@appliqation/agent-core 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -1,12 +1,13 @@
|
|
|
1
1
|
# @appliqation/agent-core
|
|
2
2
|
|
|
3
|
-
**The shared engine every standalone Appliqation agent is built from.** Not an app on its own — no CLI, no `.env` — just the generic, workflow-agnostic pieces that [`appliqation-autotest`](https://github.com/appliqation/
|
|
3
|
+
**The shared engine every standalone Appliqation agent is built from.** Not an app on its own — no CLI, no `.env` — just the generic, workflow-agnostic pieces that [`appliqation-autotest`](https://github.com/appliqation/autotest), [`appliqation-scriptgen`](https://github.com/appliqation/scriptgen), [`appliqation-defect-fix`](https://github.com/appliqation/defect-fix), [`appliqation-pr-raise`](https://github.com/appliqation/pr-raise), [`appliqation-explorer`](https://github.com/appliqation/explorer), and [`appliqation-autopilot`](https://github.com/appliqation/autopilot) each build on:
|
|
4
4
|
|
|
5
5
|
- **`/engine`** — the think→act→observe tool-calling loop, budget tracking (calls/pages/time/turns), and a workflow runner that fetches a named prompt (from Appliqation's MCP server or a local file) and runs it through that loop.
|
|
6
6
|
- **`/appq`** — a JSON-RPC client for Appliqation's MCP API, plus scenario/test-set/run resolvers that always derive `project_id`/`url` from a source of truth (a scenario ID, a TC UUID) rather than accepting a second, possibly-diverging input.
|
|
7
7
|
- **`/providers`** — Anthropic and OpenAI adapters implementing one common interface, including prompt caching and image-handling for both wire formats.
|
|
8
|
-
- **`/tools`** — a Playwright-backed browser-tool palette, the tool-allowlist gating mechanism every agent's own safety boundary is built on, a destructive-action click gate, auth-session resolution, and per-test-case role inference.
|
|
8
|
+
- **`/tools`** — a Playwright-backed browser-tool palette (multi-tab aware — `browser_tabs`/`browser_resize`/`browser_evaluate`), an HTTP client for API test cases (`http_request`, with dry-run write-verb suppression), the tool-allowlist gating mechanism every agent's own safety boundary is built on, a destructive-action click gate, an argument-level read-only gate for Appliqation's project-context document, auth-session resolution (UI storageState and API credentials), and per-test-case role/test-type inference.
|
|
9
9
|
- **`/evidence`** — screenshot/console/network/accessibility-snapshot capture with cursor-based delta reads.
|
|
10
|
+
- **`/audit`** — optional, best-effort run logging (`AuditRecord`/`AuditSink`, MongoDB and local-JSONL-file implementations) that every sibling agent can opt into, read back by [`appliqation-dashboard`](https://github.com/appliqation/dashboard). A write failure here never affects the real run it's describing.
|
|
10
11
|
|
|
11
12
|
## Design principle: mechanism shared, domain knowledge local
|
|
12
13
|
|
|
@@ -17,14 +18,18 @@ Every module here is either genuinely universal, or an explicit injection point
|
|
|
17
18
|
|
|
18
19
|
## Installation
|
|
19
20
|
|
|
20
|
-
|
|
21
|
+
```bash
|
|
22
|
+
npm install @appliqation/agent-core
|
|
23
|
+
```
|
|
21
24
|
|
|
22
25
|
```json
|
|
23
26
|
"dependencies": {
|
|
24
|
-
"@appliqation/agent-core": "
|
|
27
|
+
"@appliqation/agent-core": "^0.1.0"
|
|
25
28
|
}
|
|
26
29
|
```
|
|
27
30
|
|
|
31
|
+
Requires `playwright` and `@appliqation/automation-sdk` as peer dependencies (already a dependency of every consuming agent in this family).
|
|
32
|
+
|
|
28
33
|
## Development
|
|
29
34
|
|
|
30
35
|
```bash
|
package/dist/tools/apiTools.d.ts
CHANGED
|
@@ -14,7 +14,8 @@ export declare class ApiRequestTools {
|
|
|
14
14
|
private readonly context;
|
|
15
15
|
private readonly dryRun;
|
|
16
16
|
private readonly requestHistory;
|
|
17
|
-
|
|
17
|
+
private readonly allowedOrigin;
|
|
18
|
+
constructor(context: APIRequestContext, dryRun?: boolean, baseUrl?: string);
|
|
18
19
|
getRequestHistory(): ApiRequestRecord[];
|
|
19
20
|
dispatch(name: string, args: Record<string, unknown>): Promise<ToolResult>;
|
|
20
21
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"apiTools.d.ts","sourceRoot":"","sources":["../../src/tools/apiTools.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI1D,eAAO,MAAM,aAAa,EAAE,UAAU,EAkBrC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,qBAAa,eAAe;
|
|
1
|
+
{"version":3,"file":"apiTools.d.ts","sourceRoot":"","sources":["../../src/tools/apiTools.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI1D,eAAO,MAAM,aAAa,EAAE,UAAU,EAkBrC,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,EAAE,EAAE,OAAO,CAAC;IACZ,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,qBAAa,eAAe;IAKxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA0B;IACzD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAGhC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,GAAE,OAAe,EASxC,OAAO,CAAC,EAAE,MAAM;IAKlB,iBAAiB,IAAI,gBAAgB,EAAE;IAIjC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;CAyDjF"}
|
package/dist/tools/apiTools.js
CHANGED
|
@@ -34,9 +34,20 @@ export class ApiRequestTools {
|
|
|
34
34
|
context;
|
|
35
35
|
dryRun;
|
|
36
36
|
requestHistory = [];
|
|
37
|
-
|
|
37
|
+
allowedOrigin;
|
|
38
|
+
constructor(context, dryRun = false,
|
|
39
|
+
// The same baseURL the context itself was constructed with (whatever's
|
|
40
|
+
// configured via extraHTTPHeaders — the real project credential — gets
|
|
41
|
+
// attached to EVERY request Playwright sends through this context,
|
|
42
|
+
// regardless of host). Restricting url to this origin is what stops a
|
|
43
|
+
// model tricked into requesting an attacker-controlled URL (a malicious
|
|
44
|
+
// API response, injected test data) from carrying that credential along
|
|
45
|
+
// with it. Optional and unenforced when omitted, for callers with no
|
|
46
|
+
// fixed base to scope against.
|
|
47
|
+
baseUrl) {
|
|
38
48
|
this.context = context;
|
|
39
49
|
this.dryRun = dryRun;
|
|
50
|
+
this.allowedOrigin = baseUrl ? new URL(baseUrl).origin : undefined;
|
|
40
51
|
}
|
|
41
52
|
getRequestHistory() {
|
|
42
53
|
return [...this.requestHistory];
|
|
@@ -48,6 +59,23 @@ export class ApiRequestTools {
|
|
|
48
59
|
const url = String(args.url ?? '');
|
|
49
60
|
const headers = args.headers ?? undefined;
|
|
50
61
|
const body = args.body;
|
|
62
|
+
if (this.allowedOrigin) {
|
|
63
|
+
let resolvedOrigin;
|
|
64
|
+
try {
|
|
65
|
+
resolvedOrigin = new URL(url, this.allowedOrigin).origin;
|
|
66
|
+
}
|
|
67
|
+
catch {
|
|
68
|
+
return { ok: false, text: `Invalid URL "${url}".` };
|
|
69
|
+
}
|
|
70
|
+
if (resolvedOrigin !== this.allowedOrigin) {
|
|
71
|
+
return {
|
|
72
|
+
ok: false,
|
|
73
|
+
text: `Blocked: "${url}" resolves to ${resolvedOrigin}, outside the API under test ` +
|
|
74
|
+
`(${this.allowedOrigin}). This context's credentials are scoped to that origin and are not ` +
|
|
75
|
+
`sent elsewhere — not executed.`,
|
|
76
|
+
};
|
|
77
|
+
}
|
|
78
|
+
}
|
|
51
79
|
if (this.dryRun && WRITE_VERBS.has(method)) {
|
|
52
80
|
this.requestHistory.push({ method, url, status: null, ok: true, dryRunSuppressed: true, timestamp: Date.now() });
|
|
53
81
|
console.error(`[dry-run] would send ${method} ${url} with body: ${JSON.stringify(body)}`);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"apiTools.js","sourceRoot":"","sources":["../../src/tools/apiTools.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,UAAU;AACV,EAAE;AACF,gEAAgE;AAChE,yEAAyE;AACzE,yEAAyE;AACzE,8DAA8D;AAK9D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,wGAAwG;YACxG,wFAAwF;YACxF,iGAAiG;QACnG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;gBAC3F,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8DAA8D,EAAE;gBACpG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;gBAC3E,IAAI,EAAE,EAAE,WAAW,EAAE,mFAAmF,EAAE;aAC3G;YACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;SAC5B;KACF;CACF,CAAC;AAWF,oFAAoF;AACpF,MAAM,OAAO,eAAe;
|
|
1
|
+
{"version":3,"file":"apiTools.js","sourceRoot":"","sources":["../../src/tools/apiTools.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,UAAU;AACV,EAAE;AACF,gEAAgE;AAChE,yEAAyE;AACzE,yEAAyE;AACzE,8DAA8D;AAK9D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,wGAAwG;YACxG,wFAAwF;YACxF,iGAAiG;QACnG,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kDAAkD,EAAE;gBAC3F,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,8DAA8D,EAAE;gBACpG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iCAAiC,EAAE;gBAC3E,IAAI,EAAE,EAAE,WAAW,EAAE,mFAAmF,EAAE;aAC3G;YACD,QAAQ,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;SAC5B;KACF;CACF,CAAC;AAWF,oFAAoF;AACpF,MAAM,OAAO,eAAe;IAKP;IACA;IALF,cAAc,GAAuB,EAAE,CAAC;IACxC,aAAa,CAAqB;IAEnD,YACmB,OAA0B,EAC1B,SAAkB,KAAK;IACxC,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IACnE,sEAAsE;IACtE,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,+BAA+B;IAC/B,OAAgB;QAVC,YAAO,GAAP,OAAO,CAAmB;QAC1B,WAAM,GAAN,MAAM,CAAiB;QAWxC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,iBAAiB;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,IAA6B;QACxD,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAI,GAAG,EAAE,CAAC;QAEtF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACnC,MAAM,OAAO,GAAI,IAAI,CAAC,OAA8C,IAAI,SAAS,CAAC;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,IAAI,cAAsB,CAAC;YAC3B,IAAI,CAAC;gBACH,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC;YACtD,CAAC;YACD,IAAI,cAAc,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC1C,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,IAAI,EACF,aAAa,GAAG,iBAAiB,cAAc,+BAA+B;wBAC9E,IAAI,IAAI,CAAC,aAAa,sEAAsE;wBAC5F,gCAAgC;iBACnC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACjH,OAAO,CAAC,KAAK,CAAC,wBAAwB,MAAM,IAAI,GAAG,eAAe,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1F,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,aAAa,MAAM,IAAI,GAAG,iEAAiE;aAClG,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7C,MAAM;gBACN,OAAO;gBACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAEtG,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrG,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAoB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1E,CAAC;IACH,CAAC;CACF"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@appliqation/agent-core",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
4
|
"description": "Shared engine (think->act->observe loop, budget tracking, appq MCP client, gated tool dispatch, Playwright browser tools, evidence capture) for Appliqation's family of standalone agents.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|