@agentage/extension 0.2.0 → 0.2.1

package/dist/ui/ui-app.js

@@ -1,23 +1,36 @@
 import cors from 'cors';
 import express, {} from 'express';
 import { createPartApp, PUBLIC_CORS } from '../server/app.js';
-// Widgets reach their own /mcp and /api only; the dev issuer of `up` is the one other origin.
-const CSP = {
+const LOOPBACK = new Set(['localhost', '127.0.0.1']);
+// AGENTAGE_DEV_ISSUER, when set, must be a loopback http origin: anything else stops the start.
+export const devIssuerOrigin = (value) => {
+    if (!value)
+        return undefined;
+    const url = URL.canParse(value) ? new URL(value) : undefined;
+    if (url?.protocol !== 'http:' || !LOOPBACK.has(url.hostname))
+        throw new Error(`AGENTAGE_DEV_ISSUER ${value} is not a loopback http origin`);
+    return url.origin;
+};
+// Widgets reach their own /mcp and /api only; under `up` also the dev issuer.
+const cspFor = (devIssuer) => ({
     directives: {
         defaultSrc: ["'self'"],
         scriptSrc: ["'self'"],
         styleSrc: ["'self'", "'unsafe-inline'"],
-        connectSrc: ["'self'", 'http://localhost:4281', 'http://127.0.0.1:4281'],
+        connectSrc: devIssuer ? ["'self'", devIssuer] : ["'self'"],
         imgSrc: ["'self'", 'data:'],
         upgradeInsecureRequests: null,
     },
-};
+});
 const IMMUTABLE = 'public, max-age=31536000, immutable';
 // /ui/{version}/: static widget modules, anonymous, cached forever (a version never changes).
 export const createUiApp = (options) => createPartApp({
     ...options,
     part: 'ui',
-    helmet: { contentSecurityPolicy: CSP, crossOriginResourcePolicy: { policy: 'cross-origin' } },
+    helmet: {
+        contentSecurityPolicy: cspFor(devIssuerOrigin(options.devIssuer)),
+        crossOriginResourcePolicy: { policy: 'cross-origin' },
+    },
     mount: (app) => void app.use(`/ui/${options.pkg.version}`, cors(PUBLIC_CORS), express.static(options.dir, {
         index: false,
         fallthrough: true,

package/dist/worker/runs.js

@@ -21,6 +21,15 @@ const fromRow = (row) => ({
     log: row.log,
     ...(row.timeout_ms === null ? {} : { timeoutMs: row.timeout_ms }),
 });
+const LAST = 'select * from agentage_job_runs where job = $1 order by id desc limit 1';
+const valuesOf = (run) => [
+    run.job,
+    run.startedAt,
+    run.endedAt,
+    run.status,
+    run.log,
+    run.timeoutMs ?? null,
+];
 // Runs live in the extension's own store, in a table the kit owns; the last 50 per job are kept.
 export const storeRuns = (store) => {
     let table;
@@ -28,21 +37,12 @@ export const storeRuns = (store) => {
     return {
         save: async (run) => {
             await ready();
-            const values = [
-                run.job,
-                run.startedAt,
-                run.endedAt,
-                run.status,
-                run.log,
-                run.timeoutMs ?? null,
-            ];
-            await store.query(INSERT, values);
+            await store.query(INSERT, valuesOf(run));
             await store.query(PRUNE, [run.job]);
         },
         last: async (job) => {
             await ready();
-            const sql = 'select * from agentage_job_runs where job = $1 order by id desc limit 1';
-            const { rows } = await store.query(sql, [job]);
+            const { rows } = await store.query(LAST, [job]);
             return rows[0] ? fromRow(rows[0]) : undefined;
         },
     };

package/dist/worker/scheduler.js

@@ -20,6 +20,7 @@ const fire = async (s, entry) => {
     arm(s, entry);
     if (!entry.running)
         return execute(s, entry);
+    entry.overran = true;
     s.deps.log.warn('job skipped: its previous run is still running', { job: entry.name });
     return undefined;
 };
@@ -27,7 +28,8 @@ const newEntry = (name, cron, job, options, at) => {
     JobNameSchema.parse(name);
     const parsed = parseCron(cron);
     const timeout = JobOptionsSchema.parse(options)?.timeout;
-    const entry = { name, cron: parsed, job, nextAt: nextRun(parsed, at), running: false };
+    const nextAt = nextRun(parsed, at);
+    const entry = { name, cron: parsed, job, nextAt, running: false, overran: false };
     if (timeout !== undefined)
         entry.timeoutMs = toMs(timeout);
     return entry;
@@ -44,9 +46,9 @@ const runJob = async (entry, log, buffer) => {
 };
 // Never twice at once; every run saved with its log, a failed save is logged and the job goes on.
 const execute = async (s, entry) => {
-    entry.running = true;
-    const buffer = { text: '', truncated: false };
     const startedAt = s.now();
+    Object.assign(entry, { running: true, runningSince: startedAt, overran: false });
+    const buffer = { text: '', truncated: false };
     const status = await runJob(entry, s.deps.log, buffer);
     entry.running = false;
     entry.last = status;
@@ -56,10 +58,17 @@ const execute = async (s, entry) => {
     await s.deps.runs.save(run).catch((err) => s.deps.log.error(err, { job: entry.name }));
     return run;
 };
-// ok: the last run ok and the timer on time; a failed or late job is degraded, never a restart.
+// A run still going past its declared timeout, or one that made the job skip a tick.
+const overrunning = (s, entry) => {
+    if (!entry.running)
+        return false;
+    const ranMs = s.now().getTime() - (entry.runningSince?.getTime() ?? 0);
+    return entry.overran || (entry.timeoutMs !== undefined && ranMs > entry.timeoutMs);
+};
+// ok: the last run ok, the timer on time, no run overrunning; else degraded, never a restart.
 const check = (s, entry) => async () => {
     const late = s.now().getTime() - entry.nextAt.getTime() > LATE_MS;
-    return entry.last === 'failed' || late ? 'degraded' : 'ok';
+    return entry.last === 'failed' || late || overrunning(s, entry) ? 'degraded' : 'ok';
 };
 const scheduleOn = (s) => (name, cron, job, options) => {
     const entry = newEntry(name, cron, job, options, s.now());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentage/extension",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "The agentage extension kit: create(ctx) per part (pages, ui, api, mcp, worker, cli), the store, /health, discovery, the envelope, and the build tool with up and token",
   "type": "module",
   "license": "MIT",