@andreprado/agentkit 0.1.0 → 0.2.0

package/src/index.ts

@@ -1,4 +1,4 @@
-export type AgentRuntime = "local" | "edge";
+export type AgentRuntime = "local";
 export type AgentProviderName = "test" | "openai" | "openai-codex" | "anthropic" | "openrouter" | "opencode" | "opencode-go" | "custom";
 export type AccessMode = "private" | "token" | "public";
 export type ToolVisibility = "user" | "internal";
@@ -275,38 +275,12 @@ export type AgentChannel =
   | GenericWebhookChannelConfig
   | GenericWebhookOutputChannelConfig;
 
-export type IntegrationTagsConfig = {
-  enable?: string[];
-  disable?: string[];
-};
-
-export type ComposioManagedIntegrationInput = {
-  name?: string;
-  toolkits: string[];
-  tools?: Record<string, string[]>;
-  tags?: IntegrationTagsConfig;
-  confirmExternalWrites?: boolean;
-};
-
-export type ComposioManagedIntegration = {
-  type: "composio";
-  provider: "composio";
-  mode: "managed";
-  name: string;
-  toolkits: string[];
-  tools?: Record<string, string[]>;
-  tags?: IntegrationTagsConfig;
-  confirmExternalWrites?: boolean;
-};
-
-export type AgentIntegration = ComposioManagedIntegration;
-
 export type AgentDatabaseConfig =
   | {
       driver: "none";
     }
   | {
-      driver: "turso";
+      driver: "sqlite";
       schema?: string;
       migrations?: string;
     };
@@ -316,8 +290,7 @@ export type AgentFilesConfig =
       driver: "none";
     }
   | {
-      driver: "r2";
-      bucket?: string;
+      driver: "local";
       prefix?: string;
       maxUploadBytes?: number;
     };
@@ -417,10 +390,10 @@ export type ToolRenderContext<Input = unknown> = {
 };
 
 export type ToolRuntimeContext = {
-  environment: "local" | "hosted" | "eval" | "test";
+  environment: "local" | "eval" | "test";
   invocation: "chat" | "tool" | "dev" | "channel" | "eval" | "sync";
-  target: "bun" | "cloudflare";
-  database: "sqlite" | "turso" | "none";
+  target: "bun";
+  database: "sqlite" | "none";
 };
 
 export type ToolClockContext = {
@@ -472,7 +445,6 @@ export type AgentConfig = {
   instructions: string;
   secrets: string[];
   tools?: AgentTool[];
-  integrations?: AgentIntegration[];
   channels?: AgentChannel[];
   transcription?: AgentTranscriptionConfig;
   knowledge?: AgentKnowledgeConfig;
@@ -495,25 +467,6 @@ export function defineTool<Input = unknown, Output = unknown>(tool: AgentTool<In
   return tool;
 }
 
-export function composioManaged(input: ComposioManagedIntegrationInput): ComposioManagedIntegration {
-  const name = normalizeIntegrationName(input.name ?? "composio", "composio integration name");
-  const toolkits = normalizeToolkitList(input.toolkits, "composioManaged.toolkits");
-  const tools = input.tools ? normalizeComposioToolMap(input.tools, toolkits) : undefined;
-  const tags = input.tags ? normalizeIntegrationTags(input.tags) : undefined;
-  const confirmExternalWrites = input.confirmExternalWrites;
-
-  return {
-    type: "composio",
-    provider: "composio",
-    mode: "managed",
-    name,
-    toolkits,
-    ...(tools ? { tools } : {}),
-    ...(tags ? { tags } : {}),
-    ...(confirmExternalWrites === undefined ? {} : { confirmExternalWrites }),
-  };
-}
-
 export function websiteChannel(input: WebsiteChannelInput): WebsiteChannelConfig {
   return {
     type: "website",
@@ -663,109 +616,6 @@ function normalizeSecretName(secret: string, context: string): string {
   return secret;
 }
 
-function normalizeIntegrationName(value: string, context: string): string {
-  const name = value.trim();
-
-  if (!/^[a-z][a-z0-9-]*$/.test(name)) {
-    throw new Error(`${context} must start with a lowercase letter and contain only lowercase letters, numbers, and hyphens.`);
-  }
-
-  return name;
-}
-
-function normalizeToolkitList(values: string[], context: string): string[] {
-  if (!Array.isArray(values) || values.length === 0) {
-    throw new Error(`${context} must include at least one toolkit slug.`);
-  }
-
-  const toolkits = new Set<string>();
-
-  for (const value of values) {
-    if (typeof value !== "string") {
-      throw new Error(`${context} entries must be toolkit slug strings.`);
-    }
-
-    const toolkit = value.trim().toLowerCase();
-
-    if (!/^[a-z][a-z0-9_-]*$/.test(toolkit)) {
-      throw new Error(`${context} entries must start with a letter and contain only letters, numbers, underscores, and hyphens.`);
-    }
-
-    toolkits.add(toolkit);
-  }
-
-  return Array.from(toolkits).sort();
-}
-
-function normalizeComposioToolMap(values: Record<string, string[]>, toolkits: string[]): Record<string, string[]> | undefined {
-  const toolkitSet = new Set(toolkits);
-  const normalized: Record<string, string[]> = {};
-
-  for (const [rawToolkit, rawTools] of Object.entries(values)) {
-    const toolkit = rawToolkit.trim().toLowerCase();
-
-    if (!toolkitSet.has(toolkit)) {
-      throw new Error(`composioManaged.tools.${rawToolkit} must reference a toolkit listed in composioManaged.toolkits.`);
-    }
-
-    if (!Array.isArray(rawTools) || rawTools.length === 0) {
-      throw new Error(`composioManaged.tools.${rawToolkit} must include at least one Composio action slug.`);
-    }
-
-    const tools = new Set<string>();
-
-    for (const rawTool of rawTools) {
-      if (typeof rawTool !== "string") {
-        throw new Error(`composioManaged.tools.${rawToolkit} entries must be Composio action slug strings.`);
-      }
-
-      const tool = rawTool.trim().toUpperCase();
-
-      if (!/^[A-Z][A-Z0-9_]*$/.test(tool)) {
-        throw new Error(`composioManaged.tools.${rawToolkit} entries must be uppercase Composio action slugs.`);
-      }
-
-      tools.add(tool);
-    }
-
-    normalized[toolkit] = Array.from(tools).sort();
-  }
-
-  return Object.keys(normalized).length > 0 ? normalized : undefined;
-}
-
-function normalizeIntegrationTags(tags: IntegrationTagsConfig): IntegrationTagsConfig {
-  const normalized: IntegrationTagsConfig = {};
-
-  if (tags.enable !== undefined) {
-    normalized.enable = normalizeTagList(tags.enable, "composioManaged.tags.enable");
-  }
-
-  if (tags.disable !== undefined) {
-    normalized.disable = normalizeTagList(tags.disable, "composioManaged.tags.disable");
-  }
-
-  return normalized;
-}
-
-function normalizeTagList(values: string[], context: string): string[] {
-  if (!Array.isArray(values)) {
-    throw new Error(`${context} must be an array of tag strings.`);
-  }
-
-  return Array.from(
-    new Set(
-      values.map((value) => {
-        if (typeof value !== "string" || value.trim().length === 0) {
-          throw new Error(`${context} entries must be non-empty strings.`);
-        }
-
-        return value.trim();
-      }),
-    ),
-  ).sort();
-}
-
 function normalizeChannelBuffer(input: ChannelBufferInput, context: string): ChannelBufferConfig {
   if (input.mode === "off") {
     return { mode: "off" };
@@ -928,8 +778,6 @@ export { getConversationTraceFromCwd } from "./runtime/traces";
 export { runToolFromCwd } from "./runtime/tool-runner";
 export { startAgentDevServer } from "./runtime/dev-server";
 export { inspectAgentCapsule } from "./runtime/inspect";
-export { buildAgentCapsule } from "./runtime/build";
-export { deployBuildToAgentKitCloud } from "./runtime/deploy";
 export { AgentKitError } from "./runtime/errors";
 export type {
   ChannelAdapter,

package/src/providers/pi.ts

@@ -117,7 +117,9 @@ export function providerToolResultText(result: {
   visibility?: "user" | "internal";
   rendered?: { text?: string };
   output: unknown;
+  modelText?: string;
 }): string {
+  if (result.modelText !== undefined) return result.modelText;
   if (result.visibility === "internal") {
     return `Internal tool ${result.name} completed.`;
   }

package/src/runtime/channels/discord.ts

@@ -8,6 +8,10 @@ import type {
   WebhookVerificationResult,
 } from "../channels";
 import { AgentKitError } from "../errors";
+import {
+  CHANNEL_SEND_TIMEOUT_MS,
+  classifySendRequestError,
+} from "./provider-fetch";
 
 const DISCORD_INTERACTION_PING = 1;
 const DISCORD_INTERACTION_APPLICATION_COMMAND = 2;
@@ -120,9 +124,9 @@ export const discordChannelAdapter: ChannelAdapter = {
       }
 
       return {
-        status: "waiting_for_provider_event",
+        status: "needs_setup",
         checkedAt: new Date().toISOString(),
-        message: "Invite the Discord bot to a server and enable Message Content Intent.",
+        message: "AgentKit does not connect to the Discord Gateway. Use interactions or run your own Gateway bridge to forward authenticated bot events; inviting the bot alone is insufficient. Bridge connectivity cannot be verified here.",
       };
     }
 
@@ -331,16 +335,18 @@ export async function sendDiscordMessage(
 
   try {
     response = await fetcher(actualRequest.url, {
+      signal: AbortSignal.timeout(CHANNEL_SEND_TIMEOUT_MS),
       method: actualRequest.method,
       headers: actualRequest.headers,
       body: JSON.stringify(actualRequest.body),
     });
   } catch (error) {
+    const failure = classifySendRequestError(error);
     return {
       ok: false,
-      retryable: true,
-      code: "channel_provider_unavailable",
-      message: `Discord bot message request failed before a response: ${redactDiscordToken(
+      retryable: failure.retryable,
+      code: failure.code,
+      message: `Discord bot message request ${failure.reason}: ${redactDiscordToken(
         error instanceof Error ? error.message : String(error),
         input.secrets.DISCORD_BOT_TOKEN,
       )}`,
@@ -457,6 +463,7 @@ export async function sendDiscordInteractionFollowup(
 
   try {
     response = await fetcher(actualRequest.url, {
+      signal: AbortSignal.timeout(CHANNEL_SEND_TIMEOUT_MS),
       method: actualRequest.method,
       headers: {
         "Content-Type": "application/json",
@@ -464,11 +471,12 @@ export async function sendDiscordInteractionFollowup(
       body: JSON.stringify(actualRequest.body),
     });
   } catch (error) {
+    const failure = classifySendRequestError(error);
     return {
       ok: false,
-      retryable: true,
-      code: "channel_provider_unavailable",
-      message: `Discord follow-up request failed before a response: ${redactDiscordToken(
+      retryable: failure.retryable,
+      code: failure.code,
+      message: `Discord follow-up request ${failure.reason}: ${redactDiscordToken(
         error instanceof Error ? error.message : String(error),
         replyTarget.interactionToken,
       )}`,

package/src/runtime/channels/generic-webhook.ts

@@ -1,16 +1,21 @@
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
-import { lookup as dnsLookup } from "node:dns/promises";
-import { request as httpsRequest } from "node:https";
-import type { LookupFunction } from "node:net";
-import { Readable } from "node:stream";
 
 import type { GenericWebhookOutputChannelConfig } from "../../index";
 import type { ChannelAdapter, ChannelSendInput, ChannelSendResult, RawWebhookEvent } from "../channels";
 import { AgentKitError } from "../errors";
+import {
+  isBlockedOutboundHost,
+  pinnedHttpsFetch,
+  resolveOutboundAddresses,
+  resolvePublicOutboundUrl,
+  type OutboundResolver,
+  type ResolvedOutboundUrl,
+} from "./net-guard";
 
 const DEFAULT_SECRET_NAME = "AGENTKIT_WEBHOOK_SECRET";
 const DEFAULT_OUTPUT_HMAC_HEADER = "X-AgentKit-Webhook-Signature";
 const MAX_OUTPUT_RESPONSE_BYTES = 64_000;
+const GENERIC_WEBHOOK_OUTPUT_URL_LABEL = "Generic webhook output URL";
 
 export const genericWebhookChannelAdapter: ChannelAdapter = {
   type: "webhook",
@@ -152,12 +157,7 @@ type GenericWebhookOutputRequest = {
 };
 
 type GenericWebhookOutputFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-type GenericWebhookOutputResolver = (hostname: string) => Promise<string[]>;
-type GenericWebhookOutputResolvedUrl = {
-  href: string;
-  address: string;
-  family: 4 | 6;
-};
+type GenericWebhookOutputResolver = OutboundResolver;
 type GenericWebhookOutputRequestInit = {
   method: "POST";
   headers: Record<string, string>;
@@ -218,10 +218,12 @@ export async function sendGenericWebhookOutputMessage(
   input: ChannelSendInput,
   channel: GenericWebhookOutputChannelConfig,
   fetcher?: GenericWebhookOutputFetch,
-  resolver: GenericWebhookOutputResolver = resolveGenericWebhookOutputAddresses,
+  resolver: GenericWebhookOutputResolver = resolveOutboundAddresses,
 ): Promise<ChannelSendResult> {
   let request: GenericWebhookOutputRequest;
-  let resolvedUrl: GenericWebhookOutputResolvedUrl;
+  let resolvedUrl: ResolvedOutboundUrl;
+  // Started before DNS resolution so a stalled resolver counts against the deadline.
+  const signal = AbortSignal.timeout(15_000);
 
   try {
     request = buildGenericWebhookOutputRequest(input, channel);
@@ -235,7 +237,7 @@ export async function sendGenericWebhookOutputMessage(
       };
     }
 
-    resolvedUrl = await validateGenericWebhookOutputResolvedUrl(request.url, resolver);
+    resolvedUrl = await validateGenericWebhookOutputResolvedUrl(request.url, resolver, signal);
   } catch (error) {
     return genericWebhookOutputFailureFromError(error);
   }
@@ -246,13 +248,13 @@ export async function sendGenericWebhookOutputMessage(
     headers: request.headers,
     body: JSON.stringify(request.body),
     redirect: "manual",
-    signal: AbortSignal.timeout(15_000),
+    signal,
   };
 
   try {
     response = fetcher
       ? await fetcher(resolvedUrl.href, requestInit)
-      : await fetchGenericWebhookOutputResponse(resolvedUrl, requestInit);
+      : await pinnedHttpsFetch(resolvedUrl, requestInit, GENERIC_WEBHOOK_OUTPUT_URL_LABEL);
   } catch (error) {
     if (error instanceof AgentKitError) {
       return {
@@ -411,7 +413,7 @@ function validateGenericWebhookOutputUrl(rawUrl: string): string {
     throw new AgentKitError("channel_payload_invalid", "Generic webhook output URL must not include credentials.");
   }
 
-  if (isBlockedGenericWebhookOutputHost(url.hostname)) {
+  if (isBlockedOutboundHost(url.hostname)) {
     throw new AgentKitError("channel_payload_invalid", "Generic webhook output URL host is not allowed.");
   }
 
@@ -421,317 +423,23 @@ function validateGenericWebhookOutputUrl(rawUrl: string): string {
 async function validateGenericWebhookOutputResolvedUrl(
   rawUrl: string,
   resolver: GenericWebhookOutputResolver,
-): Promise<GenericWebhookOutputResolvedUrl> {
-  const href = validateGenericWebhookOutputUrl(rawUrl);
-  const url = new URL(href);
-  let addresses: string[];
-
-  try {
-    addresses = await resolver(url.hostname);
-  } catch (error) {
-    throw new AgentKitError(
-      "channel_provider_unavailable",
-      `Generic webhook output URL host could not be resolved: ${error instanceof Error ? error.message : String(error)}`,
-    );
-  }
-
-  if (addresses.length === 0) {
-    throw new AgentKitError("channel_provider_unavailable", "Generic webhook output URL host did not resolve.");
-  }
-
-  for (const address of addresses) {
-    if (isBlockedGenericWebhookOutputHost(address)) {
-      throw new AgentKitError("channel_payload_invalid", "Generic webhook output URL host resolved to a blocked address.");
-    }
-  }
-
-  const address = normalizeGenericWebhookOutputHost(addresses[0]);
-
-  return {
-    href,
-    address,
-    family: parseIpv4Octets(address) ? 4 : 6,
-  };
-}
-
-function fetchGenericWebhookOutputResponse(
-  resolvedUrl: GenericWebhookOutputResolvedUrl,
-  init: GenericWebhookOutputRequestInit,
-): Promise<Response> {
-  const url = new URL(resolvedUrl.href);
-  const lookup: LookupFunction = (_hostname, _options, callback) => {
-    callback(null, resolvedUrl.address, resolvedUrl.family);
-  };
-
-  return new Promise((resolve, reject) => {
-    const request = httpsRequest(
-      url,
-      {
-        method: init.method,
-        headers: init.headers,
-        lookup,
-        signal: init.signal,
-      },
-      (response) => {
-        try {
-          assertAllowedGenericWebhookOutputRemoteAddress(response.socket.remoteAddress);
-        } catch (error) {
-          response.destroy(error instanceof Error ? error : new Error(String(error)));
-          reject(error);
-          return;
-        }
-
-        resolve(
-          new Response(Readable.toWeb(response) as unknown as ReadableStream<Uint8Array>, {
-            status: response.statusCode ?? 502,
-            headers: headersFromIncomingMessage(response.headers),
-          }),
-        );
-      },
-    );
-
-    request.on("socket", (socket) => {
-      const validateSocket = () => {
-        try {
-          assertAllowedGenericWebhookOutputRemoteAddress(socket.remoteAddress);
-        } catch (error) {
-          request.destroy(error instanceof Error ? error : new Error(String(error)));
-        }
-      };
-
-      socket.once("connect", validateSocket);
-      socket.once("secureConnect", validateSocket);
-    });
-    request.once("error", reject);
-    request.end(init.body);
-  });
-}
-
-function assertAllowedGenericWebhookOutputRemoteAddress(address: string | undefined): void {
-  if (!address || isBlockedGenericWebhookOutputHost(address)) {
-    throw new AgentKitError("channel_payload_invalid", "Generic webhook output URL connected to a blocked address.");
-  }
-}
-
-function headersFromIncomingMessage(headers: Record<string, string | string[] | number | undefined>): Headers {
-  const result = new Headers();
-
-  for (const [key, value] of Object.entries(headers)) {
-    if (Array.isArray(value)) {
-      for (const item of value) {
-        result.append(key, item);
-      }
-      continue;
-    }
-
-    if (value !== undefined) {
-      result.set(key, String(value));
-    }
-  }
-
-  return result;
-}
-
-async function resolveGenericWebhookOutputAddresses(hostname: string): Promise<string[]> {
-  const host = normalizeGenericWebhookOutputHost(hostname);
-
-  if (parseIpv4Octets(host) || parseIpv6Segments(host)) {
-    return [host];
-  }
-
-  const records = await dnsLookup(host, {
-    all: true,
-    verbatim: true,
-  });
-
-  return records.map((record) => record.address);
-}
-
-function isBlockedGenericWebhookOutputHost(hostname: string): boolean {
-  const host = normalizeGenericWebhookOutputHost(hostname);
-
-  if (
-    host === "localhost" ||
-    host.endsWith(".localhost") ||
-    host === "metadata.google.internal"
-  ) {
-    return true;
-  }
-
-  const ipv4 = parseIpv4Octets(host);
-
-  if (ipv4) {
-    return isBlockedIpv4Octets(ipv4);
-  }
-
-  const ipv6 = parseIpv6Segments(host);
-
-  if (ipv6) {
-    return isBlockedIpv6Segments(ipv6);
-  }
-
-  return false;
-}
-
-function normalizeGenericWebhookOutputHost(hostname: string): string {
-  return hostname.toLowerCase().replace(/^\[/, "").replace(/\]$/, "").replace(/\.$/, "");
-}
-
-function parseIpv4Octets(host: string): number[] | undefined {
-  const parts = host.split(".");
-
-  if (parts.length !== 4) {
-    return undefined;
-  }
-
-  const octets = parts.map((part) => Number(part));
-
-  if (octets.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-    return undefined;
-  }
-
-  return octets;
+  signal: AbortSignal,
+): Promise<ResolvedOutboundUrl> {
+  return resolvePublicOutboundUrl(validateGenericWebhookOutputUrl(rawUrl), GENERIC_WEBHOOK_OUTPUT_URL_LABEL, resolver, signal);
 }
 
-function isBlockedIpv4Octets(parts: number[]): boolean {
-  const [a, b] = parts;
 
-  return (
-    a === 0 ||
-    a === 10 ||
-    a === 127 ||
-    (a === 100 && b >= 64 && b <= 127) ||
-    (a === 169 && b === 254) ||
-    (a === 172 && b >= 16 && b <= 31) ||
-    (a === 192 && b === 168) ||
-    (a === 198 && (b === 18 || b === 19)) ||
-    a >= 224
-  );
-}
 
-function parseIpv6Segments(host: string): number[] | undefined {
-  if (!host.includes(":")) {
-    return undefined;
-  }
 
-  if (host === "::") {
-    return new Array(8).fill(0);
-  }
 
-  const [leftRaw, rightRaw, extra] = host.split("::");
 
-  if (extra !== undefined) {
-    return undefined;
-  }
 
-  const left = parseIpv6SegmentSide(leftRaw ?? "");
-  const right = parseIpv6SegmentSide(rightRaw ?? "");
 
-  if (!left || !right) {
-    return undefined;
-  }
 
-  if (rightRaw === undefined) {
-    return left.length === 8 ? left : undefined;
-  }
-
-  const missing = 8 - left.length - right.length;
-
-  if (missing < 1) {
-    return undefined;
-  }
-
-  return [...left, ...new Array(missing).fill(0), ...right];
-}
 
-function parseIpv6SegmentSide(value: string): number[] | undefined {
-  if (!value) {
-    return [];
-  }
 
-  const segments: number[] = [];
 
-  const parts = value.split(":");
-
-  for (const [index, part] of parts.entries()) {
-    if (part.includes(".")) {
-      if (index !== parts.length - 1) {
-        return undefined;
-      }
-
-      const octets = parseIpv4Octets(part);
-
-      if (!octets) {
-        return undefined;
-      }
-
-      segments.push((octets[0] << 8) | octets[1], (octets[2] << 8) | octets[3]);
-      continue;
-    }
 
-    if (!/^[0-9a-f]{1,4}$/i.test(part)) {
-      return undefined;
-    }
-
-    segments.push(parseInt(part, 16));
-  }
-
-  return segments;
-}
-
-function isBlockedIpv6Segments(parts: number[]): boolean {
-  if (parts.length !== 8) {
-    return true;
-  }
-
-  const embeddedIpv4 = ipv4OctetsFromIpv6Segments(parts);
-
-  if (embeddedIpv4) {
-    return isBlockedIpv4Octets(embeddedIpv4);
-  }
-
-  const isAllZero = parts.every((part) => part === 0);
-
-  if (isAllZero || (parts.slice(0, 7).every((part) => part === 0) && parts[7] === 1)) {
-    return true;
-  }
-
-  const first = parts[0];
-
-  return (
-    (first & 0xfe00) === 0xfc00 ||
-    (first & 0xffc0) === 0xfe80 ||
-    (first & 0xff00) === 0xff00
-  );
-}
-
-function ipv4OctetsFromIpv6Segments(parts: number[]): number[] | undefined {
-  const trailingIpv4 = [
-    (parts[6] >> 8) & 0xff,
-    parts[6] & 0xff,
-    (parts[7] >> 8) & 0xff,
-    parts[7] & 0xff,
-  ];
-
-  if (parts.slice(0, 5).every((part) => part === 0) && (parts[5] === 0xffff || parts[5] === 0)) {
-    return trailingIpv4;
-  }
-
-  if (parts[0] === 0x64 && parts[1] === 0xff9b && parts.slice(2, 6).every((part) => part === 0)) {
-    return trailingIpv4;
-  }
-
-  if (parts[0] === 0x2002) {
-    return [
-      (parts[1] >> 8) & 0xff,
-      parts[1] & 0xff,
-      (parts[2] >> 8) & 0xff,
-      parts[2] & 0xff,
-    ];
-  }
-
-  return undefined;
-}
 
 function redactedGenericWebhookOutputRequest(request: GenericWebhookOutputRequest): Record<string, unknown> {
   return {