Crate mermaid_runtime 

Daemon-safe runtime services.

The TUI reducer remains the correctness core, but durable concerns that a daemon or future remote client will also need live here. The first slice is SQLite-backed state for tasks, approvals, processes, and the future provider/memory/checkpoint tables.

Re-exports

pub use atomic::write_atomic;

pub use atomic::write_atomic_with_mode;

pub use approval::ApprovalReplayResult;

pub use approval::approve_and_replay;

pub use approval::deny_approval;

pub use checkpoint::CheckpointFile;

pub use checkpoint::CheckpointManifest;

pub use checkpoint::CheckpointOrigin;

pub use checkpoint::create_checkpoint;

pub use checkpoint::create_checkpoint_for_task;

pub use checkpoint::gc_old_checkpoint_dirs;

pub use checkpoint::restore_checkpoint;

pub use daemon::DEFAULT_PAIRING_TTL_DAYS;

pub use daemon::clamp_pairing_ttl_days;

pub use daemon::generate_pairing_token;

pub use daemon::hash_pairing_token;

pub use daemon::pairing_expiry_from_now;

pub use daemon::request_daemon_json;

pub use daemon::request_daemon_text;

pub use daemon::subscribe_daemon_lines;

pub use plugin::HookDecision;

pub use plugin::HookGate;

pub use plugin::HookResponse;

pub use plugin::PluginCapabilityPreview;

pub use plugin::PluginManifest;

pub use plugin::aggregate_hook_responses;

pub use plugin::install_plugin_from_path;

pub use plugin::plugin_capability_preview;

pub use plugin::run_plugin_hooks;

pub use plugin::validate_plugin_manifest;

pub use plugin::write_plugin_lockfile;

pub use policy::PolicyEngine;

pub use policy::is_destructive_command;

pub use policy::is_plan_file_only_write;

pub use policy::is_plan_file_path;

pub use policy::is_plan_safe_build_command;

pub use sandbox::Enforcement;

pub use sandbox::SandboxPolicy;

pub use sandbox::enforce;

pub use sandbox::fs_confinement_available;

pub use sandbox::network_killswitch_available;

pub use storage::RuntimeStore;

pub use storage::with_shared_store;

pub use worktree::AgentWorktree;

pub use worktree::MergeOutcome;

pub use worktree::gc_orphaned_worktrees;

pub use storage::try_exclusive_lock;

Modules

apply_patch

Pure apply_patch engine — parser, graduated fuzzy matcher, and applier — adapted from OpenAI Codex’s apply-patch crate.

approval

atomic

Atomic file writes.

checkpoint

daemon

git

Hardened git invocation.

hardening

Best-effort process hardening, applied as early in main as possible.

plugin

policy

Safety policy for tool actions: the engine (engine), the shell classifier (shell/), and the plan-mode carve-outs (plan_gate). The VOCABULARY (modes, risk classes, requests, decisions) lives in mermaid_model::safety so the pure domain crate can speak it without a dependency on this crate; it is re-exported here because it is this module’s API surface – PolicyEngine::decide takes ActionRequest and answers PolicyDecision.

redact

Re-export: the single redaction implementation lives in mermaid_model::utils::redact (the bottom crate), so it is available below the store. Same names, same rules; this module keeps the crate::redact:: / mermaid_runtime:: paths every repository and caller always used.

sandbox

Optional OS sandboxing for model-driven shell commands.

storage

worktree

Isolated git worktrees for subagents.

Structs

ActionRequest

ApprovalRecord

CheckpointRecord

CompactionRecord

MessageRecord

One transcript row on the daemon wire.

NewApproval

NewCheckpoint

NewCompaction

NewOutcome

NewPluginInstall

NewProcess

NewProviderProbe

NewSession

NewTask

NewToolRun

PairingTokenRecord

PluginInstallRecord

PolicyOverride

ProcessRecord

ProviderProbeRecord

SessionRecord

TaskRecord

TaskTimelineEvent

ToolRunRecord

Enums

FloorLevel

Enforcement floor for actions whose blast radius exceeds the project: write-shaped MCP tools (external_writes) and machine-scoped package operations (system_installs). Safety mode alone never authorizes them: the mode’s decision is strengthened to at least this level (severity order Allow < Auto < Ask < Deny). Default Auto: the intent classifier vets the call against the user’s request — aligned runs silently, off-task escalates — even in full_access. allow restores the old unconditional-allow behavior per knob.

HostShell

Which shell execute_command hands model commands to on this host.

OpenIntent

What kind of access an open_beneath call needs.

PolicyDecision

PolicyOverrideDecision

ProcessStatus

RiskClass

SafetyMode

TaskPriority

TaskStatus

Durable task state. A task is the daemon-level work unit; a chat transcript is just one artifact linked to it.

ToolCategory

Constants

OUTCOME_LABEL_FAILURE

OUTCOME_LABEL_SUCCESS

Graded result of an outcome. Stored as free-form TEXT (like tool_runs.status) so the taxonomy can grow without a migration; these constants are the canonical spellings so callers don’t drift.

OUTCOME_LABEL_UNKNOWN

OUTCOME_SOURCE_SYSTEM

PLAN_DENIAL_MARKER

Marker embedded verbatim in every plan-mode policy-denial reason (the policy gate rewrites the read-only mode-default deny to a plan-flavored one while a plan is being drafted). Sibling of READ_ONLY_DENIAL_MARKER: the message-history layer matches "blocked by policy: " + this marker to neutralize denials once plan mode ends.

READ_ONLY_DENIAL_MARKER

Marker embedded verbatim in every read-only policy-denial reason (see the runtime engine’s PolicyEngine::decide). Exposed so the message-history layer can detect a denial that a since-loosened safety mode has superseded, without re-hardcoding the wording in a second place.

Functions

create_dir_all_beneath

Confined mkdir -p for a root-relative directory path: creates each missing component beneath root, refusing to descend through a symlink that escapes (#77). On Linux: mkdirat + openat2(RESOLVE_BENEATH) per component; otherwise the contain_within_canonical + std::fs fallback.

data_dir

The app data dir: DATA_DIR_ENV when set, else the platform location, or ~/.local/share/mermaid when the platform has none.

open_beneath

Open root-relative rel for intent without ever traversing out of root — closing the check-then-write TOCTOU where an intermediate directory is swapped for a symlink after a lexical path check but before the operation (#77). The returned File is bound to the exact inode the confinement resolved, so subsequent reads/writes can’t be redirected.

redact_json

Redact every string leaf of a cloned structured payload in place.

redact_json_text

Redact a serialized JSON payload. Malformed input is treated as ordinary text and still receives shape-based scrubbing; persistence never fails open.

redact_secrets

Replace credential-shaped substrings while preserving surrounding context.

remove_file_beneath

Confined unlink of a root-relative file (#77): opens the parent under RESOLVE_BENEATH and unlinkats the leaf, so a swapped-in symlink parent can’t redirect the delete outside root.

sanitize_url_for_display

Sanitize a URL for display or storage without changing the transport URL.

write_atomic_beneath

Atomically write bytes to root-relative rel without ever traversing out of root. The temp file is created and renameat-swapped beneath the same confined directory fd as the destination (Linux openat2(RESOLVE_BENEATH)), so a parent dir swapped for an escaping symlink after a path check can’t redirect the write (#77), AND a crash/kill/disk-full mid-write leaves the previous file intact instead of a truncated one — open_beneath + WriteTruncate gives the first guarantee but not the second. Falls back to contain_within_canonical + by-path crate::write_atomic on non-Linux / pre-openat2 kernels (the same best-effort posture as the other helpers).