wyrm-mcp 7.2.0 → 7.2.2

package/dist/events.js

@@ -1,250 +1,18 @@
-/**
- * Live Memory v6.4 — append-only event log (Phase 1: local node).
- *
- * Every canonical write emits an event here as a FAILURE-ISOLATED side effect:
- * the emit runs AFTER the canonical write and any failure — or the feature being
- * disabled — logs-and-drops. It NEVER throws and NEVER rolls back the real write.
- * "Strictly additive" means the existing write path cannot regress even if this
- * table or its migration is broken.
- *
- * Feature flag `WYRM_LIVE_MEMORY` — DEFAULT ON (operator decision, v6.4).
- * Disable with `WYRM_LIVE_MEMORY=0` (or `false` / `off`).
- *
- * Privacy: a denormalized payload is written ONLY for shareable rows; protected
- * or private rows are reference-only (`payload_json = NULL`) so the event log
- * never becomes a copy of data the encryption/federation layer protects.
- *
- * @copyright 2026 Ghost Protocol (Pvt) Ltd.
- * @license AGPL-3.0-or-later — dual-licensed; commercial terms: ghosts.lk@proton.me. See LICENSE.
- */
-import { randomUUID } from 'node:crypto';
-import { hostname } from 'node:os';
-import { logger } from './logger.js';
-import { getActor } from './handlers/boundary.js';
-/** The closed set of valid event kinds — ingest rejects anything else (anti-spoof). */
-const KNOWN_KINDS = new Set([
-    'capture', 'session_update', 'quest', 'truth', 'presence', 'tool_call',
-    'failure', 'decision',
-]);
-// Ingest bounds for peer-supplied events (defends storage + ordering against a hostile peer).
-const MAX_PAYLOAD_BYTES = 64 * 1024; // oversized payloads degrade to reference-only
-const MAX_DEVICE_LEN = 80;
-const MAX_FIELD_LEN = 256;
-const DAY_MS = 86_400_000;
-const isSafeNonNegInt = (n) => typeof n === 'number' && Number.isInteger(n) && n >= 0 && n <= Number.MAX_SAFE_INTEGER;
-const clampStr = (s, max) => typeof s === 'string' ? s.slice(0, max) : null;
-/** Default ON in v6.4 (operator decision). Disable with WYRM_LIVE_MEMORY=0|false|off. */
-export function isLiveMemoryEnabled() {
-    const v = (process.env.WYRM_LIVE_MEMORY || '').toLowerCase();
-    return v !== '0' && v !== 'false' && v !== 'off';
-}
-// Per-DB cache (not a single module global): a process that opens more than one
-// WyrmDB — e.g. cross-device replication tests, or a future multi-DB host — must
-// get a DISTINCT device id per DB, or echo-suppression collapses.
-const deviceIdCache = new WeakMap();
-/** Stable per-node device id, persisted in wyrm_meta. Lazy + cached per DB. */
-export function getDeviceId(db) {
-    const hit = deviceIdCache.get(db);
-    if (hit)
-        return hit;
-    const read = () => db.prepare(`SELECT value FROM wyrm_meta WHERE key = 'device_id'`).get()?.value;
-    let id = read();
-    if (!id) {
-        const candidate = `${hostname().slice(0, 24)}-${randomUUID().slice(0, 8)}`;
-        db.prepare(`INSERT OR IGNORE INTO wyrm_meta (key, value) VALUES ('device_id', ?)`).run(candidate);
-        id = read() || candidate; // re-read in case another process won the race
-    }
-    deviceIdCache.set(db, id);
-    return id;
-}
-function clamp(n, lo, hi, dflt) {
-    const v = typeof n === 'number' && Number.isFinite(n) ? Math.floor(n) : dflt;
-    return Math.max(lo, Math.min(hi, v));
-}
-/**
- * Emit an event for a canonical write. NEVER throws; no-op when disabled.
- * Call AFTER the canonical row is committed.
- */
-export function emitEvent(db, ev) {
-    if (!isLiveMemoryEnabled())
-        return;
-    try {
-        const device = getDeviceId(db);
-        const isShared = ev.isShared ? 1 : 0;
-        let payloadJson = null;
-        if (isShared && ev.payload !== undefined) {
-            // Isolate stringify: a non-serializable payload (circular / BigInt) degrades
-            // to reference-only — the event still emits rather than being dropped whole.
-            try {
-                payloadJson = JSON.stringify(ev.payload);
-            }
-            catch {
-                payloadJson = null;
-            }
-        }
-        // v7 F2 (T009): machine attribution from the ambient actor envelope unless
-        // the caller passed it explicitly. The 6.x `actor` display label keeps being
-        // written exactly as before — agent_id/run_id land ALONGSIDE it.
-        const ambient = getActor();
-        const agentId = ev.agentId !== undefined ? ev.agentId : ambient.agent_id;
-        const runId = ev.runId !== undefined ? ev.runId : ambient.run_id;
-        // Atomic origin_seq allocation: the MAX(origin_seq)+1 is computed INSIDE the
-        // INSERT so it runs under the write lock — no read-then-write race between the
-        // server, the CLI, and the trace hook all writing to one DB.
-        db.prepare(`
+import{randomUUID as g}from"node:crypto";import{hostname as m}from"node:os";import{logger as l}from"./logger.js";import{getActor as R}from"./handlers/boundary.js";const I=new Set(["capture","session_update","quest","truth","presence","tool_call","failure","decision"]),T=64*1024,y=80,d=256,_=864e5,p=r=>typeof r=="number"&&Number.isInteger(r)&&r>=0&&r<=Number.MAX_SAFE_INTEGER,s=(r,t)=>typeof r=="string"?r.slice(0,t):null;function O(){const r=(process.env.WYRM_LIVE_MEMORY||"").toLowerCase();return r!=="0"&&r!=="false"&&r!=="off"}const f=new WeakMap;function S(r){const t=f.get(r);if(t)return t;const e=()=>r.prepare("SELECT value FROM wyrm_meta WHERE key = 'device_id'").get()?.value;let n=e();if(!n){const o=`${m().slice(0,24)}-${g().slice(0,8)}`;r.prepare("INSERT OR IGNORE INTO wyrm_meta (key, value) VALUES ('device_id', ?)").run(o),n=e()||o}return f.set(r,n),n}function a(r,t,e,n){const o=typeof r=="number"&&Number.isFinite(r)?Math.floor(r):n;return Math.max(t,Math.min(e,o))}function C(r,t){if(O())try{const e=S(r),n=t.isShared?1:0;let o=null;if(n&&t.payload!==void 0)try{o=JSON.stringify(t.payload)}catch{o=null}const i=R(),c=t.agentId!==void 0?t.agentId:i.agent_id,u=t.runId!==void 0?t.runId:i.run_id;r.prepare(`
       INSERT INTO events
         (origin_device, origin_seq, project_id, kind, ref_table, ref_id, actor, is_shared, payload_json, created_at, agent_id, run_id)
       VALUES (?, (SELECT COALESCE(MAX(origin_seq), 0) + 1 FROM events WHERE origin_device = ?), ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(device, device, String(ev.projectId), ev.kind, ev.refTable ?? null, ev.refId != null ? String(ev.refId) : null, ev.actor ?? null, isShared, payloadJson, Date.now(), agentId, runId);
-    }
-    catch (err) {
-        // log-and-drop: the canonical write already succeeded; the event is best-effort.
-        logger.warn('live-memory: emitEvent dropped', { err: err instanceof Error ? err.message : String(err) });
-    }
-}
-/** One-shot pull of events newer than a cursor, for a project. Idempotent. */
-export function eventsSince(db, projectId, sinceCursor = 0, limit = 100) {
-    const lim = clamp(limit, 1, 1000, 100);
-    const since = clamp(sinceCursor, 0, Number.MAX_SAFE_INTEGER, 0);
-    return db
-        .prepare(`SELECT * FROM events WHERE project_id = ? AND cursor > ? ORDER BY cursor ASC LIMIT ?`)
-        .all(String(projectId), since, lim);
-}
-/** Initial subscribe: current head cursor + a recent window (chronological). */
-export function subscribeEvents(db, projectId, window = 20) {
-    const win = clamp(window, 1, 200, 20);
-    const recent = db
-        .prepare(`SELECT * FROM events WHERE project_id = ? ORDER BY cursor DESC LIMIT ?`)
-        .all(String(projectId), win);
-    recent.reverse();
-    const head = db
-        .prepare(`SELECT COALESCE(MAX(cursor), 0) AS c FROM events WHERE project_id = ?`)
-        .get(String(projectId));
-    return { cursor: head.c, recent };
-}
-/**
- * Ingest one event received from a peer (replication PULL). Failure-isolated.
- * - **Echo-suppression:** an event whose `origin_device` is THIS device is
- *   dropped (`'echo'`) — our own events bouncing back never re-insert.
- * - **Idempotent dedup:** `INSERT OR IGNORE` on `UNIQUE(origin_device, origin_seq)`
- *   → re-delivering the same event is a no-op (`'duplicate'`).
- * - `localProjectId` files the event under a LOCAL project (peer project ids are
- *   not assumed to match ours — the local node decides the mapping).
- * The remote `(origin_device, origin_seq)` identity is preserved verbatim so the
- * dedup key stays globally stable; only the local `cursor` is freshly minted.
- */
-export function ingestRemoteEvent(db, localProjectId, ev) {
-    try {
-        // ── Validate + bound every peer-supplied field (hostile peer hardening) ──
-        if (!ev || typeof ev.origin_device !== 'string' || !isSafeNonNegInt(ev.origin_seq)) {
-            return 'duplicate'; // malformed identity — drop, never throw
-        }
-        const device = clampStr(ev.origin_device, MAX_DEVICE_LEN);
-        if (!device)
-            return 'duplicate';
-        if (device === getDeviceId(db))
-            return 'echo'; // our own event bounced back
-        // Reject unknown kinds — stops a peer injecting arbitrary `event:` types downstream.
-        if (typeof ev.kind !== 'string' || !KNOWN_KINDS.has(ev.kind))
-            return 'duplicate';
-        const isShared = ev.is_shared ? 1 : 0;
-        // Privacy consistency: a non-shared row NEVER carries a payload (mirrors emit's invariant),
-        // so a peer can't smuggle a private-flagged blob. Oversized shared payloads degrade to
-        // reference-only rather than bloating the store unboundedly.
-        let payloadJson = isShared && typeof ev.payload_json === 'string' ? ev.payload_json : null;
-        if (payloadJson && payloadJson.length > MAX_PAYLOAD_BYTES)
-            payloadJson = null;
-        const now = Date.now();
-        const createdAt = isSafeNonNegInt(ev.created_at) && ev.created_at <= now + DAY_MS ? ev.created_at : now;
-        const cloudCursor = isSafeNonNegInt(ev.cloud_cursor) ? ev.cloud_cursor : null;
-        // v7 F2 (T009): the remote author's attribution is preserved (clamped like
-        // every peer-supplied field) — the LOCAL actor envelope is deliberately NOT
-        // stamped on ingested events: provenance belongs to whoever wrote the row,
-        // and NULL stays NULL so replication round-trips are byte-faithful.
-        const info = db.prepare(`
+    `).run(e,e,String(t.projectId),t.kind,t.refTable??null,t.refId!=null?String(t.refId):null,t.actor??null,n,o,Date.now(),c,u)}catch(e){l.warn("live-memory: emitEvent dropped",{err:e instanceof Error?e.message:String(e)})}}function D(r,t,e=0,n=100){const o=a(n,1,1e3,100),i=a(e,0,Number.MAX_SAFE_INTEGER,0);return r.prepare("SELECT * FROM events WHERE project_id = ? AND cursor > ? ORDER BY cursor ASC LIMIT ?").all(String(t),i,o)}function F(r,t,e=20){const n=a(e,1,200,20),o=r.prepare("SELECT * FROM events WHERE project_id = ? ORDER BY cursor DESC LIMIT ?").all(String(t),n);return o.reverse(),{cursor:r.prepare("SELECT COALESCE(MAX(cursor), 0) AS c FROM events WHERE project_id = ?").get(String(t)).c,recent:o}}function j(r,t,e){try{if(!e||typeof e.origin_device!="string"||!p(e.origin_seq))return"duplicate";const n=s(e.origin_device,y);if(!n)return"duplicate";if(n===S(r))return"echo";if(typeof e.kind!="string"||!I.has(e.kind))return"duplicate";const o=e.is_shared?1:0;let i=o&&typeof e.payload_json=="string"?e.payload_json:null;i&&i.length>T&&(i=null);const c=Date.now(),u=p(e.created_at)&&e.created_at<=c+_?e.created_at:c,E=p(e.cloud_cursor)?e.cloud_cursor:null;return r.prepare(`
       INSERT OR IGNORE INTO events
         (origin_device, origin_seq, cloud_cursor, project_id, kind, ref_table, ref_id, actor, is_shared, payload_json, created_at, agent_id, run_id)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    `).run(device, ev.origin_seq, cloudCursor, String(localProjectId), ev.kind, clampStr(ev.ref_table, MAX_FIELD_LEN), clampStr(ev.ref_id, MAX_FIELD_LEN), clampStr(ev.actor, MAX_FIELD_LEN), isShared, payloadJson, createdAt, clampStr(ev.agent_id, MAX_FIELD_LEN), clampStr(ev.run_id, MAX_FIELD_LEN));
-        return info.changes > 0 ? 'inserted' : 'duplicate';
-    }
-    catch (err) {
-        logger.warn('live-memory: ingestRemoteEvent dropped', { err: err instanceof Error ? err.message : String(err) });
-        return 'duplicate';
-    }
-}
-/**
- * Shared events past a local-cursor watermark, for PUSH up to a peer/cloud.
- * **Privacy gate:** only `is_shared = 1` rows are eligible to leave the box;
- * reference-only rows keep `payload_json = NULL` exactly as stored, so protected
- * data never replicates even by accident.
- */
-export function eventsForPush(db, projectId, sinceCursor = 0, limit = 200) {
-    const lim = clamp(limit, 1, 1000, 200);
-    const since = clamp(sinceCursor, 0, Number.MAX_SAFE_INTEGER, 0);
-    // [grove isolation] Live Memory replication is a separate egress channel; gate
-    // it by grove too. Only a 'team' grove's events may leave the box. We match the
-    // event's project_id against BOTH projects.id and projects.path (events store a
-    // path-or-id key), so a private grove (e.g. GHOST PROTOCOL) never replicates.
-    // If the projects.sync_policy column is absent (pre-migration), the grove
-    // feature is off and we fall back to the is_shared-only gate.
-    try {
-        const pol = db.prepare(`SELECT sync_policy AS p FROM projects WHERE CAST(id AS TEXT) = ? OR path = ? LIMIT 1`).get(String(projectId), String(projectId));
-        if (pol && pol.p && pol.p !== 'team')
-            return [];
-    }
-    catch { /* sync_policy column absent (pre-migration): grove gate off */ }
-    return db.prepare(`
+    `).run(n,e.origin_seq,E,String(t),e.kind,s(e.ref_table,d),s(e.ref_id,d),s(e.actor,d),o,i,u,s(e.agent_id,d),s(e.run_id,d)).changes>0?"inserted":"duplicate"}catch(n){return l.warn("live-memory: ingestRemoteEvent dropped",{err:n instanceof Error?n.message:String(n)}),"duplicate"}}function v(r,t,e=0,n=200){const o=a(n,1,1e3,200),i=a(e,0,Number.MAX_SAFE_INTEGER,0);try{const c=r.prepare("SELECT sync_policy AS p FROM projects WHERE CAST(id AS TEXT) = ? OR path = ? LIMIT 1").get(String(t),String(t));if(c&&c.p&&c.p!=="team")return[]}catch{}return r.prepare(`
     SELECT * FROM events
     WHERE project_id = ? AND is_shared = 1 AND cursor > ?
     ORDER BY cursor ASC LIMIT ?
-  `).all(String(projectId), since, lim);
-}
-/**
- * Retention for the append-only event log. Live Memory is a DERIVED stream, not
- * the system of record — trimming old events is lossless for memory; it only
- * shortens how far back the live tail / replication catch-up can reach. Bounds
- * the table two ways: (1) drop events older than `olderThanDays` (old enough that
- * any peer has long since synced), then (2) cap each project to its most recent
- * `maxPerProject` by cursor. Failure-isolated — a retention hiccup never throws.
- *
- * Performance note: this is why widening producers (truths/captures/failures/
- * decisions all emit now) can't grow the DB unbounded — maintenance trims it.
- */
-export function pruneEvents(db, opts = {}) {
-    const olderThanDays = clamp(opts.olderThanDays, 1, 3650, 90);
-    const maxPerProject = clamp(opts.maxPerProject, 1, 1_000_000, 5000);
-    try {
-        let deleted = 0;
-        // (1) Age-based sweep.
-        const cutoff = Date.now() - olderThanDays * DAY_MS;
-        deleted += db.prepare(`DELETE FROM events WHERE created_at < ?`).run(cutoff).changes;
-        // (2) Per-project count cap: keep the most recent `maxPerProject` by cursor.
-        // The OFFSET row is the (max+1)-th newest cursor; deleting <= it keeps exactly
-        // `maxPerProject`. Projects under the cap return NULL → `cursor <= NULL` deletes
-        // nothing (safe no-op).
-        const overflow = db.prepare(`SELECT project_id FROM events GROUP BY project_id HAVING COUNT(*) > ?`).all(maxPerProject);
-        const trim = db.prepare(`
+  `).all(String(t),i,o)}function w(r,t={}){const e=a(t.olderThanDays,1,3650,90),n=a(t.maxPerProject,1,1e6,5e3);try{let o=0;const i=Date.now()-e*_;o+=r.prepare("DELETE FROM events WHERE created_at < ?").run(i).changes;const c=r.prepare("SELECT project_id FROM events GROUP BY project_id HAVING COUNT(*) > ?").all(n),u=r.prepare(`
       DELETE FROM events WHERE project_id = ? AND cursor <= (
         SELECT cursor FROM events WHERE project_id = ? ORDER BY cursor DESC LIMIT 1 OFFSET ?
       )
-    `);
-        for (const { project_id } of overflow) {
-            deleted += trim.run(project_id, project_id, maxPerProject).changes;
-        }
-        return { deleted };
-    }
-    catch (err) {
-        logger.warn('live-memory: pruneEvents failed', { err: err instanceof Error ? err.message : String(err) });
-        return { deleted: 0 };
-    }
-}
-/** Tiny persistent KV in wyrm_meta — used for replication watermarks. */
-export function getMeta(db, key) {
-    return db.prepare(`SELECT value FROM wyrm_meta WHERE key = ?`).get(key)?.value;
-}
-export function setMeta(db, key, value) {
-    db.prepare(`INSERT INTO wyrm_meta (key, value) VALUES (?, ?)
-              ON CONFLICT(key) DO UPDATE SET value = excluded.value`).run(key, value);
-}
-//# sourceMappingURL=events.js.map
+    `);for(const{project_id:E}of c)o+=u.run(E,E,n).changes;return{deleted:o}}catch(o){return l.warn("live-memory: pruneEvents failed",{err:o instanceof Error?o.message:String(o)}),{deleted:0}}}function x(r,t){return r.prepare("SELECT value FROM wyrm_meta WHERE key = ?").get(t)?.value}function W(r,t,e){r.prepare(`INSERT INTO wyrm_meta (key, value) VALUES (?, ?)
+              ON CONFLICT(key) DO UPDATE SET value = excluded.value`).run(t,e)}export{C as emitEvent,v as eventsForPush,D as eventsSince,S as getDeviceId,x as getMeta,j as ingestRemoteEvent,O as isLiveMemoryEnabled,w as pruneEvents,W as setMeta,F as subscribeEvents};