@agentproto/driver-agent-cli 2.9.0 → 2.10.0

package/dist/{chunk-AN5G6ENG.mjs → chunk-K5PKRW2Q.mjs}

@@ -400,6 +400,7 @@ var agentCliFrontmatterSchema = z.object({
     share: z.array(z.string().regex(/^[^/]+$/)).optional(),
     seed: z.record(z.string().regex(/^[^/]+$/).refine((n) => n !== "." && n !== "..", { message: "seed names a file of the home" }), z.string()).optional()
   }).strict().optional(),
+  credentialDataHome: z.object({ env: z.string().regex(/^[A-Z][A-Z0-9_]*$/) }).strict().optional(),
   runner: z.union([z.string(), z.record(z.string(), z.unknown())]).optional(),
   protocol: z.enum(["acp", "mcp", "proprietary", "print"]),
   acp: z.string().optional(),
@@ -1808,6 +1809,49 @@ function interpolateEnv(env, value) {
   }
   return out;
 }
+function realStateHome(stateHome, env) {
+  const fromEnv = env[stateHome.env];
+  if (fromEnv && isAbsolute(fromEnv)) return fromEnv;
+  return resolve(homedir(), stateHome.defaultDir);
+}
+function prepareIsolatedStateHome(stateHome, opts) {
+  const real = realStateHome(stateHome, opts.env);
+  let dir;
+  if (opts.configDir) {
+    dir = opts.configDir;
+    mkdirSync(dir, { recursive: true });
+  } else {
+    dir = mkdtempSync(join(tmpdir(), `agentproto-${stateHome.env.toLowerCase()}-`));
+  }
+  const writePaths = [dir];
+  for (const name of stateHome.share ?? []) {
+    const target = join(real, name);
+    const link = join(dir, name);
+    try {
+      lstatSync(link);
+      unlinkSync(link);
+    } catch {
+    }
+    if (!existsSync(target)) continue;
+    symlinkSync(target, link);
+    writePaths.push(realpathSync(target));
+  }
+  for (const [name, content] of Object.entries(stateHome.seed ?? {})) {
+    const file = join(dir, name);
+    try {
+      unlinkSync(file);
+    } catch {
+    }
+    writeFileSync(file, content);
+  }
+  return { dir, writePaths };
+}
+var CREDENTIAL_DATA_SUBDIR = "auth-data";
+function isolatedCredentialDataHome(configDir) {
+  const dir = configDir ? join(configDir, CREDENTIAL_DATA_SUBDIR) : mkdtempSync(join(tmpdir(), "agentproto-data-"));
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
 function agentCliSupportsHostContextIsolation(adapterId) {
   return adapterId === "claude-code";
 }
@@ -2022,43 +2066,6 @@ async function* promptTurn(arm, turnId, message, stderrTurnError) {
     });
   }
 }
-function realStateHome(stateHome, env) {
-  const fromEnv = env[stateHome.env];
-  if (fromEnv && isAbsolute(fromEnv)) return fromEnv;
-  return resolve(homedir(), stateHome.defaultDir);
-}
-function prepareIsolatedStateHome(stateHome, opts) {
-  const real = realStateHome(stateHome, opts.env);
-  let dir;
-  if (opts.configDir) {
-    dir = opts.configDir;
-    mkdirSync(dir, { recursive: true });
-  } else {
-    dir = mkdtempSync(join(tmpdir(), `agentproto-${stateHome.env.toLowerCase()}-`));
-  }
-  const writePaths = [dir];
-  for (const name of stateHome.share ?? []) {
-    const target = join(real, name);
-    const link = join(dir, name);
-    try {
-      lstatSync(link);
-      unlinkSync(link);
-    } catch {
-    }
-    if (!existsSync(target)) continue;
-    symlinkSync(target, link);
-    writePaths.push(realpathSync(target));
-  }
-  for (const [name, content] of Object.entries(stateHome.seed ?? {})) {
-    const file = join(dir, name);
-    try {
-      unlinkSync(file);
-    } catch {
-    }
-    writeFileSync(file, content);
-  }
-  return { dir, writePaths };
-}
 function npxCacheKey(packages) {
   return createHash("sha512").update([...packages].sort((a, b) => a.localeCompare(b, "en")).join("\n")).digest("hex").slice(0, 16);
 }
@@ -2164,6 +2171,26 @@ function ensureExecDirOnPath(env, execPath = process.execPath) {
   if (parts.includes(execDir)) return;
   env.PATH = [...parts, execDir].join(delimiter);
 }
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function deepMergeJson(base, over) {
+  const out = { ...base };
+  for (const [k, v] of Object.entries(over)) {
+    const prev = out[k];
+    out[k] = isPlainObject(prev) && isPlainObject(v) ? deepMergeJson(prev, v) : v;
+  }
+  return out;
+}
+function mergeJsonEnvValue(base, over) {
+  try {
+    const a = JSON.parse(base);
+    const b = JSON.parse(over);
+    if (isPlainObject(a) && isPlainObject(b)) return JSON.stringify(deepMergeJson(a, b));
+  } catch {
+  }
+  return over;
+}
 function createAgentCliRuntime(definition) {
   return {
     definition,
@@ -2181,6 +2208,7 @@ function createAgentCliRuntime(definition) {
       };
       for (const k of composed.envUnset) delete env[k];
       const authSpec = opts?.auth;
+      let credentialDataDir;
       const hasGatewayAuthToken = "ANTHROPIC_AUTH_TOKEN" in composed.env;
       const hasGatewayBaseUrl = "ANTHROPIC_BASE_URL" in composed.env;
       const resolverCoupledGateway = authSpec?.baseUrl !== void 0;
@@ -2200,6 +2228,15 @@ function createAgentCliRuntime(definition) {
             throw new RuntimeConfigError("missing_auth_credential", "opts.auth.credential", message);
           }
           env[authSpec.setEnv] = authSpec.credential;
+          if (authSpec.extraEnv) {
+            for (const [key, value] of Object.entries(authSpec.extraEnv)) {
+              env[key] = key in composed.env ? mergeJsonEnvValue(composed.env[key], value) : value;
+            }
+          }
+          if (definition.credentialDataHome && authSpec.isolateDataHome !== false) {
+            credentialDataDir = isolatedCredentialDataHome(opts?.configDir);
+            env[definition.credentialDataHome.env] = credentialDataDir;
+          }
         }
       }
       Object.assign(env, opts?.env ?? {});
@@ -2266,6 +2303,7 @@ function createAgentCliRuntime(definition) {
         env.CLAUDE_CONFIG_DIR = claudeConfigDir;
       }
       const extraWritePaths = claudeConfigDir ? [claudeConfigDir] : [];
+      if (credentialDataDir) extraWritePaths.push(credentialDataDir);
       if (definition.stateHome && definition.protocol !== "proprietary" && await willConfineAgentCliSpawn({ mode: opts?.commandSandbox, cwd, zones: opts?.fsZones })) {
         const isolated = prepareIsolatedStateHome(definition.stateHome, {
           ...opts?.configDir ? { configDir: opts.configDir } : {},
@@ -2548,6 +2586,6 @@ function derivedModelRefusalError(definition, requested, reason) {
   );
 }
 
-export { LEGACY_GATEWAY_MODE_IDS, LEGACY_POSTURE_MODE_IDS, RuntimeConfigError, agentCliFrontmatterSchema, agentCliSupportsHostContextIsolation, applyModelCommand, autoAllowPermissionHandler, composeSpawn, createAcpProtocolArm, createAgentCliRuntime, createArmSessionControls, createJcodeMapperState, createMastraMapperState, createPrintSession, createProprietaryProtocolArm, defineAgentCli, hostContextExcludes, inferLegacyModeKind, isLegacyExtractedModeId, isModelSwitchAcknowledgement, mapJcodeEvent, mapMastraEvent, parseModelSwitchCommand, planModePermissionHandler, promptTurn, resolveContinuationStrategy, runtimeConfigSchema, toFileBasedMcpServers };
-//# sourceMappingURL=chunk-AN5G6ENG.mjs.map
-//# sourceMappingURL=chunk-AN5G6ENG.mjs.map
+export { CREDENTIAL_DATA_SUBDIR, LEGACY_GATEWAY_MODE_IDS, LEGACY_POSTURE_MODE_IDS, RuntimeConfigError, agentCliFrontmatterSchema, agentCliSupportsHostContextIsolation, applyModelCommand, autoAllowPermissionHandler, composeSpawn, createAcpProtocolArm, createAgentCliRuntime, createArmSessionControls, createJcodeMapperState, createMastraMapperState, createPrintSession, createProprietaryProtocolArm, defineAgentCli, hostContextExcludes, inferLegacyModeKind, isLegacyExtractedModeId, isModelSwitchAcknowledgement, mapJcodeEvent, mapMastraEvent, parseModelSwitchCommand, planModePermissionHandler, promptTurn, resolveContinuationStrategy, runtimeConfigSchema, toFileBasedMcpServers };
+//# sourceMappingURL=chunk-K5PKRW2Q.mjs.map
+//# sourceMappingURL=chunk-K5PKRW2Q.mjs.map