toolroll 0.9.94 → 0.9.96

package/dist/project-tools.js

@@ -19,6 +19,7 @@
  * the agent. A tool connected by signing in gives a run only an access token
  * of its own (oauth-run-token.ts).
  */
+import { prepareProtectedStorage, storageRefusalOf } from "./protected-storage.js";
 import { inReadOnlyRequest } from "./read-only-request.js";
 import { toolRefusal } from "./policy.js";
 import { createHash } from "node:crypto";
@@ -572,17 +573,21 @@ export async function callProjectTool(spec, values, name, args, options) {
         || (result.structuredContent === undefined ? "" : JSON.stringify(result.structuredContent));
     return { ok: true, text, isError: result.isError === true };
 }
-function exchange(spec, values, request, options) {
+async function exchange(spec, values, request, options) {
+    // The server's fence may still be on its way (toolServerFor): an answer that isn't used is never an unhandled failure.
+    const served = Promise.resolve(options.server);
+    served.catch(() => undefined);
     const missing = missingSecrets(spec, values);
     if (missing.length > 0)
-        return Promise.resolve({ ok: false, problem: `Set ${missing.join(", ")} first.` });
+        return { ok: false, problem: `Set ${missing.join(", ")} first.` };
     const timeoutMs = options.timeoutMs ?? 60_000;
     if (spec.transport === "http")
         return exchangeHttp(spec, values, timeoutMs, request);
     // A local server starts only in the server fence its caller made (toolServerFor), never bare.
-    if ("problem" in options.server)
-        return Promise.resolve({ ok: false, problem: options.server.problem });
-    return exchangeStdio(spec, values, timeoutMs, options.env ?? process.env, options.omitEnv ?? [], request, options.server.fence);
+    const server = await served;
+    if ("problem" in server)
+        return { ok: false, problem: server.problem };
+    return exchangeStdio(spec, values, timeoutMs, options.env ?? process.env, options.omitEnv ?? [], request, server.fence);
 }
 function exchangeStdio(spec, values, timeoutMs, base, omit, request, fence) {
     return new Promise(resolve => {
@@ -1137,7 +1142,7 @@ export function splitCommandLine(line) {
  * byte a build wrote can load into a process that holds the tool's secrets. Required: where this machine can't confine
  * it, it doesn't start unless an instance operator allowed unconfined agents.
  */
-export function toolServerFor(store, repo, options = {}) {
+export async function toolServerFor(store, repo, options = {}) {
     const databaseFile = store.databaseFile();
     if (databaseFile === null || databaseFile === "" || databaseFile === ":memory:")
         return { fence: null };
@@ -1149,7 +1154,18 @@ export function toolServerFor(store, repo, options = {}) {
     const poolRoots = [join(dirname(databaseFile), "worktrees"), ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
     const cache = buildCacheFolder(repo, home);
     const untrusted = existsSync(cache) ? [realpathSync(cache)] : [];
-    return { fence: fenceFor("tool-server", { databaseFile, worktree: null, home, boundary: null, binding: null, runFolders: runFolders(null), poolRoots, extra: untrusted }) };
+    // The storage check, awaited off this thread (protected-storage.ts): the console's Test button never waits on it.
+    let storage;
+    try {
+        storage = await prepareProtectedStorage(home);
+    }
+    catch (error) {
+        const refused = storageRefusalOf(error);
+        if (refused === null)
+            throw error;
+        return { problem: refused.message };
+    }
+    return { fence: fenceFor("tool-server", { databaseFile, worktree: null, home, boundary: null, binding: null, runFolders: runFolders(null), poolRoots, storage, extra: untrusted }) };
 }
 /** Each project's `.mcp.json` as the console last read it off its thread (its background pass): what its pages and the
  * lead offer, so neither reads a project folder on the console's thread. */

package/dist/protected-storage-look.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/protected-storage-look.js

@@ -0,0 +1,13 @@
+/**
+ * The storage check's child process (protected-storage.ts prepareProtectedStorage): it finds the protected roots, reads
+ * Firefox's profiles.ini and walks every present root here, where a listing that waits on a macOS privacy prompt holds
+ * up only this process. It writes `at\t<root>` before each walk and `done\t<answer>` at the end; the parent kills it at
+ * its limit and refuses the launch.
+ */
+import { protectedStorageHere } from "./protected-storage.js";
+const request = JSON.parse(process.argv[2] ?? "{}");
+if (typeof request.home !== "string" || typeof request.platform !== "string" || request.env === null || typeof request.env !== "object")
+    process.exit(2);
+const env = Object.fromEntries(Object.entries(request.env).filter((one) => typeof one[1] === "string"));
+const answer = protectedStorageHere(request.home, env, request.platform, () => { }, undefined, root => { process.stdout.write(`at\t${JSON.stringify(root)}\n`); });
+process.stdout.write(`done\t${JSON.stringify(answer)}\n`);

package/dist/protected-storage.d.ts

@@ -21,47 +21,78 @@ export declare const PROTECTED_WALK: {
 };
 /** The roots by name, under the (real) home folder and the overrides the plane's environment names. */
 export declare function protectedStorageNames(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform): string[];
+/** What one launch keeps out: every root by name (`names`), and every protected path it denies (`denies`). */
+export type ProtectedStorage = {
+    names: string[];
+    denies: string[];
+};
 /**
- * Every protected path one launch denies: each root by name and by real path, every link inside a present root that
- * leads outward (where it leads, by real path and as spelled), and the overrides. Resolved at each launch, never kept.
- * A link macOS makes in a sandboxed app's container to the same place under the home folder (its Desktop, Downloads,
- * Fonts…) is the system's own mirror of the person's folders, not the app's data, and isn't followed (systemMirror).
+ * The storage check, run right here: every root by name and by real path, every link inside a present root that leads
+ * outward (where it leads, by real path and as spelled), and the overrides. `unfinished` names each present root whose
+ * walk met an error other than "not there" or "not allowed": its links aren't all known. A link macOS makes in a
+ * sandboxed app's container to the same place under the home folder (its Desktop, Downloads, Fonts…) is the system's
+ * own mirror of the person's folders, not the app's data, and isn't followed (systemMirror).
  *
- * On a Mac, listing inside another app's container waits for the person to answer macOS's "access data from other apps"
- * prompt when the process asking has no answer yet (a plane run by launchd: every launch, and the console with it, hung
- * there in release check 3249). So the containers are walked only after a time-limited look in a child process
- * (`containers`, containersListable) shows they can be listed without waiting. A look that fails any other way refuses
- * the launch (it throws). When macOS is waiting on the person, the containers stay denied by name and real path, and
- * the outward links the last complete walk found (kept in the plane's own state folder, linkCacheFile) stay denied too;
- * with none kept, only the roots are denied, and that is said once.
+ * On a Mac a listing (or an open) inside another app's data can wait until a person answers a privacy prompt, so there
+ * this runs only in the check's own child process (prepareProtectedStorage), never on a thread that serves anything.
+ * `at` is told each root before its walk starts, so a check that runs out of time can name the app it was waiting on.
  */
-export declare function protectedStorageDenies(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, say?: (line: string) => void, containers?: (roots: readonly string[]) => boolean, list?: (path: string) => import("node:fs").Dirent[]): string[];
-/** How long the look at other apps' containers may take before Toolroll takes it that macOS is waiting on the person. */
-export declare const CONTAINER_LOOK_MS = 3000;
-/** What a look at the containers found: listable without waiting, macOS waiting on the person (the look timed out), or
- * the look itself failing (it couldn't start, crashed or was killed by anything but its own limit). */
-export type ContainerLook = "listable" | "waiting" | "failed";
+export declare function protectedStorageHere(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, say?: (line: string) => void, list?: (path: string) => import("node:fs").Dirent[], at?: (root: string) => void): ProtectedStorage & {
+    unfinished: string[];
+};
+/** Every protected path, checked right here (protectedStorageHere), for a caller that has no prepared check. */
+export declare function protectedStorageDenies(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, say?: (line: string) => void, list?: (path: string) => import("node:fs").Dirent[]): string[];
+/** How long the storage check may take before the launch is refused (a slow Mac finishes well inside it). */
+export declare const STORAGE_LOOK_MS = 10000;
+/** What the check asked of its child, and how the child's run ended. */
+export type StorageLookRequest = {
+    home: string;
+    env: Record<string, string>;
+    platform: NodeJS.Platform;
+};
+export type StorageLookResult = {
+    kind: "done";
+    storage: ProtectedStorage;
+    unfinished: string[];
+} | {
+    kind: "timed-out";
+    at: string | null;
+} | {
+    kind: "failed";
+    detail: string;
+};
+export type StorageLook = (request: StorageLookRequest) => Promise<StorageLookResult>;
+/** Why a launch didn't start: the storage check couldn't finish. Its words survive every catch (storageRefusalOf). */
+export declare class ProtectedStorageRefusal extends Error {
+    readonly apps: readonly string[];
+    readonly why: "timed-out" | "unfinished" | "failed";
+    readonly code: "protected-storage";
+    constructor(apps: readonly string[], why: "timed-out" | "unfinished" | "failed", message: string);
+}
+/** The storage refusal inside a caught error, when it is one. */
+export declare function storageRefusalOf(error: unknown): ProtectedStorageRefusal | null;
+/** Which program macOS must allow: the one this plane runs as. A launchd service is its program itself; a plane started
+ * from a terminal asks as that terminal app. */
+export declare function storageAccessHolder(env?: Readonly<Record<string, string | undefined>>, execPath?: string, versions?: NodeJS.ProcessVersions): string;
+/** Why nothing was launched, and what the person does about it. Never says macOS is asking: that isn't known. */
+export declare function storageRefusalWords(apps: readonly string[], why: ProtectedStorageRefusal["why"], holder: string): string;
 /**
- * Whether this process can list inside these app containers without macOS stopping to ask the person: the walk run
- * first in a child process that is killed at CONTAINER_LOOK_MS. Finishing in time (listed, or refused outright) means
- * the walk can run here too; only running into that limit means macOS is waiting on the person (only the child waited).
- * A look that fails any other way is tried once more, then throws: the launch is refused rather than fenced with less.
- * A yes is kept (macOS keeps the person's answer); a no is looked at again after CONTAINER_RELOOK_MS.
+ * The storage check for one launch, awaited: what it denies, from a walk that finished just now. On a Mac the whole check
+ * (finding the roots, reading profiles.ini, every walk) runs in a child process, so a listing that waits on a privacy
+ * prompt holds up only that child; the thread that asked keeps serving. A check that doesn't finish within
+ * STORAGE_LOOK_MS, fails, or leaves a present root's walk unfinished refuses the launch (ProtectedStorageRefusal): no
+ * earlier walk stands in for it, since a link can move inside a root at any time. Checks asked for at once share one child.
  */
-export declare function containersListable(roots: readonly string[], look?: (roots: readonly string[]) => ContainerLook, now?: () => number): boolean;
-/** A look's outcome from its child's result: only its own limit (ETIMEDOUT) is macOS waiting; any other error, signal
- * or exit code is a failed look. */
-export declare function lookOutcome(result: {
-    error?: Error;
-    signal: NodeJS.Signals | null;
-    status: number | null;
-}): ContainerLook;
-/** Where the outward links the last complete container walk found are kept: the plane's own state folder (fenced from
- * every build), one file per user. */
-export declare function linkCacheFile(home: string, env?: Readonly<Record<string, string | undefined>>): string;
-/** The kept links for this home: only a plain file of this user's (no link), at most LINK_CACHE_MAX, of exactly the
- * kept shape; anything else is no cache at all. */
-export declare function readLinkCache(file: string, home: string): string[] | null;
-/** Keep a complete walk's links: written aside (owner-only) and renamed into place, only into a state folder that is
- * already there. A failed write keeps whatever was kept before. */
-export declare function writeLinkCache(file: string, home: string, targets: readonly string[]): void;
+export declare function prepareProtectedStorage(home?: string, env?: Readonly<Record<string, string | undefined>>, platform?: NodeJS.Platform, look?: StorageLook, holder?: string): Promise<ProtectedStorage>;
+/** Where the check's child script is: beside this module once built, else the built copy (a run from source). */
+export declare function storageLookScript(): string;
+/** A finished child's lines as the check's answer: `at\t<root>` before each walk, `done\t<answer>` once at the end. */
+export declare function readLook(ran: SpawnedLook): StorageLookResult;
+/** How a child ran: everything it wrote, and whether it finished, ran out of time (killed) or failed some other way. */
+export type SpawnedLook = {
+    stdout: string;
+    outcome: "done" | "timed-out" | "failed";
+    detail: string;
+};
+/** Run a child without waiting on this thread: its output, bounded, and how it ended. Killed at `limitMs`. */
+export declare function spawnLook(command: string, args: readonly string[], limitMs: number): Promise<SpawnedLook>;