@agentproto/runtime 0.7.0 → 0.8.0

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { createReadStream, existsSync, readdirSync, readFileSync, mkdirSync, writeFileSync, renameSync, promises, createWriteStream, statSync, openSync, closeSync } from 'fs';
+import { createReadStream, existsSync, promises, readdirSync, readFileSync, mkdirSync, writeFileSync, renameSync, createWriteStream, statSync, openSync, closeSync } from 'fs';
 import { homedir, tmpdir } from 'os';
 import { join, resolve, dirname, isAbsolute, normalize, relative, basename } from 'path';
 import { createInterface } from 'readline';
@@ -1809,7 +1809,7 @@ function sanitizeAcpAgents(raw, target) {
   return Object.keys(out).length > 0 ? out : void 0;
 }
 async function loadConfig(path) {
-  const target = CONFIG_FILE_PATH();
+  const target = path ?? CONFIG_FILE_PATH();
   try {
     const raw = await promises.readFile(target, "utf8");
     const parsed = JSON.parse(raw);
@@ -1900,6 +1900,7 @@ function resolveAuthSpec(input) {
   const subCredAvailable = input.subscriptionCredential !== void 0;
   const apiCredAvailable = input.apiKeyConfigCredential !== void 0 || input.apiKeyStoreCredential !== void 0;
   let mode;
+  let neitherConfigured = false;
   if (input.requestedMode) {
     if (input.requestedMode === "subscription" && !supportsSub) {
       throw new AuthResolutionError(
@@ -1909,7 +1910,11 @@ function resolveAuthSpec(input) {
     mode = input.requestedMode;
   } else {
     const preference = supportsSub ? ["subscription", "api-key"] : ["api-key"];
-    mode = preference.find((m) => m === "subscription" ? subCredAvailable : apiCredAvailable) ?? preference[0];
+    const available = preference.find(
+      (m) => m === "subscription" ? subCredAvailable : apiCredAvailable
+    );
+    mode = available ?? preference[0];
+    neitherConfigured = available === void 0;
   }
   let setEnv;
   let credential;
@@ -1945,7 +1950,8 @@ function resolveAuthSpec(input) {
     setEnv,
     unsetEnv,
     explicit: input.explicit,
-    enforce
+    enforce,
+    ...neitherConfigured ? { neitherConfigured } : {}
   };
   const echo = {
     provider,
@@ -2271,6 +2277,50 @@ function createSandboxAgentSessionProxy(opts) {
   };
 }
 
+// src/worktree-isolation.ts
+var WORKTREE_ISOLATION_ENV = "AGENTPROTO_WORKTREES_ISOLATION";
+var DEFAULT_WORKTREE_ISOLATION = "on-request";
+function normalizeWorktreeField(field) {
+  if (field === void 0 || field === false) return void 0;
+  if (field === true) return {};
+  const request = {};
+  if (field.slug !== void 0) request.slug = field.slug;
+  if (field.base !== void 0) request.base = field.base;
+  return request;
+}
+function decideWorktreeIsolation(input) {
+  const request = normalizeWorktreeField(input.field);
+  if (input.depth > 0) return { action: "spawn-in-place" };
+  switch (input.mode) {
+    case "never":
+      if (request !== void 0) {
+        return {
+          action: "reject",
+          message: `agent_start: \`worktree\` was requested but this daemon's \`worktrees.isolation\` policy is set to "never". Remove the \`worktree\` field, or change the policy (config \`worktrees.isolation\` / env ${WORKTREE_ISOLATION_ENV}).`
+        };
+      }
+      return { action: "spawn-in-place" };
+    case "on-request":
+      return request !== void 0 ? { action: "provision", request } : { action: "spawn-in-place" };
+    case "always":
+      return { action: "provision", request: request ?? {} };
+  }
+}
+function parseWorktreeIsolationMode(raw) {
+  return raw === "always" || raw === "on-request" || raw === "never" ? raw : void 0;
+}
+async function loadWorktreeIsolation(loadCfg = loadConfig) {
+  const fromEnv = parseWorktreeIsolationMode(process.env[WORKTREE_ISOLATION_ENV]);
+  if (fromEnv) return fromEnv;
+  try {
+    const cfg = await loadCfg();
+    const fromCfg = parseWorktreeIsolationMode(cfg.worktrees?.isolation);
+    if (fromCfg) return fromCfg;
+  } catch {
+  }
+  return DEFAULT_WORKTREE_ISOLATION;
+}
+
 // src/session-spawn.ts
 var SPAWN_CLAIM_WINDOW_MS = 3e4;
 var spawnClaimsByRegistry = /* @__PURE__ */ new WeakMap();
@@ -2298,7 +2348,9 @@ async function spawnAgentSession(deps2, input) {
     callerScope,
     webhookNotifier,
     loadDefaultsConfig,
-    resolveSandboxProvider: resolveSandboxProvider2
+    resolveSandboxProvider: resolveSandboxProvider2,
+    provisionWorktree,
+    resolveWorktreeIsolation
   } = deps2;
   let cwd = input.cwd;
   let resolvedSlug = input.workspaceSlug;
@@ -2366,6 +2418,28 @@ async function spawnAgentSession(deps2, input) {
       };
     }
   }
+  let worktreeRequest;
+  if (input.sandbox === void 0) {
+    const mode = resolveWorktreeIsolation ? await resolveWorktreeIsolation() : await loadWorktreeIsolation();
+    const decision = decideWorktreeIsolation({
+      mode,
+      field: input.worktree,
+      depth: childDepth
+    });
+    if (decision.action === "reject") {
+      return { ok: false, code: "worktree_disabled", message: decision.message };
+    }
+    if (decision.action === "provision") {
+      if (!provisionWorktree) {
+        return {
+          ok: false,
+          code: "worktree_provisioner_not_enabled",
+          message: `agent_start: \`worktree\` isolation is required (by request or the "${mode}" policy) but this daemon has no worktree provisioner wired (createGateway needs \`provisionWorktree\`, injected by the CLI over @agentproto/worktree).`
+        };
+      }
+      worktreeRequest = decision.request;
+    }
+  }
   const configDefaults = loadDefaultsConfig ? await loadDefaultsConfig() : (await loadConfig()).defaults;
   const roleRegistry = deps2.loadRoleRegistry ? await deps2.loadRoleRegistry() : await loadDefaultRoleRegistry();
   let role;
@@ -2476,6 +2550,12 @@ async function spawnAgentSession(deps2, input) {
       }
       throw err;
     }
+    if (authSpec && authSpec.enforce === "always" && authSpec.credential === void 0 && !spawnDefaults.auth.explicit && resolvedProvider !== void 0) {
+      const ignored = await (0, providers_store_exports.getProviderKey)(resolvedProvider);
+      if (ignored !== void 0) {
+        authSpec = { ...authSpec, ignoredApiKeyInStore: true };
+      }
+    }
   }
   const effectiveOptions = normalizeSkillsOption(
     spawnDefaults.skills,
@@ -2520,6 +2600,24 @@ ${input.prompt}` : input.prompt;
     return result;
   };
   try {
+    if (worktreeRequest && provisionWorktree) {
+      let outcome;
+      try {
+        outcome = await provisionWorktree({
+          cwd,
+          ...worktreeRequest.slug ? { slug: worktreeRequest.slug } : {},
+          ...worktreeRequest.base ? { base: worktreeRequest.base } : {},
+          ...input.label ? { labelHint: input.label } : {}
+        });
+      } catch (err) {
+        return finish({
+          ok: false,
+          code: "worktree_provision_failed",
+          message: `agent_start: worktree provisioning failed \u2014 ${err instanceof Error ? err.message : String(err)}`
+        });
+      }
+      if (outcome.isolated) cwd = outcome.cwd;
+    }
     const resolvedMcpServers = await resolveMcpCredentialHeaders(mcpServers);
     let liveSessionId;
     let agentSession;
@@ -2804,7 +2902,9 @@ function registerAgentTools(server, opts) {
     webhookNotifier,
     daemonMcpUrl,
     loadRoleRegistry: loadRoleRegistry2,
-    resolveSandboxProvider: resolveSandboxProvider2
+    resolveSandboxProvider: resolveSandboxProvider2,
+    provisionWorktree,
+    resolveWorktreeIsolation
   } = opts;
   server.tool(
     "agent_start",
@@ -2919,6 +3019,22 @@ function registerAgentTools(server, opts) {
         ])
       ).optional().describe(
         "Run this session inside a sandbox instead of on the host \u2014 pass a provider slug (see `list_sandbox_providers`) or an inline AIP-36 SandboxDefinition object. The daemon boots the sandbox, spawns `adapter` on the box's OWN agentproto daemon, and proxies the conversation back onto this session \u2014 `agent_prompt`/`agent_output`/`agent_kill` behave exactly as they do for a local spawn, and the transcript stays readable here even after the box is torn down. Omit to run locally (default). Pass an inline spec with `reuse: \"<sandboxId>\"` (from a prior session's `sandboxId`) to reconnect to an existing box instead \u2014 by default such a box is PAUSED (not killed) on session close so it stays reusable; set `lifecycle.destroy_on` to always kill it."
+      ),
+      worktree: jsonTolerant(
+        z.union([
+          mcpBool,
+          z.object({
+            slug: z.string().regex(
+              /^[a-z0-9][a-z0-9-]*$/,
+              "slug must be lowercase kebab-case (letters, digits, hyphens)"
+            ).optional().describe(
+              "Pin the worktree's slug (names its branch `wt/<slug>` and its directory). Omit to auto-mint a collision-free one from the label."
+            ),
+            base: z.string().min(1).optional().describe("Git ref the worktree branch is cut from. Default 'origin/main'.")
+          }).strict()
+        ])
+      ).optional().describe(
+        "Isolate this session in its OWN git worktree instead of spawning directly in `cwd` \u2014 so a parallel agent can't collide on the working tree. `true` provisions a worktree on a fresh branch `wt/<slug>` cut from origin/main (slug auto-minted from `label`); pass `{ slug, base }` to pin either. The daemon boots the worktree (git worktree add + the repo's agentproto.json setup hooks) and spawns `adapter` THERE; the session's cwd, and every path it edits, live inside the worktree. Honoured only for a ROOT spawn (a spawn made THROUGH an orchestrator inherits its parent's tree \u2014 no second worktree) and only when `cwd` is inside a git repo (nothing to isolate otherwise \u21D2 spawns plain, no error). The daemon's `worktrees.isolation` policy may force this ON for every root spawn (`always`) or OFF (`never`, which REJECTS an explicit `worktree`). Ignored for a `sandbox` spawn (the box already isolates). The worktree is NOT auto-removed on session close \u2014 it holds the agent's work; tear it down with `agentproto worktree rm|archive|gc`."
       )
     },
     async (input) => {
@@ -2942,7 +3058,9 @@ function registerAgentTools(server, opts) {
           callerScope,
           webhookNotifier,
           loadRoleRegistry: loadRoleRegistry2,
-          resolveSandboxProvider: resolveSandboxProvider2
+          resolveSandboxProvider: resolveSandboxProvider2,
+          ...provisionWorktree ? { provisionWorktree } : {},
+          ...resolveWorktreeIsolation ? { resolveWorktreeIsolation } : {}
         },
         input
       );
@@ -3836,6 +3954,12 @@ async function restartAgentSession(registry, resolveAgentAdapter, prev, opts = {
       authSpec = result.spec;
       authEcho = result.echo;
     }
+    if (authSpec && authSpec.enforce === "always" && authSpec.credential === void 0 && !spawnDefaults.auth.explicit && resolvedProvider !== void 0) {
+      const ignored = await (0, providers_store_exports.getProviderKey)(resolvedProvider);
+      if (ignored !== void 0) {
+        authSpec = { ...authSpec, ignoredApiKeyInStore: true };
+      }
+    }
   }
   const spawnWithResume = async (resumeSessionId) => {
     let liveSessionId;
@@ -11745,7 +11869,8 @@ async function startHttpServer(opts) {
             opts.sessionEvents,
             opts.eventRing,
             opts.buildOrchestratorMcp,
-            opts.daemonMcpUrl
+            opts.daemonMcpUrl,
+            opts.provisionWorktree
           );
           if (handled) return;
         }
@@ -12203,6 +12328,22 @@ function parseOrchestratorField(raw) {
   }
   return void 0;
 }
+function parseWorktreeField(raw) {
+  const value = typeof raw === "string" ? tryParseJson(raw) ?? raw : raw;
+  if (typeof value === "boolean") return value;
+  if (value === "true") return true;
+  if (value === "false") return false;
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    const slug = typeof obj.slug === "string" ? obj.slug : void 0;
+    const base = typeof obj.base === "string" ? obj.base : void 0;
+    return {
+      ...slug !== void 0 ? { slug } : {},
+      ...base !== void 0 ? { base } : {}
+    };
+  }
+  return void 0;
+}
 function parseMcpServersField(raw) {
   const value = typeof raw === "string" ? tryParseJson(raw) : raw;
   if (!Array.isArray(value)) return void 0;
@@ -12253,7 +12394,7 @@ async function resolveSlugFromCwd(cwd) {
     return void 0;
   }
 }
-async function handleSessions(req, res, path, registry, resolveAgentAdapter, ptyEnabled = false, resolveBrowserAdapter, listBrowserAdapters, sessionEvents, eventRing, buildOrchestratorMcp, daemonMcpUrl) {
+async function handleSessions(req, res, path, registry, resolveAgentAdapter, ptyEnabled = false, resolveBrowserAdapter, listBrowserAdapters, sessionEvents, eventRing, buildOrchestratorMcp, daemonMcpUrl, provisionWorktree) {
   const json = (status, body) => {
     res.writeHead(status, { "content-type": "application/json" });
     res.end(JSON.stringify(body));
@@ -12282,7 +12423,13 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
       return true;
     }
     const result = await spawnAgentSession(
-      { registry, resolveAgentAdapter, buildOrchestratorMcp, daemonMcpUrl },
+      {
+        registry,
+        resolveAgentAdapter,
+        buildOrchestratorMcp,
+        daemonMcpUrl,
+        ...provisionWorktree ? { provisionWorktree } : {}
+      },
       {
         adapter,
         ...typeof b.cwd === "string" && b.cwd.length > 0 ? { cwd: b.cwd } : {},
@@ -12326,6 +12473,14 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
         ...b.permissionHold !== void 0 ? (() => {
           const h = typeof b.permissionHold === "boolean" ? b.permissionHold : b.permissionHold === "true" ? true : b.permissionHold === "false" ? false : void 0;
           return h ? { permissionHold: true } : {};
+        })() : {},
+        // Worktree isolation — the HTTP twin of the MCP `agent_start` tool's
+        // `worktree` field. Same `spawnAgentSession` core resolves the
+        // `worktrees.isolation` policy, so `always` bites here too and there's
+        // no policy-bypassing spawn path.
+        ...b.worktree !== void 0 ? (() => {
+          const parsed = parseWorktreeField(b.worktree);
+          return parsed !== void 0 ? { worktree: parsed } : {};
         })() : {}
       }
     );
@@ -17876,6 +18031,29 @@ function isEnoent(err) {
 function errMsg(err) {
   return err instanceof Error ? err.message : String(err);
 }
+async function isAgentCliAuthConfigured(slug, descriptor, model) {
+  const config = await loadConfig();
+  const spawnDefaults = resolveSpawnDefaults(config.defaults, slug, {});
+  const pinnedProvider = spawnDefaults.auth.provider;
+  const resolvedProvider = pinnedProvider ?? descriptor.provider ?? (model ? getModelProvider(model) : void 0);
+  const apiKeyStoreCredential = resolvedProvider && spawnDefaults.auth.explicit && spawnDefaults.auth.apiKeyCredential === void 0 ? await (0, providers_store_exports.getProviderKey)(resolvedProvider) : void 0;
+  try {
+    const result = resolveAuthSpec({
+      descriptor,
+      ...model ? { model } : {},
+      ...pinnedProvider ? { requestedProvider: pinnedProvider } : {},
+      ...spawnDefaults.auth.requestedMode ? { requestedMode: spawnDefaults.auth.requestedMode } : {},
+      explicit: spawnDefaults.auth.explicit,
+      ...spawnDefaults.auth.subscriptionCredential !== void 0 ? { subscriptionCredential: spawnDefaults.auth.subscriptionCredential } : {},
+      ...spawnDefaults.auth.apiKeyCredential !== void 0 ? { apiKeyConfigCredential: spawnDefaults.auth.apiKeyCredential } : {},
+      ...apiKeyStoreCredential !== void 0 ? { apiKeyStoreCredential } : {}
+    });
+    return result?.spec.credential !== void 0;
+  } catch (err) {
+    if (err instanceof AuthResolutionError) return false;
+    throw err;
+  }
+}
 
 // src/index.ts
 var DEFAULT_ALWAYS_ON_TOOLS = [
@@ -18086,6 +18264,7 @@ async function createGateway(opts) {
       webhookNotifier,
       daemonMcpUrl,
       resolveSandboxProvider: resolveSandboxProviderResolved,
+      ...opts.provisionWorktree ? { provisionWorktree: opts.provisionWorktree } : {},
       ...opts.resolveAgentAdapter ? { resolveAgentAdapter: opts.resolveAgentAdapter } : {},
       ...opts.listAgentAdapters ? { listAgentAdapters: opts.listAgentAdapters } : {}
     });
@@ -18241,6 +18420,7 @@ async function createGateway(opts) {
     // `agent_start` tool gets (session-spawn.ts is the shared logic).
     buildOrchestratorMcp: orchestratorInjector,
     daemonMcpUrl,
+    ...opts.provisionWorktree ? { provisionWorktree: opts.provisionWorktree } : {},
     ...opts.listAgentAdapters ? { listAgentAdapters: opts.listAgentAdapters } : {},
     ...opts.resolveBrowserAdapter ? { resolveBrowserAdapter: opts.resolveBrowserAdapter } : {},
     ...opts.listBrowserAdapters ? { listBrowserAdapters: opts.listBrowserAdapters } : {},
@@ -18328,6 +18508,6 @@ var export_providersPath = providers_store_exports.providersPath;
 var export_removeProviderKey = providers_store_exports.removeProviderKey;
 var export_setProviderKey = providers_store_exports.setProviderKey;
 
-export { AuthResolutionError, BUCKETS_ROOT, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, LEGACY_SESSIONS_FILE, PAIRINGS_VERSION, export_PROVIDER_ENV_VARS as PROVIDER_ENV_VARS, bucketDir, bucketSessionsFile, bucketTranscriptDir, composeSessionObservers, createFileStepCache, createGateway, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createScopeTokenRegistry, createWorkspaceFs, credentialFingerprint, daemonRegistryDir, declaredPresetToProviderPreset, deriveSessionUsage, fileConversationStore, formatToolCall, formatToolResult, getMcpCredentialDeps, export_getProviderKey as getProviderKey, export_injectProviderKeysIntoEnv as injectProviderKeysIntoEnv, isSafeBucketSlug, listBuckets, listPresets, export_loadProviders as loadProviders, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeSkillsOption, parseDuration, policyWatchesSession, projectSessionUsage, export_providerEnvVar as providerEnvVar, export_providersPath as providersPath, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, registerPairingTools, export_removeProviderKey as removeProviderKey, resolveAuthSpec, resolveBucketSlug, resolveSpawnDefaults, setMcpCredentialDeps, export_setProviderKey as setProviderKey, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, writeDaemonRegistryEntry };
+export { AuthResolutionError, BUCKETS_ROOT, DEFAULT_BUCKET, DEFAULT_ORCHESTRATOR_TOOLS, DEFAULT_WORKTREE_ISOLATION, LEGACY_SESSIONS_FILE, PAIRINGS_VERSION, export_PROVIDER_ENV_VARS as PROVIDER_ENV_VARS, WORKTREE_ISOLATION_ENV, bucketDir, bucketSessionsFile, bucketTranscriptDir, composeSessionObservers, createFileStepCache, createGateway, createOrchestratorInjector, createOrchestratorMcpServerFactory, createPairingRegistry, createScopeTokenRegistry, createWorkspaceFs, credentialFingerprint, daemonRegistryDir, decideWorktreeIsolation, declaredPresetToProviderPreset, deriveSessionUsage, fileConversationStore, formatToolCall, formatToolResult, getMcpCredentialDeps, export_getProviderKey as getProviderKey, export_injectProviderKeysIntoEnv as injectProviderKeysIntoEnv, isAgentCliAuthConfigured, isSafeBucketSlug, listBuckets, listPresets, export_loadProviders as loadProviders, loadWorktreeIsolation, makeBrowserAdapterLister, migrateLegacySessionsFile, migrationMarkerPath, monitorPolicyWait, monitorSessionWait, narrowOrchestratorTools, normalizeSkillsOption, normalizeWorktreeField, parseDuration, parseWorktreeIsolationMode, policyWatchesSession, projectSessionUsage, export_providerEnvVar as providerEnvVar, export_providersPath as providersPath, readDaemonRegistry, readRegisteredSlugs, readRuntimeMeta, registerPairingTools, export_removeProviderKey as removeProviderKey, resolveAuthSpec, resolveBucketSlug, resolveSpawnDefaults, setMcpCredentialDeps, export_setProviderKey as setProviderKey, sweepStaleDaemonRegistry, sweepStaleRuntimeMetas, unlinkDaemonRegistryEntry, unlinkRuntimeMeta, writeDaemonRegistryEntry };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map