@agentconnect.md/daemon 1.0.0-rc.22 → 1.0.0-rc.23

package/dist/index.js

@@ -12,7 +12,6 @@ import { createInterface } from "node:readline";
 import { freemem, homedir, hostname, loadavg, totalmem, type } from "node:os";
 import { spawn as spawn$1 } from "child_process";
 import { Readable, Writable } from "node:stream";
-import { MAX_FRAME_BYTES, buildEnvelope, decodeEnvelope, encode, isFrame } from "@agentconnect.md/protocol";
 import { randomUUID } from "node:crypto";
 import { lstat, open, readdir, realpath, stat as stat$1 } from "node:fs/promises";
 import { DatabaseSync } from "node:sqlite";
@@ -16872,6 +16871,553 @@ async function runChat(opts) {
 //#region src/version.ts
 const DAEMON_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 //#endregion
+//#region ../protocol/dist/envelope.js
+/**
+* The protocol envelope — every frame, both directions, is wrapped in this.
+* Mirrors daemon-cp-ws-protocol.md §1.1.
+*
+* `payload` is left as `unknown` here and validated by the per-type schema in
+* `frames/*` via `FRAME_SCHEMAS[type]` (see `frame.ts`). This two-step parse is
+* what lets the codec answer an unknown `type` with `UNKNOWN_FRAME` (a REP)
+* instead of a hard close — forward-compat, protocol §1.
+*/
+const Envelope = object({
+	v: literal(1),
+	id: string().uuid(),
+	ts: string().datetime(),
+	type: string(),
+	corr: string().uuid().optional(),
+	payload: unknown()
+});
+object({
+	epoch: number().int(),
+	seq: number().int().optional(),
+	agentId: string().uuid().optional(),
+	launchId: string().uuid().optional()
+});
+/** The all-zero UUID used when a frame is malformed past the point of reading `id`. */
+const NIL_UUID = "00000000-0000-0000-0000-000000000000";
+//#endregion
+//#region ../protocol/dist/frames/auth.js
+/**
+* Auth & identity — protocol §3.1 / §3.2.
+*
+* `auth` is the first frame after the socket opens. `auth/ok` carries the
+* minted `sessionEpoch` (the global fencing token), heartbeat cadence, and the
+* resume verdict.
+*/
+const AuthReq = object({
+	apiKey: string(),
+	daemonId: string().uuid().optional(),
+	machineId: string().uuid().optional(),
+	attestation: string().optional(),
+	agentVersion: string(),
+	resume: object({
+		lastEpoch: number().int(),
+		lastRecvSeq: record(string(), number())
+	}).optional()
+});
+const AuthOk = object({
+	daemonId: string().uuid(),
+	sessionEpoch: number().int(),
+	heartbeatSec: number().int(),
+	serverTime: string().datetime(),
+	resume: object({
+		accepted: boolean(),
+		redeliverFromSeq: record(string(), number()).optional()
+	}).optional()
+});
+//#endregion
+//#region ../protocol/dist/frames/route.js
+/**
+* Routing & orchestration (C→D control) — protocol §5.
+*
+* `SessionKey` is the canonical session primitive shared across route/*,
+* agent/*, and event/session. Its canonical string form is
+* `${platform}:${channel}:${thread ?? "-"}`.
+*/
+const Platform = _enum(["slack", "telegram"]);
+const SessionKey = object({
+	platform: Platform,
+	channel: string(),
+	thread: string().optional()
+});
+/** Trigger-matching rule for a binding (protocol §5.1). */
+const BindRule = object({ match: discriminatedUnion("kind", [
+	object({ kind: literal("mention") }),
+	object({ kind: literal("dm") }),
+	object({
+		kind: literal("keyword"),
+		value: string()
+	}),
+	object({ kind: literal("auto") })
+]) });
+const RouteAssign = object({
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	workspaceId: string().uuid(),
+	bindRules: array(BindRule).default([])
+});
+const RouteAssignAck = object({
+	ok: boolean(),
+	sessionKey: SessionKey,
+	reason: string().optional()
+});
+const RouteUpdate = object({
+	routingEpoch: number().int(),
+	rules: array(object({
+		match: unknown(),
+		agentId: string().uuid()
+	}))
+});
+/** Graceful scale-down / rebalance — protocol §5.3. */
+const Drain = object({
+	scope: union([
+		object({
+			kind: literal("agent"),
+			agentId: string().uuid()
+		}),
+		object({ kind: literal("daemon") }),
+		object({
+			kind: literal("session"),
+			sessionKey: SessionKey
+		})
+	]),
+	deadline: string().datetime()
+});
+const DrainProgress = object({
+	remaining: number().int(),
+	drained: array(SessionKey)
+});
+const DrainDone = object({ released: array(SessionKey) });
+//#endregion
+//#region ../protocol/dist/frames/cron.js
+/**
+* Cron sinks to the daemon (D5) — protocol §5.4.
+*
+* The CP owns the definition; the daemon owns firing + last-run persistence so
+* crons fire even when the CP is down.
+*/
+const CronUpsert = object({
+	cronId: string().uuid(),
+	schedule: string(),
+	target: object({ channel: string() }),
+	trigger: string(),
+	enabled: boolean().default(true)
+});
+const CronRemove = object({ cronId: string().uuid() });
+//#endregion
+//#region ../protocol/dist/frames/secrets.js
+/**
+* Secrets (C5 ↔ D10) — protocol §6.
+*
+* Lease-based, no plaintext on the wire or in PG. Every frame carries a
+* REFERENCE to a Vault/KMS path, never the secret material itself.
+*/
+const SecretsRequest = object({ scope: object({
+	platform: Platform,
+	workspaceId: string().uuid()
+}) });
+const SecretsGrant = object({
+	leaseId: string().uuid(),
+	scope: object({
+		platform: string(),
+		workspaceId: string().uuid()
+	}),
+	ref: string(),
+	ttl: number().int(),
+	renewBeforeSec: number().int()
+});
+const SecretsRenew = object({ leaseId: string().uuid() });
+const SecretsRevoke = object({
+	leaseId: string().uuid(),
+	reason: string()
+});
+/** 🅼 Direct-to-store upload/download grant — protocol §3.2 / frame #25. */
+const ScopeAttestation = object({
+	machineId: string().uuid(),
+	scope: _enum([
+		"attachment.put",
+		"attachment.get",
+		"facts.put"
+	]),
+	resourceRef: string(),
+	jws: string(),
+	exp: string().datetime()
+});
+//#endregion
+//#region ../protocol/dist/frames/agent.js
+/**
+* Agent lifecycle + delivery (protocol §4.3, §4.4, §7.4, §8).
+*
+* Body-locality invariant (protocol §12): no frame here carries
+* `NormalizedMessage.text`. `agent/prompt` ships a `NormalizedMessageRef` — a
+* reference the daemon resolves against its local body store.
+*/
+/**
+* A REFERENCE/digest of a normalized message, NOT the body (protocol §4.3).
+* Enough for D4/D6 to fetch the local body and prompt.
+*/
+const NormalizedMessageRef = object({
+	sessionKey: SessionKey,
+	platformMsgId: string(),
+	seenUpToSeq: number().int()
+});
+/**
+* The editable agent definition the CP owns and the daemon needs to run it:
+* prompt + runtime selection. Raft ships this in the launch config and the
+* daemon synthesizes the system prompt locally; `description` IS the prompt.
+*/
+const AgentSpec = object({
+	name: string(),
+	description: string().optional(),
+	model: string().optional(),
+	reasoningEffort: string().optional(),
+	executionMode: string().optional(),
+	env: record(string(), string()).optional()
+});
+const AgentLaunch = object({
+	agentId: string().uuid(),
+	runtime: string(),
+	workspaceId: string().uuid(),
+	capabilities: array(string()),
+	spec: AgentSpec,
+	mode: _enum(["long_lived", "per_turn"]).default("long_lived")
+});
+/**
+* Live agent CRUD (C→D): the console edited an agent's spec; push it so a
+* running daemon reloads without waiting for the next launch. `agent/remove`
+* tears the agent down. Deleting an agent never relaunches it.
+*/
+const AgentUpsert = object({
+	agentId: string().uuid(),
+	spec: AgentSpec
+});
+const AgentRemove = object({ agentId: string().uuid() });
+const AgentLaunched = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	acpSessionId: string().optional(),
+	startedAt: string().datetime(),
+	runtime: string()
+});
+const AgentStop = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	reason: string()
+});
+const AgentPrompt = object({
+	sessionKey: SessionKey,
+	agentId: string().uuid(),
+	content: NormalizedMessageRef,
+	seenUpToSeq: number().int()
+});
+const AgentPromptAck = object({
+	accepted: boolean(),
+	reason: _enum([
+		"queued",
+		"held",
+		"scope_denied",
+		"no_session",
+		"stale"
+	]).optional(),
+	seq: number().int()
+});
+const AgentActivity = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	state: _enum([
+		"thinking",
+		"tool_call",
+		"awaiting_permission",
+		"idle"
+	]),
+	ts: string().datetime()
+});
+const AgentScopeDenied = object({
+	agentId: string().uuid(),
+	launchId: string().uuid(),
+	capability: string()
+});
+//#endregion
+//#region ../protocol/dist/frame.js
+/**
+* The single source of truth for the wire: `type` string → payload zod schema.
+*
+* Mirrors the frame index in daemon-cp-ws-protocol.md §10 (the 29 numbered
+* frames) plus the correlated REP types named in the "Reply" column
+* (`route/assign/ack`, `drain/done`, and the generic `ack` replies) that also
+* travel on the wire and must be decodable.
+*
+* `ws/codec.ts` validates every inbound `payload` against `FRAME_SCHEMAS[type]`;
+* an unknown `type` → `ErrorFrame{code:"UNKNOWN_FRAME"}` (a REP, not a close).
+*/
+const FRAME_SCHEMAS = {
+	auth: AuthReq,
+	"auth/ok": AuthOk,
+	register: object({
+		host: string(),
+		capabilities: object({
+			platforms: array(Platform),
+			runtimes: array(string()),
+			acp: boolean(),
+			features: array(string()).default([])
+		}),
+		maxAgents: number().int(),
+		localState: object({
+			assignments: array(string()),
+			crons: array(string()),
+			leases: array(string())
+		})
+	}),
+	"register/ok": object({
+		routingEpoch: number().int(),
+		assignments: array(RouteAssign),
+		agents: array(AgentSpec.extend({ agentId: string().uuid() })).default([]),
+		crons: array(CronUpsert),
+		leases: array(SecretsGrant),
+		drop: object({
+			assignments: array(string()),
+			crons: array(string())
+		})
+	}),
+	heartbeat: object({
+		load: object({
+			cpu: number(),
+			mem: number(),
+			agents: number().int()
+		}),
+		health: _enum(["ok", "degraded"]),
+		activeSessions: number().int(),
+		degradedScopes: array(string()).default([])
+	}),
+	"agent/launch": AgentLaunch,
+	"agent/launched": AgentLaunched,
+	"agent/stop": AgentStop,
+	"agent/upsert": AgentUpsert,
+	"agent/remove": AgentRemove,
+	"agent/prompt": AgentPrompt,
+	"agent/prompt/ack": AgentPromptAck,
+	"agent/activity": AgentActivity,
+	"agent/scope-denied": AgentScopeDenied,
+	"route/assign": RouteAssign,
+	"route/assign/ack": RouteAssignAck,
+	"route/update": RouteUpdate,
+	"daemon/drain": Drain,
+	"drain/progress": DrainProgress,
+	"drain/done": DrainDone,
+	"cron/upsert": CronUpsert,
+	"cron/remove": CronRemove,
+	"secrets/request": SecretsRequest,
+	"secrets/grant": SecretsGrant,
+	"secrets/renew": SecretsRenew,
+	"secrets/revoke": SecretsRevoke,
+	"scope-attestation": ScopeAttestation,
+	"event/session": object({
+		sessionId: string().uuid(),
+		agentId: string().uuid(),
+		launchId: string().uuid(),
+		phase: _enum([
+			"start",
+			"plan",
+			"problem",
+			"end"
+		]),
+		link: string().optional(),
+		summary: string().optional(),
+		ts: string().datetime()
+	}),
+	"facts/runtime-profile": object({
+		runtime: string(),
+		version: string(),
+		models: array(string()),
+		contextWindow: number().int().optional(),
+		acpSupport: _enum([
+			"full",
+			"partial",
+			"none"
+		]),
+		toolCalling: boolean()
+	}),
+	"config/push": object({ keys: record(string(), unknown()) }),
+	"daemon/restart": object({
+		reason: string(),
+		drainFirst: boolean().default(true)
+	}),
+	"daemon/upgrade": object({
+		targetVersion: string(),
+		drainFirst: boolean().default(true)
+	}),
+	"daemon/control/ack": object({
+		accepted: boolean(),
+		willDrainUntil: string().datetime().optional()
+	}),
+	ack: object({
+		ok: boolean(),
+		reason: string().optional()
+	}),
+	error: object({
+		code: _enum([
+			"UNKNOWN_FRAME",
+			"FRAME_TOO_LARGE",
+			"PROTOCOL_STATE",
+			"BAD_PAYLOAD",
+			"AUTH_FAILED",
+			"ATTESTATION_INVALID",
+			"STALE_EPOCH",
+			"STALE_LAUNCH",
+			"SEQ_GAP",
+			"NO_SESSION",
+			"HELD",
+			"SCOPE_DENIED",
+			"LEASE_EXPIRED",
+			"LEASE_DENIED",
+			"RATE_LIMITED",
+			"INTERNAL"
+		]),
+		message: string(),
+		retryable: boolean(),
+		details: record(string(), unknown()).optional()
+	})
+};
+Object.keys(FRAME_SCHEMAS);
+/**
+* Builds the envelope schema for one frame `type` with a `type` literal and the
+* typed payload, so the discriminated union infers `payload` precisely.
+*/
+function frame(type, payload) {
+	return object({
+		v: literal(1),
+		id: string().uuid(),
+		ts: string().datetime(),
+		type: literal(type),
+		corr: string().uuid().optional(),
+		payload
+	});
+}
+discriminatedUnion("type", [
+	frame("auth", FRAME_SCHEMAS["auth"]),
+	frame("auth/ok", FRAME_SCHEMAS["auth/ok"]),
+	frame("register", FRAME_SCHEMAS["register"]),
+	frame("register/ok", FRAME_SCHEMAS["register/ok"]),
+	frame("heartbeat", FRAME_SCHEMAS["heartbeat"]),
+	frame("agent/launch", FRAME_SCHEMAS["agent/launch"]),
+	frame("agent/launched", FRAME_SCHEMAS["agent/launched"]),
+	frame("agent/stop", FRAME_SCHEMAS["agent/stop"]),
+	frame("agent/upsert", FRAME_SCHEMAS["agent/upsert"]),
+	frame("agent/remove", FRAME_SCHEMAS["agent/remove"]),
+	frame("agent/prompt", FRAME_SCHEMAS["agent/prompt"]),
+	frame("agent/prompt/ack", FRAME_SCHEMAS["agent/prompt/ack"]),
+	frame("agent/activity", FRAME_SCHEMAS["agent/activity"]),
+	frame("agent/scope-denied", FRAME_SCHEMAS["agent/scope-denied"]),
+	frame("route/assign", FRAME_SCHEMAS["route/assign"]),
+	frame("route/assign/ack", FRAME_SCHEMAS["route/assign/ack"]),
+	frame("route/update", FRAME_SCHEMAS["route/update"]),
+	frame("daemon/drain", FRAME_SCHEMAS["daemon/drain"]),
+	frame("drain/progress", FRAME_SCHEMAS["drain/progress"]),
+	frame("drain/done", FRAME_SCHEMAS["drain/done"]),
+	frame("cron/upsert", FRAME_SCHEMAS["cron/upsert"]),
+	frame("cron/remove", FRAME_SCHEMAS["cron/remove"]),
+	frame("secrets/request", FRAME_SCHEMAS["secrets/request"]),
+	frame("secrets/grant", FRAME_SCHEMAS["secrets/grant"]),
+	frame("secrets/renew", FRAME_SCHEMAS["secrets/renew"]),
+	frame("secrets/revoke", FRAME_SCHEMAS["secrets/revoke"]),
+	frame("scope-attestation", FRAME_SCHEMAS["scope-attestation"]),
+	frame("event/session", FRAME_SCHEMAS["event/session"]),
+	frame("facts/runtime-profile", FRAME_SCHEMAS["facts/runtime-profile"]),
+	frame("config/push", FRAME_SCHEMAS["config/push"]),
+	frame("daemon/restart", FRAME_SCHEMAS["daemon/restart"]),
+	frame("daemon/upgrade", FRAME_SCHEMAS["daemon/upgrade"]),
+	frame("daemon/control/ack", FRAME_SCHEMAS["daemon/control/ack"]),
+	frame("ack", FRAME_SCHEMAS["ack"]),
+	frame("error", FRAME_SCHEMAS["error"])
+]);
+//#endregion
+//#region ../protocol/dist/codec.js
+/** Soft cap per frame — 256 KiB (protocol §1). Over this → FRAME_TOO_LARGE. */
+const MAX_FRAME_BYTES = 256 * 1024;
+const textEncoder = new TextEncoder();
+function byteLength(text) {
+	return textEncoder.encode(text).length;
+}
+function extractControlExt(json) {
+	if (typeof json !== "object" || json === null) return void 0;
+	const o = json;
+	const ext = {};
+	if (typeof o.epoch === "number") ext.epoch = o.epoch;
+	if (typeof o.seq === "number") ext.seq = o.seq;
+	if (typeof o.agentId === "string") ext.agentId = o.agentId;
+	if (typeof o.launchId === "string") ext.launchId = o.launchId;
+	return Object.keys(ext).length > 0 ? ext : void 0;
+}
+function decodeEnvelope(text) {
+	if (byteLength(text) > 262144) return {
+		ok: false,
+		id: NIL_UUID,
+		msg: "FRAME_TOO_LARGE"
+	};
+	let json;
+	try {
+		json = JSON.parse(text);
+	} catch {
+		return {
+			ok: false,
+			id: NIL_UUID,
+			msg: "invalid json"
+		};
+	}
+	const env = Envelope.safeParse(json);
+	if (!env.success) return {
+		ok: false,
+		id: typeof json === "object" && json !== null && typeof json.id === "string" ? json.id : NIL_UUID,
+		msg: env.error.message
+	};
+	const schema = FRAME_SCHEMAS[env.data.type];
+	if (!schema) return {
+		ok: false,
+		id: env.data.id,
+		msg: "UNKNOWN_FRAME"
+	};
+	const payload = schema.safeParse(env.data.payload);
+	if (!payload.success) return {
+		ok: false,
+		id: env.data.id,
+		msg: payload.error.message
+	};
+	const ext = extractControlExt(json);
+	return {
+		ok: true,
+		frame: {
+			...env.data,
+			payload: payload.data
+		},
+		...ext ? { ext } : {}
+	};
+}
+function buildEnvelope(type, payload, opts = {}) {
+	return {
+		v: 1,
+		id: opts.id ?? randomUUID(),
+		ts: opts.ts ?? (/* @__PURE__ */ new Date()).toISOString(),
+		type,
+		payload,
+		...opts.corr ? { corr: opts.corr } : {},
+		...opts.ext ?? {}
+	};
+}
+function encode(frame) {
+	return JSON.stringify(frame);
+}
+//#endregion
+//#region ../protocol/dist/index.js
+/**
+* Narrowing guard factory: `isFrame("auth")(frame)` narrows a decoded
+* `AnyFrame` to the member whose `type` matches.
+*/
+function isFrame(type) {
+	return (frame) => frame.type === type;
+}
+//#endregion
 //#region ../../node_modules/.pnpm/ws@8.21.0/node_modules/ws/lib/constants.js
 var require_constants$1 = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const BINARY_TYPES = [