mermaid_runtime/
lib.rs

1//! Daemon-safe runtime services.
2//!
3//! The TUI reducer remains the correctness core, but durable concerns
4//! that a daemon or future remote client will also need live
5//! here. The first slice is SQLite-backed state for tasks, approvals,
6//! processes, and the future provider/memory/checkpoint tables.
7
8pub mod apply_patch;
9pub mod approval;
10pub mod atomic;
11pub mod checkpoint;
12pub mod daemon;
13pub mod hardening;
14mod pathguard;
15pub mod plugin;
16pub mod policy;
17pub mod sandbox;
18pub mod storage;
19
20/// Lowercase hex encoding of a byte slice. Shared by the SHA-256 hashing sites
21/// (pairing-token hash, project hashes, plugin-source hash) that each used to
22/// carry an identical private copy.
23pub(crate) fn hex_lower(bytes: &[u8]) -> String {
24    const HEX: &[u8; 16] = b"0123456789abcdef";
25    let mut out = String::with_capacity(bytes.len() * 2);
26    for byte in bytes {
27        out.push(HEX[(byte >> 4) as usize] as char);
28        out.push(HEX[(byte & 0x0f) as usize] as char);
29    }
30    out
31}
32
33pub use atomic::{write_atomic, write_atomic_with_mode};
34
35pub use approval::{ApprovalReplayResult, approve_and_replay, deny_approval};
36pub use checkpoint::{
37    CheckpointFile, CheckpointManifest, CheckpointOrigin, create_checkpoint,
38    create_checkpoint_for_task, gc_old_checkpoint_dirs, restore_checkpoint,
39};
40pub use daemon::{
41    DEFAULT_PAIRING_TTL_DAYS, clamp_pairing_ttl_days, daemon_socket_path, generate_pairing_token,
42    hash_pairing_token, pairing_expiry_from_now, request_daemon_json, request_daemon_text,
43    snapshot_field_from_daemon, subscribe_daemon_lines,
44};
45pub use pathguard::{
46    OpenIntent, create_dir_all_beneath, open_beneath, remove_file_beneath, write_atomic_beneath,
47};
48pub use plugin::{
49    HookDecision, HookGate, HookResponse, PluginCapabilityPreview, PluginManifest,
50    aggregate_hook_responses, install_plugin_from_path, plugin_capability_preview,
51    run_plugin_hooks, validate_plugin_manifest, write_plugin_lockfile,
52};
53pub use policy::{
54    ActionRequest, FloorLevel, PLAN_DENIAL_MARKER, PolicyDecision, PolicyEngine, PolicyOverride,
55    PolicyOverrideDecision, READ_ONLY_DENIAL_MARKER, RiskClass, SafetyMode, ToolCategory,
56    is_destructive_command, is_plan_safe_build_command,
57};
58pub use sandbox::{
59    Enforcement, SandboxPolicy, enforce, fs_confinement_available, network_killswitch_available,
60};
61pub use storage::{
62    ApprovalRecord, ApprovalsRepo, CheckpointRecord, CheckpointsRepo, CompactionRecord,
63    CompactionsRepo, MessageRecord, MessagesRepo, NewApproval, NewCheckpoint, NewCompaction,
64    NewMessage, NewOutcome, NewPluginInstall, NewProcess, NewProviderProbe, NewSession, NewTask,
65    NewToolRun, OUTCOME_LABEL_ACCEPTED, OUTCOME_LABEL_FAILURE, OUTCOME_LABEL_PARTIAL,
66    OUTCOME_LABEL_REJECTED, OUTCOME_LABEL_SUCCESS, OUTCOME_LABEL_UNKNOWN, OUTCOME_SOURCE_MODEL,
67    OUTCOME_SOURCE_SYSTEM, OUTCOME_SOURCE_USER, OUTCOME_SOURCE_VERIFIER, OutcomeRecord,
68    OutcomesRepo, PairingTokenRecord, PairingTokensRepo, PluginInstallRecord, PluginsRepo,
69    ProcessRecord, ProcessStatus, ProcessesRepo, ProviderProbeRecord, ProviderProbesRepo,
70    RuntimeStore, SessionRecord, SessionsRepo, TaskPriority, TaskRecord, TaskStatus,
71    TaskTimelineEvent, TasksRepo, ToolRunRecord, ToolRunsRepo, data_dir,
72};
73// Unix-only: backs the `#[cfg(unix)]` daemon singleton via `flock`.
74#[cfg(unix)]
75pub use storage::try_exclusive_lock;
mermaid_runtime/lib.rs

mermaid_runtime/
lib.rs
