@camerontaylor/paseo-protocol 0.12.0-fork.1 → 0.13.0-fork.2

package/dist/addresses.d.ts

@@ -0,0 +1,6 @@
+/** Agent identity is qualified by its daemon; transport and reachability are separate. */
+export interface AgentAddress {
+    serverId: string;
+    agentId: string;
+}
+//# sourceMappingURL=addresses.d.ts.map

package/dist/addresses.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=addresses.js.map

package/dist/agent-labels.d.ts

@@ -1,3 +1,5 @@
+import type { AgentAddress } from "./addresses.js";
+export declare const PARENT_SERVER_ID_LABEL = "paseo.parent-server-id";
 export declare const PARENT_AGENT_ID_LABEL = "paseo.parent-agent-id";
 export declare function getOpenAgentTabLabel(clientId: string): string;
 export declare function isOpenAgentTabLabel(label: string): boolean;
@@ -7,4 +9,6 @@ export interface AgentLabelSource {
 export declare function getParentAgentIdFromLabels(labels: Record<string, unknown> | null | undefined): string | null;
 export declare function isDelegatedAgent(agent: AgentLabelSource): boolean;
 export declare function hasOpenAgentTab(labels: Record<string, unknown> | null | undefined): boolean;
+export declare function getParentAddressFromLabels(labels: Record<string, unknown> | null | undefined, serverId: string): AgentAddress | null;
+export declare function parentAddressLabels(parent: AgentAddress): Record<string, string>;
 //# sourceMappingURL=agent-labels.d.ts.map

package/dist/agent-labels.js

@@ -1,3 +1,4 @@
+export const PARENT_SERVER_ID_LABEL = "paseo.parent-server-id";
 export const PARENT_AGENT_ID_LABEL = "paseo.parent-agent-id";
 const OPEN_AGENT_TAB_LABEL_PREFIX = "paseo.open-agent-tab.";
 export function getOpenAgentTabLabel(clientId) {
@@ -18,4 +19,20 @@ export function isDelegatedAgent(agent) {
 export function hasOpenAgentTab(labels) {
     return Object.entries(labels ?? {}).some(([label, value]) => isOpenAgentTabLabel(label) && value === "true");
 }
+// Absent parent server label means the same host.
+export function getParentAddressFromLabels(labels, serverId) {
+    const agentId = getParentAgentIdFromLabels(labels);
+    if (!agentId)
+        return null;
+    const parentServerId = labels?.[PARENT_SERVER_ID_LABEL];
+    return {
+        serverId: typeof parentServerId === "string" && parentServerId.trim()
+            ? parentServerId.trim()
+            : serverId,
+        agentId,
+    };
+}
+export function parentAddressLabels(parent) {
+    return { [PARENT_AGENT_ID_LABEL]: parent.agentId, [PARENT_SERVER_ID_LABEL]: parent.serverId };
+}
 //# sourceMappingURL=agent-labels.js.map

package/dist/agent-message.d.ts

@@ -10,6 +10,7 @@ export declare const AgentMessageSchema: z.ZodObject<{
     }>;
     sender: z.ZodObject<{
         id: z.ZodString;
+        serverId: z.ZodOptional<z.ZodString>;
         title: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
     text: z.ZodString;

package/dist/agent-message.js

@@ -4,6 +4,7 @@ export const AgentMessageSchema = z.object({
     event: z.enum(["message", "finished", "errored", "permission-required", "closed"]),
     sender: z.object({
         id: z.string().min(1),
+        serverId: z.string().min(1).optional(),
         title: z.string().min(1).optional(),
     }),
     text: z.string(),

package/dist/binary-frames/demux.d.ts

@@ -1,6 +1,10 @@
+import { type HostRouteFrame } from "./host-route.js";
 import { type FileTransferFrame } from "./file-transfer.js";
 import { type TerminalStreamFrame } from "./terminal.js";
 export type BinaryFrame = {
+    kind: "host_route";
+    frame: HostRouteFrame;
+} | {
     kind: "terminal";
     frame: TerminalStreamFrame;
 } | {

package/dist/binary-frames/demux.js

@@ -1,7 +1,12 @@
+import { HOST_ROUTE_OPCODE, decodeHostRouteFrame } from "./host-route.js";
 import { decodeFileTransferFrame, FileTransferOpcode, } from "./file-transfer.js";
 import { decodeTerminalStreamFrame, TerminalStreamOpcode, } from "./terminal.js";
 export function decodeBinaryFrame(bytes) {
     switch (bytes[0]) {
+        case HOST_ROUTE_OPCODE: {
+            const frame = decodeHostRouteFrame(bytes);
+            return frame ? { kind: "host_route", frame } : null;
+        }
         case TerminalStreamOpcode.Output:
         case TerminalStreamOpcode.Input:
         case TerminalStreamOpcode.Resize:

package/dist/binary-frames/host-route.d.ts

@@ -0,0 +1,12 @@
+/** Routing adds a bounded header; the enclosed terminal/file frame is never re-encoded. */
+export declare const HOST_ROUTE_OPCODE = 48;
+export declare const MAX_HOST_ROUTE_ID_BYTES = 256;
+export declare const MAX_HOST_ROUTE_HEADER_BYTES: number;
+export declare const MAX_ROUTED_PAYLOAD_BYTES: number;
+export interface HostRouteFrame {
+    routeId: string;
+    payload: Uint8Array;
+}
+export declare function encodeHostRouteFrame(routeId: string, payload: Uint8Array): Uint8Array;
+export declare function decodeHostRouteFrame(bytes: Uint8Array): HostRouteFrame | null;
+//# sourceMappingURL=host-route.d.ts.map

package/dist/binary-frames/host-route.js

@@ -0,0 +1,36 @@
+import { MAX_WEBSOCKET_MESSAGE_BYTES } from "../websocket-message-limit.js";
+/** Routing adds a bounded header; the enclosed terminal/file frame is never re-encoded. */
+export const HOST_ROUTE_OPCODE = 0x30;
+export const MAX_HOST_ROUTE_ID_BYTES = 256;
+export const MAX_HOST_ROUTE_HEADER_BYTES = 3 + MAX_HOST_ROUTE_ID_BYTES;
+export const MAX_ROUTED_PAYLOAD_BYTES = MAX_WEBSOCKET_MESSAGE_BYTES - MAX_HOST_ROUTE_HEADER_BYTES;
+export function encodeHostRouteFrame(routeId, payload) {
+    const id = new TextEncoder().encode(routeId);
+    if (!id.length || id.length > MAX_HOST_ROUTE_ID_BYTES)
+        throw new Error("Invalid host route ID");
+    if (payload.byteLength > MAX_ROUTED_PAYLOAD_BYTES)
+        throw new Error("Host frame is too large");
+    const frame = new Uint8Array(3 + id.length + payload.byteLength);
+    frame[0] = HOST_ROUTE_OPCODE;
+    new DataView(frame.buffer).setUint16(1, id.length);
+    frame.set(id, 3);
+    frame.set(payload, 3 + id.length);
+    return frame;
+}
+export function decodeHostRouteFrame(bytes) {
+    if (bytes[0] !== HOST_ROUTE_OPCODE || bytes.length < 3)
+        return null;
+    const length = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint16(1);
+    if (!length || length > MAX_HOST_ROUTE_ID_BYTES || bytes.length < 3 + length)
+        return null;
+    if (bytes.length - 3 - length > MAX_ROUTED_PAYLOAD_BYTES)
+        return null;
+    try {
+        const routeId = new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(3, 3 + length));
+        return { routeId, payload: bytes.subarray(3 + length) };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=host-route.js.map

package/dist/binary-frames/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./demux.js";
 export * from "./file-transfer.js";
 export * from "./terminal.js";
+export * from "./host-route.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/binary-frames/index.js

@@ -1,4 +1,5 @@
 export * from "./demux.js";
 export * from "./file-transfer.js";
 export * from "./terminal.js";
+export * from "./host-route.js";
 //# sourceMappingURL=index.js.map

package/dist/client-capabilities.d.ts

@@ -16,6 +16,7 @@ export declare const CLIENT_CAPS: {
     readonly timelineReplacementInvalidation: "timeline_replacement_invalidation";
     readonly timelineNotifications: "timeline_notifications";
     readonly pluginTimelineItems: "plugin_timeline_items";
+    readonly workspaceSetupObservation: "workspace_setup_observation";
     readonly workspaceSetupBlocked: "workspace_setup_blocked";
     readonly durableAgentQueue: "durable_agent_queue";
     readonly durableVoiceInputV1: "durable_voice_input_v1";

package/dist/client-capabilities.js

@@ -45,6 +45,7 @@ export const CLIENT_CAPS = {
     timelineNotifications: "timeline_notifications",
     // COMPAT(pluginTimelineItems): added in v0.8.0, remove after 2027-03-07 once client floor >= v0.8.0.
     pluginTimelineItems: "plugin_timeline_items",
+    workspaceSetupObservation: "workspace_setup_observation",
     // COMPAT(workspaceSetupBlocked): added in v0.8.0, remove after 2027-03-07 once client floor >= v0.8.0.
     workspaceSetupBlocked: "workspace_setup_blocked",
     // COMPAT(durableAgentQueue): fork addition (TM-02). The daemon only mirrors

package/dist/connection-offer.d.ts

@@ -13,6 +13,7 @@ export declare const ConnectionOfferV2Schema: z.ZodObject<{
         endpoint: z.ZodString;
         useTls: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
+    minimumSecurityMode: z.ZodOptional<z.ZodLiteral<"protected">>;
 }, z.core.$strip>;
 export type ConnectionOfferV2 = z.infer<typeof ConnectionOfferV2Schema>;
 export declare const ConnectionOfferSchema: z.ZodObject<{
@@ -23,6 +24,7 @@ export declare const ConnectionOfferSchema: z.ZodObject<{
         endpoint: z.ZodString;
         useTls: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
+    minimumSecurityMode: z.ZodOptional<z.ZodLiteral<"protected">>;
 }, z.core.$strip>;
 export type ConnectionOffer = ConnectionOfferV2;
 export declare function decodeOfferFragmentPayload(encoded: string): unknown;

package/dist/connection-offer.js

@@ -13,6 +13,9 @@ export const ConnectionOfferV2Schema = z.object({
         endpoint: z.string().min(1),
         useTls: z.boolean().optional(),
     }),
+    // COMPAT(relayProtectedSecurity): added in v0.13.0. Present when the daemon requires
+    // protected endpoint security; clients pin it before their first handshake.
+    minimumSecurityMode: z.literal("protected").optional(),
 });
 export const ConnectionOfferSchema = ConnectionOfferV2Schema;
 function decodeBase64UrlToUtf8(input) {

package/dist/daemon-endpoints.js

@@ -21,12 +21,17 @@ export function parseRelayConnectionUri(input) {
     }
     const endpoint = normalizeHostPort(url.host);
     const password = url.searchParams.get("password") || undefined;
+    const security = url.searchParams.get("security");
+    if (security !== null && security !== "protected") {
+        throw new Error("Relay connection URI has an unsupported security mode");
+    }
     return {
         offer: {
             v: 2,
             serverId,
             daemonPublicKeyB64: key,
             relay: { endpoint, useTls: url.searchParams.get("ssl") === "true" },
+            ...(security === "protected" ? { minimumSecurityMode: "protected" } : {}),
         },
         ...(password ? { password } : {}),
     };
@@ -36,6 +41,9 @@ export function serializeRelayConnectionUri(parts) {
     url.searchParams.set("key", parts.offer.daemonPublicKeyB64);
     if (parts.offer.relay.useTls)
         url.searchParams.set("ssl", "true");
+    if (parts.offer.minimumSecurityMode) {
+        url.searchParams.set("security", parts.offer.minimumSecurityMode);
+    }
     if (parts.password)
         url.searchParams.set("password", parts.password);
     return url.toString();