@corenel/sidecar 0.6.2 → 0.7.0

package/dist/cli.js

@@ -22488,6 +22488,10 @@ var SidecarServer = class {
        * is the session layer's call, because the operator's permission lives
        * there; this class would have to duplicate that rule to decide, and a
        * duplicated permission rule is one that eventually disagrees. */
+      // NOT from the wire: `allowMutations` is the daemon's own decision,
+      // derived from an agent's `session:` block. A client that could set it
+      // would grant itself mutating tools inside a sandbox. Deliberately
+      // absent -- see session/guestRunner.ts.
       this.opts.sessions.run(m2.sessionId, agent, input, onEvent2, identity, { keepTranscript: m2.keepTranscript === true })
     ) : (agent, input, onEvent2, identity) => this.opts.runner.run(agent, input, onEvent2, identity);
     let runId;
@@ -28252,6 +28256,9 @@ async function readTranscript(files, crewRoot2, agent, runId) {
 }
 
 // src/session/manager.ts
+function isErrorStopReason(stopReason) {
+  return stopReason === "error" || (stopReason ?? "").startsWith("error:");
+}
 var SessionManager = class {
   constructor(deps) {
     this.deps = deps;
@@ -28337,11 +28344,11 @@ var SessionManager = class {
       }
       this.deps.log?.(`session ${sessionId}: running agent "${agent}" inside the session`);
       const kept2 = this.transcriptOf(onEvent, opts?.keepTranscript === true);
-      return this.recorded(session, agent, identity, () => this.deps.guestRunnerFor(sessionId).run(agent, input, kept2.tee, identity), kept2.buffer);
+      return this.recorded(session, agent, identity, () => this.deps.guestRunnerFor(sessionId, { allowMutations: opts?.allowMutations === true }).run(agent, input, kept2.tee, identity), kept2.buffer, opts?.source);
     }
     this.deps.log?.(`session ${sessionId}: running agent "${agent}" on the host (isolation: none)`);
     const kept = this.transcriptOf(onEvent, opts?.keepTranscript === true);
-    return this.recorded(session, agent, identity, () => this.deps.runner.runFrom ? this.deps.runner.runFrom(session.workdir, agent, input, kept.tee, identity, session.stateDir) : this.deps.runner.run(agent, input, kept.tee, identity), kept.buffer);
+    return this.recorded(session, agent, identity, () => this.deps.runner.runFrom ? this.deps.runner.runFrom(session.workdir, agent, input, kept.tee, identity, session.stateDir) : this.deps.runner.run(agent, input, kept.tee, identity, void 0, opts?.source), kept.buffer, opts?.source);
   }
   /**
    * Run, then write one line about it — whatever happened.
@@ -28379,7 +28386,7 @@ var SessionManager = class {
       }
     };
   }
-  async recorded(session, agent, identity, go, transcript) {
+  async recorded(session, agent, identity, go, transcript, source = "chat") {
     const startedAt = Date.now();
     const keep = (runId) => {
       if (!this.deps.recordTranscript || !transcript || transcript.length === 0) return;
@@ -28397,7 +28404,7 @@ var SessionManager = class {
         sessionId: session.id,
         isolated: this.isolated,
         kind: this.deps.backend.kind,
-        source: "chat",
+        source,
         startedAt,
         endedAt: Date.now(),
         ok,
@@ -28409,7 +28416,7 @@ var SessionManager = class {
       void r2.done.then(
         (d2) => {
           keep(r2.runId);
-          write3(r2.runId, d2.stopReason !== "error", d2.stopReason);
+          write3(r2.runId, !isErrorStopReason(d2.stopReason), d2.stopReason);
         },
         (e2) => {
           keep(r2.runId);
@@ -28731,6 +28738,7 @@ var LABEL_CREATED = "corenel.created";
 var LABEL_REPO_URL = "corenel.repo.url";
 var LABEL_REPO_REF = "corenel.repo.ref";
 var LABEL_REPO_COMMIT = "corenel.repo.commit";
+var LABEL_CREW_SESSION = "corenel.crew.session";
 function idFromSandboxName(name) {
   const m2 = /^corenel-(sess_\d+)$/.exec(name);
   return m2 ? m2[1] : null;
@@ -28896,7 +28904,8 @@ function makeMicrovmBackend(deps) {
             [LABEL_REPO_URL]: spec.source.url,
             [LABEL_REPO_COMMIT]: spec.source.commit,
             ...spec.source.ref ? { [LABEL_REPO_REF]: spec.source.ref } : {}
-          } : {}
+          } : {},
+          ...spec.sessionName ? { [LABEL_CREW_SESSION]: spec.sessionName } : {}
         }
       }), `create session ${id}`);
       const handle = {
@@ -28908,7 +28917,8 @@ function makeMicrovmBackend(deps) {
         // Kept so a run in this session looks for the agent where the creator's
         // workspace actually keeps it.
         ...spec.stateDir ? { stateDir: spec.stateDir } : {},
-        ...spec.source ? { source: spec.source } : {}
+        ...spec.source ? { source: spec.source } : {},
+        ...spec.sessionName ? { sessionName: spec.sessionName } : {}
       };
       sessions.set(id, handle);
       deps.log?.(
@@ -29011,9 +29021,28 @@ function makeMicrovmBackend(deps) {
      *
      * CAVEAT, deliberate: the log is the SANDBOX's, not this exec's. Entries
      * carry an `id` per invocation, but it is not known before the exec starts,
-     * so concurrent execs in one sandbox would interleave. That is acceptable
-     * because SessionManager admits one run per session at a time — and it is
-     * written down because it stops being acceptable the moment that changes.
+     * so concurrent execs in one sandbox interleave.
+     *
+     * NOTHING PREVENTS THAT, and no earlier claim here should be believed.
+     * This comment once said SessionManager admits one run per session at a
+     * time; a correction then said a scheduled agent's runs "already chain on
+     * that queue". BOTH ARE FALSE. `manager.ts` checks existence and status
+     * only; `SessionStatus` is 'created' | 'paused' | 'destroyed' (types.ts)
+     * with no 'running'; and `RunQueue` (runnerService.ts) wraps the HOST
+     * executor, which the bound path never reaches -- `dispatcher.startInSession`
+     * goes straight to `sessions.run` -> `crewSessions.ts` -> `manager.run`.
+     * Nothing anywhere serializes two runs into one session.
+     *
+     * What NARROWS the window is weaker than a lock and worth stating exactly:
+     * a bound agent gets its own box (spec D3), and the dispatcher dedupes on
+     * an in-flight key of `owner:agent:trigger`.
+     *
+     * What is STILL OPEN, inside the scheduled path: an agent carrying both a
+     * `schedule` and a `continuous` trigger holds two DISTINCT in-flight keys,
+     * so both fire concurrently by design (dispatcher.ts says so in as many
+     * words), and `resolveCrewSession` keys reuse on (name, workdir) only --
+     * so both land in the same sandbox and interleave in one log. The browser
+     * can likewise send two runs into one session.
      */
     ...deps.stream ? {
       execStream(id, command, onLine, opts) {
@@ -29157,6 +29186,7 @@ function makeMicrovmBackend(deps) {
         const repoUrl = labels[LABEL_REPO_URL];
         const repoCommit = labels[LABEL_REPO_COMMIT];
         const repoRef = labels[LABEL_REPO_REF];
+        const sessionName = labels[LABEL_CREW_SESSION];
         sessions.set(id, {
           id,
           status: statusFromSandbox(row2.status),
@@ -29164,6 +29194,7 @@ function makeMicrovmBackend(deps) {
           createdAt: Number.isFinite(stamped) && stamped > 0 ? stamped : row2.createdAt ?? now2(),
           ...owner ? { owner } : {},
           ...repoUrl && repoCommit ? { source: { url: repoUrl, commit: repoCommit, ...repoRef ? { ref: repoRef } : {} } } : {},
+          ...sessionName ? { sessionName } : {},
           /* THE ONLY PLACE THIS IS EVER SET TRUE. `create()` never touches it,
            * so a card can tell "this daemon booted it" from "this daemon
            * found it already running" — procs.ts's own words: a running
@@ -29263,10 +29294,11 @@ function makeMicrovmBackend(deps) {
 }
 
 // src/session/guestRunner.ts
-var DEFAULT_GUEST_COMMAND = (agent, input) => [
+var DEFAULT_GUEST_COMMAND = (agent, input, opts) => [
   "corenel",
   "run-agent",
   agent,
+  ...opts.allowMutations ? ["--allow-mutations"] : [],
   "--input",
   input
 ];
@@ -29311,7 +29343,7 @@ function makeGuestRunner(deps) {
       const exec = deps.backend.exec.bind(deps.backend);
       const runId = `grun_${++seq3}`;
       deps.log?.(`session ${sessionId}: running "${agent}" inside the guest (${runId})`);
-      const command = build(agent, input);
+      const command = build(agent, input, { allowMutations: deps.allowMutations === true });
       const timeout = deps.timeoutMs === void 0 ? void 0 : { timeoutMs: deps.timeoutMs };
       const seen = [];
       let skipped = 0;
@@ -29519,9 +29551,10 @@ async function wireSessions(opts) {
     ...opts.recordTranscript ? { recordTranscript: opts.recordTranscript } : {},
     // One runner per session, built on demand: the manager knows which session a
     // run belongs to, so nothing has to infer it.
-    guestRunnerFor: (sessionId) => makeGuestRunner({
+    guestRunnerFor: (sessionId, guestOpts) => makeGuestRunner({
       backend,
       sessionId: () => sessionId,
+      allowMutations: guestOpts.allowMutations,
       ...opts.log ? { log: opts.log } : {}
     }),
     ...opts.log ? { log: opts.log } : {}
@@ -29533,6 +29566,26 @@ async function wireSessions(opts) {
   return { manager, backend, port: makeSessionsPort({ manager, backend, guestEnv, ...portExtras(opts) }) };
 }
 
+// src/runner/crewSessions.ts
+function makeCrewSessions(src2, opts) {
+  if (!src2?.manager.isolated) return void 0;
+  const { manager, backend } = src2;
+  return {
+    list: () => backend.list(),
+    adopt: () => backend.adopt?.() ?? Promise.resolve(void 0),
+    create: async (spec) => {
+      const env = await opts.guestEnv().catch(() => ({}));
+      return manager.create({
+        workdir: spec.workdir,
+        sessionName: spec.sessionName,
+        stateDir: opts.stateDir,
+        env: { ...env, CORENEL_STATE_DIR: opts.stateDir }
+      });
+    },
+    run: (sessionId, agent, input, onEvent, identity, runOpts) => manager.run(sessionId, agent, input, onEvent, identity, runOpts)
+  };
+}
+
 // src/runner/owners.ts
 import { readdir } from "node:fs/promises";
 import { join as join8 } from "node:path";
@@ -30220,6 +30273,41 @@ var CREW_EXCLUDED_TOOLS = /* @__PURE__ */ new Set(["ask_user", "spawn_agent", "s
 
 // ../crew/store.ts
 var import_yaml3 = __toESM(require_dist(), 1);
+
+// ../crew/sessionBinding.ts
+var SESSION_NAME_RE = /^[a-z0-9_-]{1,32}$/;
+function isValidSessionName(name) {
+  return SESSION_NAME_RE.test(name);
+}
+function parseSessionBinding(meta) {
+  const raw = meta.session;
+  if (raw === void 0) return { kind: "absent" };
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return { kind: "malformed", reason: "session: must be a block with `name:` and `workdir:`" };
+  }
+  const o2 = raw;
+  const name = typeof o2.name === "string" ? o2.name : "";
+  const workdir = typeof o2.workdir === "string" ? o2.workdir.trim() : "";
+  if (!isValidSessionName(name)) {
+    return {
+      kind: "malformed",
+      reason: `session.name ${JSON.stringify(name)} must be 1-32 characters of a-z, 0-9, "-" or "_"`
+    };
+  }
+  if (!workdir) return { kind: "malformed", reason: "session.workdir is required" };
+  return {
+    kind: "binding",
+    binding: {
+      name,
+      workdir,
+      // Anything but an explicit `false` is true, matching how `enabled` is read
+      // in store.ts — absent means the default, and the default is on.
+      createIfMissing: o2.createIfMissing !== false
+    }
+  };
+}
+
+// ../crew/store.ts
 var TRIGGER_TYPES = [
   "manual",
   "file-change",
@@ -30305,6 +30393,7 @@ async function loadCrewAgentAt(files, root, name, scope = "workspace") {
   if (!isValidAgentName(name)) throw new Error(`invalid crew agent name: ${name}`);
   const dir = `${root}/${name}`;
   const { meta, body: body2 } = parseFrontmatter(await readOr(files, `${dir}/AGENT.md`));
+  const session = parseSessionBinding(meta);
   return {
     name,
     jobTitle: typeof meta.jobTitle === "string" ? meta.jobTitle : "",
@@ -30319,7 +30408,9 @@ async function loadCrewAgentAt(files, root, name, scope = "workspace") {
     policy: parsePolicyYaml(await readOr(files, `${dir}/POLICY.yaml`), name),
     settings: parseSettings(await readOr(files, `${dir}/settings.json`, "{}")),
     budget: parseBudget(meta),
-    canCall: parseCanCall(meta)
+    canCall: parseCanCall(meta),
+    ...session.kind === "binding" ? { session: session.binding } : {},
+    ...session.kind === "malformed" ? { sessionError: session.reason } : {}
   };
 }
 async function loadCrewAgentAtIfExists(files, root, name, scope = "workspace") {
@@ -42618,6 +42709,26 @@ function makeTriggerSchedule(opts) {
   return { due, nextWakeAfter, registrations };
 }
 
+// src/session/crewSessionResolve.ts
+function sameDir(a2, b2) {
+  const norm2 = (p2) => p2.split("\\").join("/").replace(/[/]+$/, "").toLowerCase();
+  return norm2(a2) === norm2(b2);
+}
+function resolveCrewSession(binding, handles) {
+  const matches = handles.filter((h2) => h2.status === "created" && h2.sessionName === binding.name && sameDir(h2.workdir, binding.workdir));
+  if (matches.length) {
+    const newest = matches.reduce((a2, b2) => b2.createdAt > a2.createdAt ? b2 : a2);
+    return { kind: "reuse", sessionId: newest.id };
+  }
+  if (!binding.createIfMissing) {
+    return {
+      kind: "refuse",
+      reason: `no live session "${binding.name}" on ${binding.workdir}, and createIfMissing is off`
+    };
+  }
+  return { kind: "create", spec: { workdir: binding.workdir, sessionName: binding.name } };
+}
+
 // src/runner/dispatcher.ts
 function hasBudget2(def) {
   return def.budget?.maxUsd != null || def.budget?.maxTokens != null;
@@ -42641,11 +42752,17 @@ function makeDispatcher(opts) {
     });
     return next;
   }
-  async function recordFailedDispatch(d2, root, startedAt, runId, message) {
+  async function recordFailedDispatch(d2, root, startedAt, runId, message, where) {
     await appendRun(root.files, root.root, {
       runId,
       agent: d2.agent,
-      where: "host",
+      /* PASSED, NOT ASSUMED. This said `where: 'host'` unconditionally, so
+       * every D5 refusal -- no session backend, `createIfMissing: false`, a
+       * `create` that threw, a malformed `session:` block -- told the operator
+       * the run had happened on the host, which is the one thing this feature
+       * guarantees did NOT happen. A bound agent that refuses files a
+       * `where: 'session'` row: nothing ran, and nothing ran THERE. */
+      where,
       source: d2.trigger,
       startedAt,
       endedAt: now2(),
@@ -42653,6 +42770,35 @@ function makeDispatcher(opts) {
       stopReason: message
     }, log);
   }
+  async function startInSession(binding, d2) {
+    const sessions = opts.sessions?.();
+    if (!sessions) {
+      throw new Error(
+        `crew agent "${d2.agent}" is bound to session "${binding.name}", but this daemon has no session backend`
+      );
+    }
+    try {
+      await sessions.adopt?.();
+    } catch {
+    }
+    const decision = resolveCrewSession(binding, sessions.list());
+    if (decision.kind === "refuse") {
+      throw new Error(`crew agent "${d2.agent}": ${decision.reason}`);
+    }
+    const sessionId = decision.kind === "reuse" ? decision.sessionId : (await sessions.create(decision.spec)).id;
+    return sessions.run(
+      sessionId,
+      d2.agent,
+      d2.input,
+      () => {
+      },
+      { owner: d2.owner },
+      // `source` is the trigger, not 'chat': the session's own run record is
+      // the only durable answer to "why did this happen", and it is written by
+      // the session layer, not by this file's failure path.
+      { allowMutations: true, source: d2.trigger }
+    );
+  }
   async function fire(d2) {
     const dispatchedAt = now2();
     const key = `${d2.owner}:${d2.agent}:${d2.trigger}`;
@@ -42661,6 +42807,7 @@ function makeDispatcher(opts) {
       return;
     }
     inFlight.add(key);
+    let where = "host";
     try {
       const roots = await opts.ownerRoots();
       const match = roots.find((r2) => r2.owner === d2.owner);
@@ -42673,12 +42820,17 @@ function makeDispatcher(opts) {
         log(`dispatcher: agent "${d2.agent}" not found (owner "${d2.owner}") -- skipped`);
         return;
       }
+      where = def.session || def.sessionError ? "session" : "host";
       if (d2.trigger === "continuous" && !hasBudget2(def)) {
         log(`refusing continuous run for "${d2.agent}" (owner "${d2.owner}"): a budget (maxUsd or maxTokens) is required`);
         return;
       }
       await withAgentStateLock(`${d2.owner}:${d2.agent}`, () => persistDispatch(d2, match));
-      const started = await runner.run(d2.agent, d2.input, () => {
+      if (def.sessionError) {
+        throw new Error(`crew agent "${d2.agent}" has an unusable session: block -- ${def.sessionError}`);
+      }
+      const binding = def.session;
+      const started = binding ? await startInSession(binding, d2) : await runner.run(d2.agent, d2.input, () => {
       }, { owner: d2.owner }, d2.generation ?? 0, d2.trigger);
       const startedAt = now2();
       const announce = (extra) => {
@@ -42710,7 +42862,7 @@ function makeDispatcher(opts) {
           announce({ endedAt: now2(), ok: false, stopReason: msg });
           log(`dispatcher: run of "${d2.agent}" (${d2.trigger}) failed -- ${msg}`);
           void settleSelfDirected(d2, match);
-          void recordFailedDispatch(d2, match, startedAt, started.runId, msg);
+          void recordFailedDispatch(d2, match, startedAt, started.runId, msg, where);
         }
       );
     } catch (err) {
@@ -42719,7 +42871,7 @@ function makeDispatcher(opts) {
       try {
         const roots = await opts.ownerRoots();
         const root = roots.find((r2) => r2.owner === d2.owner);
-        if (root) await recordFailedDispatch(d2, root, dispatchedAt, `dispatch-${dispatchedAt}`, msg);
+        if (root) await recordFailedDispatch(d2, root, dispatchedAt, `dispatch-${dispatchedAt}`, msg, where);
       } catch {
       }
     } finally {
@@ -43409,6 +43561,9 @@ function startDaemonCore(opts) {
     // it -- the same contract `schedule_self` has. `clock` is declared below
     // and only read when this fires, long after it is initialized.
     onScheduled: () => clock.wake(),
+    // Read per fire(), so a daemon whose session layer comes up after this
+    // core still routes bound agents into it.
+    ...opts.sessions ? { sessions: opts.sessions } : {},
     log
   });
   const roomProgressSubs = /* @__PURE__ */ new Set();
@@ -45520,6 +45675,10 @@ function layerConfig(args, explicit, file) {
     from[key] = "file";
     if (key === "endpoint") out.endpointExplicit = true;
   }
+  if (out.allowLan) {
+    if (from.host === "default") out.host = "0.0.0.0";
+    if (from.selfSigned === "default" && !out.tlsCert && !out.tlsKey) out.selfSigned = true;
+  }
   return { args: out, from, warnings };
 }
 
@@ -47653,6 +47812,7 @@ async function main() {
   const attendance = makeAttendanceRegistry({ log: slog });
   const runs = makeRunHub({ log: slog });
   let core;
+  let crewSessions;
   const pauses = args.daemon ? await loadPauseStore(args.stateDir) : void 0;
   let controlPlane = null;
   const runner = args.daemon ? new NodeRunnerService({
@@ -47767,6 +47927,9 @@ async function main() {
       // through the attendance registry -- there is no room-progress member on
       // AttendanceRegistry (unlike runActivity/registrations), and adding one
       // is out of this task's scope.
+      // Bound crew agents run in the session layer built below -- read through
+      // the holder, never captured by value, because it does not exist yet.
+      sessions: () => crewSessions,
       onRoomProgress: (room) => slog(`room ${room.roomId}: ${room.turns} turn(s), ${room.participants.length} participant(s)${room.closed ? ` -- closed (${room.closed.reason})` : ""}`)
     });
   }
@@ -47892,6 +48055,7 @@ async function main() {
     git: createGitSource({ areas: args.cloneUnder, run: makeGitRunner(), log: slog }),
     approveCheckout: (dir) => rootsController.addFromClone(dir)
   }) : void 0;
+  crewSessions = makeCrewSessions(sessions, { stateDir: stateDirName(), guestEnv });
   const handle = await startSidecar({
     port: args.port,
     host: args.host,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@corenel/sidecar",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "type": "module",
   "license": "Elastic-2.0",
   "description": "Prompd sidecar — a local capability server. Run it next to Prompd (prompd.app) so the browser app can reach your machine: local LLMs (Ollama/LM Studio/vLLM) without CORS, your filesystem, and (opt-in) shell.",
@@ -36,10 +36,10 @@
     "esbuild": "^0.21.5",
     "tsx": "^4.19.2",
     "typescript": "^5.9.3",
-    "@corenel/protocol": "0.6.1",
-    "@corenel/harness": "0.6.1",
     "@corenel/tools-node": "0.3.1",
-    "@corenel/crew": "0.0.0"
+    "@corenel/protocol": "0.6.1",
+    "@corenel/crew": "0.0.0",
+    "@corenel/harness": "0.6.1"
   },
   "repository": {
     "type": "git",