@caupulican/pi-adaptative 0.80.65 → 0.80.67

package/dist/core/agent-session.js

@@ -31,6 +31,7 @@ import { createCoreDiagnosticsToolDefinitions } from "./extensions/builtin.js";
 import { ExtensionRunner, wrapRegisteredTools, } from "./extensions/index.js";
 import { disposeExtensionEventSubscriptions } from "./extensions/loader.js";
 import { emitSessionShutdownEvent } from "./extensions/runner.js";
+import { GatewayRegistry } from "./gateways/channel-provider.js";
 import { decideDemand, ReflectionEngine, } from "./learning/reflection-engine.js";
 import { EffectivenessTracker } from "./memory/effectiveness-tracker.js";
 import { MemoryManager } from "./memory/memory-manager.js";
@@ -40,6 +41,7 @@ import { compactToolResultDetailsForRetention } from "./message-retention.js";
 import { resolveProfileModelSettings } from "./model-resolver.js";
 import { expandPromptTemplate } from "./prompt-templates.js";
 import { stripResourceProfileBlocks } from "./resource-profile-blocks.js";
+import { classifyToolTrust, UNTRUSTED_BOUNDARY_SYSTEM_RULE, wrapUntrustedText } from "./security/untrusted-boundary.js";
 import { CURRENT_SESSION_VERSION, getLatestCompactionEntry } from "./session-manager.js";
 import { matchesResourceProfilePattern, } from "./settings-manager.js";
 import { createSyntheticSourceInfo } from "./source-info.js";
@@ -123,6 +125,8 @@ export class AgentSession {
     _memoryManager = new MemoryManager();
     /** R4: tracks whether injected recall is actually used, to adapt the recall gate. */
     _effectivenessTracker = new EffectivenessTracker();
+    /** R8: registry for deployment-supplied gateway channels + schedulers (lifecycle driven by the host runner). */
+    _gatewayRegistry = new GatewayRegistry();
     _isChildSession;
     /** Memory providers registered by extensions via pi.registerMemoryProvider, applied on (re)init. */
     _pendingMemoryProviders = [];
@@ -350,26 +354,37 @@ export class AgentSession {
         };
         this.agent.afterToolCall = async ({ toolCall, args, result, isError }) => {
             const runner = this._extensionRunner;
-            if (!runner.hasHandlers("tool_result")) {
-                return undefined;
+            let content = result.content;
+            let details = result.details;
+            let resolvedIsError = isError;
+            if (runner.hasHandlers("tool_result")) {
+                const hookResult = await runner.emitToolResult({
+                    type: "tool_result",
+                    toolName: toolCall.name,
+                    toolCallId: toolCall.id,
+                    input: args,
+                    content,
+                    details,
+                    isError,
+                });
+                if (hookResult) {
+                    content = hookResult.content ?? content;
+                    details = hookResult.details;
+                    resolvedIsError = hookResult.isError ?? isError;
+                }
             }
-            const hookResult = await runner.emitToolResult({
-                type: "tool_result",
-                toolName: toolCall.name,
-                toolCallId: toolCall.id,
-                input: args,
-                content: result.content,
-                details: result.details,
-                isError,
-            });
-            if (!hookResult) {
+            // Untrusted-content boundary: structurally fence output from attacker-controllable sources
+            // (web/search, subagents, recall, third-party tools) so injection payloads are framed as data.
+            // First-party tools (read/grep/find/ls/edit/write/bash) are trusted and pass through unchanged.
+            if (classifyToolTrust(toolCall.name) === "untrusted") {
+                const source = `tool:${toolCall.name}`;
+                const wrapped = content.map((block) => block.type === "text" ? { ...block, text: wrapUntrustedText(block.text, source) } : block);
+                content = wrapped;
+            }
+            if (content === result.content && details === result.details && resolvedIsError === isError) {
                 return undefined;
             }
-            return {
-                content: hookResult.content,
-                details: hookResult.details,
-                isError: hookResult.isError ?? isError,
-            };
+            return { content, details, isError: resolvedIsError };
         };
     }
     // =========================================================================
@@ -659,6 +674,8 @@ export class AgentSession {
             this.abortBranchSummary();
             this.abortBash();
             this.agent.abort();
+            // R8: stop any deployment-registered gateway channels / schedulers.
+            void this._gatewayRegistry.stop().catch(() => { });
         }
         catch {
             // Dispose must succeed even if an abort hook throws.
@@ -896,6 +913,8 @@ export class AgentSession {
             // R6: situational soul — the active profile's identity prefix, switched atomically with the
             // profile's capabilities/model. Most prominent, so it comes first.
             this._buildSituationSoulPrompt(),
+            // Always-on untrusted-content boundary contract (gives the <untrusted_content> fences meaning).
+            UNTRUSTED_BOUNDARY_SYSTEM_RULE,
             this._buildSelfModificationPrompt(),
             this._buildAutonomyPrompt(),
             // Memory subsystem: static, frozen-per-session block (e.g. file-store MEMORY.md/USER.md).
@@ -2301,6 +2320,18 @@ export class AgentSession {
             this._pendingMemoryProviders.push(provider);
         }
     }
+    /** R8: the gateway/scheduler registry. A deployment runner registers providers and drives start/stop. */
+    get gateways() {
+        return this._gatewayRegistry;
+    }
+    /** R8: register a deployment-supplied transport channel (gateway). */
+    registerChannelProvider(provider) {
+        this._gatewayRegistry.registerChannel(provider);
+    }
+    /** R8: register a deployment-supplied job scheduler (cron). */
+    registerJobScheduler(provider) {
+        this._gatewayRegistry.registerScheduler(provider);
+    }
     _refreshToolRegistry(options) {
         const previousRegistryNames = new Set(this._toolRegistry.keys());
         const previousActiveToolNames = this.getActiveToolNames();