@adonis-agora/agent 0.20.0 → 0.21.0

package/dist/src/dashboard/paths.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Pure path/asset helpers for serving the `@adonis-agora/agent-dashboard` governance SPA — extracted
+ * so they can be unit-tested without booting an AdonisJS app. Both dashboard providers compose these;
+ * each holds only the router wiring + I/O. Owned here (rather than in `@adonis-agora/agent-dashboard`)
+ * so `packages/adonis`'s OWN embedded dashboard provider (`providers/dashboard_provider.ts`) can reuse
+ * them without depending on the dashboard package at runtime — the dashboard package already depends
+ * on THIS one (for `AgentConfig`/`ActorResolver`/...), and a package.json edge the other way would be
+ * circular. See `providers/dashboard_provider.ts`'s module doc for the full story.
+ */
+/** Collapse duplicate slashes and strip leading/trailing ones: `/agent//` → `agent`. */
+export declare function trimSlashes(path: string): string;
+/** The agent API base as an absolute path with a single leading slash: `agent` → `/agent`. */
+export declare function apiBaseFor(agentPath: string): string;
+/**
+ * The canonical dashboard mount path (no trailing slash), default `<agentPath>/dashboard`. A caller
+ * may override with an explicit `dashboardPath`; both are normalized to a single leading slash.
+ */
+export declare function mountPathFor(agentPath: string, dashboardPath?: string): string;
+/** MIME type for a filename by extension; `application/octet-stream` for anything unknown. */
+export declare function contentTypeFor(filename: string): string;
+/**
+ * Reject a wildcard asset request that tries to escape the SPA root via `..` or an absolute path.
+ * Returns the safe, normalized relative segments (never starting with `..`), or `null` to deny.
+ */
+export declare function safeAssetSegments(wildcard: string | string[] | undefined): string[] | null;
+/**
+ * Inject the resolved agent API base into the served `index.html` as a global the SPA reads before
+ * boot, so the client calls the exact base the provider mounted (no build-time coupling). Idempotent
+ * per response — inserted right before `</head>`.
+ */
+export declare function injectApiBase(html: string, apiBase: string): string;
+/**
+ * Inject a `<base href="${mount}/">` as the FIRST thing inside `<head>`, so the SPA's relative
+ * `./assets/*` URLs (Vite `base: './'`) resolve against the mount directory no matter whether the
+ * browser's URL carries a trailing slash. This replaces the old trailing-slash redirect, which the
+ * AdonisJS router (it normalizes trailing slashes) turned into a duplicate-route crash. `mount` is a
+ * leading-slash, no-trailing-slash path (e.g. `/agent/dashboard`).
+ */
+export declare function injectBaseHref(html: string, mount: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/src/dashboard/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/dashboard/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAGpD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAM9E;AAsBD,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,GAAG,IAAI,CAU1F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAInE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQlE"}

package/dist/src/dashboard/paths.js

@@ -0,0 +1,99 @@
+/**
+ * Pure path/asset helpers for serving the `@adonis-agora/agent-dashboard` governance SPA — extracted
+ * so they can be unit-tested without booting an AdonisJS app. Both dashboard providers compose these;
+ * each holds only the router wiring + I/O. Owned here (rather than in `@adonis-agora/agent-dashboard`)
+ * so `packages/adonis`'s OWN embedded dashboard provider (`providers/dashboard_provider.ts`) can reuse
+ * them without depending on the dashboard package at runtime — the dashboard package already depends
+ * on THIS one (for `AgentConfig`/`ActorResolver`/...), and a package.json edge the other way would be
+ * circular. See `providers/dashboard_provider.ts`'s module doc for the full story.
+ */
+/** Collapse duplicate slashes and strip leading/trailing ones: `/agent//` → `agent`. */
+export function trimSlashes(path) {
+    return path.replace(/\/+/g, '/').replace(/^\/+|\/+$/g, '');
+}
+/** The agent API base as an absolute path with a single leading slash: `agent` → `/agent`. */
+export function apiBaseFor(agentPath) {
+    const trimmed = trimSlashes(agentPath);
+    return trimmed === '' ? '/' : `/${trimmed}`;
+}
+/**
+ * The canonical dashboard mount path (no trailing slash), default `<agentPath>/dashboard`. A caller
+ * may override with an explicit `dashboardPath`; both are normalized to a single leading slash.
+ */
+export function mountPathFor(agentPath, dashboardPath) {
+    if (dashboardPath !== undefined && trimSlashes(dashboardPath) !== '') {
+        return `/${trimSlashes(dashboardPath)}`;
+    }
+    const trimmed = trimSlashes(agentPath);
+    return trimmed === '' ? '/dashboard' : `/${trimmed}/dashboard`;
+}
+const CONTENT_TYPES = {
+    html: 'text/html; charset=utf-8',
+    js: 'text/javascript; charset=utf-8',
+    mjs: 'text/javascript; charset=utf-8',
+    css: 'text/css; charset=utf-8',
+    json: 'application/json; charset=utf-8',
+    svg: 'image/svg+xml',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    ico: 'image/x-icon',
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    ttf: 'font/ttf',
+    map: 'application/json; charset=utf-8',
+    txt: 'text/plain; charset=utf-8',
+};
+/** MIME type for a filename by extension; `application/octet-stream` for anything unknown. */
+export function contentTypeFor(filename) {
+    const dot = filename.lastIndexOf('.');
+    const ext = dot === -1 ? '' : filename.slice(dot + 1).toLowerCase();
+    return CONTENT_TYPES[ext] ?? 'application/octet-stream';
+}
+/**
+ * Reject a wildcard asset request that tries to escape the SPA root via `..` or an absolute path.
+ * Returns the safe, normalized relative segments (never starting with `..`), or `null` to deny.
+ */
+export function safeAssetSegments(wildcard) {
+    const parts = Array.isArray(wildcard) ? wildcard : (wildcard ?? '').split('/');
+    const segments = [];
+    for (const raw of parts) {
+        const part = raw.trim();
+        if (part === '' || part === '.')
+            continue;
+        if (part === '..' || part.includes('\0') || part.includes('\\'))
+            return null;
+        segments.push(part);
+    }
+    return segments;
+}
+/**
+ * Inject the resolved agent API base into the served `index.html` as a global the SPA reads before
+ * boot, so the client calls the exact base the provider mounted (no build-time coupling). Idempotent
+ * per response — inserted right before `</head>`.
+ */
+export function injectApiBase(html, apiBase) {
+    const tag = `<script>window.__AGENT_DASHBOARD_BASE__=${JSON.stringify(apiBase)}</script>`;
+    if (html.includes('</head>'))
+        return html.replace('</head>', `${tag}</head>`);
+    return `${tag}${html}`;
+}
+/**
+ * Inject a `<base href="${mount}/">` as the FIRST thing inside `<head>`, so the SPA's relative
+ * `./assets/*` URLs (Vite `base: './'`) resolve against the mount directory no matter whether the
+ * browser's URL carries a trailing slash. This replaces the old trailing-slash redirect, which the
+ * AdonisJS router (it normalizes trailing slashes) turned into a duplicate-route crash. `mount` is a
+ * leading-slash, no-trailing-slash path (e.g. `/agent/dashboard`).
+ */
+export function injectBaseHref(html, mount) {
+    const tag = `<base href="${mount}/">`;
+    const headOpen = html.match(/<head[^>]*>/i);
+    if (headOpen?.index !== undefined) {
+        const at = headOpen.index + headOpen[0].length;
+        return html.slice(0, at) + tag + html.slice(at);
+    }
+    return `${tag}${html}`;
+}
+//# sourceMappingURL=paths.js.map

package/dist/src/dashboard/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/dashboard/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,aAAsB;IACpE,IAAI,aAAa,KAAK,SAAS,IAAI,WAAW,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC;QACrE,OAAO,IAAI,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,OAAO,YAAY,CAAC;AACjE,CAAC;AAED,MAAM,aAAa,GAA2B;IAC5C,IAAI,EAAE,0BAA0B;IAChC,EAAE,EAAE,gCAAgC;IACpC,GAAG,EAAE,gCAAgC;IACrC,GAAG,EAAE,yBAAyB;IAC9B,IAAI,EAAE,iCAAiC;IACvC,GAAG,EAAE,eAAe;IACpB,GAAG,EAAE,WAAW;IAChB,GAAG,EAAE,YAAY;IACjB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,WAAW;IAChB,IAAI,EAAE,YAAY;IAClB,GAAG,EAAE,cAAc;IACnB,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE,YAAY;IACnB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,iCAAiC;IACtC,GAAG,EAAE,2BAA2B;CACjC,CAAC;AAEF,8FAA8F;AAC9F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,0BAA0B,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAuC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC1C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,MAAM,GAAG,GAAG,2CAA2C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC;IAC1F,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC;IAC9E,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAa;IACxD,MAAM,GAAG,GAAG,eAAe,KAAK,KAAK,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,QAAQ,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,CAAC;AACzB,CAAC"}

package/dist/src/index.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.20.0";
+export declare const VERSION = "0.21.0";
 export * from './types.js';
 export * from './spi/tool.js';
 export * from './base-tool.js';

package/dist/src/index.js

@@ -1,4 +1,4 @@
-export const VERSION = '0.20.0';
+export const VERSION = '0.21.0';
 export * from './types.js';
 export * from './spi/tool.js';
 export * from './base-tool.js';

package/dist/stubs/config/agent.stub

@@ -39,6 +39,13 @@ export default defineConfig({
   // defaultRoles: ['ADMIN'],  // roles a tool requires when it declares none (fail-closed)
   // maxSteps: 8,              // cap on model↔tool iterations per turn
 
+  // Governance console — served automatically at <path>/dashboard (default /agent/dashboard), no
+  // separate install. It only mounts once `governanceAuthorize` is set (every panel but Quota reads
+  // the cross-actor governance routes, which need that gate too — see the docs). Toggle it off,
+  // relocate it, or add an extra gate on top of governanceAuthorize:
+  // dashboard: { enabled: true, path: '/agent/dashboard', authorize: (actor) => actor.roles?.includes('ADMIN') ?? false },
+  // governanceAuthorize: (actor) => actor.roles?.includes('ADMIN') ?? false,
+
   // Multimodal uploads — mounts POST /agent/attachments, which stages a file into a model-fetchable
   // MessageAttachment the client sends back with its next chat message. Bind your own store (presign
   // S3/GCS or wrap your media pipeline); `attachmentStores.memory()` inlines bytes as a data: URL.

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@adonis-agora/agent",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "Governed, durable-backed AI agent (chat + tool-calling + governance) for AdonisJS — part of the Agora ecosystem.",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/DavideCarvalho/adonis-agent.git",
+    "url": "git+https://github.com/DavideCarvalho/adonis-agora-agent.git",
     "directory": "packages/adonis"
   },
   "author": "Davi Carvalho <davi@goflip.ai>",
@@ -58,6 +58,16 @@
       "import": "./dist/providers/agent_provider.js",
       "default": "./dist/providers/agent_provider.js"
     },
+    "./dashboard_provider": {
+      "types": "./dist/providers/dashboard_provider.d.ts",
+      "import": "./dist/providers/dashboard_provider.js",
+      "default": "./dist/providers/dashboard_provider.js"
+    },
+    "./dashboard": {
+      "types": "./dist/src/dashboard/index.d.ts",
+      "import": "./dist/src/dashboard/index.js",
+      "default": "./dist/src/dashboard/index.js"
+    },
     "./configure": {
       "types": "./dist/configure.d.ts",
       "import": "./dist/configure.js",
@@ -106,8 +116,8 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "@standard-schema/spec": "^1.0.0"
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@standard-schema/spec": "1.1.0"
   },
   "peerDependencies": {
     "@adonis-agora/authz": ">=0.4.2 <1.0.0",
@@ -166,27 +176,27 @@
     }
   },
   "devDependencies": {
-    "@adonis-agora/authz": "^0.10.1",
-    "@adonis-agora/diagnostics": "^0.2.5",
+    "@adonis-agora/authz": "0.10.1",
+    "@adonis-agora/diagnostics": "0.2.5",
     "@adonis-agora/durable": "0.21.0",
-    "@adonis-agora/telescope": "^0.6.0",
-    "@adonisjs/assembler": "^8.4.0",
+    "@adonis-agora/telescope": "0.6.0",
+    "@adonisjs/assembler": "8.4.0",
     "@adonisjs/core": "7.4.0",
-    "@adonisjs/lucid": "^22.4.0",
+    "@adonisjs/lucid": "22.4.2",
     "@qdrant/js-client-rest": "1.19.0",
-    "@types/node": "^22.0.0",
+    "@types/node": "22.20.0",
     "@types/react": "19.2.18",
     "ai": "7.0.59",
-    "better-sqlite3": "^11.0.0",
-    "luxon": "^3.4.0",
-    "node-sql-parser": "^5.3.0",
+    "better-sqlite3": "11.10.0",
+    "luxon": "3.7.2",
+    "node-sql-parser": "5.4.0",
     "react": "19.2.8",
-    "typescript": "^5.4.0",
-    "vitest": "^3.0.0",
-    "zod": "^3.25.0"
+    "typescript": "5.9.3",
+    "vitest": "3.2.7",
+    "zod": "3.25.76"
   },
   "engines": {
-    "node": ">=22.0.0 <23"
+    "node": "v22.23.2"
   },
   "keywords": [
     "adonisjs",
@@ -204,7 +214,7 @@
     "build": "pnpm run clean && tsc -p tsconfig.build.json && pnpm run copy:stubs && pnpm run check:dist",
     "check:dist": "node ../../scripts/assert-build-output.mjs dist src/index.js",
     "clean": "rm -rf dist",
-    "copy:stubs": "mkdir -p dist/stubs/config dist/stubs/database/migrations && cp stubs/config/agent.stub dist/stubs/config/agent.stub && cp stubs/config/mcp.stub dist/stubs/config/mcp.stub && cp -r stubs/database/migrations/. dist/stubs/database/migrations/",
+    "copy:stubs": "mkdir -p dist/stubs/config dist/stubs/database/migrations dist/assets && cp stubs/config/agent.stub dist/stubs/config/agent.stub && cp stubs/config/mcp.stub dist/stubs/config/mcp.stub && cp -r stubs/database/migrations/. dist/stubs/database/migrations/ && rm -rf dist/assets/spa && cp -r ../dashboard/dist/spa dist/assets/spa",
     "test": "vitest run --passWithNoTests",
     "test:watch": "vitest",
     "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.tests.json"