@agentproto/runtime 5.2.1 → 5.4.0

package/dist/config.mjs

@@ -11,8 +11,8 @@ import '@agentproto/provider-presets';
 import '@agentproto/secrets/provision/recipe';
 import { z } from 'zod';
 import '@agentproto/auth';
-import 'child_process';
 import '@agentproto/command-sandbox';
+import 'child_process';
 import '@agentproto/plugin-local-browser';
 import '@modelcontextprotocol/sdk/types.js';
 import '@agentproto/provider-kit';
@@ -57,11 +57,13 @@ var __copyProps = (to, from, except, desc) => {
 var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget);
 
 // src/worktree-isolation.ts
-var WORKTREE_ISOLATION_ENV, DEFAULT_WORKTREE_ISOLATION;
+var WORKTREE_ISOLATION_ENV, WORKTREE_PROVISION_CONCURRENCY_ENV, DEFAULT_WORKTREE_PROVISION_CONCURRENCY, DEFAULT_WORKTREE_ISOLATION;
 var init_worktree_isolation = __esm({
   "src/worktree-isolation.ts"() {
     init_config();
     WORKTREE_ISOLATION_ENV = "AGENTPROTO_WORKTREES_ISOLATION";
+    WORKTREE_PROVISION_CONCURRENCY_ENV = "AGENTPROTO_WORKTREES_PROVISION_CONCURRENCY";
+    DEFAULT_WORKTREE_PROVISION_CONCURRENCY = 2;
     DEFAULT_WORKTREE_ISOLATION = "on-request";
   }
 });
@@ -319,9 +321,9 @@ async function exportClaudeCodeSession(adapterSessionId, cwd, configDir) {
   let stream;
   try {
     stream = createReadStream(filePath, { encoding: "utf8" });
-    await new Promise((resolve16, reject) => {
+    await new Promise((resolve17, reject) => {
       stream.once("error", reject);
-      stream.once("open", resolve16);
+      stream.once("open", resolve17);
     });
   } catch (err) {
     const code = err.code;
@@ -595,7 +597,7 @@ async function discoverHermesSessions(cwd, since, expectedId) {
 }
 async function defaultHermesRunner(adapterSessionId) {
   const { spawn: spawn5 } = await import('child_process');
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     const chunks = [];
     const errChunks = [];
     const proc = spawn5(
@@ -614,7 +616,7 @@ async function defaultHermesRunner(adapterSessionId) {
           )
         );
       } else {
-        resolve16(Buffer.concat(chunks).toString("utf8"));
+        resolve17(Buffer.concat(chunks).toString("utf8"));
       }
     });
   });
@@ -651,9 +653,9 @@ async function exportDaemonEventsSession(sessionId, desc) {
   let stream;
   try {
     stream = createReadStream(filePath, { encoding: "utf8" });
-    await new Promise((resolve16, reject) => {
+    await new Promise((resolve17, reject) => {
       stream.once("error", reject);
-      stream.once("open", resolve16);
+      stream.once("open", resolve17);
     });
   } catch (err) {
     const code = err.code;
@@ -1924,6 +1926,10 @@ var init_pr_provenance_stamp = __esm({
     init_pr_provenance();
   }
 });
+var init_app_boundary = __esm({
+  "src/app-boundary.ts"() {
+  }
+});
 var init_command_allowlist = __esm({
   "src/command-allowlist.ts"() {
   }
@@ -1932,10 +1938,16 @@ var init_command_tools = __esm({
   "src/command-tools.ts"() {
     init_sessions();
     init_pr_provenance_stamp();
+    init_app_boundary();
     init_command_allowlist();
     init_command_allowlist();
   }
 });
+var init_process_stats = __esm({
+  "src/process-stats.ts"() {
+    z.preprocess((v) => v === "true" ? true : v === "false" ? false : v, z.union([z.boolean(), z.literal("full")])).optional();
+  }
+});
 var init_workspaces_config = __esm({
   "src/workspaces-config.ts"() {
   }
@@ -1958,7 +1970,7 @@ var init_bundles = __esm({
       id: bundleIdSchema,
       label: z.string().min(1),
       description: z.string().min(1).optional(),
-      mcpImports: z.array(z.string().min(1)),
+      mcpImports: z.union([z.array(z.string().min(1)), z.literal("*")]),
       includeDaemon: z.boolean().optional(),
       skills: z.array(z.string().min(1))
     });
@@ -1987,6 +1999,12 @@ var init_launch_config = __esm({
   }
 });
 
+// src/adapter-slug-hint.ts
+var init_adapter_slug_hint = __esm({
+  "src/adapter-slug-hint.ts"() {
+  }
+});
+
 // src/context-continuity.ts
 var init_context_continuity = __esm({
   "src/context-continuity.ts"() {
@@ -2209,6 +2227,7 @@ var init_sandbox_adapters = __esm({
 });
 var init_session_spawn = __esm({
   "src/session-spawn.ts"() {
+    init_process_stats();
     init_sessions();
     init_transcript_writer();
     init_workspaces_config();
@@ -2221,6 +2240,7 @@ var init_session_spawn = __esm({
     init_claude_code_oauth_source();
     init_providers_store();
     init_catalog_models();
+    init_adapter_slug_hint();
     init_context_continuity();
     init_canonical_posture();
     init_user_presets();
@@ -2232,6 +2252,7 @@ var init_session_spawn = __esm({
     init_agents_md();
     init_workspace_rules();
     init_session_title();
+    init_app_boundary();
     init_inference_binding();
     init_mcp_credential_deps();
     init_sandbox_agent_session_proxy();
@@ -2583,6 +2604,7 @@ var init_agent_tools = __esm({
   "src/agent-tools.ts"() {
     init_transcript_export();
     init_agent_start_schema();
+    init_process_stats();
     init_spawn_field_schemas();
     init_session_spawn();
     init_canonical_posture();
@@ -2673,6 +2695,7 @@ var init_context_checkpoint = __esm({
 // src/session-continue-fresh.ts
 var init_session_continue_fresh = __esm({
   "src/session-continue-fresh.ts"() {
+    init_app_boundary();
     init_context_checkpoint();
     init_context_continuity();
     init_session_spawn();
@@ -2733,6 +2756,21 @@ var init_gh_provenance_shim = __esm({
     DEFAULT_WRAP_GH = false;
   }
 });
+var DEFAULT_MODEL_ROLES;
+var init_model_roles = __esm({
+  "src/model-roles.ts"() {
+    DEFAULT_MODEL_ROLES = {
+      /** Reviewer for a small residual (repo-maintenance `review` step). */
+      "review.small": "claude-sonnet-5-5",
+      /** Reviewer for a large residual + the retry reviewer. */
+      "review.large": "claude-opus-5-5",
+      /** CI pull-request reviewer (mirrors `.github/agentic-review.json`'s `reviewerModel`). */
+      "review.pr": "openrouter/z-ai/glm-5.3-flash",
+      /** The session-steward's agent judge. */
+      "judge.session": "claude-sonnet-5-5"
+    };
+  }
+});
 function validateConfig(raw) {
   const result = agentprotoConfigSchema.safeParse(raw);
   if (result.success) return { ok: true, issues: [] };
@@ -2742,7 +2780,7 @@ function validateConfig(raw) {
   });
   return { ok: false, issues };
 }
-var contextContinuityPolicySchema, deferredToolsConfigSchema, spawnBrowserModeSchema, optionsMapSchema, defaultsAdapterAuthConfigSchema, defaultsAdapterConfigSchema, mcpDefaultsConfigSchema, spawnDefaultsConfigSchema, daemonConfigSchema, titlerConfigSchema, tunnelConfigSchema, featuresConfigSchema, worktreesConfigSchema, spawnConfigSchema, provenanceConfigSchema, sessionsConfigSchema, agentsMdConfigSchema, pairPageSchema, pairingConfigSchema, profileConfigSchema, acpAgentConfigEntrySchema, terminalPresetSchema, agentprotoConfigSchema, bool, str, num, strArray;
+var contextContinuityPolicySchema, deferredToolsConfigSchema, spawnBrowserModeSchema, optionsMapSchema, defaultsAdapterAuthConfigSchema, defaultsAdapterConfigSchema, mcpDefaultsConfigSchema, spawnDefaultsConfigSchema, daemonConfigSchema, titlerConfigSchema, catalogConfigSchema, tunnelConfigSchema, featuresConfigSchema, worktreesConfigSchema, spawnConfigSchema, provenanceConfigSchema, approvalsConfigSchema, sessionsConfigSchema, agentsMdConfigSchema, pairPageSchema, pairingConfigSchema, modelRoleValueSchema, profileConfigSchema, acpAgentConfigEntrySchema, terminalPresetSchema, agentprotoConfigSchema, bool, str, num, strArray;
 var init_config_schema = __esm({
   "src/config-schema.ts"() {
     init_worktree_isolation();
@@ -2752,6 +2790,7 @@ var init_config_schema = __esm({
     init_gh_provenance_shim();
     init_agents_md();
     init_session_titler();
+    init_model_roles();
     init_background_task_wake();
     init_role();
     contextContinuityPolicySchema = z.object({
@@ -2837,6 +2876,9 @@ var init_config_schema = __esm({
       enabled: z.boolean().optional(),
       model: z.string().optional()
     }).passthrough();
+    catalogConfigSchema = z.object({
+      sources: z.array(z.object({ url: z.string() }).passthrough()).optional()
+    }).passthrough();
     tunnelConfigSchema = z.object({
       host: z.string().optional(),
       token: z.string().optional(),
@@ -2851,13 +2893,17 @@ var init_config_schema = __esm({
     }).passthrough();
     worktreesConfigSchema = z.object({
       root: z.string().optional(),
-      isolation: z.enum(["always", "on-request", "never"]).optional()
+      isolation: z.enum(["always", "on-request", "never"]).optional(),
+      provisionConcurrency: z.number().int().min(0).optional(),
+      provisionConcurrencyByRepo: z.record(z.string(), z.number().int().min(0)).optional(),
+      provisionLoadFactor: z.number().min(0).optional()
     }).passthrough();
     spawnConfigSchema = z.object({
       attach: z.enum(["always", "on-request"]).optional(),
       dedupe: z.enum(["always", "on-request"]).optional()
     }).passthrough();
     provenanceConfigSchema = z.object({ wrapGh: z.boolean().optional() }).passthrough();
+    approvalsConfigSchema = z.object({ webOrigins: z.array(z.string()).optional() }).passthrough();
     sessionsConfigSchema = z.object({
       attentionDelaySec: z.number().optional(),
       eventsDir: z.string().optional()
@@ -2875,6 +2921,14 @@ var init_config_schema = __esm({
       autoconnect: z.boolean().optional(),
       pairPage: pairPageSchema.optional()
     }).passthrough();
+    modelRoleValueSchema = z.union([
+      z.string().min(1),
+      z.object({
+        model: z.string().min(1),
+        route: z.string().optional(),
+        profile: z.string().optional()
+      }).passthrough()
+    ]);
     profileConfigSchema = z.object({
       daemon: daemonConfigSchema.optional(),
       tunnel: tunnelConfigSchema.optional(),
@@ -2913,8 +2967,11 @@ var init_config_schema = __esm({
       spawn: spawnConfigSchema.optional(),
       sessions: sessionsConfigSchema.optional(),
       provenance: provenanceConfigSchema.optional(),
+      approvals: approvalsConfigSchema.optional(),
       agentsMd: agentsMdConfigSchema.optional(),
+      models: z.record(z.string(), modelRoleValueSchema).optional(),
       titler: titlerConfigSchema.optional(),
+      catalog: catalogConfigSchema.optional(),
       profiles: z.record(z.string(), profileConfigSchema).optional(),
       activeProfile: z.string().optional(),
       defaults: spawnDefaultsConfigSchema.optional(),
@@ -2965,6 +3022,16 @@ var init_config_schema = __esm({
         label: "Allowed origins",
         help: "Trusted browser origins for mutating /sessions/* routes, in addition to the hardcoded localhost defaults. Lockout: a bad value can lock a browser UI out."
       },
+      {
+        path: "approvals.webOrigins",
+        schema: strArray,
+        apply: "restart",
+        writable: false,
+        section: "daemon",
+        label: "Approval web-click origins",
+        help: "Origins allowed to decide a pending approval via POST /approvals/:id/decision (web_click channel). Empty (default) turns the channel off entirely. A SEPARATE allowlist from daemon.allowedOrigins, which is not automatically trusted to decide approvals. Lockout: a bad value can lock the web decision UI out.",
+        default: []
+      },
       {
         path: "daemon.strictOrigins",
         schema: bool,
@@ -3158,6 +3225,20 @@ var init_config_schema = __esm({
         default: DEFAULT_PAIR_PAGE
       },
       // ── models ──
+      {
+        // One row per configured role. Role names are dotted (`review.pr`), so a
+        // concrete key is `models.review.pr` — `findConfigKey` maps any
+        // `models.<role>` onto this entry, and `splitConfigPath` (config.ts) keeps
+        // the role as ONE segment. The full role list (incl. built-in defaults and
+        // where each value comes from) is the `model_roles` tool.
+        path: "models.*",
+        schema: modelRoleValueSchema,
+        apply: "hot",
+        writable: true,
+        section: "models",
+        label: "Model role",
+        help: `Model for a role (review.small, review.large, review.pr, judge.session, \u2026): a model id, or { model, route?, profile? }. Precedence: explicit run input > the repo's agentproto.json \`models\` > this daemon config > built-in default (\`model_roles\` lists every role and its source). Built-in defaults: ${Object.entries(DEFAULT_MODEL_ROLES).map(([r, m]) => `${r}=${m}`).join(", ")}.`
+      },
       {
         path: "titler.model",
         schema: str,
@@ -3168,6 +3249,16 @@ var init_config_schema = __esm({
         help: "OpenRouter model id used to generate session titles. Requires OPENROUTER_API_KEY.",
         default: DEFAULT_TITLER_MODEL
       },
+      // ── daemon: app catalog ──
+      {
+        path: "catalog.sources",
+        schema: z.array(z.object({ url: str }).passthrough()),
+        apply: "hot",
+        writable: true,
+        section: "daemon",
+        label: "App catalog sources",
+        help: "Remote catalogs merged into `app_catalog`: an array of `{ url }`, each returning `{ entries: AppCatalogEntry[] }`. Wins over `sources` in ~/.agentproto/app-catalog.json when both are set."
+      },
       // ── defaults: spawn ──
       {
         path: "defaults.skills",
@@ -3247,6 +3338,36 @@ var init_config_schema = __esm({
         help: "Whether a freshly-spawned agent_start session is isolated into its own git worktree.",
         default: DEFAULT_WORKTREE_ISOLATION
       },
+      {
+        path: "worktrees.provisionConcurrency",
+        schema: z.number().int().min(0),
+        apply: "hot",
+        env: WORKTREE_PROVISION_CONCURRENCY_ENV,
+        writable: true,
+        section: "defaults",
+        label: "Worktree provisioning concurrency",
+        help: "Max worktree provisionings running their heavy phases (depsCmd, clones, setup hooks) at once; the rest queue FIFO. 0 = unlimited.",
+        default: DEFAULT_WORKTREE_PROVISION_CONCURRENCY
+      },
+      {
+        path: "worktrees.provisionConcurrencyByRepo",
+        schema: z.record(str, z.number().int().min(0)),
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Per-repo provisioning concurrency",
+        help: "Per-repo caps on concurrent heavy provisioning, keyed by repo path or directory name; never looser than the global cap."
+      },
+      {
+        path: "worktrees.provisionLoadFactor",
+        schema: z.number().min(0),
+        apply: "hot",
+        writable: true,
+        section: "defaults",
+        label: "Provisioning load guard factor",
+        help: "Hold back a new heavy provisioning while the 1-minute load average exceeds cores x this factor. 0 or unset = off.",
+        default: 0
+      },
       {
         path: "spawn.attach",
         schema: z.enum(["always", "on-request"]),
@@ -3619,6 +3740,34 @@ var init_config_schema = __esm({
         label: "Terminal preset argv",
         help: "Command + args to spawn. Not writable through config_set; set via `agentproto config set` or a hand edit."
       },
+      {
+        path: "jev.apiKey",
+        schema: str,
+        apply: "hot",
+        secret: true,
+        writable: false,
+        section: "advanced",
+        label: "Jev API key",
+        help: "Jev (TypeSafe System One) judge API key. Read by the session steward's Jev backend before falling back to the JEV_API_KEY env var. Not writable through config_set; edit ~/.agentproto/config.json by hand."
+      },
+      {
+        path: "jev.model",
+        schema: str,
+        apply: "hot",
+        writable: true,
+        section: "advanced",
+        label: "Jev model",
+        help: `Jev model id for the session steward's judge backend. Default "jev-latest".`
+      },
+      {
+        path: "jev.baseUrl",
+        schema: str,
+        apply: "hot",
+        writable: true,
+        section: "advanced",
+        label: "Jev base URL",
+        help: "Jev endpoint override. Default https://api.typesafe.ai/v1/systemone."
+      },
       {
         path: "terminalPresets.*.env",
         schema: z.record(str, str),
@@ -3777,16 +3926,22 @@ async function saveConfig(next, path) {
   await promises.writeFile(tmp, JSON.stringify(payload, null, 2) + "\n", "utf8");
   await promises.rename(tmp, target);
 }
+function splitConfigPath(dotted) {
+  if (dotted.startsWith("models.") && dotted.length > "models.".length) {
+    return ["models", dotted.slice("models.".length)];
+  }
+  return dotted.split(".");
+}
 function getConfigKey(cfg, dotted) {
   let cur = cfg;
-  for (const part of dotted.split(".")) {
+  for (const part of splitConfigPath(dotted)) {
     if (cur == null || typeof cur !== "object") return void 0;
     cur = cur[part];
   }
   return cur;
 }
 function setConfigKey(cfg, dotted, value) {
-  const parts = dotted.split(".");
+  const parts = splitConfigPath(dotted);
   const out = { ...cfg };
   let cur = out;
   for (let i = 0; i < parts.length - 1; i++) {
@@ -3818,6 +3973,6 @@ var init_config = __esm({
 });
 init_config();
 
-export { CONFIG_FILE_PATH, CONFIG_VERSION, getConfigKey, loadConfig, saveConfig, setConfigKey };
+export { CONFIG_FILE_PATH, CONFIG_VERSION, getConfigKey, loadConfig, saveConfig, setConfigKey, splitConfigPath };
 //# sourceMappingURL=config.mjs.map
 //# sourceMappingURL=config.mjs.map