@addai/node 0.30.13 → 0.30.15

package/dist/entitybox-file-session.d.ts

@@ -0,0 +1,38 @@
+import { type EntityboxFileBlock } from './entitybox-file-inputs';
+interface Request {
+    id: string;
+    runtime_id: string;
+    agent: string;
+    mode: string;
+    entitybox_file_request?: boolean;
+    entitybox_computer_request?: boolean;
+}
+interface Io {
+    rpc: <T>(name: string, args: Record<string, unknown>) => Promise<T>;
+    pairing: () => {
+        runtimeId: string;
+        daemonToken: string;
+    } | null;
+    fetch?: typeof fetch;
+}
+export declare function entityboxFileSessionConfiguration(request: Request, env?: NodeJS.ProcessEnv): string | undefined;
+/** Ordinary native chat keeps its existing identity and Claude launcher. Only
+ * explicitly marked file requests enter this strict path; legacy attachments
+ * and all unmarked requests retain their existing behavior. */
+export declare function prepareEntityboxSessionFiles(request: Request, io: Io, signal: AbortSignal, env?: NodeJS.ProcessEnv): Promise<readonly EntityboxFileBlock[] | undefined>;
+/** Reuse the native heartbeat rather than inventing a second presence system.
+ * Only explicit, valid configuration and a verified usable Claude binary can
+ * advertise chat support. The URL/credentials are never capability metadata. */
+export declare function entityboxFileCapabilities(claude: {
+    available: boolean;
+    authed?: boolean;
+    version?: string;
+}, env?: NodeJS.ProcessEnv): {
+    version: number;
+    chat: boolean;
+    computer: boolean;
+    maxFiles: number;
+    maxImageBytes: number;
+    maxTotalBytes: number;
+} | undefined;
+export {};

package/dist/entitybox-file-session.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entityboxFileSessionConfiguration = entityboxFileSessionConfiguration;
+exports.prepareEntityboxSessionFiles = prepareEntityboxSessionFiles;
+exports.entityboxFileCapabilities = entityboxFileCapabilities;
+const entitybox_file_inputs_1 = require("./entitybox-file-inputs");
+const entitybox_operation_1 = require("./entitybox-operation");
+const entitybox_execution_host_1 = require("./entitybox-execution-host");
+function entityboxFileSessionConfiguration(request, env = process.env) {
+    if (request.entitybox_file_request !== true)
+        return undefined;
+    if (request.entitybox_computer_request === true || request.agent !== 'claude' || request.mode !== 'print' || env.AINODE_ENTITYBOX_FILE_INPUTS_ENABLED !== '1')
+        throw new entitybox_file_inputs_1.EntityboxFileInputError();
+    return (0, entitybox_file_inputs_1.entityboxFileGatewayUrl)(env.AINODE_ENTITYBOX_FILE_GATEWAY_URL ?? '');
+}
+/** Ordinary native chat keeps its existing identity and Claude launcher. Only
+ * explicitly marked file requests enter this strict path; legacy attachments
+ * and all unmarked requests retain their existing behavior. */
+async function prepareEntityboxSessionFiles(request, io, signal, env = process.env) {
+    const gateway = entityboxFileSessionConfiguration(request, env);
+    if (!gateway)
+        return undefined;
+    const token = () => { const p = io.pairing(); if (signal.aborted || !p || p.runtimeId !== request.runtime_id || !p.daemonToken)
+        throw new entitybox_file_inputs_1.EntityboxFileInputError(); return p.daemonToken; };
+    const inputs = new entitybox_file_inputs_1.EntityboxFileInputs({ requestId: request.id, signal, requireFiles: true,
+        manifest: async (active) => { if (active.aborted)
+            throw new Error(); const value = await io.rpc('entitybox_file_manifest', { p_token: token(), p_request_id: request.id }); token(); if (active.aborted)
+            throw new Error(); return value; },
+        download: async (fileId, active) => {
+            if (active.aborted)
+                throw new Error();
+            const response = await (io.fetch ?? fetch)(gateway, { method: 'POST', redirect: 'error', credentials: 'omit', signal: active, headers: { authorization: 'Bearer ' + token(), 'content-type': 'application/json' }, body: JSON.stringify({ requestId: request.id, fileId }) });
+            try {
+                token();
+                if (active.aborted)
+                    throw new Error();
+                return response;
+            }
+            catch {
+                void response.body?.cancel().catch(() => { });
+                throw new Error();
+            }
+        },
+    });
+    try {
+        const blocks = await inputs.blocks(signal);
+        if (!blocks.length)
+            throw new Error();
+        // A canceled task cannot start a CLI from a completed download. Missing
+        // status/transport evidence also prevents spawn rather than guessing.
+        const status = await (0, entitybox_operation_1.entityboxOperation)([signal], 4500, () => io.rpc('runtime_get_request_status', { p_token: token(), p_request_id: request.id }));
+        token();
+        if (!['starting', 'running'].includes(status))
+            throw new Error();
+        return blocks;
+    }
+    catch {
+        throw new entitybox_file_inputs_1.EntityboxFileInputError();
+    }
+}
+/** Reuse the native heartbeat rather than inventing a second presence system.
+ * Only explicit, valid configuration and a verified usable Claude binary can
+ * advertise chat support. The URL/credentials are never capability metadata. */
+function entityboxFileCapabilities(claude, env = process.env) {
+    try {
+        if (env.AINODE_ENTITYBOX_FILE_INPUTS_ENABLED !== '1')
+            return undefined;
+        (0, entitybox_file_inputs_1.entityboxFileGatewayUrl)(env.AINODE_ENTITYBOX_FILE_GATEWAY_URL ?? '');
+        const match = /^(\d+)\.(\d+)\.(\d+)/.exec(claude.version ?? '');
+        const compatible = !!match && (Number(match[1]) > 2 || Number(match[1]) === 2 && (Number(match[2]) > 1 || Number(match[2]) === 1 && Number(match[3]) >= 263));
+        const chat = claude.available && claude.authed === true && compatible;
+        let computer = false;
+        try {
+            computer = !!(0, entitybox_execution_host_1.entityboxExecutionEnvironment)(env);
+        }
+        catch { }
+        return { version: 1, chat, computer, maxFiles: 6, maxImageBytes: 7 * 1024 * 1024, maxTotalBytes: 18 * 1024 * 1024 };
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/entitybox-host-process.d.ts

@@ -0,0 +1,12 @@
+export interface EntityboxHostProcess {
+    platform: 'win32' | 'linux';
+    pid: number;
+    start: string;
+    domain: string;
+}
+export declare function parseEntityboxHostProcess(value: unknown): Readonly<EntityboxHostProcess>;
+export declare function sameEntityboxHostProcess(a: EntityboxHostProcess, b: EntityboxHostProcess): boolean;
+export declare function parseEntityboxLinuxStat(raw: string, pid: number, domain: string): Readonly<EntityboxHostProcess> | null;
+/** Read OS birth identity; never kill, focus, inspect environment or capture UI. */
+export declare function readEntityboxHostProcess(pid?: number): Promise<Readonly<EntityboxHostProcess> | null>;
+export declare function assertEntityboxHostProcessGone(value: EntityboxHostProcess): Promise<void>;

package/dist/entitybox-host-process.js

@@ -0,0 +1,120 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEntityboxHostProcess = parseEntityboxHostProcess;
+exports.sameEntityboxHostProcess = sameEntityboxHostProcess;
+exports.parseEntityboxLinuxStat = parseEntityboxLinuxStat;
+exports.readEntityboxHostProcess = readEntityboxHostProcess;
+exports.assertEntityboxHostProcessGone = assertEntityboxHostProcessGone;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const fs = __importStar(require("fs/promises"));
+const path = __importStar(require("path"));
+const entitybox_execution_lease_1 = require("./entitybox-execution-lease");
+const exec = (0, util_1.promisify)(child_process_1.execFile), uuid = '[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}';
+const failure = () => new entitybox_execution_lease_1.EntityboxExecutionError('Native process identity could not be verified');
+function parseEntityboxHostProcess(value) {
+    const p = value;
+    if (!p || Object.keys(p).sort().join(',') !== 'domain,pid,platform,start' || !Number.isSafeInteger(p.pid) || p.pid < 1 || p.pid > 2147483647 || typeof p.start !== 'string' || !/^[0-9]{1,20}$/.test(p.start) || typeof p.domain !== 'string'
+        || !(p.platform === 'win32' && p.domain === 'win32' || p.platform === 'linux' && new RegExp('^' + uuid + '/[0-9]{1,20}$').test(p.domain)))
+        throw failure();
+    return Object.freeze({ ...p });
+}
+function sameEntityboxHostProcess(a, b) { return a.platform === b.platform && a.pid === b.pid && a.start === b.start && a.domain === b.domain; }
+async function linuxDomain() { const boot = (await fs.readFile('/proc/sys/kernel/random/boot_id', 'utf8')).trim(), ns = await fs.stat('/proc/self/ns/pid', { bigint: true }); return boot + '/' + ns.ino.toString(); }
+function parseEntityboxLinuxStat(raw, pid, domain) {
+    if (!raw.startsWith(pid + ' ('))
+        throw failure();
+    const close = raw.lastIndexOf(')'), parts = raw.slice(close + 2).trim().split(/\s+/);
+    if (close < 0 || parts.length < 20)
+        throw failure();
+    const identity = parseEntityboxHostProcess({ platform: 'linux', pid, start: parts[19], domain });
+    return ['Z', 'X'].includes(parts[0]) ? null : identity;
+}
+/** Read OS birth identity; never kill, focus, inspect environment or capture UI. */
+async function readEntityboxHostProcess(pid = process.pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1 || pid > 2147483647)
+        throw failure();
+    try {
+        if (process.platform === 'linux') {
+            const domain = await linuxDomain();
+            let raw;
+            try {
+                raw = await fs.readFile('/proc/' + pid + '/stat', 'utf8');
+            }
+            catch (e) {
+                if (e.code === 'ENOENT')
+                    return null;
+                throw e;
+            }
+            return parseEntityboxLinuxStat(raw, pid, domain);
+        }
+        if (process.platform === 'win32') {
+            const shell = path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+            const script = "$ErrorActionPreference='Stop'; $targetProcess=Get-Process -Id " + pid + " -ErrorAction SilentlyContinue; if($null -eq $targetProcess){'null'; exit 0}; try {if($targetProcess.HasExited){'null'}else{@{platform='win32';domain='win32';pid=$targetProcess.Id;start=$targetProcess.StartTime.ToUniversalTime().Ticks.ToString([Globalization.CultureInfo]::InvariantCulture)}|ConvertTo-Json -Compress}}catch{exit 3}";
+            const env = {};
+            for (const key of ['SystemRoot', 'WINDIR', 'Path', 'PATH', 'TEMP', 'TMP'])
+                if (process.env[key] !== undefined)
+                    env[key] = process.env[key];
+            const raw = (await exec(shell, ['-NoProfile', '-NonInteractive', '-Command', script], { env, windowsHide: true, timeout: 5000, maxBuffer: 4096 })).stdout.trim(), value = JSON.parse(raw);
+            if (value === null)
+                return null;
+            const identity = parseEntityboxHostProcess(value);
+            if (identity.pid !== pid)
+                throw failure();
+            return identity;
+        }
+        throw failure();
+    }
+    catch {
+        throw failure();
+    }
+}
+async function assertEntityboxHostProcessGone(value) {
+    const expected = parseEntityboxHostProcess(value);
+    if (expected.platform !== process.platform)
+        throw failure();
+    if (expected.platform === 'linux') {
+        const domain = await linuxDomain();
+        if (domain.split('/')[0] !== expected.domain.split('/')[0])
+            return;
+        // A different PID namespace cannot establish whether the old process died.
+        if (domain !== expected.domain)
+            throw failure();
+    }
+    const current = await readEntityboxHostProcess(expected.pid);
+    if (current && sameEntityboxHostProcess(current, expected))
+        throw new entitybox_execution_lease_1.EntityboxExecutionError('The previous native controller or guard is still present');
+}

package/dist/entitybox-install.d.ts

@@ -0,0 +1,10 @@
+/** EntityBox's opt-in installation restriction. Public identifiers are not
+ * credentials; the native resolver and desktop MCP still authorize access. */
+export declare class EntityboxInstallError extends Error {
+}
+export declare function entityboxInstallScope(overrides: Record<string, Record<string, string>> | undefined, requestId: string | undefined): string | null;
+export declare function assertEntityboxDesktopMcp(mcps: Array<{
+    slug: string;
+    command: string;
+    env: Record<string, string> | null;
+}>, scope: string): void;

package/dist/entitybox-install.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EntityboxInstallError = void 0;
+exports.entityboxInstallScope = entityboxInstallScope;
+exports.assertEntityboxDesktopMcp = assertEntityboxDesktopMcp;
+/** EntityBox's opt-in installation restriction. Public identifiers are not
+ * credentials; the native resolver and desktop MCP still authorize access. */
+class EntityboxInstallError extends Error {
+}
+exports.EntityboxInstallError = EntityboxInstallError;
+function entityboxInstallScope(overrides, requestId) {
+    const env = overrides?.['entity-desktop-mcp'];
+    if (!env || !Object.prototype.hasOwnProperty.call(env, 'ENTITYBOX_DESKTOP_SCOPE'))
+        return null;
+    const value = env.ENTITYBOX_DESKTOP_SCOPE;
+    const uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    try {
+        if (!requestId || !uuid.test(requestId) || typeof value !== 'string' || value.length > 512)
+            throw new Error();
+        const scope = JSON.parse(value);
+        if (!scope || Array.isArray(scope) || scope.version !== 1
+            || Object.keys(scope).sort().join(',') !== 'desktopId,runId,runtimeId,version'
+            || !['runId', 'desktopId', 'runtimeId'].every(key => typeof scope[key] === 'string' && uuid.test(scope[key])))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new EntityboxInstallError('The computer task has an invalid execution scope. Start a new task.');
+    }
+}
+function assertEntityboxDesktopMcp(mcps, scope) {
+    const rows = mcps.filter(m => m.slug === 'entity-desktop-mcp');
+    if (rows.length !== 1 || !rows[0].command?.trim() || ['http', 'sse', 'streamable-http'].includes(rows[0].command.toLowerCase())) {
+        throw new EntityboxInstallError('The required native desktop connection could not be installed.');
+    }
+    const env = rows[0].env;
+    if (env?.ENTITYBOX_DESKTOP_SCOPE !== scope || !env?.ENTITY_API_KEY?.trim()) {
+        throw new EntityboxInstallError('The computer connection credentials or execution scope are unavailable.');
+    }
+}

package/dist/entitybox-mcp-broker.d.ts

@@ -0,0 +1,77 @@
+import { type EntityboxExecutionLease } from './entitybox-execution-lease';
+import { type EntityboxMcpScope } from './entitybox-mcp-contract';
+import type { EntityboxBrokerEmit } from './entitybox-provider-broker';
+/** Trusted runtime resource owner, never supplied by the task/model. It must
+ * cover ALL dispatched desktop actions, including detached/background work
+ * and periodic MCP captures. MCP process exit is not this proof. There is no
+ * production implementation for legacy native desktops yet. */
+export interface EntityboxDesktopActionOwner {
+    readonly scope: EntityboxMcpScope;
+    readonly transport?: {
+        configuration: string;
+        token: string;
+        capability: {
+            version: number;
+            requestId: string;
+            attemptId: string;
+            scope: EntityboxMcpScope;
+        };
+    };
+    assertActive(): Promise<void>;
+    stopAndVerify(): Promise<void>;
+}
+interface Config {
+    /** Actual request-scoped descriptor returned by the native installer. */
+    connection: {
+        command: string;
+        args: string[];
+        env: Record<string, string>;
+    };
+    allowedTools: readonly string[];
+    actions: EntityboxDesktopActionOwner;
+    /** Additional resolved credentials to scrub; never public task input. */
+    secrets?: readonly string[];
+    /** Trusted test/runtime deadline, bounded at two minutes. */
+    requestTimeoutMs?: number;
+}
+/** One required, scoped native MCP connection per isolated task. The model
+ * receives a small MCP facade over the existing broker pipe, not this process,
+ * command line, configuration, entity key, pairing token or lease nonce. */
+export declare class EntityboxMcpBroker {
+    private readonly lease;
+    private readonly proc;
+    private readonly closed;
+    private didClose;
+    private childPid?;
+    private buffer;
+    private diagnostics;
+    private readonly pending;
+    private readonly allowed;
+    private readonly secrets;
+    private readonly timeout;
+    private readonly actions;
+    private catalog;
+    private ready;
+    private closing;
+    private stopping?;
+    private clientPhase;
+    private serial;
+    private queued;
+    failureCode?: 'entitybox_mcp_connection_failed';
+    private constructor();
+    static connect(lease: EntityboxExecutionLease, config: Config): Promise<EntityboxMcpBroker>;
+    /** Public process identity for the owning runtime's resource ledger. */
+    get processId(): number | undefined;
+    private active;
+    private rejectPending;
+    private fail;
+    private consume;
+    private rpc;
+    private notify;
+    handle(raw: unknown, signal: AbortSignal, emit: EntityboxBrokerEmit): Promise<void>;
+    /** Aggregate this with the isolated model owner's stop proof before calling
+     * lease.acknowledgeStopped. Never acknowledge on MCP/container exit alone. */
+    stopAndVerify(): Promise<void>;
+    private closeOwnedConnection;
+}
+export {};