@cotal-ai/manager 0.10.1 → 0.11.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/attach-endpoint.js +1 -1
- package/dist/authorize.d.ts +62 -0
- package/dist/authorize.d.ts.map +1 -0
- package/dist/authorize.js +65 -0
- package/dist/authorize.js.map +1 -0
- package/dist/commands.js +3 -3
- package/dist/commands.js.map +1 -1
- package/dist/launch.d.ts +2 -1
- package/dist/launch.d.ts.map +1 -1
- package/dist/launch.js +28 -12
- package/dist/launch.js.map +1 -1
- package/dist/manager.d.ts +54 -7
- package/dist/manager.d.ts.map +1 -1
- package/dist/manager.js +373 -61
- package/dist/manager.js.map +1 -1
- package/dist/runtime/index.js +2 -2
- package/dist/runtime/windows-launch.js +2 -2
- package/package.json +4 -4
package/dist/attach-endpoint.js
CHANGED
|
@@ -187,7 +187,7 @@ export class AttachEndpoint {
|
|
|
187
187
|
session = handle.attach();
|
|
188
188
|
}
|
|
189
189
|
catch {
|
|
190
|
-
ws.close(1011, `attach unsupported for the ${handle.kind} runtime
|
|
190
|
+
ws.close(1011, `attach unsupported for the ${handle.kind} runtime - watch its surface directly`);
|
|
191
191
|
return;
|
|
192
192
|
}
|
|
193
193
|
const send = (b) => {
|
|
@@ -0,0 +1,62 @@
|
|
|
1
|
+
/** What the named-target decision needs to know about the managed row — the manager's spawn-time
|
|
2
|
+
* records only, never payload fields, personas, or presence display data. */
|
|
3
|
+
export interface NamedControlTarget {
|
|
4
|
+
name: string;
|
|
5
|
+
/** Authenticated principal that requested the spawn (`req.from.id` at spawn time). */
|
|
6
|
+
spawner: string;
|
|
7
|
+
/** The derived owner (`u_…`) a user-mode agent runs under; absent on static/open meshes. */
|
|
8
|
+
userOwner?: string;
|
|
9
|
+
}
|
|
10
|
+
/**
|
|
11
|
+
* The named-target (stop/attach) authorization decision — pure, so the policy is pinnable without
|
|
12
|
+
* a broker. The caller already passed the broker's tier admission (cred-gated publish); this
|
|
13
|
+
* decides what the manager honors, fail-closed, ONLY from the subject-pinned caller principal and
|
|
14
|
+
* the target's spawn-time records:
|
|
15
|
+
*
|
|
16
|
+
* - **Admin tier**: any named target (reaching that subject IS the cross-agent authority — the
|
|
17
|
+
* static `control-caller-admin` cred, or a user-mode bearer whose scope carries `admin`).
|
|
18
|
+
* - **Privileged tier, both modes**: the caller's own child (`spawner === caller`).
|
|
19
|
+
* - **Privileged tier, user mesh (owner-domain)**: any agent whose stored owner equals the
|
|
20
|
+
* caller's owner — the human is the administrative boundary of their own subtree, so their cli
|
|
21
|
+
* actor and sibling agents reach every agent they own, not just what they personally spawned.
|
|
22
|
+
* Failing that, a FRESH ledger read granting `admin` allows (so a scope edit bites the next op
|
|
23
|
+
* with no reconnect); else the refusal names the boundary and the ADD-to-current re-grant
|
|
24
|
+
* (a bare `--scope admin` upsert would silently strip `spawn`).
|
|
25
|
+
*
|
|
26
|
+
* Fail closed everywhere: an unparseable caller, a target with no stored owner, or an unreadable
|
|
27
|
+
* ledger authorizes nothing.
|
|
28
|
+
*/
|
|
29
|
+
export declare function authorizeNamedControl(opts: {
|
|
30
|
+
target: NamedControlTarget;
|
|
31
|
+
/** Subject-pinned caller principal (`req.from.id`) — non-forgeable in auth mode. */
|
|
32
|
+
caller: string;
|
|
33
|
+
/** True when the request arrived on the admin control tier. */
|
|
34
|
+
admin: boolean;
|
|
35
|
+
/** True on a per-user-auth mesh. */
|
|
36
|
+
userMode: boolean;
|
|
37
|
+
/** Fresh capability-scope read for a principal's ledger row; `undefined` = no row. Consulted
|
|
38
|
+
* only on a user mesh. A throw is treated as "no row". */
|
|
39
|
+
scopeOf: (owner: string, actor: string) => Promise<string[] | undefined>;
|
|
40
|
+
}): Promise<string | undefined>;
|
|
41
|
+
/**
|
|
42
|
+
* The manifest-launch authorization decision — pure, same contract style as
|
|
43
|
+
* {@link authorizeNamedControl}. The dispatch already rejects a static-mesh privileged-tier
|
|
44
|
+
* `launch` (operator-only there), so this decides the remaining cases:
|
|
45
|
+
*
|
|
46
|
+
* - **Admin tier**: allowed (operator behavior, both modes).
|
|
47
|
+
* - **Privileged tier, user mesh**: you deploy your own team — the launch spec's apply-time
|
|
48
|
+
* stamped owner must EQUAL the subject-pinned caller's owner. Fail-closed on an unparseable
|
|
49
|
+
* caller or a spec with no owner; the cross-owner refusal names the `admin` ADD-to-current
|
|
50
|
+
* re-grant.
|
|
51
|
+
*/
|
|
52
|
+
export declare function authorizeLaunch(opts: {
|
|
53
|
+
/** The launch spec's apply-time stamped owner (`u_…`); absent = an ownerless spec. */
|
|
54
|
+
specOwner: string | undefined;
|
|
55
|
+
/** Subject-pinned caller principal (`req.from.id`). */
|
|
56
|
+
caller: string;
|
|
57
|
+
/** True when the request arrived on the admin control tier. */
|
|
58
|
+
admin: boolean;
|
|
59
|
+
/** The run id, for the refusal copy only. */
|
|
60
|
+
runId: string;
|
|
61
|
+
}): string | undefined;
|
|
62
|
+
//# sourceMappingURL=authorize.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAEA;8EAC8E;AAC9E,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,EAAE,OAAO,CAAC;IACf,oCAAoC;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB;+DAC2D;IAC3D,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CAC1E,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAkB9B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,sFAAsF;IACtF,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,EAAE,OAAO,CAAC;IACf,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,GAAG,SAAS,CAWrB"}
|
|
@@ -0,0 +1,65 @@
|
|
|
1
|
+
import { parsePrincipalKey } from "@cotal-ai/core";
|
|
2
|
+
/**
|
|
3
|
+
* The named-target (stop/attach) authorization decision — pure, so the policy is pinnable without
|
|
4
|
+
* a broker. The caller already passed the broker's tier admission (cred-gated publish); this
|
|
5
|
+
* decides what the manager honors, fail-closed, ONLY from the subject-pinned caller principal and
|
|
6
|
+
* the target's spawn-time records:
|
|
7
|
+
*
|
|
8
|
+
* - **Admin tier**: any named target (reaching that subject IS the cross-agent authority — the
|
|
9
|
+
* static `control-caller-admin` cred, or a user-mode bearer whose scope carries `admin`).
|
|
10
|
+
* - **Privileged tier, both modes**: the caller's own child (`spawner === caller`).
|
|
11
|
+
* - **Privileged tier, user mesh (owner-domain)**: any agent whose stored owner equals the
|
|
12
|
+
* caller's owner — the human is the administrative boundary of their own subtree, so their cli
|
|
13
|
+
* actor and sibling agents reach every agent they own, not just what they personally spawned.
|
|
14
|
+
* Failing that, a FRESH ledger read granting `admin` allows (so a scope edit bites the next op
|
|
15
|
+
* with no reconnect); else the refusal names the boundary and the ADD-to-current re-grant
|
|
16
|
+
* (a bare `--scope admin` upsert would silently strip `spawn`).
|
|
17
|
+
*
|
|
18
|
+
* Fail closed everywhere: an unparseable caller, a target with no stored owner, or an unreadable
|
|
19
|
+
* ledger authorizes nothing.
|
|
20
|
+
*/
|
|
21
|
+
export async function authorizeNamedControl(opts) {
|
|
22
|
+
const { target, caller, admin, userMode } = opts;
|
|
23
|
+
if (admin)
|
|
24
|
+
return undefined;
|
|
25
|
+
if (target.spawner === caller)
|
|
26
|
+
return undefined;
|
|
27
|
+
if (userMode) {
|
|
28
|
+
const pr = parsePrincipalKey(caller);
|
|
29
|
+
if (pr && target.userOwner && pr.owner === target.userOwner)
|
|
30
|
+
return undefined;
|
|
31
|
+
if (pr) {
|
|
32
|
+
const scope = await opts.scopeOf(pr.owner, pr.actor).catch(() => undefined);
|
|
33
|
+
if (scope?.includes("admin"))
|
|
34
|
+
return undefined;
|
|
35
|
+
}
|
|
36
|
+
return (`not authorized: ${target.name} runs under another owner - your grant covers agents under your own owner; ` +
|
|
37
|
+
`cross-owner stop/attach needs scope "admin" on your actor. Re-grant with "admin" ADDED to your current ` +
|
|
38
|
+
`scope (the upsert replaces the list; see \`cotal actor list\`)`);
|
|
39
|
+
}
|
|
40
|
+
return `not authorized: ${target.name} was not spawned by ${caller} (admin tier required)`;
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* The manifest-launch authorization decision — pure, same contract style as
|
|
44
|
+
* {@link authorizeNamedControl}. The dispatch already rejects a static-mesh privileged-tier
|
|
45
|
+
* `launch` (operator-only there), so this decides the remaining cases:
|
|
46
|
+
*
|
|
47
|
+
* - **Admin tier**: allowed (operator behavior, both modes).
|
|
48
|
+
* - **Privileged tier, user mesh**: you deploy your own team — the launch spec's apply-time
|
|
49
|
+
* stamped owner must EQUAL the subject-pinned caller's owner. Fail-closed on an unparseable
|
|
50
|
+
* caller or a spec with no owner; the cross-owner refusal names the `admin` ADD-to-current
|
|
51
|
+
* re-grant.
|
|
52
|
+
*/
|
|
53
|
+
export function authorizeLaunch(opts) {
|
|
54
|
+
if (opts.admin)
|
|
55
|
+
return undefined;
|
|
56
|
+
const callerOwner = parsePrincipalKey(opts.caller)?.owner;
|
|
57
|
+
if (callerOwner === undefined)
|
|
58
|
+
return `launch denied: caller "${opts.caller}" is not a valid principal`;
|
|
59
|
+
if (opts.specOwner === undefined || opts.specOwner !== callerOwner)
|
|
60
|
+
return (`not authorized: run ${opts.runId} was applied under another owner - a spawn-scoped deploy launches only ` +
|
|
61
|
+
`your own manifest agents; cross-owner deploys need scope "admin" on your actor. Re-grant with "admin" ` +
|
|
62
|
+
`ADDED to your current scope (the upsert replaces the list; see \`cotal actor list\`)`);
|
|
63
|
+
return undefined;
|
|
64
|
+
}
|
|
65
|
+
//# sourceMappingURL=authorize.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../src/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAYnD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAW3C;IACC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACjD,IAAI,KAAK;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,EAAE,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,EAAE,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QAC9E,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5E,IAAI,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;QACjD,CAAC;QACD,OAAO,CACL,mBAAmB,MAAM,CAAC,IAAI,6EAA6E;YAC3G,yGAAyG;YACzG,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,MAAM,CAAC,IAAI,uBAAuB,MAAM,wBAAwB,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAS/B;IACC,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC;IAC1D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,0BAA0B,IAAI,CAAC,MAAM,4BAA4B,CAAC;IACxG,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,WAAW;QAChE,OAAO,CACL,uBAAuB,IAAI,CAAC,KAAK,yEAAyE;YAC1G,wGAAwG;YACxG,sFAAsF,CACvF,CAAC;IACJ,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
package/dist/commands.js
CHANGED
|
@@ -26,7 +26,7 @@ async function runManager(args, defaultRuntime) {
|
|
|
26
26
|
let runtime = defaultRuntime;
|
|
27
27
|
if (defaultRuntime === "auto" && v.runtime) {
|
|
28
28
|
if (!RUNTIME_OVERRIDES.includes(v.runtime)) {
|
|
29
|
-
console.error(c.red(`unknown runtime "${v.runtime}"
|
|
29
|
+
console.error(c.red(`unknown runtime "${v.runtime}" - expected ${RUNTIME_OVERRIDES.join(", ")}`));
|
|
30
30
|
process.exit(1);
|
|
31
31
|
}
|
|
32
32
|
runtime = v.runtime;
|
|
@@ -113,7 +113,7 @@ async function runManager(args, defaultRuntime) {
|
|
|
113
113
|
console.error(c.red(`✗ ${la.name}: ${e.message}`));
|
|
114
114
|
continue;
|
|
115
115
|
}
|
|
116
|
-
const reply = await mgr.startAgent(launchAgentToStartOpts(la, configPath));
|
|
116
|
+
const reply = await mgr.startAgent(launchAgentToStartOpts(la, configPath, launchSpec.owner));
|
|
117
117
|
if (!reply.ok) {
|
|
118
118
|
console.error(c.red(`✗ ${la.name}: ${reply.error}`));
|
|
119
119
|
continue;
|
|
@@ -135,7 +135,7 @@ const managerCommands = [
|
|
|
135
135
|
kind: "command",
|
|
136
136
|
name: "supervise",
|
|
137
137
|
group: "Manager",
|
|
138
|
-
summary: "run a manager
|
|
138
|
+
summary: "run a manager - [--runtime <pty|tmux|cmux>] (default pty; tmux/cmux are explicit-only, each teammate in its own window/tab) [--space <s>] [--server <url>] [--console-port <n>] [--roster <file>] [--launch <spec>]",
|
|
139
139
|
flags: [
|
|
140
140
|
{ name: "space", type: "string", value: "<s>", description: "space to supervise (default: this folder's auth space)" },
|
|
141
141
|
{ name: "server", type: "string", value: "<url>", description: "broker URL (default: the local mesh)" },
|
package/dist/commands.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,cAAc,EACd,aAAa,EACb,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,SAAS,CAAC;AAI5B;qGACqG;AACrG,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,KAAK,IAAI,aAAa,CAAC;AACpF,CAAC;AAED;;;;;;8FAM8F;AAC9F,wFAAwF;AACxF,0FAA0F;AAC1F,wBAAwB;AACxB,MAAM,iBAAiB,GAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1E,KAAK,UAAU,UAAU,CAAC,IAAgB,EAAE,cAA2B;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,IAAI,OAAO,GAAG,cAAc,CAAC;IAC7B,IAAI,cAAc,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAsB,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,OAAO,gBAAgB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,OAAsB,CAAC;IACrC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,kGAAkG;IAClG,uDAAuD;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,MAAM,iBAAiB,CAAC,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,oGAAoG;IACpG,iGAAiG;IACjG,0DAA0D;IAC1D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;QACrB,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,GAAG,CAAC,WAAW,GAAG,CAAC;QAC/C,gBAAgB,GAAG,CAAC,UAAU,EAAE;QAChC,CAAC,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAC/G,CAAC;IACF,yFAAyF;IACzF,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,kGAAkG;IAClG,uFAAuF;IACvF,uDAAuD;IACvD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,mGAAmG;QACnG,MAAM,OAAO,GAAI,KAAK,CAAC,IAAsC,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;QAClF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;;YAC3F,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,6FAA6F;IAC7F,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC;gBACnF,SAAS;YACX,CAAC;YACD,6FAA6F;YAC7F,8FAA8F;YAC9F,8DAA8D;YAC9D,MAAM,OAAO,GAAI,KAAK,CAAC,IAAsC,EAAE,IAAI,IAAI,GAAG,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,wBAAwB,CAAC,CAAC,CAAC,KAAK,OAAO,6BAA6B,CAAC,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;IACH,CAAC;IACD,4FAA4F;IAC5F,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,cAAc,EACd,aAAa,EACb,QAAQ,GAGT,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,SAAS,CAAC;AAI5B;qGACqG;AACrG,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,KAAK,IAAI,aAAa,CAAC;AACpF,CAAC;AAED;;;;;;8FAM8F;AAC9F,wFAAwF;AACxF,0FAA0F;AAC1F,wBAAwB;AACxB,MAAM,iBAAiB,GAA2B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1E,KAAK,UAAU,UAAU,CAAC,IAAgB,EAAE,cAA2B;IACrE,MAAM,CAAC,GAAG,IAAI,CAAC,MAAgB,CAAC;IAChC,IAAI,OAAO,GAAG,cAAc,CAAC;IAC7B,IAAI,cAAc,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAsB,CAAC,EAAE,CAAC;YAC1D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,OAAO,gBAAgB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAClG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC,CAAC,OAAsB,CAAC;IACrC,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,cAAc,CAAC;IAC1C,kGAAkG;IAClG,uDAAuD;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,uBAAuB,MAAM,iBAAiB,CAAC,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,oGAAoG;IACpG,iGAAiG;IACjG,0DAA0D;IAC1D,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;IAClB,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;QACrB,CAAC,CAAC,GAAG,CAAC,WAAW,KAAK,MAAM,GAAG,CAAC,WAAW,GAAG,CAAC;QAC/C,gBAAgB,GAAG,CAAC,UAAU,EAAE;QAChC,CAAC,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAC/G,CAAC;IACF,yFAAyF;IACzF,+FAA+F;IAC/F,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,kGAAkG;IAClG,uFAAuF;IACvF,uDAAuD;IACvD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC1C,mGAAmG;QACnG,MAAM,OAAO,GAAI,KAAK,CAAC,IAAsC,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC;QAClF,IAAI,KAAK,CAAC,EAAE;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;;YAC3F,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,6FAA6F;IAC7F,+FAA+F;IAC/F,6FAA6F;IAC7F,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,GAAG,KAAK,KAAK,CAAC,KAAK,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC;gBACnF,SAAS;YACX,CAAC;YACD,6FAA6F;YAC7F,8FAA8F;YAC9F,8DAA8D;YAC9D,MAAM,OAAO,GAAI,KAAK,CAAC,IAAsC,EAAE,IAAI,IAAI,GAAG,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,wBAAwB,CAAC,CAAC,CAAC,KAAK,OAAO,6BAA6B,CAAC,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;IACH,CAAC;IACD,4FAA4F;IAC5F,gGAAgG;IAChG,iGAAiG;IACjG,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC9D,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACrD,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAI,KAAK,CAAC,IAAsC,EAAE,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC;YAC/E,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACxE,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,wBAAwB,CAAC,CAAC,CAAC,KAAK,OAAO,6BAA6B,CAAC,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;oDACoD;AACpD,MAAM,eAAe,GAAc;IACjC;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,SAAS;QAChB,OAAO,EACL,qNAAqN;QACvN,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,wDAAwD,EAAE;YACtH,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,sCAAsC,EAAE;YACvG,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,0DAA0D,EAAE;YACtI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,uBAAuB,EAAE;YAC5F,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,uCAAuC,EAAE;YACzG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,6DAA6D,EAAE;YAC/H,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,kDAAkD,EAAE;SACrH;QACD,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;KACxC;CACF,CAAC;AAEF,QAAQ,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,CAAC"}
|
package/dist/launch.d.ts
CHANGED
|
@@ -15,7 +15,7 @@ export declare function launchSpecForRun(root: string, runId: string): MeshLaunc
|
|
|
15
15
|
export declare function materializePersona(root: string, runId: string, a: MeshLaunchAgent): string;
|
|
16
16
|
/** Build the manager spawn opts for a launch agent: identity/role/model/variant + the resolved object
|
|
17
17
|
* (which carries the ACL authority) + the materialized configPath. */
|
|
18
|
-
export declare function launchAgentToStartOpts(a: MeshLaunchAgent, configPath: string): {
|
|
18
|
+
export declare function launchAgentToStartOpts(a: MeshLaunchAgent, configPath: string, owner?: string): {
|
|
19
19
|
name: string;
|
|
20
20
|
agent: string;
|
|
21
21
|
role?: string;
|
|
@@ -23,5 +23,6 @@ export declare function launchAgentToStartOpts(a: MeshLaunchAgent, configPath: s
|
|
|
23
23
|
variant?: string;
|
|
24
24
|
config: string;
|
|
25
25
|
resolved: MeshLaunchAgent;
|
|
26
|
+
owner?: string;
|
|
26
27
|
};
|
|
27
28
|
//# sourceMappingURL=launch.d.ts.map
|
package/dist/launch.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../src/launch.ts"],"names":[],"mappings":"AAGA,OAAO,
|
|
1
|
+
{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../src/launch.ts"],"names":[],"mappings":"AAGA,OAAO,EAAyH,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAmDlM;qGACqG;AACrG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAe3D;AAED;;;;;kFAKkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc,CAe5E;AA+BD;;wGAEwG;AACxG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,GAAG,MAAM,CAkB1F;AAED;uEACuE;AACvE,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAEA"}
|
package/dist/launch.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { readFileSync, writeFileSync, lstatSync } from "node:fs";
|
|
2
2
|
import { dirname, join, resolve } from "node:path";
|
|
3
3
|
import { z } from "zod";
|
|
4
|
-
import { assertValidChannel, assertValidName, ensureDirNoSymlink, isConcreteChannel, realDirNoSymlink } from "@cotal-ai/core";
|
|
4
|
+
import { assertDerivedOwnerToken, assertValidChannel, assertValidName, ensureDirNoSymlink, isConcreteChannel, realDirNoSymlink } from "@cotal-ai/core";
|
|
5
5
|
/**
|
|
6
6
|
* Load + materialize a resolved launch spec for `supervise --launch`.
|
|
7
7
|
*
|
|
@@ -22,19 +22,31 @@ const LaunchAgentSchema = z.strictObject({
|
|
|
22
22
|
role: z.string().regex(TOKEN, "role must be a route-safe token ([A-Za-z0-9_-])").optional(),
|
|
23
23
|
model: z.string().optional(),
|
|
24
24
|
variant: z.string().min(1).optional(),
|
|
25
|
+
launchOptions: z.record(z.string(), z.unknown()).optional(),
|
|
25
26
|
description: z.string().optional(),
|
|
26
27
|
body: z.string().optional(),
|
|
27
|
-
capabilities: z.array(z.string().regex(
|
|
28
|
+
capabilities: z.array(z.string().regex(/^[A-Za-z0-9_-]+(?::[A-Za-z0-9_-]+)?$/, "capability must be a safe token, optionally role-namespaced (role:<r>)")).optional(),
|
|
28
29
|
subscribe: z.array(z.string()),
|
|
29
30
|
allowSubscribe: z.array(z.string()),
|
|
30
31
|
allowPublish: z.array(z.string()),
|
|
31
32
|
personaPath: z.string().optional(),
|
|
32
33
|
hash: z.string().regex(/^[A-Za-z0-9]+$/, "hash must be alphanumeric"),
|
|
33
34
|
});
|
|
35
|
+
// USER-AUTH meshes: the derived owner every launched agent runs under, stamped at apply time by
|
|
36
|
+
// the logged-in operator (core `MeshLaunchSpec.owner`). Validated as a real derived token so a
|
|
37
|
+
// hand-edited spec can't smuggle an arbitrary string into ownership attribution.
|
|
38
|
+
const DerivedOwner = z.string().refine((o) => { try {
|
|
39
|
+
assertDerivedOwnerToken(o);
|
|
40
|
+
return true;
|
|
41
|
+
}
|
|
42
|
+
catch {
|
|
43
|
+
return false;
|
|
44
|
+
} }, "owner must be a derived owner token (u_ + 26 lowercase base32)");
|
|
34
45
|
const LaunchSpecSchema = z.strictObject({
|
|
35
46
|
apiVersion: z.literal("cotal-launch/v1"),
|
|
36
47
|
space: z.string().min(1),
|
|
37
48
|
runId: RunId,
|
|
49
|
+
owner: DerivedOwner.optional(),
|
|
38
50
|
agents: z.array(LaunchAgentSchema),
|
|
39
51
|
});
|
|
40
52
|
/** Parse + strictly validate a launch spec file. Throws on any deviation (it's untrusted, local
|
|
@@ -83,9 +95,13 @@ export function launchSpecForRun(root, runId) {
|
|
|
83
95
|
throw new Error(`launch spec runId "${spec.runId}" does not match requested "${runId}"`);
|
|
84
96
|
return spec;
|
|
85
97
|
}
|
|
86
|
-
// Capabilities that actually grant anything in v1 (
|
|
87
|
-
//
|
|
88
|
-
|
|
98
|
+
// Capabilities that actually grant anything in v1: `spawn` (the privileged control tier), and — on
|
|
99
|
+
// user-auth meshes — `role:<r>` delegation tokens the provision filter passes into the agent's
|
|
100
|
+
// ledger scope (the envelope walk still attenuates them against the spawner chain). `admin` is
|
|
101
|
+
// deliberately NOT accepted from a manifest: a hand-editable file must not be what mints an
|
|
102
|
+
// authority-root agent. An unknown capability is inert downstream, so reject it at the boundary
|
|
103
|
+
// rather than carry a no-op grant.
|
|
104
|
+
const isKnownCapability = (c) => c === "spawn" || /^role:[A-Za-z0-9_-]+$/.test(c);
|
|
89
105
|
/** Re-enforce the v1 manifest's policy constraints at the manager boundary so a hand-edited/malicious
|
|
90
106
|
* launch spec can't smuggle in what the CLI schema would reject: concrete channels only (no wildcard
|
|
91
107
|
* scopes — the v1 wildcard deferral), `subscribe ⊆ allowSubscribe`, and known capabilities. Channel
|
|
@@ -101,14 +117,14 @@ function validateLaunchPolicy(a) {
|
|
|
101
117
|
throw new Error(`${where}: ${field}: ${e.message}`);
|
|
102
118
|
}
|
|
103
119
|
if (!isConcreteChannel(ch))
|
|
104
|
-
throw new Error(`${where}: ${field} "${ch}" is a wildcard
|
|
120
|
+
throw new Error(`${where}: ${field} "${ch}" is a wildcard - not allowed in a v1 launch spec`);
|
|
105
121
|
}
|
|
106
122
|
const missing = a.subscribe.filter((c) => !a.allowSubscribe.includes(c));
|
|
107
123
|
if (missing.length)
|
|
108
124
|
throw new Error(`${where}: subscribe [${missing.join(", ")}] not within allowSubscribe`);
|
|
109
125
|
for (const cap of a.capabilities ?? [])
|
|
110
|
-
if (!
|
|
111
|
-
throw new Error(`${where}: unknown capability "${cap}" (known:
|
|
126
|
+
if (!isKnownCapability(cap))
|
|
127
|
+
throw new Error(`${where}: unknown capability "${cap}" (known: spawn, role:<r>)`);
|
|
112
128
|
}
|
|
113
129
|
/** Materialize one resolved agent's persona to a transient file the connector reads, and return its
|
|
114
130
|
* path. Carries only what a connector needs (identity/role/model/variant/description + body) plus a loud
|
|
@@ -119,7 +135,7 @@ export function materializePersona(root, runId, a) {
|
|
|
119
135
|
const dir = ensureDirNoSymlink(root, ".cotal", "run", runId, "agents");
|
|
120
136
|
const path = resolve(dir, `${a.name}.md`);
|
|
121
137
|
if (dirname(path) !== dir)
|
|
122
|
-
throw new Error(`unsafe agent name "${a.name}"
|
|
138
|
+
throw new Error(`unsafe agent name "${a.name}" - persona path escapes ${dir}`);
|
|
123
139
|
const fm = ["---", `name: ${a.name}`];
|
|
124
140
|
if (a.role)
|
|
125
141
|
fm.push(`role: ${scalar(a.role)}`);
|
|
@@ -131,7 +147,7 @@ export function materializePersona(root, runId, a) {
|
|
|
131
147
|
fm.push(`description: ${scalar(a.description)}`);
|
|
132
148
|
fm.push("---", "");
|
|
133
149
|
const src = a.personaPath ?? "the manifest";
|
|
134
|
-
const header = `<!-- Generated runtime artifact from a cotal mesh manifest (run ${runId}). Do NOT edit
|
|
150
|
+
const header = `<!-- Generated runtime artifact from a cotal mesh manifest (run ${runId}). Do NOT edit - regenerated on each launch and deleted by \`cotal down\`. Edit ${src} instead. This file is not a reusable persona and carries no access authority. -->`;
|
|
135
151
|
const body = a.body ? `${a.body.trim()}\n` : "";
|
|
136
152
|
// `wx`: exclusive create — fails rather than following a symlink pre-planted at the path.
|
|
137
153
|
writeFileSync(path, `${fm.join("\n")}${header}\n\n${body}`, { mode: 0o600, flag: "wx" });
|
|
@@ -139,8 +155,8 @@ export function materializePersona(root, runId, a) {
|
|
|
139
155
|
}
|
|
140
156
|
/** Build the manager spawn opts for a launch agent: identity/role/model/variant + the resolved object
|
|
141
157
|
* (which carries the ACL authority) + the materialized configPath. */
|
|
142
|
-
export function launchAgentToStartOpts(a, configPath) {
|
|
143
|
-
return { name: a.name, agent: a.agent, role: a.role, model: a.model, variant: a.variant, config: configPath, resolved: a };
|
|
158
|
+
export function launchAgentToStartOpts(a, configPath, owner) {
|
|
159
|
+
return { name: a.name, agent: a.agent, role: a.role, model: a.model, variant: a.variant, config: configPath, resolved: a, owner };
|
|
144
160
|
}
|
|
145
161
|
/** Quote a frontmatter scalar so the agent-file parser reads it back unchanged (it strips a matching
|
|
146
162
|
* outer quote pair). Plain tokens pass through; anything with structural chars is double-quoted. */
|
package/dist/launch.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"launch.js","sourceRoot":"","sources":["../src/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAA6C,MAAM,gBAAgB,CAAC;
|
|
1
|
+
{"version":3,"file":"launch.js","sourceRoot":"","sources":["../src/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAA6C,MAAM,gBAAgB,CAAC;AAElM;;;;;;;;GAQG;AAEH,6FAA6F;AAC7F,qGAAqG;AACrG,qGAAqG;AACrG,MAAM,KAAK,GAAG,kBAAkB,CAAC;AACjC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,iDAAiD,CAAC,CAAC;AAEzF,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,iDAAiD,CAAC;IACjF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,iDAAiD,CAAC,CAAC,QAAQ,EAAE;IAC3F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sCAAsC,EAAE,wEAAwE,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpK,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,2BAA2B,CAAC;CACtE,CAAC,CAAC;AAEH,gGAAgG;AAChG,+FAA+F;AAC/F,iFAAiF;AACjF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC;IAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAAC,OAAO,IAAI,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,KAAK,CAAC;AAAC,CAAC,CAAC,CAAC,EACnF,gEAAgE,CACjE,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IACtC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,YAAY,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC;CACnC,CAAC,CAAC;AAEH;qGACqG;AACrG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,CAAC,OAAO;QACZ,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC9B,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,0CAA0C;QACnE,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,wDAAwD;IACnF,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,CAAC;AAChB,CAAC;AAED;;;;;kFAKkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACjH,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,yCAAyC;IACjG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,yBAAyB,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC3C,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,EAAE,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,oBAAoB,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,KAAK,+BAA+B,KAAK,GAAG,CAAC,CAAC;IACnH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AACnG,+FAA+F;AAC/F,+FAA+F;AAC/F,4FAA4F;AAC5F,gGAAgG;AAChG,mCAAmC;AACnC,MAAM,iBAAiB,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAEnG;;;2GAG2G;AAC3G,SAAS,oBAAoB,CAAC,CAAkB;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,IAAI,GAAG,CAAC;IACzC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,CAAU;QACvI,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,KAAK,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,KAAK,KAAK,EAAE,mDAAmD,CAAC,CAAC;QAC5H,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC7G,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,YAAY,IAAI,EAAE;QACpC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,GAAG,4BAA4B,CAAC,CAAC;AACnH,CAAC;AAED;;wGAEwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,KAAa,EAAE,CAAkB;IAChF,iGAAiG;IACjG,yFAAyF;IACzF,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,IAAI,4BAA4B,GAAG,EAAE,CAAC,CAAC;IAC1G,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,IAAI;QAAE,EAAE,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,KAAK;QAAE,EAAE,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,OAAO;QAAE,EAAE,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,WAAW;QAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACpE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,CAAC;IAC5C,MAAM,MAAM,GAAG,mEAAmE,KAAK,mFAAmF,GAAG,oFAAoF,CAAC;IAClQ,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,0FAA0F;IAC1F,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,sBAAsB,CAAC,CAAkB,EAAE,UAAkB,EAAE,KAAc;IAU3F,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;AACpI,CAAC;AAED;qGACqG;AACrG,SAAS,MAAM,CAAC,CAAS;IACvB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC;IAC3D,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC"}
|
package/dist/manager.d.ts
CHANGED
|
@@ -40,6 +40,13 @@ export interface StartAgentOpts {
|
|
|
40
40
|
model?: string;
|
|
41
41
|
/** Model variant override (the `--variant` flag). Takes precedence over the agent file's `variant:`. */
|
|
42
42
|
variant?: string;
|
|
43
|
+
/** Opaque connector launch options (the `--opt k=v` flags). Merged per key over the agent file's
|
|
44
|
+
* `launchOptions:` (imperative wins); forwarded verbatim to the connector, which validates them. */
|
|
45
|
+
launchOptions?: Record<string, unknown>;
|
|
46
|
+
/** USER-MESH manifest launches only: the derived owner (`u_…`) from the launch spec (the
|
|
47
|
+
* logged-in operator who applied it). Imperative spawns resolve the owner from the ctl
|
|
48
|
+
* CALLER's principal instead — never from a payload field. */
|
|
49
|
+
owner?: string;
|
|
43
50
|
/** Opaque host-local session id to FORK into the mesh (the `--resume` flag), forwarded verbatim to
|
|
44
51
|
* the connector. Only ever set from imperative control args (`opStart`), NEVER from `resolved` —
|
|
45
52
|
* the manifest path stays resume-free by construction. Unsupported connectors throw at buildLaunch. */
|
|
@@ -98,14 +105,26 @@ export declare class Manager {
|
|
|
98
105
|
* field so a test can shorten it (the join/exit signals are event-driven; only the backstop is timed).
|
|
99
106
|
* Production leaves it at the constant. */
|
|
100
107
|
private readinessTimeoutMs;
|
|
108
|
+
/** True on a USER-AUTH space (the on-disk marker; cross-checked against the registry at start).
|
|
109
|
+
* Gates the whole spawn path: user mode grants ledger actors + bearer plumbing, never static mints. */
|
|
110
|
+
private userMode;
|
|
101
111
|
private leaseInfo?;
|
|
102
112
|
private leaseRevision?;
|
|
103
113
|
private leaseTimer?;
|
|
114
|
+
/** The class-2 renewal owner's half-TTL schedule (D5 slice 5); armed only on auth meshes. */
|
|
115
|
+
private credRenewTimer?;
|
|
104
116
|
constructor(opts: ManagerOptions);
|
|
105
117
|
get runtimeKind(): string;
|
|
106
118
|
/** The console page URL (manager-hosted, loopback). */
|
|
107
119
|
get consoleUrl(): string;
|
|
108
120
|
start(): Promise<void>;
|
|
121
|
+
/** One class-2 renewal pass (D5 slice 5): re-sign `.cotal/delivery.creds` + `.cotal/membership-rw.creds`
|
|
122
|
+
* for their existing nkeys, then request the delivery daemon's EXPLICIT `reloadCreds` adoption on the
|
|
123
|
+
* delivery-admin rail and persist the audit record (`.cotal/renewal.json`) that `cotal doctor auth`
|
|
124
|
+
* renders — so "file re-signed" and "daemon adopted" are distinguishable states. A missing daemon
|
|
125
|
+
* (no responder) is recorded honestly: the daemon's 75% source re-read remains the adoption backstop.
|
|
126
|
+
* Never throws — renewal failure must be LOUD (log + record), not fatal to the supervisor. */
|
|
127
|
+
private renewDaemonCreds;
|
|
109
128
|
/** Tear down every managed agent's footprint — the shared teardown for EVERY manager-exit path (#159
|
|
110
129
|
* B2): graceful {@link stop} AND the fail-closed lease-loss exit ({@link renewLease}). A manager exit is
|
|
111
130
|
* a mass agent-exit, and without this its agents' footprints (creds files + `dm_`/`dlv_` durables + ACL
|
|
@@ -125,10 +144,18 @@ export declare class Manager {
|
|
|
125
144
|
private handle;
|
|
126
145
|
/** Collapsed despawn/attach authorization (P4b). The caller already reached the privileged or
|
|
127
146
|
* admin tier (cred-gated). On the admin tier any named target is allowed (operator). On the
|
|
128
|
-
* privileged tier a named target is allowed
|
|
129
|
-
*
|
|
130
|
-
*
|
|
147
|
+
* privileged tier a named target is allowed if it's the caller's OWN child (`spawner ==
|
|
148
|
+
* caller`) — and, on a user mesh, if it runs under the CALLER'S OWNER (owner-domain) or the
|
|
149
|
+
* caller's ledger row holds `admin`, read fresh. The policy is the pure
|
|
150
|
+
* {@link authorizeNamedControl}; this wrapper only binds the manager's state (the mode flag +
|
|
151
|
+
* the provider-backed ledger read — a build with no provider authorizes nothing extra,
|
|
152
|
+
* fail-closed via the policy's catch). Error string when denied, `undefined` when allowed. */
|
|
131
153
|
private authorizeNamed;
|
|
154
|
+
/** The wire PRINCIPAL dot-form a managed agent's presence/control identity carries: user-mode
|
|
155
|
+
* entries already store it in `id`; static mints store the raw nkey there (the durable/teardown
|
|
156
|
+
* key), so the wire form derives under DEV_OWNER. Every comparison against an AUTHENTICATED wire
|
|
157
|
+
* id (presence card.id, control from.id) must go through this, never raw `a.id`. */
|
|
158
|
+
private managedPrincipal;
|
|
132
159
|
/** Self-despawn (P2b): stop the managed agent whose id == the authenticated caller. The
|
|
133
160
|
* no-name self-op can only ever resolve to the caller's OWN managed entry (ids are unique
|
|
134
161
|
* per spawn + non-forgeable in auth mode), never a peer — so it's structurally incapable of
|
|
@@ -148,16 +175,25 @@ export declare class Manager {
|
|
|
148
175
|
* footprint, nor (in `reapChildrenOf`) abort the reap of later siblings. The failure is logged loudly,
|
|
149
176
|
* never swallowed silently. Being the single stop chokepoint, guarding here covers all callers at once. */
|
|
150
177
|
private stopHandle;
|
|
178
|
+
/** USER-MODE spawn provisioning (the gate-1 counterpart to the static mint block): resolve the
|
|
179
|
+
* OWNER (ctl caller's principal, or the manifest's stamped owner — never a payload field),
|
|
180
|
+
* pre-create the principal-keyed durables + ACL row on the ephemeral provisioner, author the
|
|
181
|
+
* ledger grant (the upsert ROTATES the per-agent secret on every start — a non-running agent
|
|
182
|
+
* never holds a standing mint secret), materialize the 0600 secret/sentinel files, and
|
|
183
|
+
* PREFLIGHT the bearer chain once — the spawned agent must never be the first to discover a
|
|
184
|
+
* dead auth plane. Every failure is returned as the refusal sentence, with the grant + files
|
|
185
|
+
* rolled back. */
|
|
186
|
+
private provisionUserAgent;
|
|
151
187
|
/** Drop a live agent's slot. When `floor` is set and the agent died young (lived less than
|
|
152
188
|
* MIN_LIFETIME), push a cooling stamp so the freed slot still counts toward the ceiling until it
|
|
153
189
|
* expires — flooring the RECYCLE, not the call, so both free paths (despawn + exit/reap) are
|
|
154
190
|
* covered (P4c). Floor self + own-child despawn and natural exit; NEVER admin despawn (operator
|
|
155
191
|
* emergency-kill stays unthrottled) and NEVER the reserved-rollback path (no cold-start paid). */
|
|
156
192
|
private freeSlot;
|
|
157
|
-
/** Tear down a departed agent's minted footprint (#159 B2, auth mode): its
|
|
158
|
-
* (`
|
|
193
|
+
/** Tear down a departed agent's minted footprint (#159 B2, auth mode): its local-principal durables
|
|
194
|
+
* (`dm_local-<id>`, `dlv_local-<id>`), its read-ACL row, and its creds file — everything the spawn's
|
|
159
195
|
* `provisionAgent` + creds-write left behind. Mints an EPHEMERAL, TARGET-PINNED `deprovisioner` cred
|
|
160
|
-
* (mirrors the ephemeral `provisioner`/`purger`): it can delete only THIS agent's
|
|
196
|
+
* (mirrors the ephemeral `provisioner`/`purger`): it can delete only THIS agent's local-principal footprint,
|
|
161
197
|
* never a peer's and never the role-shared `svc_<role>` (which its siblings still bind). Open mesh →
|
|
162
198
|
* no-op (nothing was minted). Idempotent at the broker (missing consumer / ACL row = no-op) and on
|
|
163
199
|
* disk (`force` tolerates an absent creds file, e.g. a ledgered deploy that wrote none).
|
|
@@ -197,6 +233,14 @@ export declare class Manager {
|
|
|
197
233
|
/** Return connector-provided model catalogs for selector UIs. Optional by connector: a host with no
|
|
198
234
|
* local model-list API reports `supported:false` rather than blocking the manager. */
|
|
199
235
|
private opModels;
|
|
236
|
+
/** The owner-domain bound on `ps`/`status` metadata: on a USER mesh, a privileged-tier caller
|
|
237
|
+
* sees only agents under its OWN subject-pinned owner. Two ways to see ALL owners: the admin
|
|
238
|
+
* TIER (operator), or a fresh ledger `admin` SCOPE on the caller's row — the SAME authority that
|
|
239
|
+
* lets `stop`/`attach` reach cross-owner agents ({@link authorizeNamedControl}). Without this the
|
|
240
|
+
* two surfaces disagree: an admin operator could cross-owner stop an agent it could not list.
|
|
241
|
+
* Read fresh so a revoked admin loses visibility on its next call; a read failure and an
|
|
242
|
+
* unparseable caller both fall closed (own-owner / matches-nothing). Static meshes are unbounded. */
|
|
243
|
+
private psOwnerFilter;
|
|
200
244
|
/** Boot one resolved agent from a mesh-manifest launch spec, for `cotal spawn -f` onto a RUNNING
|
|
201
245
|
* manager. The request carries a `{ runId, name }`, NEVER a path: the manager derives + validates
|
|
202
246
|
* `.cotal/run/<runId>.json` itself ({@link launchSpecForRun} — token-safe id, no-follow,
|
|
@@ -204,7 +248,8 @@ export declare class Manager {
|
|
|
204
248
|
* agent's transient persona, and spawns via the same `startAgent({ resolved })` path as
|
|
205
249
|
* `supervise --launch`. The reply is enriched for the ownership ledger: the SPAWNED
|
|
206
250
|
* (collision-numbered) name + nkey id creds are filed under, plus the manifest `requested` name,
|
|
207
|
-
* `runId`, and resolved `hash`.
|
|
251
|
+
* `runId`, and resolved `hash`. USER mesh: a privileged-tier launch is owner-equality-authorized
|
|
252
|
+
* (spec owner === caller owner) before any side effect; the admin tier keeps operator behavior. */
|
|
208
253
|
private opLaunch;
|
|
209
254
|
/** Spawn and supervise one agent. The single spawn path: both the control-plane
|
|
210
255
|
* `start` op and declarative roster boot call this. Mints scoped creds in auth mode,
|
|
@@ -265,6 +310,8 @@ export declare class Manager {
|
|
|
265
310
|
private opDefinePersona;
|
|
266
311
|
private opAttach;
|
|
267
312
|
/** Managed agents cross-referenced with live presence (the manager sees the roster). */
|
|
313
|
+
/** `ownerFilter`: restrict to agents whose spawn-time stored `userOwner` equals it (the ps/status
|
|
314
|
+
* owner-domain bound); undefined = unbounded. {@link NO_OWNER_MATCHES} matches nothing. */
|
|
268
315
|
private list;
|
|
269
316
|
}
|
|
270
317
|
//# sourceMappingURL=manager.d.ts.map
|
package/dist/manager.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAA6D,YAAY,EAAiD,eAAe,EAAa,MAAM,gBAAgB,CAAC;AACzL,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAa5B;;;;;;;sDAOsD;AACtD,eAAO,MAAM,oBAAoB,QAAS,CAAC;AAkC3C,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oGAAoG;IACpG,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;0GAC0G;AAC1G,MAAM,WAAW,cAAc;IAC7B;;0GAEsG;IACtG,IAAI,EAAE,MAAM,CAAC;IACb,8GAA8G;IAC9G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;gEAC4D;IAC5D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;mFAE+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;yGACqG;IACrG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC;;mEAE+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;4GAEwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;wCACoC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;oGACgG;IAChG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;kEAG8D;IAC9D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;iGAC6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;sDAGkD;IAClD,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B;;iGAE6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AA4BD;;;;;GAKG;AACH,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmC;IAC1D;gGAC4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C;gGAC4F;IAC5F,OAAO,CAAC,OAAO,CAAgB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiB;IACxC,OAAO,CAAC,EAAE,CAAiB;IAC3B;+FAC2F;IAC3F,OAAO,CAAC,IAAI,CAAC,CAAY;IACzB;;gDAE4C;IAC5C,OAAO,CAAC,kBAAkB,CAAwB;IAClD;4GACwG;IACxG,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,SAAS,CAAC,CAAkC;IACpD,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAC,CAAiC;IACpD,6FAA6F;IAC7F,OAAO,CAAC,cAAc,CAAC,CAAiC;gBAE5C,IAAI,EAAE,cAAc;IAehC,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,uDAAuD;IACvD,IAAI,UAAU,IAAI,MAAM,CAEvB;IAEK,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgH5B;;;;;mGAK+F;YACjF,gBAAgB;IAsB9B;;;;;;;;kEAQ8D;YAChD,qBAAqB;IAgB7B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B;;;wGAGoG;YACtF,UAAU;YAgBV,MAAM;IAoEpB;;;;;;;mGAO+F;IAC/F,OAAO,CAAC,cAAc;IAWtB;;;yFAGqF;IACrF,OAAO,CAAC,gBAAgB;IAIxB;;;;6DAIyD;IACzD,OAAO,CAAC,UAAU;IAclB;;;;;;;;;;;gHAW4G;IAC5G,OAAO,CAAC,UAAU;IASlB;;;;;;;uBAOmB;YACL,kBAAkB;IAiGhC;;;;uGAImG;IACnG,OAAO,CAAC,QAAQ;IAYhB;;;;;;;;;;;mDAW+C;YACjC,WAAW;IAmCzB;;uGAEmG;IACnG,OAAO,CAAC,cAAc;IAStB;;oGAEgG;IAChG,OAAO,CAAC,WAAW;IAKnB;iGAC6F;IAC7F,OAAO,CAAC,SAAS;IAMjB;;sDAEkD;IAClD,OAAO,CAAC,UAAU;IAIlB;;8DAE0D;IACpD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAItD;;;;0EAIsE;IAChE,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IASzE,kFAAkF;IAClF,OAAO,CAAC,OAAO;IAmDf;2FACuF;YACzE,QAAQ;IAmCtB;;;;;;0GAMsG;YACxF,aAAa;IAiB3B;;;;;;;;wGAQoG;YACtF,QAAQ;IAqCtB;;;;;+DAK2D;IACrD,UAAU,CAAC,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAuR/E;;;;;;;;;;;;qGAYiG;YACnF,cAAc;IA0D5B;;sBAEkB;IAClB,OAAO,CAAC,IAAI;IAaZ;;;;;kGAK8F;IAC9F,OAAO,CAAC,SAAS;IAcjB;0GACsG;IACtG,OAAO,CAAC,YAAY;YAMN,MAAM;IAYpB;;;;uGAImG;YACrF,eAAe;IAuB7B;;;gCAG4B;YACd,OAAO;IAgBrB;;;;;;;;4GAQwG;IACxG,OAAO,CAAC,eAAe;YAqCT,QAAQ;IAqBtB,wFAAwF;IACxF;gGAC4F;IAC5F,OAAO,CAAC,IAAI;CA2Bb"}
|