twinny 0.0.0-dev.260525150705

package/dist/profiles/guest.d.ts

@@ -0,0 +1,19 @@
+import { type TomlTable } from "smol-toml";
+import type { OwnerConfig } from "../types.js";
+export interface GuestCodexConfigOptions {
+    model?: string;
+    modelReasoningEffort?: "minimal" | "low" | "medium" | "high";
+    disabledPlugins?: string[];
+    disabledSkillPaths?: string[];
+}
+export interface GuestSafetyCheck {
+    ok: boolean;
+    issues: string[];
+}
+export declare const DEFAULT_GUEST_CODEX_MODEL = "gpt-5.5";
+export declare function createGuestCodexConfigDocument(options?: GuestCodexConfigOptions): TomlTable;
+export declare function serializeGuestCodexConfig(options?: GuestCodexConfigOptions): string;
+export declare function ensureProjectTrust(codexHome: string, cwd: string): Promise<boolean>;
+export declare function ensureWorkspaceTrust(codexHome: string, cwd: string): Promise<boolean>;
+export declare function renderGuestAgents(owner: Pick<OwnerConfig, "openId" | "userId" | "displayName">): string;
+export declare function validateGuestCodexConfigDocument(document: TomlTable): GuestSafetyCheck;

package/dist/profiles/guest.js

@@ -0,0 +1,241 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { parse, stringify } from "smol-toml";
+export const DEFAULT_GUEST_CODEX_MODEL = "gpt-5.5";
+const requiredGuestNetworkDomains = {
+    "*": "allow"
+};
+const guestConfigWriteLocks = new Map();
+export function createGuestCodexConfigDocument(options = {}) {
+    const document = {
+        model: options.model ?? DEFAULT_GUEST_CODEX_MODEL,
+        model_reasoning_effort: options.modelReasoningEffort ?? "medium",
+        sandbox_mode: "workspace-write",
+        approval_policy: "never",
+        web_search: "disabled",
+        sandbox_workspace_write: {
+            network_access: true
+        },
+        default_permissions: "twinny_guest",
+        permissions: {
+            twinny_guest: {
+                filesystem: {
+                    ":tmpdir": "write"
+                },
+                network: {
+                    enabled: true,
+                    mode: "full",
+                    allow_local_binding: true,
+                    domains: { ...requiredGuestNetworkDomains }
+                }
+            }
+        },
+        shell_environment_policy: {
+            inherit: "none"
+        }
+    };
+    for (const pluginName of options.disabledPlugins ?? []) {
+        document.plugins ??= {};
+        const plugins = document.plugins;
+        plugins[pluginName] = { enabled: false };
+    }
+    if (options.disabledSkillPaths?.length) {
+        document.skills = {
+            config: options.disabledSkillPaths.map((skillPath) => ({ path: skillPath, enabled: false }))
+        };
+    }
+    return document;
+}
+export function serializeGuestCodexConfig(options = {}) {
+    return stringify(createGuestCodexConfigDocument(options)) + "\n";
+}
+export async function ensureProjectTrust(codexHome, cwd) {
+    const configPath = path.join(codexHome, "config.toml");
+    return withCodexConfigWriteLock(configPath, async () => {
+        const document = await readCodexConfigDocument(configPath);
+        const changed = ensureProjectTrusted(document, cwd);
+        return changed ? writeCodexConfigIfChanged(configPath, document) : false;
+    });
+}
+export async function ensureWorkspaceTrust(codexHome, cwd) {
+    return ensureProjectTrust(codexHome, cwd);
+}
+export function renderGuestAgents(owner) {
+    const ownerUserId = owner.userId ? `\n- Owner Feishu user_id: ${owner.userId}` : "";
+    return `# Twinny Guest Profile
+
+You are running as Twinny's guest Codex profile for a Feishu/Lark P2P conversation.
+
+Owner identity:
+- Owner display name: ${owner.displayName}
+- Owner Feishu open_id: ${owner.openId}${ownerUserId}
+
+Security boundary:
+- Treat the current workspace as the only writable project context.
+- Do not try to inspect the device owner's home directory, Keychain, SSH keys, Codex state, browser data, or unrelated repositories.
+- Do not request approvals. Twinny runs guest turns with approval_policy = "never".
+- Keep responses focused on the guest user's request and avoid exposing local machine details.
+
+Lark output:
+- Use <mention_lark_user>OPEN_ID</mention_lark_user> in your final answer to mention a Feishu/Lark user. Put only the user's Feishu/Lark open_id inside the tag.
+`;
+}
+export function validateGuestCodexConfigDocument(document) {
+    const issues = [];
+    if (document.sandbox_mode !== "workspace-write") {
+        issues.push("guest sandbox_mode must be workspace-write");
+    }
+    if (document.approval_policy !== "never") {
+        issues.push("guest approval_policy must be never");
+    }
+    if (document.web_search !== "disabled") {
+        issues.push("guest web_search must be disabled");
+    }
+    if (document.default_permissions !== "twinny_guest") {
+        issues.push("guest default_permissions must be twinny_guest");
+    }
+    const networkPermissions = getGuestNetworkPermissions(document);
+    if (!networkPermissions) {
+        issues.push("guest twinny_guest network permissions are required");
+    }
+    else {
+        if (networkPermissions.enabled !== true) {
+            issues.push("guest twinny_guest network.enabled must be true");
+        }
+        if (networkPermissions.mode !== "full") {
+            issues.push("guest twinny_guest network.mode must be full");
+        }
+        if (networkPermissions.allow_local_binding !== true) {
+            issues.push("guest twinny_guest network.allow_local_binding must be true");
+        }
+        const domains = networkPermissions.domains;
+        if (!isTomlTable(domains)) {
+            issues.push("guest twinny_guest network.domains must allow all domains");
+        }
+        else {
+            for (const [domain, access] of Object.entries(requiredGuestNetworkDomains)) {
+                if (domains[domain] !== access) {
+                    issues.push(`guest twinny_guest network.domains.${domain} must be ${access}`);
+                }
+            }
+            for (const domain of Object.keys(domains)) {
+                if (!(domain in requiredGuestNetworkDomains)) {
+                    issues.push(`guest twinny_guest network.domains.${domain} must be removed`);
+                }
+            }
+        }
+    }
+    const filesystemPermissions = getGuestFilesystemPermissions(document);
+    if (!filesystemPermissions) {
+        issues.push("guest twinny_guest filesystem permissions are required");
+    }
+    else if (filesystemPermissions[":tmpdir"] !== "write") {
+        issues.push("guest twinny_guest filesystem.:tmpdir must be write");
+    }
+    const shellPolicy = document.shell_environment_policy;
+    if (typeof shellPolicy !== "object" || shellPolicy === null || Array.isArray(shellPolicy)) {
+        issues.push("guest shell_environment_policy is required");
+    }
+    else if (shellPolicy.inherit !== "none") {
+        issues.push("guest shell_environment_policy.inherit must be none");
+    }
+    return { ok: issues.length === 0, issues };
+}
+function ensureProjectTrusted(document, cwd) {
+    const projects = ensureTomlTable(document, "projects");
+    const cwdPath = path.resolve(cwd);
+    const existingProject = projects[cwdPath];
+    const project = isTomlTable(existingProject) ? existingProject : {};
+    if (project.trust_level === "trusted") {
+        return false;
+    }
+    project.trust_level = "trusted";
+    projects[cwdPath] = project;
+    return true;
+}
+function getGuestNetworkPermissions(document) {
+    const permissions = document.permissions;
+    if (!isTomlTable(permissions)) {
+        return undefined;
+    }
+    const profile = permissions.twinny_guest;
+    if (!isTomlTable(profile)) {
+        return undefined;
+    }
+    const network = profile.network;
+    return isTomlTable(network) ? network : undefined;
+}
+function getGuestFilesystemPermissions(document) {
+    const permissions = document.permissions;
+    if (!isTomlTable(permissions)) {
+        return undefined;
+    }
+    const profile = permissions.twinny_guest;
+    if (!isTomlTable(profile)) {
+        return undefined;
+    }
+    const filesystem = profile.filesystem;
+    return isTomlTable(filesystem) ? filesystem : undefined;
+}
+async function readCodexConfigDocument(configPath) {
+    try {
+        return parse(await fs.readFile(configPath, "utf8"));
+    }
+    catch (error) {
+        if (isNodeError(error, "ENOENT")) {
+            return {};
+        }
+        throw error;
+    }
+}
+async function writeCodexConfigIfChanged(configPath, document) {
+    const content = stringify(document) + "\n";
+    try {
+        if ((await fs.readFile(configPath, "utf8")) === content) {
+            return false;
+        }
+    }
+    catch (error) {
+        if (!isNodeError(error, "ENOENT")) {
+            throw error;
+        }
+    }
+    await fs.mkdir(path.dirname(configPath), { recursive: true });
+    await fs.writeFile(configPath, content, { encoding: "utf8", mode: 0o600 });
+    return true;
+}
+function ensureTomlTable(document, key) {
+    const existing = document[key];
+    if (isTomlTable(existing)) {
+        return existing;
+    }
+    const table = {};
+    document[key] = table;
+    return table;
+}
+function isTomlTable(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+async function withCodexConfigWriteLock(configPath, operation) {
+    const previous = guestConfigWriteLocks.get(configPath) ?? Promise.resolve();
+    let releaseCurrent;
+    const current = new Promise((resolve) => {
+        releaseCurrent = resolve;
+    });
+    const next = previous.catch(() => undefined).then(() => current);
+    guestConfigWriteLocks.set(configPath, next);
+    await previous.catch(() => undefined);
+    try {
+        return await operation();
+    }
+    finally {
+        releaseCurrent();
+        if (guestConfigWriteLocks.get(configPath) === next) {
+            guestConfigWriteLocks.delete(configPath);
+        }
+    }
+}
+function isNodeError(error, code) {
+    return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+//# sourceMappingURL=guest.js.map

package/dist/profiles/guest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guest.js","sourceRoot":"","sources":["../../src/profiles/guest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAkB,MAAM,WAAW,CAAC;AAe7D,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAEnD,MAAM,2BAA2B,GAA4B;IAC3D,GAAG,EAAE,OAAO;CACb,CAAC;AAEF,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAC;AAE/D,MAAM,UAAU,8BAA8B,CAAC,UAAmC,EAAE;IAClF,MAAM,QAAQ,GAAc;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,yBAAyB;QACjD,sBAAsB,EAAE,OAAO,CAAC,oBAAoB,IAAI,QAAQ;QAChE,YAAY,EAAE,iBAAiB;QAC/B,eAAe,EAAE,OAAO;QACxB,UAAU,EAAE,UAAU;QACtB,uBAAuB,EAAE;YACvB,cAAc,EAAE,IAAI;SACrB;QACD,mBAAmB,EAAE,cAAc;QACnC,WAAW,EAAE;YACX,YAAY,EAAE;gBACZ,UAAU,EAAE;oBACV,SAAS,EAAE,OAAO;iBACnB;gBACD,OAAO,EAAE;oBACP,OAAO,EAAE,IAAI;oBACb,IAAI,EAAE,MAAM;oBACZ,mBAAmB,EAAE,IAAI;oBACzB,OAAO,EAAE,EAAE,GAAG,2BAA2B,EAAE;iBAC5C;aACF;SACF;QACD,wBAAwB,EAAE;YACxB,OAAO,EAAE,MAAM;SAChB;KACF,CAAC;IAEF,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;QACvD,QAAQ,CAAC,OAAO,KAAK,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAoB,CAAC;QAC9C,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,kBAAkB,EAAE,MAAM,EAAE,CAAC;QACvC,QAAQ,CAAC,MAAM,GAAG;YAChB,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;SAC7F,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAAmC,EAAE;IAC7E,OAAO,SAAS,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;AACnE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,GAAW;IACrE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACvD,OAAO,wBAAwB,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,UAAU,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB,EAAE,GAAW;IACvE,OAAO,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA6D;IAC7F,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,6BAA6B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,OAAO;;;;;wBAKe,KAAK,CAAC,WAAW;0BACf,KAAK,CAAC,MAAM,GAAG,WAAW;;;;;;;;;;CAUnD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,QAAmB;IAClE,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,QAAQ,CAAC,YAAY,KAAK,iBAAiB,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,eAAe,KAAK,OAAO,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,QAAQ,CAAC,mBAAmB,KAAK,cAAc,EAAE,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,kBAAkB,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,IAAI,kBAAkB,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,kBAAkB,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,EAAE,CAAC;gBAC3E,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;oBAC/B,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,YAAY,MAAM,EAAE,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,CAAC,MAAM,IAAI,2BAA2B,CAAC,EAAE,CAAC;oBAC7C,MAAM,CAAC,IAAI,CAAC,sCAAsC,MAAM,kBAAkB,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,KAAK,OAAO,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,wBAAwB,CAAC;IACtD,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC5D,CAAC;SAAM,IAAK,WAAyB,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAmB,EAAE,GAAW;IAC5D,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAmB;IACrD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAmB;IACxD,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,OAAO,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,UAAkB;IACvD,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAc,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,UAAkB,EAAE,QAAmB;IAC9E,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;YACxD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,QAAmB,EAAE,GAAW;IACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,wBAAwB,CAAI,UAAkB,EAAE,SAA2B;IACxF,MAAM,QAAQ,GAAG,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5E,IAAI,cAA2B,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,cAAc,GAAG,OAAO,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IACjE,qBAAqB,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAE5C,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,cAAc,EAAE,CAAC;QACjB,IAAI,qBAAqB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YACnD,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC/C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAK,KAA2B,CAAC,IAAI,KAAK,IAAI,CAAC;AACtH,CAAC"}

package/dist/profiles/index.d.ts

@@ -0,0 +1,5 @@
+import { type ProfileName, type TwinnyConfig } from "../types.js";
+export declare function defaultProfileForSender(senderOpenId: string, ownerOpenId: string): ProfileName;
+export declare function getProfileCodexHome(config: TwinnyConfig, profile: ProfileName): string;
+export { defaultOwnerCodexTarget } from "./owner.js";
+export { createGuestCodexConfigDocument, DEFAULT_GUEST_CODEX_MODEL, ensureProjectTrust, ensureWorkspaceTrust, ensureWorkspaceTrust as ensureGuestWorkspaceTrust, ensureWorkspaceTrust as ensureGuestWorkspaceProjectTrusted, renderGuestAgents, serializeGuestCodexConfig, validateGuestCodexConfigDocument, type GuestCodexConfigOptions, type GuestSafetyCheck } from "./guest.js";

package/dist/profiles/index.js

@@ -0,0 +1,14 @@
+import { GUEST_PROFILE_NAME, HOST_PROFILE_NAME } from "../types.js";
+export function defaultProfileForSender(senderOpenId, ownerOpenId) {
+    return senderOpenId === ownerOpenId ? HOST_PROFILE_NAME : GUEST_PROFILE_NAME;
+}
+export function getProfileCodexHome(config, profile) {
+    const resolved = config.profiles[profile];
+    if (!resolved) {
+        throw new Error(`Unknown Twinny profile: ${profile}`);
+    }
+    return resolved.codexHome;
+}
+export { defaultOwnerCodexTarget } from "./owner.js";
+export { createGuestCodexConfigDocument, DEFAULT_GUEST_CODEX_MODEL, ensureProjectTrust, ensureWorkspaceTrust, ensureWorkspaceTrust as ensureGuestWorkspaceTrust, ensureWorkspaceTrust as ensureGuestWorkspaceProjectTrusted, renderGuestAgents, serializeGuestCodexConfig, validateGuestCodexConfigDocument } from "./guest.js";
+//# sourceMappingURL=index.js.map

package/dist/profiles/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/profiles/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAuC,MAAM,aAAa,CAAC;AAEzG,MAAM,UAAU,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;IAC/E,OAAO,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,OAAoB;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,QAAQ,CAAC,SAAS,CAAC;AAC5B,CAAC;AAED,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,IAAI,yBAAyB,EACjD,oBAAoB,IAAI,kCAAkC,EAC1D,iBAAiB,EACjB,yBAAyB,EACzB,gCAAgC,EAGjC,MAAM,YAAY,CAAC"}

package/dist/profiles/owner.d.ts

@@ -0,0 +1 @@
+export declare function defaultOwnerCodexTarget(homeDir?: string): string;

package/dist/profiles/owner.js

@@ -0,0 +1,6 @@
+import os from "node:os";
+import path from "node:path";
+export function defaultOwnerCodexTarget(homeDir = os.homedir()) {
+    return path.join(homeDir, ".codex");
+}
+//# sourceMappingURL=owner.js.map

package/dist/profiles/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../src/profiles/owner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,uBAAuB,CAAC,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACtC,CAAC"}

package/dist/store/db.d.ts

@@ -0,0 +1,10 @@
+import Database from "better-sqlite3";
+import type { RuntimePaths } from "../types.js";
+export type TwinnyDatabase = InstanceType<typeof Database>;
+export interface OpenTwinnyDatabaseOptions {
+    migrate?: boolean;
+    readonly?: boolean;
+    timeoutMs?: number;
+}
+export declare function openTwinnyDatabase(sqliteFile: string, options?: OpenTwinnyDatabaseOptions): TwinnyDatabase;
+export declare function openRuntimeDatabase(paths: Pick<RuntimePaths, "sqliteFile">, options?: OpenTwinnyDatabaseOptions): TwinnyDatabase;

package/dist/store/db.js

@@ -0,0 +1,29 @@
+import fs from "node:fs";
+import path from "node:path";
+import Database from "better-sqlite3";
+import { runStoreMigrations } from "./migrations.js";
+export function openTwinnyDatabase(sqliteFile, options = {}) {
+    if (!options.readonly) {
+        fs.mkdirSync(path.dirname(sqliteFile), { recursive: true });
+    }
+    const databaseOptions = {};
+    if (options.readonly !== undefined) {
+        databaseOptions.readonly = options.readonly;
+    }
+    if (options.timeoutMs !== undefined) {
+        databaseOptions.timeout = options.timeoutMs;
+    }
+    const db = new Database(sqliteFile, databaseOptions);
+    db.pragma("foreign_keys = ON");
+    if (!options.readonly) {
+        db.pragma("journal_mode = WAL");
+        if (options.migrate ?? true) {
+            runStoreMigrations(db);
+        }
+    }
+    return db;
+}
+export function openRuntimeDatabase(paths, options = {}) {
+    return openTwinnyDatabase(paths.sqliteFile, options);
+}
+//# sourceMappingURL=db.js.map

package/dist/store/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/store/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AAGtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAUrD,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,UAAqC,EAAE;IAC5F,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,eAAe,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACpC,eAAe,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9C,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAErD,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5B,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAuC,EAAE,UAAqC,EAAE;IAClH,OAAO,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC"}

package/dist/store/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./db.js";
+export * from "./migrations.js";
+export * from "./repositories.js";

package/dist/store/index.js

@@ -0,0 +1,4 @@
+export * from "./db.js";
+export * from "./migrations.js";
+export * from "./repositories.js";
+//# sourceMappingURL=index.js.map

package/dist/store/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/store/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC"}

package/dist/store/migrations.d.ts

@@ -0,0 +1,13 @@
+import type Database from "better-sqlite3";
+export interface StoreMigration {
+    version: number;
+    name: string;
+    sql: string;
+}
+export interface RunMigrationsOptions {
+    migrations?: StoreMigration[];
+}
+export declare const currentStoreSchemaVersion = 1;
+export declare function loadStoreMigrations(): StoreMigration[];
+export declare function getStoreSchemaVersion(db: Database.Database): number;
+export declare function runStoreMigrations(db: Database.Database, options?: RunMigrationsOptions): number;

package/dist/store/migrations.js

@@ -0,0 +1,79 @@
+import fs from "node:fs";
+import { fileURLToPath } from "node:url";
+import { TwinnyError } from "../errors.js";
+export const currentStoreSchemaVersion = 1;
+const baselineMigrationFile = fileURLToPath(new URL("../../migrations/0001_initial.sql", import.meta.url));
+export function loadStoreMigrations() {
+    return [
+        {
+            version: 1,
+            name: "0001_initial",
+            sql: fs.readFileSync(baselineMigrationFile, "utf8")
+        }
+    ];
+}
+export function getStoreSchemaVersion(db) {
+    const version = db.pragma("user_version", { simple: true });
+    if (typeof version !== "number") {
+        throw new TwinnyError("SQLite PRAGMA user_version returned a non-numeric value", "STORE_INVALID_VERSION");
+    }
+    return version;
+}
+export function runStoreMigrations(db, options = {}) {
+    const migrations = [...(options.migrations ?? loadStoreMigrations())].sort((left, right) => left.version - right.version);
+    const targetVersion = migrations.at(-1)?.version ?? 0;
+    const currentVersion = getStoreSchemaVersion(db);
+    if (currentVersion > targetVersion) {
+        throw new TwinnyError(`SQLite schema version ${currentVersion} is newer than supported version ${targetVersion}`, "STORE_UNSUPPORTED_VERSION");
+    }
+    const pending = migrations.filter((migration) => migration.version > currentVersion);
+    const migrate = db.transaction(() => {
+        let lastVersion = currentVersion;
+        if (pending.length === 0) {
+            return lastVersion;
+        }
+        for (const migration of pending) {
+            if (migration.version !== lastVersion + 1) {
+                throw new TwinnyError(`SQLite migration ${migration.name} is not contiguous after version ${lastVersion}`, "STORE_MIGRATION_GAP");
+            }
+            db.exec(migration.sql);
+            db.pragma(`user_version = ${migration.version}`);
+            lastVersion = migration.version;
+        }
+        return lastVersion;
+    });
+    const appliedVersion = migrate();
+    if (appliedVersion >= currentStoreSchemaVersion) {
+        validateBaselineSchema(db);
+    }
+    return appliedVersion;
+}
+function validateBaselineSchema(db) {
+    const requiredColumnsByTable = new Map([
+        [
+            "conversations",
+            ["conversation_key", "type", "chat_id", "name", "profile", "thread_id", "workspace", "profile_codex_home", "response_mode"]
+        ],
+        [
+            "threads",
+            ["thread_id", "conversation_key", "profile", "thread_has_rollout", "mode", "status", "name", "goal_status", "model", "effort"]
+        ],
+        [
+            "lark_messages",
+            ["event_id", "lark_user_id", "conversation_key", "thread_id", "route_kind", "status", "side_id", "token_usage_json"]
+        ]
+    ]);
+    for (const [tableName, requiredColumns] of requiredColumnsByTable) {
+        const columns = getTableColumns(db, tableName);
+        for (const columnName of requiredColumns) {
+            if (!columns.has(columnName)) {
+                throw new TwinnyError(`SQLite schema does not match the 1.0 baseline; reset or manually migrate the pre-1.0 development database before continuing`, "STORE_BASELINE_MISMATCH");
+            }
+        }
+    }
+}
+function getTableColumns(db, tableName) {
+    const rows = db.prepare(`PRAGMA table_info(${tableName})`).all();
+    return new Set(rows.map((row) => row.name));
+}
+//# sourceMappingURL=migrations.js.map

package/dist/store/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/store/migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAY3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAE3C,MAAM,qBAAqB,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,mCAAmC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE3G,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL;YACE,OAAO,EAAE,CAAC;YACV,IAAI,EAAE,cAAc;YACpB,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,EAAqB;IACzD,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5D,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,yDAAyD,EAAE,uBAAuB,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAqB,EAAE,UAAgC,EAAE;IAC1F,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1H,MAAM,aAAa,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAEjD,IAAI,cAAc,GAAG,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,WAAW,CACnB,yBAAyB,cAAc,oCAAoC,aAAa,EAAE,EAC1F,2BAA2B,CAC5B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC;IACrF,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAClC,IAAI,WAAW,GAAG,cAAc,CAAC;QACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;YAChC,IAAI,SAAS,CAAC,OAAO,KAAK,WAAW,GAAG,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,WAAW,CACnB,oBAAoB,SAAS,CAAC,IAAI,oCAAoC,WAAW,EAAE,EACnF,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACvB,EAAE,CAAC,MAAM,CAAC,kBAAkB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,OAAO,EAAE,CAAC;IACjC,IAAI,cAAc,IAAI,yBAAyB,EAAE,CAAC;QAChD,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAMD,SAAS,sBAAsB,CAAC,EAAqB;IACnD,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAmB;QACvD;YACE,eAAe;YACf,CAAC,kBAAkB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC;SAC5H;QACD;YACE,SAAS;YACT,CAAC,WAAW,EAAE,kBAAkB,EAAE,SAAS,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC;SAC/H;QACD;YACE,eAAe;YACf,CAAC,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,kBAAkB,CAAC;SACrH;KACF,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,sBAAsB,EAAE,CAAC;QAClE,MAAM,OAAO,GAAG,eAAe,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC/C,KAAK,MAAM,UAAU,IAAI,eAAe,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,WAAW,CACnB,6HAA6H,EAC7H,yBAAyB,CAC1B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,EAAqB,EAAE,SAAiB;IAC/D,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAmB,qBAAqB,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACnF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC"}