Crate mermaid_runtime 

Daemon-safe runtime services.

The TUI reducer remains the correctness core, but durable concerns that a daemon or future remote client will also need live here. The first slice is SQLite-backed state for tasks, approvals, processes, and the future provider/memory/checkpoint tables.

Re-exports

pub use atomic::write_atomic;

pub use atomic::write_atomic_with_mode;

pub use approval::ApprovalReplayResult;

pub use approval::approve_and_replay;

pub use approval::deny_approval;

pub use checkpoint::CheckpointFile;

pub use checkpoint::CheckpointManifest;

pub use checkpoint::CheckpointOrigin;

pub use checkpoint::create_checkpoint;

pub use checkpoint::create_checkpoint_for_task;

pub use checkpoint::gc_old_checkpoint_dirs;

pub use checkpoint::restore_checkpoint;

pub use daemon::DEFAULT_PAIRING_TTL_DAYS;

pub use daemon::clamp_pairing_ttl_days;

pub use daemon::daemon_socket_path;

pub use daemon::generate_pairing_token;

pub use daemon::hash_pairing_token;

pub use daemon::pairing_expiry_from_now;

pub use daemon::request_daemon_json;

pub use daemon::request_daemon_text;

pub use daemon::snapshot_field_from_daemon;

pub use daemon::subscribe_daemon_lines;

pub use plugin::HookDecision;

pub use plugin::HookGate;

pub use plugin::HookResponse;

pub use plugin::PluginCapabilityPreview;

pub use plugin::PluginManifest;

pub use plugin::aggregate_hook_responses;

pub use plugin::install_plugin_from_path;

pub use plugin::plugin_capability_preview;

pub use plugin::run_plugin_hooks;

pub use plugin::validate_plugin_manifest;

pub use plugin::write_plugin_lockfile;

pub use policy::ActionRequest;

pub use policy::FloorLevel;

pub use policy::PLAN_DENIAL_MARKER;

pub use policy::PolicyDecision;

pub use policy::PolicyEngine;

pub use policy::PolicyOverride;

pub use policy::PolicyOverrideDecision;

pub use policy::READ_ONLY_DENIAL_MARKER;

pub use policy::RiskClass;

pub use policy::SafetyMode;

pub use policy::ToolCategory;

pub use policy::is_destructive_command;

pub use policy::is_plan_safe_build_command;

pub use sandbox::Enforcement;

pub use sandbox::SandboxPolicy;

pub use sandbox::enforce;

pub use sandbox::fs_confinement_available;

pub use sandbox::network_killswitch_available;

pub use storage::ApprovalRecord;

pub use storage::ApprovalsRepo;

pub use storage::CheckpointRecord;

pub use storage::CheckpointsRepo;

pub use storage::CompactionRecord;

pub use storage::CompactionsRepo;

pub use storage::MessageRecord;

pub use storage::MessagesRepo;

pub use storage::NewApproval;

pub use storage::NewCheckpoint;

pub use storage::NewCompaction;

pub use storage::NewMessage;

pub use storage::NewOutcome;

pub use storage::NewPluginInstall;

pub use storage::NewProcess;

pub use storage::NewProviderProbe;

pub use storage::NewSession;

pub use storage::NewTask;

pub use storage::NewToolRun;

pub use storage::OUTCOME_LABEL_ACCEPTED;

pub use storage::OUTCOME_LABEL_FAILURE;

pub use storage::OUTCOME_LABEL_PARTIAL;

pub use storage::OUTCOME_LABEL_REJECTED;

pub use storage::OUTCOME_LABEL_SUCCESS;

pub use storage::OUTCOME_LABEL_UNKNOWN;

pub use storage::OUTCOME_SOURCE_MODEL;

pub use storage::OUTCOME_SOURCE_SYSTEM;

pub use storage::OUTCOME_SOURCE_USER;

pub use storage::OUTCOME_SOURCE_VERIFIER;

pub use storage::OutcomeRecord;

pub use storage::OutcomesRepo;

pub use storage::PairingTokenRecord;

pub use storage::PairingTokensRepo;

pub use storage::PluginInstallRecord;

pub use storage::PluginsRepo;

pub use storage::ProcessRecord;

pub use storage::ProcessStatus;

pub use storage::ProcessesRepo;

pub use storage::ProviderProbeRecord;

pub use storage::ProviderProbesRepo;

pub use storage::RuntimeStore;

pub use storage::SessionRecord;

pub use storage::SessionsRepo;

pub use storage::TaskPriority;

pub use storage::TaskRecord;

pub use storage::TaskStatus;

pub use storage::TaskTimelineEvent;

pub use storage::TasksRepo;

pub use storage::ToolRunRecord;

pub use storage::ToolRunsRepo;

pub use storage::data_dir;

pub use storage::try_exclusive_lock;

Modules

apply_patch

Pure apply_patch engine — parser, graduated fuzzy matcher, and applier — adapted from OpenAI Codex’s apply-patch crate.

approval

atomic

Atomic file writes.

checkpoint

daemon

hardening

Best-effort process hardening, applied as early in main as possible.

plugin

policy

sandbox

Optional OS sandboxing for model-driven shell commands.

storage

Enums

OpenIntent

What kind of access an open_beneath call needs.

Functions

create_dir_all_beneath

Confined mkdir -p for a root-relative directory path: creates each missing component beneath root, refusing to descend through a symlink that escapes (#77). On Linux: mkdirat + openat2(RESOLVE_BENEATH) per component; otherwise the contain_within_canonical + std::fs fallback.

open_beneath

Open root-relative rel for intent without ever traversing out of root — closing the check-then-write TOCTOU where an intermediate directory is swapped for a symlink after a lexical path check but before the operation (#77). The returned File is bound to the exact inode the confinement resolved, so subsequent reads/writes can’t be redirected.

remove_file_beneath

Confined unlink of a root-relative file (#77): opens the parent under RESOLVE_BENEATH and unlinkats the leaf, so a swapped-in symlink parent can’t redirect the delete outside root.

write_atomic_beneath

Atomically write bytes to root-relative rel without ever traversing out of root. The temp file is created and renameat-swapped beneath the same confined directory fd as the destination (Linux openat2(RESOLVE_BENEATH)), so a parent dir swapped for an escaping symlink after a path check can’t redirect the write (#77), AND a crash/kill/disk-full mid-write leaves the previous file intact instead of a truncated one — open_beneath + WriteTruncate gives the first guarantee but not the second. Falls back to contain_within_canonical + by-path crate::write_atomic on non-Linux / pre-openat2 kernels (the same best-effort posture as the other helpers).