dguiducci
178a38357e
Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.
## UserManager + per-user encryption (§9/§11)
New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.
New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).
- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
<0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
`create_owner_tables` (one owner's content, identical in every file). No FK in
the owner bucket may reach the registry — enforced by a standalone test.
Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
so a crash leaves an orphan file, never a user without a database. `open_db`
never creates: a missing file is an error, not a silent empty database.
Not consumed yet: no login, call sites still use the shared system.db pool.
## Extract crates/skald-core
The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:
- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
(sibling of `http_router`), so the core no longer downcasts to
`MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
teardown-and-respawn; the core defaults to the supervisor exit code. The core
loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
only emits tracing events.
All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.
95 lines
3.2 KiB
Rust
95 lines
3.2 KiB
Rust
//! `known_tools` — every tool ever offered to the LLM, captured at injection
|
|
//! time by [`crate::tool_discovery::ToolDiscovery`].
|
|
//!
|
|
//! This is the drift-proof half of tool visibility: instead of maintaining a
|
|
//! parallel list of "all tools", we record what is actually assembled into the
|
|
//! LLM request (`AgentRunConfig::all_tool_defs`). The approval / Security-groups
|
|
//! UI merges these rows so tools injected outside the `ToolRegistry` (interface
|
|
//! tools, plugin tools, provider tools) can still be assigned a permission.
|
|
|
|
use anyhow::Result;
|
|
use serde::Serialize;
|
|
use sqlx::SqlitePool;
|
|
|
|
#[derive(Debug, Clone, Serialize)]
|
|
pub struct KnownTool {
|
|
pub name: String,
|
|
pub description: String,
|
|
/// JSON parameters schema as last seen, if any.
|
|
pub schema: Option<String>,
|
|
}
|
|
|
|
/// Records (or refreshes) a tool by name. Idempotent: re-seeing a tool updates
|
|
/// its description/schema and bumps `last_seen`.
|
|
pub async fn upsert(
|
|
pool: &SqlitePool,
|
|
name: &str,
|
|
description: &str,
|
|
schema: Option<&str>,
|
|
) -> Result<()> {
|
|
sqlx::query(
|
|
"INSERT INTO known_tools (name, description, schema, first_seen, last_seen)
|
|
VALUES (?1, ?2, ?3, strftime('%s','now'), strftime('%s','now'))
|
|
ON CONFLICT(name) DO UPDATE SET
|
|
description = excluded.description,
|
|
schema = excluded.schema,
|
|
last_seen = excluded.last_seen",
|
|
)
|
|
.bind(name)
|
|
.bind(description)
|
|
.bind(schema)
|
|
.execute(pool)
|
|
.await?;
|
|
Ok(())
|
|
}
|
|
|
|
/// All recorded tools, sorted by name.
|
|
pub async fn all(pool: &SqlitePool) -> Result<Vec<KnownTool>> {
|
|
let rows = sqlx::query_as::<_, (String, String, Option<String>)>(
|
|
"SELECT name, description, schema FROM known_tools ORDER BY name",
|
|
)
|
|
.fetch_all(pool)
|
|
.await?;
|
|
Ok(rows
|
|
.into_iter()
|
|
.map(|(name, description, schema)| KnownTool { name, description, schema })
|
|
.collect())
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
fn temp_db_path(tag: &str) -> String {
|
|
let mut p = std::env::temp_dir();
|
|
let nanos = std::time::SystemTime::now()
|
|
.duration_since(std::time::UNIX_EPOCH).unwrap().as_nanos();
|
|
p.push(format!("skald-test-{tag}-{}-{nanos}.db", std::process::id()));
|
|
p.to_string_lossy().into_owned()
|
|
}
|
|
|
|
fn cleanup(path: &str) {
|
|
for suffix in ["", "-wal", "-shm"] {
|
|
let _ = std::fs::remove_file(format!("{path}{suffix}"));
|
|
}
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn upsert_is_idempotent_and_updates_metadata() {
|
|
let path = temp_db_path("known-tools");
|
|
let pool = crate::db::init_system_pool(&path).await.unwrap();
|
|
|
|
upsert(&pool, "send_voice_message", "v1", Some(r#"{"type":"object"}"#)).await.unwrap();
|
|
upsert(&pool, "send_voice_message", "v2", None).await.unwrap();
|
|
|
|
let rows = all(&pool).await.unwrap();
|
|
assert_eq!(rows.len(), 1, "same name must not create a second row");
|
|
assert_eq!(rows[0].name, "send_voice_message");
|
|
assert_eq!(rows[0].description, "v2", "description is refreshed on re-upsert");
|
|
assert_eq!(rows[0].schema, None, "schema is refreshed on re-upsert");
|
|
|
|
pool.close().await;
|
|
cleanup(&path);
|
|
}
|
|
}
|