@agentproto/runtime 3.2.0 → 3.4.0

package/dist/index.d.ts

@@ -3899,8 +3899,12 @@ type WorktreeGcClass = "reclaim" | "salvage" | "hold";
  * `orphan` is set on an entry/outcome the orphan scan found — a directory
  * physically present under the repo's worktree pool with no `git worktree
  * list` entry at all (see `WorktreeGcPlanEntryView.orphan`).
+ * `prunable` is set on an entry/outcome `git worktree list --porcelain`
+ * itself already reported dead — the mirror image of `orphan`: the
+ * registration is still there, but the working directory is gone (see
+ * `WorktreeGcPlanEntryView.prunable`).
  */
-type WorktreeGcReclaimReason = "dep-bump" | "orphan";
+type WorktreeGcReclaimReason = "dep-bump" | "orphan" | "prunable";
 /**
  * One entry of the dry-run plan — a runtime-local projection of a
  * `GcPlanEntry`. `tree` / `integration` / `liveness` are flattened to their
@@ -3912,7 +3916,7 @@ interface WorktreeGcPlanEntryView {
     branch: string | null;
     head: string;
     class: WorktreeGcClass;
-    /** Set only when `class === "reclaim"` via the dep-bump exemption or the orphan scan. */
+    /** Set only when `class === "reclaim"` via the dep-bump exemption, the orphan scan, or the prunable signal. */
     reclaimReason?: WorktreeGcReclaimReason;
     /**
      * `true` only for an orphan-scan entry: a directory physically present
@@ -3923,6 +3927,13 @@ interface WorktreeGcPlanEntryView {
      * literal `"orphan"` placeholder below rather than a fabricated value.
      */
     orphan?: boolean;
+    /**
+     * `true` only for a linked worktree `git worktree list --porcelain` itself
+     * already marked `prunable`. Same reasoning as `orphan` above — no
+     * tree/integration/liveness axis was ever read for a working directory
+     * that's gone — projected as the literal `"prunable"` placeholder below.
+     */
+    prunable?: boolean;
     tree: string;
     integration: {
         state: string;
@@ -5249,6 +5260,15 @@ interface SessionDescriptor {
      *  posture or a raw `{ harnessModeId }` sourced from the harness's ACP mode
      *  registry (SPEC §3.4a). */
     posture?: Posture;
+    /**
+     * Read-surface echo of the live harness's advertised ACP session modes
+     * (`SessionModeState.availableModes`, #482) — stamped at READ TIME from the
+     * live agent session by `list()`/`get()`, never persisted. A client posture
+     * picker resolves the native (enforced, live-switchable) rows from this;
+     * absent for arms with no native mode registry (print/proprietary) and for a
+     * session whose live runtime handle is gone.
+     */
+    availableModes?: SessionMode[];
     /** Endpoint / gateway rail (SPEC §3.1 axis 4). `baseUrl` is carried only
      *  for a custom gateway the catalog can't resolve; `access` is downstream
      *  of this axis (SPEC §1c). */
@@ -6216,6 +6236,7 @@ interface SessionsRegistry {
      */
     listSummaries(opts?: {
         includeArchived?: boolean;
+        lane?: "agents" | "auto";
         limit?: number;
         offset?: number;
     }): {
@@ -7522,14 +7543,17 @@ declare function registerBuiltinRoutes(opts?: {
  * kind-organized catalogs, so NO adapters, NO profiles, NO host wiring.
  * `getModelsByProvider` is itself router-aware: OpenRouter's route table is
  * spread into `LLM_PRICING_CATALOG` upstream (`llm/catalog.ts`), so an
- * `openrouter` query returns that full, large list with bare ids; Requesty
- * and HuggingFace are NOT spread into that catalog — spreading a second
- * router's bare-id pricing there would repoint direct-vendor ids at router
- * pricing (`route-identity/index.ts`) — so `getModelsByProvider` instead
- * folds their generated route tables in directly, emitting `vendor/
- * product@route` ids. All three routers enumerate through the same path;
- * the picker paginates client-side. NEVER log the rows: OpenRouter alone is
- * thousands.
+ * `openrouter` query returns that full, large list with bare ids; Requesty,
+ * HuggingFace and OpenCode's two hosted endpoints (`opencode-go`,
+ * `opencode`) are NOT spread into that catalog — spreading a second router's
+ * bare-id pricing there would repoint direct-vendor ids at router pricing
+ * (`route-identity/index.ts`) — so `getModelsByProvider` instead folds their
+ * generated route tables in directly. The emitted id is whatever the ref
+ * formats to: `vendor/product@route` for the vendor-namespacing routers, and
+ * the bare `opencode-go/glm-5.3` form for the OpenCode endpoints, whose route
+ * IS the id's leading segment. Every provider enumerates through the same
+ * path; the picker paginates client-side. NEVER log the rows: OpenRouter
+ * alone is thousands.
  */
 
 interface CatalogProviderModelsQuery {

package/dist/index.mjs

@@ -25,7 +25,7 @@ import { inferLegacyModeKind, parseModelSwitchCommand, isModelSwitchAcknowledgem
 import { loadSandboxConfig, resolveCommandSandbox, COMMAND_SANDBOX_MODE_ENV } from '@agentproto/command-sandbox';
 import { createBrainManager, parseKnowledgeConfig } from '@agentproto/workspace-brain';
 import { defineHttpDriver } from '@agentproto/driver-http';
-import { makeSessionsPanelApp, makeAgentsOverviewApp, makeBureauSessionsApp, makeSessionStoryPanelApp, makeLiveSessionApp, makeSessionChatApp, makeWorkBoardApp, SESSION_CHAT_APP_ID, sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, liveSessionApp, sessionChatApp, workBoardApp } from '@agentproto/apps';
+import { liveSessionApp, makeLiveSessionApp, sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, workBoardApp, makeSessionsPanelApp, makeAgentsOverviewApp, makeBureauSessionsApp, makeSessionStoryPanelApp, makeSessionChatApp, makeWorkBoardApp, SESSION_CHAT_APP_ID, sessionChatApp } from '@agentproto/apps';
 import matter2 from 'gray-matter';
 import { createServer } from 'http';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
@@ -4036,7 +4036,13 @@ function resolveWorktreeIdentity(cwd) {
     dir = parent;
   }
 }
-var WIDENING_ROUTES = ["openrouter", "requesty", "huggingface"];
+var WIDENING_ROUTES = [
+  "openrouter",
+  "requesty",
+  "huggingface",
+  "opencode-go",
+  "opencode"
+];
 var VENDOR_COMPATIBILITY_ROUTES = {
   xai: ["xai", "xai-anthropic"]
 };
@@ -4375,9 +4381,12 @@ function reconcileModelRoute(input) {
 }
 function serviceableModelRoutes(model) {
   const routes = /* @__PURE__ */ new Set();
-  const provider = getModelProvider(model);
-  if (provider) routes.add(provider);
   const parsed = tryParseModelRef(normalizeRouterPrefixedId(model));
+  const selfRouted = parsed !== void 0 && parsed.route === parsed.vendor && WIDENING_ROUTES.includes(parsed.vendor) && tryResolveLlmModelRoute(`${parsed.vendor}/${parsed.product}`)?.pricing.provider === parsed.vendor;
+  if (!selfRouted) {
+    const provider = getModelProvider(model);
+    if (provider) routes.add(provider);
+  }
   if (parsed) {
     if (parsed.route !== parsed.vendor) routes.add(parsed.route);
     if (resolvePricingExact(parsed.product)?.provider === parsed.vendor) {
@@ -11091,6 +11100,14 @@ function stampInterrupted(desc) {
     delete desc.interrupted;
   }
 }
+function stampLiveModes(desc, rt) {
+  const modes = rt.agentSession?.availableModes;
+  if (modes && modes.length > 0) {
+    desc.availableModes = [...modes];
+  } else {
+    delete desc.availableModes;
+  }
+}
 function isResumable(desc) {
   return desc.kind === "agent-cli" && !!desc.adapterSlug && !!desc.adapterSessionId && !!desc.cwd && !desc.archived;
 }
@@ -11525,6 +11542,7 @@ function createSessionsRegistry(opts) {
       secondsSinceLastActivity: _secondsSinceLastActivity,
       toolCallsThisTurn: _toolCallsThisTurn,
       eventsPath: _eventsPath,
+      availableModes: _availableModes,
       ...rest
     } = s.desc;
     return rest;
@@ -13529,6 +13547,7 @@ ${message}`;
         stampInterrupted(desc);
         stampCurrentStatus(rt);
         stampWatchers(desc);
+        stampLiveModes(desc, rt);
         desc.childrenBusy = childrenBusy.get(desc.id) ?? 0;
         desc.queuedPrompts = desc.promptQueue?.length ?? 0;
         return desc;
@@ -13536,10 +13555,30 @@ ${message}`;
     },
     listSummaries(opts2) {
       const includeArchived = opts2?.includeArchived ?? false;
+      const lane = opts2?.lane;
       const limit = Math.max(1, Math.min(200, opts2?.limit ?? 50));
       const offset = Math.max(0, opts2?.offset ?? 0);
       const childrenBusy = childrenBusyCounts();
-      const all = Array.from(sessions.values()).filter((rt) => includeArchived || !rt.desc.archived).sort((a, b) => b.desc.startedAt.localeCompare(a.desc.startedAt));
+      const hasMachineLineage = (rt) => {
+        const ownMachine = (desc) => desc.origin === "cron" || desc.origin === "gate";
+        if (ownMachine(rt.desc)) return true;
+        const seen = /* @__PURE__ */ new Set([rt.desc.id]);
+        let current = rt.desc;
+        while (current.parentSessionId) {
+          const parent = sessions.get(current.parentSessionId)?.desc;
+          if (!parent || seen.has(parent.id)) return true;
+          if (parent.kind === "terminal" || parent.kind === "command") return true;
+          seen.add(parent.id);
+          current = parent;
+        }
+        return ownMachine(current);
+      };
+      const all = Array.from(sessions.values()).filter((rt) => includeArchived || !rt.desc.archived).filter((rt) => {
+        if (!lane) return true;
+        if (rt.desc.kind === "terminal" || rt.desc.kind === "command") return false;
+        const machine = hasMachineLineage(rt);
+        return lane === "auto" ? machine : !machine;
+      }).sort((a, b) => b.desc.startedAt.localeCompare(a.desc.startedAt));
       const slice = all.slice(offset, offset + limit);
       const summaries = slice.map((rt) => {
         const desc = rt.desc;
@@ -13561,6 +13600,7 @@ ${message}`;
         stampInterrupted(desc);
         stampCurrentStatus(rt);
         stampWatchers(desc);
+        stampLiveModes(desc, rt);
         desc.childrenBusy = childrenBusyCounts().get(desc.id) ?? 0;
         desc.queuedPrompts = desc.promptQueue?.length ?? 0;
       }
@@ -20343,6 +20383,18 @@ var PANEL_APP_HANDLES = [
   sessionChatApp,
   workBoardApp
 ];
+function resolveBuiltinPanelUi(appId, httpBaseUrl) {
+  if (appId === liveSessionApp.id) {
+    const app = makeLiveSessionApp({ httpBaseUrl });
+    const html = typeof app.html === "function" ? app.html({ httpBaseUrl }) : app.html;
+    return { html, tools: liveSessionApp.ui?.tools ?? [] };
+  }
+  const handle = [sessionsPanelApp, agentsOverviewApp, bureauSessionsApp, sessionStoryApp, workBoardApp].find(
+    (h) => h.id === appId
+  );
+  if (!handle?.ui) return void 0;
+  return { html: handle.ui.html, tools: handle.ui.tools ?? [] };
+}
 function builtinPanelCatalogEntries() {
   const apps = makeBuiltinPanelApps({
     listSessions: () => [],
@@ -21953,12 +22005,7 @@ function notEnabled(tool) {
     `${tool} is not enabled \u2014 the daemon was started without an adapter resolver. Re-run the daemon with the \`@agentproto/cli\` shim wired (see playground/scripts/gateway.ts).`
   );
 }
-async function performAppToolCall(appRegistry, input, deps2) {
-  const installed = appRegistry.getApp(input.appId);
-  if (!installed || !installed.ui) {
-    return errorResult2(`app_tool_call: app "${input.appId}" is not installed or has no UI.`);
-  }
-  const declaredAllowlist = installed.ui.tools ?? [];
+async function dispatchAllowlistedAppTool(declaredAllowlist, input, deps2) {
   const effectiveAllowlist = [...declaredAllowlist, ...APP_UI_DISCOVERY_TOOLS];
   if (!effectiveAllowlist.includes(input.tool)) {
     return errorResult2(
@@ -21986,6 +22033,19 @@ async function performAppToolCall(appRegistry, input, deps2) {
     return errorResult2(`app_tool_call: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
+async function performAppToolCall(appRegistry, input, deps2) {
+  const installed = appRegistry.getApp(input.appId);
+  if (!installed || !installed.ui) {
+    return errorResult2(`app_tool_call: app "${input.appId}" is not installed or has no UI.`);
+  }
+  return dispatchAllowlistedAppTool(installed.ui.tools ?? [], input, deps2);
+}
+async function performBuiltinPanelToolCall(tools, input, deps2) {
+  if (tools === void 0) {
+    return errorResult2(`app_tool_call: app "${input.appId}" is not installed or has no UI.`);
+  }
+  return dispatchAllowlistedAppTool(tools, input, deps2);
+}
 function refIdOf(ref) {
   if (typeof ref === "string") return ref;
   return ref.ref ?? ref.file ?? "inline";
@@ -22871,7 +22931,7 @@ var STANDALONE_REST_BRIDGE_SCRIPT = `<script>
             return res.json().catch(function () {
               throw new Error("tool-call failed: HTTP " + res.status);
             }).then(function (body) {
-              if (!res.ok) throw new Error((body && body.error) || ("tool-call failed: HTTP " + res.status));
+              if (!res.ok) throw new Error((body && (body.message || body.error)) || ("tool-call failed: HTTP " + res.status));
               return body;
             });
           });
@@ -26688,6 +26748,7 @@ var DEFAULT_ALLOWED_ORIGINS = [
   // matching how guilde.work is trusted. Drop it via `strictOrigins`.
   "https://cli.agentproto.sh"
 ];
+var DEFAULT_FRAME_ANCESTORS = ["vscode-webview:"];
 var PROXY_FORWARDING_HEADERS = [
   "x-forwarded-for",
   "forwarded",
@@ -28050,7 +28111,8 @@ async function startHttpServer(opts) {
               req,
               res,
               decodeURIComponent(uiMatch[1]),
-              opts.appRegistry
+              opts.appRegistry,
+              [...DEFAULT_FRAME_ANCESTORS, ...opts.frameAncestors ?? []]
             );
             return;
           }
@@ -28601,7 +28663,9 @@ function parseMcpServersField(raw) {
     servers.push({
       name: o.name,
       transport: o.transport,
-      ...typeof o.ref === "string" ? { ref: o.ref } : {}
+      ...typeof o.ref === "string" ? { ref: o.ref } : {},
+      ...isStringRecord(o.headers) ? { headers: o.headers } : {},
+      ...typeof o.credentialRef === "string" ? { credentialRef: o.credentialRef } : {}
     });
   }
   return servers;
@@ -28795,10 +28859,13 @@ async function handleSessions(req, res, path, registry, resolveAgentAdapter, pty
     const queryString = reqUrl.includes("?") ? reqUrl.slice(reqUrl.indexOf("?") + 1) : "";
     const params = new URLSearchParams(queryString);
     const includeArchived = params.get("includeArchived") === "true";
+    const laneParam = params.get("lane");
+    const lane = laneParam === "agents" || laneParam === "auto" ? laneParam : void 0;
     const limit = Number.parseInt(params.get("limit") ?? "", 10);
     const offset = Number.parseInt(params.get("offset") ?? "", 10);
     const result = registry.listSummaries({
       includeArchived,
+      lane,
       limit: Number.isNaN(limit) ? void 0 : limit,
       offset: Number.isNaN(offset) ? void 0 : offset
     });
@@ -30749,33 +30816,43 @@ async function handleProviderInbound(req, res, slug, deps2) {
   res.writeHead(200, { "content-type": "application/json" });
   res.end(JSON.stringify(result));
 }
-async function handleAppUiPage(req, res, appId, appRegistry) {
+function requestHttpBaseUrl(req) {
+  return `http://${req.headers.host ?? "127.0.0.1"}`;
+}
+async function handleAppUiPage(req, res, appId, appRegistry, frameAncestors) {
   const app = appRegistry.getApp(appId);
-  if (!app?.ui) {
+  const builtin = app?.ui ? void 0 : resolveBuiltinPanelUi(appId, requestHttpBaseUrl(req));
+  if (!app?.ui && !builtin) {
     res.writeHead(404, { "content-type": "application/json" });
     res.end(JSON.stringify({ error: `app "${appId}" is not installed or has no UI.` }));
     return;
   }
   let raw;
-  try {
-    raw = await readFile(app.ui.path, "utf8");
-  } catch (err) {
-    res.writeHead(500, { "content-type": "application/json" });
-    res.end(
-      JSON.stringify({
-        error: `could not read app "${appId}"'s ui html at "${app.ui.path}": ${err instanceof Error ? err.message : String(err)}`
-      })
-    );
-    return;
+  if (app?.ui) {
+    try {
+      raw = await readFile(app.ui.path, "utf8");
+    } catch (err) {
+      res.writeHead(500, { "content-type": "application/json" });
+      res.end(
+        JSON.stringify({
+          error: `could not read app "${appId}"'s ui html at "${app.ui.path}": ${err instanceof Error ? err.message : String(err)}`
+        })
+      );
+      return;
+    }
+  } else {
+    raw = builtin.html;
   }
   const embedRequested = new URL(req.url ?? "/", "http://localhost").searchParams.get("embed") === "1";
   const headers = {
     "content-type": "text/html; charset=utf-8",
     "cache-control": "no-store"
   };
-  if (!(embedRequested && iframeEmbedAllowed(req, app))) {
-    headers["x-frame-options"] = "DENY";
-    headers["content-security-policy"] = "frame-ancestors 'none'";
+  if (!(embedRequested && iframeEmbedAllowed(req, app ?? {}))) {
+    headers["content-security-policy"] = `frame-ancestors 'self' ${frameAncestors.join(" ")}`.trimEnd();
+    if (frameAncestors.length === 0) {
+      headers["x-frame-options"] = "SAMEORIGIN";
+    }
   }
   res.writeHead(200, headers);
   res.end(injectStandaloneAppBridge(raw));
@@ -30911,7 +30988,12 @@ async function handleAppUiToolCall(req, res, appId, appRegistry, deps2) {
     tool = inner.tool;
     args = inner.args && typeof inner.args === "object" && !Array.isArray(inner.args) ? inner.args : {};
   }
-  const result = await performAppToolCall(appRegistry, { appId, tool, args }, deps2);
+  const installed = appRegistry.getApp(appId);
+  const result = installed?.ui ? await performAppToolCall(appRegistry, { appId, tool, args }, deps2) : await performBuiltinPanelToolCall(
+    resolveBuiltinPanelUi(appId, requestHttpBaseUrl(req))?.tools,
+    { appId, tool, args },
+    deps2
+  );
   res.writeHead(200, { "content-type": "application/json" });
   res.end(JSON.stringify(result));
 }