@andreprado/agentkit 0.1.0-alpha.2 → 0.1.0-alpha.21

package/src/runtime/targets/container/server.ts

@@ -12,7 +12,7 @@ export async function startContainerRuntime(options: ContainerRuntimeOptions = {
   const capsuleRoot = resolve(options.capsuleRoot ?? process.env.AGENTKIT_CAPSULE_ROOT ?? process.cwd());
   const hostname = options.hostname ?? process.env.HOST ?? "0.0.0.0";
   const port = options.port ?? parsePort(process.env.PORT) ?? 4123;
-  return startAgentDevServer(capsuleRoot, { hostname, port });
+  return startAgentDevServer(capsuleRoot, { hostname, port, access: "enforce" });
 }
 
 function parsePort(value: string | undefined): number | undefined {

package/src/runtime/targets/vps/deploy.ts

@@ -1,4 +1,4 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 import type { LocalDeployState } from "../../core/deploy-state";
@@ -38,15 +38,19 @@ export async function prepareVpsDeploy(
   const manifest = JSON.parse(await readFile(container.manifestPath, "utf8")) as {
     name: string;
     secrets: string[];
+    access: {
+      mode: "private" | "token" | "public";
+    };
   };
 
   await mkdir(buildDir, { recursive: true });
   const envExample = renderEnvExample(manifest.secrets);
   await writeFile(composePath, renderCompose(manifest.name));
   await writeFile(envExamplePath, envExample);
-  await writeFile(envPath, envExample);
+  await writeFile(envPath, envExample, { mode: 0o600 });
+  await chmod(envPath, 0o600);
   await writeFile(secretsPath, renderSecretsChecklist(manifest.secrets));
-  await writeFile(handoffPath, renderProductionHandoff(options.host, manifest.name));
+  await writeFile(handoffPath, renderProductionHandoff(options.host, manifest.name, manifest.access.mode));
 
   const state: LocalDeployState = {
     deploy_id: `vps_${slugify(manifest.name)}`,
@@ -71,7 +75,8 @@ export async function prepareVpsDeploy(
     },
     created_at: new Date().toISOString(),
   };
-  await writeFile(statePath, `${JSON.stringify(state, null, 2)}\n`);
+  await writeFile(statePath, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+  await chmod(statePath, 0o600);
 
   return {
     target: "vps",
@@ -88,7 +93,7 @@ export async function prepareVpsDeploy(
       `docker compose -f ${composePath} --env-file ${envPath} config`,
       `docker compose -f ${composePath} --env-file ${envPath} up -d --build`,
       `curl -fsS https://${options.host}/health`,
-      `curl -fsS https://${options.host}/_agentkit`,
+      `curl -fsS -H "Authorization: Bearer $AGENTKIT_PRIVATE_TOKEN" https://${options.host}/_agentkit`,
     ],
   };
 }
@@ -113,7 +118,7 @@ function renderCompose(agentName: string): string {
       - agentkit_data:/data
       - agentkit_files:/capsule/.agentkit/files
     healthcheck:
-      test: ["CMD", "bun", "-e", "const r=await fetch('http://127.0.0.1:4123/health'); process.exit(r.ok?0:1)"]
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:4123/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
       interval: 30s
       timeout: 5s
       retries: 3
@@ -145,7 +150,7 @@ ${lines}
 `;
 }
 
-function renderProductionHandoff(host: string, agentName: string): string {
+function renderProductionHandoff(host: string, agentName: string, accessMode: "private" | "token" | "public"): string {
   return `# VPS Production Handoff
 
 ## Deploy
@@ -169,12 +174,14 @@ docker compose -f .agentkit/build/vps/compose.yaml --env-file .agentkit/build/vp
 
 \`\`\`sh
 curl -fsS https://${host}/health
-curl -fsS https://${host}/_agentkit
+curl -fsS -H "Authorization: Bearer $AGENTKIT_PRIVATE_TOKEN" https://${host}/_agentkit
 curl -fsS -X POST https://${host}/chat \\
-  -H 'content-type: application/json' \\
+  -H 'content-type: application/json'${renderChatAuthHeader(accessMode)} \\
   -d '{"message":{"role":"user","content":"hello"}}'
 \`\`\`
 
+Set AGENTKIT_PRIVATE_TOKEN for privileged AgentKit endpoints. Chat access follows access.mode: ${accessMode}.
+
 ## Database
 
 - Default database: SQLite at /data/agentkit.db in the agentkit_data volume.
@@ -195,6 +202,16 @@ docker compose -f .agentkit/build/vps/compose.yaml --env-file .agentkit/build/vp
 `;
 }
 
+function renderChatAuthHeader(accessMode: "private" | "token" | "public"): string {
+  if (accessMode === "public") {
+    return "";
+  }
+
+  const secretName = accessMode === "private" ? "AGENTKIT_PRIVATE_TOKEN" : "AGENTKIT_ACCESS_TOKEN";
+  return ` \\
+  -H "Authorization: Bearer $${secretName}"`;
+}
+
 function slugify(value: string): string {
   const slug = value
     .toLowerCase()

package/src/runtime/tool-runner.ts

@@ -2,12 +2,15 @@ import { loadAgentCapsule } from "./config";
 import { openPreparedCapsuleStore } from "./database";
 import { loadCapsuleEnv } from "./env";
 import { isAgentKitError } from "./errors";
+import { createManagedComposioTools } from "./integrations/composio";
+import { buildRuntimeClockContext } from "./prompt-context";
 import { createToolRuntime, type ToolCallResult } from "./tools";
 
 export type RunToolOptions = {
   name: string;
   input?: unknown;
   signal?: AbortSignal;
+  now?: Date;
 };
 
 export async function runToolFromCwd(cwd: string, options: RunToolOptions): Promise<ToolCallResult> {
@@ -24,12 +27,17 @@ export async function runToolFromCwd(cwd: string, options: RunToolOptions): Prom
     model: capsule.config.provider.model,
   });
   const toolRuntime = createToolRuntime({
-    tools: capsule.config.tools ?? [],
+    tools: [...createManagedComposioTools(capsule.config), ...(capsule.config.tools ?? [])],
     store,
     runId: run.id,
     conversationId: conversation.id,
     env,
     signal: options.signal,
+    clock: buildRuntimeClockContext({
+      timeZone: capsule.config.timeZone,
+      env,
+      now: options.now,
+    }),
     runtime: {
       environment: "local",
       invocation: "tool",

package/src/runtime/tools.ts

@@ -1,7 +1,8 @@
-import type { AgentTool, JsonSchema, ToolContext, ToolRuntimeContext } from "../index";
+import type { AgentTool, JsonSchema, ToolContext, ToolRenderResult, ToolRuntimeContext } from "../index";
 import type { SqliteAgentKitStore } from "../storage/sqlite";
 import { createLocalDatabaseRunner } from "./database";
 import { AgentKitError } from "./errors";
+import type { RuntimeClockContext } from "./prompt-context";
 
 export type ToolCallRequest = {
   name: string;
@@ -14,6 +15,7 @@ export type ToolCallResult = {
   visibility: "user" | "internal";
   input: unknown;
   output: unknown;
+  rendered?: ToolRenderResult;
 };
 
 export type ToolRuntime = {
@@ -30,6 +32,7 @@ export type ToolRuntimeOptions = {
   signal?: AbortSignal;
   defaultTimeoutMs?: number;
   runtime: ToolRuntimeContext;
+  clock: RuntimeClockContext;
 };
 
 const DEFAULT_TOOL_TIMEOUT_MS = 30_000;
@@ -88,6 +91,7 @@ async function executeToolCall(
         secrets,
         database,
         runtime: options.runtime,
+        clock: options.clock,
         signal: options.signal,
       },
       tool.timeoutMs ?? options.defaultTimeoutMs ?? DEFAULT_TOOL_TIMEOUT_MS,
@@ -97,10 +101,13 @@ async function executeToolCall(
       validateSchema(output, tool.outputSchema, `tool "${tool.name}" output`);
     }
 
+    const rendered = renderToolOutput(tool, input, output, options.runtime, options.clock);
+
     options.store.completeToolCall({
       toolCallId: toolCall.id,
       status: "completed",
       output,
+      rendered,
       secretValues,
     });
 
@@ -110,6 +117,7 @@ async function executeToolCall(
       visibility: tool.visibility ?? "user",
       input,
       output,
+      ...(rendered ? { rendered } : {}),
     };
   } catch (error) {
     const secretValues = collectConfiguredSecretValues(tool, options.env ?? process.env);
@@ -125,6 +133,123 @@ async function executeToolCall(
   }
 }
 
+function renderToolOutput(
+  tool: AgentTool,
+  input: unknown,
+  output: unknown,
+  runtime: ToolRuntimeContext,
+  clock: RuntimeClockContext,
+): ToolRenderResult | undefined {
+  if (!tool.render) {
+    return undefined;
+  }
+
+  const rendered = tool.render(output, {
+    input,
+    runtime,
+    clock,
+  });
+
+  if (typeof rendered === "string") {
+    return { text: rendered };
+  }
+
+  if (!isRecord(rendered) || typeof rendered.text !== "string" || rendered.text.trim().length === 0) {
+    throw new AgentKitError("tool_validation_error", `tool "${tool.name}" render must return a non-empty text string.`);
+  }
+
+  if (rendered.blocks !== undefined) {
+    if (!Array.isArray(rendered.blocks)) {
+      throw new AgentKitError("tool_validation_error", `tool "${tool.name}" render.blocks must be an array when provided.`);
+    }
+
+    for (const [index, block] of rendered.blocks.entries()) {
+      validateRenderBlock(block, `tool "${tool.name}" render.blocks[${index}]`);
+    }
+  }
+
+  return {
+    text: rendered.text,
+    ...(rendered.blocks ? { blocks: rendered.blocks } : {}),
+  };
+}
+
+function validateRenderBlock(block: unknown, label: string): void {
+  if (!isRecord(block)) {
+    throw new AgentKitError("tool_validation_error", `${label} must be an object.`);
+  }
+
+  if (block.type === "text") {
+    if (typeof block.text !== "string" || block.text.trim().length === 0) {
+      throw new AgentKitError("tool_validation_error", `${label}.text must be a non-empty string.`);
+    }
+    return;
+  }
+
+  if (block.type === "card") {
+    if (typeof block.title !== "string" || block.title.trim().length === 0) {
+      throw new AgentKitError("tool_validation_error", `${label}.title must be a non-empty string.`);
+    }
+
+    validateOptionalString(block.subtitle, `${label}.subtitle`);
+    validateRenderFields(block.fields, `${label}.fields`);
+    validateRenderActions(block.actions, `${label}.actions`);
+    return;
+  }
+
+  throw new AgentKitError("tool_validation_error", `${label}.type must be "text" or "card".`);
+}
+
+function validateRenderFields(value: unknown, label: string): void {
+  if (value === undefined) {
+    return;
+  }
+
+  if (!Array.isArray(value)) {
+    throw new AgentKitError("tool_validation_error", `${label} must be an array when provided.`);
+  }
+
+  for (const [index, field] of value.entries()) {
+    if (!isRecord(field)) {
+      throw new AgentKitError("tool_validation_error", `${label}[${index}] must be an object.`);
+    }
+
+    validateRequiredString(field.label, `${label}[${index}].label`);
+    validateRequiredString(field.value, `${label}[${index}].value`);
+  }
+}
+
+function validateRenderActions(value: unknown, label: string): void {
+  if (value === undefined) {
+    return;
+  }
+
+  if (!Array.isArray(value)) {
+    throw new AgentKitError("tool_validation_error", `${label} must be an array when provided.`);
+  }
+
+  for (const [index, action] of value.entries()) {
+    if (!isRecord(action)) {
+      throw new AgentKitError("tool_validation_error", `${label}[${index}] must be an object.`);
+    }
+
+    validateRequiredString(action.label, `${label}[${index}].label`);
+    validateOptionalString(action.href, `${label}[${index}].href`);
+  }
+}
+
+function validateRequiredString(value: unknown, label: string): void {
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new AgentKitError("tool_validation_error", `${label} must be a non-empty string.`);
+  }
+}
+
+function validateOptionalString(value: unknown, label: string): void {
+  if (value !== undefined && typeof value !== "string") {
+    throw new AgentKitError("tool_validation_error", `${label} must be a string when provided.`);
+  }
+}
+
 function resolveToolSecrets(
   tool: AgentTool,
   env: Record<string, string | undefined>,
@@ -158,7 +283,7 @@ function collectConfiguredSecretValues(tool: AgentTool | undefined, env: Record<
 async function runToolWithTimeout(
   tool: AgentTool,
   input: unknown,
-  context: Pick<ToolContext, "secrets" | "database" | "runtime"> & { signal?: AbortSignal },
+  context: Pick<ToolContext, "secrets" | "database" | "runtime" | "clock"> & { signal?: AbortSignal },
   timeoutMs: number,
 ): Promise<unknown> {
   const controller = new AbortController();
@@ -186,6 +311,7 @@ async function runToolWithTimeout(
         secrets: context.secrets,
         signal: controller.signal,
         runtime: context.runtime,
+        clock: context.clock,
         database: context.database,
         db: context.database,
         storage: {

package/src/runtime/traces.ts

@@ -0,0 +1,41 @@
+import type { ConversationRecord, StoredRun, StoredToolCall } from "../storage/sqlite";
+import { openCapsuleStore } from "../storage/sqlite";
+import { loadAgentCapsule } from "./config";
+import { AgentKitError } from "./errors";
+
+export type ConversationTrace = ConversationRecord & {
+  runs: ConversationTraceRun[];
+};
+
+export type ConversationTraceRun = StoredRun & {
+  toolCalls: StoredToolCall[];
+};
+
+export async function getConversationTraceFromCwd(cwd: string, conversationId: string): Promise<ConversationTrace> {
+  if (!conversationId) {
+    throw new AgentKitError("validation_error", "Missing conversation id.");
+  }
+
+  const capsule = await loadAgentCapsule(cwd);
+  const store = await openCapsuleStore(capsule);
+
+  try {
+    const conversation = store.getConversation(conversationId);
+
+    if (!conversation) {
+      throw new AgentKitError("conversation_not_found", `Conversation "${conversationId}" was not found.`);
+    }
+
+    const runs = store.listRunsForConversation(conversation.id).map((run) => ({
+      ...run,
+      toolCalls: store.listToolCallsForRun(run.id),
+    }));
+
+    return {
+      ...conversation,
+      runs,
+    };
+  } finally {
+    store.close();
+  }
+}