@capybara-hq/kernel 0.1.0-rc.26 → 0.1.0-rc.28

package/dist/channels/phrases.js

@@ -96,6 +96,15 @@ export const CHANNEL_PHRASES = {
     networkAllowOnce: { zh: "这次允许", en: "Allow this time" },
     /** A network ask's 「always」 button. */
     networkAllowAlways: { zh: "这台设备一直允许", en: "Always allow on this device" },
+    /** A git push ask's card title (`{repo}`; sandbox git credentials spec §7). */
+    gitTitle: {
+        zh: "智能体想推送到 {repo}，允许吗？",
+        en: "The agent wants to push to {repo}. Allow?",
+    },
+    /** A git push ask's 「once」 button. */
+    gitAllowOnce: { zh: "这次允许", en: "Allow this time" },
+    /** A git push ask's 「always」 button: the person's standing allow for the repository. */
+    gitAllowAlways: { zh: "这个仓库一直允许", en: "Always allow this repository" },
     /** 提问卡片的随附文本。 */
     questionTitle: { zh: "需要你的回答", en: "Your input is needed" },
     /** 连接卡片的随附文本。 */

package/dist/config/schema.d.ts

@@ -144,6 +144,14 @@ export declare const KernelConfigSchema: z.ZodObject<{
         driftIntervalHours: z.ZodDefault<z.ZodNumber>;
         maxResultReadChars: z.ZodDefault<z.ZodNumber>;
         oauthAllowInsecureLoopback: z.ZodDefault<z.ZodBoolean>;
+        git: z.ZodPrefault<z.ZodObject<{
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            gatewayUrl: z.ZodOptional<z.ZodURL>;
+            maxBytesPerRun: z.ZodDefault<z.ZodNumber>;
+            idleTimeoutMs: z.ZodDefault<z.ZodNumber>;
+            maxConcurrentPerOrg: z.ZodDefault<z.ZodNumber>;
+            ticketTtlSeconds: z.ZodDefault<z.ZodNumber>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     channels: z.ZodDefault<z.ZodObject<{
         leaseTtlMs: z.ZodDefault<z.ZodNumber>;

package/dist/config/schema.js

@@ -773,6 +773,68 @@ export const KernelConfigSchema = z.object({
             .meta(meta({
             description: "Allow OAuth discovery, registration and token endpoints over plain http on loopback hosts (development and tests only; production requires https)",
         })),
+        git: z
+            .object({
+            enabled: z
+                .boolean()
+                .default(true)
+                .meta(meta({
+                hot: true,
+                description: "Serve the git gateway that lets sandboxes clone and push over HTTPS with run tickets; when off the gateway refuses every request",
+            })),
+            gatewayUrl: z
+                .url({ protocol: /^https?$/ })
+                .refine((u) => {
+                const x = URL.canParse(u) ? new URL(u) : null;
+                return (x !== null &&
+                    x.pathname === "/" &&
+                    !x.search &&
+                    !x.hash &&
+                    !x.username &&
+                    !x.password);
+            }, { message: "must be an origin: no path, query, fragment or credentials" })
+                .optional()
+                .meta(meta({
+                description: "Origin (http or https, no path, query or credentials) of the kernel as sandboxes reach it, e.g. https://kernel.internal:8080; when unset the kernel uses http.publicUrl",
+            })),
+            maxBytesPerRun: z
+                .number()
+                .int()
+                .min(1048576)
+                .max(107374182400)
+                .default(5368709120)
+                .meta(meta({
+                description: "Maximum bytes the git gateway transfers (both directions) for one run, between 1 MiB and 100 GiB (default 5 GiB)",
+            })),
+            idleTimeoutMs: z
+                .number()
+                .int()
+                .min(1000)
+                .max(3600000)
+                .default(60000)
+                .meta(meta({
+                description: "A git gateway request that moves no data for this many milliseconds is aborted, between 1000 and 3600000",
+            })),
+            maxConcurrentPerOrg: z
+                .number()
+                .int()
+                .min(1)
+                .max(1000)
+                .default(8)
+                .meta(meta({
+                description: "Maximum git gateway requests in flight at once for one org, between 1 and 1000",
+            })),
+            ticketTtlSeconds: z
+                .number()
+                .int()
+                .min(60)
+                .max(86400)
+                .default(900)
+                .meta(meta({
+                description: "Lifetime in seconds of the ticket issued for one exec to the git gateway (a ticket also dies when its run ends), between 60 and 86400",
+            })),
+        })
+            .prefault({}),
     })
         .default({
         timeoutMs: 60000,
@@ -787,6 +849,13 @@ export const KernelConfigSchema = z.object({
         driftIntervalHours: 24,
         maxResultReadChars: 20000,
         oauthAllowInsecureLoopback: false,
+        git: {
+            enabled: true,
+            maxBytesPerRun: 5368709120,
+            idleTimeoutMs: 60000,
+            maxConcurrentPerOrg: 8,
+            ticketTtlSeconds: 900,
+        },
     }),
     channels: z
         .object({

package/dist/conversations/events.d.ts

@@ -4,6 +4,15 @@ import { z } from "zod";
 export declare const NETWORK_ASK_MAX_HOSTS = 20;
 /** The longest host name a network ask or `network_blocked` event carries. */
 export declare const NETWORK_HOST_MAX_CHARS = 255;
+/** The most refs one git push ask (and its `approval_requested.git`) lists. */
+export declare const GIT_ASK_MAX_REFS = 20;
+/** The longest ref name a git push ask carries. */
+export declare const GIT_REF_MAX_CHARS = 255;
+/**
+ * The longest `<owner>/<repo>` a git push ask carries (GitHub allows 39 + 100 characters): the
+ * grant key `git:push:<owner>/<repo>` must fit an org's `forbiddenTools` entry (200 characters).
+ */
+export declare const GIT_REPO_MAX_CHARS = 191;
 /** The longest deny reason (characters): the decision route's limit and `approval_decided.reason`'s. */
 export declare const APPROVAL_DENY_REASON_MAX_CHARS = 500;
 /** 一条 `media_excluded` 事件最多的附件数。 */
@@ -716,6 +725,11 @@ export declare const ConversationEventSchema: z.ZodDiscriminatedUnion<[z.ZodObje
         network: z.ZodOptional<z.ZodObject<{
             hosts: z.ZodArray<z.ZodString>;
         }, z.core.$strip>>;
+        git: z.ZodOptional<z.ZodObject<{
+            host: z.ZodString;
+            repo: z.ZodString;
+            refs: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"approval_decided">;

package/dist/conversations/events.js

@@ -31,6 +31,15 @@ const ApproverFields = {
 export const NETWORK_ASK_MAX_HOSTS = 20;
 /** The longest host name a network ask or `network_blocked` event carries. */
 export const NETWORK_HOST_MAX_CHARS = 255;
+/** The most refs one git push ask (and its `approval_requested.git`) lists. */
+export const GIT_ASK_MAX_REFS = 20;
+/** The longest ref name a git push ask carries. */
+export const GIT_REF_MAX_CHARS = 255;
+/**
+ * The longest `<owner>/<repo>` a git push ask carries (GitHub allows 39 + 100 characters): the
+ * grant key `git:push:<owner>/<repo>` must fit an org's `forbiddenTools` entry (200 characters).
+ */
+export const GIT_REPO_MAX_CHARS = 191;
 /** The longest deny reason (characters): the decision route's limit and `approval_decided.reason`'s. */
 export const APPROVAL_DENY_REASON_MAX_CHARS = 500;
 /** 一条 `media_excluded` 事件最多的附件数。 */
@@ -604,6 +613,17 @@ export const ConversationEventSchema = z.discriminatedUnion("type", [
                 .max(NETWORK_ASK_MAX_HOSTS),
         })
             .optional(),
+        /**
+         * A git push ask (sandbox git credentials spec §7): the host, repository and refs the push
+         * the gateway held would have updated. Display only, never model-visible, as `network`.
+         */
+        git: z
+            .object({
+            host: z.string().min(1).max(NETWORK_HOST_MAX_CHARS),
+            repo: z.string().min(1).max(GIT_REPO_MAX_CHARS),
+            refs: z.array(z.string().min(1).max(GIT_REF_MAX_CHARS)).max(GIT_ASK_MAX_REFS),
+        })
+            .optional(),
         ...ApproverFields,
     })),
     /**

package/dist/db/kernel-schema.d.ts

@@ -1,4 +1,4 @@
-import type { ConversationSource, FileSystemHandle, ParsedTheme, SandboxTier, SkillInvocation } from "@capybara-hq/plugin-sdk";
+import type { ConversationSource, FileSystemHandle, GitHostEntry, ParsedTheme, SandboxTier, SkillInvocation } from "@capybara-hq/plugin-sdk";
 import type { ColumnType, Generated, Kysely } from "kysely";
 import type { ModelRef } from "../agents/definition.js";
 import type { ScheduleChat, ScheduleMarker, ScheduleMode, SchedulePauseReason, ScheduleStatus, ScheduleTrigger, TaskRunSkipReason, TaskRunStatus } from "../schedules/types.js";
@@ -454,6 +454,18 @@ export interface ConnectorsTable {
      * hash, mode: null }`); null when unknown (custom connectors, connectors before 0106).
      */
     guide_ack: ColumnType<GuideAckJson | null, string | null | undefined, string | null>;
+    /** 0126: the git hosts this connector declares (null: none). */
+    git_hosts: ColumnType<GitHostEntry[] | null, string | null | undefined, string | null>;
+    /** 0126: an org-owned connector serves as a git gateway source (personal ones always do). */
+    use_for_git: Generated<boolean>;
+    /** 0127: the org's policy for pushes through this connector (virtual tool `git_push`). */
+    git_push_policy: Generated<"allow" | "ask" | "deny">;
+    /**
+     * 0129: the plugin (catalog item) whose switch-off disabled this connector; null = not switched
+     * off by a plugin (an org admin's own disable, or enabled). Switching that plugin back on
+     * re-enables exactly the connectors it disabled.
+     */
+    disabled_by_plugin_id: ColumnType<string | null, string | null | undefined, string | null>;
 }
 /**
  * 0104: a member's own policy for one tool of a personal-credential connector, for calls made with
@@ -539,9 +551,12 @@ export interface ApprovalsTable {
     } | null, string | null | undefined, string | null>;
     /** 0086: the scopes the person may choose (null: derived, see `approvals.service.ts`). */
     scopes: ColumnType<("once" | "session" | "always")[] | null, ("once" | "session" | "always")[] | null | undefined, ("once" | "session" | "always")[] | null>;
-    /** 0114: what is asked: a tool call ('tool') or a refused network domain ('network'). */
-    kind: Generated<"tool" | "network">;
-    /** 0114: a network ask's hosts, command, kept result and outcome (null for tool approvals). */
+    /**
+     * 0114: what is asked: a tool call ('tool') or a refused network domain ('network'); 0126: a
+     * git push the gateway held ('git').
+     */
+    kind: Generated<"tool" | "network" | "git">;
+    /** 0114: a network or git ask's facts, kept result and outcome (null for tool approvals). */
     detail: ColumnType<unknown | null, string | null | undefined, string | null>;
 }
 /** 0010_tools.sql：AskUserQuestion 提问。 */

package/dist/errors.d.ts

@@ -191,6 +191,11 @@ export declare const ERROR_CODES: {
     readonly "catalog.marketplace_browse_disabled": 409;
     readonly "catalog.custom_disabled": 403;
     readonly "catalog.not_deployed": 409;
+    /**
+     * The connector an install planned to reuse (a template it asked no input for) was removed before
+     * the install ran: retry it, so the new plan asks for the input.
+     */
+    readonly "catalog.connector_removed": 409;
     readonly "catalog.icon_not_found": 404;
     readonly "catalog.guide_not_found": 404;
     /** The check is not in the setup guide rendered for that mode and audience (setup guides v2 §10.3). */

package/dist/errors.js

@@ -191,6 +191,11 @@ export const ERROR_CODES = {
     "catalog.marketplace_browse_disabled": 409,
     "catalog.custom_disabled": 403,
     "catalog.not_deployed": 409,
+    /**
+     * The connector an install planned to reuse (a template it asked no input for) was removed before
+     * the install ran: retry it, so the new plan asks for the input.
+     */
+    "catalog.connector_removed": 409,
     "catalog.icon_not_found": 404,
     "catalog.guide_not_found": 404,
     /** The check is not in the setup guide rendered for that mode and audience (setup guides v2 §10.3). */

package/dist/git/gateway.d.ts

@@ -0,0 +1,93 @@
+import type { FastifyReply, FastifyRequest } from "fastify";
+import type { Redis } from "ioredis";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import type { KernelLogger } from "../log.js";
+import { Credentials } from "../tools/credentials.js";
+import { GitSources } from "./sources.js";
+import { GitTickets } from "./tickets.js";
+/**
+ * The git gateway (sandbox git credentials spec §5): relays git smart-HTTP from a sandbox to a git
+ * host, authenticated by a run ticket, adding the actor's credential on the way out. Stateless
+ * across replicas: the ticket, the source, the push policy, the byte and concurrency counters are
+ * read from Redis / PG on every request; only the request's own idle timer lives in the process.
+ *
+ * The route (`/git/v1/<host>/<owner>/<repo>[.git]/<endpoint>`, {@link GIT_GATEWAY_PREFIX}) is a raw
+ * Fastify route (`gateway.route.ts`), like the channel webhook: git sends no CSRF header and the
+ * ticket is not an API credential, so neither the `AuthGuard` nor the API's error envelope apply.
+ * Everything git shows is plain text or pkt-lines in English.
+ */
+/** The route prefix. */
+export declare const GIT_GATEWAY_PREFIX = "/git/v1/";
+/** The smart-HTTP services. */
+export type GitService = "git-upload-pack" | "git-receive-pack";
+/** A parsed gateway path. */
+export interface GitGatewayTarget {
+    host: string;
+    /** `<owner>/<repo>` as written (validated), for the upstream URL. */
+    path: string;
+    /** `<owner>/<repo>` normalized (lower case, no `.git`), for policy and allowlists. */
+    repo: string;
+    /** `info/refs` (GET, with `service`) or the service endpoint itself (POST). */
+    endpoint: "info/refs" | GitService;
+    service: GitService;
+}
+/**
+ * Test seam (`KernelAppOptions.overrides`): the upstream origin of a git host (default
+ * `https://<host>`), e.g. a loopback fake for `github.com`. Production validation is unchanged:
+ * the fake is reached through the same `safeFetch` rules (loopback http only under
+ * `tools.oauthAllowInsecureLoopback`).
+ */
+export declare const GIT_UPSTREAM_ORIGIN: unique symbol;
+export type GitUpstreamOrigin = (host: string) => string;
+/**
+ * Parses `/git/v1/<host>/<owner>/<repo>[.git]/<endpoint>` with its query: GET `info/refs` with
+ * `service=git-upload-pack|git-receive-pack` and nothing else in the query, or POST
+ * `git-upload-pack` / `git-receive-pack` without a query. Anything else (dumb HTTP, other paths,
+ * other methods) is null (404).
+ */
+export declare function parseGitGatewayPath(method: string, url: string): GitGatewayTarget | null;
+/**
+ * Whether the ticket's repository allowlist admits `repo` (normalized). Entries are
+ * `<owner>/<repo>`, `<owner>/*` or `*`, compared case-insensitively; no list admits every one.
+ */
+export declare function repoAllowed(repos: readonly string[] | undefined, repo: string): boolean;
+/** The Redis counter of a run's relayed bytes. */
+export declare const gitBytesKey: (runId: string) => string;
+/** The Redis counter of an org's open gateway requests. */
+export declare const gitConcurrencyKey: (orgId: string) => string;
+export declare class GitGateway {
+    private readonly tickets;
+    private readonly sources;
+    private readonly credentials;
+    private readonly db;
+    private readonly redis;
+    /** Read per request: `tools.git.*` is read live. */
+    private readonly config;
+    private readonly log;
+    private readonly upstreamOrigin?;
+    constructor(tickets: Pick<GitTickets, "resolve">, sources: Pick<GitSources, "sourcesFor">, credentials: Pick<Credentials, "gitAuthorization" | "gitUnauthorized">, db: KernelDb, redis: Redis, 
+    /** Read per request: `tools.git.*` is read live. */
+    config: Pick<KernelConfigService, "get">, log: Pick<KernelLogger, "info" | "warn" | "debug">, upstreamOrigin?: GitUpstreamOrigin | undefined);
+    /** Handles one gateway request (the raw route's handler). */
+    handle(req: FastifyRequest, reply: FastifyReply): Promise<void>;
+    /** The `git.push` audit row of a receive-pack and the run's fetch counters (best effort). */
+    private afterRequest;
+    /**
+     * Takes one of the org's gateway slots (Redis `git-conc:<orgId>`, TTL refreshed by every
+     * request and every byte meter flush) and returns how many are in use now with the slot's
+     * release (idempotent; a counter that went below zero after an expiry is reset).
+     */
+    private acquireOrgSlot;
+    private done;
+    private relay;
+    /** The push decision for this target (spec §7). */
+    private decide;
+    /**
+     * Records a refused push for the exec (`git-ask:<execId>`, read by the Bash pipeline after the
+     * command) and, for an unattended run without a task grant, the missing grant on the task run.
+     */
+    private recordRefusal;
+    /** The connector's auth (it may have changed since the source was chosen); null when gone. */
+    private connectorAuth;
+}