@corenel/sidecar 0.2.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +181 -91
- package/dist/cli.js +6818 -1565
- package/package.json +14 -13
package/CHANGELOG.md
CHANGED
|
@@ -1,91 +1,181 @@
|
|
|
1
|
-
# Changelog
|
|
2
|
-
|
|
3
|
-
## 0.
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
- `
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## 0.3.1
|
|
4
|
+
|
|
5
|
+
This package is Corenel's, and now says so in its defaults. 0.3.0 pointed its
|
|
6
|
+
gateway, and the app it opens, at the sibling product.
|
|
7
|
+
|
|
8
|
+
The direction is the fix: prompd.app is a CONSUMER of these APIs, so it names
|
|
9
|
+
its own origin (`--app-url https://prompd.app/studio`, `--endpoint <its own>`)
|
|
10
|
+
and corenel.ai is what you get without asking.
|
|
11
|
+
|
|
12
|
+
### Added
|
|
13
|
+
- `sessions` subcommand: `corenel-sidecar sessions [list | show <id>]`, also
|
|
14
|
+
reachable as `corenel sessions`. Read-only, and read from the SANDBOXES rather
|
|
15
|
+
than from a daemon -- a subcommand runs in a new process and cannot see a
|
|
16
|
+
running daemon's SessionManager, so anything derived from it would be a guess.
|
|
17
|
+
Asking msb gets the same answer the daemon gets when it adopts at boot, and it
|
|
18
|
+
works with nothing running.
|
|
19
|
+
|
|
20
|
+
### Changed
|
|
21
|
+
- `--app-url` defaults to `https://corenel.ai`, and the open URL no longer has
|
|
22
|
+
`/studio` appended to it. That is a prompd route; corenel serves its app at
|
|
23
|
+
`/`, so the old shape would have opened a page that does not exist and lost
|
|
24
|
+
the pairing fragment on the redirect. `--app-url` is now the app URL in full,
|
|
25
|
+
path included -- prompd pairs at `https://prompd.app/studio`.
|
|
26
|
+
|
|
27
|
+
### Fixed
|
|
28
|
+
- The daemon called `https://api.prompd.app` for every model run -- the sibling
|
|
29
|
+
product's gateway, with a token minted against this one. The default endpoint
|
|
30
|
+
is now `https://api.corenel.ai/api`.
|
|
31
|
+
- That default was also missing the `/api` prefix the gateway is mounted behind.
|
|
32
|
+
`setGatewayBase` appends `/v1`, so a bare origin composed
|
|
33
|
+
`https://host/v1/chat/completions` and 404'd -- surfacing as "the run failed",
|
|
34
|
+
nowhere near the flag responsible. A bare origin now has the prefix added, and
|
|
35
|
+
any endpoint carrying a path is left exactly as given.
|
|
36
|
+
- `--allow-lan` did not do what it says. It widened the CORS origin allowlist
|
|
37
|
+
while the socket stayed bound to `127.0.0.1`, so nothing on the network could
|
|
38
|
+
connect and the banner still printed a loopback URL. It now binds all
|
|
39
|
+
interfaces and serves `wss://` with the self-signed cert (which already
|
|
40
|
+
covered the LAN IPs for exactly this). Both halves defer to anything
|
|
41
|
+
explicit: `--host` keeps its address, a supplied `--tls-cert` is not replaced.
|
|
42
|
+
|
|
43
|
+
This is the only way LAN pairing can work from the product: the app is served
|
|
44
|
+
over https, and a browser on an https page refuses a `ws://` connection to a
|
|
45
|
+
LAN address.
|
|
46
|
+
|
|
47
|
+
## 0.3.0
|
|
48
|
+
|
|
49
|
+
The isolation release. 0.2.0 could expose a machine's files and shell to a
|
|
50
|
+
session and run crew agents unattended; it always did that work in its own
|
|
51
|
+
process, on the host, with whatever reach the host had. This release puts a
|
|
52
|
+
boundary around a run and lets an external coding agent be governed by it.
|
|
53
|
+
|
|
54
|
+
Everything is additive and off by default. A 0.2.0 setup behaves exactly as it
|
|
55
|
+
did unless you pass one of the new flags.
|
|
56
|
+
|
|
57
|
+
### Sessions in a sandbox
|
|
58
|
+
- `--isolation <none|microvm>` chooses how a session confines a run. `none` is
|
|
59
|
+
the old behaviour and stays the default; `microvm` boots a sandbox per session.
|
|
60
|
+
- `--msb <path>` locates the microsandbox binary, and `--guest-image <ref>` picks
|
|
61
|
+
what a session boots. Pin the image by digest for anything you snapshot -- a
|
|
62
|
+
floating tag means a restored snapshot is not the thing that was captured.
|
|
63
|
+
|
|
64
|
+
### Proxying an external agent
|
|
65
|
+
- `--acp <target>` runs an external coding agent (`claude-code`) under our
|
|
66
|
+
policy rather than beside it. Needs `--root`.
|
|
67
|
+
- `--acp-policy <standard|read-only|autonomous>` governs what the proxied agent
|
|
68
|
+
may do, and `--acp-auth <subscription|api-key|inherit>` selects the credential
|
|
69
|
+
it uses.
|
|
70
|
+
- `--agent <name>` names the crew agent an `acp-agent` session drives.
|
|
71
|
+
|
|
72
|
+
### Boundaries the operator sets
|
|
73
|
+
- `--clone-under <dir>` lets a session clone a repository, and nothing more. The
|
|
74
|
+
clone runs on the host with your own git credentials; they never enter the
|
|
75
|
+
session.
|
|
76
|
+
- `--keep-transcripts` PERMITS a run to keep its words rather than only its
|
|
77
|
+
metadata. It is a ceiling, not a switch: each run still has to ask, and no run
|
|
78
|
+
can ask past an operator who did not pass this.
|
|
79
|
+
- `--allow-add-under <dir>` lets a client add working directories beneath a
|
|
80
|
+
subtree during a session. This grants directory-name enumeration over that
|
|
81
|
+
subtree, and added roots last only until the sidecar exits.
|
|
82
|
+
|
|
83
|
+
### Fixed
|
|
84
|
+
- `hosts list` -- the spelling `--help` documents -- was rejected as an unknown
|
|
85
|
+
argument; only a bare `hosts` worked. Both now do.
|
|
86
|
+
|
|
87
|
+
### Naming
|
|
88
|
+
- The `corenel` binary this package briefly declared is gone; it collided with
|
|
89
|
+
`@corenel/cli`, which owns that name. This package installs `corenel-sidecar`,
|
|
90
|
+
and `corenel sidecar …` reaches the same program through the CLI. `--help`
|
|
91
|
+
now reports whichever name you invoked.
|
|
92
|
+
|
|
93
|
+
## 0.2.0
|
|
94
|
+
|
|
95
|
+
Ships `--help`, and moves onto the workspace's shared version line — every
|
|
96
|
+
`@corenel/*` package is now 0.2.0, so a compatible set is obvious at a glance.
|
|
97
|
+
|
|
98
|
+
- `--help` / `-h` print usage and exit 0. They were previously rejected as
|
|
99
|
+
unknown arguments, which printed a bare flag list and exited 1 — the first
|
|
100
|
+
thing anyone types against an unfamiliar binary. The text is generated from the
|
|
101
|
+
same table the parser validates against, so a flag cannot be added without
|
|
102
|
+
appearing in `--help`. This landed just after 0.1.6 was published, so it has
|
|
103
|
+
not been in a release until now.
|
|
104
|
+
|
|
105
|
+
No behaviour changes to the daemon, tunnels, or host sync. Upgrading from 0.1.6
|
|
106
|
+
is safe; everything in the 0.1.6 notes below still applies.
|
|
107
|
+
|
|
108
|
+
## 0.1.6
|
|
109
|
+
|
|
110
|
+
The daemon release. `@corenel/sidecar` could already expose a machine's files and
|
|
111
|
+
shell to a browser session; it can now also **run crew agents on its own** —
|
|
112
|
+
on a schedule, when files change, or when another run finishes — with budgets,
|
|
113
|
+
permissions and per-owner isolation enforced node-side.
|
|
114
|
+
|
|
115
|
+
Everything below is additive. An existing `pd sidecar` setup behaves as it did in
|
|
116
|
+
0.1.5 unless you pass `--daemon`.
|
|
117
|
+
|
|
118
|
+
### Daemon core
|
|
119
|
+
- `--daemon` starts an always-on core: an interruptible clock (sleep-until-next-wake,
|
|
120
|
+
wake signal, max-sleep cap) driving a trigger dispatcher over a shared runner.
|
|
121
|
+
- Node run executor built on `runAgent`, with session recording to disk.
|
|
122
|
+
- Per-agent run queue — one live run per agent, so a slow run cannot stack.
|
|
123
|
+
- Node gateway client (absolute endpoint, node auth); daemon-origin requests are
|
|
124
|
+
tagged so entitlement metering can tell them from browser traffic.
|
|
125
|
+
- `--default-model` fallback; a crew agent with no model fails fast rather than
|
|
126
|
+
starting an unrunnable run.
|
|
127
|
+
|
|
128
|
+
### Triggers
|
|
129
|
+
- Minimal 5-field UTC cron matcher with per-agent trigger state (`lastFired`,
|
|
130
|
+
`nextWake`), persisted and serialized so concurrent writes cannot clobber it.
|
|
131
|
+
- File-change triggers: a self-contained glob matcher, a bounded change buffer,
|
|
132
|
+
and an idempotent re-scan.
|
|
133
|
+
- Run-complete triggers: an evaluator carrying owner, stop reason and run
|
|
134
|
+
generation, with a chain-depth cap (`--max-chain-depth`, validated so a bad
|
|
135
|
+
value cannot disable the cap) to stop runs triggering each other forever.
|
|
136
|
+
- `schedule_self` tool for self-directed wakes.
|
|
137
|
+
|
|
138
|
+
### Budgets
|
|
139
|
+
- Run budgets enforced node-side (stop / degrade), failing **closed** on an
|
|
140
|
+
unpriceable run rather than proceeding unmetered.
|
|
141
|
+
- A continuous trigger cannot become due without a budget cap.
|
|
142
|
+
- Pure usage pricing extracted to the harness; the node side hydrates a price table.
|
|
143
|
+
|
|
144
|
+
### Permissions and attendance
|
|
145
|
+
- Unattended prompt resolver: deny, park (bounded by the real budget remainder),
|
|
146
|
+
or allow — an abort resolves to null rather than a silent deny.
|
|
147
|
+
- Attendance registry: asks are broadcast to attached clients, first answer wins,
|
|
148
|
+
and replay on attach means reconnecting does not lose a pending ask.
|
|
149
|
+
- Pending-ask records with boot reconciliation (audit-only) and permission audit lines.
|
|
150
|
+
- Stall watchdog aborts hung runs while leaving parked ones alone.
|
|
151
|
+
|
|
152
|
+
### Multi-owner isolation
|
|
153
|
+
- Per-owner run state and owner-qualified dispatch keys; a multi-root schedule
|
|
154
|
+
enumerates the daemon's own crew plus every `hosts/<dir>/crew`.
|
|
155
|
+
- `call_agent` is confined to the caller's owner, and an attended run resolves its
|
|
156
|
+
owner from the authenticated identity rather than a client-supplied value.
|
|
157
|
+
|
|
158
|
+
### Hosts and sync
|
|
159
|
+
- Durable `sidecarId` with friendly-name resolution; the CLI advertises id and name.
|
|
160
|
+
- `hosts.json` manifest: sanitized frozen `dirName`, null-prototype parsing,
|
|
161
|
+
per-record validation, atomic writes and serialized read-modify-write.
|
|
162
|
+
- `pd sidecar hosts list` / `forget`; boot logs manifest drift.
|
|
163
|
+
- Host-sync service with daemon-derived destinations. Writes to a synced tree go
|
|
164
|
+
through `syncWrite`/`syncRemove` only — the exposed surface has no `write`/`remove`
|
|
165
|
+
to bypass, and path confinement is reused from `NodeFileService` rather than
|
|
166
|
+
reimplemented.
|
|
167
|
+
- A materialized directory is never reclaimed by eviction.
|
|
168
|
+
|
|
169
|
+
### Also
|
|
170
|
+
- `--help` / `-h` now print usage and exit 0. They were previously rejected as
|
|
171
|
+
unknown arguments, which printed a bare flag list and exited 1. The help text is
|
|
172
|
+
generated from the same table the parser validates against, so a flag cannot be
|
|
173
|
+
added without appearing in `--help`.
|
|
174
|
+
- `fs_delete` tool, wired to `SidecarFileService.remove`.
|
|
175
|
+
- Quieter cloudflared output.
|
|
176
|
+
- A second `hello` is ignored once authenticated.
|
|
177
|
+
|
|
178
|
+
### Housekeeping
|
|
179
|
+
- The package's own `typecheck` now passes. It shares modules with the browser
|
|
180
|
+
harness (which guards its browser bits at runtime), so the tsconfig lacked the
|
|
181
|
+
DOM *types* and reported a dozen phantom errors against correct code.
|