mermaid_runtime/
lib.rs

1//! Daemon-safe runtime services.
2//!
3//! The TUI reducer remains the correctness core, but durable concerns
4//! that a daemon or future remote client will also need live
5//! here. The first slice is SQLite-backed state for tasks, approvals,
6//! processes, and the future provider/memory/checkpoint tables.
7
8pub mod apply_patch;
9pub mod approval;
10pub mod atomic;
11pub mod checkpoint;
12pub mod daemon;
13pub mod git;
14pub mod hardening;
15mod pathguard;
16pub mod plugin;
17pub mod policy;
18pub mod redact;
19pub mod sandbox;
20pub mod storage;
21pub mod worktree;
22
23/// Lowercase hex encoding of a byte slice. Shared by the SHA-256 hashing sites
24/// (pairing-token hash, project hashes, plugin-source hash) that each used to
25/// carry an identical private copy.
26pub(crate) fn hex_lower(bytes: &[u8]) -> String {
27    const HEX: &[u8; 16] = b"0123456789abcdef";
28    let mut out = String::with_capacity(bytes.len() * 2);
29    for byte in bytes {
30        out.push(HEX[(byte >> 4) as usize] as char);
31        out.push(HEX[(byte & 0x0f) as usize] as char);
32    }
33    out
34}
35
36pub use atomic::{write_atomic, write_atomic_with_mode};
37
38pub use approval::{ApprovalReplayResult, approve_and_replay, deny_approval};
39pub use checkpoint::{
40    CheckpointFile, CheckpointManifest, CheckpointOrigin, create_checkpoint,
41    create_checkpoint_for_task, gc_old_checkpoint_dirs, restore_checkpoint,
42};
43pub use daemon::{
44    DEFAULT_PAIRING_TTL_DAYS, clamp_pairing_ttl_days, generate_pairing_token, hash_pairing_token,
45    pairing_expiry_from_now, request_daemon_json, request_daemon_text, subscribe_daemon_lines,
46};
47
48pub use pathguard::{
49    OpenIntent, create_dir_all_beneath, open_beneath, remove_file_beneath, write_atomic_beneath,
50};
51pub use plugin::{
52    HookDecision, HookGate, HookResponse, PluginCapabilityPreview, PluginManifest,
53    aggregate_hook_responses, install_plugin_from_path, plugin_capability_preview,
54    run_plugin_hooks, validate_plugin_manifest, write_plugin_lockfile,
55};
56pub use policy::{
57    ActionRequest, FloorLevel, HostShell, PLAN_DENIAL_MARKER, PolicyDecision, PolicyEngine,
58    PolicyOverride, PolicyOverrideDecision, READ_ONLY_DENIAL_MARKER, RiskClass, SafetyMode,
59    ToolCategory, is_destructive_command, is_plan_file_only_write, is_plan_file_path,
60    is_plan_safe_build_command,
61};
62pub use redact::{redact_json, redact_json_text, redact_secrets, sanitize_url_for_display};
63pub use sandbox::{
64    Enforcement, SandboxPolicy, enforce, fs_confinement_available, network_killswitch_available,
65};
66pub use storage::{
67    ApprovalRecord, CheckpointRecord, CompactionRecord, MessageRecord, NewApproval, NewCheckpoint,
68    NewCompaction, NewOutcome, NewPluginInstall, NewProcess, NewProviderProbe, NewTask, NewToolRun,
69    OUTCOME_LABEL_FAILURE, OUTCOME_LABEL_SUCCESS, OUTCOME_LABEL_UNKNOWN, OUTCOME_SOURCE_SYSTEM,
70    PairingTokenRecord, PluginInstallRecord, ProcessRecord, ProcessStatus, ProviderProbeRecord,
71    RuntimeStore, SessionRecord, TaskPriority, TaskRecord, TaskStatus, TaskTimelineEvent,
72    ToolRunRecord, data_dir,
73};
74pub use worktree::{AgentWorktree, MergeOutcome, gc_orphaned_worktrees};
75// Unix-only: backs the `#[cfg(unix)]` daemon singleton via `flock`.
76#[cfg(unix)]
77pub use storage::try_exclusive_lock;
mermaid_runtime/lib.rs

mermaid_runtime/
lib.rs
