@andreprado/agentkit 0.1.0-alpha.9 → 0.1.0

package/src/runtime/targets/container/server.ts

@@ -12,7 +12,7 @@ export async function startContainerRuntime(options: ContainerRuntimeOptions = {
   const capsuleRoot = resolve(options.capsuleRoot ?? process.env.AGENTKIT_CAPSULE_ROOT ?? process.cwd());
   const hostname = options.hostname ?? process.env.HOST ?? "0.0.0.0";
   const port = options.port ?? parsePort(process.env.PORT) ?? 4123;
-  return startAgentDevServer(capsuleRoot, { hostname, port });
+  return startAgentDevServer(capsuleRoot, { hostname, port, access: "enforce" });
 }
 
 function parsePort(value: string | undefined): number | undefined {

package/src/runtime/targets/vps/deploy.ts

@@ -1,4 +1,4 @@
-import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 
 import type { LocalDeployState } from "../../core/deploy-state";
@@ -38,15 +38,19 @@ export async function prepareVpsDeploy(
   const manifest = JSON.parse(await readFile(container.manifestPath, "utf8")) as {
     name: string;
     secrets: string[];
+    access: {
+      mode: "private" | "token" | "public";
+    };
   };
 
   await mkdir(buildDir, { recursive: true });
   const envExample = renderEnvExample(manifest.secrets);
   await writeFile(composePath, renderCompose(manifest.name));
   await writeFile(envExamplePath, envExample);
-  await writeFile(envPath, envExample);
+  await writeFile(envPath, envExample, { mode: 0o600 });
+  await chmod(envPath, 0o600);
   await writeFile(secretsPath, renderSecretsChecklist(manifest.secrets));
-  await writeFile(handoffPath, renderProductionHandoff(options.host, manifest.name));
+  await writeFile(handoffPath, renderProductionHandoff(options.host, manifest.name, manifest.access.mode));
 
   const state: LocalDeployState = {
     deploy_id: `vps_${slugify(manifest.name)}`,
@@ -71,7 +75,8 @@ export async function prepareVpsDeploy(
     },
     created_at: new Date().toISOString(),
   };
-  await writeFile(statePath, `${JSON.stringify(state, null, 2)}\n`);
+  await writeFile(statePath, `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+  await chmod(statePath, 0o600);
 
   return {
     target: "vps",
@@ -88,7 +93,7 @@ export async function prepareVpsDeploy(
       `docker compose -f ${composePath} --env-file ${envPath} config`,
       `docker compose -f ${composePath} --env-file ${envPath} up -d --build`,
       `curl -fsS https://${options.host}/health`,
-      `curl -fsS https://${options.host}/_agentkit`,
+      `curl -fsS -H "Authorization: Bearer $AGENTKIT_PRIVATE_TOKEN" https://${options.host}/_agentkit`,
     ],
   };
 }
@@ -113,7 +118,7 @@ function renderCompose(agentName: string): string {
       - agentkit_data:/data
       - agentkit_files:/capsule/.agentkit/files
     healthcheck:
-      test: ["CMD", "bun", "-e", "const r=await fetch('http://127.0.0.1:4123/health'); process.exit(r.ok?0:1)"]
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:4123/health').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
       interval: 30s
       timeout: 5s
       retries: 3
@@ -145,7 +150,7 @@ ${lines}
 `;
 }
 
-function renderProductionHandoff(host: string, agentName: string): string {
+function renderProductionHandoff(host: string, agentName: string, accessMode: "private" | "token" | "public"): string {
   return `# VPS Production Handoff
 
 ## Deploy
@@ -169,12 +174,14 @@ docker compose -f .agentkit/build/vps/compose.yaml --env-file .agentkit/build/vp
 
 \`\`\`sh
 curl -fsS https://${host}/health
-curl -fsS https://${host}/_agentkit
+curl -fsS -H "Authorization: Bearer $AGENTKIT_PRIVATE_TOKEN" https://${host}/_agentkit
 curl -fsS -X POST https://${host}/chat \\
-  -H 'content-type: application/json' \\
+  -H 'content-type: application/json'${renderChatAuthHeader(accessMode)} \\
   -d '{"message":{"role":"user","content":"hello"}}'
 \`\`\`
 
+Set AGENTKIT_PRIVATE_TOKEN for privileged AgentKit endpoints. Chat access follows access.mode: ${accessMode}.
+
 ## Database
 
 - Default database: SQLite at /data/agentkit.db in the agentkit_data volume.
@@ -195,6 +202,16 @@ docker compose -f .agentkit/build/vps/compose.yaml --env-file .agentkit/build/vp
 `;
 }
 
+function renderChatAuthHeader(accessMode: "private" | "token" | "public"): string {
+  if (accessMode === "public") {
+    return "";
+  }
+
+  const secretName = accessMode === "private" ? "AGENTKIT_PRIVATE_TOKEN" : "AGENTKIT_ACCESS_TOKEN";
+  return ` \\
+  -H "Authorization: Bearer $${secretName}"`;
+}
+
 function slugify(value: string): string {
   const slug = value
     .toLowerCase()

package/src/runtime/tool-runner.ts

@@ -2,12 +2,15 @@ import { loadAgentCapsule } from "./config";
 import { openPreparedCapsuleStore } from "./database";
 import { loadCapsuleEnv } from "./env";
 import { isAgentKitError } from "./errors";
+import { createManagedComposioTools } from "./integrations/composio";
+import { buildRuntimeClockContext } from "./prompt-context";
 import { createToolRuntime, type ToolCallResult } from "./tools";
 
 export type RunToolOptions = {
   name: string;
   input?: unknown;
   signal?: AbortSignal;
+  now?: Date;
 };
 
 export async function runToolFromCwd(cwd: string, options: RunToolOptions): Promise<ToolCallResult> {
@@ -24,12 +27,17 @@ export async function runToolFromCwd(cwd: string, options: RunToolOptions): Prom
     model: capsule.config.provider.model,
   });
   const toolRuntime = createToolRuntime({
-    tools: capsule.config.tools ?? [],
+    tools: [...createManagedComposioTools(capsule.config), ...(capsule.config.tools ?? [])],
     store,
     runId: run.id,
     conversationId: conversation.id,
     env,
     signal: options.signal,
+    clock: buildRuntimeClockContext({
+      timeZone: capsule.config.timeZone,
+      env,
+      now: options.now,
+    }),
     runtime: {
       environment: "local",
       invocation: "tool",

package/src/runtime/tools.ts

@@ -2,6 +2,7 @@ import type { AgentTool, JsonSchema, ToolContext, ToolRenderResult, ToolRuntimeC
 import type { SqliteAgentKitStore } from "../storage/sqlite";
 import { createLocalDatabaseRunner } from "./database";
 import { AgentKitError } from "./errors";
+import type { RuntimeClockContext } from "./prompt-context";
 
 export type ToolCallRequest = {
   name: string;
@@ -31,6 +32,7 @@ export type ToolRuntimeOptions = {
   signal?: AbortSignal;
   defaultTimeoutMs?: number;
   runtime: ToolRuntimeContext;
+  clock: RuntimeClockContext;
 };
 
 const DEFAULT_TOOL_TIMEOUT_MS = 30_000;
@@ -79,6 +81,7 @@ async function executeToolCall(
 
     input = normalizeOptionalNulls(input, tool.inputSchema);
     validateSchema(input, tool.inputSchema, `tool "${tool.name}" input`);
+    assertToolInvocationAuthorized(tool, options.runtime);
 
     const { secrets, secretValues } = resolveToolSecrets(tool, options.env ?? process.env);
     const database = createLocalDatabaseRunner(options.store);
@@ -89,6 +92,7 @@ async function executeToolCall(
         secrets,
         database,
         runtime: options.runtime,
+        clock: options.clock,
         signal: options.signal,
       },
       tool.timeoutMs ?? options.defaultTimeoutMs ?? DEFAULT_TOOL_TIMEOUT_MS,
@@ -98,7 +102,7 @@ async function executeToolCall(
       validateSchema(output, tool.outputSchema, `tool "${tool.name}" output`);
     }
 
-    const rendered = renderToolOutput(tool, input, output, options.runtime);
+    const rendered = renderToolOutput(tool, input, output, options.runtime, options.clock);
 
     options.store.completeToolCall({
       toolCallId: toolCall.id,
@@ -130,11 +134,29 @@ async function executeToolCall(
   }
 }
 
+function assertToolInvocationAuthorized(tool: AgentTool, runtime: ToolRuntimeContext): void {
+  if (runtime.invocation === "tool") {
+    return;
+  }
+
+  const privilegedPermissions = (tool.permissions ?? []).filter((permission) => !permission.endsWith(":read"));
+
+  if (privilegedPermissions.length === 0) {
+    return;
+  }
+
+  throw new AgentKitError(
+    "tool_authorization_required",
+    `Tool "${tool.name}" requires an explicit operator invocation because it declares privileged permissions: ${privilegedPermissions.join(", ")}. Run it with "agentkit tool ${tool.name} --input '<json>'" after reviewing the exact action.`,
+  );
+}
+
 function renderToolOutput(
   tool: AgentTool,
   input: unknown,
   output: unknown,
   runtime: ToolRuntimeContext,
+  clock: RuntimeClockContext,
 ): ToolRenderResult | undefined {
   if (!tool.render) {
     return undefined;
@@ -143,6 +165,7 @@ function renderToolOutput(
   const rendered = tool.render(output, {
     input,
     runtime,
+    clock,
   });
 
   if (typeof rendered === "string") {
@@ -278,7 +301,7 @@ function collectConfiguredSecretValues(tool: AgentTool | undefined, env: Record<
 async function runToolWithTimeout(
   tool: AgentTool,
   input: unknown,
-  context: Pick<ToolContext, "secrets" | "database" | "runtime"> & { signal?: AbortSignal },
+  context: Pick<ToolContext, "secrets" | "database" | "runtime" | "clock"> & { signal?: AbortSignal },
   timeoutMs: number,
 ): Promise<unknown> {
   const controller = new AbortController();
@@ -306,6 +329,7 @@ async function runToolWithTimeout(
         secrets: context.secrets,
         signal: controller.signal,
         runtime: context.runtime,
+        clock: context.clock,
         database: context.database,
         db: context.database,
         storage: {