@corenel/sidecar 0.3.1 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +231 -181
- package/dist/cli.js +642 -95
- package/package.json +16 -14
package/CHANGELOG.md
CHANGED
|
@@ -1,181 +1,231 @@
|
|
|
1
|
-
# Changelog
|
|
2
|
-
|
|
3
|
-
## 0.3.
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
129
|
-
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
133
|
-
|
|
134
|
-
|
|
135
|
-
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
|
|
169
|
-
|
|
170
|
-
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
###
|
|
179
|
-
-
|
|
180
|
-
|
|
181
|
-
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## 0.3.2
|
|
4
|
+
|
|
5
|
+
Sessions stop being something you can only list. This release gives the sandbox
|
|
6
|
+
a full lifecycle from the command line, and the verbs are the port's own --
|
|
7
|
+
create/destroy, not add/remove: you add an entry to a list, you create and
|
|
8
|
+
destroy a thing that boots and holds memory.
|
|
9
|
+
|
|
10
|
+
Everything goes through the SAME backend the daemon uses. Two ways to make a
|
|
11
|
+
sandbox would stamp labels two ways and drift on limits.
|
|
12
|
+
|
|
13
|
+
### Added
|
|
14
|
+
- Session lifecycle: `corenel sessions create [--root <dir>]`, `run <id>
|
|
15
|
+
"<prompt>"`, and `pause|resume|destroy <id>`. `corenel run --session <id>`
|
|
16
|
+
forwards to the same place. `stop` is deliberately absent -- the port has
|
|
17
|
+
pause (stop admitting work, bounded drain, and it reports whether it drained)
|
|
18
|
+
and destroy, and a third word over two real concepts is a translation nobody
|
|
19
|
+
asked for.
|
|
20
|
+
- `exec` takes an optional env, threaded to `msb exec -e`. Without it the CLI
|
|
21
|
+
inside the guest answers "not signed in" -- the image ships no token and
|
|
22
|
+
create injects none -- so the sandbox was a box nothing useful could happen
|
|
23
|
+
in. It carries the HOST's identity: a session isolates the filesystem and the
|
|
24
|
+
process, not the wallet.
|
|
25
|
+
|
|
26
|
+
### Fixed
|
|
27
|
+
Running against a real hypervisor found five defects that reading the code did
|
|
28
|
+
not:
|
|
29
|
+
|
|
30
|
+
- `create` always allocated `sess_1`. The id counter lives in the backend and
|
|
31
|
+
starts at zero, so the second create on a machine collided with the first.
|
|
32
|
+
Adoption is what advances it past what already exists -- the daemon does this
|
|
33
|
+
at boot and a one-shot command needs it for the same reason. The same fix is
|
|
34
|
+
what made `run` work at all.
|
|
35
|
+
- `sessions create --root X` silently used the CWD. The dispatcher stripped
|
|
36
|
+
flags before the subcommand could read them, so the value was dropped without
|
|
37
|
+
a word. The whole argv is passed through now, and the verbs are the non-flag
|
|
38
|
+
words.
|
|
39
|
+
- A created session reported `created 1787430794235` -- the label stores epoch
|
|
40
|
+
millis and nothing rendered it.
|
|
41
|
+
- A STOPPED session vanished from the list: `msb inspect` returns no labels for
|
|
42
|
+
one, so there was nothing to read. It is recovered from the sandbox name,
|
|
43
|
+
which the backend reserves for exactly this.
|
|
44
|
+
- ...and was therefore unrecoverable, since resume and destroy both look it up
|
|
45
|
+
first. `adopt()` also refuses a session whose workdir label it cannot read, so
|
|
46
|
+
the backend declined too and destroy reported success having done nothing.
|
|
47
|
+
There is now a direct-to-sandbox path used only after the backend declines,
|
|
48
|
+
and destroy VERIFIES the session is gone instead of assuming.
|
|
49
|
+
|
|
50
|
+
Verified end to end against real microVMs: create -> list -> show -> pause ->
|
|
51
|
+
resume -> destroy, and a run reaching the guest's own CLI.
|
|
52
|
+
|
|
53
|
+
## 0.3.1
|
|
54
|
+
|
|
55
|
+
This package is Corenel's, and now says so in its defaults. 0.3.0 pointed its
|
|
56
|
+
gateway, and the app it opens, at the sibling product.
|
|
57
|
+
|
|
58
|
+
The direction is the fix: prompd.app is a CONSUMER of these APIs, so it names
|
|
59
|
+
its own origin (`--app-url https://prompd.app/studio`, `--endpoint <its own>`)
|
|
60
|
+
and corenel.ai is what you get without asking.
|
|
61
|
+
|
|
62
|
+
### Added
|
|
63
|
+
- `sessions` subcommand: `corenel-sidecar sessions [list | show <id>]`, also
|
|
64
|
+
reachable as `corenel sessions`. Read-only, and read from the SANDBOXES rather
|
|
65
|
+
than from a daemon -- a subcommand runs in a new process and cannot see a
|
|
66
|
+
running daemon's SessionManager, so anything derived from it would be a guess.
|
|
67
|
+
Asking msb gets the same answer the daemon gets when it adopts at boot, and it
|
|
68
|
+
works with nothing running.
|
|
69
|
+
|
|
70
|
+
### Changed
|
|
71
|
+
- `--app-url` defaults to `https://corenel.ai`, and the open URL no longer has
|
|
72
|
+
`/studio` appended to it. That is a prompd route; corenel serves its app at
|
|
73
|
+
`/`, so the old shape would have opened a page that does not exist and lost
|
|
74
|
+
the pairing fragment on the redirect. `--app-url` is now the app URL in full,
|
|
75
|
+
path included -- prompd pairs at `https://prompd.app/studio`.
|
|
76
|
+
|
|
77
|
+
### Fixed
|
|
78
|
+
- The daemon called `https://api.prompd.app` for every model run -- the sibling
|
|
79
|
+
product's gateway, with a token minted against this one. The default endpoint
|
|
80
|
+
is now `https://api.corenel.ai/api`.
|
|
81
|
+
- That default was also missing the `/api` prefix the gateway is mounted behind.
|
|
82
|
+
`setGatewayBase` appends `/v1`, so a bare origin composed
|
|
83
|
+
`https://host/v1/chat/completions` and 404'd -- surfacing as "the run failed",
|
|
84
|
+
nowhere near the flag responsible. A bare origin now has the prefix added, and
|
|
85
|
+
any endpoint carrying a path is left exactly as given.
|
|
86
|
+
- `--allow-lan` did not do what it says. It widened the CORS origin allowlist
|
|
87
|
+
while the socket stayed bound to `127.0.0.1`, so nothing on the network could
|
|
88
|
+
connect and the banner still printed a loopback URL. It now binds all
|
|
89
|
+
interfaces and serves `wss://` with the self-signed cert (which already
|
|
90
|
+
covered the LAN IPs for exactly this). Both halves defer to anything
|
|
91
|
+
explicit: `--host` keeps its address, a supplied `--tls-cert` is not replaced.
|
|
92
|
+
|
|
93
|
+
This is the only way LAN pairing can work from the product: the app is served
|
|
94
|
+
over https, and a browser on an https page refuses a `ws://` connection to a
|
|
95
|
+
LAN address.
|
|
96
|
+
|
|
97
|
+
## 0.3.0
|
|
98
|
+
|
|
99
|
+
The isolation release. 0.2.0 could expose a machine's files and shell to a
|
|
100
|
+
session and run crew agents unattended; it always did that work in its own
|
|
101
|
+
process, on the host, with whatever reach the host had. This release puts a
|
|
102
|
+
boundary around a run and lets an external coding agent be governed by it.
|
|
103
|
+
|
|
104
|
+
Everything is additive and off by default. A 0.2.0 setup behaves exactly as it
|
|
105
|
+
did unless you pass one of the new flags.
|
|
106
|
+
|
|
107
|
+
### Sessions in a sandbox
|
|
108
|
+
- `--isolation <none|microvm>` chooses how a session confines a run. `none` is
|
|
109
|
+
the old behaviour and stays the default; `microvm` boots a sandbox per session.
|
|
110
|
+
- `--msb <path>` locates the microsandbox binary, and `--guest-image <ref>` picks
|
|
111
|
+
what a session boots. Pin the image by digest for anything you snapshot -- a
|
|
112
|
+
floating tag means a restored snapshot is not the thing that was captured.
|
|
113
|
+
|
|
114
|
+
### Proxying an external agent
|
|
115
|
+
- `--acp <target>` runs an external coding agent (`claude-code`) under our
|
|
116
|
+
policy rather than beside it. Needs `--root`.
|
|
117
|
+
- `--acp-policy <standard|read-only|autonomous>` governs what the proxied agent
|
|
118
|
+
may do, and `--acp-auth <subscription|api-key|inherit>` selects the credential
|
|
119
|
+
it uses.
|
|
120
|
+
- `--agent <name>` names the crew agent an `acp-agent` session drives.
|
|
121
|
+
|
|
122
|
+
### Boundaries the operator sets
|
|
123
|
+
- `--clone-under <dir>` lets a session clone a repository, and nothing more. The
|
|
124
|
+
clone runs on the host with your own git credentials; they never enter the
|
|
125
|
+
session.
|
|
126
|
+
- `--keep-transcripts` PERMITS a run to keep its words rather than only its
|
|
127
|
+
metadata. It is a ceiling, not a switch: each run still has to ask, and no run
|
|
128
|
+
can ask past an operator who did not pass this.
|
|
129
|
+
- `--allow-add-under <dir>` lets a client add working directories beneath a
|
|
130
|
+
subtree during a session. This grants directory-name enumeration over that
|
|
131
|
+
subtree, and added roots last only until the sidecar exits.
|
|
132
|
+
|
|
133
|
+
### Fixed
|
|
134
|
+
- `hosts list` -- the spelling `--help` documents -- was rejected as an unknown
|
|
135
|
+
argument; only a bare `hosts` worked. Both now do.
|
|
136
|
+
|
|
137
|
+
### Naming
|
|
138
|
+
- The `corenel` binary this package briefly declared is gone; it collided with
|
|
139
|
+
`@corenel/cli`, which owns that name. This package installs `corenel-sidecar`,
|
|
140
|
+
and `corenel sidecar …` reaches the same program through the CLI. `--help`
|
|
141
|
+
now reports whichever name you invoked.
|
|
142
|
+
|
|
143
|
+
## 0.2.0
|
|
144
|
+
|
|
145
|
+
Ships `--help`, and moves onto the workspace's shared version line — every
|
|
146
|
+
`@corenel/*` package is now 0.2.0, so a compatible set is obvious at a glance.
|
|
147
|
+
|
|
148
|
+
- `--help` / `-h` print usage and exit 0. They were previously rejected as
|
|
149
|
+
unknown arguments, which printed a bare flag list and exited 1 — the first
|
|
150
|
+
thing anyone types against an unfamiliar binary. The text is generated from the
|
|
151
|
+
same table the parser validates against, so a flag cannot be added without
|
|
152
|
+
appearing in `--help`. This landed just after 0.1.6 was published, so it has
|
|
153
|
+
not been in a release until now.
|
|
154
|
+
|
|
155
|
+
No behaviour changes to the daemon, tunnels, or host sync. Upgrading from 0.1.6
|
|
156
|
+
is safe; everything in the 0.1.6 notes below still applies.
|
|
157
|
+
|
|
158
|
+
## 0.1.6
|
|
159
|
+
|
|
160
|
+
The daemon release. `@corenel/sidecar` could already expose a machine's files and
|
|
161
|
+
shell to a browser session; it can now also **run crew agents on its own** —
|
|
162
|
+
on a schedule, when files change, or when another run finishes — with budgets,
|
|
163
|
+
permissions and per-owner isolation enforced node-side.
|
|
164
|
+
|
|
165
|
+
Everything below is additive. An existing `pd sidecar` setup behaves as it did in
|
|
166
|
+
0.1.5 unless you pass `--daemon`.
|
|
167
|
+
|
|
168
|
+
### Daemon core
|
|
169
|
+
- `--daemon` starts an always-on core: an interruptible clock (sleep-until-next-wake,
|
|
170
|
+
wake signal, max-sleep cap) driving a trigger dispatcher over a shared runner.
|
|
171
|
+
- Node run executor built on `runAgent`, with session recording to disk.
|
|
172
|
+
- Per-agent run queue — one live run per agent, so a slow run cannot stack.
|
|
173
|
+
- Node gateway client (absolute endpoint, node auth); daemon-origin requests are
|
|
174
|
+
tagged so entitlement metering can tell them from browser traffic.
|
|
175
|
+
- `--default-model` fallback; a crew agent with no model fails fast rather than
|
|
176
|
+
starting an unrunnable run.
|
|
177
|
+
|
|
178
|
+
### Triggers
|
|
179
|
+
- Minimal 5-field UTC cron matcher with per-agent trigger state (`lastFired`,
|
|
180
|
+
`nextWake`), persisted and serialized so concurrent writes cannot clobber it.
|
|
181
|
+
- File-change triggers: a self-contained glob matcher, a bounded change buffer,
|
|
182
|
+
and an idempotent re-scan.
|
|
183
|
+
- Run-complete triggers: an evaluator carrying owner, stop reason and run
|
|
184
|
+
generation, with a chain-depth cap (`--max-chain-depth`, validated so a bad
|
|
185
|
+
value cannot disable the cap) to stop runs triggering each other forever.
|
|
186
|
+
- `schedule_self` tool for self-directed wakes.
|
|
187
|
+
|
|
188
|
+
### Budgets
|
|
189
|
+
- Run budgets enforced node-side (stop / degrade), failing **closed** on an
|
|
190
|
+
unpriceable run rather than proceeding unmetered.
|
|
191
|
+
- A continuous trigger cannot become due without a budget cap.
|
|
192
|
+
- Pure usage pricing extracted to the harness; the node side hydrates a price table.
|
|
193
|
+
|
|
194
|
+
### Permissions and attendance
|
|
195
|
+
- Unattended prompt resolver: deny, park (bounded by the real budget remainder),
|
|
196
|
+
or allow — an abort resolves to null rather than a silent deny.
|
|
197
|
+
- Attendance registry: asks are broadcast to attached clients, first answer wins,
|
|
198
|
+
and replay on attach means reconnecting does not lose a pending ask.
|
|
199
|
+
- Pending-ask records with boot reconciliation (audit-only) and permission audit lines.
|
|
200
|
+
- Stall watchdog aborts hung runs while leaving parked ones alone.
|
|
201
|
+
|
|
202
|
+
### Multi-owner isolation
|
|
203
|
+
- Per-owner run state and owner-qualified dispatch keys; a multi-root schedule
|
|
204
|
+
enumerates the daemon's own crew plus every `hosts/<dir>/crew`.
|
|
205
|
+
- `call_agent` is confined to the caller's owner, and an attended run resolves its
|
|
206
|
+
owner from the authenticated identity rather than a client-supplied value.
|
|
207
|
+
|
|
208
|
+
### Hosts and sync
|
|
209
|
+
- Durable `sidecarId` with friendly-name resolution; the CLI advertises id and name.
|
|
210
|
+
- `hosts.json` manifest: sanitized frozen `dirName`, null-prototype parsing,
|
|
211
|
+
per-record validation, atomic writes and serialized read-modify-write.
|
|
212
|
+
- `pd sidecar hosts list` / `forget`; boot logs manifest drift.
|
|
213
|
+
- Host-sync service with daemon-derived destinations. Writes to a synced tree go
|
|
214
|
+
through `syncWrite`/`syncRemove` only — the exposed surface has no `write`/`remove`
|
|
215
|
+
to bypass, and path confinement is reused from `NodeFileService` rather than
|
|
216
|
+
reimplemented.
|
|
217
|
+
- A materialized directory is never reclaimed by eviction.
|
|
218
|
+
|
|
219
|
+
### Also
|
|
220
|
+
- `--help` / `-h` now print usage and exit 0. They were previously rejected as
|
|
221
|
+
unknown arguments, which printed a bare flag list and exited 1. The help text is
|
|
222
|
+
generated from the same table the parser validates against, so a flag cannot be
|
|
223
|
+
added without appearing in `--help`.
|
|
224
|
+
- `fs_delete` tool, wired to `SidecarFileService.remove`.
|
|
225
|
+
- Quieter cloudflared output.
|
|
226
|
+
- A second `hello` is ignored once authenticated.
|
|
227
|
+
|
|
228
|
+
### Housekeeping
|
|
229
|
+
- The package's own `typecheck` now passes. It shares modules with the browser
|
|
230
|
+
harness (which guards its browser bits at runtime), so the tsconfig lacked the
|
|
231
|
+
DOM *types* and reported a dozen phantom errors against correct code.
|