@corenel/sidecar 0.2.0 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +137 -91
- package/dist/cli.js +6689 -1556
- package/package.json +14 -13
package/CHANGELOG.md
CHANGED
|
@@ -1,91 +1,137 @@
|
|
|
1
|
-
# Changelog
|
|
2
|
-
|
|
3
|
-
## 0.
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
###
|
|
29
|
-
- `--
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
- `--
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
-
|
|
90
|
-
|
|
91
|
-
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## 0.3.0
|
|
4
|
+
|
|
5
|
+
The isolation release. 0.2.0 could expose a machine's files and shell to a
|
|
6
|
+
session and run crew agents unattended; it always did that work in its own
|
|
7
|
+
process, on the host, with whatever reach the host had. This release puts a
|
|
8
|
+
boundary around a run and lets an external coding agent be governed by it.
|
|
9
|
+
|
|
10
|
+
Everything is additive and off by default. A 0.2.0 setup behaves exactly as it
|
|
11
|
+
did unless you pass one of the new flags.
|
|
12
|
+
|
|
13
|
+
### Sessions in a sandbox
|
|
14
|
+
- `--isolation <none|microvm>` chooses how a session confines a run. `none` is
|
|
15
|
+
the old behaviour and stays the default; `microvm` boots a sandbox per session.
|
|
16
|
+
- `--msb <path>` locates the microsandbox binary, and `--guest-image <ref>` picks
|
|
17
|
+
what a session boots. Pin the image by digest for anything you snapshot -- a
|
|
18
|
+
floating tag means a restored snapshot is not the thing that was captured.
|
|
19
|
+
|
|
20
|
+
### Proxying an external agent
|
|
21
|
+
- `--acp <target>` runs an external coding agent (`claude-code`) under our
|
|
22
|
+
policy rather than beside it. Needs `--root`.
|
|
23
|
+
- `--acp-policy <standard|read-only|autonomous>` governs what the proxied agent
|
|
24
|
+
may do, and `--acp-auth <subscription|api-key|inherit>` selects the credential
|
|
25
|
+
it uses.
|
|
26
|
+
- `--agent <name>` names the crew agent an `acp-agent` session drives.
|
|
27
|
+
|
|
28
|
+
### Boundaries the operator sets
|
|
29
|
+
- `--clone-under <dir>` lets a session clone a repository, and nothing more. The
|
|
30
|
+
clone runs on the host with your own git credentials; they never enter the
|
|
31
|
+
session.
|
|
32
|
+
- `--keep-transcripts` PERMITS a run to keep its words rather than only its
|
|
33
|
+
metadata. It is a ceiling, not a switch: each run still has to ask, and no run
|
|
34
|
+
can ask past an operator who did not pass this.
|
|
35
|
+
- `--allow-add-under <dir>` lets a client add working directories beneath a
|
|
36
|
+
subtree during a session. This grants directory-name enumeration over that
|
|
37
|
+
subtree, and added roots last only until the sidecar exits.
|
|
38
|
+
|
|
39
|
+
### Fixed
|
|
40
|
+
- `hosts list` -- the spelling `--help` documents -- was rejected as an unknown
|
|
41
|
+
argument; only a bare `hosts` worked. Both now do.
|
|
42
|
+
|
|
43
|
+
### Naming
|
|
44
|
+
- The `corenel` binary this package briefly declared is gone; it collided with
|
|
45
|
+
`@corenel/cli`, which owns that name. This package installs `corenel-sidecar`,
|
|
46
|
+
and `corenel sidecar …` reaches the same program through the CLI. `--help`
|
|
47
|
+
now reports whichever name you invoked.
|
|
48
|
+
|
|
49
|
+
## 0.2.0
|
|
50
|
+
|
|
51
|
+
Ships `--help`, and moves onto the workspace's shared version line — every
|
|
52
|
+
`@corenel/*` package is now 0.2.0, so a compatible set is obvious at a glance.
|
|
53
|
+
|
|
54
|
+
- `--help` / `-h` print usage and exit 0. They were previously rejected as
|
|
55
|
+
unknown arguments, which printed a bare flag list and exited 1 — the first
|
|
56
|
+
thing anyone types against an unfamiliar binary. The text is generated from the
|
|
57
|
+
same table the parser validates against, so a flag cannot be added without
|
|
58
|
+
appearing in `--help`. This landed just after 0.1.6 was published, so it has
|
|
59
|
+
not been in a release until now.
|
|
60
|
+
|
|
61
|
+
No behaviour changes to the daemon, tunnels, or host sync. Upgrading from 0.1.6
|
|
62
|
+
is safe; everything in the 0.1.6 notes below still applies.
|
|
63
|
+
|
|
64
|
+
## 0.1.6
|
|
65
|
+
|
|
66
|
+
The daemon release. `@corenel/sidecar` could already expose a machine's files and
|
|
67
|
+
shell to a browser session; it can now also **run crew agents on its own** —
|
|
68
|
+
on a schedule, when files change, or when another run finishes — with budgets,
|
|
69
|
+
permissions and per-owner isolation enforced node-side.
|
|
70
|
+
|
|
71
|
+
Everything below is additive. An existing `pd sidecar` setup behaves as it did in
|
|
72
|
+
0.1.5 unless you pass `--daemon`.
|
|
73
|
+
|
|
74
|
+
### Daemon core
|
|
75
|
+
- `--daemon` starts an always-on core: an interruptible clock (sleep-until-next-wake,
|
|
76
|
+
wake signal, max-sleep cap) driving a trigger dispatcher over a shared runner.
|
|
77
|
+
- Node run executor built on `runAgent`, with session recording to disk.
|
|
78
|
+
- Per-agent run queue — one live run per agent, so a slow run cannot stack.
|
|
79
|
+
- Node gateway client (absolute endpoint, node auth); daemon-origin requests are
|
|
80
|
+
tagged so entitlement metering can tell them from browser traffic.
|
|
81
|
+
- `--default-model` fallback; a crew agent with no model fails fast rather than
|
|
82
|
+
starting an unrunnable run.
|
|
83
|
+
|
|
84
|
+
### Triggers
|
|
85
|
+
- Minimal 5-field UTC cron matcher with per-agent trigger state (`lastFired`,
|
|
86
|
+
`nextWake`), persisted and serialized so concurrent writes cannot clobber it.
|
|
87
|
+
- File-change triggers: a self-contained glob matcher, a bounded change buffer,
|
|
88
|
+
and an idempotent re-scan.
|
|
89
|
+
- Run-complete triggers: an evaluator carrying owner, stop reason and run
|
|
90
|
+
generation, with a chain-depth cap (`--max-chain-depth`, validated so a bad
|
|
91
|
+
value cannot disable the cap) to stop runs triggering each other forever.
|
|
92
|
+
- `schedule_self` tool for self-directed wakes.
|
|
93
|
+
|
|
94
|
+
### Budgets
|
|
95
|
+
- Run budgets enforced node-side (stop / degrade), failing **closed** on an
|
|
96
|
+
unpriceable run rather than proceeding unmetered.
|
|
97
|
+
- A continuous trigger cannot become due without a budget cap.
|
|
98
|
+
- Pure usage pricing extracted to the harness; the node side hydrates a price table.
|
|
99
|
+
|
|
100
|
+
### Permissions and attendance
|
|
101
|
+
- Unattended prompt resolver: deny, park (bounded by the real budget remainder),
|
|
102
|
+
or allow — an abort resolves to null rather than a silent deny.
|
|
103
|
+
- Attendance registry: asks are broadcast to attached clients, first answer wins,
|
|
104
|
+
and replay on attach means reconnecting does not lose a pending ask.
|
|
105
|
+
- Pending-ask records with boot reconciliation (audit-only) and permission audit lines.
|
|
106
|
+
- Stall watchdog aborts hung runs while leaving parked ones alone.
|
|
107
|
+
|
|
108
|
+
### Multi-owner isolation
|
|
109
|
+
- Per-owner run state and owner-qualified dispatch keys; a multi-root schedule
|
|
110
|
+
enumerates the daemon's own crew plus every `hosts/<dir>/crew`.
|
|
111
|
+
- `call_agent` is confined to the caller's owner, and an attended run resolves its
|
|
112
|
+
owner from the authenticated identity rather than a client-supplied value.
|
|
113
|
+
|
|
114
|
+
### Hosts and sync
|
|
115
|
+
- Durable `sidecarId` with friendly-name resolution; the CLI advertises id and name.
|
|
116
|
+
- `hosts.json` manifest: sanitized frozen `dirName`, null-prototype parsing,
|
|
117
|
+
per-record validation, atomic writes and serialized read-modify-write.
|
|
118
|
+
- `pd sidecar hosts list` / `forget`; boot logs manifest drift.
|
|
119
|
+
- Host-sync service with daemon-derived destinations. Writes to a synced tree go
|
|
120
|
+
through `syncWrite`/`syncRemove` only — the exposed surface has no `write`/`remove`
|
|
121
|
+
to bypass, and path confinement is reused from `NodeFileService` rather than
|
|
122
|
+
reimplemented.
|
|
123
|
+
- A materialized directory is never reclaimed by eviction.
|
|
124
|
+
|
|
125
|
+
### Also
|
|
126
|
+
- `--help` / `-h` now print usage and exit 0. They were previously rejected as
|
|
127
|
+
unknown arguments, which printed a bare flag list and exited 1. The help text is
|
|
128
|
+
generated from the same table the parser validates against, so a flag cannot be
|
|
129
|
+
added without appearing in `--help`.
|
|
130
|
+
- `fs_delete` tool, wired to `SidecarFileService.remove`.
|
|
131
|
+
- Quieter cloudflared output.
|
|
132
|
+
- A second `hello` is ignored once authenticated.
|
|
133
|
+
|
|
134
|
+
### Housekeeping
|
|
135
|
+
- The package's own `typecheck` now passes. It shares modules with the browser
|
|
136
|
+
harness (which guards its browser bits at runtime), so the tsconfig lacked the
|
|
137
|
+
DOM *types* and reported a dozen phantom errors against correct code.
|