@ai-workbench/remote-agent 0.0.0-stage → 0.8.1

package/dist/conversation-details.js

@@ -0,0 +1,319 @@
+import { randomUUID } from 'node:crypto';
+const redactionMarkers = new WeakSet();
+function redaction(fields) {
+    const marker = { redacted: true, ...fields };
+    redactionMarkers.add(marker);
+    return marker;
+}
+/** Only objects created by this module are trusted as redaction markers. */
+export function isSanitizedRedaction(value) {
+    return value !== null && typeof value === 'object' && redactionMarkers.has(value);
+}
+const sensitiveWords = new Set(['auth', 'token', 'tokens', 'password', 'passwords', 'passwd', 'secret', 'secrets', 'authorization', 'cookie', 'cookies', 'credential', 'credentials', 'key', 'keys']);
+const sensitiveCompounds = new Set([
+    'apikey', 'privatekey', 'publickey', 'accesskey', 'secretkey', 'sshkey', 'encryptionkey', 'signingkey',
+    'devicecode', 'usercode', 'onetimecode', 'verificationcode', 'codeverifier', 'authcode', 'authorizationcode', 'authpayload', 'authorizationpayload',
+    'accesstoken', 'refreshtoken', 'idtoken', 'apitoken', 'authtoken', 'sessiontoken', 'bearertoken',
+    'clientsecret', 'tokenpayload', 'tokenvalue', 'passwordpayload', 'passwordvalue', 'secretpayload', 'secretvalue',
+    'credentialpayload', 'credentialspayload', 'cookiepayload', 'keypayload',
+]);
+// These whole words are safe despite containing a credential-like substring.
+// redactedKeys is the recorder's explicit entry-wrapper marker and is stable
+// across repeated sanitization. It is not an exception for arbitrary values.
+const safeWholeFieldWords = new Set(['author', 'monkey', 'keyboard', 'secretary', 'keyword', 'keywords', 'tokenizer', 'tokenization', 'redactedkeys']);
+// A recognized suffix supplies a field boundary after case information is lost.
+// Prefixes remain unrestricted: employeePassword and customApiKey must not depend
+// on an inventory of employee/customer/application-specific field prefixes.
+const sensitiveFieldSuffixes = new Set([
+    '', 'code', 'payload', 'value', 'values', 'data', 'header', 'headers', 'config', 'configuration',
+    'option', 'options', 'detail', 'details', 'info',
+]);
+const unsafeKeys = new Set(['__proto__', 'constructor', 'prototype']);
+function isSensitiveFieldWord(word) {
+    if (safeWholeFieldWords.has(word))
+        return false;
+    if (sensitiveWords.has(word) || sensitiveCompounds.has(word))
+        return true;
+    for (const root of sensitiveWords) {
+        for (let index = word.indexOf(root); index !== -1; index = word.indexOf(root, index + 1)) {
+            // Match roots at the start, or roots ending a field (possibly followed by
+            // a known suffix), rather than fuzzy containment at any word position.
+            if (index === 0 || sensitiveFieldSuffixes.has(word.slice(index + root.length)))
+                return true;
+        }
+    }
+    return false;
+}
+function isSensitiveKey(key) {
+    if (safeWholeFieldWords.has(key.toLowerCase()))
+        return false;
+    // Preserve the original camel/delimiter rule. Anchored field-shape matching
+    // additionally recognizes the same common fields after case normalization.
+    const camelWords = key.replace(/([a-z0-9])([A-Z])/g, '$1 $2').toLowerCase().split(/[^a-z0-9]+/);
+    const words = key.toLowerCase().split(/[^a-z0-9]+/);
+    return camelWords.some(word => sensitiveWords.has(word)) || words.some(isSensitiveFieldWord)
+        || sensitiveCompounds.has(key.replace(/[^a-z0-9]/gi, '').toLowerCase());
+}
+function unsupported(type, reason) {
+    return { unsupported: true, type, reason };
+}
+function credentialText(value) {
+    return /\bBearer\s+\S+/i.test(value)
+        || /\bsk-[a-z\d_-]+/i.test(value)
+        || /-----BEGIN (?:[A-Z\d]+ )*PRIVATE KEY-----/i.test(value)
+        || /\b(?:gh[pousr]_|github_pat_|xox[baprs]-)[a-z\d_-]+/i.test(value);
+}
+function cleanUrls(value) {
+    let changed = false;
+    const safe = value.replace(/\b[a-z][a-z\d+.-]*:\/\/[^\s<>"'`]+/gi, raw => {
+        let url;
+        try {
+            url = new URL(raw);
+        }
+        catch {
+            changed = true;
+            return '[已脱敏：无法解析URL]';
+        }
+        const userinfo = /^[a-z][a-z\d+.-]*:\/\/[^/?#]*@/i.test(raw);
+        if (!userinfo && !raw.includes('?') && !raw.includes('#'))
+            return raw;
+        url.username = '';
+        url.password = '';
+        url.search = '';
+        url.hash = '';
+        changed = true;
+        return url.toString();
+    });
+    return { value: safe, changed };
+}
+function safeText(value) {
+    if (credentialText(value))
+        return redaction({ reason: '凭据文本' });
+    const url = cleanUrls(value);
+    return url.changed ? redaction({ reason: 'URL敏感部分', value: url.value }) : value;
+}
+function safeLabel(value) {
+    if (typeof value !== 'string')
+        throw new TypeError('Detail observation labels must be strings');
+    // Inspect credentials before removing control characters, so a bearer newline cannot evade detection.
+    if (credentialText(value))
+        return '[已脱敏：凭据文本]';
+    const cleaned = value.replace(/[\u0000-\u001f\u007f-\u009f]/g, '');
+    if (credentialText(cleaned))
+        return '[已脱敏：凭据文本]';
+    const url = cleanUrls(cleaned);
+    return url.changed ? `[已脱敏：URL敏感部分] ${url.value}` : cleaned;
+}
+/** JSON-only snapshot. Non-JSON input is represented, never coerced or executed. */
+function snapshotPayload(value, ancestors = new Set(), protectModelMaterial = false) {
+    if (isSanitizedRedaction(value))
+        return value;
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'string')
+        return safeText(value);
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? value : unsupported('number', '非有限数值不能表示为JSON');
+    if (typeof value !== 'object')
+        return unsupported(typeof value, '非JSON值');
+    if (ancestors.has(value))
+        return unsupported('object', '循环引用');
+    let descriptors;
+    let isArray;
+    try {
+        isArray = Array.isArray(value);
+        const prototype = Object.getPrototypeOf(value);
+        if (!isArray && prototype !== Object.prototype && prototype !== null)
+            return unsupported('object', '非JSON普通对象');
+        if (Object.getOwnPropertySymbols(value).some(symbol => Object.getOwnPropertyDescriptor(value, symbol)?.enumerable)) {
+            return unsupported('object', 'JSON不能表示符号字段');
+        }
+        descriptors = Object.getOwnPropertyDescriptors(value);
+    }
+    catch {
+        return unsupported('object', '无法读取对象结构');
+    }
+    if (Object.keys(descriptors).some(key => descriptors[key].enumerable && unsafeKeys.has(key))) {
+        return unsupported('object', '不允许的原型字段');
+    }
+    ancestors.add(value);
+    try {
+        if (isArray) {
+            // Array metadata beyond indexed items is not representable in a JSON array.
+            const length = descriptors.length?.value;
+            if (Object.keys(descriptors).some(key => descriptors[key].enumerable && (!/^(0|[1-9]\d*)$/.test(key) || Number(key) >= length))) {
+                return unsupported('array', 'JSON数组不能表示额外字段');
+            }
+            return Array.from({ length }, (_, index) => {
+                const descriptor = descriptors[String(index)];
+                return !descriptor ? unsupported('undefined', '数组空位')
+                    : 'value' in descriptor ? snapshotPayload(descriptor.value, ancestors, protectModelMaterial)
+                        : unsupported('accessor', '不执行访问器');
+            });
+        }
+        const result = {};
+        const entries = [];
+        let redactedKeys = false;
+        for (const [key, descriptor] of Object.entries(descriptors)) {
+            if (!descriptor.enumerable)
+                continue;
+            const name = safeText(key);
+            const value = 'value' in descriptor ? descriptor.value : undefined;
+            const normalized = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+            const counterNames = new Set(['inputtokens', 'outputtokens', 'cachedinputtokens', 'cachedreadtokens', 'cachedwritetokens', 'thoughtTokens'.toLowerCase(), 'totaltokens', 'cachewriteinputtokens', 'cachereadinputtokens', 'reasoningoutputtokens']);
+            const validCounter = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0;
+            const counter = counterNames.has(normalized) && validCounter(value)
+                || normalized === 'tokencount' && value !== null && typeof value === 'object' && Object.values(Object.getOwnPropertyDescriptors(value)).every(d => 'value' in d && validCounter(d.value)) && Object.keys(value).every(k => counterNames.has(k.replace(/[^a-z0-9]/gi, '').toLowerCase()));
+            const material = protectModelMaterial && (/(?:headers?|body|oldtext|newtext|aggregatedoutput|stdout|stderr)$/.test(normalized)
+                || ['text', 'content', 'prompt', 'input', 'output', 'rawinput', 'rawoutput', 'messages', 'modelinput', 'modeloutput', 'patch', 'diff', 'arguments', 'command', 'commandline', 'filecontent', 'data', 'message', 'usercode', 'devicecode', 'onetimecode'].includes(normalized));
+            const child = ((!counter && isSensitiveKey(key)) || material) ? redaction({ reason: '敏感字段' })
+                : 'value' in descriptor ? snapshotPayload(descriptor.value, ancestors, protectModelMaterial)
+                    : unsupported('accessor', '不执行访问器');
+            if (typeof name !== 'string')
+                redactedKeys = true;
+            // Only safe property names may become object keys. The entry form keeps
+            // distinct original fields even when multiple names redact identically.
+            if (typeof name === 'string')
+                result[name] = child;
+            entries.push({ name, value: child });
+        }
+        return redactedKeys ? { redactedKeys: true, entries } : result;
+    }
+    finally {
+        ancestors.delete(value);
+    }
+}
+function freezeDeep(value) {
+    if (value !== null && typeof value === 'object') {
+        for (const child of Object.values(value))
+            freezeDeep(child);
+        Object.freeze(value);
+    }
+    return value;
+}
+function cloneFrozen(value) { return freezeDeep(structuredClone(value)); }
+/** No raw values from unclassified events or tool I/O are approved. The
+ * structure and original JSON types remain inspectable, including unknown keys. */
+function opaqueStructure(value) {
+    if (Array.isArray(value))
+        return value.map(opaqueStructure);
+    if (value !== null && typeof value === 'object') {
+        if (isSanitizedRedaction(value))
+            return value;
+        return Object.fromEntries(Object.entries(value).map(([name, child]) => [name, opaqueStructure(child)]));
+    }
+    return redaction({ valueType: value === null ? 'null' : typeof value });
+}
+/** Structural identifiers are approved only at the SDK/ACP envelope and its
+ * immediate item/update. Arbitrary result subtrees never inherit that trust. */
+function toolStructure(value, level = 'envelope') {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return opaqueStructure(value);
+    if (isSanitizedRedaction(value))
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        const field = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+        if (typeof child === 'string' && ['id', 'type', 'kind', 'status', 'code', 'name', 'toolcallid', 'optionid', 'sessionid', 'sessionupdate'].includes(field))
+            return [key, child];
+        if (typeof child === 'number' && ['exitcode', 'durationms'].includes(field))
+            return [key, child];
+        if (level === 'envelope' && ['item', 'update', 'toolCall'].includes(key))
+            return [key, toolStructure(child, 'item')];
+        return [key, opaqueStructure(child)];
+    }));
+}
+function catalogStructure(value, level = 'root') {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return opaqueStructure(value);
+    if (isSanitizedRedaction(value))
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        if (typeof child === 'string' && ((level === 'entry' && ['name', 'description'].includes(key)) || (level === 'input' && key === 'hint') || (level === 'root' && ['sessionId', 'sessionUpdate'].includes(key))))
+            return [key, child];
+        if (level === 'root' && key === 'update')
+            return [key, catalogStructure(child)];
+        if (level === 'root' && key === 'availableCommands' && Array.isArray(child))
+            return [key, child.map(v => catalogStructure(v, 'entry'))];
+        if (level === 'entry' && key === 'input')
+            return [key, child === null ? null : catalogStructure(child, 'input')];
+        return [key, opaqueStructure(child)];
+    }));
+}
+function usageStructure(value, key = '') {
+    if (Array.isArray(value))
+        return value.map(child => usageStructure(child));
+    if (value !== null && typeof value === 'object') {
+        if (isSanitizedRedaction(value))
+            return value;
+        return Object.fromEntries(Object.entries(value).map(([name, child]) => [name, usageStructure(child, name)]));
+    }
+    const field = key.replace(/[^a-z0-9]/gi, '').toLowerCase();
+    if (typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 && ['inputtokens', 'outputtokens', 'cachedinputtokens', 'cachedreadtokens', 'cachedwritetokens', 'thoughttokens', 'totaltokens', 'cachewriteinputtokens', 'cachereadinputtokens', 'reasoningoutputtokens'].includes(field))
+        return value;
+    if (key === 'stopReason' && typeof value === 'string' && ['end_turn', 'max_tokens', 'max_turn_requests', 'refusal', 'cancelled'].includes(value))
+        return value;
+    return opaqueStructure(value);
+}
+/** Sanitize an internal observation without attaching any L wire semantics. */
+export function sanitizeObservation(observation, protectModelMaterial = false) {
+    const payload = snapshotPayload(observation.payload, new Set(), protectModelMaterial && observation.kind !== 'commands');
+    return freezeDeep({
+        kind: observation.kind, severity: observation.severity,
+        code: safeLabel(observation.code), summary: safeLabel(observation.summary),
+        ...(observation.method === undefined ? {} : { method: safeLabel(observation.method) }),
+        payload: !protectModelMaterial ? payload
+            : observation.kind === 'commands' ? catalogStructure(payload)
+                : observation.kind === 'usage' ? usageStructure(payload)
+                    : observation.kind === 'need' ? payload
+                        : observation.kind === 'tool' || ['SDK_ITEM', 'SDK_TOOL', 'ACP_SESSION_UPDATE', 'ACP_IDLE_UPDATE'].includes(observation.code) ? toolStructure(payload)
+                            : opaqueStructure(payload),
+    });
+}
+function validatedScope(scope) {
+    for (const name of ['instanceId', 'sessionId']) {
+        if (typeof scope[name] !== 'string' || scope[name].trim().length === 0)
+            throw new TypeError(`Invalid detail scope ${name}`);
+    }
+    for (const name of ['epoch', 'turn', 'step']) {
+        if (!Number.isInteger(scope[name]) || scope[name] < (name === 'epoch' ? 0 : 1))
+            throw new TypeError(`Invalid detail scope ${name}`);
+    }
+    if (scope.provider !== 'claude' && scope.provider !== 'codex')
+        throw new TypeError('Invalid detail scope provider');
+    return { instanceId: scope.instanceId, epoch: scope.epoch, sessionId: scope.sessionId, provider: scope.provider, turn: scope.turn, step: scope.step };
+}
+/** Internal diagnostic recorder; a sink is not an assertion that an L wire API exists. */
+export class ConversationDetails {
+    scope;
+    sink;
+    records = [];
+    tail = Promise.resolve();
+    firstFailure;
+    constructor(scope, sink) {
+        this.scope = freezeDeep(validatedScope(scope));
+        this.sink = sink;
+    }
+    record(observation) {
+        const record = freezeDeep({
+            ...this.scope, version: 1, eventId: randomUUID(), sequence: this.records.length + 1,
+            ...sanitizeObservation(observation),
+        });
+        this.records.push(record);
+        this.tail = this.tail.then(async () => {
+            try {
+                await this.sink.append(cloneFrozen(record));
+            }
+            catch (error) {
+                // Keep processing later entries in order, but never turn a failed flush green.
+                if (!this.firstFailure)
+                    this.firstFailure = { error };
+            }
+        });
+    }
+    async flush() {
+        await this.tail;
+        if (this.firstFailure)
+            throw this.firstFailure.error;
+    }
+    snapshot() { return cloneFrozen(this.records); }
+}

package/dist/host-layout.d.ts

@@ -0,0 +1,8 @@
+import { type ConnectTarget } from './provider.ts';
+/** S host-layout 0.3.4 fixed executable conventions, not employee policy defaults. */
+export declare function protectedOneShotLayout(target: ConnectTarget): {
+    runner: string;
+    runnerKind: "executable";
+    root: string;
+    codex: string;
+};

package/dist/host-layout.js

@@ -0,0 +1,9 @@
+import { validateTarget } from "./provider.js";
+import { NeedError } from "./remote.js";
+/** S host-layout 0.3.4 fixed executable conventions, not employee policy defaults. */
+export function protectedOneShotLayout(target) {
+    validateTarget(target);
+    if (!/^emp-[a-z0-9][a-z0-9-]*$/.test(target.username) || target.session.root !== `/Users/${target.username}/.aw/s`)
+        throw new NeedError('HOST_LAYOUT_MISMATCH', '远程主机的运行位置需要管理员核对', 'S声明的同一员工HOME/.aw/s与HOME/.aw/oneshot布局');
+    return { runner: '/usr/local/aw-host/bin/aw-codex-once', runnerKind: 'executable', root: `/Users/${target.username}/.aw/oneshot`, codex: '/opt/homebrew/bin/codex' };
+}

package/dist/index.d.ts

@@ -0,0 +1,114 @@
+import type { Context } from '@deepseek-ai/cordis';
+import Schema from '@deepseek-ai/schemastery';
+import { LlmAdapter, type GenerateOptions, type StreamChunk } from '@deepseek-ai/dsh-llm';
+import { type AcpHooks } from './acp.ts';
+import { type RuntimeProvider } from './provider.ts';
+import { type AgentDefinition } from './agents.ts';
+import { type ImageReader } from './input.ts';
+export declare const name = "ai-workbench-remote-agent";
+export declare const settingsNamespace = "ai-workbench-codex";
+export declare const inject: string[];
+/** Owner-approved defaults; administrators may override through the existing settings. */
+export declare const DEFAULT_CONFIG: Readonly<{
+    readonly mode: "session";
+    readonly acpMaxMessageBytes: 4194304;
+    readonly brokerMaxFrameBytes: 2097152;
+    readonly brokerControlMaxBytes: 1048576;
+    readonly oneShotSandbox: "workspace-write";
+    readonly oneShotApproval: "never";
+}>;
+export declare const Config: Schema<Schemastery.ObjectS<NoInfer<{
+    mode: Schema<"session" | "one-shot", "session" | "one-shot", "volatile-defined">;
+    acpMaxMessageBytes: Schema<number, number, "volatile-defined">;
+    brokerMaxFrameBytes: Schema<number, number, "volatile-defined">;
+    brokerControlMaxBytes: Schema<number, number, "volatile-defined">;
+    oneShotSandbox: Schema<"read-only" | "workspace-write" | "danger-full-access", "read-only" | "workspace-write" | "danger-full-access", "volatile-defined">;
+    oneShotApproval: Schema<"never", "never", "volatile-defined">;
+}>>, Schemastery.ObjectT<NoInfer<{
+    mode: Schema<"session" | "one-shot", "session" | "one-shot", "volatile-defined">;
+    acpMaxMessageBytes: Schema<number, number, "volatile-defined">;
+    brokerMaxFrameBytes: Schema<number, number, "volatile-defined">;
+    brokerControlMaxBytes: Schema<number, number, "volatile-defined">;
+    oneShotSandbox: Schema<"read-only" | "workspace-write" | "danger-full-access", "read-only" | "workspace-write" | "danger-full-access", "volatile-defined">;
+    oneShotApproval: Schema<"never", "never", "volatile-defined">;
+}>>, "plain">;
+export interface PluginConfig {
+    mode?: 'session' | 'one-shot';
+    acpMaxMessageBytes?: number;
+    brokerMaxFrameBytes?: number;
+    brokerControlMaxBytes?: number;
+    oneShotSandbox?: 'read-only' | 'workspace-write' | 'danger-full-access';
+    oneShotApproval?: 'never';
+}
+type LiveConfig = {
+    [K in keyof PluginConfig]: PluginConfig[K] | {
+        get(): PluginConfig[K];
+    };
+};
+/** DSH volatile settings are handles; adapters freeze their values once per invocation. */
+export declare function readConfig(config: LiveConfig): PluginConfig;
+export declare class CodexRemoteAdapter extends LlmAdapter {
+    private resolveRuntime;
+    private approve?;
+    private readonly providerName;
+    private readonly agent;
+    private readonly readImage?;
+    private config;
+    private sessions;
+    private turns;
+    private lifetime;
+    constructor(config: PluginConfig | (() => PluginConfig), resolveRuntime: RuntimeProvider, approve?: InvocationApproval | undefined, providerName?: () => string, agent?: AgentDefinition, readImage?: ImageReader | undefined);
+    providerInfo(provider: string): {
+        id: string;
+        name: string;
+    };
+    listModels(provider: string): Promise<{
+        provider: string;
+        id: string;
+        name: string;
+        inputModalities: ("text" | "image")[];
+    }[]>;
+    providerRetryPolicy(): {
+        mode: "normal";
+        maxRetries: number;
+        retryableCodes: never[];
+        initialDelayMs: number;
+        maxDelayMs: number;
+        jitterRatio: number;
+    };
+    disposeSession(sessionId: string): Promise<void>;
+    dispose(): Promise<void>;
+    stream(options: GenerateOptions): AsyncGenerator<StreamChunk>;
+    private generate;
+}
+/** One official registration owns both routes, preserving opaque replay ownership. */
+export declare class RemoteAgentsAdapter extends LlmAdapter {
+    private adapters;
+    constructor(config: () => PluginConfig, makeRuntime: (agent: AgentDefinition) => RuntimeProvider, approve: InvocationApproval, nameFor: (agent: AgentDefinition) => string, readImage?: ImageReader);
+    private adapter;
+    providerInfo(provider: string): {
+        id: string;
+        name: string;
+    };
+    listModels(provider: string): Promise<{
+        provider: string;
+        id: string;
+        name: string;
+        inputModalities: ("text" | "image")[];
+    }[]>;
+    providerRetryPolicy(): {
+        mode: "normal";
+        maxRetries: number;
+        retryableCodes: never[];
+        initialDelayMs: number;
+        maxDelayMs: number;
+        jitterRatio: number;
+    };
+    stream(options: GenerateOptions): AsyncGenerator<StreamChunk, any, any>;
+    disposeSession(sessionId: string): Promise<void>;
+    dispose(): Promise<void>;
+}
+export declare function apply(ctx: Context, live: LiveConfig): void;
+type InvocationApproval = (request: Parameters<NonNullable<AcpHooks['approve']>>[0], signal: AbortSignal | undefined, options: GenerateOptions, context?: string) => ReturnType<NonNullable<AcpHooks['approve']>>;
+export declare function dshApproval(ctx: Context): InvocationApproval;
+export {};