@agentstep/agent-sdk 0.5.27 → 0.5.33

package/dist/chunk-KLGAE7V4.js

@@ -0,0 +1,108 @@
+import {
+  resolveCreateTenant,
+  tenantFilter
+} from "./chunk-23UKWXJH.js";
+import {
+  jsonOk,
+  paginatedOk,
+  routeWrap
+} from "./chunk-XOWRUT4X.js";
+import {
+  createUserProfile,
+  getUserProfile,
+  listUserProfiles,
+  updateUserProfile
+} from "./chunk-YOZ6WDP3.js";
+import {
+  badRequest,
+  notFound
+} from "./chunk-EZYKRG4W.js";
+
+// src/handlers/user-profiles.ts
+import { z } from "zod";
+var TrustGrantSchema = z.object({
+  type: z.literal("vault_credential"),
+  vault_id: z.string().min(1),
+  credential_id: z.string().min(1)
+});
+var CreateSchema = z.object({
+  external_id: z.string().max(256).optional(),
+  display_name: z.string().max(256).optional(),
+  trust_grants: z.array(TrustGrantSchema).max(50).optional()
+});
+var UpdateSchema = z.object({
+  external_id: z.string().max(256).nullish(),
+  display_name: z.string().max(256).nullish(),
+  trust_grants: z.array(TrustGrantSchema).max(50).optional()
+});
+function handleCreateUserProfile(request) {
+  return routeWrap(request, async ({ auth }) => {
+    const body = await request.json().catch(() => null);
+    const parsed = CreateSchema.safeParse(body);
+    if (!parsed.success) {
+      throw badRequest(`invalid body: ${parsed.error.issues.map((i) => i.message).join("; ")}`);
+    }
+    const tenantId = resolveCreateTenant(auth, void 0);
+    const profile = createUserProfile({
+      external_id: parsed.data.external_id,
+      display_name: parsed.data.display_name,
+      trust_grants: parsed.data.trust_grants,
+      tenant_id: tenantId
+    });
+    return jsonOk(profile, 201);
+  });
+}
+function handleListUserProfiles(request) {
+  return routeWrap(request, async ({ auth }) => {
+    const url = new URL(request.url);
+    const limit = Math.min(Number(url.searchParams.get("limit") ?? 50), 100);
+    const afterId = url.searchParams.get("after_id") ?? void 0;
+    const filter = tenantFilter(auth);
+    const result = listUserProfiles({
+      tenant_id: filter ?? void 0,
+      limit,
+      after_id: afterId
+    });
+    return paginatedOk(result.data, limit);
+  });
+}
+function handleGetUserProfile(request, id) {
+  return routeWrap(request, async ({ auth }) => {
+    const profile = getUserProfile(id);
+    if (!profile) throw notFound(`user profile not found: ${id}`);
+    const filter = tenantFilter(auth);
+    if (filter && profile.tenant_id !== filter) {
+      throw notFound(`user profile not found: ${id}`);
+    }
+    return jsonOk(profile);
+  });
+}
+function handleUpdateUserProfile(request, id) {
+  return routeWrap(request, async ({ auth }) => {
+    const existing = getUserProfile(id);
+    if (!existing) throw notFound(`user profile not found: ${id}`);
+    const filter = tenantFilter(auth);
+    if (filter && existing.tenant_id !== filter) {
+      throw notFound(`user profile not found: ${id}`);
+    }
+    const body = await request.json().catch(() => null);
+    const parsed = UpdateSchema.safeParse(body);
+    if (!parsed.success) {
+      throw badRequest(`invalid body: ${parsed.error.issues.map((i) => i.message).join("; ")}`);
+    }
+    const updated = updateUserProfile(id, {
+      external_id: parsed.data.external_id,
+      display_name: parsed.data.display_name,
+      trust_grants: parsed.data.trust_grants
+    });
+    if (!updated) throw notFound(`user profile not found: ${id}`);
+    return jsonOk(updated);
+  });
+}
+
+export {
+  handleCreateUserProfile,
+  handleListUserProfiles,
+  handleGetUserProfile,
+  handleUpdateUserProfile
+};

package/dist/{chunk-VEPT2NDJ.js → chunk-KSL2D4AD.js}

@@ -7,16 +7,16 @@ import {
   pollWorkItem,
   stopWorkItem,
   updateWorkItemMetadata
-} from "./chunk-A4GJADRQ.js";
+} from "./chunk-JF777FWD.js";
 import {
   decodeCursor,
   jsonOk,
   paginatedOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   getEnvironment
-} from "./chunk-BRULBMRN.js";
+} from "./chunk-NSUVDKNC.js";
 import {
   badRequest,
   notFound

package/dist/{chunk-MNW6D7T4.js → chunk-M72ERPMT.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-US26CY2Y.js";
+} from "./chunk-6EIONZ7F.js";
 
 // src/backends/factory/auth.ts
 function buildFactoryAuthEnv() {

package/dist/{chunk-IC5ZTBAW.js → chunk-MUARVVXF.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-AIBH32FN.js";
 import {
   DEFAULT_TENANT_ID
-} from "./chunk-F5SHFZUA.js";
+} from "./chunk-YTBVILAH.js";
 import {
   init_ids,
   newId
@@ -17,10 +17,10 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-7U62OZSD.js";
+} from "./chunk-ZDDMPGN4.js";
 import {
   schema_exports
-} from "./chunk-4ENK7S24.js";
+} from "./chunk-CXYMVLYK.js";
 
 // src/db/vaults.ts
 init_drizzle();

package/dist/{chunk-G6XFFNCQ.js → chunk-N7XSXI5O.js}

@@ -1,60 +1,60 @@
-import {
-  enqueueTurn
-} from "./chunk-SKVAM5H2.js";
 import {
   runTurn
-} from "./chunk-BYUIOMPX.js";
+} from "./chunk-AKGWEACL.js";
 import {
-  installOtlpExporter
-} from "./chunk-PZKWZKRP.js";
+  enqueueTurn
+} from "./chunk-B3W3E5CS.js";
 import {
   redactAppendInput
-} from "./chunk-ISGA4AOC.js";
+} from "./chunk-J6ESQUW6.js";
+import {
+  installOtlpExporter
+} from "./chunk-2KF2TIEY.js";
 import {
   createApiKey,
   listApiKeys
-} from "./chunk-LJNLU5PQ.js";
+} from "./chunk-3NUTTKE5.js";
 import {
   initSentry
 } from "./chunk-3MQ2FWXS.js";
 import {
   installShutdownHandlers
-} from "./chunk-KD5Y4XSU.js";
+} from "./chunk-S6HILC3F.js";
 import {
   runSweep
-} from "./chunk-HPL2MQGY.js";
+} from "./chunk-T3TNJHED.js";
 import {
   fillWarmPools,
   reconcileDockerOrphanSandboxes,
   reconcileOrphanSandboxes
-} from "./chunk-2REGK4VO.js";
+} from "./chunk-U4SVWPLC.js";
 import {
   appendEvent,
   installPayloadRedactor
-} from "./chunk-2K3UO6TC.js";
+} from "./chunk-RES4BCTF.js";
 import {
   setSessionSandbox
-} from "./chunk-GBJ3OT4D.js";
+} from "./chunk-ZC7OR65K.js";
 import {
   readEnvValue,
   upsertEnvLine
 } from "./chunk-YPXI7Q2M.js";
 import {
   getLastUnprocessedUserMessage
-} from "./chunk-IS6CQPAQ.js";
+} from "./chunk-OEFJPZYH.js";
 import {
   getBySession,
   register
 } from "./chunk-EFOIR7R3.js";
 import {
   tryResolveProvider
-} from "./chunk-QQGXM2OQ.js";
+} from "./chunk-C7P2TYOG.js";
 import {
   getEnvironment
-} from "./chunk-BRULBMRN.js";
+} from "./chunk-NSUVDKNC.js";
 import {
   getConfig
-} from "./chunk-US26CY2Y.js";
+} from "./chunk-6EIONZ7F.js";
 import {
   init_clock,
   nowMs
@@ -62,7 +62,7 @@ import {
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 import {
   getRuntime
 } from "./chunk-UYTSKFGK.js";

package/dist/{chunk-NOW46DBT.js → chunk-NLJK7FEN.js}

@@ -1,13 +1,13 @@
 import {
   jsonOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   resolveContainerProvider
-} from "./chunk-QQGXM2OQ.js";
+} from "./chunk-C7P2TYOG.js";
 import {
   getConfig
-} from "./chunk-US26CY2Y.js";
+} from "./chunk-6EIONZ7F.js";
 
 // src/handlers/providers.ts
 var LOCAL_PROVIDERS = ["docker", "apple-container", "podman"];

package/dist/{chunk-BRULBMRN.js → chunk-NSUVDKNC.js}

@@ -1,6 +1,6 @@
 import {
   DEFAULT_TENANT_ID
-} from "./chunk-F5SHFZUA.js";
+} from "./chunk-YTBVILAH.js";
 import {
   init_ids,
   newId
@@ -13,10 +13,10 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-7U62OZSD.js";
+} from "./chunk-ZDDMPGN4.js";
 import {
   schema_exports
-} from "./chunk-4ENK7S24.js";
+} from "./chunk-CXYMVLYK.js";
 
 // src/db/environments.ts
 init_drizzle();

package/dist/{chunk-IS6CQPAQ.js → chunk-OEFJPZYH.js}

@@ -10,14 +10,14 @@ import {
 import {
   getDrizzle,
   init_drizzle
-} from "./chunk-7U62OZSD.js";
+} from "./chunk-ZDDMPGN4.js";
 import {
   schema_exports
-} from "./chunk-4ENK7S24.js";
+} from "./chunk-CXYMVLYK.js";
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 
 // src/db/events.ts
 init_client();

package/dist/{chunk-P56WU3UT.js → chunk-PDWLVL34.js}

@@ -1,15 +1,18 @@
 // src/backends/opencode/args.ts
+function normalizeOpencodeModel(model) {
+  if (model.includes("/")) return model;
+  if (model.startsWith("claude-")) return `anthropic/${model}`;
+  if (model.startsWith("gemini-")) return `google/${model}`;
+  if (model.startsWith("gpt-") || model.startsWith("o1-") || model.startsWith("o3-") || model.startsWith("o4-") || model.startsWith("chatgpt-")) return `openai/${model}`;
+  return `ollama/${model}`;
+}
 function buildOpencodeArgs(input) {
   const args = ["run", "--format", "json", "--dangerously-skip-permissions"];
   if (input.backendSessionId) {
     args.push("--session", input.backendSessionId);
   }
   if (input.agent.model) {
-    const modelId = input.agent.model.id;
-    const cloudPrefixes = ["claude-", "gpt-", "o1-", "o3-", "o4-", "codex-", "chatgpt-", "gemini-"];
-    const isOllama = !modelId.includes("/") && !cloudPrefixes.some((p) => modelId.startsWith(p));
-    const modelArg = isOllama ? `ollama/${modelId}` : modelId;
-    args.push("--model", modelArg);
+    args.push("--model", normalizeOpencodeModel(input.agent.model.id));
   }
   return args;
 }

package/dist/{chunk-I2WVMCYN.js → chunk-PWLWDWRL.js}

@@ -84,7 +84,7 @@ import {
   VaultListResponseSchema,
   VaultSchema,
   WhoamiResponseSchema
-} from "./chunk-CBPO2P4I.js";
+} from "./chunk-SAI6LBXW.js";
 import {
   registry
 } from "./chunk-7346CKTF.js";

package/dist/{chunk-JTGISCYV.js → chunk-QCGIYXN4.js}

@@ -1,6 +1,6 @@
 import {
   getConfig
-} from "./chunk-US26CY2Y.js";
+} from "./chunk-6EIONZ7F.js";
 
 // src/backends/opencode/auth.ts
 function buildOpencodeAuthEnv() {

package/dist/{chunk-6B66DQAS.js → chunk-QGPHATO3.js}

@@ -1,10 +1,10 @@
 import {
   getModels
-} from "./chunk-WHTGWLGJ.js";
+} from "./chunk-UTGP4X74.js";
 import {
   jsonOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 
 // src/handlers/models.ts
 function handleListModels(request) {

package/dist/{chunk-YS3W5AQA.js → chunk-REHIJQUD.js}

@@ -1,22 +1,22 @@
-import {
-  buildOpencodeArgs
-} from "./chunk-P56WU3UT.js";
-import {
-  buildOpencodeAuthEnv,
-  validateOpencodeRuntime
-} from "./chunk-JTGISCYV.js";
 import {
   buildOpencodeConfigEnv
 } from "./chunk-V5DH3OAC.js";
 import {
   prepareOpencodeOnSandbox
 } from "./chunk-URNG7ZX2.js";
+import {
+  createOpencodeTranslator
+} from "./chunk-ETWGCBIQ.js";
 import {
   OPENCODE_WRAPPER_PATH
 } from "./chunk-UY3VT3HQ.js";
 import {
-  createOpencodeTranslator
-} from "./chunk-ETWGCBIQ.js";
+  buildOpencodeArgs
+} from "./chunk-PDWLVL34.js";
+import {
+  buildOpencodeAuthEnv,
+  validateOpencodeRuntime
+} from "./chunk-QCGIYXN4.js";
 import {
   wrapPromptWithSystem
 } from "./chunk-YE2RMJY7.js";

package/dist/{chunk-2K3UO6TC.js → chunk-RES4BCTF.js}

@@ -1,19 +1,19 @@
 import {
   getSession
-} from "./chunk-GBJ3OT4D.js";
+} from "./chunk-ZC7OR65K.js";
 import {
   appendEvent,
   appendEventsBatch,
   listEvents,
   rowToManagedEvent
-} from "./chunk-IS6CQPAQ.js";
+} from "./chunk-OEFJPZYH.js";
 import {
   getAgent
-} from "./chunk-ENFWZ2QM.js";
+} from "./chunk-6U6HEVSN.js";
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 
 // src/sessions/bus.ts
 import { EventEmitter } from "events";

package/dist/{chunk-HDLPEXWS.js → chunk-S5CMAWEC.js}

@@ -636,6 +636,26 @@ function runMigrations(db) {
       db.exec(`CREATE INDEX IF NOT EXISTS idx_vaults_tenant ON vaults(tenant_id)`);
     }
   }
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS user_profiles (
+      id TEXT PRIMARY KEY,
+      external_id TEXT,
+      display_name TEXT,
+      trust_grants_json TEXT NOT NULL DEFAULT '[]',
+      tenant_id TEXT,
+      created_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      UNIQUE(tenant_id, external_id)
+    )
+  `);
+  try {
+    db.exec(`ALTER TABLE sessions ADD COLUMN user_profile_id TEXT`);
+  } catch {
+  }
+  try {
+    db.exec(`ALTER TABLE agent_versions ADD COLUMN permission_policy_json TEXT`);
+  } catch {
+  }
 }
 var init_migrations = __esm({
   "src/db/migrations.ts"() {

package/dist/{chunk-KD5Y4XSU.js → chunk-S6HILC3F.js}

@@ -1,11 +1,11 @@
 import {
   markStopping
-} from "./chunk-HPL2MQGY.js";
+} from "./chunk-T3TNJHED.js";
 import {
   closeDb,
   init_client,
   syncDb
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 import {
   getRuntime
 } from "./chunk-UYTSKFGK.js";

package/dist/{chunk-CBPO2P4I.js → chunk-SAI6LBXW.js}

@@ -139,7 +139,7 @@ var CreateAgentRequestSchema = registry.register(
   "CreateAgentRequest",
   z.object({
     name: z.string().min(1).openapi({ example: "my-agent" }),
-    model: z.object({ id: z.string().min(1), speed: z.enum(["standard", "fast"]).optional() }).openapi({ description: "Model configuration. `id` is the canonical model identifier.", example: { id: "claude-sonnet-4-6" } }),
+    model: z.object({ id: z.string().min(1), speed: z.enum(["standard", "fast"]).optional() }).openapi({ description: "Model configuration. `id` is the bare model identifier (e.g. `gemini-2.5-flash`, `claude-sonnet-4-6`, `gpt-5.4`). Do not include provider prefixes.", example: { id: "claude-sonnet-4-6" } }),
     description: z.string().max(2048).optional().openapi({
       description: "Human-readable description of the agent."
     }),
@@ -156,7 +156,7 @@ var CreateAgentRequestSchema = registry.register(
       description: "MCP servers as an array of objects with name, type, and optional url."
     }),
     engine: z.enum(["claude", "opencode", "codex", "anthropic", "gemini", "factory", "pi"]).optional().openapi({
-      description: "Agent harness. Defaults to `claude`. Opencode agents must set `model` to a `provider/model` string (e.g. `anthropic/claude-sonnet-4-6`) and must NOT declare `tools` \u2014 opencode manages its tool surface internally. Gemini agents require GEMINI_API_KEY. Factory agents require FACTORY_API_KEY. Pi agents (pi.dev) require at least one of ANTHROPIC_API_KEY, OPENAI_API_KEY, or GEMINI_API_KEY.",
+      description: "Agent harness. Auto-inferred from model prefix if omitted: `gemini-*` \u2192 gemini, `gpt-*`/`o1-*` \u2192 codex, `claude-*` \u2192 claude. Always use bare model IDs (`gemini-2.5-flash`, not `google/gemini-2.5-flash`) \u2014 provider prefixes are added internally where needed. Non-claude engines must NOT declare `tools` (they manage tool permissions internally). Required vault keys: claude \u2192 ANTHROPIC_API_KEY, gemini \u2192 GEMINI_API_KEY, codex \u2192 OPENAI_API_KEY, pi \u2192 any of the three.",
       example: "claude"
     }),
     webhook_url: z.string().url().optional().openapi({

package/dist/{chunk-EY7LWGRO.js → chunk-SDTRWSGF.js}

@@ -1,10 +1,10 @@
 import {
   syncAndCreateSession
-} from "./chunk-NKOGWVP3.js";
+} from "./chunk-AUEKXYNE.js";
 import {
   resolveRemoteSessionId,
   upsertSync
-} from "./chunk-MQSTE4WH.js";
+} from "./chunk-ZBWKJ42J.js";
 import {
   assertResourceTenant,
   tenantFilter
@@ -14,19 +14,19 @@ import {
 } from "./chunk-DC2UMEQH.js";
 import {
   getMemoryStore
-} from "./chunk-GNXIA5WC.js";
+} from "./chunk-TVV7AE3G.js";
 import {
   kickoffEnvironmentSetup
-} from "./chunk-7DPZMROX.js";
+} from "./chunk-YRFWPBGX.js";
 import {
   decodeCursor,
   jsonOk,
   paginatedOk,
   routeWrap
-} from "./chunk-I2GML5Z7.js";
+} from "./chunk-XOWRUT4X.js";
 import {
   forwardToAnthropic
-} from "./chunk-IDQKHWWN.js";
+} from "./chunk-JFHYXFAL.js";
 import {
   errors_exports,
   init_errors
@@ -36,32 +36,33 @@ import {
   isProxied,
   markProxied,
   unmarkProxied
-} from "./chunk-GKNBECPD.js";
+} from "./chunk-DZKBUOYU.js";
 import {
   dropActor,
   getActor
 } from "./chunk-LAWTTG2E.js";
 import {
   releaseSession
-} from "./chunk-2REGK4VO.js";
+} from "./chunk-U4SVWPLC.js";
 import {
   appendEvent,
   dropEmitter
-} from "./chunk-2K3UO6TC.js";
+} from "./chunk-RES4BCTF.js";
 import {
   archiveSession,
   createSession,
   getSession,
   listSessions,
+  setOutcomeCriteria,
   updateSessionMutable,
   updateSessionStatus
-} from "./chunk-GBJ3OT4D.js";
+} from "./chunk-ZC7OR65K.js";
 import {
   getEnvironment
-} from "./chunk-BRULBMRN.js";
+} from "./chunk-NSUVDKNC.js";
 import {
   getAgent
-} from "./chunk-ENFWZ2QM.js";
+} from "./chunk-6U6HEVSN.js";
 import {
   init_clock,
   nowMs
@@ -69,7 +70,7 @@ import {
 import {
   getDb,
   init_client
-} from "./chunk-Q62QJXGO.js";
+} from "./chunk-AGIXZFHQ.js";
 import {
   badRequest,
   notFound
@@ -149,7 +150,17 @@ var CreateSchema = z.object({
   max_tokens: z.number().int().positive().optional(),
   max_wall_duration_ms: z.number().int().positive().optional(),
   resources: z.array(ResourceSchema).optional(),
-  vault_ids: z.array(z.string()).optional()
+  vault_ids: z.array(z.string()).optional(),
+  user_profile_id: z.string().optional(),
+  outcomes: z.object({
+    description: z.string().min(1),
+    rubric: z.array(z.object({
+      name: z.string(),
+      description: z.string(),
+      weight: z.number().optional()
+    })).optional(),
+    max_iterations: z.number().int().min(1).max(10).optional()
+  }).optional()
 });
 var UpdateSchema = z.object({
   title: z.string().nullish(),
@@ -250,6 +261,14 @@ function handleCreateSession(request) {
           }
         }
       }
+      if (data.user_profile_id) {
+        const { getUserProfile } = await import("./db/user-profiles.js");
+        const profile = getUserProfile(data.user_profile_id);
+        if (!profile) throw badRequest(`user profile not found: ${data.user_profile_id}`);
+        if (profile.tenant_id && profile.tenant_id !== agentTenantId) {
+          throw badRequest(`user profile does not belong to this tenant`);
+        }
+      }
       if (data.resources?.length) {
         const memStoreResources = data.resources.filter((r) => r.type === "memory_store");
         if (memStoreResources.length > 8) {
@@ -296,6 +315,7 @@ function handleCreateSession(request) {
           max_wall_duration_ms: data.max_wall_duration_ms ?? null,
           resources: data.resources?.length ? data.resources : null,
           vault_ids: data.vault_ids?.length ? data.vault_ids : null,
+          user_profile_id: data.user_profile_id ?? null,
           api_key_id: auth.keyId,
           tenant_id: agentTenantId
         });
@@ -335,6 +355,14 @@ function handleCreateSession(request) {
         });
         upsertSync(session2.id, "session", remoteSessionId);
         markProxied(session2.id, "session", agentTenantId);
+        if (data.outcomes) {
+          setOutcomeCriteria(session2.id, {
+            description: data.outcomes.description,
+            rubric: data.outcomes.rubric ?? [],
+            max_iterations: data.outcomes.max_iterations ?? 3,
+            status: "running"
+          });
+        }
         getActor(session2.id);
         return jsonOk(session2, 201);
       }
@@ -357,6 +385,7 @@ function handleCreateSession(request) {
         max_wall_duration_ms: data.max_wall_duration_ms ?? null,
         resources: data.resources?.length ? data.resources : null,
         vault_ids: data.vault_ids?.length ? data.vault_ids : null,
+        user_profile_id: data.user_profile_id ?? null,
         api_key_id: auth.keyId,
         tenant_id: agentTenantId
       });
@@ -391,6 +420,14 @@ function handleCreateSession(request) {
           });
         }
       }
+      if (data.outcomes) {
+        setOutcomeCriteria(session.id, {
+          description: data.outcomes.description,
+          rubric: data.outcomes.rubric ?? [],
+          max_iterations: data.outcomes.max_iterations ?? 3,
+          status: "running"
+        });
+      }
       getActor(session.id);
       return jsonOk(session, 201);
     }