_MAX_BYTES} bytes each.`);
+            if (imageMimeFromBytes(bytes) !== row.mimeType)
+                throw new CliAttachmentError('ATTACHMENT_IMAGE_SIGNATURE', 'The declared image type does not match its bytes.');
+            imageBytes += row.bytes;
+            if (imageBytes > IMAGE_ATTACHMENTS_MAX_BYTES)
+                throw new CliAttachmentError('ATTACHMENT_IMAGE_TOTAL_LIMIT', `Images are limited to ${IMAGE_ATTACHMENTS_MAX_BYTES} bytes per message.`);
+            out.push({ kind: 'image', path: attachmentPath, mimeType: row.mimeType, bytes: row.bytes, dataBase64: row.dataBase64 });
+            continue;
+        }
+        throw new CliAttachmentError('ATTACHMENT_INVALID', 'Attachment kind is unsupported.');
+    }
+    return out;
+}
+export function renderPromptWithAttachments(prompt, attachments) {
+    const textRows = attachments.filter((row) => row.kind === 'text');
+    if (textRows.length === 0)
+        return prompt;
+    const blocks = textRows.map(row => `[TALOS project reference: ${row.path} · ${row.bytes} bytes]\n${row.text}\n[End TALOS project reference]`);
+    return `${prompt}\n\n${blocks.join('\n\n')}`;
+}