@agentproto/runtime 2.1.0 → 2.3.0

package/README.md

@@ -42,6 +42,7 @@ A per-boot bearer token is generated automatically and written into `<workspace>
 | MCP               | `POST /mcp` (Streamable HTTP)            | Stateless mode; per-request transport                  |
 | Conversations     | `GET /conversations` / `GET /conversations/<id>` | Markdown bodies                                |
 | Adapter discovery | `GET /adapters` / `POST /adapters/:slug/install` | When `listAgentAdapters` / `installAgentAdapter` is wired |
+| App scope mounts   | `POST /apps/:appId/apply` / `DELETE /apps/:appId/apply` / `GET /scopes/:scopeId/apps` | Mirrors MCP `app_apply` / `app_unapply` / `app_list_applied`; needs `appRegistry` |
 | Sessions list     | `GET /sessions` / `GET /sessions/:id` / `GET /sessions/summaries` | id-or-name in `:id`; summaries are lightweight + paginated |
 | Agent spawn       | `POST /sessions/agent`                   | Long-lived ACP agent (needs `resolveAgentAdapter`)    |
 | Interrupt turn    | `POST /sessions/:id/interrupt`           | Cancel the in-flight turn; session stays alive        |

package/dist/index.d.ts

@@ -3753,8 +3753,14 @@ interface AuthOptions {
  */
 
 interface SessionObserver {
-    /** Record the outgoing message that opens a new turn. */
-    recordPrompt(sessionId: string, message: unknown): void;
+    /** Record the outgoing message that opens a new turn. `opts.source`, when
+     *  set, is the prompt's provenance — `agent:<sessionId>` for a prompt
+     *  injected by another session (`agent_prompt` from a supervisor), absent
+     *  for a human operator — so a transcript view can attribute the turn to
+     *  its real author instead of "you". */
+    recordPrompt(sessionId: string, message: unknown, opts?: {
+        source?: string;
+    }): void;
     /** Record one structured stream event (text-delta, tool-call, usage_update, …). */
     recordEvent(sessionId: string, evt: AgentStreamEvent): void;
     /** Record the durable turn-boundary / exit usage snapshot. */
@@ -3995,6 +4001,16 @@ interface AgentStreamEvent {
      *  but no `cost`). */
     tokensIn?: number;
     tokensOut?: number;
+    /** "permission-resolved" outcome for the "agent-prompt" it answers (same
+     *  `toolCallId`) — mirrors `session:permission-resolved`'s `decision` so
+     *  the durable transcript can tell an answered ask from a still-pending
+     *  one. Not an ACP `StreamEvent` kind (synthesized by the registry, same
+     *  as "notice"/"turn-end" synthetics) — see registerPendingPermission's
+     *  docblock for the "agent-prompt" ask this resolves. */
+    decision?: "approve" | "deny" | "cancelled";
+    /** "permission-resolved" chosen option id, when the driver's offered
+     *  options included one (e.g. ACP's `allow_always`). */
+    optionId?: string;
 }
 /**
  * Env vars the registry injects into every process it spawns on a session's
@@ -4019,6 +4035,14 @@ interface AgentStreamEvent {
  * assign-last rule is what makes that true by construction rather than by
  * accident, and is what guarantees a child spawned from inside a session
  * gets its OWN id rather than inheriting its parent's.
+ *
+ * `PARENT_SESSION_ID_ENV` is the third var, injected by `session-spawn.ts`
+ * only (agent spawns, and only when the spawn resolved a parent): the
+ * recorded `parentSessionId` lineage, so a child agent can know WHO spawned
+ * it without a registry round-trip — the discovery half of the child→parent
+ * report-back channel (`message_parent` is the delivery half). Same
+ * assign-last/no-forgery rule as the other two: it mirrors the descriptor's
+ * own `parentSessionId` field, never anything caller- or env-inherited.
  */
 declare const SESSION_ID_ENV = "AGENTPROTO_SESSION_ID";
 declare const WORKSPACE_SLUG_ENV = "AGENTPROTO_WORKSPACE_SLUG";
@@ -4943,6 +4967,7 @@ interface SessionsRegistry {
      *  the previous mid-turn rejection byte-for-byte. */
     sendPrompt(id: string, message: unknown, opts?: {
         interrupt?: boolean;
+        source?: string;
     }): Promise<void>;
     /** Fire-and-forget variant of `sendPrompt` for the TURN ITSELF only.
      *  Admission (resume attempt + the missing/wrong-kind/dead/busy
@@ -4962,8 +4987,12 @@ interface SessionsRegistry {
      *  prompt is admitted + fired on the SAME live session. Ignored
      *  (identical to the default) when the session is idle. Omitted or
      *  `false` reproduces today's mid-turn rejection byte-for-byte. */
+    /** `opts.source` on either prompt verb is the turn's provenance
+     *  (`agent:<sessionId>` when another session injected it — see
+     *  `SessionObserver.recordPrompt`); recording-only, never behavioral. */
     enqueuePrompt(id: string, message: unknown, opts?: {
         interrupt?: boolean;
+        source?: string;
     }): Promise<void>;
     /** Eagerly resume ONE dead-but-resumable agent-cli session IN PLACE,
      *  WITHOUT a prompt — the boot-time counterpart to the lazy resume that