@dudousxd/nestjs-agent 0.5.0 → 0.7.0

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import { DynamicModule, OnModuleInit, Type, OnApplicationBootstrap } from '@nestjs/common';
-import { a as AgentModuleOptions, b as AgentModuleAsyncOptions, A as AgentDepsFactory } from './agent-deps.factory-DGM0IVtA.cjs';
-export { c as AGENT_TOOL_BRAND, d as AgentAttachmentsOptions, e as AgentDeps, F as FunctionalTool, f as delegateToolName, p as provideAgentTool, u as utcDay } from './agent-deps.factory-DGM0IVtA.cjs';
-import { AgentRunner, AgentStore, QuotaStore, Actor, MessageAttachment, PageContext, ThreadSummary, ThreadDetail, UpdateThreadInput, QuotaView, ActorResolver, AttachmentStagingStore, ToolRegistry, AgentRegistry, PromptContributor, AgentRunInput, Decision, TokenStreamSink, SinkWriter, QuotaState } from '@dudousxd/nestjs-agent-core';
+import { a as AgentModuleOptions, b as AgentModuleAsyncOptions, A as AgentDepsFactory } from './agent-deps.factory-BlC9tumI.cjs';
+export { c as AGENT_TOOL_BRAND, d as AgentAttachmentsOptions, e as AgentDeps, F as FunctionalTool, f as delegateToolName, p as provideAgentTool, u as utcDay } from './agent-deps.factory-BlC9tumI.cjs';
+import { AgentRunner, AgentStore, QuotaStore, Actor, MessageAttachment, PageContext, Decision, ThreadSummary, ThreadDetail, UpdateThreadInput, QuotaView, AgentApprovalPort, ActorResolver, AttachmentStagingStore, ToolRegistry, AgentRegistry, PromptContributor, AgentRunInput, TokenStreamSink, SinkWriter, QuotaState } from '@dudousxd/nestjs-agent-core';
 export * from '@dudousxd/nestjs-agent-core';
 import { Request } from 'express';
 import { StandardSchemaV1 } from '@standard-schema/spec';
@@ -42,6 +42,15 @@ declare class AgentService {
     subscribe(runId: string): AsyncIterable<Uint8Array>;
     approve(actor: Actor, toolCallId: string): Promise<void>;
     reject(actor: Actor, toolCallId: string, reason?: string): Promise<void>;
+    /**
+     * The decision core behind approve/reject, WITHOUT an ownership check: resolves the run
+     * currently awaiting `toolCallId` and signals it. `approve`/`reject` above call this after their
+     * own `assertOwnsToolCall` gate; the console `AgentApprovalPort` adapter (bound by `AgentModule`)
+     * calls it directly — a console caller is already authorized by the dashboard's own guards, and
+     * re-deriving thread ownership here would reject a legitimate operator decision (an operator is
+     * not the thread's own actor).
+     */
+    signalToolCall(toolCallId: string, decision: Decision): Promise<void>;
     cancel(actor: Actor, runId: string): Promise<void>;
     listThreads(actorRef: string): Promise<ThreadSummary[]>;
     getThread(actor: Actor, threadId: string): Promise<ThreadDetail | null>;
@@ -84,16 +93,46 @@ declare class AgentService {
      */
     private assertOwnsThread;
     /**
-     * Authorization + routing seam for HITL approve/reject: assert the caller owns the tool call's
-     * thread, then resolve the run currently awaiting that call (its thread's active stream). That run
-     * is the sub-agent's own child run when the pending call belongs to a delegated agent — the client
-     * never knows or supplies a runId; it is derived here from the tool call alone.
+     * Authorization seam for HITL approve/reject: the caller must own the tool call's thread. Split
+     * out from run resolution (see {@link resolveRunForToolCall}) so the console `AgentApprovalPort`
+     * adapter can resolve+signal a decision WITHOUT this check — it is authorized upstream instead.
      */
-    private runForOwnedToolCall;
+    private assertOwnsToolCall;
+    /**
+     * Resolve the run currently awaiting `toolCallId` (its thread's active stream). That run is the
+     * sub-agent's own child run when the pending call belongs to a delegated agent — the client never
+     * knows or supplies a runId; it is derived here from the tool call alone.
+     */
+    private resolveRunForToolCall;
     /** Authorization seam for `cancel`: the caller must own the thread currently streaming this run. */
     private assertOwnsActiveStream;
 }
 
+/**
+ * Binds `AGENT_APPROVAL_PORT` for the console's cross-thread approvals inbox to the SAME decision
+ * path chat approvals use — `AgentService.signalToolCall` (resolve the run awaiting `toolCallId`,
+ * then `AgentRunner.signal`, which is either the inline pending-promise map or the durable signal
+ * `tool:<runId>:<callId>`, depending on how the host configured `AgentModule`).
+ *
+ * Deliberately WITHOUT `AgentService.approve`/`reject`'s ownership check: a console caller reaches
+ * this port only through the dashboard's own guards (already authorized), not as the thread's own
+ * actor — re-deriving "does this actor own the thread" here would reject a legitimate operator
+ * decision. `opts.executedByRef` is an OPAQUE decider ref, not re-authorized against anything: it
+ * rides the `Decision` and the loop records it as the tool call's decider
+ * (`decision.executedByRef ?? input.actor.id`, on both the executed and rejected paths).
+ */
+declare class AgentApprovalPortAdapter implements AgentApprovalPort {
+    private readonly agent;
+    constructor(agent: AgentService);
+    approve(toolCallId: string, opts?: {
+        executedByRef?: string;
+    }): Promise<void>;
+    reject(toolCallId: string, opts?: {
+        executedByRef?: string;
+        reason?: string;
+    }): Promise<void>;
+}
+
 /** Default per-file size cap when `AgentModuleOptions.attachments.maxBytes` is omitted (20 MiB). */
 declare const DEFAULT_MAX_ATTACHMENT_BYTES: number;
 /**
@@ -332,4 +371,4 @@ declare class HeaderActorResolver implements ActorResolver {
     resolve(req: unknown): Actor;
 }
 
-export { AGENT_METADATA, AI_TOOL_METADATA, Agent, AgentDepsFactory, AgentDiscoveryService, AgentModule, AgentModuleAsyncOptions, AgentModuleOptions, type AgentOptions, AgentService, AiTool, AiToolDiscoveryService, type AiToolOptions, AttachmentsController, type ChatParams, DEFAULT_ALLOWED_ATTACHMENT_CONTENT_TYPES, DEFAULT_MAX_ATTACHMENT_BYTES, HeaderActorResolver, InProcessTokenStreamSink, InlineAgentRunner, LedgerQuotaStore, SYSTEM_PROMPT_CONTRIBUTOR_METADATA, SYSTEM_PROMPT_METADATA, SystemPrompt, SystemPromptContributor, readAgentMetadata, readAiToolMetadata };
+export { AGENT_METADATA, AI_TOOL_METADATA, Agent, AgentApprovalPortAdapter, AgentDepsFactory, AgentDiscoveryService, AgentModule, AgentModuleAsyncOptions, AgentModuleOptions, type AgentOptions, AgentService, AiTool, AiToolDiscoveryService, type AiToolOptions, AttachmentsController, type ChatParams, DEFAULT_ALLOWED_ATTACHMENT_CONTENT_TYPES, DEFAULT_MAX_ATTACHMENT_BYTES, HeaderActorResolver, InProcessTokenStreamSink, InlineAgentRunner, LedgerQuotaStore, SYSTEM_PROMPT_CONTRIBUTOR_METADATA, SYSTEM_PROMPT_METADATA, SystemPrompt, SystemPromptContributor, readAgentMetadata, readAiToolMetadata };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { DynamicModule, OnModuleInit, Type, OnApplicationBootstrap } from '@nestjs/common';
-import { a as AgentModuleOptions, b as AgentModuleAsyncOptions, A as AgentDepsFactory } from './agent-deps.factory-DGM0IVtA.js';
-export { c as AGENT_TOOL_BRAND, d as AgentAttachmentsOptions, e as AgentDeps, F as FunctionalTool, f as delegateToolName, p as provideAgentTool, u as utcDay } from './agent-deps.factory-DGM0IVtA.js';
-import { AgentRunner, AgentStore, QuotaStore, Actor, MessageAttachment, PageContext, ThreadSummary, ThreadDetail, UpdateThreadInput, QuotaView, ActorResolver, AttachmentStagingStore, ToolRegistry, AgentRegistry, PromptContributor, AgentRunInput, Decision, TokenStreamSink, SinkWriter, QuotaState } from '@dudousxd/nestjs-agent-core';
+import { a as AgentModuleOptions, b as AgentModuleAsyncOptions, A as AgentDepsFactory } from './agent-deps.factory-BlC9tumI.js';
+export { c as AGENT_TOOL_BRAND, d as AgentAttachmentsOptions, e as AgentDeps, F as FunctionalTool, f as delegateToolName, p as provideAgentTool, u as utcDay } from './agent-deps.factory-BlC9tumI.js';
+import { AgentRunner, AgentStore, QuotaStore, Actor, MessageAttachment, PageContext, Decision, ThreadSummary, ThreadDetail, UpdateThreadInput, QuotaView, AgentApprovalPort, ActorResolver, AttachmentStagingStore, ToolRegistry, AgentRegistry, PromptContributor, AgentRunInput, TokenStreamSink, SinkWriter, QuotaState } from '@dudousxd/nestjs-agent-core';
 export * from '@dudousxd/nestjs-agent-core';
 import { Request } from 'express';
 import { StandardSchemaV1 } from '@standard-schema/spec';
@@ -42,6 +42,15 @@ declare class AgentService {
     subscribe(runId: string): AsyncIterable<Uint8Array>;
     approve(actor: Actor, toolCallId: string): Promise<void>;
     reject(actor: Actor, toolCallId: string, reason?: string): Promise<void>;
+    /**
+     * The decision core behind approve/reject, WITHOUT an ownership check: resolves the run
+     * currently awaiting `toolCallId` and signals it. `approve`/`reject` above call this after their
+     * own `assertOwnsToolCall` gate; the console `AgentApprovalPort` adapter (bound by `AgentModule`)
+     * calls it directly — a console caller is already authorized by the dashboard's own guards, and
+     * re-deriving thread ownership here would reject a legitimate operator decision (an operator is
+     * not the thread's own actor).
+     */
+    signalToolCall(toolCallId: string, decision: Decision): Promise<void>;
     cancel(actor: Actor, runId: string): Promise<void>;
     listThreads(actorRef: string): Promise<ThreadSummary[]>;
     getThread(actor: Actor, threadId: string): Promise<ThreadDetail | null>;
@@ -84,16 +93,46 @@ declare class AgentService {
      */
     private assertOwnsThread;
     /**
-     * Authorization + routing seam for HITL approve/reject: assert the caller owns the tool call's
-     * thread, then resolve the run currently awaiting that call (its thread's active stream). That run
-     * is the sub-agent's own child run when the pending call belongs to a delegated agent — the client
-     * never knows or supplies a runId; it is derived here from the tool call alone.
+     * Authorization seam for HITL approve/reject: the caller must own the tool call's thread. Split
+     * out from run resolution (see {@link resolveRunForToolCall}) so the console `AgentApprovalPort`
+     * adapter can resolve+signal a decision WITHOUT this check — it is authorized upstream instead.
      */
-    private runForOwnedToolCall;
+    private assertOwnsToolCall;
+    /**
+     * Resolve the run currently awaiting `toolCallId` (its thread's active stream). That run is the
+     * sub-agent's own child run when the pending call belongs to a delegated agent — the client never
+     * knows or supplies a runId; it is derived here from the tool call alone.
+     */
+    private resolveRunForToolCall;
     /** Authorization seam for `cancel`: the caller must own the thread currently streaming this run. */
     private assertOwnsActiveStream;
 }
 
+/**
+ * Binds `AGENT_APPROVAL_PORT` for the console's cross-thread approvals inbox to the SAME decision
+ * path chat approvals use — `AgentService.signalToolCall` (resolve the run awaiting `toolCallId`,
+ * then `AgentRunner.signal`, which is either the inline pending-promise map or the durable signal
+ * `tool:<runId>:<callId>`, depending on how the host configured `AgentModule`).
+ *
+ * Deliberately WITHOUT `AgentService.approve`/`reject`'s ownership check: a console caller reaches
+ * this port only through the dashboard's own guards (already authorized), not as the thread's own
+ * actor — re-deriving "does this actor own the thread" here would reject a legitimate operator
+ * decision. `opts.executedByRef` is an OPAQUE decider ref, not re-authorized against anything: it
+ * rides the `Decision` and the loop records it as the tool call's decider
+ * (`decision.executedByRef ?? input.actor.id`, on both the executed and rejected paths).
+ */
+declare class AgentApprovalPortAdapter implements AgentApprovalPort {
+    private readonly agent;
+    constructor(agent: AgentService);
+    approve(toolCallId: string, opts?: {
+        executedByRef?: string;
+    }): Promise<void>;
+    reject(toolCallId: string, opts?: {
+        executedByRef?: string;
+        reason?: string;
+    }): Promise<void>;
+}
+
 /** Default per-file size cap when `AgentModuleOptions.attachments.maxBytes` is omitted (20 MiB). */
 declare const DEFAULT_MAX_ATTACHMENT_BYTES: number;
 /**
@@ -332,4 +371,4 @@ declare class HeaderActorResolver implements ActorResolver {
     resolve(req: unknown): Actor;
 }
 
-export { AGENT_METADATA, AI_TOOL_METADATA, Agent, AgentDepsFactory, AgentDiscoveryService, AgentModule, AgentModuleAsyncOptions, AgentModuleOptions, type AgentOptions, AgentService, AiTool, AiToolDiscoveryService, type AiToolOptions, AttachmentsController, type ChatParams, DEFAULT_ALLOWED_ATTACHMENT_CONTENT_TYPES, DEFAULT_MAX_ATTACHMENT_BYTES, HeaderActorResolver, InProcessTokenStreamSink, InlineAgentRunner, LedgerQuotaStore, SYSTEM_PROMPT_CONTRIBUTOR_METADATA, SYSTEM_PROMPT_METADATA, SystemPrompt, SystemPromptContributor, readAgentMetadata, readAiToolMetadata };
+export { AGENT_METADATA, AI_TOOL_METADATA, Agent, AgentApprovalPortAdapter, AgentDepsFactory, AgentDiscoveryService, AgentModule, AgentModuleAsyncOptions, AgentModuleOptions, type AgentOptions, AgentService, AiTool, AiToolDiscoveryService, type AiToolOptions, AttachmentsController, type ChatParams, DEFAULT_ALLOWED_ATTACHMENT_CONTENT_TYPES, DEFAULT_MAX_ATTACHMENT_BYTES, HeaderActorResolver, InProcessTokenStreamSink, InlineAgentRunner, LedgerQuotaStore, SYSTEM_PROMPT_CONTRIBUTOR_METADATA, SYSTEM_PROMPT_METADATA, SystemPrompt, SystemPromptContributor, readAgentMetadata, readAiToolMetadata };