@agent-native/core 0.93.0 → 0.94.0

package/corpus/core/src/agent/production-agent.ts

@@ -44,7 +44,7 @@ import {
 import { fireInternalDispatch } from "../server/self-dispatch.js";
 import {
   isReasoningEffort,
-  normalizeReasoningEffortForModel,
+  normalizeReasoningEffortForRequest,
   stepDownReasoningEffort,
   type ReasoningEffort,
 } from "../shared/reasoning-effort.js";
@@ -2202,6 +2202,174 @@ export function actionsToEngineTools(
   return tools;
 }
 
+export type AgentToolCallExecutionResult =
+  | {
+      status: "completed";
+      output: string;
+      completedSideEffect?: boolean;
+    }
+  | {
+      status: "approval_required";
+      output: string;
+      approvalKey: string;
+    }
+  | {
+      status: "failed";
+      output: string;
+    };
+
+export interface ExecuteAgentToolCallOptions {
+  actions: Record<string, ActionEntry>;
+  name: string;
+  input?: unknown;
+  callId: string;
+  signal?: AbortSignal;
+  ownerEmail?: string | null;
+  orgId?: string | null;
+  threadId?: string;
+  turnId?: string;
+  approvedToolCalls?: string[];
+  send?: (event: AgentChatEvent) => void;
+}
+
+/**
+ * Execute one externally-selected tool through the exact same guarded runtime
+ * as a normal model-selected tool call. Realtime voice and other duplex
+ * transports use this instead of calling `ActionEntry.run` directly, which
+ * would bypass approvals, schema validation, timeouts, the tool journal,
+ * result redaction, mutation ordering, and refresh notifications.
+ */
+export async function executeAgentToolCall(
+  options: ExecuteAgentToolCallOptions,
+): Promise<AgentToolCallExecutionResult> {
+  const entry = options.actions[options.name];
+  if (!entry || entry.agentTool === false) {
+    return {
+      status: "failed",
+      output: `Unknown or unavailable tool: ${options.name}`,
+    };
+  }
+
+  let streamCalls = 0;
+  const engine: AgentEngine = {
+    name: "agent-native:single-tool",
+    label: "Agent Native tool runtime",
+    defaultModel: "agent-native:single-tool",
+    supportedModels: ["agent-native:single-tool"],
+    capabilities: {
+      thinking: false,
+      promptCaching: false,
+      vision: false,
+      computerUse: false,
+      parallelToolCalls: false,
+    },
+    async *stream(): AsyncIterable<EngineEvent> {
+      streamCalls += 1;
+      if (streamCalls === 1) {
+        yield {
+          type: "assistant-content",
+          parts: [
+            {
+              type: "tool-call",
+              id: options.callId,
+              name: options.name,
+              input: options.input ?? {},
+            },
+          ],
+        };
+        yield { type: "stop", reason: "tool_use" };
+        return;
+      }
+      yield {
+        type: "assistant-content",
+        parts: [{ type: "text", text: "Tool execution complete." }],
+      };
+      yield { type: "stop", reason: "end_turn" };
+    },
+  };
+
+  const events: AgentChatEvent[] = [];
+  const send = (event: AgentChatEvent) => {
+    events.push(event);
+    options.send?.(event);
+  };
+  const controller = options.signal ? null : new AbortController();
+  const signal = options.signal ?? controller!.signal;
+  const tools = actionsToEngineTools(options.actions);
+
+  try {
+    await runAgentLoop({
+      engine,
+      model: engine.defaultModel,
+      systemPrompt: "Execute the selected Agent Native tool call.",
+      tools,
+      availableTools: tools,
+      messages: [
+        {
+          role: "user",
+          content: [
+            {
+              type: "text",
+              text: `Execute the ${options.name} tool call.`,
+            },
+          ],
+        },
+      ],
+      actions: options.actions,
+      send,
+      signal,
+      ownerEmail: options.ownerEmail,
+      orgId: options.orgId,
+      executionMode: "act",
+      maxIterations: 2,
+      threadId: options.threadId,
+      turnId: options.turnId,
+      approvedToolCalls: options.approvedToolCalls,
+    });
+  } catch (error) {
+    return {
+      status: "failed",
+      output: sanitizeToolErrorValue(error),
+    };
+  }
+
+  const approval = events.find(
+    (event): event is Extract<AgentChatEvent, { type: "approval_required" }> =>
+      event.type === "approval_required" && event.tool === options.name,
+  );
+  const completed = [...events]
+    .reverse()
+    .find(
+      (event): event is Extract<AgentChatEvent, { type: "tool_done" }> =>
+        event.type === "tool_done" && event.tool === options.name,
+    );
+
+  if (approval) {
+    return {
+      status: "approval_required",
+      approvalKey: approval.approvalKey,
+      output:
+        completed?.result ?? `Awaiting human approval to run ${options.name}.`,
+    };
+  }
+  if (!completed) {
+    return {
+      status: "failed",
+      output: `The ${options.name} tool did not return a result.`,
+    };
+  }
+  if (completed.isError) {
+    return { status: "failed", output: completed.result };
+  }
+  return {
+    status: "completed",
+    output: completed.result,
+    ...(typeof completed.completedSideEffect === "boolean"
+      ? { completedSideEffect: completed.completedSideEffect }
+      : {}),
+  };
+}
+
 export function filterInitialEngineTools(
   tools: EngineTool[],
   initialToolNames?: string[],
@@ -3509,9 +3677,11 @@ export async function runAgentLoop(opts: {
           effectiveReasoningEffort = stepDownReasoningEffort(
             effectiveReasoningEffort,
           );
+          send({ type: "clear" });
           appendAgentLoopContinuation(messages, "max_tokens");
           continue;
         }
+        send({ type: "clear" });
         send({
           type: "text",
           text: "The model returned an empty response. This usually means reasoning used the full output-token budget. Try again, or pick a different model from the model menu.",
@@ -5616,6 +5786,21 @@ function progressStepFromAgentChatEvent(event: AgentChatEvent): string | null {
   }
 }
 
+export function resolveAgentRequestReasoningEffort({
+  model,
+  requestEffort,
+  configuredEffort,
+}: {
+  model: string;
+  requestEffort?: unknown;
+  configuredEffort?: ReasoningEffort;
+}): ReasoningEffort | undefined {
+  return normalizeReasoningEffortForRequest(
+    model,
+    isReasoningEffort(requestEffort) ? requestEffort : configuredEffort,
+  );
+}
+
 export function createProductionAgentHandler(
   options: ProductionAgentOptions,
 ): H3EventHandler {
@@ -5963,12 +6148,11 @@ export function createProductionAgentHandler(
     // DIAGNOSTIC-ONLY: stored-model resolution finished.
     workerStep("model_done");
     const model = normalizeModelForEngine(engine, modelCandidate);
-    const reasoningEffort = normalizeReasoningEffortForModel(
+    const reasoningEffort = resolveAgentRequestReasoningEffort({
       model,
-      isReasoningEffort(requestEffort)
-        ? requestEffort
-        : options.reasoningEffort,
-    );
+      requestEffort,
+      configuredEffort: options.reasoningEffort,
+    });
 
     options.onEngineResolved?.(engine, model);
 

package/corpus/core/src/agent/run-manager.ts

@@ -1119,7 +1119,11 @@ export function startRun(
 
   // On Cloudflare Workers, keep the isolate alive for this run
   try {
-    const cfCtx = globalThis.__cf_ctx;
+    const cfCtx = (
+      globalThis as typeof globalThis & {
+        __cf_ctx?: { waitUntil(promise: Promise<unknown>): void };
+      }
+    ).__cf_ctx;
     if (cfCtx?.waitUntil) {
       cfCtx.waitUntil(runPromise);
     }

package/corpus/core/src/application-state/index.ts

@@ -1,6 +1,7 @@
 // Store
 export {
   appStateGet,
+  appStateGetMany,
   appStatePut,
   appStateDelete,
   appStateList,

package/corpus/core/src/application-state/store.ts

@@ -117,6 +117,38 @@ export async function appStateGet(
   }
 }
 
+/**
+ * Read several application-state keys for one session in a single SQL query.
+ * Missing keys are returned as `null` so callers can preserve the requested
+ * shape without issuing one fallback query per key.
+ */
+export async function appStateGetMany(
+  sessionId: string,
+  keys: readonly string[],
+): Promise<Record<string, Record<string, unknown> | null>> {
+  const uniqueKeys = [...new Set(keys)];
+  const values: Record<string, Record<string, unknown> | null> = {};
+  for (const key of uniqueKeys) values[key] = null;
+  if (uniqueKeys.length === 0) return values;
+
+  try {
+    await ensureTable();
+    const client = getDbExec();
+    const placeholders = uniqueKeys.map(() => "?").join(", ");
+    const { rows } = await client.execute({
+      sql: `SELECT key, value FROM application_state WHERE session_id = ? AND key IN (${placeholders})`,
+      args: [sessionId, ...uniqueKeys],
+    });
+    for (const row of rows) {
+      values[row.key as string] = JSON.parse(row.value as string);
+    }
+    return values;
+  } catch (err) {
+    if (isConnectionError(err)) return values;
+    throw err;
+  }
+}
+
 export async function appStatePut(
   sessionId: string,
   key: string,

package/corpus/core/src/cli/code-agent-connector.ts

@@ -3,6 +3,12 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 
+import { assertValidComputerCommandEnvelope } from "../integrations/computer-supervision.js";
+import { serializeBoundedRemoteJson } from "../integrations/remote-json-safety.js";
+import type {
+  ComputerCommandEnvelope,
+  RemoteComputerCapabilities,
+} from "../integrations/remote-types.js";
 import {
   executeDenyCodeAgentApproval,
   executePendingCodeAgentApproval,
@@ -37,6 +43,12 @@ export interface RunCodeAgentConnectorOptions {
   once?: boolean;
 }
 
+export interface LocalComputerBridgeConfig {
+  url: string;
+  token: string;
+  capabilities: RemoteComputerCapabilities;
+}
+
 interface RemoteCommand {
   id: string;
   kind: string;
@@ -58,6 +70,9 @@ interface RunnerProcess {
 }
 
 const DEVICE_PATH_ENV = "AGENT_NATIVE_REMOTE_DEVICE_PATH";
+const COMPUTER_BRIDGE_URL_ENV = "AGENT_NATIVE_COMPUTER_BRIDGE_URL";
+const COMPUTER_BRIDGE_TOKEN_ENV = "AGENT_NATIVE_COMPUTER_BRIDGE_TOKEN";
+const COMPUTER_CAPABILITIES_ENV = "AGENT_NATIVE_COMPUTER_CAPABILITIES";
 const DEFAULT_POLL_INTERVAL_MS = 2_000;
 const MAX_POLL_INTERVAL_MS = 30_000;
 const MAX_TRANSCRIPT_EVENTS_PER_BATCH = 50;
@@ -144,6 +159,7 @@ class RemoteCodeAgentConnector {
   private readonly transcriptCursors = new Map<string, TranscriptCursor>();
   private readonly remoteRunIds = new Set<string>();
   private stopped = false;
+  private readonly computerBridge = loadLocalComputerBridgeConfig();
 
   constructor(
     private readonly config: RemoteCodeAgentDeviceConfig,
@@ -188,6 +204,13 @@ class RemoteCodeAgentConnector {
       }
     } finally {
       options.signal?.removeEventListener("abort", onAbort);
+      if (this.computerBridge) {
+        await callLocalComputerBridgeTool(
+          this.computerBridge,
+          "computer_revoke_control",
+          { reason: "connector-stopped" },
+        ).catch(() => undefined);
+      }
     }
   }
 
@@ -206,6 +229,7 @@ class RemoteCodeAgentConnector {
           "status",
           "run-events",
         ],
+        computerCapabilities: this.computerBridge?.capabilities ?? {},
         activeRunIds: Array.from(this.remoteRunIds),
       },
     );
@@ -234,6 +258,8 @@ class RemoteCodeAgentConnector {
         return this.deny(command);
       case "stop":
         return this.stop(command);
+      case "computer-operation":
+        return this.computerOperation(command);
       case "status":
         return this.status(command);
       default:
@@ -244,6 +270,13 @@ class RemoteCodeAgentConnector {
     }
   }
 
+  private async computerOperation(command: RemoteCommand) {
+    return dispatchComputerOperationToLocalBridge(
+      this.computerBridge,
+      command.params.envelope,
+    );
+  }
+
   private createRun(command: RemoteCommand) {
     const prompt = firstTextValue(
       command.params.prompt,
@@ -398,11 +431,42 @@ class RemoteCodeAgentConnector {
     return { ok: true, runId, run: result ?? getCodeAgentRunRecord(runId) };
   }
 
-  private stop(command: RemoteCommand) {
+  private async stop(command: RemoteCommand) {
     const runId = firstStringValue(command.params.runId);
-    if (!runId) return { ok: false, error: "Missing runId." };
+    const taskId = firstStringValue(command.params.taskId);
+    let revokeError: string | undefined;
+    if (this.computerBridge) {
+      try {
+        await callLocalComputerBridgeTool(
+          this.computerBridge,
+          "computer_revoke_control",
+          { taskId, runId, reason: "remote-stop" },
+        );
+      } catch (error) {
+        revokeError = error instanceof Error ? error.message : String(error);
+      }
+    } else if (taskId || command.params.computer === true) {
+      revokeError = "Local authenticated computer bridge is unavailable.";
+    }
+    if (!runId) {
+      return taskId
+        ? {
+            ok: !revokeError,
+            taskId,
+            revoked: !revokeError,
+            error: revokeError,
+          }
+        : { ok: false, error: "Missing runId." };
+    }
     const run = getCodeAgentRunRecord(runId);
-    if (!run) return { ok: false, error: `Run not found: ${runId}` };
+    if (!run) {
+      return {
+        ok: !revokeError && Boolean(this.computerBridge),
+        runId,
+        revoked: !revokeError && Boolean(this.computerBridge),
+        error: revokeError ?? `Run not found: ${runId}`,
+      };
+    }
     const active = activeRunners.get(runId);
     const pid = active?.child.pid ?? Number(run.metadata?.runnerPid);
     let killed = false;
@@ -447,7 +511,14 @@ class RemoteCodeAgentConnector {
         stopError: killError,
       },
     });
-    return { ok: !killError, runId, run: updated, killed, error: killError };
+    return {
+      ok: !killError && !revokeError,
+      runId,
+      run: updated,
+      killed,
+      controlRevoked: !revokeError && Boolean(this.computerBridge),
+      error: revokeError ?? killError,
+    };
   }
 
   private status(command: RemoteCommand) {
@@ -562,14 +633,27 @@ class RemoteCodeAgentConnector {
     command: RemoteCommand,
     result: Record<string, unknown>,
   ) {
+    let safeResult: Record<string, unknown>;
+    try {
+      safeResult = boundedConnectorResult(result);
+    } catch (error) {
+      safeResult = {
+        ok: false,
+        error:
+          error instanceof Error
+            ? `Connector result rejected: ${error.message}`
+            : "Connector result rejected as unsafe.",
+      };
+    }
     await this.postJson("/_agent-native/integrations/remote/result", {
       deviceId: this.config.deviceId,
       commandId: command.id,
       kind: command.kind,
-      ok: result.ok !== false,
-      status: result.ok === false ? "failed" : "completed",
-      result,
-      errorMessage: typeof result.error === "string" ? result.error : undefined,
+      ok: safeResult.ok !== false,
+      status: safeResult.ok === false ? "failed" : "completed",
+      result: safeResult,
+      errorMessage:
+        typeof safeResult.error === "string" ? safeResult.error : undefined,
     });
   }
 
@@ -796,6 +880,177 @@ function normalizeRelayUrl(value: string | undefined): string | null {
   }
 }
 
+export function loadLocalComputerBridgeConfig(
+  env: NodeJS.ProcessEnv = process.env,
+): LocalComputerBridgeConfig | null {
+  const rawUrl = firstStringValue(env[COMPUTER_BRIDGE_URL_ENV]);
+  const token = firstStringValue(env[COMPUTER_BRIDGE_TOKEN_ENV]);
+  const rawCapabilities = firstStringValue(env[COMPUTER_CAPABILITIES_ENV]);
+  if (!rawUrl || !token || !rawCapabilities) return null;
+  let url: URL;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    return null;
+  }
+  const host = url.hostname.toLowerCase();
+  if (
+    (url.protocol !== "http:" && url.protocol !== "https:") ||
+    (host !== "localhost" && host !== "127.0.0.1" && host !== "[::1]")
+  ) {
+    return null;
+  }
+  try {
+    const value = JSON.parse(rawCapabilities) as unknown;
+    const capabilities = normalizeComputerCapabilities(value);
+    if (!hasComputerCapability(capabilities)) return null;
+    return { url: url.toString(), token, capabilities };
+  } catch {
+    return null;
+  }
+}
+
+export async function callLocalComputerBridgeTool(
+  config: LocalComputerBridgeConfig,
+  toolName: "computer_operation" | "computer_revoke_control",
+  args: Record<string, unknown>,
+  fetchImpl: typeof fetch = fetch,
+): Promise<unknown> {
+  const response = await fetchImpl(config.url, {
+    method: "POST",
+    headers: {
+      accept: "application/json, text/event-stream",
+      authorization: `Bearer ${config.token}`,
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: `computer-bridge-${Date.now()}`,
+      method: "tools/call",
+      params: { name: toolName, arguments: args },
+    }),
+    signal: AbortSignal.timeout(30_000),
+  });
+  if (!response.ok) {
+    throw new Error(`Local computer bridge returned ${response.status}`);
+  }
+  const text = await response.text();
+  const payload = parseMcpResponse(text);
+  if (!isObject(payload)) {
+    throw new Error("Local computer bridge returned an invalid response");
+  }
+  if (payload.error) {
+    const error = isObject(payload.error) ? payload.error : {};
+    throw new Error(
+      firstStringValue(error.message) ?? "Local computer bridge rejected call",
+    );
+  }
+  return boundedJsonValue(payload.result, "Local computer bridge result");
+}
+
+export async function dispatchComputerOperationToLocalBridge(
+  config: LocalComputerBridgeConfig | null,
+  rawEnvelope: unknown,
+  fetchImpl: typeof fetch = fetch,
+): Promise<Record<string, unknown>> {
+  if (!config) {
+    throw new Error("Local authenticated computer bridge is unavailable.");
+  }
+  const envelope = await assertValidComputerCommandEnvelope(rawEnvelope);
+  const result = await callLocalComputerBridgeTool(
+    config,
+    "computer_operation",
+    { envelope },
+    fetchImpl,
+  );
+  return boundedConnectorResult({
+    ok: true,
+    taskId: envelope.taskId,
+    runId: envelope.runId,
+    sequence: envelope.sequence,
+    idempotencyKey: envelope.idempotencyKey,
+    actionHash: envelope.approval.actionHash,
+    operationClass: envelope.operationClass,
+    bridgeResult: result,
+  });
+}
+
+function normalizeComputerCapabilities(
+  value: unknown,
+): RemoteComputerCapabilities {
+  if (!isObject(value)) return {};
+  const browser = isObject(value.browser) ? value.browser : null;
+  const desktop = isObject(value.desktop) ? value.desktop : null;
+  return {
+    ...(browser
+      ? {
+          browser: {
+            observe: browser.observe === true,
+            control: browser.control === true,
+            provider: firstStringValue(browser.provider) ?? null,
+            version: firstStringValue(browser.version) ?? null,
+          },
+        }
+      : {}),
+    ...(desktop
+      ? {
+          desktop: {
+            observe: desktop.observe === true,
+            control: desktop.control === true,
+            accessibility: desktop.accessibility === true,
+            screenCapture: desktop.screenCapture === true,
+            provider: firstStringValue(desktop.provider) ?? null,
+            version: firstStringValue(desktop.version) ?? null,
+          },
+        }
+      : {}),
+  };
+}
+
+function hasComputerCapability(
+  capabilities: RemoteComputerCapabilities,
+): boolean {
+  return Boolean(
+    capabilities.browser?.observe ||
+    capabilities.browser?.control ||
+    capabilities.desktop?.observe ||
+    capabilities.desktop?.control,
+  );
+}
+
+function parseMcpResponse(text: string): unknown {
+  const trimmed = text.trim();
+  if (!trimmed) throw new Error("Local computer bridge returned no response");
+  if (!trimmed.startsWith("data:")) return JSON.parse(trimmed);
+  const data = trimmed
+    .split(/\r?\n/)
+    .filter((line) => line.startsWith("data:"))
+    .map((line) => line.slice(5).trim())
+    .filter((line) => line && line !== "[DONE]")
+    .at(-1);
+  if (!data) throw new Error("Local computer bridge returned no MCP result");
+  return JSON.parse(data);
+}
+
+function boundedJsonValue(value: unknown, label: string): unknown {
+  return JSON.parse(
+    serializeBoundedRemoteJson(value ?? null, {
+      label,
+      maxBytes: 128_000,
+    }),
+  );
+}
+
+function boundedConnectorResult(
+  value: Record<string, unknown>,
+): Record<string, unknown> {
+  const parsed = boundedJsonValue(value, "Remote connector result");
+  if (!isObject(parsed)) {
+    throw new Error("Remote connector result must be an object");
+  }
+  return parsed;
+}
+
 function firstStringValue(...values: unknown[]): string | undefined {
   for (const value of values) {
     if (typeof value !== "string") continue;

package/corpus/core/src/cli/code-agent-executor.ts

@@ -44,6 +44,7 @@ import {
   buildMergedConfig,
   McpClientManager,
   mcpToolsToActionEntries,
+  type McpToolInvocationPolicy,
 } from "../mcp-client/index.js";
 import {
   readAgentsBundleFromFs,
@@ -256,7 +257,12 @@ export async function executeCodeAgentRun(
   );
   const mcpManager = await startCodeAgentMcpManager(existing.id);
   if (mcpManager) {
-    Object.assign(actions, mcpToolsToActionEntries(mcpManager));
+    Object.assign(
+      actions,
+      mcpToolsToActionEntries(mcpManager, {
+        invocationPolicy: codeAgentMcpInvocationPolicy(permissionMode),
+      }),
+    );
   }
   actions[TOOL_SEARCH_ACTION_NAME] = createToolSearchEntry(() => actions);
   const tools = actionsToEngineTools(actions);
@@ -534,6 +540,14 @@ export async function executeCodeAgentRun(
   }
 }
 
+export function codeAgentMcpInvocationPolicy(
+  permissionMode: CodeAgentPermissionMode,
+): McpToolInvocationPolicy {
+  return {
+    mode: permissionMode === "read-only" ? "read-only" : "allow-all",
+  };
+}
+
 async function executeCodexCliRun(options: {
   run: CodeAgentRunRecord;
   prompt: string;