@agenthippo-ai/agenthippo 1.110.11 → 1.110.19

package/out/permissions.js

@@ -1,108 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_PERMISSIONS = void 0;
-exports.getDefaultPermissions = getDefaultPermissions;
-exports._resetMappingConfigCache = _resetMappingConfigCache;
-exports.parsePermissions = parsePermissions;
-exports.parseManifestPermissions = parseManifestPermissions;
-exports.enforcePermissions = enforcePermissions;
-exports.toClaudeOptions = toClaudeOptions;
-exports.toCodexOptions = toCodexOptions;
-/**
- * Default runtime permissions.
- */
-exports.DEFAULT_PERMISSIONS = {
-    fileAccess: 'full',
-};
-const PERMISSION_MAPPING_CONFIG = {
-    defaults: { fileAccess: 'full' },
-    claude: {
-        readOnly: { permissionMode: 'plan', allowDangerouslySkipPermissions: false },
-        workspaceWrite: { permissionMode: 'acceptEdits', allowDangerouslySkipPermissions: false },
-        fullAccess: { permissionMode: 'bypassPermissions', allowDangerouslySkipPermissions: true },
-    },
-    codex: {
-        approvalPolicy: 'never',
-        readOnly: { sandboxMode: 'read-only' },
-        workspaceWrite: { sandboxMode: 'workspace-write' },
-        fullAccess: { sandboxMode: 'danger-full-access' },
-    },
-};
-/**
- * Get default permissions from static mapping config.
- */
-function getDefaultPermissions() {
-    return { ...PERMISSION_MAPPING_CONFIG.defaults };
-}
-/**
- * No-op compatibility hook retained for existing tests/callers.
- * @internal
- */
-function _resetMappingConfigCache() {
-    // no-op: config is now static and in-code
-}
-// =============================================================================
-// Parse from Manifest
-// =============================================================================
-/**
- * Parse permissions from an agent manifest.
- * Falls back to defaults for missing fields.
- */
-function parsePermissions(manifest) {
-    const perms = manifest?.spec?.permissions;
-    const defaults = getDefaultPermissions();
-    return {
-        fileAccess: perms?.fileAccess ?? defaults.fileAccess,
-    };
-}
-/**
- * Parse effective permissions from manifest.
- */
-function parseManifestPermissions(manifest) {
-    return parsePermissions(manifest);
-}
-// =============================================================================
-// Enforcement
-// =============================================================================
-/**
- * Resolve effective permissions with user settings taking precedence.
- */
-function enforcePermissions(_manifestPerms, userPerms) {
-    return {
-        fileAccess: userPerms.fileAccess,
-    };
-}
-/**
- * Map unified permissions to Claude SDK options.
- */
-function toClaudeOptions(perms, workspaceFolders) {
-    const modeOpts = perms.fileAccess === 'read-only'
-        ? PERMISSION_MAPPING_CONFIG.claude.readOnly
-        : (perms.fileAccess === 'workspace-write'
-            ? PERMISSION_MAPPING_CONFIG.claude.workspaceWrite
-            : PERMISSION_MAPPING_CONFIG.claude.fullAccess);
-    return {
-        ...modeOpts,
-        // Writable/read-only workspace modes: constrain to workspace folders
-        // Full mode: undefined lets Claude use its defaults
-        additionalDirectories: perms.fileAccess === 'full' ? undefined : workspaceFolders,
-    };
-}
-/**
- * Map unified permissions to Codex SDK options.
- */
-function toCodexOptions(perms, workspaceFolders) {
-    const fileOpts = perms.fileAccess === 'read-only'
-        ? PERMISSION_MAPPING_CONFIG.codex.readOnly
-        : (perms.fileAccess === 'workspace-write'
-            ? PERMISSION_MAPPING_CONFIG.codex.workspaceWrite
-            : PERMISSION_MAPPING_CONFIG.codex.fullAccess);
-    return {
-        approvalPolicy: PERMISSION_MAPPING_CONFIG.codex.approvalPolicy,
-        ...fileOpts,
-        additionalDirectories: workspaceFolders,
-    };
-}

package/out/permissions.mapping.yaml

@@ -1,68 +0,0 @@
-# AgentIDE Permission Mapping
-# Security-auditable mapping from unified permissions to engine SDK options
-#
-# RULE: Most restrictive wins - manifest cannot be bypassed by user settings
-#
-# See PLAN/perm-design.md for full documentation.
-
-version: "1.0"
-
-# Default permissions for agents without explicit permissions
-defaults:
-  fileAccess: workspace-write   # read-only | workspace-write | full
-
-# Claude Agent SDK mapping
-#
-# NOTE: Claude does NOT have a sandboxMode equivalent for fileAccess.
-# File access is controlled via `additionalDirectories` which lists allowed paths.
-# The toClaudeOptions() function handles this by passing workspace folders directly.
-#
-# SECURITY: Claude's `additionalDirectories` is more of a suggestion than a hard
-# sandbox - Claude can still potentially access files outside if it tries.
-# This is an SDK limitation, not something we can fix in the mapping.
-#
-# permissionMode options used by V1:
-#   - 'plan': strict read-only (no tool execution)
-#   - 'acceptEdits': non-interactive auto-accept file edits (workspace-write)
-#   - 'bypassPermissions': non-interactive full access mode
-claude:
-  # fileAccess: read-only
-  readOnly:
-    permissionMode: plan
-    allowDangerouslySkipPermissions: false
-
-  # fileAccess: workspace-write
-  workspaceWrite:
-    permissionMode: acceptEdits
-    allowDangerouslySkipPermissions: false
-
-  # fileAccess: full
-  fullAccess:
-    permissionMode: bypassPermissions
-    allowDangerouslySkipPermissions: true
-
-# Codex SDK mapping
-#
-# NOTE: Codex has explicit sandboxMode for fileAccess control.
-# Approval is non-interactive in V1.
-# - workspace-write: Can only write to workspace folders
-# - danger-full-access: Full filesystem access (requires explicit opt-in)
-#
-# SECURITY: Unlike Claude, Codex's `sandboxMode` is a HARD enforcement at the
-# SDK level. The sandbox cannot be bypassed by the agent.
-codex:
-  approvalPolicy: never
-
-  # fileAccess: read-only
-  readOnly:
-    sandboxMode: read-only
-
-  # fileAccess: workspace-write - Only workspace folders + additionalDirectories
-  # (additionalDirectories always includes all multi-root workspace folders)
-  workspaceWrite:
-    sandboxMode: workspace-write
-
-  # fileAccess: full - Full filesystem access
-  fullAccess:
-    sandboxMode: danger-full-access
-

package/out/registry/index.js

@@ -1,332 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-/*---------------------------------------------------------------------------------------------
- *  Local Registry - JSON file-based registry for pack/skill/MCP discovery.
- *
- *  Design:
- *  - Uses simple JSON files for storage
- *  - Stores data in ~/.agentide/registry/
- *  - Provides search and lookup APIs
- *  - Easy to test with Mocha (no native dependencies)
- *--------------------------------------------------------------------------------------------*/
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LocalRegistry = void 0;
-exports.getRegistry = getRegistry;
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-const os = __importStar(require("os"));
-function createEmptyData() {
-    return { packs: {}, skills: {}, mcp: {} };
-}
-// -----------------------------------------------------------------------------
-// Registry Class
-// -----------------------------------------------------------------------------
-class LocalRegistry {
-    data = null;
-    registryPath;
-    constructor(registryPath, _outputChannel) {
-        this.registryPath = registryPath || path.join(os.homedir(), '.agentide', 'registry.json');
-    }
-    // -------------------------------------------------------------------------
-    // Data Management
-    // -------------------------------------------------------------------------
-    ensureDir() {
-        const dir = path.dirname(this.registryPath);
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true });
-        }
-    }
-    load() {
-        if (this.data) {
-            return this.data;
-        }
-        if (fs.existsSync(this.registryPath)) {
-            try {
-                const raw = fs.readFileSync(this.registryPath, 'utf-8');
-                this.data = JSON.parse(raw);
-            }
-            catch {
-                this.data = createEmptyData();
-            }
-        }
-        else {
-            this.data = createEmptyData();
-        }
-        return this.data;
-    }
-    save() {
-        if (!this.data) {
-            return;
-        }
-        this.ensureDir();
-        fs.writeFileSync(this.registryPath, JSON.stringify(this.data, null, 2));
-    }
-    // -------------------------------------------------------------------------
-    // Pack Operations
-    // -------------------------------------------------------------------------
-    async registerPack(input) {
-        const data = this.load();
-        data.packs[input.slug] = {
-            slug: input.slug,
-            displayName: input.displayName,
-            description: input.description,
-            githubOwner: input.github?.owner,
-            githubRepo: input.github?.repo,
-            latestVersion: input.latestVersion,
-            tags: input.tags,
-            installs: input.stats.installs,
-            stars: input.stats.stars,
-            updatedAt: Date.now(),
-        };
-        this.save();
-    }
-    async getPack(slug) {
-        const data = this.load();
-        return data.packs[slug] || null;
-    }
-    async listPacks() {
-        const data = this.load();
-        return Object.values(data.packs).sort((a, b) => b.installs - a.installs);
-    }
-    async trackPackInstall(slug) {
-        const data = this.load();
-        const pack = data.packs[slug];
-        if (pack) {
-            pack.installs += 1;
-            pack.updatedAt = Date.now();
-            this.save();
-        }
-    }
-    // -------------------------------------------------------------------------
-    // Skill Operations
-    // -------------------------------------------------------------------------
-    async registerSkill(input) {
-        const data = this.load();
-        const existing = data.skills[input.slug];
-        // Merge installedTo: keep existing agent packs and add new one if provided
-        let installedTo = existing?.installedTo || [];
-        if (input.agentPackId && !installedTo.includes(input.agentPackId)) {
-            installedTo = [...installedTo, input.agentPackId];
-        }
-        data.skills[input.slug] = {
-            slug: input.slug,
-            displayName: input.displayName,
-            description: input.description,
-            githubOwner: input.github?.owner,
-            githubRepo: input.github?.repo,
-            githubPath: input.github?.path,
-            latestVersion: input.latestVersion,
-            tags: input.tags,
-            installs: input.stats.installs,
-            updatedAt: Date.now(),
-            installedTo,
-        };
-        this.save();
-    }
-    async getSkill(slug) {
-        const data = this.load();
-        return data.skills[slug] || null;
-    }
-    async listSkills() {
-        const data = this.load();
-        return Object.values(data.skills).sort((a, b) => b.installs - a.installs);
-    }
-    // -------------------------------------------------------------------------
-    // MCP Operations
-    // -------------------------------------------------------------------------
-    async registerMcp(input) {
-        const data = this.load();
-        const existing = data.mcp[input.slug];
-        // Merge installedTo: keep existing agent packs and add new one if provided
-        let installedTo = existing?.installedTo || [];
-        if (input.agentPackId && !installedTo.includes(input.agentPackId)) {
-            installedTo = [...installedTo, input.agentPackId];
-        }
-        data.mcp[input.slug] = {
-            slug: input.slug,
-            displayName: input.displayName,
-            description: input.description,
-            transport: input.transport,
-            githubOwner: input.github?.owner,
-            githubRepo: input.github?.repo,
-            npmPackage: input.npmPackage,
-            latestVersion: input.latestVersion,
-            tags: input.tags,
-            installs: input.stats.installs,
-            updatedAt: Date.now(),
-            installedTo,
-        };
-        this.save();
-    }
-    async getMcp(slug) {
-        const data = this.load();
-        return data.mcp[slug] || null;
-    }
-    async listMcp() {
-        const data = this.load();
-        return Object.values(data.mcp).sort((a, b) => b.installs - a.installs);
-    }
-    /**
-     * Check if a skill is installed to a specific agent pack.
-     */
-    async isSkillInstalledTo(slug, agentPackId) {
-        const skill = await this.getSkill(slug);
-        return skill?.installedTo?.includes(agentPackId) ?? false;
-    }
-    /**
-     * Check if an MCP is installed to a specific agent pack.
-     */
-    async isMcpInstalledTo(slug, agentPackId) {
-        const mcp = await this.getMcp(slug);
-        return mcp?.installedTo?.includes(agentPackId) ?? false;
-    }
-    /**
-     * Remove an agent pack from a skill's installedTo list.
-     * Used when uninstalling a skill from an agent pack.
-     */
-    async unregisterSkillFromPack(slug, agentPackId) {
-        const data = this.load();
-        const skill = data.skills[slug];
-        if (skill && skill.installedTo) {
-            skill.installedTo = skill.installedTo.filter(id => id !== agentPackId);
-            skill.updatedAt = Date.now();
-            this.save();
-        }
-    }
-    /**
-     * Remove an agent pack from an MCP's installedTo list.
-     * Used when uninstalling an MCP from an agent pack.
-     */
-    async unregisterMcpFromPack(slug, agentPackId) {
-        const data = this.load();
-        const mcp = data.mcp[slug];
-        if (mcp && mcp.installedTo) {
-            mcp.installedTo = mcp.installedTo.filter(id => id !== agentPackId);
-            mcp.updatedAt = Date.now();
-            this.save();
-        }
-    }
-    // -------------------------------------------------------------------------
-    // Search
-    // -------------------------------------------------------------------------
-    async search(query, options) {
-        const types = options?.types || ['pack', 'skill', 'mcp'];
-        const limit = options?.limit || 20;
-        const results = [];
-        const queryLower = query.toLowerCase();
-        const queryTerms = queryLower.split(/\s+/).filter(t => t.length > 0);
-        // Score function - returns 0 if no term matches
-        const score = (item, installs) => {
-            const text = `${item.slug} ${item.displayName} ${item.description || ''} ${item.tags.join(' ')}`.toLowerCase();
-            let termScore = 0;
-            for (const term of queryTerms) {
-                if (text.includes(term)) {
-                    termScore += 10;
-                }
-            }
-            // Only add popularity boost if there's a term match
-            if (termScore === 0) {
-                return 0;
-            }
-            return termScore + installs / 100;
-        };
-        // Search packs
-        if (types.includes('pack')) {
-            const packs = await this.listPacks();
-            for (const pack of packs) {
-                const s = score(pack, pack.installs);
-                if (s > 0) {
-                    results.push({
-                        type: 'pack',
-                        slug: pack.slug,
-                        displayName: pack.displayName,
-                        description: pack.description,
-                        score: s,
-                        data: pack,
-                    });
-                }
-            }
-        }
-        // Search skills
-        if (types.includes('skill')) {
-            const skills = await this.listSkills();
-            for (const skill of skills) {
-                const s = score(skill, skill.installs);
-                if (s > 0) {
-                    results.push({
-                        type: 'skill',
-                        slug: skill.slug,
-                        displayName: skill.displayName,
-                        description: skill.description,
-                        score: s,
-                        data: skill,
-                    });
-                }
-            }
-        }
-        // Search MCP
-        if (types.includes('mcp')) {
-            const mcps = await this.listMcp();
-            for (const mcp of mcps) {
-                const s = score(mcp, mcp.installs);
-                if (s > 0) {
-                    results.push({
-                        type: 'mcp',
-                        slug: mcp.slug,
-                        displayName: mcp.displayName,
-                        description: mcp.description,
-                        score: s,
-                        data: mcp,
-                    });
-                }
-            }
-        }
-        return results.sort((a, b) => b.score - a.score).slice(0, limit);
-    }
-}
-exports.LocalRegistry = LocalRegistry;
-// -----------------------------------------------------------------------------
-// Singleton Instance
-// -----------------------------------------------------------------------------
-let _registry = null;
-function getRegistry(outputChannel) {
-    if (!_registry) {
-        _registry = new LocalRegistry(undefined, outputChannel);
-    }
-    return _registry;
-}

package/out/runner/host.js

@@ -1,141 +0,0 @@
-"use strict";
-/*---------------------------------------------------------------------------------------------
- *  Copyright (c) AgentHippo.ai. All rights reserved.
- *--------------------------------------------------------------------------------------------*/
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.startRunnerHost = startRunnerHost;
-const protocol_1 = require("./protocol");
-/** Engines sweep idle sessions/caches on this cadence (matches the in-process host's timer). */
-const MAINTENANCE_INTERVAL_MS = 1000 * 60 * 5;
-/**
- * The answer the runner gives to every `question`. Mirrors `cli/commands/serve.ts` and
- * `headless/index.ts`: emit for visibility, decline so the run continues. There is no reverse
- * RPC to wait on, so a question can never wedge a turn.
- */
-const DECLINED = { selected: [], freeText: null, declined: true };
-function startRunnerHost(opts) {
-    const send = (frame) => { opts.output.write((0, protocol_1.encodeRunnerFrame)(frame)); };
-    const inflight = new Map();
-    let buffer = '';
-    let closed = false;
-    const maintenance = setInterval(() => {
-        try {
-            opts.engine.onMaintenance(opts.logger ?? consoleLogger());
-        }
-        catch (err) {
-            opts.logger?.warn(`[Runner] maintenance failed: ${errText(err)}`);
-        }
-    }, opts.maintenanceIntervalMs ?? MAINTENANCE_INTERVAL_MS);
-    // Never hold the sandbox open on the timer alone.
-    if (typeof maintenance.unref === 'function') {
-        maintenance.unref();
-    }
-    let finish = () => undefined;
-    const done = new Promise((resolve) => {
-        finish = () => {
-            if (closed) {
-                return;
-            }
-            closed = true;
-            clearInterval(maintenance);
-            for (const ctrl of inflight.values()) {
-                ctrl.abort();
-            }
-            inflight.clear();
-            resolve();
-        };
-        opts.input.on('data', (chunk) => {
-            buffer += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
-            const { lines, rest } = (0, protocol_1.splitFrames)(buffer);
-            buffer = rest;
-            for (const line of lines) {
-                const frame = (0, protocol_1.parseClientFrame)(line);
-                if (!frame) {
-                    opts.logger?.warn('[Runner] dropped malformed client frame');
-                    continue;
-                }
-                void handle(frame);
-            }
-        });
-        opts.input.on('end', finish);
-        opts.input.on('close', finish);
-        opts.input.on('error', (err) => {
-            opts.logger?.warn(`[Runner] input error: ${errText(err)}`);
-            finish();
-        });
-    });
-    async function handle(frame) {
-        if (frame.type === 'abort') {
-            inflight.get(frame.id)?.abort();
-            return;
-        }
-        await run(frame.id, frame.message, frame.options);
-    }
-    async function run(id, message, options) {
-        if (inflight.has(id)) {
-            send({ type: 'failed', id, message: `duplicate run id ${id}` });
-            return;
-        }
-        const controller = new AbortController();
-        inflight.set(id, controller);
-        const emitter = makeEmitter(send, id);
-        try {
-            // `options` crossed the boundary already scrubbed of apiKey (see toWireOptions); the
-            // engine reaches models via baseUrl + modelToken, both sandbox-scoped.
-            await opts.engine.stream(message, options, emitter, opts.runtime, controller.signal);
-            const nativeSessionId = opts.nativeSessionId?.();
-            send({ type: 'result', id, ...(nativeSessionId ? { nativeSessionId } : {}) });
-        }
-        catch (err) {
-            // An aborted turn is a normal terminal, not a crash — report it as such so the caller
-            // settles instead of waiting out a timeout.
-            const message = controller.signal.aborted ? 'aborted' : errText(err);
-            send({ type: 'failed', id, message });
-        }
-        finally {
-            inflight.delete(id);
-        }
-    }
-    // The runner is live once the engine is constructed and the loop is wired. `demux: true` tells
-    // serve this host tags streamed events with their run id, so it may run several turns here at
-    // once; a serve talking to an older image never sees it and serializes instead.
-    send({ type: 'ready', demux: true });
-    return { done, close: () => finish() };
-}
-/**
- * Bridges `StreamEmitter` calls onto the wire, 1:1 with the existing worker event union.
- *
- * Every event is tagged with the run it came from. One sandbox may host several of a user's
- * sessions, and an untagged event can only be broadcast to every in-flight turn — which wrote one
- * session's tokens and tool calls into another's transcript.
- */
-function makeEmitter(send, id) {
-    const emit = (event) => send({ id, event });
-    return {
-        async thinking(delta) { emit({ type: 'thinking', delta }); },
-        async text(delta) { emit({ type: 'text', delta }); },
-        async toolStart(toolName, input, toolCallId) {
-            emit({ type: 'toolStart', toolName, ...(input !== undefined ? { input } : {}), ...(toolCallId ? { toolCallId } : {}) });
-        },
-        async toolEnd(toolName, toolCallId, result, isError) {
-            emit({ type: 'toolEnd', toolName, toolCallId, ...(result !== undefined ? { result } : {}), ...(isError !== undefined ? { isError } : {}) });
-        },
-        async progress(message) { emit({ type: 'progress', message }); },
-        async question(payload) {
-            // One-way: forwarded for visibility, answered here. No answer frame exists, but it
-            // still reaches a client stream, so it carries the run id like any other event.
-            send({ type: 'question', payload, id });
-            return DECLINED;
-        },
-        async error(message) { emit({ type: 'error', message }); },
-        async done() { emit({ type: 'done' }); },
-    };
-}
-function errText(err) {
-    return err instanceof Error ? err.message : String(err);
-}
-function consoleLogger() {
-    return {
-        info: () => undefined, warn: () => undefined, error: () => undefined, debug: () => undefined,
-    };
-}