@agentconnect.md/daemon 1.0.0-rc.296 → 1.0.0-rc.298

package/dist/{run-foreground-DasVEmdw.js → run-foreground-qa22G1Nt.js}

@@ -3,11 +3,13 @@ import { n as require_ms, t as require_src$3 } from "./src-DDtlVutj.js";
 import { n as init_esm_shims, t as __dirname } from "./esm-shims-DxGcm4Hw.js";
 import { t as DAEMON_VERSION } from "./version-DGaRXjBK.js";
 import { C as _coercedNumber, T as NEVER, a as array, d as literal, f as looseObject, i as any, m as object, o as boolean, p as number$1, t as ZodNumber, v as string, x as url$4 } from "./schemas-CQkO9hC5.js";
-import { C as ZodIssueCode, S as RESERVED_MCP_SERVER_NAME, _ as buildEnvelope, a as agentChildEnv, b as MAX_FRAME_BYTES, c as persistRelays, d as normalizeGitUrl, f as RELAY_DAEMON_SUBPROTOCOL, g as SHARED_CONFIG_ACTION_ID, h as decodeRelayDaemonFrame, i as selectAgent, m as buildRelayDaemonFrame, n as findAgentFiles, o as loadConfig, p as RELAY_DAEMON_WS_PATH, r as loadAgents, s as persistDaemonId, v as decodeEnvelope, y as encode } from "./load-agents-8AzZXdVx.js";
+import { a as RELAY_DAEMON_WS_PATH, c as SHARED_CONFIG_ACTION_ID, d as encode, f as MAX_FRAME_BYTES, g as ZodIssueCode, h as RESERVED_MCP_SERVER_NAME, i as RELAY_DAEMON_SUBPROTOCOL, l as buildEnvelope, n as gitRepoLabel, o as buildRelayDaemonFrame, r as normalizeGitUrl, s as decodeRelayDaemonFrame, u as decodeEnvelope } from "./dist-Cq1Kimg_.js";
+import { a as agentChildEnv, c as persistRelays, i as selectAgent, n as findAgentFiles, o as loadConfig, r as loadAgents, s as persistDaemonId } from "./load-agents-gTqVkOwl.js";
 import { l as resolveRoot, o as mcpSocketPath, u as statePath } from "./paths-DEcUO8lC.js";
-import { S as resolveRuntimes, _ as writeMemoryFile, a as initGitInjection, b as cachedRuntimeNames, c as simpleGit, d as memoryProviderFor, f as MemoryConflictError, g as resolveInMemoryDir, h as listMemory, i as prepareWorkspace, l as createMemoryProvider, m as MemoryTooLargeError, n as installedRuntimes, o as probeGitVersion, p as MemoryPathError, r as prefetchWorkspace, s as sessionGitEnv, t as AcpHost, u as memoryKindOf, v as MEMORY_TOOL_NAMES, x as cachedRuntimeVersions, y as toolsForIntegrations } from "./acp-host-03mQVw2Q.js";
-import { i as GitCredentialCache, n as gitcredSocketPath, r as writeGitcredShim, t as GitCredServer } from "./gitcred-server-Dhp-tyEI.js";
+import { S as resolveRuntimes, _ as writeMemoryFile, a as initGitInjection, b as cachedRuntimeNames, c as simpleGit, d as memoryProviderFor, f as MemoryConflictError, g as resolveInMemoryDir, h as listMemory, i as prepareWorkspace, l as createMemoryProvider, m as MemoryTooLargeError, n as installedRuntimes, o as probeGitVersion, p as MemoryPathError, r as prefetchWorkspace, s as sessionGitEnv, t as AcpHost, u as memoryKindOf, v as MEMORY_TOOL_NAMES, x as cachedRuntimeVersions, y as toolsForIntegrations } from "./acp-host-DezWSmEG.js";
+import { i as GitCredentialCache, n as gitcredSocketPath, r as writeGitcredShim, t as GitCredServer } from "./gitcred-server-KXxLyYxc.js";
 import { B as ToolListChangedNotificationSchema, D as ListPromptsResultSchema, E as ListChangedOptionsBaseSchema, F as PromptListChangedNotificationSchema, G as isZ4Schema, H as isJSONRPCRequest, I as ReadResourceResultSchema, J as encodeFrame, K as safeParse, L as ResourceListChangedNotificationSchema, M as ListToolsResultSchema, O as ListResourceTemplatesResultSchema, P as McpError, R as SUPPORTED_PROTOCOL_VERSIONS, S as InitializeResultSchema, T as LATEST_PROTOCOL_VERSION, U as isJSONRPCResultResponse, V as isInitializedNotification, W as getObjectShape, _ as ElicitResultSchema, a as AjvJsonSchemaValidator, b as GetPromptResultSchema, c as mergeCapabilities, d as CompleteResultSchema, f as CreateMessageRequestSchema, g as ElicitRequestSchema, h as CreateTaskResultSchema, i as assertToolsCallTaskCapability, k as ListResourcesResultSchema, m as CreateMessageResultWithToolsSchema, n as serializeMessage, o as require_fast_deep_equal, p as CreateMessageResultSchema, q as decodeFrames, r as assertClientRequestTaskCapability, s as Protocol, t as ReadBuffer, u as CallToolResultSchema, v as EmptyResultSchema, w as JSONRPCMessageSchema, y as ErrorCode } from "./stdio-DnS8WcXi.js";
+import { createRequire } from "node:module";
 import { URL as URL$1 } from "url";
 import * as tls from "tls";
 import * as net$5 from "net";
@@ -7583,6 +7585,119 @@ var McpControlServer = class {
 	}
 };
 //#endregion
+//#region src/cp/gh-shim.ts
+/**
+* run/bin/gh — the gh wrapper shim (agent-multi-repo-authorization.md decision
+* 4, issue #457).
+*
+* `gh` has no credential-helper hook: it reads a STATIC `GH_TOKEN` fixed at
+* process spawn, which is why P2.5's injected token went stale after ≤1h and
+* could only ever name the workspace repo. The daemon prepends `run/bin` to
+* the agent runtime's PATH so every `gh …` the agent runs lands here first;
+* the wrapper resolves the TARGET repo (GH_REPO → -R/--repo → cwd origin),
+* pulls that repo's fresh token through gitcred.sock (`agentconnect gh-token`,
+* same socket + cache as the git credential helper) and exec's the real gh
+* with GH_TOKEN set. Per-invocation fresh + per-repo correct.
+*
+* Precedence: a USER-supplied GH_TOKEN must win (the `daemon.ts` env-injection
+* contract) — the daemon exports the spawn token under both GH_TOKEN and the
+* AC_GH_TOKEN_INJECTED sentinel, so `GH_TOKEN != sentinel` means the user set
+* their own and the wrapper defers entirely. When the daemon can't serve a
+* token (repo unauthorized, CP down) the wrapper prints the daemon's
+* actionable reason on stderr and falls back to the spawn-time env token.
+*
+* The script is SECRET-FREE (paths + agent id only) and regenerated every
+* daemon boot, like `git-credential-helper.sh`. Tokens transit a shell
+* variable and the exec'd process env — never argv, never disk.
+*/
+function ghShimDir(root) {
+	return join(root, "run", "bin");
+}
+/** (Re)write `run/bin/gh` and return the bin dir to prepend to agent PATHs. */
+function writeGhShim(root, cliEntry) {
+	const dir = ghShimDir(root);
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	try {
+		chmodSync(dir, 448);
+	} catch {}
+	const q = (v) => `'${v.replaceAll("'", "'\\''")}'`;
+	const argv = [q(process.execPath)];
+	if (cliEntry.endsWith(".ts")) {
+		const req = createRequire(import.meta.url);
+		argv.push(q(req.resolve("tsx/cli")));
+	}
+	argv.push(q(cliEntry));
+	const cli = argv.join(" ");
+	const body = `#!/bin/sh
+# agentconnect gh wrapper — regenerated on daemon start; NO secrets.
+# Per-repo, per-invocation GH_TOKEN via the daemon socket (issue #457).
+
+SELF_DIR=${q(dir)}
+
+# The real gh: first one on PATH outside our own bin dir.
+REAL_GH=""
+_OLDIFS=$IFS; IFS=:
+for _d in $PATH; do
+  [ "$_d" = "$SELF_DIR" ] && continue
+  if [ -x "$_d/gh" ]; then REAL_GH="$_d/gh"; break; fi
+done
+IFS=$_OLDIFS
+if [ -z "$REAL_GH" ]; then
+  echo "agentconnect: gh is not installed on this machine" >&2
+  exit 127
+fi
+
+# A user-configured GH_TOKEN wins: the daemon-injected one always equals the
+# AC_GH_TOKEN_INJECTED sentinel, so any difference means "the user set it".
+if [ -n "$GH_TOKEN" ] && [ "$GH_TOKEN" != "$AC_GH_TOKEN_INJECTED" ]; then
+  exec "$REAL_GH" "$@"
+fi
+if [ -z "$AC_AGENT_ID" ]; then
+  exec "$REAL_GH" "$@"
+fi
+
+# Target repo: -R/--repo argv (all spellings, last wins — matches gh's pflag),
+# then GH_REPO env (gh gives the flag precedence over the env), then the cwd
+# origin remote. Scans a COPY of the args (for-loop doesn't consume "$@").
+_REPO=""
+_prev=""
+for _a in "$@"; do
+  case "$_prev" in
+    -R|--repo) _REPO="$_a" ;;
+  esac
+  case "$_a" in
+    --repo=*) _REPO="\${_a#--repo=}" ;;
+    -R=*) _REPO="\${_a#-R=}" ;;
+    -R?*) _REPO="\${_a#-R}" ;;
+  esac
+  _prev="$_a"
+done
+if [ -z "$_REPO" ]; then _REPO="$GH_REPO"; fi
+if [ -z "$_REPO" ]; then
+  _REPO=$(git remote get-url origin 2>/dev/null || true)
+fi
+
+# Fresh token from the daemon (stdout = token only; stderr passes through so
+# the agent can read WHY a repo was refused). Exit 2 = "not ours" (non-github
+# host) — run the real gh untouched.
+_TOKEN=$(AGENTCONNECT_ROOT=${q(root)} ${cli} gh-token "$AC_AGENT_ID" "$_REPO")
+_RC=$?
+if [ "$_RC" -eq 2 ]; then
+  exec "$REAL_GH" "$@"
+fi
+if [ -n "$_TOKEN" ]; then
+  GH_TOKEN="$_TOKEN" exec "$REAL_GH" "$@"
+fi
+# Daemon couldn't serve one — fall back to the spawn-time env token (if any).
+exec "$REAL_GH" "$@"
+`;
+	writeFileSync(join(dir, "gh"), body, { mode: 493 });
+	return dir;
+}
+//#endregion
 //#region src/mcp/inject.ts
 /**
 * Build the `mcpServers` entry that makes the agent harness spawn our stdio
@@ -214910,6 +215025,9 @@ var Daemon = class Daemon {
 	});
 	gitCreds;
 	gitCredServer;
+	/** run/bin with the gh wrapper (multi-repo #457) — prepended to github-app
+	*  agents' PATH at host spawn; unset ⇒ shim write failed, spawn without it. */
+	ghBinDir;
 	agents = /* @__PURE__ */ new Map();
 	fileAgents = /* @__PURE__ */ new Map();
 	hosts = /* @__PURE__ */ new Map();
@@ -214998,9 +215116,21 @@ var Daemon = class Daemon {
 				await this.gitCreds.get(agentId, reason);
 			}
 		});
+		try {
+			this.ghBinDir = writeGhShim(root, process.argv[1] ?? "");
+		} catch (err) {
+			this.log.warn(`gitcred: gh wrapper shim write failed — spawning agents without it (${formatErr(err)})`);
+		}
 		this.gitCredServer = new GitCredServer(this.gitCreds, gitcredSocketPath(root), {
-			info: (m) => this.log.info(m),
-			warn: (m) => this.log.warn(m)
+			log: {
+				info: (m) => this.log.info(m),
+				warn: (m) => this.log.warn(m)
+			},
+			workspaceRepoOf: (agentId) => {
+				const ws = this.agents.get(agentId)?.workspace;
+				if (ws?.mode !== "git-repo" || !ws.gitRepo) return void 0;
+				return gitRepoLabel(ws.gitRepo) ?? void 0;
+			}
 		});
 		this.gitCredServer.start();
 		probeGitVersion((m) => this.log.warn(m));
@@ -215731,17 +215861,26 @@ var Daemon = class Daemon {
 		else {
 			const runtime = this.runtimes[agent.runtime];
 			if (!runtime) throw new Error(`runtime "${agent.runtime}" not available: not installed on this host, or absent from config.runtimes / the ACP registry`);
+			const githubApp = agent.workspace.mode === "git-repo" && agent.workspace.gitCredential === "github-app";
+			const env = {
+				...ghToken ? {
+					GH_TOKEN: ghToken,
+					AC_GH_TOKEN_INJECTED: ghToken
+				} : {},
+				...agentChildEnv(agent),
+				...cpRuntimeEnv(agent),
+				...memoryProviderFor(agent, runtime).runtimeEnv(),
+				...githubApp ? sessionGitEnv(agent.id) : {}
+			};
+			if (githubApp && this.ghBinDir) {
+				env.AC_AGENT_ID = agent.id;
+				env.PATH = `${this.ghBinDir}:${env.PATH ?? process.env.PATH ?? ""}`;
+			}
 			host = new AcpHost(runtime, {
 				onUpdate,
 				onPermission: (sid, params) => this.onAcpPermission(agentId, sid, params),
 				onElicit: (sid, params) => this.onAcpElicit(agentId, sid, params),
-				env: {
-					...ghToken ? { GH_TOKEN: ghToken } : {},
-					...agentChildEnv(agent),
-					...cpRuntimeEnv(agent),
-					...memoryProviderFor(agent, runtime).runtimeEnv(),
-					...agent.workspace.mode === "git-repo" && agent.workspace.gitCredential === "github-app" ? sessionGitEnv(agent.id) : {}
-				},
+				env,
 				configPrefs: {
 					model: agent.runtimeOverrides?.model,
 					permissionMode: agent.permissionMode,
@@ -217379,7 +217518,10 @@ var Daemon = class Daemon {
 				index: 0,
 				replyText: ""
 			} } : {},
-			...githubReply ? { github: this.makeGithubReply(agentId, githubReply, sessionId) } : {}
+			...githubReply ? { github: {
+				...this.makeGithubReply(agentId, githubReply, sessionId),
+				deferredFinalTranscript: false
+			} } : {}
 		};
 		this.pending.set(sessionId, p);
 		if (callMeta) this.activeTurnCallMeta.set(key, callMeta);
@@ -217460,7 +217602,16 @@ var Daemon = class Daemon {
 			this.releaseElicits(sessionId);
 			if (callMeta) this.activeTurnCallMeta.delete(key);
 			this.clearCancelBackstop(sessionId);
-			if (p.github) await p.github.stream.finish(p.github.collector.finalText(finalPhase === "end")).catch((err) => this.log.warn(`github poster: final flush failed (${formatErr(err)})`));
+			const githubFinal = p.github && finalPhase === "end" ? p.github.collector.finalText(true) : void 0;
+			if (p.github?.deferredFinalTranscript && githubFinal?.trim()) this.store.appendTranscript({
+				channel: p.channel,
+				thread: p.statusThread,
+				ts: monotonicTs(),
+				sender: p.agentId,
+				kind: "text",
+				text: githubFinal
+			});
+			if (p.github) await p.github.stream.finish(githubFinal).catch((err) => this.log.warn(`github poster: final flush failed (${formatErr(err)})`));
 			this.pending.delete(sessionId);
 			this.store.setSessionState(key, "idle", this.clock.now());
 			this.emitSessionMetadataSnapshot({
@@ -218116,15 +218267,16 @@ var Daemon = class Daemon {
 				text: slackTitle
 			});
 		}
+		const isHeadlessGithubFinal = p.github !== void 0 && p.platform === "hook" && update?.sessionUpdate === "agent_message_chunk" && update?._meta?.codex?.phase === "final_answer";
+		if (p.github) {
+			p.github.collector.onUpdate(update);
+			if (isHeadlessGithubFinal) p.github.deferredFinalTranscript = true;
+		}
 		if (p.webchat) this.emitWebchatUpdate(p, update);
-		else {
+		else if (!isHeadlessGithubFinal) {
 			for (const action of p.conv.onUpdate(update)) this.enqueueApply(p, action);
 			this.armIdle(p);
 		}
-		if (p.github) {
-			const finalAnswer = p.github.collector.onUpdate(update);
-			if (finalAnswer) p.github.stream.replace(finalAnswer);
-		}
 		for (const ev of p.rec.onUpdate(update)) this.recordEvent(p.agentId, p.channel, p.statusThread, ev);
 	}
 	/**
@@ -219117,4 +219269,4 @@ async function runForeground(opts, deps = {}) {
 //#endregion
 export { ClientTransport as i, CP_SUBPROTOCOL as n, CP_WS_PATH as r, runForeground as t };
 
-//# sourceMappingURL=run-foreground-DasVEmdw.js.map
+//# sourceMappingURL=run-foreground-qa22G1Nt.js.map