@agentstep/agent-sdk 0.4.16 → 0.4.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (72) hide show
  1. package/dist/{chunk-BYWW5GFO.js → chunk-22KJNZXF.js} +1 -1
  2. package/dist/{chunk-SMKHXHLP.js → chunk-2RYJEIG3.js} +1 -1
  3. package/dist/{chunk-MD4BZGMS.js → chunk-3PEVKW47.js} +1 -1
  4. package/dist/{chunk-TPAHUFSM.js → chunk-4IB3KV7S.js} +1 -1
  5. package/dist/{chunk-C4IHTLG2.js → chunk-4X4KT4CJ.js} +4 -4
  6. package/dist/{chunk-TKV7CFAM.js → chunk-4XG3HLXP.js} +1 -1
  7. package/dist/{chunk-XQA62XTJ.js → chunk-5X4BWQJP.js} +1 -1
  8. package/dist/{chunk-ECRLACEF.js → chunk-5ZZX7JZP.js} +1 -1
  9. package/dist/{chunk-IHMQQ43E.js → chunk-7WBVG6D4.js} +1 -1
  10. package/dist/{chunk-K62YRMVY.js → chunk-APWMSN3I.js} +2 -2
  11. package/dist/{chunk-JNQLE5D7.js → chunk-BXMBMUCK.js} +1 -1
  12. package/dist/{chunk-WWYVMGRP.js → chunk-CZHJNZAG.js} +1 -1
  13. package/dist/{chunk-DHSSHDIG.js → chunk-D2TRWKVQ.js} +2 -2
  14. package/dist/{chunk-L4T7KCQ2.js → chunk-DGLW2SSG.js} +1 -1
  15. package/dist/{chunk-RZMR6H5Y.js → chunk-E6F2Z3QT.js} +1 -1
  16. package/dist/{chunk-TOKLTGSO.js → chunk-FANJGS3D.js} +1 -1
  17. package/dist/{chunk-QDOCVDWJ.js → chunk-FEOW453X.js} +1 -1
  18. package/dist/{chunk-PNYCULIF.js → chunk-G5CIMVGV.js} +1 -1
  19. package/dist/{chunk-LRPU2HS5.js → chunk-GK4SHVMZ.js} +1 -1
  20. package/dist/{chunk-OFLYKESG.js → chunk-KFN4X3GZ.js} +1 -1
  21. package/dist/{chunk-U6GNZJGO.js → chunk-KWB3FXD5.js} +1 -1
  22. package/dist/{chunk-FCCWKCGQ.js → chunk-NH63FTAL.js} +1 -1
  23. package/dist/{chunk-HJGUG7IH.js → chunk-ORFFR5UG.js} +11 -6
  24. package/dist/{chunk-OWTXN2FU.js → chunk-OXWELRJL.js} +17 -12
  25. package/dist/{chunk-LJL3DM2L.js → chunk-OYXDU3HX.js} +1 -1
  26. package/dist/{chunk-EUUDZGUE.js → chunk-Q3GZ6QUQ.js} +1 -1
  27. package/dist/{chunk-QOJMXK4S.js → chunk-RDGOGAQ5.js} +1 -1
  28. package/dist/{chunk-MA7IO6RU.js → chunk-SQCGHEU7.js} +1 -1
  29. package/dist/{chunk-S6AM7WVH.js → chunk-U7GILP6F.js} +1 -1
  30. package/dist/{chunk-UYNE3WPU.js → chunk-UBS4LDDI.js} +1 -1
  31. package/dist/{chunk-7CADMELE.js → chunk-URHTKS66.js} +2 -2
  32. package/dist/{chunk-W5KXLYJH.js → chunk-UWPHCWZO.js} +2 -2
  33. package/dist/{chunk-6RRYNQXP.js → chunk-ZJFWDMML.js} +1 -1
  34. package/dist/{chunk-JOAEFGXZ.js → chunk-ZMCS7MYZ.js} +12 -8
  35. package/dist/containers/lifecycle.js +5 -3
  36. package/dist/handlers/agents.js +7 -7
  37. package/dist/handlers/api_keys.js +7 -7
  38. package/dist/handlers/audit.js +7 -7
  39. package/dist/handlers/batch.js +7 -7
  40. package/dist/handlers/credentials.js +8 -8
  41. package/dist/handlers/environments.js +7 -7
  42. package/dist/handlers/events.js +7 -7
  43. package/dist/handlers/files.js +7 -7
  44. package/dist/handlers/index.js +34 -34
  45. package/dist/handlers/license.js +7 -7
  46. package/dist/handlers/memory.js +7 -7
  47. package/dist/handlers/metrics.js +7 -7
  48. package/dist/handlers/models.js +7 -7
  49. package/dist/handlers/openapi.js +3 -3
  50. package/dist/handlers/providers.js +7 -7
  51. package/dist/handlers/resources.js +7 -7
  52. package/dist/handlers/sessions.js +7 -7
  53. package/dist/handlers/settings.js +7 -7
  54. package/dist/handlers/skills-write.js +7 -7
  55. package/dist/handlers/skills.js +7 -7
  56. package/dist/handlers/stream.js +6 -6
  57. package/dist/handlers/tenants.js +7 -7
  58. package/dist/handlers/threads.js +7 -7
  59. package/dist/handlers/traces.js +7 -7
  60. package/dist/handlers/upstream_keys.js +7 -7
  61. package/dist/handlers/vaults.js +7 -7
  62. package/dist/handlers/whoami.js +7 -7
  63. package/dist/http.js +6 -6
  64. package/dist/index.js +8 -8
  65. package/dist/init.js +5 -5
  66. package/dist/openapi/schemas.js +1 -1
  67. package/dist/openapi/spec.js +2 -2
  68. package/dist/sessions/driver.js +2 -2
  69. package/dist/sessions/sweeper.js +2 -2
  70. package/dist/sessions/threads.js +2 -2
  71. package/dist/shutdown.js +3 -3
  72. package/package.json +2 -2
@@ -18,7 +18,7 @@ import {
18
18
  import {
19
19
  jsonOk,
20
20
  routeWrap
21
- } from "./chunk-LJL3DM2L.js";
21
+ } from "./chunk-OYXDU3HX.js";
22
22
  import {
23
23
  getDb,
24
24
  init_client
@@ -4,7 +4,7 @@ import {
4
4
  import {
5
5
  jsonOk,
6
6
  routeWrap
7
- } from "./chunk-LJL3DM2L.js";
7
+ } from "./chunk-OYXDU3HX.js";
8
8
 
9
9
  // src/handlers/license.ts
10
10
  function handleGetLicense(request) {
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  jsonOk,
3
3
  routeWrap
4
- } from "./chunk-LJL3DM2L.js";
4
+ } from "./chunk-OYXDU3HX.js";
5
5
  import {
6
6
  readSetting,
7
7
  writeSetting
@@ -5,7 +5,7 @@ import {
5
5
  import {
6
6
  jsonOk,
7
7
  routeWrap
8
- } from "./chunk-LJL3DM2L.js";
8
+ } from "./chunk-OYXDU3HX.js";
9
9
  import {
10
10
  badRequest
11
11
  } from "./chunk-EZYKRG4W.js";
@@ -3,7 +3,7 @@ import {
3
3
  } from "./chunk-HECQRMDR.js";
4
4
  import {
5
5
  runTurn
6
- } from "./chunk-HJGUG7IH.js";
6
+ } from "./chunk-ORFFR5UG.js";
7
7
  import {
8
8
  installOtlpExporter
9
9
  } from "./chunk-ACKMNK3C.js";
@@ -19,14 +19,14 @@ import {
19
19
  } from "./chunk-3MQ2FWXS.js";
20
20
  import {
21
21
  installShutdownHandlers
22
- } from "./chunk-S6AM7WVH.js";
22
+ } from "./chunk-U7GILP6F.js";
23
23
  import {
24
24
  runSweep
25
- } from "./chunk-PNYCULIF.js";
25
+ } from "./chunk-G5CIMVGV.js";
26
26
  import {
27
27
  reconcileDockerOrphanSandboxes,
28
28
  reconcileOrphanSandboxes
29
- } from "./chunk-JOAEFGXZ.js";
29
+ } from "./chunk-ZMCS7MYZ.js";
30
30
  import {
31
31
  appendEvent,
32
32
  installPayloadRedactor
@@ -10,7 +10,7 @@ import {
10
10
  import {
11
11
  jsonOk,
12
12
  routeWrap
13
- } from "./chunk-LJL3DM2L.js";
13
+ } from "./chunk-OYXDU3HX.js";
14
14
  import {
15
15
  archiveTenant,
16
16
  createTenant,
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  routeWrap
3
- } from "./chunk-LJL3DM2L.js";
3
+ } from "./chunk-OYXDU3HX.js";
4
4
  import {
5
5
  ApiError
6
6
  } from "./chunk-EZYKRG4W.js";
@@ -8,7 +8,7 @@ import {
8
8
  import {
9
9
  jsonOk,
10
10
  routeWrap
11
- } from "./chunk-LJL3DM2L.js";
11
+ } from "./chunk-OYXDU3HX.js";
12
12
 
13
13
  // src/handlers/skills.ts
14
14
  async function handleGetSkillsCatalog(request) {
@@ -8,7 +8,7 @@ import {
8
8
  import {
9
9
  jsonOk,
10
10
  routeWrap
11
- } from "./chunk-LJL3DM2L.js";
11
+ } from "./chunk-OYXDU3HX.js";
12
12
  import {
13
13
  badRequest
14
14
  } from "./chunk-EZYKRG4W.js";
@@ -18,7 +18,7 @@ import {
18
18
  import {
19
19
  jsonOk,
20
20
  routeWrap
21
- } from "./chunk-LJL3DM2L.js";
21
+ } from "./chunk-OYXDU3HX.js";
22
22
  import {
23
23
  forwardToAnthropic
24
24
  } from "./chunk-QLWA4MJ5.js";
@@ -38,7 +38,7 @@ import {
38
38
  } from "./chunk-LAWTTG2E.js";
39
39
  import {
40
40
  releaseSession
41
- } from "./chunk-JOAEFGXZ.js";
41
+ } from "./chunk-ZMCS7MYZ.js";
42
42
  import {
43
43
  appendEvent,
44
44
  dropEmitter
@@ -4,7 +4,7 @@ import {
4
4
  import {
5
5
  jsonOk,
6
6
  routeWrap
7
- } from "./chunk-LJL3DM2L.js";
7
+ } from "./chunk-OYXDU3HX.js";
8
8
 
9
9
  // src/handlers/models.ts
10
10
  function handleListModels(request) {
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  jsonOk,
3
3
  routeWrap
4
- } from "./chunk-LJL3DM2L.js";
4
+ } from "./chunk-OYXDU3HX.js";
5
5
  import {
6
6
  resolveContainerProvider
7
7
  } from "./chunk-JSLEB2ED.js";
@@ -83,7 +83,7 @@ import {
83
83
  VaultListResponseSchema,
84
84
  VaultSchema,
85
85
  WhoamiResponseSchema
86
- } from "./chunk-OWTXN2FU.js";
86
+ } from "./chunk-OXWELRJL.js";
87
87
  import {
88
88
  registry
89
89
  } from "./chunk-7346CKTF.js";
@@ -774,7 +774,7 @@ registry.registerPath({
774
774
  path: "/v1/vaults/{id}/credentials",
775
775
  tags: ["Credentials"],
776
776
  summary: "Create a vault credential",
777
- description: "Creates a structured credential in the vault. The secret token is encrypted at rest and never returned in API responses.",
777
+ description: "Creates a credential in the vault for MCP server authentication or plain API key storage. The token is encrypted at rest and never returned in responses. When `mcp_server_url` is provided, the credential is automatically injected as MCP auth during sessions. Without `mcp_server_url`, the token is injected as an env var derived from `display_name`.",
778
778
  security: [{ ApiKey: [] }],
779
779
  request: {
780
780
  params: z.object({ id: z.string() }),
@@ -5,7 +5,7 @@ import {
5
5
  import {
6
6
  jsonOk,
7
7
  routeWrap
8
- } from "./chunk-LJL3DM2L.js";
8
+ } from "./chunk-OYXDU3HX.js";
9
9
  import {
10
10
  getSession,
11
11
  listSessions
@@ -16,7 +16,7 @@ import {
16
16
  import {
17
17
  jsonOk,
18
18
  routeWrap
19
- } from "./chunk-LJL3DM2L.js";
19
+ } from "./chunk-OYXDU3HX.js";
20
20
  import {
21
21
  getDb,
22
22
  init_client
@@ -1,7 +1,7 @@
1
1
  import {
2
2
  jsonOk,
3
3
  routeWrap
4
- } from "./chunk-LJL3DM2L.js";
4
+ } from "./chunk-OYXDU3HX.js";
5
5
 
6
6
  // src/handlers/whoami.ts
7
7
  function handleWhoami(request) {
@@ -21,7 +21,7 @@ import {
21
21
  import {
22
22
  jsonOk,
23
23
  routeWrap
24
- } from "./chunk-LJL3DM2L.js";
24
+ } from "./chunk-OYXDU3HX.js";
25
25
  import {
26
26
  badRequest,
27
27
  notFound
@@ -6,7 +6,7 @@ import {
6
6
  reconcileDockerOrphanSandboxes,
7
7
  reconcileOrphanSandboxes,
8
8
  releaseSession
9
- } from "./chunk-JOAEFGXZ.js";
9
+ } from "./chunk-ZMCS7MYZ.js";
10
10
  import {
11
11
  appendEvent,
12
12
  dropEmitter
@@ -4,7 +4,7 @@ import {
4
4
  import {
5
5
  jsonOk,
6
6
  routeWrap
7
- } from "./chunk-LJL3DM2L.js";
7
+ } from "./chunk-OYXDU3HX.js";
8
8
  import {
9
9
  getProxiedTenantId
10
10
  } from "./chunk-NIOWKTIF.js";
@@ -6,7 +6,7 @@ import {
6
6
  import {
7
7
  jsonOk,
8
8
  routeWrap
9
- } from "./chunk-LJL3DM2L.js";
9
+ } from "./chunk-OYXDU3HX.js";
10
10
  import {
11
11
  forwardToAnthropic,
12
12
  validateAnthropicProxy
@@ -12,7 +12,7 @@ import {
12
12
  } from "./chunk-QLWA4MJ5.js";
13
13
  import {
14
14
  ensureInitialized
15
- } from "./chunk-C4IHTLG2.js";
15
+ } from "./chunk-4X4KT4CJ.js";
16
16
  import {
17
17
  getProxiedTenantId,
18
18
  isProxied
@@ -8,7 +8,7 @@ import {
8
8
  import {
9
9
  jsonOk,
10
10
  routeWrap
11
- } from "./chunk-LJL3DM2L.js";
11
+ } from "./chunk-OYXDU3HX.js";
12
12
  import {
13
13
  snapshotApiMetrics
14
14
  } from "./chunk-D2XITRN6.js";
@@ -28,10 +28,12 @@ import {
28
28
  import {
29
29
  acquireForFirstTurn,
30
30
  installSkills,
31
- provisionResources
32
- } from "./chunk-JOAEFGXZ.js";
31
+ provisionResources,
32
+ wrapProviderWithSecrets
33
+ } from "./chunk-ZMCS7MYZ.js";
33
34
  import {
34
- BLOCKED_ENV_KEYS
35
+ BLOCKED_ENV_KEYS,
36
+ resolveVaultSecrets
35
37
  } from "./chunk-DO4WVWW7.js";
36
38
  import {
37
39
  appendEvent,
@@ -192,6 +194,7 @@ async function runTurn(sessionId, inputs, _depth = 0, parentTrace) {
192
194
  try {
193
195
  sandboxName = await acquireForFirstTurn(sessionId);
194
196
  console.log(`[driver] ${sessionId} container ready: ${sandboxName}`);
197
+ const postAcquireSecrets = getBySession(sessionId)?.vaultSecrets ?? (session.vault_ids?.length ? resolveVaultSecrets(session.vault_ids) : void 0);
195
198
  const latestAgent = getAgent(session.agent.id);
196
199
  if (latestAgent && latestAgent.skills && latestAgent.skills.length > 0) {
197
200
  const currentSkills = new Map((agent.skills ?? []).map((s) => [s.name, s.content.length]));
@@ -201,7 +204,8 @@ async function runTurn(sessionId, inputs, _depth = 0, parentTrace) {
201
204
  if (newSkills.length > 0) {
202
205
  console.log(`[driver] ${sessionId} injecting ${newSkills.length} new skill(s)...`);
203
206
  const envRow = getEnvironment(session.environment_id);
204
- const sp = await resolveContainerProvider(envRow?.config?.provider);
207
+ const baseProvider = await resolveContainerProvider(envRow?.config?.provider);
208
+ const sp = wrapProviderWithSecrets(baseProvider, postAcquireSecrets);
205
209
  await installSkills(sandboxName, sp, newSkills, agent.engine);
206
210
  console.log(`[driver] ${sessionId} skills injected`);
207
211
  }
@@ -209,7 +213,8 @@ async function runTurn(sessionId, inputs, _depth = 0, parentTrace) {
209
213
  const freshSession2 = getSession(sessionId);
210
214
  if (freshSession2?.resources && freshSession2.resources.length > 0) {
211
215
  const envRow = getEnvironment(session.environment_id);
212
- const sp = await resolveContainerProvider(envRow?.config?.provider);
216
+ const baseProvider = await resolveContainerProvider(envRow?.config?.provider);
217
+ const sp = wrapProviderWithSecrets(baseProvider, postAcquireSecrets);
213
218
  await provisionResources(sandboxName, freshSession2.resources, sp);
214
219
  }
215
220
  } catch (err) {
@@ -316,7 +321,7 @@ ${turnBuild.stdin}`;
316
321
  const env = getEnvironment(session.environment_id);
317
322
  const provider = await resolveContainerProvider(env?.config?.provider);
318
323
  const poolEntry = getBySession(sessionId);
319
- const secrets = poolEntry?.vaultSecrets ?? (session.vault_ids?.length ? (await import("./providers/resolve-secrets.js")).resolveVaultSecrets(session.vault_ids) : void 0);
324
+ const secrets = poolEntry?.vaultSecrets ?? (session.vault_ids?.length ? resolveVaultSecrets(session.vault_ids) : void 0);
320
325
  const tools = resolveToolset(agent.tools);
321
326
  if (agent.threads_enabled) {
322
327
  tools.customToolNames.add("spawn_agent");
@@ -567,26 +567,30 @@ var FileDeletedResponseSchema = registry.register(
567
567
  var VaultCredentialSchema = registry.register(
568
568
  "VaultCredential",
569
569
  z.object({
570
+ type: z.literal("vault_credential"),
570
571
  id: UlidId,
571
572
  vault_id: UlidId,
572
573
  display_name: z.string(),
573
574
  auth: z.object({
574
- type: z.string().openapi({ description: "Auth type, e.g. 'static_bearer'." }),
575
- mcp_server_url: z.string().nullable().openapi({ description: "Associated MCP server URL, if any." })
575
+ type: z.enum(["static_bearer"]).openapi({ description: "Auth type. Currently only `static_bearer` is supported." }),
576
+ mcp_server_url: z.string().nullable().openapi({ description: "MCP server URL this credential authenticates with. Null for plain API keys." })
576
577
  }),
578
+ metadata: z.record(z.string()).optional().openapi({ description: "Arbitrary key-value metadata." }),
577
579
  created_at: IsoTimestamp,
578
- updated_at: IsoTimestamp
579
- }).openapi({ description: "Vault credential metadata. The secret token is NEVER returned in API responses." })
580
+ updated_at: IsoTimestamp,
581
+ archived_at: IsoTimestamp.nullable()
582
+ }).openapi({ description: "Vault credential. Secret fields (token) are write-only \u2014 never returned in responses." })
580
583
  );
581
584
  var CreateCredentialRequestSchema = registry.register(
582
585
  "CreateCredentialRequest",
583
586
  z.object({
584
- display_name: z.string().min(1).max(200),
587
+ display_name: z.string().min(1).max(200).openapi({ description: "Human-readable name for this credential.", example: "Linear API key" }),
585
588
  auth: z.object({
586
- type: z.enum(["static_bearer"]),
587
- token: z.string().min(1).openapi({ description: "Secret token value. Stored encrypted; never returned." }),
588
- mcp_server_url: z.string().url().optional()
589
- })
589
+ type: z.enum(["static_bearer"]).openapi({ description: "Auth type." }),
590
+ mcp_server_url: z.string().url().optional().openapi({ description: "MCP server URL this credential authenticates with. Optional for plain API keys.", example: "https://mcp.linear.app/mcp" }),
591
+ token: z.string().min(1).openapi({ description: "Secret token. Stored encrypted at rest; never returned in responses.", example: "lin_api_xxxxx" })
592
+ }),
593
+ metadata: z.record(z.string()).optional().openapi({ description: "Arbitrary key-value metadata." })
590
594
  })
591
595
  );
592
596
  var UpdateCredentialRequestSchema = registry.register(
@@ -595,9 +599,10 @@ var UpdateCredentialRequestSchema = registry.register(
595
599
  display_name: z.string().min(1).max(200).optional(),
596
600
  auth: z.object({
597
601
  type: z.enum(["static_bearer"]).optional(),
598
- token: z.string().min(1).optional(),
602
+ token: z.string().min(1).optional().openapi({ description: "New token value. Write-only." }),
599
603
  mcp_server_url: z.string().url().nullish()
600
- }).optional()
604
+ }).optional(),
605
+ metadata: z.record(z.string().nullable()).optional().openapi({ description: "Patch semantics: set key to string to upsert, null to delete, omit to preserve." })
601
606
  })
602
607
  );
603
608
  var CredentialListResponseSchema = registry.register(
@@ -606,7 +611,7 @@ var CredentialListResponseSchema = registry.register(
606
611
  );
607
612
  var CredentialDeletedResponseSchema = registry.register(
608
613
  "CredentialDeletedResponse",
609
- z.object({ id: UlidId, type: z.literal("credential_deleted") })
614
+ z.object({ id: UlidId, type: z.literal("vault_credential_deleted") })
610
615
  );
611
616
  var MemoryStoreSchema = registry.register(
612
617
  "MemoryStore",
@@ -10,7 +10,7 @@ import {
10
10
  } from "./chunk-HVUWXUUI.js";
11
11
  import {
12
12
  ensureInitialized
13
- } from "./chunk-C4IHTLG2.js";
13
+ } from "./chunk-4X4KT4CJ.js";
14
14
  import {
15
15
  captureException
16
16
  } from "./chunk-3MQ2FWXS.js";
@@ -9,7 +9,7 @@ import {
9
9
  import {
10
10
  jsonOk,
11
11
  routeWrap
12
- } from "./chunk-LJL3DM2L.js";
12
+ } from "./chunk-OYXDU3HX.js";
13
13
  import {
14
14
  forwardToAnthropic
15
15
  } from "./chunk-QLWA4MJ5.js";
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  buildOpenApiDocument
3
- } from "./chunk-DHSSHDIG.js";
3
+ } from "./chunk-D2TRWKVQ.js";
4
4
 
5
5
  // src/handlers/openapi.ts
6
6
  function originFromRequest(request) {
@@ -15,7 +15,7 @@ import {
15
15
  import {
16
16
  jsonOk,
17
17
  routeWrap
18
- } from "./chunk-LJL3DM2L.js";
18
+ } from "./chunk-OYXDU3HX.js";
19
19
  import {
20
20
  createApiKey,
21
21
  getApiKeyById,
@@ -1,6 +1,6 @@
1
1
  import {
2
2
  markStopping
3
- } from "./chunk-PNYCULIF.js";
3
+ } from "./chunk-G5CIMVGV.js";
4
4
  import {
5
5
  closeDb,
6
6
  init_client,
@@ -6,7 +6,7 @@ import {
6
6
  import {
7
7
  jsonOk,
8
8
  routeWrap
9
- } from "./chunk-LJL3DM2L.js";
9
+ } from "./chunk-OYXDU3HX.js";
10
10
  import {
11
11
  createVault,
12
12
  deleteEntry,
@@ -1,10 +1,10 @@
1
1
  import {
2
2
  loadVaultForCaller
3
- } from "./chunk-UYNE3WPU.js";
3
+ } from "./chunk-UBS4LDDI.js";
4
4
  import {
5
5
  jsonOk,
6
6
  routeWrap
7
- } from "./chunk-LJL3DM2L.js";
7
+ } from "./chunk-OYXDU3HX.js";
8
8
  import {
9
9
  createCredential,
10
10
  deleteCredential,
@@ -24,7 +24,7 @@ import {
24
24
  import {
25
25
  jsonOk,
26
26
  routeWrap
27
- } from "./chunk-LJL3DM2L.js";
27
+ } from "./chunk-OYXDU3HX.js";
28
28
  import {
29
29
  forwardToAnthropic
30
30
  } from "./chunk-QLWA4MJ5.js";
@@ -34,7 +34,7 @@ import {
34
34
  import {
35
35
  runTurn,
36
36
  writePermissionResponse
37
- } from "./chunk-HJGUG7IH.js";
37
+ } from "./chunk-ORFFR5UG.js";
38
38
  import {
39
39
  getProxiedTenantId,
40
40
  isProxied
@@ -4,7 +4,7 @@ import {
4
4
  import {
5
5
  jsonOk,
6
6
  routeWrap
7
- } from "./chunk-LJL3DM2L.js";
7
+ } from "./chunk-OYXDU3HX.js";
8
8
  import {
9
9
  exportTrace
10
10
  } from "./chunk-ACKMNK3C.js";
@@ -52,6 +52,16 @@ var lcLog = (...args) => {
52
52
  if (process.env.DEBUG_LIFECYCLE === "1") console.log(...args);
53
53
  };
54
54
  var SANDBOX_NAME_PREFIX = "ca-sess-";
55
+ function wrapProviderWithSecrets(provider, secrets) {
56
+ if (!secrets || Object.keys(secrets).length === 0) return provider;
57
+ return {
58
+ ...provider,
59
+ exec: (n, argv, opts) => provider.exec(n, argv, { ...opts, secrets }),
60
+ startExec: (n, opts) => provider.startExec(n, { ...opts, secrets }),
61
+ create: (opts) => provider.create({ ...opts, secrets }),
62
+ delete: (n, s) => provider.delete(n, s ?? secrets)
63
+ };
64
+ }
55
65
  async function installSkills(sandboxName, provider, skills, engine) {
56
66
  if (!skills || skills.length === 0) return;
57
67
  const SAFE_NAME_RE = /^[a-zA-Z0-9_.-]+$/;
@@ -117,14 +127,7 @@ async function acquireForFirstTurn(sessionId) {
117
127
  throw new Error(`provider ${provider.name} is not available: ${result.message}`);
118
128
  }
119
129
  }
120
- const hasSecrets = Object.keys(secrets).length > 0;
121
- const sp = hasSecrets ? {
122
- ...provider,
123
- exec: (n, argv, opts) => provider.exec(n, argv, { ...opts, secrets }),
124
- startExec: (n, opts) => provider.startExec(n, { ...opts, secrets }),
125
- create: (opts) => provider.create({ ...opts, secrets }),
126
- delete: (n, s) => provider.delete(n, s ?? secrets)
127
- } : provider;
130
+ const sp = wrapProviderWithSecrets(provider, secrets);
128
131
  const name = deriveSandboxName(sessionId);
129
132
  lcLog(`[lifecycle] ${sessionId} creating container via ${sp.name}...`);
130
133
  try {
@@ -397,6 +400,7 @@ async function reconcileDockerOrphanSandboxes() {
397
400
  }
398
401
 
399
402
  export {
403
+ wrapProviderWithSecrets,
400
404
  installSkills,
401
405
  acquireForFirstTurn,
402
406
  provisionResources,
@@ -4,8 +4,9 @@ import {
4
4
  provisionResources,
5
5
  reconcileDockerOrphanSandboxes,
6
6
  reconcileOrphanSandboxes,
7
- releaseSession
8
- } from "../chunk-JOAEFGXZ.js";
7
+ releaseSession,
8
+ wrapProviderWithSecrets
9
+ } from "../chunk-ZMCS7MYZ.js";
9
10
  import "../chunk-DO4WVWW7.js";
10
11
  import "../chunk-RMZRSYIJ.js";
11
12
  import "../chunk-5ZFOKZGR.js";
@@ -81,5 +82,6 @@ export {
81
82
  provisionResources,
82
83
  reconcileDockerOrphanSandboxes,
83
84
  reconcileOrphanSandboxes,
84
- releaseSession
85
+ releaseSession,
86
+ wrapProviderWithSecrets
85
87
  };
@@ -4,17 +4,17 @@ import {
4
4
  handleGetAgent,
5
5
  handleListAgents,
6
6
  handleUpdateAgent
7
- } from "../chunk-OFLYKESG.js";
7
+ } from "../chunk-KFN4X3GZ.js";
8
8
  import "../chunk-23UKWXJH.js";
9
- import "../chunk-LJL3DM2L.js";
9
+ import "../chunk-OYXDU3HX.js";
10
10
  import "../chunk-D2XITRN6.js";
11
11
  import "../chunk-PWWRWR75.js";
12
12
  import "../chunk-QLWA4MJ5.js";
13
13
  import "../chunk-W6WKXFHN.js";
14
14
  import "../chunk-HVUWXUUI.js";
15
- import "../chunk-C4IHTLG2.js";
15
+ import "../chunk-4X4KT4CJ.js";
16
16
  import "../chunk-HECQRMDR.js";
17
- import "../chunk-HJGUG7IH.js";
17
+ import "../chunk-ORFFR5UG.js";
18
18
  import "../chunk-PJZ5TQYW.js";
19
19
  import "../chunk-AU4NAQGA.js";
20
20
  import "../chunk-H6TQGV4L.js";
@@ -27,10 +27,10 @@ import "../chunk-NIOWKTIF.js";
27
27
  import "../chunk-ZQGJKPPY.js";
28
28
  import "../chunk-ADK2TYO4.js";
29
29
  import "../chunk-3MQ2FWXS.js";
30
- import "../chunk-S6AM7WVH.js";
31
- import "../chunk-PNYCULIF.js";
30
+ import "../chunk-U7GILP6F.js";
31
+ import "../chunk-G5CIMVGV.js";
32
32
  import "../chunk-LAWTTG2E.js";
33
- import "../chunk-JOAEFGXZ.js";
33
+ import "../chunk-ZMCS7MYZ.js";
34
34
  import "../chunk-DO4WVWW7.js";
35
35
  import "../chunk-RMZRSYIJ.js";
36
36
  import "../chunk-5ZFOKZGR.js";
@@ -5,19 +5,19 @@ import {
5
5
  handleListApiKeys,
6
6
  handlePatchApiKey,
7
7
  handleRevokeApiKey
8
- } from "../chunk-MA7IO6RU.js";
8
+ } from "../chunk-SQCGHEU7.js";
9
9
  import "../chunk-23UKWXJH.js";
10
10
  import "../chunk-MHQXDTJB.js";
11
11
  import "../chunk-2N2KL4KM.js";
12
- import "../chunk-LJL3DM2L.js";
12
+ import "../chunk-OYXDU3HX.js";
13
13
  import "../chunk-D2XITRN6.js";
14
14
  import "../chunk-PWWRWR75.js";
15
15
  import "../chunk-QLWA4MJ5.js";
16
16
  import "../chunk-W6WKXFHN.js";
17
17
  import "../chunk-HVUWXUUI.js";
18
- import "../chunk-C4IHTLG2.js";
18
+ import "../chunk-4X4KT4CJ.js";
19
19
  import "../chunk-HECQRMDR.js";
20
- import "../chunk-HJGUG7IH.js";
20
+ import "../chunk-ORFFR5UG.js";
21
21
  import "../chunk-PJZ5TQYW.js";
22
22
  import "../chunk-AU4NAQGA.js";
23
23
  import "../chunk-H6TQGV4L.js";
@@ -30,10 +30,10 @@ import "../chunk-NIOWKTIF.js";
30
30
  import "../chunk-ZQGJKPPY.js";
31
31
  import "../chunk-ADK2TYO4.js";
32
32
  import "../chunk-3MQ2FWXS.js";
33
- import "../chunk-S6AM7WVH.js";
34
- import "../chunk-PNYCULIF.js";
33
+ import "../chunk-U7GILP6F.js";
34
+ import "../chunk-G5CIMVGV.js";
35
35
  import "../chunk-LAWTTG2E.js";
36
- import "../chunk-JOAEFGXZ.js";
36
+ import "../chunk-ZMCS7MYZ.js";
37
37
  import "../chunk-DO4WVWW7.js";
38
38
  import "../chunk-RMZRSYIJ.js";
39
39
  import "../chunk-5ZFOKZGR.js";
@@ -1,18 +1,18 @@
1
1
  import {
2
2
  handleListAudit
3
- } from "../chunk-IHMQQ43E.js";
3
+ } from "../chunk-7WBVG6D4.js";
4
4
  import "../chunk-23UKWXJH.js";
5
5
  import "../chunk-MHQXDTJB.js";
6
6
  import "../chunk-2N2KL4KM.js";
7
- import "../chunk-LJL3DM2L.js";
7
+ import "../chunk-OYXDU3HX.js";
8
8
  import "../chunk-D2XITRN6.js";
9
9
  import "../chunk-PWWRWR75.js";
10
10
  import "../chunk-QLWA4MJ5.js";
11
11
  import "../chunk-W6WKXFHN.js";
12
12
  import "../chunk-HVUWXUUI.js";
13
- import "../chunk-C4IHTLG2.js";
13
+ import "../chunk-4X4KT4CJ.js";
14
14
  import "../chunk-HECQRMDR.js";
15
- import "../chunk-HJGUG7IH.js";
15
+ import "../chunk-ORFFR5UG.js";
16
16
  import "../chunk-PJZ5TQYW.js";
17
17
  import "../chunk-AU4NAQGA.js";
18
18
  import "../chunk-H6TQGV4L.js";
@@ -25,10 +25,10 @@ import "../chunk-NIOWKTIF.js";
25
25
  import "../chunk-ZQGJKPPY.js";
26
26
  import "../chunk-ADK2TYO4.js";
27
27
  import "../chunk-3MQ2FWXS.js";
28
- import "../chunk-S6AM7WVH.js";
29
- import "../chunk-PNYCULIF.js";
28
+ import "../chunk-U7GILP6F.js";
29
+ import "../chunk-G5CIMVGV.js";
30
30
  import "../chunk-LAWTTG2E.js";
31
- import "../chunk-JOAEFGXZ.js";
31
+ import "../chunk-ZMCS7MYZ.js";
32
32
  import "../chunk-DO4WVWW7.js";
33
33
  import "../chunk-RMZRSYIJ.js";
34
34
  import "../chunk-5ZFOKZGR.js";