@agentstep/agent-sdk 0.5.27 → 0.5.33

package/dist/chunk-6SD6MC2B.js

@@ -0,0 +1,29 @@
+// src/backends/pi/args.ts
+function normalizePiModel(model) {
+  if (model.includes("/")) return model;
+  if (model.startsWith("gemini-")) return `google/${model}`;
+  if (model.startsWith("claude-")) return `anthropic/${model}`;
+  if (model.startsWith("gpt-") || model.startsWith("o1-") || model.startsWith("o3-") || model.startsWith("o4-") || model.startsWith("chatgpt-")) return `openai/${model}`;
+  return model;
+}
+function buildPiArgs(input) {
+  const args = [
+    "-p",
+    "--mode",
+    "json",
+    "--no-extensions"
+  ];
+  if (input.backendSessionId) {
+    args.push("--session", input.backendSessionId);
+  }
+  if (input.agent.model) {
+    const modelId = typeof input.agent.model === "string" ? input.agent.model : input.agent.model.id;
+    if (modelId) args.push("--model", normalizePiModel(modelId));
+  }
+  args.push(input.prompt);
+  return args;
+}
+
+export {
+  buildPiArgs
+};

package/dist/{chunk-ENFWZ2QM.js → chunk-6U6HEVSN.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_TENANT_ID
-} from "./chunk-F5SHFZUA.js";
+} from "./chunk-YTBVILAH.js";
 import {
   init_ids,
   newId
@@ -13,10 +13,10 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-7U62OZSD.js";
+} from "./chunk-ZDDMPGN4.js";
 import {
   schema_exports
-} from "./chunk-4ENK7S24.js";
+} from "./chunk-CXYMVLYK.js";
 
 // src/db/agents.ts
 init_drizzle();
@@ -38,6 +38,7 @@ function hydrate(row, ver) {
     threadsEnabled = true;
     callableAgents = multiagent.agents.filter((a) => a.type === "agent").map((a) => ({ type: "agent", id: a.id, version: a.version }));
   }
+  const permissionPolicy = ver.permission_policy_json ? JSON.parse(ver.permission_policy_json) : null;
   return {
     type: "agent",
     id: row.id,
@@ -57,6 +58,7 @@ function hydrate(row, ver) {
     confirmation_mode: Boolean(ver.confirmation_mode),
     callable_agents: callableAgents,
     multiagent,
+    permission_policy: permissionPolicy,
     skills: ver.skills_json ? JSON.parse(ver.skills_json) : [],
     model_config: modelConfig,
     fallback_json: row.fallback_json ?? null,
@@ -95,6 +97,7 @@ function createAgent(input) {
       confirmation_mode: input.confirmation_mode ? 1 : 0,
       callable_agents_json: input.callable_agents?.length ? JSON.stringify(input.callable_agents) : null,
       multiagent_json: input.multiagent ? JSON.stringify(input.multiagent) : null,
+      permission_policy_json: input.permission_policy ? JSON.stringify(input.permission_policy) : null,
       skills_json: JSON.stringify(input.skills ?? []),
       model_config_json: JSON.stringify(input.model_config ?? {}),
       created_at: now
@@ -148,6 +151,7 @@ function updateAgent(id, input) {
       confirmation_mode: input.confirmation_mode !== void 0 ? input.confirmation_mode ? 1 : 0 : existing.confirmation_mode ? 1 : 0,
       callable_agents_json: input.callable_agents !== void 0 ? input.callable_agents.length ? JSON.stringify(input.callable_agents) : null : existing.callable_agents.length ? JSON.stringify(existing.callable_agents) : null,
       multiagent_json: input.multiagent !== void 0 ? input.multiagent ? JSON.stringify(input.multiagent) : null : existing.multiagent ? JSON.stringify(existing.multiagent) : null,
+      permission_policy_json: input.permission_policy !== void 0 ? input.permission_policy ? JSON.stringify(input.permission_policy) : null : existing.permission_policy ? JSON.stringify(existing.permission_policy) : null,
       skills_json: JSON.stringify(input.skills ?? existing.skills),
       model_config_json: JSON.stringify(input.model_config !== void 0 ? input.model_config : existing.model_config),
       created_at: now

package/dist/{chunk-J7XHNSPO.js → chunk-7JA6HCMK.js}

@@ -6,7 +6,7 @@ import {
   getSkill,
   getSkillVersion,
   listSkillVersions
-} from "./chunk-D3LKWVPA.js";
+} from "./chunk-TTDMQ54U.js";
 import {
   resolveCreateTenant
 } from "./chunk-23UKWXJH.js";
@@ -15,7 +15,7 @@ import {
   jsonOk,
   paginatedOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-7HTCDMOB.js → chunk-7PFDF5PN.js}

@@ -5,25 +5,25 @@ import {
 } from "./chunk-23UKWXJH.js";
 import {
   kickoffEnvironmentSetup
-} from "./chunk-7DPZMROX.js";
+} from "./chunk-YRFWPBGX.js";
 import {
   decodeCursor,
   jsonOk,
   paginatedOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   forwardToAnthropic
-} from "./chunk-IDQKHWWN.js";
+} from "./chunk-JFHYXFAL.js";
 import {
   getProxiedTenantId,
   isProxied,
   markProxied,
   unmarkProxied
-} from "./chunk-GKNBECPD.js";
+} from "./chunk-DZKBUOYU.js";
 import {
   resolveContainerProvider
-} from "./chunk-QQGXM2OQ.js";
+} from "./chunk-C7P2TYOG.js";
 import {
   archiveEnvironment,
   createEnvironment,
@@ -32,11 +32,11 @@ import {
   hasSessionsAttached,
   listEnvironments,
   updateEnvironment
-} from "./chunk-BRULBMRN.js";
+} from "./chunk-NSUVDKNC.js";
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 import {
   badRequest,
   conflict,

package/dist/{chunk-UB7GS7XT.js → chunk-A3FQHVUG.js}

@@ -1,19 +1,19 @@
-import {
-  createGeminiTranslator
-} from "./chunk-S3JRZFF5.js";
-import {
-  buildGeminiArgs
-} from "./chunk-IBYOMAZ3.js";
 import {
   buildGeminiAuthEnv,
   validateGeminiRuntime
-} from "./chunk-TJORQTH6.js";
+} from "./chunk-KGOOCFQY.js";
 import {
   prepareGeminiOnSandbox
 } from "./chunk-PAQ2JFVD.js";
+import {
+  createGeminiTranslator
+} from "./chunk-S3JRZFF5.js";
 import {
   GEMINI_WRAPPER_PATH
 } from "./chunk-PZ5EGY64.js";
+import {
+  buildGeminiArgs
+} from "./chunk-IBYOMAZ3.js";
 import {
   wrapPromptWithSystem
 } from "./chunk-YE2RMJY7.js";

package/dist/{chunk-ZP5QO5BR.js → chunk-ABUNDZCE.js}

@@ -13,7 +13,7 @@ import {
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 
 // src/db/upstream_keys.ts
 init_client();

package/dist/{chunk-Q62QJXGO.js → chunk-AGIXZFHQ.js}

@@ -1,7 +1,7 @@
 import {
   init_migrations,
   runMigrations
-} from "./chunk-HDLPEXWS.js";
+} from "./chunk-S5CMAWEC.js";
 import {
   __esm
 } from "./chunk-2ESYSVXG.js";

package/dist/{chunk-ELK5PVI3.js → chunk-AK6HMO7I.js}

@@ -1,32 +1,32 @@
 import {
   resolveRemoteSessionId
-} from "./chunk-MQSTE4WH.js";
+} from "./chunk-ZBWKJ42J.js";
 import {
   assertResourceTenant
 } from "./chunk-23UKWXJH.js";
 import {
   authenticateAndIntercept
-} from "./chunk-BW6OSLW7.js";
+} from "./chunk-CWB2DQN5.js";
 import {
   forwardToAnthropic
-} from "./chunk-IDQKHWWN.js";
+} from "./chunk-JFHYXFAL.js";
 import {
   ensureInitialized
-} from "./chunk-G6XFFNCQ.js";
+} from "./chunk-N7XSXI5O.js";
 import {
   getProxiedTenantId,
   isProxied
-} from "./chunk-GKNBECPD.js";
+} from "./chunk-DZKBUOYU.js";
 import {
   subscribe
-} from "./chunk-2K3UO6TC.js";
+} from "./chunk-RES4BCTF.js";
 import {
   getSession
-} from "./chunk-GBJ3OT4D.js";
+} from "./chunk-ZC7OR65K.js";
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 import {
   notFound,
   toResponse

package/dist/{chunk-BYUIOMPX.js → chunk-AKGWEACL.js}

@@ -5,6 +5,11 @@ import {
   childSpan,
   newTrace
 } from "./chunk-AU4NAQGA.js";
+import {
+  buildErrorPayload,
+  classifyError,
+  init_errors
+} from "./chunk-H6TQGV4L.js";
 import {
   injectMcpAuthHeaders
 } from "./chunk-DBFPJSOY.js";
@@ -16,29 +21,24 @@ import {
 } from "./chunk-72BKGVBE.js";
 import {
   loadSessionSecrets
-} from "./chunk-Z2AVP3QL.js";
-import {
-  buildErrorPayload,
-  classifyError,
-  init_errors
-} from "./chunk-H6TQGV4L.js";
+} from "./chunk-VB6GGRIA.js";
 import {
   isProxied
-} from "./chunk-GKNBECPD.js";
+} from "./chunk-DZKBUOYU.js";
 import {
   acquireForFirstTurn,
   installSkills,
   provisionResources,
   wrapProviderWithSecrets
-} from "./chunk-2REGK4VO.js";
+} from "./chunk-U4SVWPLC.js";
 import {
   BLOCKED_ENV_KEYS,
   resolveVaultSecrets
-} from "./chunk-FQQ2R6FA.js";
+} from "./chunk-JNSJKHYX.js";
 import {
   appendEvent,
   appendEventsBatch
-} from "./chunk-2K3UO6TC.js";
+} from "./chunk-RES4BCTF.js";
 import {
   bumpSessionStats,
   getOutcomeCriteria,
@@ -49,43 +49,43 @@ import {
   setOutcomeCriteria,
   updateSessionMutable,
   updateSessionStatus
-} from "./chunk-GBJ3OT4D.js";
+} from "./chunk-ZC7OR65K.js";
 import {
   listEvents,
   markUserEventProcessed
-} from "./chunk-IS6CQPAQ.js";
+} from "./chunk-OEFJPZYH.js";
 import {
   getBySession
 } from "./chunk-EFOIR7R3.js";
 import {
   resolveProvider,
   resolveProviderName
-} from "./chunk-QQGXM2OQ.js";
+} from "./chunk-C7P2TYOG.js";
 import {
   getEnvironment
-} from "./chunk-BRULBMRN.js";
+} from "./chunk-NSUVDKNC.js";
 import {
   getAgent
-} from "./chunk-ENFWZ2QM.js";
+} from "./chunk-6U6HEVSN.js";
 import {
   resolveBackend
-} from "./chunk-XMZQW5G5.js";
-import {
-  PERMISSION_BRIDGE_PENDING_PATH,
-  PERMISSION_BRIDGE_REQUEST_PATH,
-  PERMISSION_BRIDGE_RESPONSE_PATH
-} from "./chunk-CY6AWCC6.js";
+} from "./chunk-V5RHOS43.js";
 import {
   TOOL_BRIDGE_PENDING_PATH,
   TOOL_BRIDGE_REQUEST_PATH,
   TOOL_BRIDGE_RESPONSE_PATH
 } from "./chunk-VRRGSQI7.js";
+import {
+  PERMISSION_BRIDGE_PENDING_PATH,
+  PERMISSION_BRIDGE_REQUEST_PATH,
+  PERMISSION_BRIDGE_RESPONSE_PATH
+} from "./chunk-CY6AWCC6.js";
 import {
   resolveToolset
 } from "./chunk-FX2AEKOV.js";
 import {
   getConfig
-} from "./chunk-US26CY2Y.js";
+} from "./chunk-6EIONZ7F.js";
 import {
   init_clock,
   nowMs
@@ -139,7 +139,7 @@ async function runTurn(sessionId, inputs, _depth = 0, parentTrace) {
   const backend = resolveBackend(agent.engine);
   const vaultEntries = [];
   if (session.vault_ids && session.vault_ids.length > 0) {
-    const secrets2 = loadSessionSecrets(session.vault_ids);
+    const secrets2 = loadSessionSecrets(session.vault_ids, session.user_profile_id);
     vaultEntries.push(...secrets2.map((s) => ({ key: s.key, value: s.value })));
   }
   const hasVaultKeys = vaultEntries.length > 0;

package/dist/{chunk-NKOGWVP3.js → chunk-AUEKXYNE.js}

@@ -2,19 +2,19 @@ import {
   getSyncRow,
   getSyncedRemoteId,
   upsertSync
-} from "./chunk-MQSTE4WH.js";
+} from "./chunk-ZBWKJ42J.js";
 import {
   injectMcpAuthHeaders
 } from "./chunk-DBFPJSOY.js";
 import {
   listEntries
-} from "./chunk-IC5ZTBAW.js";
+} from "./chunk-MUARVVXF.js";
 import {
   getEnvironment
-} from "./chunk-BRULBMRN.js";
+} from "./chunk-NSUVDKNC.js";
 import {
   getAgent
-} from "./chunk-ENFWZ2QM.js";
+} from "./chunk-6U6HEVSN.js";
 
 // src/sync/anthropic.ts
 import { createHash } from "crypto";

package/dist/{chunk-A6FHXGSI.js → chunk-B24Q4CUC.js}

@@ -4,14 +4,14 @@ import {
 import {
   jsonOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   getProxiedTenantId
-} from "./chunk-GKNBECPD.js";
+} from "./chunk-DZKBUOYU.js";
 import {
   getSession,
   updateSessionResources
-} from "./chunk-GBJ3OT4D.js";
+} from "./chunk-ZC7OR65K.js";
 import {
   countResources,
   createResource,
@@ -20,11 +20,11 @@ import {
   init_session_resources,
   listResources,
   updateResource
-} from "./chunk-FDL2JHXO.js";
+} from "./chunk-GCT7A5KR.js";
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-SKVAM5H2.js → chunk-B3W3E5CS.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-US26CY2Y.js";
+} from "./chunk-6EIONZ7F.js";
 import {
   serverBusy
 } from "./chunk-EZYKRG4W.js";

package/dist/{chunk-5AV732JY.js → chunk-BKMY6TSV.js}

@@ -4,10 +4,10 @@ import {
   getWorkItemInputs,
   heartbeatWorkItem,
   pollWorkItem
-} from "./chunk-A4GJADRQ.js";
+} from "./chunk-JF777FWD.js";
 import {
   runTurn
-} from "./chunk-BYUIOMPX.js";
+} from "./chunk-AKGWEACL.js";
 
 // src/workers/runner.ts
 async function startWorker(opts) {

package/dist/{chunk-H5UBRKRU.js → chunk-C3UXUDZS.js}

@@ -1,6 +1,6 @@
 import {
   SUPPORTED_PROVIDERS
-} from "./chunk-Z5XQQN7H.js";
+} from "./chunk-HWWFRSAX.js";
 import {
   addUpstreamKey,
   deleteUpstreamKey,
@@ -8,20 +8,20 @@ import {
   enableUpstreamKey,
   getUpstreamKey,
   listUpstreamKeys
-} from "./chunk-ZP5QO5BR.js";
+} from "./chunk-ABUNDZCE.js";
 import {
   requireGlobalAdmin
 } from "./chunk-23UKWXJH.js";
 import {
   recordAudit
-} from "./chunk-FC3UAHXM.js";
+} from "./chunk-FDLQ3IUB.js";
 import {
   requireFeature
 } from "./chunk-2N2KL4KM.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-QQGXM2OQ.js → chunk-C7P2TYOG.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-US26CY2Y.js";
+} from "./chunk-6EIONZ7F.js";
 
 // src/providers/registry.ts
 var PROVIDERS = {

package/dist/{chunk-VOHHDBIX.js → chunk-CHNJK2KW.js}

@@ -4,11 +4,11 @@ import {
   getSources,
   getStats,
   searchSkills
-} from "./chunk-R37QM2U4.js";
+} from "./chunk-DF34ESOO.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 
 // src/handlers/skills.ts
 async function handleGetSkillsCatalog(request) {

package/dist/{chunk-A3MNXVCR.js → chunk-CJIGDJIJ.js}

@@ -3,21 +3,21 @@ import {
 } from "./chunk-23UKWXJH.js";
 import {
   recordAudit
-} from "./chunk-FC3UAHXM.js";
+} from "./chunk-FDLQ3IUB.js";
 import {
   requireFeature
 } from "./chunk-2N2KL4KM.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   archiveTenant,
   createTenant,
   getTenant,
   listTenants,
   renameTenant
-} from "./chunk-F5SHFZUA.js";
+} from "./chunk-YTBVILAH.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-BW6OSLW7.js → chunk-CWB2DQN5.js}

@@ -1,6 +1,6 @@
 import {
   forwardToAnthropic
-} from "./chunk-IDQKHWWN.js";
+} from "./chunk-JFHYXFAL.js";
 import {
   isAnthropicApiKey,
   isPassthroughAllowedPath
@@ -8,10 +8,10 @@ import {
 import {
   findByRawKey,
   hydratePermissions
-} from "./chunk-LJNLU5PQ.js";
+} from "./chunk-3NUTTKE5.js";
 import {
   getConfig
-} from "./chunk-US26CY2Y.js";
+} from "./chunk-6EIONZ7F.js";
 import {
   unauthorized
 } from "./chunk-EZYKRG4W.js";
@@ -21,9 +21,17 @@ function extractKey(request) {
   const xKey = request.headers.get("x-api-key");
   if (xKey && xKey.length > 0) return xKey;
   const auth = request.headers.get("authorization") || request.headers.get("Authorization");
-  if (!auth) return null;
-  const m = /^Bearer\s+(.+)$/i.exec(auth);
-  return m ? m[1] : null;
+  if (auth) {
+    const m = /^Bearer\s+(.+)$/i.exec(auth);
+    if (m) return m[1];
+  }
+  try {
+    const url = new URL(request.url);
+    const qKey = url.searchParams.get("x-api-key");
+    if (qKey && qKey.length > 0 && !qKey.startsWith("sk-ant-api")) return qKey;
+  } catch {
+  }
+  return null;
 }
 async function authenticate(request) {
   const key = extractKey(request);

package/dist/{chunk-JC2XJBV2.js → chunk-CWVYFBZF.js}

@@ -7,7 +7,7 @@ import {
   jsonOk,
   paginatedOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   archiveVault,
   createVault,
@@ -19,14 +19,14 @@ import {
   listVaults,
   setEntry,
   updateVault
-} from "./chunk-IC5ZTBAW.js";
+} from "./chunk-MUARVVXF.js";
 import {
   getAgent
-} from "./chunk-ENFWZ2QM.js";
+} from "./chunk-6U6HEVSN.js";
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 import {
   badRequest,
   conflict,

package/dist/{chunk-4ENK7S24.js → chunk-CXYMVLYK.js}

@@ -91,6 +91,8 @@ var init_schema = __esm({
       webhook_secret: text("webhook_secret"),
       // Multi-agent orchestration config:
       multiagent_json: text("multiagent_json"),
+      // Per-agent tool permission overrides:
+      permission_policy_json: text("permission_policy_json"),
       created_at: integer("created_at").notNull()
     }, (table) => [
       primaryKey({ columns: [table.agent_id, table.version] })
@@ -147,6 +149,8 @@ var init_schema = __esm({
       api_key_id: text("api_key_id"),
       // v0.5 ALTER TABLE addition:
       tenant_id: text("tenant_id"),
+      // User profile scoping:
+      user_profile_id: text("user_profile_id"),
       created_at: integer("created_at").notNull(),
       updated_at: integer("updated_at").notNull(),
       archived_at: integer("archived_at")